Commit Graph

63 Commits (master)

Author SHA1 Message Date
Philippe Antoine 6dbc421825 rust: bindgen AppLayerParserConfParserEnabled
Ticket: 7667
1 month ago
Philippe Antoine 49b2a2be5d rust: bindgen SCAppLayerParserRegisterLogger
Ticket: 7667
1 month ago
Philippe Antoine b29d46d81f rust: bindgen SCAppLayerParserStateIssetFlag
Ticket: 7667
1 month ago
Philippe Antoine 7bb0c94ae9 rust: bindgen app-layer-detect-proto.h
Ticket: 7667
2 months ago
Richard McConnell 6c1238b7bd tls: Integrate ALPNs into HandshakeParams object
Ticket: 6695

With the introduction of the HandshakeParams object we're able to
utilise the theory further by using it as the object to track the ALPNs.

The HandshakeParams object is now responsible for holding all ALPNS. The
user of this HandshakeParams object i.e. JA4, can use whichever fields
are needed. So only when we generate a JA4 hash do we use the first ALPN
and require to format it. Other users of HandshakeParams may opt to use
all ALPN's i.e. during TlsAlpnGetData().
2 months ago
Richard McConnell 468a037daa tls: Introduce HandshakeParams object for tracking
Ticket: 6695

This introduction splits the use of the handshake parameters into their
own object, HandshakeParams, which is populated by the TLS decoder. The
JA4 object is now very simple. It's a simple String object (the JA4
Hash) which is generated during new().

This introduction is part of a larger idea, which is to enable
outputting these raw parameters without JA3/JA4. These handshake
parameters are the components used to generate the JA4 hash, thus it
makes sense for it to be a user of HandshakeParams.
2 months ago
Philippe Antoine 0d82e905bc rust: bindgen DetectHelperMultiBufferMpmRegister
Ticket: 7667
2 months ago
Philippe Antoine 06ad72e83e quic: ja3 getter function uses direction
so that future lua code can specify a direction
3 months ago
Jason Ish 4e2f1de308 rust/quic: replace rs_ naming with SC 3 months ago
Philippe Antoine 8ecc3efdc8 detect/multi-buf: harmonize wrapper
Introduce DetectGetMultiData which does the generic wrapping,
including the transforms.

And let each keyword do just the getter.
3 months ago
Victor Julien add7d3fcf5 app-layer: API for mapping progress name vs id 4 months ago
Philippe Antoine 726de5520f quic: discard late retry packets
Ticket: 7556

See RFC 9000 section 17.2.5.2 :
After the client has received and processed an Initial
or Retry packet from the server,
it MUST discard any subsequent Retry packets that it receives.
5 months ago
Philippe Antoine d61f36c66f quic: decrypt only initial packets
Ticket: 7556

Avoids failed_decrypt events when the first packet seen is not
a Quic Initial packet
5 months ago
Philippe Antoine 6d8910d245 quic: handle retry packets
Ticket: 7556
5 months ago
Philippe Antoine f295cc059d quic: handle fragmented hello over multiple packets
Ticket: 7556

To do so, we need to add 2 buffers (one for each direction)
to the QuicState structure, so that on parsing the second packet
with hello/crypto fragment, we still have the data of the first
hello/crypto fragment.

Use a hardcoded limit so that these buffers cannot grow indefinitely
and set an event when reaching the limit
5 months ago
Philippe Antoine 68adc87bd2 quic: parse ack frame number 3
cf rfc9000 section 19.3. ACK Frames

Ticket: 7556
5 months ago
Philippe Antoine ee04d667b5 quic: move all_consuming check to callee
Will alow to have decode_frames accept one additional parameter
with past fragment data
5 months ago
Philippe Antoine 294a33a890 quic: rustfmt 5 months ago
Jason Ish 4554c4778d rust: use AppProto from generated bindings instead of duplicating
Have bindgen generate bindings for app-layer-protos.h, then use the
generated definitions of AppProto/AppProtoEnum instead if defining
them ourselves.

This header was chosen as its used by Rust, and its a simple header
with no circular dependencies.

Ticket: #7341
5 months ago
Jason Ish c86b2608aa rust/applayer: clean visibility of export macros
Both the macros export_tx_data_get and export_state_data_get can
generate non-pub functions as the function they generate is only used
as a pointer during registration.

Remove "pub" and "no_mangle" from the generated functions and update
the names of the generated functions to follow Rust rules as they are
no longer exported into the global C namespace.

Ticket: 7498
6 months ago
Jason Ish f62be374ea rust/direction: move direction to own file (cleanup)
Move the implementation of Direction to its own file, direction.rs.
6 months ago
Jason Ish 7ef4caf90e rust/flow: move flow support to its own file (cleanup)
Move the Rust Flow support from core.rs to flow.rs.
6 months ago
Jason Ish 604e3c7422 rust/jsonbuilder: make set_uint generic over Into<u64>
Allow `set_uint` to accept any number value that can be converted to a
u64. Prevents callers from having to do `as u64`.

This required fixing up any callers that used `.into()` to just pass in
their value without the into conversion.

Most calls using `as u64` can have that cast removed, with the exception
of `usize` values which must still be cast is conversion can't be
guaranteed to be non-fallible.
7 months ago
Shivani Bhardwaj f2de3e01cb src: remove truncate fn and glue code
truncate fn is only active and used by dcerpc and smb parsers. In case
stream depth is reached for any side, truncate fn is supposed to set the
tx entity (request/response) in the same direction as complete so the
other side is not forever waiting for data.

However, whether the stream depth is reached is already checked by
AppLayerParserGetStateProgress fn which is called by:
- DetectTx
- DetectEngineInspectBufferGeneric
- AppLayerParserSetTransactionInspectId
- OutputTxLog
- AppLayerParserTransactionsCleanup

and, in such a case, StateGetProgressCompletionStatus is returned for
the respective direction. This fn following efc9a7a, always returns 1
as long as the direction is valid meaning that the progress for the
current direction is marked complete. So, there is no need for the additional
callback to mark the entities as done in case of depth or a gap.
Remove all such glue code and callbacks for truncate fns.

Bug 7044
1 year ago
Philippe Antoine 37a9003736 rust/probing: safety check for null input
Ticket: 7013

Done consistently for all protocols

This may change some protocols behaviors which failed early
if they found there was not enough data...
1 year ago
Sascha Steinbiss 120313f4da ja4: implement for TLS and QUIC
Ticket: OISF#6379
1 year ago
Sascha Steinbiss 9d0db71ebf ja3: make feature compile time configurable 1 year ago
Philippe Antoine 3643b6ed4b output: generic simple tx json logger
Ticket: 3827
1 year ago
Philippe Antoine 0b6b015e26 output/alert: rewrite code for app-layer properties
Especially fix setup-app-layer script to not forget this part

This allows, for simple loggers, to have a unique definition
of the actual logging function with the jsonbuilder.
This way, alerts, files, and app-layer event can share the code
to output the same data.

Ticket: #3827
2 years ago
Daniel Olatunji 5c0af0b203 rust/doc: add docstring to rust module files.
Issue: #4584
2 years ago
Philippe Antoine 9157070907 quic: v2 support per rfc 9369
Ticket: #4968
2 years ago
Philippe Antoine 668501c225 rust: remove unused 2 years ago
Jason Ish 0e55307c1d app-layer: remove APP_LAYER_PARSER_OPT_UNIDIR_TXS
This flag is no longer needed as a parser can now create a transaction
as unidirectional.

Setting this flag also doesn't make sense on parsers that may have
request/reply and some unidirectional messaging.
2 years ago
Jason Ish 8ef410e284 app-layer: add direction to transaction creation where needed
Build on Eric's but set the direction on transaction creation when
needed. I think this makes it a little more clear, and easier to
document when creating single direction transactions.

This also somewhat abstracts the inner-workings of a directional
transaction from the implementation.

Ticket: #4759
2 years ago
Eric Leblond 19174de4f3 quic: add TX orientation
Set no inspection in the opposite side of the transaction.

Ticket: #5799
2 years ago
Jason Ish d4418034d1 rust: update aes and aes-gcm crates
Addresses RUSTSEC-2021-0059, RUSTSEC-2021-0060.
2 years ago
Jason Ish f15ffbc869 rust/clippy: fix lint: single_match
Allow this lint in some cases where a match statement adds clarity.
3 years ago
Philippe Antoine e1ee401a12 quic: use VecDeque
Ticket: #5637
3 years ago
Jason Ish 7ba1d3e300 rust: fix clippy lints for clippy::nonminimal_bool 3 years ago
Jason Ish 572505870a rust: fix clippy lints for clippy::collapsible_else_if 3 years ago
Jason Ish 565da0d0af rust: fix clippy lints for clippy::redundant_field_names 3 years ago
Jason Ish f342d4aacd rust: fix clippy lints for clippy::len_zero 3 years ago
Jason Ish 29a4a7fddc rust: fix clippy lints for clippy::assign_op_pattern 3 years ago
Jason Ish c4034dafa1 rust: fix clippy lints for clippy::derive_partial_eq_without_eq 3 years ago
Jason Ish 85cfa7254b rust: fix clippy lint for single_char_add_str
Idiomatic cleanup and a fix automatically done by `cargo clippy --fix`.
3 years ago
Jason Ish c5b26e2043 rust: fix clippy ling for needless borrows
Cleanup needless borrows found by clippy. This fix done automatically by
`cargo clippy --fix`.
3 years ago
Victor Julien 79499e4769 app-layer: move files into transactions
Update APIs to store files in transactions instead of the per flow state.

Goal is to avoid the overhead of matching up files and transactions in
cases where there are many of both.

Update all protocol implementations to support this.

Update file logging logic to account for having files in transactions. Instead
of it acting separately on file containers, it is now tied into the
transaction logging.

Update the filestore keyword to consider a match if filestore output not
enabled.
3 years ago
Victor Julien c27df6304d app-layer: introduce common AppLayerStateData API
Add per state structure for storing flags and other variables.
3 years ago
Philippe Antoine f3b6fd3329 quic: update to nom7 3 years ago
Philippe Antoine 95125811b8 quic: reassemble crypto frames and parse it 3 years ago