aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
9,029 Commits
7 Branches
155 Tags
195 MiB
master
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'ec0a7b22a5'
${ noResults }
Commit Graph

192 Commits (ec0a7b22a5802fa33bd01c484f0a81fddbee4dd9)

Author SHA1 Message Date
Jason Ish 27fd521420 eve/dns/v2: support eve/dns v2 in rust 7 years ago
Jason Ish 57d9574839 rust/json: expose more of jansson to rust 7 years ago
Victor Julien 71742ed52b smb: share can't be <share_root> 7 years ago
Victor Julien bc193242ad smb1: add OPEN_ANDX command name for logging 7 years ago
Victor Julien 32b19fac99 smb2: don't log/track each READ/WRITE/etc 7 years ago
Victor Julien fb986abe81 smb: log file FID/GUID as fuid 7 years ago
Victor Julien 816bd022a6 smb1: improve non nt-status handling 
Support SRV error, with a couple of codes.
Rename statux field to status_code.
 7 years ago
Victor Julien 0519807639 smb1: ignore tree_id in session setup 7 years ago
Victor Julien 286c054472 smb: improve nbss/smb record detection 7 years ago
Victor Julien 7ab071a58d rust/smb: implement minimal record parsing in probing 7 years ago
Victor Julien 283be3cade smb2: break out ioctl handling 7 years ago
Victor Julien bf08285602 smb2: parse async records 7 years ago
Victor Julien 5c26020714 smb2: add ioctl transactions to log the funcs 7 years ago
Victor Julien 75265ec376 smb2: map ioctl funcs to names 
List is based on Wireshark's list.
 7 years ago
Victor Julien 7cd66516f0 smb: use formal MS names for disposition 7 years ago
Victor Julien f7ed749d4f smb: disable debug output 7 years ago
Victor Julien eed492547c smb1: extract server guid from negotiate 7 years ago
Victor Julien 6d56edc3de smb2: log client and server guid from negotiate 7 years ago
Victor Julien c56f5e11ca smb2: log share type 7 years ago
Victor Julien d75ebdb981 smb: log create empty filename as '<share_root>' like Bro does 7 years ago
Victor Julien fcbeab70a4 smb1: log create 'service' fields 7 years ago
Victor Julien 90e2abaac4 smb1: use generic string parsing for trans 7 years ago
Victor Julien 76917a8732 smb1: generic smb string parse func 7 years ago
Victor Julien 668c747aee smb1: more exact tree connect record parsing 7 years ago
Victor Julien 0ed00cf104 smb: move common parsing funcs into own file 7 years ago
Victor Julien 1c701dc50e smb: make string parsing functions public 7 years ago
Victor Julien 1d4aac1d4d smb1: set event on empty/malformed dialect 7 years ago
Victor Julien c91242e71c smb: rename file to filename in output 7 years ago
Victor Julien caf29e92b3 smb1: parse and log timestamps in CREATE 7 years ago
Victor Julien 0e05ef7369 smb2: parse and log timestamps in CREATE 7 years ago
Victor Julien 28f16e38ac smb1: disable 'generic tx's for common commands 
Don't create a generic TX for each READ, WRITE, TRANS, TRANS2,
except if they cause events to trigger.
 7 years ago
Victor Julien 78cd92a933 smb: generic event per trans/read/write for tx events 7 years ago
Victor Julien 05992f1772 smb: fix event handling when no tx is available 7 years ago
Victor Julien be615c9fbc smb: small cleanups, fixes and optimizations 7 years ago
Victor Julien dab055d8c8 smb: update to der-parser 0.5.1 7 years ago
Victor Julien 0d69e7b8c2 smb: remove unused dialects from state 7 years ago
Victor Julien ad1bc7f473 smb1: minor debug improvment 7 years ago
Victor Julien a44504a1bf smb: redo gap catch up handling 7 years ago
Victor Julien 7114d5d25b smb1: parser cleanups 7 years ago
Victor Julien d9e43d3e63 smb: cleaner server component parsing 7 years ago
Victor Julien ecbf10da70 smb2: improve write error handling 7 years ago
Victor Julien b34392051d smb3: parse transform records 7 years ago
Victor Julien 894a73ee06 smb2: add missing commands and improve ioctl err handling 7 years ago
Victor Julien 170edf7c44 smb1: improve error handling 7 years ago
Victor Julien 7ceb67138f smb: add status 7 years ago
Victor Julien 98b926bf72 smb1: implement WRITE_AND_CLOSE 7 years ago
Victor Julien 595557eb8d smb1: locking andx may have no response 7 years ago
Victor Julien 7dff9b9969 smb/nbss: work around bad traffic 7 years ago
Victor Julien 8bef120898 smb: session setup improvements 
Improve ntlmssp version extraction and logging, make its data structures
optional. Extract native os/lm from smb1 ssn setup.

Move session setup handling into their own files.

Only log auth data for the session setup tx.
 7 years ago
Victor Julien 75d7c9d64a rust/smb: initial support 
Implement SMB app-layer parser for SMB1/2/3. Features:
- file extraction
- eve logging
- existing dce keyword support
- smb_share/smb_named_pipe keyword support (stickybuffers)
- auth meta data extraction (ntlmssp, kerberos5)
 7 years ago
Pierre Chifflier b69acaadf5 Rust: add 'debug' feature 
The 'debug' feature is enabled if suricata was configured with the
--enabled-debug' flag.
If enabled, the SCLogDebug format and calls the logging function as
usual. Otherwise, this macro is a no-op (similarly to the C code).
 7 years ago
Victor Julien 053022931c rust/json: add array_append_string 7 years ago
Victor Julien 73fac478a2 rust/dns: fix nom verbose error mode 7 years ago
Jason Ish c411519605 app-layer: remove has events callback - not used 7 years ago
Pierre Chifflier 92b537d028 rust: update 'external' api for app layer changes 
Remove unused HasTxDetectState function and remove state argument
from SetTxDetectState.

Update NTP code.
 7 years ago
Victor Julien f815027cdf rust/dns: simplify tx freeing 
Now that we no longer need the state when freeing a TX, we can simply
do cleanup from the Drop trait.
 7 years ago
Victor Julien 7548944b49 app-layer: remove unused HasTxDetectState call 
Also remove the now useless 'state' argument from the SetTxDetectState
calls. For those app-layer parsers that use a state == tx approach,
the state pointer is passed as tx.

Update app-layer parsers to remove the unused call and update the
modified call.
 7 years ago
Victor Julien 1c270cae13 nfs: remove old test code 7 years ago
Victor Julien e96d9c1159 app-layer: add tx iterator API 
Until now, the transaction space is assumed to be terse. Transactions
are handled sequentially so the difference between the lowest and highest
active tx id's is small. For this reason the logic of walking every id
between the 'minimum' and max id made sense. The space might look like:

    [..........TTTT]

Here the looping starts at the first T and loops 4 times.

This assumption isn't a great fit though. A protocol like NFS has 2 types
of transactions. Long running file transfer transactions and short lived
request/reply pairs are causing the id space to be sparse. This leads to
a lot of unnecessary looping in various parts of the engine, but most
prominently: detection, tx house keeping and tx logging.

    [.T..T...TTTT.T]

Here the looping starts at the first T and loops for every spot, even
those where no tx exists anymore.

Cases have been observed where the lowest tx id was 2 and the highest
was 50k. This lead to a lot of unnecessary looping.

This patch add an alternative approach. It allows a protocol to register
an iterator function, that simply returns the next transaction until
all transactions are returned. To do this it uses a bit of state the
caller must keep.

The registration is optional. If no iterator is registered the old
behaviour will be used.
 7 years ago
Pascal Delalande 80f2fbac6e rust/tftp: eve logging with rust 7 years ago
Clement Galland b9cf49e933 rust/tftp: add tftp parsing and logging 
TFTP parsing and logging written in Rust.
Log on eve.json the type of request (read or write), the name of the file and
the mode.

Example of output:
    "tftp":{"packet":"read","file":"rfc1350.txt","mode":"octet"}
 7 years ago
Victor Julien e8939335ea rust/nfs: explicitly handle GAPs from C 
It seems that Rust optimizes this code in such a way that it
passes the null ptr along as real data.

    if buf.as_ptr().is_null() && input_len > 0 {
 7 years ago
Victor Julien 2c3c8f8b85 rust/filetracker: if file API return error, trunc file 7 years ago
Victor Julien d27ed5957f rust/nfs: fix read reply handling 
READ replies with large data chunks are processed partially to avoid
queuing too much data. When the final chunk was received however, the
start of the chunk would already tag the transaction as 'done'. The
more aggressive tx freeing that was recently merged would cause this
tx to be freed before the rest of the in-progress chunk was done.

This patch delays the tagging of the tx until the final data has been
received.
 7 years ago
Victor Julien 3a2e4614d0 rust/file: handle file open errors 7 years ago
Victor Julien 45c5030ff0 rust/file: change return type for FileOpenFileWithId 
Make it int so we can easily check it in Rust. No consumer used the
File pointer that was returned before anyway.
 7 years ago
Victor Julien 288ddc95ac rust/core: comment cleanup 7 years ago
Victor Julien 8cda2a4351 rust/nfs: add support for detect_flags API 7 years ago
Victor Julien 98eca55241 rust/dns: implement detect_flags API 7 years ago
Pierre Chifflier 4b6555588f NTP: ensure parser name is not freed after registration 7 years ago
Pierre Chifflier ec62eedc87 Rust: remove deprecated functions LoggerFlags::get_logged/set_logged 7 years ago
Pierre Chifflier 5c6868b327 NTP: update logger to use new API 7 years ago
Victor Julien bca0cd71ae app-layer: use logger bits to avoid looping 
Avoid looping in transaction output.

Update app-layer API to store the bits in one step
and retrieve the bits in a single step as well.

Update users of the API.
 7 years ago
Victor Julien e1e9ada9df rust/nfs: improve file close handling 7 years ago
Nick Price 350b5d99ce rust/nfs: don't panic on malformed NFS traffic 
Instead set events.
 7 years ago
Pierre Chifflier f5b27ae767 Rust: fix probing function prototype: change sign and add Flow 7 years ago
Eric Leblond b0a6934431 app-layer-ftp: add ftp-data support 
Use expectation to be able to identify connections that are
ftp data. It parses the PASV response, STOR message and the
RETR message to provide extraction of files.

Implementation in Rust of FTP messages parsing is available.

Also this patch changes some var name prefixed by ssh to ftp.
 7 years ago
Jason Ish 5a8537fe4a rust/dns - convert more type values to text 
Issue:
https://redmine.openinfosecfoundation.org/issues/2364

Convert more record type and errr code values to text.
Remove duplicate type declarations.
 7 years ago
Clément Galland 3396747cd6 Dns logger display flags information 7 years ago
Pierre Chifflier 83808bbdad rust/ntp: convert parser to new registration method 
Converting the NTP parser to the new registration method is a simple,
3-steps process:
- change the extern functions to use generic input parameters (functions
  in all parsers must share common types to be generic) and cast them
- declare the Parser structure
- remove the C code and call the registration function
 7 years ago
Pierre Chifflier e7c0a53cbf rust/applayer: add registration iface for parsers 
Add Rust support for the common interface to declare and register all
parsers.

Add a common structure definition to contain all required elements
required for registering a parser, similar to the C interface.
This also reduces the risk of incorrectly registering a parser: the
compiler prevents omitting required functions from the structure, and
functions (even if external) are type-checked. Optional functions are
explicitly marked.
 7 years ago
Victor Julien d9e5dfa1f0 rust/file: improve truncation handling 7 years ago
Victor Julien e023ce9aad rust/dns: fix new warning in rustc 1.21 7 years ago
Victor Julien fd38e5e82b rust/nfs: fix new warnings in rustc 1.21 7 years ago
Pierre Chifflier e4129c1568 Rust/Lua: cast value to arch-dependant type (fix build on x86, #2197) 8 years ago
Jason Ish 6a4cefb7c5 rust: --enable-rust-strict to turn warnings into errors 8 years ago
Jason Ish 3063851d85 rust/dns/tcp - probe even if payload is short 
As the DNS probe just uses the query portion of a response, don't
require there to be as many bytes as specified in the TCP DNS
header. This can occur in large responses where probe is called
without all the data.

Fixes the cases where the app proto is recorded as failed.

Fixes issue:
https://redmine.openinfosecfoundation.org/issues/2169
 8 years ago
Victor Julien a306ccfd34 rust/nfs: implement events 
Remove lots of panic statements in favor of setting non-fatal events.

Bug #2175.
 8 years ago
Victor Julien 82bd732f4e rust/nfs: improve proto detect 8 years ago
Victor Julien 6b4a04510a rust/nfs: remove debug rec_size check 
Records larger than 40k are perfectly valid.

Bug #2162.
 8 years ago
Jason Ish 40991cab82 rust/dns: handle multiple txt strings 
Fix handling of TXT records when there are multiple strings
in a single TXT record. For now, conform to the C implementation
where an answer record is created for each string in a single
txt record.

Also removes the data_len field from the answer entry. In Rust,
the length is available from actual data, which after decoding
may actually be different than the encoded data length, so just
use the length from the actual data.
 8 years ago
Pierre Chifflier 8a0549c42e NTP: change parse function to return the number of parsed messages 8 years ago
Pierre Chifflier efe11dc37e Add NTP parser (rust-experimental) 8 years ago
Jason Ish f5a90e26a9 rust: for sclog*, strip nul bytes before logging 8 years ago
Jason Ish 717b826d25 rust: safe string handling in logging 
In logging (SCLog*), safely convert strings to cstrings instead
of blindly unwrapping them.

Also implement a simple rust logger if the Suricata C context
is not available.
 8 years ago
Victor Julien 7c119cc595 nfs: log number of chunks that xfer'd a file 8 years ago
Victor Julien e8dae2e093 nfs: add to fileinfo events 8 years ago
Victor Julien db2d928151 rust/nfs: add (file)handle to log as crc32 8 years ago
Jason Ish 829155b9d5 rust/dns: pass byte arrays directly to rust/json 
Using the json.set_string_from_bytes which will
safely convert the bytes printable ascii string
before logging.
 8 years ago
Jason Ish 96cc503026 rust/lua: use lua_pushlstring for strings 
Lua strings can contain NULLs, and Rust strings are UTF8 which
can also contain NULLs. Use pushlstring so a NULL containing
string can be pushed.
 8 years ago