582 Commits (2f81f3fbe90ae164a39e4d2e737584957030d1b8)

Author	SHA1	Message	Date
Jason Ish	2f81f3fbe9	rust/log: clarify comment in non-debug mode SCLogDebug	4 years ago
Jason Ish	a453d28bc6	rust/log: order log macros in descending order ... Readability cleanup. - error, notice, ... debug	4 years ago
Jason Ish	411a5d41c1	rust/log: expand macros after checking log level ... Expand macros in the do_log macro after checking the log level instead of each log macro (ie: SCLogDebug) expanding the macros then passing off to do_log to have the log level check. Will eliminate any expense of expanding macros if this log level does not permit the given message to be logged. Redmine issue: https://redmine.openinfosecfoundation.org/issues/4114	4 years ago
Shivani Bhardwaj	269324e84d	dcerpc/log: Log fields particular to an RPC version ... Log fields that only are meant to be in a PDU for a particular RPC version. Since DCERPC/UDP works on RPC version 4 and DCERPC/TCP works on RPC version 5, there are certain fields that are particular to each version. Remove call_id from the logger for UDP. Add activityuuid and seqnum fields to the logger for UDP. call_id and (activityuuid + seqnum) fields are used to uniquely pair a request with response for RPC versions 5 and 4 respectively.	4 years ago
Ilya Bakhtin	2033f386f9	rust/dcerpc: Remove redundant fields	4 years ago
Ilya Bakhtin	2840a2e064	rust/dcerpc: Make tx_id u64	4 years ago
Ilya Bakhtin	6916b63f09	dcerpc/udp: Fix pairing of request response ... So far, request and response were paired with serial number fields in the header. This is incorrect. According to https://pubs.opengroup.org/onlinepubs/9629399/chap12.htm, "Together, the activity UUID and the sequence number uniquely identify a remote procedure call." Hence, add activity uuid and sequence number to the transaction and pair the request accordingly. Remove incorrect handling of this and fix tests.	4 years ago
Ilya Bakhtin	e9b21553cc	rust/dcerpc: Add UDP flag definitions	4 years ago
Victor Julien	51f4e4d0b7	dcerpc/udp: add missing tx free logic	4 years ago
Victor Julien	9f9c29a14a	dcerpc: fix stream flag handling ... Only hardcoded direction flags were passed to the parser, not the full range. Handle receiving an EOF flag w/o data. Bug: #3856	4 years ago
Victor Julien	f31372ad1d	dcerpc/tcp: fix compile warning ... warning: variable does not need to be mutable --> src/dcerpc/dcerpc.rs:1036:42 | 1036 | let tx = if let Some(mut tx) = self.get_tx_by_call_id(current_call_id, core::STREAM_TOCLIENT) { | ----^^ | | | help: remove this `mut` | = note: `#[warn(unused_mut)]` on by default warning: variable does not need to be mutable --> src/dcerpc/dcerpc.rs:1061:30 | 1061 | Some(mut tx) => { | ----^^ | | | help: remove this `mut`	4 years ago
Victor Julien	67b5295bbc	dcerpc/tcp: add missing detect state cleanup	4 years ago
Philippe Antoine	1fd6f5bc61	http2: asymetric sizes for headers tables ... The headers table from client to server and the one from server to client may have different maximum sizes (even if both endpoints have to keep both tables)	4 years ago
Philippe Antoine	aaa69fe3c5	smb: resistance against padding evasions ... Scenario is use of dummy padding in write AndX request or other similar commands using a data offset. Parsing skips now these dummy bytes, and generates one event	4 years ago
Philippe Antoine	caa7946888	smb: adds file overlap event against evasions ... Evasion scenario is - a first dummy write of one byte at offset 0 is done - the second full write of EICAR at offset 0 is then done and does not trigger detection The last write had the final value, and as we cannot "cancel" the previous write, we set an event which is then transformed into an app-layer decoder alert	4 years ago
Philippe Antoine	3e96f96153	rdp: fix incomplete result ... Aggregating the consumed bytes	4 years ago
Jason Ish	0529a00ffd	dhcp: set unidirection transaction flag	4 years ago
Jason Ish	3036ec4db0	ikev2: set unidirection transaction flag	4 years ago
Jason Ish	ff674d0cd0	mqtt: set unidirection transaction flag	4 years ago
Jason Ish	54d5f336d4	sip: set unidirection transaction flag	4 years ago
Jason Ish	1d40d0c5f9	rdp: set unidirection transaction flag	4 years ago
Jason Ish	f7dee602e9	krb5: set unidirection transaction flag	4 years ago
Jason Ish	984d3c7f20	ntp: set unidirection transaction flag	4 years ago
Jason Ish	fc7d59d92f	snmp: set unidirectional transaction flag	4 years ago
Philippe Antoine	64fcba228b	http2: complete parsing of priority frames	4 years ago
Philippe Antoine	c300a859a0	http2: keep track of dynamic headers table size ... And evict entries accordingly to maximum size	4 years ago
Philippe Antoine	1a21eea0e9	http2: variable size integers decoded everywhere	4 years ago
Philippe Antoine	b21acfbf21	http2: StreamIdReuse frame types exceptions ... Also handles better the state so as not to revert from HTTP2StateHalfClosedClient to HTTP2StateDataServer and not go to final HTTP2StateClosed	4 years ago
Philippe Antoine	89573060d9	http2: use variable integer for headers lengths	4 years ago
Shivani Bhardwaj	97c67cd5ce	dcerpc: fix gap handling ... This patch addresses issues discovered by redmine ticket 3896. With the approach of finding latest record, there was a chance that no record was found at all and consumed + needed became input length. e.g. input_len = 1000 input = 01 05 00 02 00 03 a5 56 00 00 ..... There exists no |05 00| identifier in the rest of the record. After having parsed |05 00|, there was a search for another record with the leftover data. Current data length at this point would be 997. Since the identifier was not found in the data, we calculate the consumed bytes at this point i.e. consumed = current_data.len() - 1 which would be 996. Needed bytes still stay at a constant of 2. So, consumed + needed = 996 + 2 = 998 which is lesser than initial input length of 1000 and hence the assertion fails. There could be two fixes to this problem. 1. Finding the latest record but making use of the last found record in case no new record was found. 2. Always use the earliest record. This patch takes the approach (2). It also makes sure that the gap and current direction are the same.	4 years ago
Philippe Antoine	4f963717f8	fuzz: better configure checks for MSAN building ... More compatible check for rust nightly Checks for CARGO_BUILD_TARGET Builds release or debug mode independently	4 years ago
Victor Julien	5d985c4271	dcerpc: implement tx free function	4 years ago
Victor Julien	8b2886635f	dcerpc/tcp: implement trunc logic ... When one side of the connection reaches the STREAM_DEPTH condition the parser should be aware of this. Otherwise transactions will forever be waiting for data in that direction.	4 years ago
Victor Julien	4da0d9bdea	applayer/rust: expose truncate callback	4 years ago
Shivani Bhardwaj	301454e9e4	dcerpc: fix datatypes while handling stub data	4 years ago
Shivani Bhardwaj	3fd9a3d420	dcerpc: fix datatype for stub data len	4 years ago
Philippe Antoine	222b386102	rust: rebuilds std when building fuzzers ... so as to have MSAN working	4 years ago
Philippe Antoine	15447cc672	dceprc: signature rust check with is_char_boundary ... before calling split_at which would panic	4 years ago
Philippe Antoine	6694737fcf	http2: settings from http1 upgrade	4 years ago
Philippe Antoine	7011bddf84	http2: mimic HTTP1 request from upgrade	4 years ago
Philippe Antoine	9d1b030ff0	http2: first connection upgrade from http1	4 years ago
Philippe Antoine	547d6c2d78	applayer: pass parameter to StateAlloc ... This parameter is NULL or the pointer to the previous state for the previous protocol in the case of a protocol change, for instance from HTTP1 to HTTP2 This way, the new protocol can use the old protocol context. For instance, HTTP2 mimicks the HTTP1 request, to have a HTTP2 transaction with both request and response	4 years ago
Sascha Steinbiss	ed9fed4958	mqtt: add some extra tests for varint parsing	4 years ago
Philippe Antoine	1a88df7e88	http2: handles incomplete frames after banner ... To signal incomplete data, we must return the number of consumed bytes. When we get a banner and some records, we have to take into account the number of bytes already consumed by the banner parsing before reaching an incomplete record.	4 years ago
Philippe Antoine	7ab9a01db2	mqtt: limit size of variable integer	4 years ago
Philippe Antoine	e3b28bcf2a	http2: returns error in case of index 0 ... As is documented in RFC 7541, section 6.1 The index value of 0 is not used. It MUST be treated as a decoding error if found in an indexed header field representation.	4 years ago
Jason Ish	e9fec043b5	rust/util: expose function to test strings for valid UTF-8 ... rs_check_utf8 will check that the provided string is valid UTF-8 by converting it to a Rust string and returning true or false.	4 years ago
Simon Dugas	7f26246ce1	dns: parse and log fields for SOA record type ... Added `dns_parse_rdata_soa` to parse SOA fields into an `DNSRDataSOA` struct. Added logging for answer and authority SOA records in both version 1 & 2, as well as grouped formats.	4 years ago
Simon Dugas	af498fd840	dns: use nom's rest to take all remaining rdata ... Using nom's `rest` combinator eliminates the need to call the do_parse macro for parsing a single element.	4 years ago
Simon Dugas	8005f50647	dns: refactor to handle more rdata formats ... Represent rdata as `DNSRData` enum variants instead of `Vec<u8>`. This will allow parsing/logging of more complex formats like SOA.	4 years ago