1252 Commits (8e5e9a289bb090f430fcf3bd6dabbe78f442866f)

Author	SHA1	Message	Date
Jason Ish	48920bd784	rust/derive: allow event name to be set as attribute ... When deriving AppLayerEvent, allow the event name to be set with the "name" attribute in cases where the transformed name is not suitable. This allows us to use enum variant names like "FtpEventRequestCommandTooLong" for direct use in C, but is also a name that doesn't transform well to an event name in rules, where we want to see "request_command_too_long".	4 years ago
Philippe Antoine	b52293b609	dcerpc: config limit maximum number of live transactions ... As is done for other protocols Ticket: #5779	4 years ago
Philippe Antoine	ba99241957	http2: fix leak with range files ... Ticket: #5808 May have been introduced by a24d7dc45c Function http2_range_open expects to be called only when tx.file_range is nil. One condition to ensure this is to check that we are beginning the files contents. The filetracker field file_open is not fit for this, as it may be reset to false.	4 years ago
Victor Julien	37f13a4fc7	smb: set defaults for file transfer limits ... Ticket: #5782.	4 years ago
Jason Ish	fab3f36b8c	dns: never return error on UDP DNS ... UDP parsers should never return error as it should indicate to Suricata that an unrecoverable error has occurred. UDP being record based for the most part is almost always recoverable, at least for protocols like DNS.	4 years ago
Jason Ish	d720ead470	dns: split header and body parsing ... As part of extra header validation, split out DNS body parsing to avoid the overhead of parsing the header twice.	4 years ago
Jason Ish	595700ab7e	dns: validate header on every incoming message ... As UDP streams getting probed, a stream that does not appear to be DNS at first, may have a single packet that does look close enough to DNS to be picked up as DNS causing every subsequent packet to result in a parser error. To mitigate this, probe every incoming DNS message header for validity before continuing onto the body. If the header doesn't validate as DNS, just ignore the packet so no parse error is registered.	4 years ago
Jason Ish	c98c49d4ba	dns: parse and alert on invalid opcodes ... Accept DNS messages with an invalid opcode that are otherwise valid. Such DNS message will create a parser event. This is a change of behavior, previously an invalid opcode would cause the DNS message to not be detected or parsed as DNS. Issue: #5444	4 years ago
Jason Ish	7afc2e3aed	dns: rustfmt	4 years ago
Jason Ish	39d2524bf6	dns: mark test buffers with rustfmt::skip	4 years ago
Victor Julien	6cc9811edd	files: move FileContainer into FileTransferTracker ... Update SMB, NFS, HTTP2.	4 years ago
Victor Julien	e3e55406a7	files: update API and callers to take stream config ... This is to allow not storing the stream buffer config in each file.	4 years ago
Victor Julien	71bc9e75f5	app-layer: get sbconfg with files	4 years ago
Victor Julien	a1a221066f	files: remove filecontainer drop trait ... In preparation of it becoming impossible to use due to the free function getting an cfg argument.	4 years ago
Victor Julien	0320c03f8c	http2: explicity free files ... In preparation of adding an argument to the free functions which means the drop trait can't be used anymore.	4 years ago
Victor Julien	4b1e9f7c21	smb: explicity free files ... In preparation of adding an argument to the free functions which means the drop trait can't be used anymore.	4 years ago
Victor Julien	3a24cce289	nfs: explicity free files ... In preparation of adding an argument to the free functions which means the drop trait can't be used anymore.	4 years ago
Victor Julien	4bfeac6591	nfs: file handling cleanups	4 years ago
Victor Julien	33f6a16290	smb: file handling cleanups	4 years ago
Victor Julien	d57510a10f	files: remove unused Rust binding for file pruning	4 years ago
Victor Julien	a24d7dc45c	smb: fix post-trunc chunk behavior ... After a gap in a file transaction, the file tracker is truncated. However this did not clear any stored out of order chunks from memory or stop more chunks to be stored, leading to accumulation of a large number of chunks. This patches fixes this be clearing the stored chunks on trunc. It also makes sure no more chunks are stored in the tracker after the trunc. Bug: #5781.	4 years ago
Philippe Antoine	55c4834e4e	smb: configurable max number of transactions per flow ... Ticket: #5753	4 years ago
Philippe Antoine	1d9183638f	smb: convert transaction list to vecdeque ... Allows for more efficient removal from front of the list. Ticket: #5753	4 years ago
Philippe Antoine	cb89192ec3	smb: fix typo in comment	4 years ago
Haleema Khan	cfcb7df9dc	mqtt: rustfmt parser.rs	4 years ago
Haleema Khan	23acb89653	mqtt: add unittests for nom7 parsers ... Ticket: #5742	4 years ago
Haleema Khan	cdc5ccd7f7	rfb: rustfmt parser.rs	4 years ago
Haleema Khan	b95d7efbd0	rfb: add unittests for nom7 parsers ... Task: #5741	4 years ago
Philippe Antoine	3979acb5ed	smb: set event for ntlmssp unusual order	4 years ago
Philippe Antoine	e41c01a483	smb: rustfmt ntlmssp_records.rs	4 years ago
Philippe Antoine	1db8685848	smb/ntlmssp: parse fields independently of order ... Instead of relying on the usual ordering... Ticket: #5258	4 years ago
Jason Ish	ae192ebae7	rust: sync log levels with C	4 years ago
Jeff Lucovsky	f8474344cd	log: Add module and subsystem identifiers to log ... Issue: 2497 This changeset provides subsystem and module identifiers in the log when the log format string contains "%S". By convention, the log format surrounds "%S" with brackets. The subsystem name is generally the same as the thread name. The module name is derived from the source code module name and usually consists of the first one or 2 segments of the name using the dash character as the segment delimiter.	4 years ago
Victor Julien	b31ffde6f4	output: remove error codes from output	4 years ago
Jason Ish	bd9adac3ac	rust/clippy: comments on why we have specific allows	4 years ago
Jason Ish	dfd7abe185	rust/clippy: fix lint: type_complexity ... Convert a DNS sub-parser to use a return type rather than a large tuple. For mqtt, allow the lint for now, but remove the global allow.	4 years ago
Jason Ish	e49ce49471	rust/clippy: allow result_unit_err in http2 only ... Its the only module making use of this pattern, but we shouldn't let new modules use this pattern.	4 years ago
Jason Ish	7ba2dadc7f	rust/clippy: fix lint: upper_case_acronyms	4 years ago
Jason Ish	029ac650d7	rust/clippy: fix lint: manual_find ... These get_tx methods look like ideal candidates for generic and/or derived methods.	4 years ago
Jason Ish	4940dfb3bd	rust/clippy: fix lint: len_without_is_empty	4 years ago
Jason Ish	e1cffd348f	rust/clippy: fix lint: field_reassign_with_default	4 years ago
Jason Ish	9df7c326b9	rust/clippy: remove allow: collapsible_else_if	4 years ago
Jason Ish	30ee5fc835	rust/clippy: remove allow: collapsible_if ... Already clean.	4 years ago
Jason Ish	da12b77f18	rust/clippy: fix lint: new_without_default	4 years ago
Jason Ish	c4cf062a6f	rust/clippy: fix lint: redundant_pattern_matching	4 years ago
Jason Ish	7c293ff68f	rust/clippy: fix lint: never_loop	4 years ago
Jason Ish	e8823644ec	rust/clippy: fix lint: nonminimal_bool	4 years ago
Jason Ish	53ae0c8a06	rust/clippy: fix lint: derive_partial_eq_without_eq	4 years ago
Jason Ish	5d62995e26	rust/clippy: fix lint: explicit_counter_loop	4 years ago
Jason Ish	f250b92180	rust/clippy: fix lint: extra_unused_lifetimes	4 years ago
Jason Ish	3044565cf4	rust/clippy: fix lint: needless_range_loop	4 years ago
Jason Ish	2ac52d0610	rust/clippy: remove lint: for_loops_over_fallibles ... Already clean.	4 years ago
Jason Ish	c026d8531b	rust/clippy: fix lint: match_ref_pats	4 years ago
Jason Ish	359d5fcb7e	rust/clippy: fix lint: needless_lifetimes	4 years ago
Jason Ish	4e001688de	rust/clippy: remove lint: bool_comparison ... Already clean.	4 years ago
Jason Ish	f15ffbc869	rust/clippy: fix lint: single_match ... Allow this lint in some cases where a match statement adds clarity.	4 years ago
Jason Ish	925bc74c1f	rust/clippy: fix lint: while_let_loop	4 years ago
Jason Ish	cf20fa1e67	template: import c_void, c_char, c_int ... These are ffi types that are commonly used, import them so they can be used by their short names instead of a fully qualified name.	4 years ago
Jason Ish	4220f18258	template: remove no_mangle and pub where not needed ... Extern functions that are only used as a function pointer do not require "pub" or "no_mangle".	4 years ago
Jason Ish	4a7567b3f0	template: rename template-rust to template ... Remove the distinction between the C template protocol "template" and the Rust template protocol "template-rust" and make the Rust parser simply template now that we no longer have support to generate a C protocol template.	4 years ago
Jason Ish	38321a213f	rust/app-layer-template: rustfmt	4 years ago
Jason Ish	50a787a9a3	app-layer-template-rust: remove C app-layer stub ... Remove the app-layer-PROTO stub for Rust based parsers. It is no longer needed as Rust parsers now contain the registration function in Rust. Ticket: 4939	4 years ago
Jason Ish	baa7021ee6	rust/conf: add fn conf_get_node ... A wrapper around ConfGetNode to get a configuration node by name.	4 years ago
Victor Julien	64c0459d2d	rust/lzma: clippy fixup	4 years ago
Jason Ish	35f99d1af7	rust/http2: fix clippy lint for is_empty() ... This snuck through as "cargo clippy" check wasn't finding lints that were fixed by the previous test for fixable lints.	4 years ago
Todd Mortimer	7d1a8cc335	file/swf: Use lzma-rs decompression instead of libhtp. ... Use the lzma-rs crate for decompressing swf/lzma files instead of the lzma decompressor in libhtp. This decouples suricata from libhtp except for actual http parsing, and means libhtp no longer has to export a lzma decompression interface. Ticket: #5638	4 years ago
Victor Julien	45eb038e63	smb: fix file reopening issue ... Fuzzing highlighted an issue where a command sequence on the same file id triggered a logging issue: file data for id N close id N file data for id N If this happened in a single blob of data passed to the parser, the existing file tx would be reused, the file "reopened", confusing the file logging logic. This would trigger a debug assert. This patch makes sure a new file tx is created for the file data coming in after the first file tx is closed. Bug: #5567.	4 years ago
Philippe Antoine	29f40c9e07	dcerpc: fix integer underflow ... as input.len() can be 65536, it cannot be directly cast to u16 Ticket: #5557	4 years ago
Jason Ish	91617f479a	rust: sha-1 is now sha1 ... This is the same crate, but renamed to be more consistent with the RustCrypto project naming. Some recent discussion is available here: https://github.com/RustCrypto/hashes/issues/438	4 years ago
Philippe Antoine	af44504550	smb: do not use tree id to match request and response ... Completes commit e94920b49f This must be true for access to state ssn2vecoffset_map Ticket: #5161	4 years ago
Victor Julien	cade6046c5	rust/files: open file without trackid as pointer	4 years ago
Victor Julien	ad869e1c52	rust/filecontainer: remove unused declaration	4 years ago
Philippe Antoine	086b28da3d	http2: fix decompression buffering ... It was not enough to set Cursor position to 0, also its inner Vec should be cleared. This way, a new input gets written at the beginning of the Cursor and its inner Vec... Ticket: #5691	4 years ago
Philippe Antoine	c6349d3cfc	http2: support padded data frames ... Ticket: #5691	4 years ago
Philippe Antoine	e1ee401a12	quic: use VecDeque ... Ticket: #5637	4 years ago
Philippe Antoine	286bd2a7ed	rust: fix cargo clippy --all-features	4 years ago
Philippe Antoine	bc287018e5	rust: cargo clippy --all-features --fix --allow-no-vcs	4 years ago
Philippe Antoine	cd4bf518f3	rust: fix warnings on rustc 1.67.0-nightly ... warning: for loop over an `Option`. This is more readably written as an `if let` statement	4 years ago
Juliana Fajardini	a654ef50de	pgsql: add test for parameter status parser ... Since we've done some changes to how the parameters are parsed, add one more test case to check that. Bug #5579	4 years ago
Juliana Fajardini	c4fbd78770	pgsql: move database into opt parameters list ... For StartupMessages, the database parameter is optional. This moves the parameter into the optional_parameters list. Bug #5579	4 years ago
Philippe Antoine	cc68898532	pgsql: support empty parameter values ... Bug #5579	4 years ago
Philippe Antoine	1e0190bc6b	pgsql: support out of order parameters for startup message ... As user can be not the first parameter Bug #5579	4 years ago
Jason Ish	1f056f9974	bittorrent-dht: parse and log node6 lists ... Node6 lists are just like node lists, but for IPv6 addresses.	4 years ago
Jason Ish	86d5ab8644	bittorrent-dht: remove tests that are no longer valid	4 years ago
Jason Ish	2f9eb5d1dd	bittorrent-dht: fix values decoding, as a list of peers ... The "values" field is not a string, but instead peer information in compact format. Decode this properly and then properly format in the log.	4 years ago
Jason Ish	4a0859beeb	jsonbuilder: add append_hex - add hex to array ... New method, append_hex to add a byte array to a JSON array in hex encoding.	4 years ago
Jason Ish	4bc9cf3986	bittorrent-dht: parse token and target as byte values	4 years ago
Jason Ish	5a30ee77a1	bittorrent-dht: only attempt to parse dht messages ... The bittorrent flow is shared with transport messages as well as dht messages. Only attempt to parse dht message as dht, ignore the rest.	4 years ago
Jason Ish	98a9391210	bittorrent-dht: decode node data structures ... Instead of decoding the nodes field into a blog of bytes, decode it into an array of node info objects, each with a node id, IP address and port.	4 years ago
Jason Ish	3cb50592ed	bittorrent-dht: convert some fields to byte arrays ... Some fields that were previously strings are not always value UTF-8 data, instead the protocol specification refers to them as strings of bytes, so in other words byte arrays. Currently fields converted are: - client_version - info_hash - response.id - request.id - nodes - token	4 years ago
Jason Ish	78ba17caa8	bittorrent-dht: register a pattern for protocol detection ... Removes the port based probing which takes a long time to register for ports 1024-65535 and instead use pattern based protocol detection.	4 years ago
Jason Ish	350c0723d7	bittorrent-dht: set parser to unidirectional ... This parser does not match up responses with requests so flag it as unidirectional.	4 years ago
Jason Ish	06eaec67ac	bittorrent: updates for new event handling ... Fixes anomaly events.	4 years ago
Aaron Bungay	86037885a9	bittorrent-dht: add bittorrent-dht app layer ... Parses and logs the bittorrent-dht protocol. Note: Includes some compilation fixups after rebase by Jason Ish. Feature: #3086	4 years ago
Haleema Khan	8d5c5f24a1	dns/eve: add 'HTTPS' type logging ... Add a new DNS record type to represent HTTPS Ticket: #4751	4 years ago
Alice Akaki	ccdc992a71	rust: fix lint warnings about mixed case hex literals ... Ticket: #4593	4 years ago
Gabriel Lima Luz	4e90d17fd9	rust: fix lint warnings about if same then else ... Ticket: 4609	4 years ago
Kristina Jefferson	9cd00424c3	rust: fix lint warnings about ptr_arg ... Ticket: #4599	4 years ago
Jason Ish	21bb697bc9	rust: fix clippy lint for unneeded late initialization	4 years ago
Jason Ish	7cca238128	rust: fix clippy lint for cmp_null is debug code ... Ticket: 5577	4 years ago