You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Victor Julien 350589d6e4 nfs: record the RPCSEC_GSS integrity unwrap reject ... A v4 COMPOUND carried with the GSS integrity service (creds procedure 0 = RPCSEC_GSS_DATA, service 2) is wrapped in an envelope: length of the wrapped body (sequence number and arguments), sequence number, arguments, checksum (RFC 2203 5.3.2.2). When that cannot be unwrapped the compound parser is never reached, and the arm ended with set_event(MalformedData). set_event stamps the newest transaction of the state, and returns without doing anything when the state has none. Two consequences: on a flow whose first RPC is such a call, the reject produced no transaction, no anomaly and nothing in EVE, so a record no server would ever send went by unremarked; and on a reply, the event landed on whichever transaction happened to be last, which on an async mount is a different call than the one being rejected, while the tx owning the xid stayed open forever. Give both arms a transaction to carry the event, like the partial-record rejects already do. The request side reuses the malformed-record helper (the xidmap is registered by the caller, so the gss creds survive and the reply of the xid is still known to be wrapped). The reply side marks the tx owning the xid, and falls back to a new one only when there is none - which is the common branch, as a compound with no main-opcode result (PUTFH+GETATTR, a SEQUENCE-led v4.1 one) opens no tx; that one therefore carries the procedure the xidmap recorded, not the 0 that EVE reads as NULL. Either way the record is skipped to its RPC boundary, never buffered toward the claimed length. Ticket: #9265.		18 hours ago
..
.cargo	rust: rename .cargo/config to .cargo/config.toml	2 years ago
derive	rust: inherit common package metadata from workspace	5 days ago
ffi	rust: keep the ffi logger out of the test binary	18 hours ago
htp	rust: hoist nom 8 dependency into workspace	5 days ago
src	nfs: record the RPCSEC_GSS integrity unwrap reject	18 hours ago
suricatactl	rust: hoist regex dependency into workspace	5 days ago
suricatasc	rust: hoist serde_json dependency into workspace	5 days ago
sys	rust: inherit common package metadata from workspace	5 days ago
.gitignore	rust: rename .cargo/config to .cargo/config.toml	2 years ago
Cargo.lock.in	rust: update clipboard-win	4 days ago
Cargo.toml.in	rust: hoist nom 8 dependency into workspace	5 days ago
Makefile.am	rust/derive: add Makefile for Cargo.toml regeneration	5 days ago
cbindgen.toml	http2: split transaction state machines	4 months ago
rustfmt.toml	rustfmt: replace deprecated fn_args_layout with fn_params_layout	3 years ago