Commit Graph

30 Commits (e160917bcfb67b23535b4ce082f506a9e66b7778)

Author SHA1 Message Date
Philippe Antoine e160917bcf mqtt: remove quadratic time complexity
When having many transactions in a single parsing call...

Fix has overhead of having one more field in the mqtt state.

Completes commit a8079dc978

Ticket: #5399
4 years ago
Jason Ish 8790968281 mqtt, rdp: fix copyright dates 4 years ago
Jason Ish 3b422e25f3 mqtt: convert transaction list to vecdeque
Allows for more efficient removal from front.

Ticket: #5294
4 years ago
Jason Ish 7b11b4d3a1 app-layer: more generic state trait
Instead of a method that is required to return a slice of transactions,
use 2 methods, one to return the number of transactions in the
collection, and another to get a transaction by its index in the
collection.

This allows for the transaction collection to not be a contiguous array
and instead can be a VecDeque, or possibly another collection type that
supports retrieval by index.

Ticket #5278
4 years ago
Philippe Antoine 3b13008c1b mqtt: fix consumed bytes computation for truncated msg
Ticket: 5268
4 years ago
Sascha Steinbiss 2a3ed9a6ae mqtt: rustfmt 4 years ago
Sascha Steinbiss 1ba62993d5 mqtt: raise event on parse error 4 years ago
Philippe Antoine e42094f238 mqtt: make max transactions configurable
Allows users to find balance between completeness of decoding
and increases resource consumption, which can DOS suricata.
5 years ago
Philippe Antoine a8079dc978 mqtt: limits the number of active transactions per flow
Ticket: 4530

So, that we do not get DOS by quadratic complexity, while
looking for a new pkt_id over the ever growing list
of active transactions
5 years ago
Victor Julien e6f49e5a05 app/frames: implement name to id API for frames 5 years ago
Victor Julien c073d5cfbf app-layer: use StreamSlice as input to parsers
Remove input, input_len and flags in favor of stream slice.
5 years ago
Victor Julien 6466296b32 app-layer: add StreamSlice to pass data to parsers
Since object to contain relevant pointer, length, offset, flags to make
it easy to pass these to the parsers.
5 years ago
Philippe Antoine 1b10848d84 mqtt: fix transaction completion
Ticket: 4862

A transaction to client is always considered
complete in the direction to server and vice versa.
Otherwise, transactions are never complete for
AppLayerParserTransactionsCleanup
5 years ago
Jason Ish 7732efbec2 app-layer: include decoder events in app-layer tx data
As most parsers use an events structure we can include it in the
tx_data structure to reduce some boilerplate/housekeeping code
in app-layer parsers.
5 years ago
Jason Ish 9c67c634c1 app-layer: include DetectEngineState in AppLayerTxData
Every transaction has an existing mandatory field, tx_data. As
DetectEngineState is also mandatory, include it in tx_data.

This allows us to remove the boilerplate every app-layer has
for managing detect engine state.
5 years ago
Jason Ish b335409690 mqtt: use generic tx iterator 5 years ago
Shivani Bhardwaj a7ac79bed7 mqtt: use Direction enum 5 years ago
Pierre Chifflier 8a584c211e rust/mqtt: convert parser to nom7 functions 5 years ago
Sam Muhammed 922a453da5 rust(lint): use is_null() instead of ptr::null_mut()
Bug: #4594
5 years ago
Jason Ish 8eac5fc221 mqtt: derive AppLayerEvent for MQTTEvent 5 years ago
Jason Ish ac3a20b6e0 rust(lint): remove useless conversions and clones
These add complexity and may not be optimized out by the compiler.
5 years ago
Jason Ish 363b5f99c3 rust: functions that reference raw pointers are unsafe
Based on the Rust clippy lint that recommends that any public
function that dereferences a raw pointer, mark all FFI functions
that reference raw pointers with build_slice and cast_pointer
as unsafe.

This commits starts by removing the unsafe wrapper inside
the build_slice and cast_pointer macros then marks all
functions that use these macros as unsafe.

Then fix all not_unsafe_ptr_arg_deref warnings from clippy.

Fixes clippy lint:
https://rust-lang.github.io/rust-clippy/master/index.html#not_unsafe_ptr_arg_deref
5 years ago
Jason Ish 53413f2d7a rust: remove all usage of transmute
All cases of our transmute can be replaced with more idiomatic
solutions and do no require the power of transmute.

When returning an object to C for life-time management, use
Box::into_raw to convert the boxed object to pointer and use
Box::from_raw to convert back.

For cases where we're just returning a pointer to Rust managed
data, use a cast.
5 years ago
Sascha Steinbiss d541b3d4a8 rust: fix warnings with nightly 5 years ago
Victor Julien efc9a7a398 app-layer: remove callback for completion status
Since the completion status was a constant for all parsers, remove the
callback logic and instead register the values themselves. This should
avoid a lot of unnecessary callback calls.

Update all parsers to take advantage of this.
6 years ago
Jason Ish ff674d0cd0 mqtt: set unidirection transaction flag 6 years ago
Victor Julien 4da0d9bdea applayer/rust: expose truncate callback 6 years ago
Philippe Antoine 547d6c2d78 applayer: pass parameter to StateAlloc
This parameter is NULL or the pointer to the previous state
for the previous protocol in the case of a protocol change,
for instance from HTTP1 to HTTP2

This way, the new protocol can use the old protocol context.
For instance, HTTP2 mimicks the HTTP1 request, to have a HTTP2
transaction with both request and response
6 years ago
Jason Ish ac93ab281d rust/logging: allow log macros to be used by plugins
Fix plugin macros so they can be used by external Rust crates
such as plugins.
6 years ago
Sascha Steinbiss c31360070b rust/mqtt: add MQTT parser 6 years ago