978 Commits (73ed780095deff40dd625412ac706337be54dc88)

Author	SHA1	Message	Date
Jason Ish	b8b6a17a5b	dns: add pdu frame ... Adds a PDU frame to the DNS parser. For UDP this is the DNS payload portion of the DNS packet, for TCP this is the payload minus the leading legth field. Ticket: 4984	2 years ago
Jason Ish	8d1840f595	frames(rust): don't call into C if running Rust unit tests ... Wrap the calls behind frames to C code if a `cfg!(not(test))` so they don't get compiled when running Rust unit tests. Linkage to C functions is not yet available for Rust unit tests, and this will keep the check out of individual parsers. Ticket: 4984	2 years ago
Jason Ish	c74ea3840d	frames (rust): method to create StreamSlice from slice ... Useful in unit test for function that require a StreamSlice.	2 years ago
Jason Ish	d712a8b29d	eve/dns: remove dns v1 logging ... Removal of DNS v1 logging was scheduled to be removed in May 2022. Ticket: #4157	2 years ago
Jason Ish	e319d31c14	template(rust): convert transaction list to vecdeque ... Allows for more efficient removal from front of the list. Ticket: #5298	2 years ago
Jason Ish	9b0b2beac1	pgsql: convert transaction list to vecdeque ... Allows for more efficient removal from front of the list. Ticket: #5297	2 years ago
Jason Ish	2db84726ad	http2: convert transaction list to vecdeque ... Allows for more efficient removal from front of the list. Ticket: #5296	2 years ago
Jason Ish	4e0ad5e0bd	rdp: convert transaction list to vecdeque ... Allows for more efficient removal from front of the list. Ticket: #5295	2 years ago
Jason Ish	3b422e25f3	mqtt: convert transaction list to vecdeque ... Allows for more efficient removal from front. Ticket: #5294	2 years ago
Jason Ish	3189414788	dns: convert transaction list to vecdeque ... Allows for more efficient removal from front of the list. Ticket: #5277	2 years ago
Jason Ish	7b11b4d3a1	app-layer: more generic state trait ... Instead of a method that is required to return a slice of transactions, use 2 methods, one to return the number of transactions in the collection, and another to get a transaction by its index in the collection. This allows for the transaction collection to not be a contiguous array and instead can be a VecDeque, or possibly another collection type that supports retrieval by index. Ticket #5278	2 years ago
Juliana Fajardini	bbd9a2ff1a	pgsql: apply clippy fixes	2 years ago
Juliana Fajardini	0fc9ade7a9	pgsql: fix uint overflow and optimizations ... Fuzzers found a possible integer overflow bug when parsing response messages. To fix that, removed the case where we incremented the parsed field length and created a new message type for situations where Suri parsers an Unknown message. This is good because there may happen that an unknown message to Suri is valid, and in this case, we would still be able to log it. Philippe Antoine found the bug while fuzzing with rust debug assertions. Bug #5016	2 years ago
Juliana Fajardini	8daa79513a	pgsql: fix clippy is_null usage warning	2 years ago
Philippe Antoine	d2f00ac824	dcerpc: use wrappingadd for padding parsing ... As we compute a modulo, we can safely wrap around even if there is an overflow Ticket: #5301	2 years ago
Philippe Antoine	464ff80c6a	smb: protocol detection on pattern without midstream ... To recognize a protocol, Suricata first looks for patterns, which can be confirmed by a probing parser. If this does not work, Suricata can try to run some probing parsers on some ports. This is the case for SMB. This commit makes handling the confirming and the probing paser differently even if they share much code. The confirmation parser knows that a pattern has been found. So, it must not do the midstream case of looking for this pattern in the whole buffer, but only check it at the beginning. But it must reverse direction if needed.	3 years ago
Victor Julien	dc57460427	smb: fix event types for limit exceeded rules	3 years ago
Jason Ish	0623ada24d	dns: better error handling when parsing names ... The DNS name parser will error out with an error even if the error is incomplete. Instead of manually generating errors, use '?' to let the nom error ripple up the error handling chain. The reason this wasn't done in the first place is this code predates the ? operator, or we were not aware of it at the time. This prevents the case where probing fails when there is enough data to parse the header, but not enough to complete name parser. In such a case a parse error is returned (instead of incomplete) resulting in the payload not being detected as DNS. Ticket #5034	3 years ago
Jason Ish	27679a12aa	dns: don't parse a full request during probe if not enough data ... If there is more data than a header, but not enough for a complete DNS message, the hostname parser could return an error causing the probe to fail on valid DNS messages. So only parse the complete message if we have enough input data. This is reliable for TCP as DNS messages are prefixed, but for UDP its just going to be the size of the input buffer presented to the parser, so incomplete could still happen. Ticket #5034	3 years ago
Victor Julien	fc9b65d8d3	smb2: validate negotiate read/write max sizes ... Raise event if they exceed the configured limit.	3 years ago
Victor Julien	4be8334c9e	smb2: allow limiting in-flight data size/cnt ... Allow limiting in-flight out or order data chunks per size or count. Implemented for read and writes separately: app-layer.protocols.smb.max-write-queue-size app-layer.protocols.smb.max-write-queue-cnt app-layer.protocols.smb.max-read-queue-size app-layer.protocols.smb.max-read-queue-cnt	3 years ago
Victor Julien	2c5ad8858e	filetracker: track total queued data (in_flight) ... As well as expose number of chunks.	3 years ago
Victor Julien	90d4b8e438	smb: log max read/write sizes	3 years ago
Victor Julien	5bcc4162f7	smb2: add options for max read/write size ... Add options for the max read/write size accepted by the parser.	3 years ago
Victor Julien	f28888513a	smb2: track max read/write size and enforce its values	3 years ago
Victor Julien	594acec5dc	smb: minor function cleanup ... Remove used argument from `filetracker_newchunk()`. We're not using fill_bytes with smb.	3 years ago
Victor Julien	c7a474c725	filetracker: make FileChunk private	3 years ago
Philippe Antoine	3b13008c1b	mqtt: fix consumed bytes computation for truncated msg ... Ticket: 5268	3 years ago
Philippe Antoine	704bc878ea	dcerpc: store consumed_bytes as i32 ... As it can grow bigger than u16	3 years ago
Philippe Antoine	dfd17e9acc	ike: fix integer underflow in parse_proposal ... By not restricting a usize to i16	3 years ago
Victor Julien	93d5bce0aa	rust: update regex & memchr dependencies ... Bug: #5260.	3 years ago
Victor Julien	053a9d2e68	smb/ntlmssp: add stricter len/offset validation	3 years ago
Philippe Antoine	3e48881b78	smb: prevents integer underflow ... Ticket: 5246 If msg_id is 0, we cannot find the previous request	3 years ago
Philippe Antoine	e72036f12f	smb: ntlmssp domain_blob_offset underflow check ... Ticket: 5246	3 years ago
Philippe Antoine	817a5001a5	smb: check on param parsing ... Ticket: 5246 so as not to overflow u16	3 years ago
Sascha Steinbiss	7eb279ac53	mqtt: remove redundant "where" keyword	3 years ago
Sascha Steinbiss	d63e5b8c51	mqtt: make some functions non-public	3 years ago
Sascha Steinbiss	2a3ed9a6ae	mqtt: rustfmt	3 years ago
Sascha Steinbiss	1ba62993d5	mqtt: raise event on parse error	3 years ago
Sascha Steinbiss	5618273ef4	mqtt: ensure we do not request extra data after buffering ... This addresses Redmine bug #5018 by ensuring that the parser never requests additional data via the Incomplete error, but to raise an actual parse error, since it is supposed to have all the data as specified by the message length in the header already.	3 years ago
Victor Julien	6d30f4442c	http2: fix file accounting for ranged files ... Increment files_opened for tx that 'gets' reassembled ranged file	3 years ago
Victor Julien	b336882008	smb1: apply close to direction ... Instead of closing files in both direction when receiving a close request, close only toserver files for the request and close toclient on receiving a response.	3 years ago
Victor Julien	b9cd502249	smb: convert 'close' parser to function	3 years ago
Sam Muhammed	3a490fb16c	nfs: Implement frames ... Feature #4872 Frames: - RPC Frames: Generic over TCP/UDP - rpc.pdu - rpc.hdr - rpc.data - rpc.creds -- for rpc calls - NFSv2, NFSv3 - nfs.pdu - nfs.status -- for nfs responses - NFSv4 Only Frames - nfs4.pdu - nfs4.hdr - nfs4.ops -- for compound request/response operations - nfs4.status -- for nfs4 responses RPC tcp/udp frames created with separate registeration functions e.g: add_rpc_tcp_tc_frames() add_rpc_udp_tc_frames()	3 years ago
Sam Muhammed	d090dcbce9	rpc: Improve rpc_record struct ... Add creds_len field to rpc_record needed for rpc.creds frame length calculation	3 years ago
Sam Muhammed	8064a5348d	rust/nfs4: Add NFSPROC4_DESTROY_CLIENTID op parsers	3 years ago
Sam Muhammed	9d1fad28a7	rust/nfs4: Add NFSPROC4_DESTROY_SESSION op parsers ... Also add respective request unittest test_nfs4_request_destroy_session()	3 years ago
Sam Muhammed	ff81cad4f1	rust/nfs4: Add NFSPROC4_LAYOUTRETURN op parsers ... Also add respective request unittest test_nfs4_request_layoutreturn()	3 years ago
Sam Muhammed	073244a0b8	rust/nfs4: Add NFSPROC4_GETDEVINFO op parsers ... Also add respective response/request unittests test_nfs4_response_getdevinfo() test_nfs4_request_getdevinfo()	3 years ago
Sam Muhammed	ff54a6d9d5	rust/nfs4: Add NFSPROC4_LAYOUTGET op parsers ... Also add respective response/request unittests test_nfs4_response_layoutget() test_nfs4_request_layoutget()	3 years ago