Commit Graph

124 Commits (715bf048ee13fd6e5a2ad4c8b90dd504a050d3b3)

Author SHA1 Message Date
Victor Julien 53f63f7498 nfs/rpc: improve RPCv2 parser, add GssApi
Improve RPCv2 credentials parsing. Add GssApi and turn creds into
an enum.

Minor cleanups and optimizations.
8 years ago
Victor Julien 47ebef3af8 nfs: minor cleanup 8 years ago
Jason Ish c411519605 app-layer: remove has events callback - not used 8 years ago
Victor Julien f815027cdf rust/dns: simplify tx freeing
Now that we no longer need the state when freeing a TX, we can simply
do cleanup from the Drop trait.
8 years ago
Victor Julien 7548944b49 app-layer: remove unused HasTxDetectState call
Also remove the now useless 'state' argument from the SetTxDetectState
calls. For those app-layer parsers that use a state == tx approach,
the state pointer is passed as tx.

Update app-layer parsers to remove the unused call and update the
modified call.
8 years ago
Victor Julien 1c270cae13 nfs: remove old test code 8 years ago
Victor Julien e96d9c1159 app-layer: add tx iterator API
Until now, the transaction space is assumed to be terse. Transactions
are handled sequentially so the difference between the lowest and highest
active tx id's is small. For this reason the logic of walking every id
between the 'minimum' and max id made sense. The space might look like:

    [..........TTTT]

Here the looping starts at the first T and loops 4 times.

This assumption isn't a great fit though. A protocol like NFS has 2 types
of transactions. Long running file transfer transactions and short lived
request/reply pairs are causing the id space to be sparse. This leads to
a lot of unnecessary looping in various parts of the engine, but most
prominently: detection, tx house keeping and tx logging.

    [.T..T...TTTT.T]

Here the looping starts at the first T and loops for every spot, even
those where no tx exists anymore.

Cases have been observed where the lowest tx id was 2 and the highest
was 50k. This lead to a lot of unnecessary looping.

This patch add an alternative approach. It allows a protocol to register
an iterator function, that simply returns the next transaction until
all transactions are returned. To do this it uses a bit of state the
caller must keep.

The registration is optional. If no iterator is registered the old
behaviour will be used.
8 years ago
Victor Julien e8939335ea rust/nfs: explicitly handle GAPs from C
It seems that Rust optimizes this code in such a way that it
passes the null ptr along as real data.

    if buf.as_ptr().is_null() && input_len > 0 {
8 years ago
Victor Julien d27ed5957f rust/nfs: fix read reply handling
READ replies with large data chunks are processed partially to avoid
queuing too much data. When the final chunk was received however, the
start of the chunk would already tag the transaction as 'done'. The
more aggressive tx freeing that was recently merged would cause this
tx to be freed before the rest of the in-progress chunk was done.

This patch delays the tagging of the tx until the final data has been
received.
8 years ago
Victor Julien 8cda2a4351 rust/nfs: add support for detect_flags API 8 years ago
Victor Julien bca0cd71ae app-layer: use logger bits to avoid looping
Avoid looping in transaction output.

Update app-layer API to store the bits in one step
and retrieve the bits in a single step as well.

Update users of the API.
8 years ago
Victor Julien e1e9ada9df rust/nfs: improve file close handling 8 years ago
Nick Price 350b5d99ce rust/nfs: don't panic on malformed NFS traffic
Instead set events.
8 years ago
Victor Julien fd38e5e82b rust/nfs: fix new warnings in rustc 1.21 8 years ago
Victor Julien a306ccfd34 rust/nfs: implement events
Remove lots of panic statements in favor of setting non-fatal events.

Bug #2175.
8 years ago
Victor Julien 82bd732f4e rust/nfs: improve proto detect 8 years ago
Victor Julien 6b4a04510a rust/nfs: remove debug rec_size check
Records larger than 40k are perfectly valid.

Bug #2162.
8 years ago
Victor Julien 7c119cc595 nfs: log number of chunks that xfer'd a file 9 years ago
Victor Julien e8dae2e093 nfs: add to fileinfo events 9 years ago
Victor Julien db2d928151 rust/nfs: add (file)handle to log as crc32 9 years ago
Victor Julien becf1a2dfe rust/nfs: fix style warning 9 years ago
Victor Julien e0c6565e68 nfs: nfs_version keyword
Store nfs version in tx and add keyword to match on it.
9 years ago
Victor Julien aff576b524 eve/nfs: log nfs version 9 years ago
Victor Julien 0d79181d78 nfs: rename nfs3 to nfs
Since the parser now also does nfs2, the name nfs3 became confusing.
As it's still in beta, we can rename so this patch renames all 'nfs3'
logic to simply 'nfs'.
9 years ago