aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
14,609 Commits
8 Branches
174 Tags
256 MiB
main-8.0.x
main
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.7
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'd4c60924f1'
${ noResults }
Commit Graph

267 Commits (d4c60924f1c6f692192bef8584d0ea53d1f342d2)

Author SHA1 Message Date
Shivani Bhardwaj 2529eb35e1 smb: use uuid crate 6 years ago
Victor Julien 77a95eddd9 smb: support AppLayerTxData 6 years ago
Victor Julien 65e9a7c31c smb: fix 'dangling' files in lossy sessions 
In case of lossy connections the SMB state would properly clean up
transactions, including file transactions. However for files the
state was never set to 'truncated', leading to files to stay 'active'.

This would lead these files staying in the SMB's state. In long running
sessions with lots of files this would lead to performance and memory
use issues.

This patch cleans truncates the file that was being transmitted when
a file transaction is being closed.
 6 years ago
Victor Julien 25f2efe977 smb: check post-gap timeouts once a second at most 6 years ago
Victor Julien 8aa380600d smb: update ts only if it changed 6 years ago
Shivani Bhardwaj a7535099b4 smb/eve: convert to jsonbuilder 
Closes redmine ticket 3712.
 6 years ago
Shivani Bhardwaj 80adf7d1cf smb: Import constants from DCERPC 
Remove DCERPC constants to avoid duplicate name errors. Import the
required constants from DCERPC implementation.
 7 years ago
Shivani Bhardwaj 6457754fd6 dcerpc: Replace C function calls with Rust 
All the dead code in C after the Rust implementation is hereby removed.
Invalid/migrated tests have also been deleted.
All the function calls in C have been replaced with appropriate calls to
Rust functions. Same has been done for smb/detect.rs as a part of this
migration.
 7 years ago
Victor Julien 2f5834cdfa rust: merge parser.rs into applayer.rs 
Both were serving the same purpose.
 7 years ago
Victor Julien 5cd9cfb5a0 smb: update return type of GAP handling 7 years ago
Victor Julien 4bf87d30e4 smb: convert to return AppLayerResult 
Support returning 'incomplete' and remove the buffering
code from the parser.
 7 years ago
Victor Julien 3bcf948a75 app-layer: change return codes 
This patch simplifies the return codes app-layer parsers use,
in preparation of a patch set for overhauling the return type.

Introduce two macros:

APP_LAYER_OK (value 0)
APP_LAYER_ERROR (value -1)

Update all parsers to use this.
 7 years ago
Victor Julien a729d266c3 smb: fix rustc 1.42 warnings 7 years ago
Pierre Chifflier 442500678b rust: use the streaming version of combinators to fix incomplete reads 7 years ago
Pierre Chifflier f3ddd7127c rust: Add types annotation when required 
Unfortunately, the transition to nom 5 (and functions instead of macros)
has side-effects, one of them being requiring lots of types annotations
when using a parsing, for ex in a match instruction.
 7 years ago
Pierre Chifflier d1bf34a427 rust/smb: add custom error handling 7 years ago
Pierre Chifflier 1ab8c5763c rust: add SecBlobError custom error type for the Kerberos parser 7 years ago
Pierre Chifflier 5b809f77f1 rust: upgrade all parsers to nom 5 7 years ago
Victor Julien d41aeccea4 smb: handle file transactions post-GAP 
After a GAP all normal transactions are closed. File transactions
are left open as they can handle GAPs in principle. However, the
GAP might have contained the closing of a file and therefore it
may remain active until the end of the flow.

This patch introduces a time based heuristic for these transactions.
After the GAP all file transactions are stamped with the current
timestamp. If 60 seconds later a file has seen no update, its marked
as closed.

This is meant to fix resource starvation issues observed in long
running SMB sessions where packet loss was causing GAPs.
 7 years ago
Jason Ish e68dfa46a6 rust: cargo fix for Rust 2018 edition 7 years ago
Jason Ish 5ee8323028 rust: remove unnecessary parentheses (Rust 1.40 fixup) 
Rust 1.40 in strict mode will now fail the build on the
presence of unnecessary parentheses.

warning: unnecessary parentheses around type
  --> src/smb/smb2_ioctl.rs:41:12
   |
41 |         -> (&mut SMBTransaction)
   |            ^^^^^^^^^^^^^^^^^^^^^ help: remove these parentheses
   |
   = note: `#[warn(unused_parens)]` on by default
 7 years ago
Victor Julien f5b33a070a smb1: allow empty trans records 7 years ago
Victor Julien 40fe29de96 smb1: fix 'event' txs not getting closed 
If the only reason we created a request side TX was to set an event,
we would not close it.

This patch always looks up the TX from the response side.
 7 years ago
Victor Julien 129cd28058 smb/dcerpc: close request tx sooner 7 years ago
Victor Julien 44ac3e30dd smb: post-GAP handling update 
Close all prior transactions in the direction of the GAP, except the
file xfers. Those use their own logic.
 7 years ago
Victor Julien a7ee2ffbde smb: winreg is a DCERPC facility 7 years ago
Jason Ish 42e5065ab8 rust: update to Rust 2018 with cargo fix 
Migrate to Rust 2018 edition.

Credit to Danny Browning for first demontrating this:
https://github.com/OISF/suricata/pull/3604/commits
 7 years ago
Shivani Bhardwaj 8bebea5d4c rust: Get rid of unneeded macros, fix warnings 7 years ago
Victor Julien 579cc9f02b const: constify decoder, app-layer, detect funcs 7 years ago
Jeff Lucovsky 9ccc28baeb rust/smb: Implement get event by id 7 years ago
Victor Julien 3f6624bf16 rust: remove libc crate dependency 
Use std::os::raw instead.
 7 years ago
Jeff Lucovsky d568e7fadd eve/logging: 2991 Optimize logging by TX 
This changeset makes changes to the TX logging path. Since the txn
is passed to the TX logger, the TX can be used directly instead of
through the TX id.
 7 years ago
Victor Julien b1d4931842 rust: fix warnings about wrong type of comments 
"rustdoc does not generate documentation for macro expansions"
 8 years ago
Victor Julien bf1bd407dd rust: fix libc deprecation warnings for int types 8 years ago
Victor Julien 422e4892cc proto-detect: improve midstream support 
When Suricata picks up a flow it assumes the first packet is
toserver. In a perfect world without packet loss and where all
sessions neatly start after Suricata itself started, this would be
true. However, in reality we have to account for packet loss and
Suricata starting to get packets for flows already active be for
Suricata is (re)started.

The protocol records on the wire would often be able to tell us more
though. For example in SMB1 and SMB2 records there is a flag that
indicates whether the record is a request or a response. This patch
is enabling the procotol detection engine to utilize this information
to 'reverse' the flow.

There are three ways in which this is supported in this patch:

1. patterns for detection are registered per direction. If the proto
   was not recognized in the traffic direction, and midstream is
   enabled, the pattern set for the opposing direction is also
   evaluated. If that matches, the flow is considered to be in the
   wrong direction and is reversed.

2. probing parsers now have a way to feed back their understanding
   of the flow direction. They are now passed the direction as
   Suricata sees the traffic when calling the probing parsers. The
   parser can then see if its own observation matches that, and
   pass back it's own view to the caller.

3. a new pattern + probing parser set up: probing parsers can now
   be registered with a pattern, so that when the pattern matches
   the probing parser is called as well. The probing parser can
   then provide the protocol detection engine with the direction
   of the traffic.

The process of reversing takes a multi step approach as well:

a. reverse the current packets direction
b. reverse most of the flows direction sensitive flags
c. tag the flow as 'reversed'. This is because the 5 tuple is
   *not* reversed, since it is immutable after the flows creation.

Most of the currently registered parsers benefit already:

- HTTP/SMTP/FTP/TLS patterns are registered per direction already
  so they will benefit from the pattern midstream logic in (1)
  above.

- the Rust based SMB parser uses a mix of pattern + probing parser
  as described in (3) above.

- the NFS detection is purely done by probing parser and is updated
  to consider the direction in that parser.

Other protocols, such as DNS, are still to do.

Ticket: #2572
 8 years ago
Victor Julien f7a41412d6 smb1: fix NT create andx records filename parsing 
Use file name parsing routines that take unicode into account
and consider padding bytes as well.
 8 years ago
Wesley van der Ree cc50908f8d smb: fix NT create filename parsing 
parse_smb_create_andx_request_record skipped 1 byte too much before
the filename.

Fixes: #2894
 8 years ago
Victor Julien 25112ee7e3 rust/smb: fix and optimize record search 
Get rid of struct with just a slice reference as well.
 8 years ago
Pierre Chifflier f22695130b rust: nom4 requires to add complete!() when using many! combinators 8 years ago
Pierre Chifflier 8c0cde36c6 rust: fix warnings for unused variables (add _) 8 years ago
Pierre Chifflier 13b7399790 rust: upgrade all parsers to nom4 8 years ago
Pierre Chifflier 2f08b3eabd rust/nom4: error_code is superseded by error_position 8 years ago
Victor Julien 8b570c0293 smb: improve request/response mapping 
Only use ssn_id and msg_id for mapping a response to a request.

By not using the tree_id it can always be included in the tx.hdr which
means it can be logged properly in case of IOCTL and DCERPC.
 8 years ago
Victor Julien 0e40231189 app-layer: improve transaction cleanup handling 
The app layers with a custom iterator would skip a tx if during
the ..Cleanup() pass a transaction was removed.

Address this by storing the current index instead of the next
index. Also pass in the next "min_tx_id" to be incremented from
the last TX. Update loops to do this increment.

Also make sure that the min_id is properly updated if the last
TX is removed when out of order.

Finally add a SMB unittest to test this.

Reported by: Ilya Bakhtin
 8 years ago
Victor Julien c62273f4fd rust/smb: silence noisy debug messages 8 years ago
Victor Julien 4d5024255f smb/dcerpc: remove now unused ssn2maxsize_map 8 years ago
Victor Julien 4d044483cf smb/dcerpc: clean up and unify DCERPC probe logic 8 years ago
Victor Julien ac4e888597 smb2/dcerpc: probe if response data is dcerpc 
If we missed the tree connect we can't know for sure if we're
reading from a (DCERPC) PIPE or not. In this case probe the data
to see if it looks like DCERPC.

If the detection succeeds, use a special 'suricata::dcerpc' service
in the TX.

Simplify handling of DCERPC records that cross records

Update logging for the response only TXs.
 8 years ago
Victor Julien 9dd7c38113 smb2: skip rest of READ response if status is not success 8 years ago
Victor Julien edd0c2246c smb1: add SMB1_COMMAND_QUERY_INFO_DISK command mapping 8 years ago
Victor Julien 177966970a smb: probing parser improvement 8 years ago
Victor Julien 2b581cd6db smb: log trans2 that enable delete on close 8 years ago
Victor Julien eefac0ef95 smb1: add support for trans2 set_path_info rename 8 years ago
Victor Julien 1b86d4e1a2 smb: improve dcerpc logic 
Detect whether a pipe is a dcerpc channel based on the name of the
pipe.
 8 years ago
Victor Julien 7c8a078a2c smb1: improve NT Create response record parsing 8 years ago
Victor Julien 2e6014b15c rust/smb: search for record on midstream start 
Calls with both START and MIDSTREAM mean the record might be cut and the
start of it could be missing. For this case, enable the same logic as is
used when catching up after a GAP. Search for the start of the record
instead of assuming it sits exactly at the start of the input data.
 8 years ago
Victor Julien f40fc0293b smb: minor optimizations 9 years ago
Victor Julien b1e2783788 auth/krb5: move kerberos5 wrapper to rust root 
Make it available outside of just the SMB parser.
 9 years ago
Victor Julien 4d58aaae90 smb: clean up partial read/write record handling 9 years ago
Victor Julien aa8d64c2b8 smb: improve skip handling 
When skipping records the skip tracker could underflow if the record
parsing had more data than expected.

Enforce the calculation by moving it into a method and make the actual
fields private.
 9 years ago
Victor Julien eac7a92200 smb2: improve read/write record parsing 
parse_smb2_response_read()/parse_smb2_response_write() can be called on
incomplete data, so they didn't use the read/write length field to grab
the data field. Instead it just used rest(). However in some cases
SMB2 records have trailing data, which would be included in the
READ/WRITE data.

This patch addresses this by using the length field if enough data is
available.
 9 years ago
Victor Julien ea1e13cb00 smb: suppress notice messages 9 years ago
Pierre Chifflier 576b8ef722 SMB: simplify code 9 years ago
Pierre Chifflier cf5de0c58e SMB: use String::from_utf8_lossy in logging functions 9 years ago
Pierre Chifflier b5529e4ffb SMB: use kerberos-parser to extract Real and PrincipalName 9 years ago
Victor Julien 0dfb3f0e7f smb1: extract rename info from TRANS2 
Exclude TRANS2 from generic TX lookup bypass.
 9 years ago
Victor Julien 8eeda113c8 smb1: add parsing for RENAME command 9 years ago
Victor Julien 7b61f2c589 smb2: log renames 9 years ago
Victor Julien 15978d4e85 smb: if filename is missing, use '<unknown>' 9 years ago
Victor Julien 71742ed52b smb: share can't be <share_root> 9 years ago
Victor Julien bc193242ad smb1: add OPEN_ANDX command name for logging 9 years ago
Victor Julien 32b19fac99 smb2: don't log/track each READ/WRITE/etc 9 years ago
Victor Julien fb986abe81 smb: log file FID/GUID as fuid 9 years ago
Victor Julien 816bd022a6 smb1: improve non nt-status handling 
Support SRV error, with a couple of codes.
Rename statux field to status_code.
 9 years ago
Victor Julien 0519807639 smb1: ignore tree_id in session setup 9 years ago
Victor Julien 286c054472 smb: improve nbss/smb record detection 9 years ago
Victor Julien 7ab071a58d rust/smb: implement minimal record parsing in probing 9 years ago
Victor Julien 283be3cade smb2: break out ioctl handling 9 years ago
Victor Julien bf08285602 smb2: parse async records 9 years ago
Victor Julien 5c26020714 smb2: add ioctl transactions to log the funcs 9 years ago
Victor Julien 75265ec376 smb2: map ioctl funcs to names 
List is based on Wireshark's list.
 9 years ago
Victor Julien 7cd66516f0 smb: use formal MS names for disposition 9 years ago
Victor Julien f7ed749d4f smb: disable debug output 9 years ago
Victor Julien eed492547c smb1: extract server guid from negotiate 9 years ago
Victor Julien 6d56edc3de smb2: log client and server guid from negotiate 9 years ago
Victor Julien c56f5e11ca smb2: log share type 9 years ago
Victor Julien d75ebdb981 smb: log create empty filename as '<share_root>' like Bro does 9 years ago
Victor Julien fcbeab70a4 smb1: log create 'service' fields 9 years ago
Victor Julien 90e2abaac4 smb1: use generic string parsing for trans 9 years ago
Victor Julien 76917a8732 smb1: generic smb string parse func 9 years ago
Victor Julien 668c747aee smb1: more exact tree connect record parsing 9 years ago
Victor Julien 0ed00cf104 smb: move common parsing funcs into own file 9 years ago
Victor Julien 1c701dc50e smb: make string parsing functions public 9 years ago
Victor Julien 1d4aac1d4d smb1: set event on empty/malformed dialect 9 years ago
Victor Julien c91242e71c smb: rename file to filename in output 9 years ago
Victor Julien caf29e92b3 smb1: parse and log timestamps in CREATE 9 years ago
Victor Julien 0e05ef7369 smb2: parse and log timestamps in CREATE 9 years ago
Victor Julien 28f16e38ac smb1: disable 'generic tx's for common commands 
Don't create a generic TX for each READ, WRITE, TRANS, TRANS2,
except if they cause events to trigger.
 9 years ago
Victor Julien 78cd92a933 smb: generic event per trans/read/write for tx events 9 years ago
Victor Julien 05992f1772 smb: fix event handling when no tx is available 9 years ago
Victor Julien be615c9fbc smb: small cleanups, fixes and optimizations 9 years ago
Victor Julien dab055d8c8 smb: update to der-parser 0.5.1 9 years ago
Victor Julien 0d69e7b8c2 smb: remove unused dialects from state 9 years ago
Victor Julien ad1bc7f473 smb1: minor debug improvment 9 years ago
Victor Julien a44504a1bf smb: redo gap catch up handling 9 years ago
Victor Julien 7114d5d25b smb1: parser cleanups 9 years ago
Victor Julien d9e43d3e63 smb: cleaner server component parsing 9 years ago
Victor Julien ecbf10da70 smb2: improve write error handling 9 years ago
Victor Julien b34392051d smb3: parse transform records 9 years ago
Victor Julien 894a73ee06 smb2: add missing commands and improve ioctl err handling 9 years ago
Victor Julien 170edf7c44 smb1: improve error handling 9 years ago
Victor Julien 7ceb67138f smb: add status 9 years ago
Victor Julien 98b926bf72 smb1: implement WRITE_AND_CLOSE 9 years ago
Victor Julien 595557eb8d smb1: locking andx may have no response 9 years ago
Victor Julien 7dff9b9969 smb/nbss: work around bad traffic 9 years ago
Victor Julien 8bef120898 smb: session setup improvements 
Improve ntlmssp version extraction and logging, make its data structures
optional. Extract native os/lm from smb1 ssn setup.

Move session setup handling into their own files.

Only log auth data for the session setup tx.
 9 years ago
Victor Julien 75d7c9d64a rust/smb: initial support 
Implement SMB app-layer parser for SMB1/2/3. Features:
- file extraction
- eve logging
- existing dce keyword support
- smb_share/smb_named_pipe keyword support (stickybuffers)
- auth meta data extraction (ntlmssp, kerberos5)
 9 years ago