suricata

Commit Graph

Author	SHA1	Message	Date
Victor Julien	bf1bd407dd	rust: fix libc deprecation warnings for int types	7 years ago
Victor Julien	0301ceab13	rust/mingw: fix missing IPPROTO_* declarations The libc crate doesn't provide these on MinGW, so define them in our 'core' instead. We only use IPPROTO_TCP and IPPROTO_UDP. Bug #2733	7 years ago
Victor Julien	422e4892cc	proto-detect: improve midstream support When Suricata picks up a flow it assumes the first packet is toserver. In a perfect world without packet loss and where all sessions neatly start after Suricata itself started, this would be true. However, in reality we have to account for packet loss and Suricata starting to get packets for flows already active be for Suricata is (re)started. The protocol records on the wire would often be able to tell us more though. For example in SMB1 and SMB2 records there is a flag that indicates whether the record is a request or a response. This patch is enabling the procotol detection engine to utilize this information to 'reverse' the flow. There are three ways in which this is supported in this patch: 1. patterns for detection are registered per direction. If the proto was not recognized in the traffic direction, and midstream is enabled, the pattern set for the opposing direction is also evaluated. If that matches, the flow is considered to be in the wrong direction and is reversed. 2. probing parsers now have a way to feed back their understanding of the flow direction. They are now passed the direction as Suricata sees the traffic when calling the probing parsers. The parser can then see if its own observation matches that, and pass back it's own view to the caller. 3. a new pattern + probing parser set up: probing parsers can now be registered with a pattern, so that when the pattern matches the probing parser is called as well. The probing parser can then provide the protocol detection engine with the direction of the traffic. The process of reversing takes a multi step approach as well: a. reverse the current packets direction b. reverse most of the flows direction sensitive flags c. tag the flow as 'reversed'. This is because the 5 tuple is not reversed, since it is immutable after the flows creation. Most of the currently registered parsers benefit already: - HTTP/SMTP/FTP/TLS patterns are registered per direction already so they will benefit from the pattern midstream logic in (1) above. - the Rust based SMB parser uses a mix of pattern + probing parser as described in (3) above. - the NFS detection is purely done by probing parser and is updated to consider the direction in that parser. Other protocols, such as DNS, are still to do. Ticket: #2572	7 years ago
Pierre Chifflier	9e7f261a88	rust: fix cargo tests	7 years ago
Pierre Chifflier	8c0cde36c6	rust: fix warnings for unused variables (add _)	7 years ago
Pierre Chifflier	13b7399790	rust: upgrade all parsers to nom4	7 years ago
Victor Julien	0e40231189	app-layer: improve transaction cleanup handling The app layers with a custom iterator would skip a tx if during the ..Cleanup() pass a transaction was removed. Address this by storing the current index instead of the next index. Also pass in the next "min_tx_id" to be incremented from the last TX. Update loops to do this increment. Also make sure that the min_id is properly updated if the last TX is removed when out of order. Finally add a SMB unittest to test this. Reported by: Ilya Bakhtin	7 years ago
Victor Julien	ae10a92bc6	rust/applayer: use correct return type for Parser The mismatch between the types would randomly lead to the return code of the Rust parser to be not correctly handled over the C/Rust boundary. This would lead to the API considering a parser to be in error state when it was not.	7 years ago
Jason Ish	58933bafc1	rust app layer template: functions to get buffers Example functions for getting the request and response buffers. Useful for running detection on the decoded buffers.	7 years ago
Jason Ish	01f7dcf5fd	rust template parser: sample pcap	7 years ago
Jason Ish	c3f1a35e28	rust: app-layer template parser and logger The protocol is a simple request/reply based protocol that can be hand driven with netcat. Request -> 12:Hello World! Response -> 3:Byte Its of the format <length>:<message> where length is the length of the message, not including the length or the delimiter.	7 years ago

11 Commits (7e8f4b70f0334d285555f11048c203ea908a6b13)