Commit Graph

1142 Commits (86831541155bac8e31d8b68873a35257d1565b80)

Author SHA1 Message Date
Jason Ish 38321a213f rust/app-layer-template: rustfmt 3 years ago
Jason Ish 50a787a9a3 app-layer-template-rust: remove C app-layer stub
Remove the app-layer-PROTO stub for Rust based parsers.  It is no longer
needed as Rust parsers now contain the registration function in Rust.

Ticket: 4939
3 years ago
Jason Ish baa7021ee6 rust/conf: add fn conf_get_node
A wrapper around ConfGetNode to get a configuration node by name.
3 years ago
Victor Julien 64c0459d2d rust/lzma: clippy fixup 3 years ago
Jason Ish 35f99d1af7 rust/http2: fix clippy lint for is_empty()
This snuck through as "cargo clippy" check wasn't finding lints that
were fixed by the previous test for fixable lints.
3 years ago
Todd Mortimer 7d1a8cc335 file/swf: Use lzma-rs decompression instead of libhtp.
Use the lzma-rs crate for decompressing swf/lzma files instead of
the lzma decompressor in libhtp. This decouples suricata from libhtp
except for actual http parsing, and means libhtp no longer has to
export a lzma decompression interface.

Ticket: #5638
3 years ago
Victor Julien 45eb038e63 smb: fix file reopening issue
Fuzzing highlighted an issue where a command sequence on the same file
id triggered a logging issue:

file data for id N
close id N
file data for id N

If this happened in a single blob of data passed to the parser, the
existing file tx would be reused, the file "reopened", confusing the
file logging logic. This would trigger a debug assert.

This patch makes sure a new file tx is created for the file data
coming in after the first file tx is closed.

Bug: #5567.
3 years ago
Philippe Antoine 29f40c9e07 dcerpc: fix integer underflow
as input.len() can be 65536, it cannot be directly cast to u16

Ticket: #5557
3 years ago
Jason Ish 91617f479a rust: sha-1 is now sha1
This is the same crate, but renamed to be more consistent with the
RustCrypto project naming. Some recent discussion is available here:

    https://github.com/RustCrypto/hashes/issues/438
3 years ago
Philippe Antoine af44504550 smb: do not use tree id to match request and response
Completes commit e94920b49f

This must be true for access to state ssn2vecoffset_map

Ticket: #5161
3 years ago
Victor Julien cade6046c5 rust/files: open file without trackid as pointer 3 years ago
Victor Julien ad869e1c52 rust/filecontainer: remove unused declaration 3 years ago
Philippe Antoine 086b28da3d http2: fix decompression buffering
It was not enough to set Cursor position to 0,
also its inner Vec should be cleared.

This way, a new input gets written at the beginning of the
Cursor and its inner Vec...

Ticket: #5691
3 years ago
Philippe Antoine c6349d3cfc http2: support padded data frames
Ticket: #5691
3 years ago
Philippe Antoine e1ee401a12 quic: use VecDeque
Ticket: #5637
3 years ago
Philippe Antoine 286bd2a7ed rust: fix cargo clippy --all-features 3 years ago
Philippe Antoine bc287018e5 rust: cargo clippy --all-features --fix --allow-no-vcs 3 years ago
Philippe Antoine cd4bf518f3 rust: fix warnings on rustc 1.67.0-nightly
warning: for loop over an `Option`. This is more readably written
as an `if let` statement
3 years ago
Juliana Fajardini a654ef50de pgsql: add test for parameter status parser
Since we've done some changes to how the parameters are parsed, add one
more test case to check that.

Bug #5579
3 years ago
Juliana Fajardini c4fbd78770 pgsql: move database into opt parameters list
For StartupMessages, the database parameter is optional. This moves the
parameter into the optional_parameters list.

Bug #5579
3 years ago
Philippe Antoine cc68898532 pgsql: support empty parameter values
Bug #5579
3 years ago
Philippe Antoine 1e0190bc6b pgsql: support out of order parameters for startup message
As user can be not the first parameter

Bug #5579
3 years ago
Jason Ish 1f056f9974 bittorrent-dht: parse and log node6 lists
Node6 lists are just like node lists, but for IPv6 addresses.
3 years ago
Jason Ish 86d5ab8644 bittorrent-dht: remove tests that are no longer valid 3 years ago
Jason Ish 2f9eb5d1dd bittorrent-dht: fix values decoding, as a list of peers
The "values" field is not a string, but instead peer information in
compact format. Decode this properly and then properly format in the
log.
3 years ago
Jason Ish 4a0859beeb jsonbuilder: add append_hex - add hex to array
New method, append_hex to add a byte array to a JSON array in hex
encoding.
3 years ago
Jason Ish 4bc9cf3986 bittorrent-dht: parse token and target as byte values 3 years ago
Jason Ish 5a30ee77a1 bittorrent-dht: only attempt to parse dht messages
The bittorrent flow is shared with transport messages as well as dht
messages. Only attempt to parse dht message as dht, ignore the rest.
3 years ago
Jason Ish 98a9391210 bittorrent-dht: decode node data structures
Instead of decoding the nodes field into a blog of bytes, decode it into
an array of node info objects, each with a node id, IP address and port.
3 years ago
Jason Ish 3cb50592ed bittorrent-dht: convert some fields to byte arrays
Some fields that were previously strings are not always value UTF-8
data, instead the protocol specification refers to them as strings of
bytes, so in other words byte arrays.

Currently fields converted are:
- client_version
- info_hash
- response.id
- request.id
- nodes
- token
3 years ago
Jason Ish 78ba17caa8 bittorrent-dht: register a pattern for protocol detection
Removes the port based probing which takes a long time to register for
ports 1024-65535 and instead use pattern based protocol detection.
3 years ago
Jason Ish 350c0723d7 bittorrent-dht: set parser to unidirectional
This parser does not match up responses with requests so flag it as
unidirectional.
3 years ago
Jason Ish 06eaec67ac bittorrent: updates for new event handling
Fixes anomaly events.
3 years ago
Aaron Bungay 86037885a9 bittorrent-dht: add bittorrent-dht app layer
Parses and logs the bittorrent-dht protocol.

Note: Includes some compilation fixups after rebase by Jason Ish.

Feature: #3086
3 years ago
Haleema Khan 8d5c5f24a1 dns/eve: add 'HTTPS' type logging
Add a new DNS record type to represent HTTPS
Ticket: #4751
3 years ago
Alice Akaki ccdc992a71 rust: fix lint warnings about mixed case hex literals
Ticket: #4593
3 years ago
Gabriel Lima Luz 4e90d17fd9 rust: fix lint warnings about if same then else
Ticket: 4609
3 years ago
Kristina Jefferson 9cd00424c3 rust: fix lint warnings about ptr_arg
Ticket: #4599
3 years ago
Jason Ish 21bb697bc9 rust: fix clippy lint for unneeded late initialization 3 years ago
Jason Ish 7cca238128 rust: fix clippy lint for cmp_null is debug code
Ticket: 5577
3 years ago
Jason Ish f0952aef0d rust: fix clippy lints for unneeded reference in debug code 3 years ago
Jason Ish 6a7439a26b rust: fix clippy lints for is_empty in debug code 3 years ago
Jason Ish 560c4ea125 rust: don't allow fixed up clippy lints 3 years ago
Jason Ish 6db85d6f89 rust: clippy fix for bitwise or with 0 3 years ago
Jason Ish 04f0ee0151 rust: fix clippy lints for clippy::unnecessary_cast 3 years ago
Jason Ish b6cc0e25b1 rust: fix clippy lints for clippy::redundant_static_lifetimes 3 years ago
Jason Ish 13db83274b rust: fix clippy lints for clippy::redundant_pattern_matching 3 years ago
Jason Ish 7ba1d3e300 rust: fix clippy lints for clippy::nonminimal_bool 3 years ago
Jason Ish 6ba0a67143 rust: fix clippy lints for clippy::map_flatten 3 years ago
Jason Ish 7ebdfa539a rust: fix clippy lints for clippy::manual_find 3 years ago