856 Commits (334b1382e0c647dfad71e9320350e87dbba90e1f)

Author	SHA1	Message	Date
Jason Ish	8bb6dab69d	rust(lint): remove useless format calls ... In these simple cases to_string() is recommended and likely performs better as the formatter is not called.	4 years ago
Jason Ish	5bf5de3350	rust(lint): don't use unwrap_or for function calls ... Calling a function in unwrap_or causes that function to always be called even when not needed. Instead use unwrap_or_else with a closure which will only be called when needed.	4 years ago
Jason Ish	602bb05e75	rust(lint): fix redundant closures ... This lint checks for a closure where a function can be directly supplied. Runtime performance is unchanged, but this makes less work for the compiler.	4 years ago
Jason Ish	69cf5c9eea	rust(lint): remove needless borrows ... These are needless borrows (references) as the item is already a reference.	4 years ago
Jason Ish	363b5f99c3	rust: functions that reference raw pointers are unsafe ... Based on the Rust clippy lint that recommends that any public function that dereferences a raw pointer, mark all FFI functions that reference raw pointers with build_slice and cast_pointer as unsafe. This commits starts by removing the unsafe wrapper inside the build_slice and cast_pointer macros then marks all functions that use these macros as unsafe. Then fix all not_unsafe_ptr_arg_deref warnings from clippy. Fixes clippy lint: https://rust-lang.github.io/rust-clippy/master/index.html#not_unsafe_ptr_arg_deref	4 years ago
Jason Ish	53413f2d7a	rust: remove all usage of transmute ... All cases of our transmute can be replaced with more idiomatic solutions and do no require the power of transmute. When returning an object to C for life-time management, use Box::into_raw to convert the boxed object to pointer and use Box::from_raw to convert back. For cases where we're just returning a pointer to Rust managed data, use a cast.	4 years ago
Victor Julien	9d24a53c53	nfs: minor code cleanup	4 years ago
Victor Julien	aa9d8658ef	smb: minor formatting fixup	4 years ago
Victor Julien	094208823b	smb: minor code cleanup	4 years ago
Shivani Bhardwaj	0a1747c1ba	nfs: fix comment	4 years ago
Shivani Bhardwaj	58ac9b0f38	nfs: Add rust registration function ... Get rid of the C glue code and move registration completely to Rust.	4 years ago
Shivani Bhardwaj	61fca4e9db	nfs: add missing code from rust impl of fns	4 years ago
Shivani Bhardwaj	de50ac631e	nfs: Change fn sign as per rust registration requirement ... Registering parsers in Rust requires signatures to be a certain way and compatible with C. Change signatures of all the functions. Probe fn has also been changed to return AppProto as required by the new fn signature.	4 years ago
Shivani Bhardwaj	e5c948df87	smb: Add rust registration function ... Get rid of the C glue code and move registration completely to Rust.	4 years ago
Shivani Bhardwaj	27af4bb002	smb: add missing code from rust impl of fns	4 years ago
Shivani Bhardwaj	6420df84b7	smb: Change fn sign as per rust registration requirement ... Registering parsers in Rust requires signatures to be a certain way and compatible with C. Change signatures of all the functions.	4 years ago
Shivani Bhardwaj	4d6b6b5dfe	smb: add constants	4 years ago
Shivani Bhardwaj	d1ea00521b	rust/core: Add flow flags	4 years ago
Jason Ish	222e55847c	flow: provide flags accessor function ... Add an accessor function for flow flags. To be used by Rust where the flow struct is an opaque data type.	4 years ago
Shivani Bhardwaj	cb8bd8c669	rust/applayer: add more externs	4 years ago
Philippe Antoine	31dccd1171	modbus: do not claim to handle gaps	4 years ago
Sascha Steinbiss	d541b3d4a8	rust: fix warnings with nightly	4 years ago
Philippe Antoine	9e7ea631b2	dns: improve probing parser ... Checks opcode is valid Checks additional_rr do not exceed message length Better logic for incomplete cases	4 years ago
Philippe Antoine	6f03ee2e47	dcerpc: handles bigger inputs than 2^16 ... By comparing integers with the largest size	4 years ago
Philippe Antoine	7d0a39412b	detect: use u32 for InspectionBufferMultipleForList ... So that we do not have an endless loop casting index to u16 and having more than 65536 buffers in one transaction Changes for all protocols, even ones where it is impossible to have such a pattern, so as to avoid bad pattern copy/paste in the future	4 years ago
Philippe Antoine	b3c1f2ab48	nfs: improve probing parser ... Checks credentials flavor is known	4 years ago
Philippe Antoine	39575e2cc9	modbus: use ascii character classes while parsin rule ... As the rust regex crate is unicode aware, which was not the case of the C version	4 years ago
Philippe Antoine	ef5755338f	rust: SCLogDebug is real nop when built as release ... Before, even if there were no outputs, all the arguments were evaluated, which could turn expensive All variables which are used only in certain build configurations are now prefixed by underscore to avoid warnings	4 years ago
Victor Julien	20e8f90981	http2: set Debug on structs	4 years ago
Victor Julien	3587033d9e	files: construct with default, free on drop ... Update protocols.	4 years ago
Victor Julien	d757545f03	files: implement default support	4 years ago
Philippe Antoine	fdab22d924	rust: fix app-layer parser flags ... This especially allows for SSH bypass to work	4 years ago
Jeff Lucovsky	aa8871a5be	rust/default: Enable Default usage	4 years ago
Jeff Lucovsky	6028ca7827	nfs: Rework constructs to use Self/Default	4 years ago
Jeff Lucovsky	aafb0a60b7	dhcp: Rework constructs to use Self/Default	4 years ago
Jeff Lucovsky	1ef0bd580b	dcerpc: Rework constructs to use Self/Default	4 years ago
Jeff Lucovsky	00167121dc	dns: Rework constructs to use Self/Default	4 years ago
Jeff Lucovsky	02dccb1529	smb: Rework constructs to use Self/Default ... This commit modifies the constructors to use Self and/or Default::default() when feasible	4 years ago
Jeff Lucovsky	f502f21f9e	rust/default: Enable Default usage in SMB	4 years ago
Shivani Bhardwaj	581cb6223d	dcerpc/udp: Add rust registration function ... Get rid of the C glue code and move registration completely to Rust.	4 years ago
Shivani Bhardwaj	d7007424bd	dcerpc/udp: Change fn sign as per rust registration requirement ... Registering parsers in Rust requires signatures to be a certain way and compatible with C. Change signatures of all the functions.	4 years ago
Shivani Bhardwaj	bac69af7e4	dcerpc: Add rust registration function ... Get rid of the C glue code and move registration completely to Rust.	4 years ago
Shivani Bhardwaj	a0a09a102b	dcerpc: Change fn sign as per rust registration requirement ... Registering parsers in Rust requires signatures to be a certain way and compatible with C. Change signatures of all the functions.	4 years ago
Shivani Bhardwaj	dee972b863	rust/core: Make AppProto type u16	4 years ago
Shivani Bhardwaj	d66ad96f0d	applayer/rust: add extern AppLayerProtoDetectPMRegisterPatternCSwPP	4 years ago
Victor Julien	d7c3ecb6f9	http2: remove dead code	4 years ago
Philippe Antoine	b3c502d572	http2: remove assertion which can be wrong ... Brotli decoder stops consuming input it it reaches the end of its input	4 years ago
Simon Dugas	c2720fc2fb	modbus: fix quantity and count calculation ... The [Modbus Spec S6.11](https://modbus.org/docs/Modbus_Application_Protocol_V1_1b.pdf) clearly states that the `count = quantity / 8` and not the other way around. This is fixed in sawp-0.5.0.	4 years ago
Philippe Antoine	999327ba1f	http2: http.cookie keyword now works for HTTP2	4 years ago
Philippe Antoine	df039555bc	http2: http.host.raw keyword now works for HTTP2	4 years ago
Philippe Antoine	1e82d0b3c8	http2: http.method keyword now works for HTTP2	4 years ago
Philippe Antoine	017e39d8fd	http2: makes all HTTP1 header keywords work	4 years ago
Simon Dugas	a8a51dc004	modbus: add eve logging	4 years ago
Simon Dugas	8342641477	modbus: move tests from c to rust ... Move tests in a seperate commit so that we can use the previous one for regression testing. This also gets rid of the temporary glue that made the C tests work with the rust implementation.	4 years ago
Simon Dugas	a458a94dca	modbus: move from C to rust ... Adds a new rust modbus app layer parser and detection module. Moves the C module to rust but leaves the test cases in place to regression test the new rust module.	4 years ago
frank honza	f83d51d0cb	ike: set event for multiple server proposals	4 years ago
Philippe Antoine	ca6e434e0b	ftp: completely parses pasv and epsv responses	4 years ago
Philippe Antoine	6fe8bce3b0	http2: have filecontainer for both directions	4 years ago
Jason Ish	c7f44447c9	dns: remove flood protection purging ... It doesn't look like flood protection is required with the stateless parser anymore. It actually can get in the way of TCP DNS when a large number of requests end-up in the same segment where a TX can get purged before it has a chance to go through the normal TX life-cycle.	4 years ago
Shivani Bhardwaj	c663ac6ddd	dcerpc/tcp: improve detection ... Lately, some of the TLS data was misdetected as DCERPC/TCP because of the pattern |05 00|. Add more checks in DCERPC probe function to ensure that it is in fact DCERPC/TCP.	4 years ago
Philippe Antoine	d2d0e0adc9	rust: remove exported unused functions	4 years ago
Philippe Antoine	6da9a37285	rdp: correctly returns incomplete in parse_tc ... Adding the already consumed bytes In case an incomplete tls handshake is handled with/after a refular rdp t123_tpkt	4 years ago
Philippe Antoine	3de0123ffb	http2: adds check about dynamic headers table size	4 years ago
Philippe Antoine	1ca4f041bb	http2: pass data through when decompression fails ... as is done for HTTP1	4 years ago
Juliana Fajardini	c6a35d09b7	templates: fix typos ... - *template*files[ch][rs]: fix typos - scripts/setup-app-layer: fix typos	4 years ago
Jason Ish	6853bf98fb	dns: only register a single logger ... DNS no longer requires a logger to be registered for to-client and to-server directions. This has not been required with the stateless design of the Rust DNS parser.	4 years ago
Philippe Antoine	0105d4f017	rust: bump bitflags dependency version ... So that lexical-core, needed by nom, and using bitflags is used with version 0.7.5 instead of version 0.7.0 which fixed the fact that BITS is now a reserved keyword in nightly version	4 years ago
Philippe Antoine	cb150e97d0	kerberos: fix probing parser tag condition ... according to the comment	4 years ago
Sascha Steinbiss	e2dbdd7fd5	ikev1: add ikev1 parser	4 years ago
frank honza	ecdf9f6b0b	ikev1: rename ikev2 to common ike ... Renaming was done with shell commands, git mv for moving the files and content like find -iname '*.c' | xargs sed -i 's/ikev1/ike/g' respecting the different mixes of upper/lower case.	4 years ago
frank honza	ab6171c429	detect: added support for protocol-aliases	4 years ago
frank honza	e9494ddd8f	util: add function converting u8-array into a hex-String	4 years ago
Philippe Antoine	8307010255	smb: relax probing parser to handle first NBSS message ... cf dcerpc-udp S-V test : First message is Message Type: Session request (0x81) Second message is SMB	4 years ago
Philippe Antoine	1b6e81cd72	smb: probing parser for start and midstream ... The probing parser is more strict at the start of the stream	4 years ago
Philippe Antoine	9dc5258a21	smb: split probing function for code style ... Introduces rs_smb_probe_tcp_midstream	4 years ago
Shivani Bhardwaj	0ac5c5376a	dcerpc: trigger raw assembly on record completion	4 years ago
Shivani Bhardwaj	c77c8e7005	rust/context: add AppLayerParserTriggerRawStreamReassembly	4 years ago
Philippe Antoine	2d14606224	smb: andx support ... Add AndX support for SMB1. Finishes #3475. [Updated by Victor Julien to split functions]	4 years ago
Shivani Bhardwaj	f967a49104	dcerpc/udp: improve detection ... Lately, Wireguard proto starting w pattern |04 00| is misdetected as DCERPC/UDP which also starts with the same pattern, add more checks to make sure that it is the best guess for packet to be dcerpc/udp.	4 years ago
Shivani Bhardwaj	3641f1b522	dcerpc: add probe function	4 years ago
Shivani Bhardwaj	d7a3523b12	rust/applayer: split EOF flag per direction	4 years ago
Shivani Bhardwaj	0ca8591994	dcerpc/udp: remove transmute ... The book defines transmute as "This is really, truly, the most horribly unsafe thing you can do in Rust. The guardrails here are dental floss." Transmute can result into mind boggling undefined behaviors. Get rid of it wherever possible.	4 years ago
Philippe Antoine	c6aadf0dfa	protodetect: rename direction to flags ... And use whole flags in AppLayerProtoDetectPPGetProto	4 years ago
Philippe Antoine	5465e0b154	http2: http.stat_msg keyword now works for HTTP2	4 years ago
Philippe Antoine	47928babfc	http2: http.user_agent keyword now works for HTTP2	4 years ago
Philippe Antoine	a98d0fe6ed	http2: http.uri keyword now works for HTTP2 ... cf #4067	4 years ago
Philippe Antoine	707f027231	protos: renaming ALPROTO_HTTP* constants ... Having now ALPROTO_HTTP1, ALPROTO_HTTP2 and ALPROTO_HTTP Run with 3 sed commands git grep ALPROTO_HTTP | cut -d: -f1 | uniq | xargs sed -i -e 's/ALPROTO_HTTP/ALPROTO_HTTP1/g' git grep ALPROTO_HTTP12 | cut -d: -f1 | uniq | xargs sed -i -e 's/ALPROTO_HTTP12/ALPROTO_HTTP2/g' git grep ALPROTO_HTTP1_ANY | cut -d: -f1 | uniq | xargs sed -i -e 's/ALPROTO_HTTP1_ANY/ALPROTO_HTTP/g' and then running clang-format	4 years ago
Jason Ish	dbae17dbc0	install: makefile target to install libraries ... As we don't install the libraries by default, provide a make target, "install-library" to install the libsuricata library files. If shared library support exists, both the static and shared libraries will be installed, otherwise only the static libraries will be installed.	4 years ago
Jason Ish	a178ec6bef	rust: rename lib to libsuricata_rust ... Previously it was libsuricata.a, but eventually we want to get to a place where libsuricata.a is a combination of the Rust and C code.	4 years ago
Jason Ish	9f20297cb3	rust/Makefile: add Cargo.toml as make dependency ... This will force Cargo.toml to be recreated if Cargo.toml.in is modified.	4 years ago
Jason Ish	3ada5e1480	rust/ffi: provide AppLayerRegisterParser in context ... AppLayerRegisterParser was creating a link error when attempting to use a convenience library for the Suricata C code, then linking the library of C code with the library of Rust code into a final Suricata executable, or use with fuzz targets. By moving AppLayerRegisterParser to the context structure and calling it like a callback the circular reference is removed allowing the convenience libraries to work again. This is also a stepping block to proving a Suricata library as a single .a or .so file.	4 years ago
Philippe Antoine	32b604e8c7	template: use response_gap in rust parser	4 years ago
Victor Julien	3f807f3bf6	rust: update dependencies	4 years ago
Victor Julien	ebde15f0e2	rust: lock all major crate versions ... To avoid surprises with dependencies bumping MSRV.	4 years ago
Victor Julien	4b5af36061	rust: relax nom version to any >=5.1.1	4 years ago
Philippe Antoine	d861228214	http2: decompression for files ... gzip and brotli decompression for files	4 years ago
Philippe Antoine	2e46b5d100	rust: BIT_U16 macro utility	4 years ago
Philippe Antoine	aee8e60149	rust: better panic message for missing file config	4 years ago
Philippe Antoine	8ac363c34d	rust: fix warning about unused values in smb tests	4 years ago
Jason Ish	0a3b9e0220	rust/hashing: add function to finalize md5 to hex string ... New function, SCMd5FinalizeToHex to finalize an md5 hash to a hex string.	4 years ago
Jason Ish	26c1321668	rust/hashing: function to md5 hash buffer to hex ... Add function SCMd5HashBufferToHex to hash a single buffer to an md5 hex string.	4 years ago
Jason Ish	0f714be9f3	rust/hashing: method to SHA256 and finalize in one call ... Add SCSha256HashBuffer to hash a single buffer returning the result.	4 years ago
Jason Ish	eb5cfd9b82	rust/hashing: new function to SHA1 hash a single buffer ... SCSha1HashBuffer will has a single buffer and compute the digest in one call.	4 years ago
Jason Ish	ff37526c6b	rust: remove md5 crate, unalias md-5 ... Remove the md5 crate as a dependency as it is no longer removed. We now use md-5 from RustCrypto.	4 years ago
Jason Ish	0a2d8509c9	rust/ssh: use md-5 crate instead of md5 ... The "md-5" crate is part of the RustCrypto project that also uses the sha1 and sha256 crates we are using. These all implement the Digest trait for a common API.	4 years ago
Jason Ish	1022b217ed	rust/hashing: a method to md5 hash a single buffer ... Add SCMd5HashBuffer as a replacement for NSS HASH_HashBuf as used in ja3 to hash a single buffer.	4 years ago
Jason Ish	46ceb13c08	rust: add ffi module for sha256, sha1 and md5 ... Add a Rust module that exposes Rust implementations of sha256, sha1 and md5 from the RustCrypto project. This is an experiment in replacing the libnss hash functions with pure Rust versions that will allow us to remove nss as a compile time option. Initial tests are good, even with a 10% or so performance improvement when being called from C. Also trying a module naming scheme where modules under the ffi modules are purely for exports to C, as it doesn't make any sense to use this new hashing module directly from Rust.	4 years ago
Jeff Lucovsky	8ce2078a38	tftp: Add test cases ... This commit adds test cases for the TFTP parser.	4 years ago
Jeff Lucovsky	e900b6d265	tftp: Improve parser ... This commit improves TFTP parsing by ensuring the mode and opcode are valid.	4 years ago
Jason Ish	f77fd0c0cb	rust: include file cleanup ... The cbindgen generated header should not include rust.h as rust.h already includes the generated binding. Fixup C source code that only pulled the generated include, it should instead pull in "rust.h" which includes the generated binding plus other misc. stuff.	4 years ago
Juliana Fajardini	e33bbee9b7	nbss: add parser tests ... Add tests to parse_nbss_record and parse_nbss_record_partial	4 years ago
Juliana Fajardini	5226ba1c15	Rust: generic files definition ... Issue: Optimization 3825 - filecontainer: add Files structure, to replace/unify SMBFiles, NFSFiles and HTTP2Files - smb/files: delete SMBFiles implementation - smb/smb: replace SMBFiles with Files - nfs/nfs: delete NFSFiles implementation, replace its former declarations with Files' ones - http2/http2: replace HTTP2Files with Files - http2/mod: Delete reference to file files.rs - http2/files: Delete	4 years ago
Sascha Steinbiss	a4556c9427	dns: use rest() for NULL parsing	4 years ago
Sascha Steinbiss	81b206a5f4	dns: add test for SRV	4 years ago
Sascha Steinbiss	08a6f1441a	dns: parse SRV records	4 years ago
Antti Tönkyrä	f3ad7f14fa	dns: add rdata logging for NS rrtype	4 years ago
Simon Dugas	4336a0e739	dns: log rdata for NULL record type ... Logs the rdata for a NULL record type as a printable string.	4 years ago
Victor Julien	efc9a7a398	app-layer: remove callback for completion status ... Since the completion status was a constant for all parsers, remove the callback logic and instead register the values themselves. This should avoid a lot of unnecessary callback calls. Update all parsers to take advantage of this.	4 years ago
Philippe Antoine	f574663352	http2: files inspection API fixes ... uses right transaction id for file tracker uses FILE_USE_DETECT for good matches with keyword startswith	4 years ago
Philippe Antoine	a63ee5adbd	http2: allow multiple size updates in one headers batch ... cf RFC 7541 section 4.2	4 years ago
Philippe Antoine	6181459086	smb: do not rely on one valid NBSS byte for probing ... Need to have the SMB header so as to validate	4 years ago
Jason Ish	f3c59ef8a6	rust: handle windows naming change from .lib to .a ... Prior to Rust 1.44, Cargo would name static libs with the .lib extension. 1.44 changes this extension to .a when running under a GNU environment on Windows like msys to make it more similar to other unix environments. Now assume static library name to be the same on Windows and unix, but rename the .lib if found to still support older versions of Rust on Windows.	4 years ago
Victor Julien	ba781265a4	dcerpc/udp: fix transaction handling and logging ... Implement missing transaction handling. Fix logging wrongly casting 'state' to DCERPCState instead of DCERPCUDPState leading to crashes and malformed output. Remove unused fields from DCERPCUDPState.	4 years ago
Philippe Antoine	8db78208f9	rust: fix warnings found by nightly compiler ... warning: getting the inner pointer of a temporary `CString` this `CString` is deallocated at the end of the statement, bind it to a variable to extend its lifetime	4 years ago
Jason Ish	2f81f3fbe9	rust/log: clarify comment in non-debug mode SCLogDebug	4 years ago
Jason Ish	a453d28bc6	rust/log: order log macros in descending order ... Readability cleanup. - error, notice, ... debug	4 years ago
Jason Ish	411a5d41c1	rust/log: expand macros after checking log level ... Expand macros in the do_log macro after checking the log level instead of each log macro (ie: SCLogDebug) expanding the macros then passing off to do_log to have the log level check. Will eliminate any expense of expanding macros if this log level does not permit the given message to be logged. Redmine issue: https://redmine.openinfosecfoundation.org/issues/4114	4 years ago
Shivani Bhardwaj	269324e84d	dcerpc/log: Log fields particular to an RPC version ... Log fields that only are meant to be in a PDU for a particular RPC version. Since DCERPC/UDP works on RPC version 4 and DCERPC/TCP works on RPC version 5, there are certain fields that are particular to each version. Remove call_id from the logger for UDP. Add activityuuid and seqnum fields to the logger for UDP. call_id and (activityuuid + seqnum) fields are used to uniquely pair a request with response for RPC versions 5 and 4 respectively.	4 years ago
Ilya Bakhtin	2033f386f9	rust/dcerpc: Remove redundant fields	4 years ago
Ilya Bakhtin	2840a2e064	rust/dcerpc: Make tx_id u64	4 years ago
Ilya Bakhtin	6916b63f09	dcerpc/udp: Fix pairing of request response ... So far, request and response were paired with serial number fields in the header. This is incorrect. According to https://pubs.opengroup.org/onlinepubs/9629399/chap12.htm, "Together, the activity UUID and the sequence number uniquely identify a remote procedure call." Hence, add activity uuid and sequence number to the transaction and pair the request accordingly. Remove incorrect handling of this and fix tests.	4 years ago
Ilya Bakhtin	e9b21553cc	rust/dcerpc: Add UDP flag definitions	4 years ago
Victor Julien	51f4e4d0b7	dcerpc/udp: add missing tx free logic	4 years ago
Victor Julien	9f9c29a14a	dcerpc: fix stream flag handling ... Only hardcoded direction flags were passed to the parser, not the full range. Handle receiving an EOF flag w/o data. Bug: #3856	4 years ago
Victor Julien	f31372ad1d	dcerpc/tcp: fix compile warning ... warning: variable does not need to be mutable --> src/dcerpc/dcerpc.rs:1036:42 | 1036 | let tx = if let Some(mut tx) = self.get_tx_by_call_id(current_call_id, core::STREAM_TOCLIENT) { | ----^^ | | | help: remove this `mut` | = note: `#[warn(unused_mut)]` on by default warning: variable does not need to be mutable --> src/dcerpc/dcerpc.rs:1061:30 | 1061 | Some(mut tx) => { | ----^^ | | | help: remove this `mut`	4 years ago
Victor Julien	67b5295bbc	dcerpc/tcp: add missing detect state cleanup	4 years ago
Philippe Antoine	1fd6f5bc61	http2: asymetric sizes for headers tables ... The headers table from client to server and the one from server to client may have different maximum sizes (even if both endpoints have to keep both tables)	4 years ago
Philippe Antoine	aaa69fe3c5	smb: resistance against padding evasions ... Scenario is use of dummy padding in write AndX request or other similar commands using a data offset. Parsing skips now these dummy bytes, and generates one event	4 years ago
Philippe Antoine	caa7946888	smb: adds file overlap event against evasions ... Evasion scenario is - a first dummy write of one byte at offset 0 is done - the second full write of EICAR at offset 0 is then done and does not trigger detection The last write had the final value, and as we cannot "cancel" the previous write, we set an event which is then transformed into an app-layer decoder alert	4 years ago
Philippe Antoine	3e96f96153	rdp: fix incomplete result ... Aggregating the consumed bytes	4 years ago
Jason Ish	0529a00ffd	dhcp: set unidirection transaction flag	4 years ago
Jason Ish	3036ec4db0	ikev2: set unidirection transaction flag	4 years ago
Jason Ish	ff674d0cd0	mqtt: set unidirection transaction flag	4 years ago
Jason Ish	54d5f336d4	sip: set unidirection transaction flag	4 years ago
Jason Ish	1d40d0c5f9	rdp: set unidirection transaction flag	4 years ago
Jason Ish	f7dee602e9	krb5: set unidirection transaction flag	4 years ago
Jason Ish	984d3c7f20	ntp: set unidirection transaction flag	4 years ago
Jason Ish	fc7d59d92f	snmp: set unidirectional transaction flag	4 years ago
Philippe Antoine	64fcba228b	http2: complete parsing of priority frames	4 years ago
Philippe Antoine	c300a859a0	http2: keep track of dynamic headers table size ... And evict entries accordingly to maximum size	4 years ago
Philippe Antoine	1a21eea0e9	http2: variable size integers decoded everywhere	4 years ago
Philippe Antoine	b21acfbf21	http2: StreamIdReuse frame types exceptions ... Also handles better the state so as not to revert from HTTP2StateHalfClosedClient to HTTP2StateDataServer and not go to final HTTP2StateClosed	4 years ago
Philippe Antoine	89573060d9	http2: use variable integer for headers lengths	4 years ago
Shivani Bhardwaj	97c67cd5ce	dcerpc: fix gap handling ... This patch addresses issues discovered by redmine ticket 3896. With the approach of finding latest record, there was a chance that no record was found at all and consumed + needed became input length. e.g. input_len = 1000 input = 01 05 00 02 00 03 a5 56 00 00 ..... There exists no |05 00| identifier in the rest of the record. After having parsed |05 00|, there was a search for another record with the leftover data. Current data length at this point would be 997. Since the identifier was not found in the data, we calculate the consumed bytes at this point i.e. consumed = current_data.len() - 1 which would be 996. Needed bytes still stay at a constant of 2. So, consumed + needed = 996 + 2 = 998 which is lesser than initial input length of 1000 and hence the assertion fails. There could be two fixes to this problem. 1. Finding the latest record but making use of the last found record in case no new record was found. 2. Always use the earliest record. This patch takes the approach (2). It also makes sure that the gap and current direction are the same.	4 years ago
Philippe Antoine	4f963717f8	fuzz: better configure checks for MSAN building ... More compatible check for rust nightly Checks for CARGO_BUILD_TARGET Builds release or debug mode independently	4 years ago
Victor Julien	5d985c4271	dcerpc: implement tx free function	4 years ago
Victor Julien	8b2886635f	dcerpc/tcp: implement trunc logic ... When one side of the connection reaches the STREAM_DEPTH condition the parser should be aware of this. Otherwise transactions will forever be waiting for data in that direction.	4 years ago
Victor Julien	4da0d9bdea	applayer/rust: expose truncate callback	4 years ago
Shivani Bhardwaj	301454e9e4	dcerpc: fix datatypes while handling stub data	4 years ago
Shivani Bhardwaj	3fd9a3d420	dcerpc: fix datatype for stub data len	4 years ago
Philippe Antoine	222b386102	rust: rebuilds std when building fuzzers ... so as to have MSAN working	5 years ago
Philippe Antoine	15447cc672	dceprc: signature rust check with is_char_boundary ... before calling split_at which would panic	5 years ago
Philippe Antoine	6694737fcf	http2: settings from http1 upgrade	5 years ago
Philippe Antoine	7011bddf84	http2: mimic HTTP1 request from upgrade	5 years ago
Philippe Antoine	9d1b030ff0	http2: first connection upgrade from http1	5 years ago
Philippe Antoine	547d6c2d78	applayer: pass parameter to StateAlloc ... This parameter is NULL or the pointer to the previous state for the previous protocol in the case of a protocol change, for instance from HTTP1 to HTTP2 This way, the new protocol can use the old protocol context. For instance, HTTP2 mimicks the HTTP1 request, to have a HTTP2 transaction with both request and response	5 years ago
Sascha Steinbiss	ed9fed4958	mqtt: add some extra tests for varint parsing	5 years ago
Philippe Antoine	1a88df7e88	http2: handles incomplete frames after banner ... To signal incomplete data, we must return the number of consumed bytes. When we get a banner and some records, we have to take into account the number of bytes already consumed by the banner parsing before reaching an incomplete record.	5 years ago
Philippe Antoine	7ab9a01db2	mqtt: limit size of variable integer	5 years ago
Philippe Antoine	e3b28bcf2a	http2: returns error in case of index 0 ... As is documented in RFC 7541, section 6.1 The index value of 0 is not used. It MUST be treated as a decoding error if found in an indexed header field representation.	5 years ago
Jason Ish	e9fec043b5	rust/util: expose function to test strings for valid UTF-8 ... rs_check_utf8 will check that the provided string is valid UTF-8 by converting it to a Rust string and returning true or false.	5 years ago
Simon Dugas	7f26246ce1	dns: parse and log fields for SOA record type ... Added `dns_parse_rdata_soa` to parse SOA fields into an `DNSRDataSOA` struct. Added logging for answer and authority SOA records in both version 1 & 2, as well as grouped formats.	5 years ago
Simon Dugas	af498fd840	dns: use nom's rest to take all remaining rdata ... Using nom's `rest` combinator eliminates the need to call the do_parse macro for parsing a single element.	5 years ago
Simon Dugas	8005f50647	dns: refactor to handle more rdata formats ... Represent rdata as `DNSRData` enum variants instead of `Vec<u8>`. This will allow parsing/logging of more complex formats like SOA.	5 years ago
Jason Ish	647e304f4b	rust/log: minor cleanup ... Group functions for setting and getting the log level together.	5 years ago
Jason Ish	ea1338b464	rust: function macro now returns the function name ... Borrow a macro from https://github.com/popzxc/stdext-rs that will give us the Rust function name in SCLog messages in Rust. As this trick only works on Rust 1.38 and newer, keep the old macro around and set a feature based on a Rust version test done during ./configure.	5 years ago
Jason Ish	bac8016d17	rust: plugin bootstrap function ... Functions written in Rust will need to suricata::plugin::init() to bootstrap themselves. This bootstrap process sets the log level within the Rust address space, and hooks up function pointers that are expected to be set during normal runs of Suricata.	5 years ago
Jason Ish	3de98b3595	rust/log: set the log level with a pure Rust function ... Make sure the log level is setup with a pure Rust function, so when it is set, its set within the address space of the caller. This is important for Rust plugins where the Rust modules are not in the address space of the Suricata main process.	5 years ago
Jason Ish	ac93ab281d	rust/logging: allow log macros to be used by plugins ... Fix plugin macros so they can be used by external Rust crates such as plugins.	5 years ago
Jason Ish	3672cea876	rust/Cargo: build as rlib for plugin linkage ... Build Rust code as an rlib, in addition to a staticlib so plugins can link with the Rust code.	5 years ago
Philippe Antoine	b20a8de646	dns: simply skips zero-sized dns requests/responses	5 years ago
Ilya Bakhtin	c903441fe7	mqtt: fixed wrong slice access ... Slice access esults in rust panic when mqtt ping is processed	5 years ago
Victor Julien	4aa80ac7f6	detect/http2: fix header inspection ... Header inspection was overwriting data that was still being referenced by the detect engine, leading to ASAN issues.	5 years ago
Jason Ish	f26d6eaf98	http2: log as http to abstract http and http2 a little ... This commit logs http2 as an http event. The idea is to somewhat normalize http/http2 so common info can be version agnostic. This puts the http2 specific fields in an "http2" object inside the "http" object. HTTP2 headers/values that are in common with HTTP1 are logged under the "http" object to be compatible with HTTP1 logging.	5 years ago
Jason Ish	6a55606adb	http2: log headers in the same format as http (1) ... Log the headers in request_headers, and response_headers like http1 to remain compatible.	5 years ago
Philippe Antoine	1422b18a99	http2: initial support	5 years ago
Jeff Lucovsky	be57f6d3cc	rust/rdp: Fix use of incorrect buffer ... This commit updates the connection confirmation parsing function to use the correct buffer when determining the packet type.	5 years ago
Shivani Bhardwaj	2529eb35e1	smb: use uuid crate	5 years ago
Jason Ish	e6668560e0	rust: only run cbindgen if needed ... Only run cbindgen when necessary. This is a bit tricky. When building a dist we want to unconditionally build the headers. When going through a "make; sudo make install" type process, cbindgen should not be run as the headers already exist, are valid, and the environment under sudo is more often than not suitable to pick up the Rust toolchains when installed with rustup. For the normal "make" case we have the gen/rust-bindings.h file depend on library file, this will cause it to only be rebuilt if the code was modified. For "make dist" we unconditionally create "dist/rust-bindings.h". This means the generated file could be in 2 locations, so update configure.ac, and the library search find to find it. The "gen/rust-bindings.h" should be picked up first if it exists, for those who develop from a dist archive where "dist/rust-bindings.h" also exists. Not completely happy having the same file in 2 locations, but not sure how else to get the dependency tracking correct.	5 years ago
Shivani Bhardwaj	4c7f55e636	dcerpc: handle gap for TCP streams	5 years ago
Jason Ish	6cff558663	dns: add tailing data to split tcp unit test ... Add trailing data to the complete payload to test the case where data is consumed, but still incomplete.	5 years ago
Jason Ish	cc154ce152	dns: fix subtraction overflow in debug message ... The math for the return value wasn't updated in the debug log to match the logic and could lead to a subtraction overflow	5 years ago
Philippe Antoine	80ccbff28a	dns: return status from parsing tcp request	5 years ago
Philippe Antoine	1296740471	dns: fix incomplete results ... and messages parsing whose length is >= 32768	5 years ago
Philippe Antoine	83567e8732	files: rust closes files even on 0 length chunk	5 years ago
Sascha Steinbiss	c31360070b	rust/mqtt: add MQTT parser	5 years ago
Victor Julien	b99ffd9ece	eve: remove unused jansson code	5 years ago
Jeff Lucovsky	961b314b86	dns: Remove parser buffering code	5 years ago
Victor Julien	00cc3c7374	eve/ssh: change hassh logging format ... Elastic search didn't accept the 'hassh' and 'hassh.string'. It would see the first 'hassh' as a string and split the second key into a object 'hassh' with a string member 'string'. So two different types for 'hassh', so it rejected it. This patch mimics the ja3(s) logging by creating a 'hassh' object with 2 members: 'hash', which holds the md5 representation, and 'string' which holds the string representation.	5 years ago
Philippe Antoine	eb5b927787	ssh: fixing incomplete kex parsing ... We use the record length from the ssh record header, and not the size of the parsed data, as is done in other places.	5 years ago