253 Commits (27f87567ca161ee948550f1c6193194e9ea93feb)

Author	SHA1	Message	Date
Victor Julien	27f87567ca	rust/nfs: improve debug output	6 years ago
Victor Julien	c62273f4fd	rust/smb: silence noisy debug messages	6 years ago
Victor Julien	083908f3be	rust/ike2: free destate on tx free ... Bug #2604	6 years ago
Jason Ish	6f00ba0659	rust: fix (again) out of tree builds ... As the generated Cargo.toml is shipped as part of a release tarball, build from the source directory but set the cargo CARGO_TARGET_DIR to the build directory.	6 years ago
Victor Julien	4d5024255f	smb/dcerpc: remove now unused ssn2maxsize_map	6 years ago
Victor Julien	4d044483cf	smb/dcerpc: clean up and unify DCERPC probe logic	6 years ago
Victor Julien	ac4e888597	smb2/dcerpc: probe if response data is dcerpc ... If we missed the tree connect we can't know for sure if we're reading from a (DCERPC) PIPE or not. In this case probe the data to see if it looks like DCERPC. If the detection succeeds, use a special 'suricata::dcerpc' service in the TX. Simplify handling of DCERPC records that cross records Update logging for the response only TXs.	6 years ago
Victor Julien	9dd7c38113	smb2: skip rest of READ response if status is not success	6 years ago
Victor Julien	ae10a92bc6	rust/applayer: use correct return type for Parser ... The mismatch between the types would randomly lead to the return code of the Rust parser to be not correctly handled over the C/Rust boundary. This would lead to the API considering a parser to be in error state when it was not.	7 years ago
Jason Ish	58933bafc1	rust app layer template: functions to get buffers ... Example functions for getting the request and response buffers. Useful for running detection on the decoded buffers.	7 years ago
Jason Ish	01f7dcf5fd	rust template parser: sample pcap	7 years ago
Jason Ish	c3f1a35e28	rust: app-layer template parser and logger ... The protocol is a simple request/reply based protocol that can be hand driven with netcat. Request -> 12:Hello World! Response -> 3:Byte Its of the format <length>:<message> where length is the length of the message, not including the length or the delimiter.	7 years ago
Jason Ish	7682b1ba74	rustfmt.toml: set to 80 char line width ... The rustfmt default is 100, set to 80 to be more inline with the Suricata C code.	7 years ago
Jason Ish	9636b9de32	rust: expose AppLayerParserStateIssetFlag to Rust.	7 years ago
Jason Ish	90dfcf4907	rust/gen-c-headers: don't attempt to split empty lines	7 years ago
Jason Ish	1c6bc5754c	dhcp: check length of option before accessing ... Prevent Rust index out of bounds panic. Redmine issue: https://redmine.openinfosecfoundation.org/issues/2571	7 years ago
Jason Ish	7bc2469eb1	dhcp: remove println!() that got committed	7 years ago
Victor Julien	a337908c78	rust/dhcp: free events and destate at tx end	7 years ago
Victor Julien	edd0c2246c	smb1: add SMB1_COMMAND_QUERY_INFO_DISK command mapping	7 years ago
Maurizio Abba	bf4398b15d	output-json: ensure string is json-encodable ... Substitute json_string with SCJsonString custom function. SCJsonString will ensure string passed is json-encodable (utf-8). If it's not, the string will be converted in such a way that any non-printable character will be encoded in its hex form. The resulting json object will be returned. rust modification will encode any non-printable character during its conversion in to_cstring.	7 years ago
Victor Julien	177966970a	smb: probing parser improvement	7 years ago
Victor Julien	fd38989113	proto/detect: remove probing parser offset argument ... Remove offset argument as it was unused.	7 years ago
Victor Julien	c6e79f4410	nfs4: create tx for CREATE procedure	7 years ago
Victor Julien	90e0e3da27	nfs: fix applying nfs3 logging logic to nfs4	7 years ago
Victor Julien	cb3abba1e0	nfs4: log remove procedure + add multi-proc support ... Add TX creation for NFS4 transactions. Start with the 'REMOVE' procedure. Start on logging all procs. In NFS4 COMPOUND records there are multiple procedures. One of them can be considered the 'main' procedure, with others as supporting utility. This patch adds the first step in supporting to track those in the TX for logging and inspection.	7 years ago
Victor Julien	ff518e5c64	nfs4: for putrootfh set 'mount root' as name	7 years ago
Victor Julien	22e0fc97f8	nfs: rename generic functions from nfs3 to nfs	7 years ago
Victor Julien	d22c170c38	nfs: move v2 parsing into own file	7 years ago
Victor Julien	9b42073e54	nfs3: move nfs3 specific handling into own file	7 years ago
Victor Julien	4c09766b33	nfs: request parser cleanup	7 years ago
Victor Julien	f570905f8c	nfs: get rid of reachable panic statements	7 years ago
Victor Julien	8a1af5c367	nfs4: remove panic calls, set events instead	7 years ago
Victor Julien	f2382356b1	nfs4: support 4.1 SEQUENCE procedure	7 years ago
Victor Julien	2b581cd6db	smb: log trans2 that enable delete on close	7 years ago
Victor Julien	eefac0ef95	smb1: add support for trans2 set_path_info rename	7 years ago
Victor Julien	1b86d4e1a2	smb: improve dcerpc logic ... Detect whether a pipe is a dcerpc channel based on the name of the pipe.	7 years ago
Victor Julien	7c8a078a2c	smb1: improve NT Create response record parsing	7 years ago
Victor Julien	2e6014b15c	rust/smb: search for record on midstream start ... Calls with both START and MIDSTREAM mean the record might be cut and the start of it could be missing. For this case, enable the same logic as is used when catching up after a GAP. Search for the start of the record instead of assuming it sits exactly at the start of the input data.	7 years ago
Victor Julien	905d9a1dd8	rust: define all STREAM_* types	7 years ago
Victor Julien	7bc3c3ac6e	app-layer: pass STREAM_* flags to parser ... Pass the STREAM_* flags to the app-layer parser functions so that the parser can know more about how it is called.	7 years ago
Victor Julien	b5bc509857	dhcp: suppress notice message at startup	7 years ago
Jason Ish	d83707bef9	rust/dns - remove extra parantheses ... Removes rust compiler warning. Redmine issue: https://redmine.openinfosecfoundation.org/issues/2521	7 years ago
Jason Ish	9210d8743b	rust/dhcp: Rust based DHCP decoder and logger. ... This is a DHCP decoder and logger written in Rust. Unlike most parsers, this one is stateless so responses are not matched up to requests by Suricata. However, the output does contain enough fields to match them up in post-processing. Rules are included to alert of malformed or truncated options.	7 years ago
Jason Ish	1b0b74dc16	rust: a Rust ConfNode wrapper. ... A Rust wrapper around the C ConfNode object. Currenlty only exposes ConfGetChildValueBool and ConfGetChildValue.	7 years ago
Jason Ish	2ec3381600	rust/app-layer: macros to export de_state functions ... These macros generate the extern "C" functions for transactions structs that need provide functions for setting and getting the de_state. The idea is to provide macros do avoid code duplication and make it simpler to create an app-layer. A trait would be the correct solution, but it doesn't look like you can use traits to export extern "C" functions.	7 years ago
Jason Ish	da4912dfe7	rust: add get_tx_iterator to parser registration	7 years ago
Pierre Chifflier	e9ae62ed05	Kerberos 5: properly handle TCP buffering	7 years ago
Pierre Chifflier	1076c7cd47	Add krb5_err_code detection keyword	7 years ago
Pierre Chifflier	d6b9c0294a	Add krb5_cname and krb5_sname detection keywords	7 years ago
Pierre Chifflier	0bd81ff838	Add krb5_msg_type detection keyword	7 years ago