Commit Graph

674 Commits (eacf933edfcec9cd352c26348e4256e9d3a012ab)

Author SHA1 Message Date
Jeff Lucovsky aa8871a5be rust/default: Enable Default usage 4 years ago
Jeff Lucovsky 6028ca7827 nfs: Rework constructs to use Self/Default 4 years ago
Jeff Lucovsky aafb0a60b7 dhcp: Rework constructs to use Self/Default 4 years ago
Jeff Lucovsky 1ef0bd580b dcerpc: Rework constructs to use Self/Default 4 years ago
Jeff Lucovsky 00167121dc dns: Rework constructs to use Self/Default 4 years ago
Jeff Lucovsky 02dccb1529 smb: Rework constructs to use Self/Default
This commit modifies the constructors to use Self and/or
Default::default() when feasible
4 years ago
Jeff Lucovsky f502f21f9e rust/default: Enable Default usage in SMB 4 years ago
Shivani Bhardwaj 581cb6223d dcerpc/udp: Add rust registration function
Get rid of the C glue code and move registration completely to Rust.
4 years ago
Shivani Bhardwaj d7007424bd dcerpc/udp: Change fn sign as per rust registration requirement
Registering parsers in Rust requires signatures to be a certain way and
compatible with C. Change signatures of all the functions.
4 years ago
Shivani Bhardwaj bac69af7e4 dcerpc: Add rust registration function
Get rid of the C glue code and move registration completely to Rust.
4 years ago
Shivani Bhardwaj a0a09a102b dcerpc: Change fn sign as per rust registration requirement
Registering parsers in Rust requires signatures to be a certain way and
compatible with C. Change signatures of all the functions.
4 years ago
Shivani Bhardwaj dee972b863 rust/core: Make AppProto type u16 4 years ago
Shivani Bhardwaj d66ad96f0d applayer/rust: add extern AppLayerProtoDetectPMRegisterPatternCSwPP 4 years ago
Victor Julien d7c3ecb6f9 http2: remove dead code 4 years ago
Philippe Antoine b3c502d572 http2: remove assertion which can be wrong
Brotli decoder stops consuming input it it reaches the
end of its input
4 years ago
Simon Dugas c2720fc2fb modbus: fix quantity and count calculation
The [Modbus Spec S6.11](https://modbus.org/docs/Modbus_Application_Protocol_V1_1b.pdf)
clearly states that the `count = quantity / 8` and not the other way
around. This is fixed in sawp-0.5.0.
4 years ago
Philippe Antoine 999327ba1f http2: http.cookie keyword now works for HTTP2 4 years ago
Philippe Antoine df039555bc http2: http.host.raw keyword now works for HTTP2 4 years ago
Philippe Antoine 1e82d0b3c8 http2: http.method keyword now works for HTTP2 4 years ago
Philippe Antoine 017e39d8fd http2: makes all HTTP1 header keywords work 4 years ago
Simon Dugas a8a51dc004 modbus: add eve logging 4 years ago
Simon Dugas 8342641477 modbus: move tests from c to rust
Move tests in a seperate commit so that we can use the previous one for
regression testing. This also gets rid of the temporary glue that made
the C tests work with the rust implementation.
4 years ago
Simon Dugas a458a94dca modbus: move from C to rust
Adds a new rust modbus app layer parser and detection module.

Moves the C module to rust but leaves the test cases in place to
regression test the new rust module.
4 years ago
frank honza f83d51d0cb ike: set event for multiple server proposals 4 years ago
Philippe Antoine ca6e434e0b ftp: completely parses pasv and epsv responses 4 years ago
Philippe Antoine 6fe8bce3b0 http2: have filecontainer for both directions 4 years ago
Jason Ish c7f44447c9 dns: remove flood protection purging
It doesn't look like flood protection is required with the
stateless parser anymore. It actually can get in the way of TCP
DNS when a large number of requests end-up in the same segment
where a TX can get purged before it has a chance to go through
the normal TX life-cycle.
4 years ago
Shivani Bhardwaj c663ac6ddd dcerpc/tcp: improve detection
Lately, some of the TLS data was misdetected as DCERPC/TCP because of
the pattern |05 00|. Add more checks in DCERPC probe function to ensure
that it is in fact DCERPC/TCP.
4 years ago
Philippe Antoine d2d0e0adc9 rust: remove exported unused functions 4 years ago
Philippe Antoine 6da9a37285 rdp: correctly returns incomplete in parse_tc
Adding the already consumed bytes
In case an incomplete tls handshake is handled with/after
a refular rdp t123_tpkt
4 years ago
Philippe Antoine 3de0123ffb http2: adds check about dynamic headers table size 4 years ago
Philippe Antoine 1ca4f041bb http2: pass data through when decompression fails
as is done for HTTP1
4 years ago
Juliana Fajardini c6a35d09b7 templates: fix typos
- *template*files[ch][rs]: fix typos
- scripts/setup-app-layer: fix typos
4 years ago
Jason Ish 6853bf98fb dns: only register a single logger
DNS no longer requires a logger to be registered for to-client and
to-server directions. This has not been required with the stateless
design of the Rust DNS parser.
4 years ago
Philippe Antoine 0105d4f017 rust: bump bitflags dependency version
So that lexical-core, needed by nom, and using bitflags
is used with version 0.7.5 instead of version 0.7.0
which fixed the fact that BITS is now a reserved keyword
in nightly version
4 years ago
Philippe Antoine cb150e97d0 kerberos: fix probing parser tag condition
according to the comment
4 years ago
Sascha Steinbiss e2dbdd7fd5 ikev1: add ikev1 parser 4 years ago
frank honza ecdf9f6b0b ikev1: rename ikev2 to common ike
Renaming was done with shell commands, git mv for moving the files and content like
find -iname '*.c' | xargs sed -i 's/ikev1/ike/g' respecting the different mixes of upper/lower case.
4 years ago
frank honza ab6171c429 detect: added support for protocol-aliases 4 years ago
frank honza e9494ddd8f util: add function converting u8-array into a hex-String 4 years ago
Philippe Antoine 8307010255 smb: relax probing parser to handle first NBSS message
cf dcerpc-udp S-V test :
First message is Message Type: Session request (0x81)
Second message is SMB
4 years ago
Philippe Antoine 1b6e81cd72 smb: probing parser for start and midstream
The probing parser is more strict at the start of the stream
4 years ago
Philippe Antoine 9dc5258a21 smb: split probing function for code style
Introduces rs_smb_probe_tcp_midstream
4 years ago
Shivani Bhardwaj 0ac5c5376a dcerpc: trigger raw assembly on record completion 4 years ago
Shivani Bhardwaj c77c8e7005 rust/context: add AppLayerParserTriggerRawStreamReassembly 4 years ago
Philippe Antoine 2d14606224 smb: andx support
Add AndX support for SMB1. Finishes #3475.

[Updated by Victor Julien to split functions]
4 years ago
Shivani Bhardwaj f967a49104 dcerpc/udp: improve detection
Lately, Wireguard proto starting w pattern |04 00| is misdetected as
DCERPC/UDP which also starts with the same pattern, add more checks
to make sure that it is the best guess for packet to be dcerpc/udp.
4 years ago
Shivani Bhardwaj 3641f1b522 dcerpc: add probe function 4 years ago
Shivani Bhardwaj d7a3523b12 rust/applayer: split EOF flag per direction 4 years ago
Shivani Bhardwaj 0ca8591994 dcerpc/udp: remove transmute
The book defines transmute as "This is really, truly, the most horribly unsafe
thing you can do in Rust. The guardrails here are dental floss."
Transmute can result into mind boggling undefined behaviors. Get rid of
it wherever possible.
4 years ago