suricata

Commit Graph

Author	SHA1	Message	Date
Pierre Chifflier	ce652511bd	rust/tftp: convert parser to nom7 functions	3 years ago
Pierre Chifflier	c525a1337c	rust/dns: convert parser to nom7 functions	3 years ago
Pierre Chifflier	74be8b94ec	rust/ssh: convert parser to nom7 functions	3 years ago
Pierre Chifflier	8a584c211e	rust/mqtt: convert parser to nom7 functions	3 years ago
Pierre Chifflier	d27125d77a	rust/sip: convert parser to nom7 functions	3 years ago
Pierre Chifflier	1046a7d1a3	rust/ftp: convert parser to nom7 functions	3 years ago
Pierre Chifflier	ebd5883da8	rust/dhcp: convert parser to nom7 functions	3 years ago
Pierre Chifflier	17170c41aa	rust: add nom7 dependency	3 years ago
Modupe Falodun	a87c7e5c08	rust: remove unnecessary nested match Bug: #4605	3 years ago
Modupe Falodun	74c39500c3	rust: fix inherent to string Bug: OISF#4618	3 years ago
Sam Muhammed	922a453da5	rust(lint): use is_null() instead of ptr::null_mut() Bug: #4594	3 years ago
Sam Muhammed	23768c7181	rust(lint): use is_null() instead of ptr::null() Bug: #4594	3 years ago
Sam Muhammed	da0a976e23	rust(lint): use let for binding single value `match` is better used with binding to multiple variables, for binding to a single value, `let` statement is recommended. Bug: #4616	3 years ago
Philippe Antoine	5bd065cb3c	range: checks that end is after start for HTTP2 As was done only for HTTP1 in previous commit The verification part stays separated from the parsing part, as we want to keep on logging invalid ranges values.	3 years ago
Philippe Antoine	accdad7881	ike: do not keep server transforms in state Fixes #4534 Now, only the tx with the transforms will match with ike.chosen_sa_attribute	3 years ago
Philippe Antoine	83887510a8	modbus: tx iterator When there are a lot of open transactions, as is possible with modbus, the default tx_iterator will loop for the whole transacations vector to find each transaction, that means quadratic complexity. Reusing the tx_iterator from the template, and keeping as a state the last index where to start looking avoids this quadratic complexity.	3 years ago
Philippe Antoine	ea4a509a54	app-layer: disable by default if not in configuration DNP3, ENIP, HTTP2 and Modbus are supposed to be disabled by default. That means the default configuration does it, but that also means that, if they are not in suricata.yaml, the protocol should stay disabled.	3 years ago
Philippe Antoine	8e8899c90c	http2: range: check return value when opening HttpRangeContainerOpenFile can return NULL so, http2_range_open can set file_range to NULL And we should check this before calling http2_range_close	3 years ago
Philippe Antoine	cb30772372	style: remove latest warnings about unused variables	3 years ago
Philippe Antoine	98f84d5a9b	http2: follow range requests Move the content-range parsing code to rust	3 years ago
Philippe Antoine	56fae072b2	http2: better rust lifetimes so that borrow check gets happy	3 years ago
Philippe Antoine	a1f9e0c97a	rust: rename to StreamingBufferConfig as in C	3 years ago
Shivani Bhardwaj	42da0fb5c5	smb: fix broken stream depth setting The stream depth setting was broken since it was moved to Rust because of a missing parser for memory values in configuration. Use get_memval fn from conf.rs to calculate and fetch the correct values.	3 years ago
Shivani Bhardwaj	0cfe512ef0	rust/conf: add getter for memval Add a parser for memory values like 50kb, 20mb, etc on the Rust side.	3 years ago
Shivani Bhardwaj	f3fcc39738	ssh: remove futile default port setting	3 years ago
Shivani Bhardwaj	1f48714e75	smb: remove futile default port setting	3 years ago
Shivani Bhardwaj	13741540ce	rfb: remove futile default port setting	3 years ago
Shivani Bhardwaj	7c9d573800	nfs: remove futile default port setting	3 years ago
Shivani Bhardwaj	f4f6387a00	dcerpc: use null for default ports	3 years ago
Philippe Antoine	596a4a9d6e	http2: better rust style	3 years ago
Philippe Antoine	48ed874dda	http2: concatenate one headers multiple values For detection, as is done with HTTP1	3 years ago
Philippe Antoine	e3ff0e7731	http2: generic http2_header_blocks so as not to forget continuation and push promise when iterating over headers	3 years ago
Philippe Antoine	0b0649d98e	http2: http.header keyword now works for HTTP2 As well as http.header.raw	3 years ago
Philippe Antoine	9b9f909d7d	http2: http.header_names keyword now works for HTTP2	3 years ago
Philippe Antoine	547e9f4ab4	http2: http.host normalized keyword now works for HTTP2	3 years ago
Philippe Antoine	75f75e1eb0	http2: turn Host header into authority during upgrade HTTP1 uses Host, but HTTP2 uses rather :authority cf HPACK	3 years ago
Philippe Antoine	bb98a18b3d	http2: better file tracking If an HTTP2 file was within only ont DATA frame, the filetracker would open it and close it in the same call, preventing the firther call to incr_files_opened Also includes rustfmt again for all HTTP2 files	3 years ago
Philippe Antoine	1378b2f451	http2: support deflate decompression cf #4556	3 years ago
Victor Julien	c9cee7af49	smb: add debug validation on file counts	3 years ago
Victor Julien	114d3ba730	smb: count files in tx	3 years ago
Victor Julien	c1dfb619c4	http2: support per-tx file accounting	3 years ago
Victor Julien	1b3c3225cd	nfs: add debug validation on file counts	3 years ago
Victor Julien	1d48601c25	nfs: support per-tx file accounting	3 years ago
Victor Julien	67759795c6	nfs: don't reuse file transactions After a file has been closed (CLOSE, COMMIT command or EOF/SYNC part of READ/WRITE data block) mark it as such so that new file commands on that file do not reuse the transaction. When a file transfer is completed it will be flagged as such and not be found anymore by the NFSState::get_file_tx_by_handle() method. This forces a new transaction to be created.	3 years ago
Victor Julien	56d3e28a3a	filestore: track files getting stored per tx Avoid evicting a tx before the filedata logger has decided it is done.	3 years ago
Victor Julien	c78f5ac316	app-layer/transactions: track files opens and logs To make sure a transaction is not evicted before all file logging is complete.	3 years ago
Philippe Antoine	9b8be5a650	smb: get file name in case of chained commands	3 years ago
Philippe Antoine	3e5f59e2cb	smb: fix parsing of file deletion over SMB1	3 years ago
Philippe Antoine	fde753d9d2	smb: recognizes file deletion over SMB2 using set_info_level == SMB2_FILE_DISPOSITION_INFO	3 years ago
Jason Ish	71679c6ad0	ike: use derive macro from app-layer events	3 years ago
Jason Ish	eb55297876	modbus: use derive macro from app-layer events	3 years ago
Jason Ish	d3bd008e33	app-layer template: use derived app-layer event	3 years ago
Jason Ish	cef2832dcf	http2: use derived app-layer event	3 years ago
Jason Ish	e92cb36bb8	krb5: use derived app-layer event	3 years ago
Jason Ish	92561837f8	ntp: use derived app-layer event	3 years ago
Jason Ish	1f71fb2cde	rfb: register None for get_event_info/get_event_info_by_id Implementations are not required if they're just going to return -1. We allow None to be registered for that.	3 years ago
Jason Ish	4fd6aa866f	sip: use derived app-layer event	3 years ago
Jason Ish	18448f6ed6	snmp: use derived app-layer event	3 years ago
Jason Ish	bb094b17db	ssh: use derived app-layer event	3 years ago
Jason Ish	9c3f06d9b5	dhcp: use derived app-layer event	3 years ago
Jason Ish	b9f10ba22f	smb: use derived get_event_info/get_event_info_by_id	3 years ago
Jason Ish	8eac5fc221	mqtt: derive AppLayerEvent for MQTTEvent	3 years ago
Jason Ish	6ed827a4ef	dns: use derive macro for DNSEvent	3 years ago
Jason Ish	9221f1d9d5	applayerevent: derive get_event_info and get_event_info_by_id Add generation of wrapper functions for get_event_info and get_event_info_by_id to the derive macro. Eliminates the need for the wrapper method to be created by the parser author.	3 years ago
Jason Ish	0fa7b5c2a2	rust/applayer: provide generic event info functions Provide generic functions for get_event_info and get_event_info_by_id. These functions can be used by any app-layer event enum that implements AppLayerEvent. Unfortunately the parser registration cannot use these functions directly as generic functions cannot be #[no_mangle]. So they do need small extern "C" wrappers around them.	3 years ago
Jason Ish	27d1ee98ce	rust: derive crate: for custom derives Currently has one derive, AppLayerEvent to be used like: #[derive(AppLayerEvent)] pub enum DNSEvent { MalformedData, NotRequest, NotResponse, ZFlagSet, } Code will be generated to: - Convert enum to a c type string - Convert string to enum variant - Convert id to enum variant	3 years ago
Jason Ish	dbea7d636f	rust/applayer: define AppLayerEvent trait The derive macro will implement this trait for app-layer event enums.	3 years ago
Jason Ish	cf21694ba6	rust(lint): suppress clippy lints that we should fix Suppress all remaining clippy lints that we trip. This can be fixed on a per-lint basis.	3 years ago
Jason Ish	91402f9fba	rust(lint): remove manual implement of map method Using `if let` expressions in these cases is better expressed by the map method, and considered idiomatic Rust for this usage.	3 years ago
Jason Ish	b021726a0d	rust(lint): map the error instead of using or_else This is the preffered style and easier to understand the meaning of the code.	3 years ago
Jason Ish	dcf57ecd96	rust(lint): replace push_str of single char to push(<char>)	3 years ago
Jason Ish	d5c0962299	rust(lint): fix some usages of references - ref is discouraged for top level variables - the other borrow is not required	3 years ago
Jason Ish	d0772e04b1	rust(lint): replace checked_mul with saturating_mul When defaulting checked_mul to u64::max, Rust has a method that does the same thing called saturating_mul.	3 years ago
Jason Ish	d0be7541e9	rust(lint): removed unused unit () return This is code that is not needed and is a bit confusing to see.	3 years ago
Jason Ish	4abbfd0d97	rust(lint): remove extra parens around bitwise or This is a readability fix, as on first look they almost look like a Rust tuple.	3 years ago
Jason Ish	ac3a20b6e0	rust(lint): remove useless conversions and clones These add complexity and may not be optimized out by the compiler.	3 years ago
Jason Ish	8bb6dab69d	rust(lint): remove useless format calls In these simple cases to_string() is recommended and likely performs better as the formatter is not called.	3 years ago
Jason Ish	5bf5de3350	rust(lint): don't use unwrap_or for function calls Calling a function in unwrap_or causes that function to always be called even when not needed. Instead use unwrap_or_else with a closure which will only be called when needed.	3 years ago
Jason Ish	602bb05e75	rust(lint): fix redundant closures This lint checks for a closure where a function can be directly supplied. Runtime performance is unchanged, but this makes less work for the compiler.	3 years ago
Jason Ish	69cf5c9eea	rust(lint): remove needless borrows These are needless borrows (references) as the item is already a reference.	3 years ago
Jason Ish	363b5f99c3	rust: functions that reference raw pointers are unsafe Based on the Rust clippy lint that recommends that any public function that dereferences a raw pointer, mark all FFI functions that reference raw pointers with build_slice and cast_pointer as unsafe. This commits starts by removing the unsafe wrapper inside the build_slice and cast_pointer macros then marks all functions that use these macros as unsafe. Then fix all not_unsafe_ptr_arg_deref warnings from clippy. Fixes clippy lint: https://rust-lang.github.io/rust-clippy/master/index.html#not_unsafe_ptr_arg_deref	3 years ago
Jason Ish	53413f2d7a	rust: remove all usage of transmute All cases of our transmute can be replaced with more idiomatic solutions and do no require the power of transmute. When returning an object to C for life-time management, use Box::into_raw to convert the boxed object to pointer and use Box::from_raw to convert back. For cases where we're just returning a pointer to Rust managed data, use a cast.	3 years ago
Victor Julien	9d24a53c53	nfs: minor code cleanup	3 years ago
Victor Julien	aa9d8658ef	smb: minor formatting fixup	3 years ago
Victor Julien	094208823b	smb: minor code cleanup	3 years ago
Shivani Bhardwaj	0a1747c1ba	nfs: fix comment	3 years ago
Shivani Bhardwaj	58ac9b0f38	nfs: Add rust registration function Get rid of the C glue code and move registration completely to Rust.	3 years ago
Shivani Bhardwaj	61fca4e9db	nfs: add missing code from rust impl of fns	3 years ago
Shivani Bhardwaj	de50ac631e	nfs: Change fn sign as per rust registration requirement Registering parsers in Rust requires signatures to be a certain way and compatible with C. Change signatures of all the functions. Probe fn has also been changed to return AppProto as required by the new fn signature.	3 years ago
Shivani Bhardwaj	e5c948df87	smb: Add rust registration function Get rid of the C glue code and move registration completely to Rust.	3 years ago
Shivani Bhardwaj	27af4bb002	smb: add missing code from rust impl of fns	3 years ago
Shivani Bhardwaj	6420df84b7	smb: Change fn sign as per rust registration requirement Registering parsers in Rust requires signatures to be a certain way and compatible with C. Change signatures of all the functions.	3 years ago
Shivani Bhardwaj	4d6b6b5dfe	smb: add constants	3 years ago
Shivani Bhardwaj	d1ea00521b	rust/core: Add flow flags	3 years ago
Jason Ish	222e55847c	flow: provide flags accessor function Add an accessor function for flow flags. To be used by Rust where the flow struct is an opaque data type.	3 years ago
Shivani Bhardwaj	cb8bd8c669	rust/applayer: add more externs	3 years ago
Philippe Antoine	31dccd1171	modbus: do not claim to handle gaps	3 years ago
Sascha Steinbiss	d541b3d4a8	rust: fix warnings with nightly	3 years ago
Philippe Antoine	9e7ea631b2	dns: improve probing parser Checks opcode is valid Checks additional_rr do not exceed message length Better logic for incomplete cases	3 years ago
Philippe Antoine	6f03ee2e47	dcerpc: handles bigger inputs than 2^16 By comparing integers with the largest size	3 years ago
Philippe Antoine	7d0a39412b	detect: use u32 for InspectionBufferMultipleForList So that we do not have an endless loop casting index to u16 and having more than 65536 buffers in one transaction Changes for all protocols, even ones where it is impossible to have such a pattern, so as to avoid bad pattern copy/paste in the future	3 years ago
Philippe Antoine	b3c1f2ab48	nfs: improve probing parser Checks credentials flavor is known	3 years ago
Philippe Antoine	39575e2cc9	modbus: use ascii character classes while parsin rule As the rust regex crate is unicode aware, which was not the case of the C version	3 years ago
Philippe Antoine	ef5755338f	rust: SCLogDebug is real nop when built as release Before, even if there were no outputs, all the arguments were evaluated, which could turn expensive All variables which are used only in certain build configurations are now prefixed by underscore to avoid warnings	3 years ago
Victor Julien	20e8f90981	http2: set Debug on structs	3 years ago
Victor Julien	3587033d9e	files: construct with default, free on drop Update protocols.	3 years ago
Victor Julien	d757545f03	files: implement default support	3 years ago
Philippe Antoine	fdab22d924	rust: fix app-layer parser flags This especially allows for SSH bypass to work	3 years ago
Jeff Lucovsky	aa8871a5be	rust/default: Enable Default usage	3 years ago
Jeff Lucovsky	6028ca7827	nfs: Rework constructs to use Self/Default	3 years ago
Jeff Lucovsky	aafb0a60b7	dhcp: Rework constructs to use Self/Default	3 years ago
Jeff Lucovsky	1ef0bd580b	dcerpc: Rework constructs to use Self/Default	3 years ago
Jeff Lucovsky	00167121dc	dns: Rework constructs to use Self/Default	3 years ago
Jeff Lucovsky	02dccb1529	smb: Rework constructs to use Self/Default This commit modifies the constructors to use Self and/or Default::default() when feasible	3 years ago
Jeff Lucovsky	f502f21f9e	rust/default: Enable Default usage in SMB	3 years ago
Shivani Bhardwaj	581cb6223d	dcerpc/udp: Add rust registration function Get rid of the C glue code and move registration completely to Rust.	3 years ago
Shivani Bhardwaj	d7007424bd	dcerpc/udp: Change fn sign as per rust registration requirement Registering parsers in Rust requires signatures to be a certain way and compatible with C. Change signatures of all the functions.	3 years ago
Shivani Bhardwaj	bac69af7e4	dcerpc: Add rust registration function Get rid of the C glue code and move registration completely to Rust.	3 years ago
Shivani Bhardwaj	a0a09a102b	dcerpc: Change fn sign as per rust registration requirement Registering parsers in Rust requires signatures to be a certain way and compatible with C. Change signatures of all the functions.	3 years ago
Shivani Bhardwaj	dee972b863	rust/core: Make AppProto type u16	3 years ago
Shivani Bhardwaj	d66ad96f0d	applayer/rust: add extern AppLayerProtoDetectPMRegisterPatternCSwPP	3 years ago
Victor Julien	d7c3ecb6f9	http2: remove dead code	3 years ago
Philippe Antoine	b3c502d572	http2: remove assertion which can be wrong Brotli decoder stops consuming input it it reaches the end of its input	3 years ago
Simon Dugas	c2720fc2fb	modbus: fix quantity and count calculation The [Modbus Spec S6.11](https://modbus.org/docs/Modbus_Application_Protocol_V1_1b.pdf) clearly states that the `count = quantity / 8` and not the other way around. This is fixed in sawp-0.5.0.	3 years ago
Philippe Antoine	999327ba1f	http2: http.cookie keyword now works for HTTP2	3 years ago
Philippe Antoine	df039555bc	http2: http.host.raw keyword now works for HTTP2	3 years ago
Philippe Antoine	1e82d0b3c8	http2: http.method keyword now works for HTTP2	3 years ago
Philippe Antoine	017e39d8fd	http2: makes all HTTP1 header keywords work	3 years ago
Simon Dugas	a8a51dc004	modbus: add eve logging	4 years ago
Simon Dugas	8342641477	modbus: move tests from c to rust Move tests in a seperate commit so that we can use the previous one for regression testing. This also gets rid of the temporary glue that made the C tests work with the rust implementation.	4 years ago
Simon Dugas	a458a94dca	modbus: move from C to rust Adds a new rust modbus app layer parser and detection module. Moves the C module to rust but leaves the test cases in place to regression test the new rust module.	4 years ago
frank honza	f83d51d0cb	ike: set event for multiple server proposals	4 years ago
Philippe Antoine	ca6e434e0b	ftp: completely parses pasv and epsv responses	4 years ago
Philippe Antoine	6fe8bce3b0	http2: have filecontainer for both directions	4 years ago
Jason Ish	c7f44447c9	dns: remove flood protection purging It doesn't look like flood protection is required with the stateless parser anymore. It actually can get in the way of TCP DNS when a large number of requests end-up in the same segment where a TX can get purged before it has a chance to go through the normal TX life-cycle.	4 years ago
Shivani Bhardwaj	c663ac6ddd	dcerpc/tcp: improve detection Lately, some of the TLS data was misdetected as DCERPC/TCP because of the pattern \|05 00\|. Add more checks in DCERPC probe function to ensure that it is in fact DCERPC/TCP.	4 years ago
Philippe Antoine	d2d0e0adc9	rust: remove exported unused functions	4 years ago
Philippe Antoine	6da9a37285	rdp: correctly returns incomplete in parse_tc Adding the already consumed bytes In case an incomplete tls handshake is handled with/after a refular rdp t123_tpkt	4 years ago
Philippe Antoine	3de0123ffb	http2: adds check about dynamic headers table size	4 years ago
Philippe Antoine	1ca4f041bb	http2: pass data through when decompression fails as is done for HTTP1	4 years ago
Juliana Fajardini	c6a35d09b7	templates: fix typos - templatefiles[ch][rs]: fix typos - scripts/setup-app-layer: fix typos	4 years ago
Jason Ish	6853bf98fb	dns: only register a single logger DNS no longer requires a logger to be registered for to-client and to-server directions. This has not been required with the stateless design of the Rust DNS parser.	4 years ago
Philippe Antoine	0105d4f017	rust: bump bitflags dependency version So that lexical-core, needed by nom, and using bitflags is used with version 0.7.5 instead of version 0.7.0 which fixed the fact that BITS is now a reserved keyword in nightly version	4 years ago
Philippe Antoine	cb150e97d0	kerberos: fix probing parser tag condition according to the comment	4 years ago
Sascha Steinbiss	e2dbdd7fd5	ikev1: add ikev1 parser	4 years ago
frank honza	ecdf9f6b0b	ikev1: rename ikev2 to common ike Renaming was done with shell commands, git mv for moving the files and content like find -iname '*.c' \| xargs sed -i 's/ikev1/ike/g' respecting the different mixes of upper/lower case.	4 years ago
frank honza	ab6171c429	detect: added support for protocol-aliases	4 years ago
frank honza	e9494ddd8f	util: add function converting u8-array into a hex-String	4 years ago
Philippe Antoine	8307010255	smb: relax probing parser to handle first NBSS message cf dcerpc-udp S-V test : First message is Message Type: Session request (0x81) Second message is SMB	4 years ago
Philippe Antoine	1b6e81cd72	smb: probing parser for start and midstream The probing parser is more strict at the start of the stream	4 years ago
Philippe Antoine	9dc5258a21	smb: split probing function for code style Introduces rs_smb_probe_tcp_midstream	4 years ago
Shivani Bhardwaj	0ac5c5376a	dcerpc: trigger raw assembly on record completion	4 years ago
Shivani Bhardwaj	c77c8e7005	rust/context: add AppLayerParserTriggerRawStreamReassembly	4 years ago
Philippe Antoine	2d14606224	smb: andx support Add AndX support for SMB1. Finishes #3475. [Updated by Victor Julien to split functions]	4 years ago
Shivani Bhardwaj	f967a49104	dcerpc/udp: improve detection Lately, Wireguard proto starting w pattern \|04 00\| is misdetected as DCERPC/UDP which also starts with the same pattern, add more checks to make sure that it is the best guess for packet to be dcerpc/udp.	4 years ago
Shivani Bhardwaj	3641f1b522	dcerpc: add probe function	4 years ago
Shivani Bhardwaj	d7a3523b12	rust/applayer: split EOF flag per direction	4 years ago
Shivani Bhardwaj	0ca8591994	dcerpc/udp: remove transmute The book defines transmute as "This is really, truly, the most horribly unsafe thing you can do in Rust. The guardrails here are dental floss." Transmute can result into mind boggling undefined behaviors. Get rid of it wherever possible.	4 years ago
Philippe Antoine	c6aadf0dfa	protodetect: rename direction to flags And use whole flags in AppLayerProtoDetectPPGetProto	4 years ago
Philippe Antoine	5465e0b154	http2: http.stat_msg keyword now works for HTTP2	4 years ago
Philippe Antoine	47928babfc	http2: http.user_agent keyword now works for HTTP2	4 years ago
Philippe Antoine	a98d0fe6ed	http2: http.uri keyword now works for HTTP2 cf #4067	4 years ago
Philippe Antoine	707f027231	protos: renaming ALPROTO_HTTP* constants Having now ALPROTO_HTTP1, ALPROTO_HTTP2 and ALPROTO_HTTP Run with 3 sed commands git grep ALPROTO_HTTP \| cut -d: -f1 \| uniq \| xargs sed -i -e 's/ALPROTO_HTTP/ALPROTO_HTTP1/g' git grep ALPROTO_HTTP12 \| cut -d: -f1 \| uniq \| xargs sed -i -e 's/ALPROTO_HTTP12/ALPROTO_HTTP2/g' git grep ALPROTO_HTTP1_ANY \| cut -d: -f1 \| uniq \| xargs sed -i -e 's/ALPROTO_HTTP1_ANY/ALPROTO_HTTP/g' and then running clang-format	4 years ago
Jason Ish	dbae17dbc0	install: makefile target to install libraries As we don't install the libraries by default, provide a make target, "install-library" to install the libsuricata library files. If shared library support exists, both the static and shared libraries will be installed, otherwise only the static libraries will be installed.	4 years ago
Jason Ish	a178ec6bef	rust: rename lib to libsuricata_rust Previously it was libsuricata.a, but eventually we want to get to a place where libsuricata.a is a combination of the Rust and C code.	4 years ago
Jason Ish	9f20297cb3	rust/Makefile: add Cargo.toml as make dependency This will force Cargo.toml to be recreated if Cargo.toml.in is modified.	4 years ago
Jason Ish	3ada5e1480	rust/ffi: provide AppLayerRegisterParser in context AppLayerRegisterParser was creating a link error when attempting to use a convenience library for the Suricata C code, then linking the library of C code with the library of Rust code into a final Suricata executable, or use with fuzz targets. By moving AppLayerRegisterParser to the context structure and calling it like a callback the circular reference is removed allowing the convenience libraries to work again. This is also a stepping block to proving a Suricata library as a single .a or .so file.	4 years ago
Philippe Antoine	32b604e8c7	template: use response_gap in rust parser	4 years ago
Victor Julien	3f807f3bf6	rust: update dependencies	4 years ago
Victor Julien	ebde15f0e2	rust: lock all major crate versions To avoid surprises with dependencies bumping MSRV.	4 years ago
Victor Julien	4b5af36061	rust: relax nom version to any >=5.1.1	4 years ago
Philippe Antoine	d861228214	http2: decompression for files gzip and brotli decompression for files	4 years ago
Philippe Antoine	2e46b5d100	rust: BIT_U16 macro utility	4 years ago
Philippe Antoine	aee8e60149	rust: better panic message for missing file config	4 years ago
Philippe Antoine	8ac363c34d	rust: fix warning about unused values in smb tests	4 years ago
Jason Ish	0a3b9e0220	rust/hashing: add function to finalize md5 to hex string New function, SCMd5FinalizeToHex to finalize an md5 hash to a hex string.	4 years ago
Jason Ish	26c1321668	rust/hashing: function to md5 hash buffer to hex Add function SCMd5HashBufferToHex to hash a single buffer to an md5 hex string.	4 years ago
Jason Ish	0f714be9f3	rust/hashing: method to SHA256 and finalize in one call Add SCSha256HashBuffer to hash a single buffer returning the result.	4 years ago
Jason Ish	eb5cfd9b82	rust/hashing: new function to SHA1 hash a single buffer SCSha1HashBuffer will has a single buffer and compute the digest in one call.	4 years ago
Jason Ish	ff37526c6b	rust: remove md5 crate, unalias md-5 Remove the md5 crate as a dependency as it is no longer removed. We now use md-5 from RustCrypto.	4 years ago
Jason Ish	0a2d8509c9	rust/ssh: use md-5 crate instead of md5 The "md-5" crate is part of the RustCrypto project that also uses the sha1 and sha256 crates we are using. These all implement the Digest trait for a common API.	4 years ago
Jason Ish	1022b217ed	rust/hashing: a method to md5 hash a single buffer Add SCMd5HashBuffer as a replacement for NSS HASH_HashBuf as used in ja3 to hash a single buffer.	4 years ago
Jason Ish	46ceb13c08	rust: add ffi module for sha256, sha1 and md5 Add a Rust module that exposes Rust implementations of sha256, sha1 and md5 from the RustCrypto project. This is an experiment in replacing the libnss hash functions with pure Rust versions that will allow us to remove nss as a compile time option. Initial tests are good, even with a 10% or so performance improvement when being called from C. Also trying a module naming scheme where modules under the ffi modules are purely for exports to C, as it doesn't make any sense to use this new hashing module directly from Rust.	4 years ago
Jeff Lucovsky	8ce2078a38	tftp: Add test cases This commit adds test cases for the TFTP parser.	4 years ago
Jeff Lucovsky	e900b6d265	tftp: Improve parser This commit improves TFTP parsing by ensuring the mode and opcode are valid.	4 years ago
Jason Ish	f77fd0c0cb	rust: include file cleanup The cbindgen generated header should not include rust.h as rust.h already includes the generated binding. Fixup C source code that only pulled the generated include, it should instead pull in "rust.h" which includes the generated binding plus other misc. stuff.	4 years ago
Juliana Fajardini	e33bbee9b7	nbss: add parser tests Add tests to parse_nbss_record and parse_nbss_record_partial	4 years ago
Juliana Fajardini	5226ba1c15	Rust: generic files definition Issue: Optimization 3825 - filecontainer: add Files structure, to replace/unify SMBFiles, NFSFiles and HTTP2Files - smb/files: delete SMBFiles implementation - smb/smb: replace SMBFiles with Files - nfs/nfs: delete NFSFiles implementation, replace its former declarations with Files' ones - http2/http2: replace HTTP2Files with Files - http2/mod: Delete reference to file files.rs - http2/files: Delete	4 years ago
Sascha Steinbiss	a4556c9427	dns: use rest() for NULL parsing	4 years ago
Sascha Steinbiss	81b206a5f4	dns: add test for SRV	4 years ago
Sascha Steinbiss	08a6f1441a	dns: parse SRV records	4 years ago
Antti Tönkyrä	f3ad7f14fa	dns: add rdata logging for NS rrtype	4 years ago
Simon Dugas	4336a0e739	dns: log rdata for NULL record type Logs the rdata for a NULL record type as a printable string.	4 years ago
Victor Julien	efc9a7a398	app-layer: remove callback for completion status Since the completion status was a constant for all parsers, remove the callback logic and instead register the values themselves. This should avoid a lot of unnecessary callback calls. Update all parsers to take advantage of this.	4 years ago
Philippe Antoine	f574663352	http2: files inspection API fixes uses right transaction id for file tracker uses FILE_USE_DETECT for good matches with keyword startswith	4 years ago
Philippe Antoine	a63ee5adbd	http2: allow multiple size updates in one headers batch cf RFC 7541 section 4.2	4 years ago
Philippe Antoine	6181459086	smb: do not rely on one valid NBSS byte for probing Need to have the SMB header so as to validate	4 years ago
Jason Ish	f3c59ef8a6	rust: handle windows naming change from .lib to .a Prior to Rust 1.44, Cargo would name static libs with the .lib extension. 1.44 changes this extension to .a when running under a GNU environment on Windows like msys to make it more similar to other unix environments. Now assume static library name to be the same on Windows and unix, but rename the .lib if found to still support older versions of Rust on Windows.	4 years ago
Victor Julien	ba781265a4	dcerpc/udp: fix transaction handling and logging Implement missing transaction handling. Fix logging wrongly casting 'state' to DCERPCState instead of DCERPCUDPState leading to crashes and malformed output. Remove unused fields from DCERPCUDPState.	4 years ago
Philippe Antoine	8db78208f9	rust: fix warnings found by nightly compiler warning: getting the inner pointer of a temporary `CString` this `CString` is deallocated at the end of the statement, bind it to a variable to extend its lifetime	4 years ago
Jason Ish	2f81f3fbe9	rust/log: clarify comment in non-debug mode SCLogDebug	4 years ago
Jason Ish	a453d28bc6	rust/log: order log macros in descending order Readability cleanup. - error, notice, ... debug	4 years ago
Jason Ish	411a5d41c1	rust/log: expand macros after checking log level Expand macros in the do_log macro after checking the log level instead of each log macro (ie: SCLogDebug) expanding the macros then passing off to do_log to have the log level check. Will eliminate any expense of expanding macros if this log level does not permit the given message to be logged. Redmine issue: https://redmine.openinfosecfoundation.org/issues/4114	4 years ago
Shivani Bhardwaj	269324e84d	dcerpc/log: Log fields particular to an RPC version Log fields that only are meant to be in a PDU for a particular RPC version. Since DCERPC/UDP works on RPC version 4 and DCERPC/TCP works on RPC version 5, there are certain fields that are particular to each version. Remove call_id from the logger for UDP. Add activityuuid and seqnum fields to the logger for UDP. call_id and (activityuuid + seqnum) fields are used to uniquely pair a request with response for RPC versions 5 and 4 respectively.	4 years ago
Ilya Bakhtin	2033f386f9	rust/dcerpc: Remove redundant fields	4 years ago
Ilya Bakhtin	2840a2e064	rust/dcerpc: Make tx_id u64	4 years ago
Ilya Bakhtin	6916b63f09	dcerpc/udp: Fix pairing of request response So far, request and response were paired with serial number fields in the header. This is incorrect. According to https://pubs.opengroup.org/onlinepubs/9629399/chap12.htm, "Together, the activity UUID and the sequence number uniquely identify a remote procedure call." Hence, add activity uuid and sequence number to the transaction and pair the request accordingly. Remove incorrect handling of this and fix tests.	4 years ago
Ilya Bakhtin	e9b21553cc	rust/dcerpc: Add UDP flag definitions	4 years ago
Victor Julien	51f4e4d0b7	dcerpc/udp: add missing tx free logic	4 years ago
Victor Julien	9f9c29a14a	dcerpc: fix stream flag handling Only hardcoded direction flags were passed to the parser, not the full range. Handle receiving an EOF flag w/o data. Bug: #3856	4 years ago
Victor Julien	f31372ad1d	dcerpc/tcp: fix compile warning warning: variable does not need to be mutable --> src/dcerpc/dcerpc.rs:1036:42 \| 1036 \| let tx = if let Some(mut tx) = self.get_tx_by_call_id(current_call_id, core::STREAM_TOCLIENT) { \| ----^^ \| \| \| help: remove this `mut` \| = note: `#[warn(unused_mut)]` on by default warning: variable does not need to be mutable --> src/dcerpc/dcerpc.rs:1061:30 \| 1061 \| Some(mut tx) => { \| ----^^ \| \| \| help: remove this `mut`	4 years ago
Victor Julien	67b5295bbc	dcerpc/tcp: add missing detect state cleanup	4 years ago
Philippe Antoine	1fd6f5bc61	http2: asymetric sizes for headers tables The headers table from client to server and the one from server to client may have different maximum sizes (even if both endpoints have to keep both tables)	4 years ago
Philippe Antoine	aaa69fe3c5	smb: resistance against padding evasions Scenario is use of dummy padding in write AndX request or other similar commands using a data offset. Parsing skips now these dummy bytes, and generates one event	4 years ago
Philippe Antoine	caa7946888	smb: adds file overlap event against evasions Evasion scenario is - a first dummy write of one byte at offset 0 is done - the second full write of EICAR at offset 0 is then done and does not trigger detection The last write had the final value, and as we cannot "cancel" the previous write, we set an event which is then transformed into an app-layer decoder alert	4 years ago
Philippe Antoine	3e96f96153	rdp: fix incomplete result Aggregating the consumed bytes	4 years ago
Jason Ish	0529a00ffd	dhcp: set unidirection transaction flag	4 years ago
Jason Ish	3036ec4db0	ikev2: set unidirection transaction flag	4 years ago
Jason Ish	ff674d0cd0	mqtt: set unidirection transaction flag	4 years ago
Jason Ish	54d5f336d4	sip: set unidirection transaction flag	4 years ago
Jason Ish	1d40d0c5f9	rdp: set unidirection transaction flag	4 years ago
Jason Ish	f7dee602e9	krb5: set unidirection transaction flag	4 years ago
Jason Ish	984d3c7f20	ntp: set unidirection transaction flag	4 years ago
Jason Ish	fc7d59d92f	snmp: set unidirectional transaction flag	4 years ago
Philippe Antoine	64fcba228b	http2: complete parsing of priority frames	4 years ago
Philippe Antoine	c300a859a0	http2: keep track of dynamic headers table size And evict entries accordingly to maximum size	4 years ago
Philippe Antoine	1a21eea0e9	http2: variable size integers decoded everywhere	4 years ago
Philippe Antoine	b21acfbf21	http2: StreamIdReuse frame types exceptions Also handles better the state so as not to revert from HTTP2StateHalfClosedClient to HTTP2StateDataServer and not go to final HTTP2StateClosed	4 years ago
Philippe Antoine	89573060d9	http2: use variable integer for headers lengths	4 years ago
Shivani Bhardwaj	97c67cd5ce	dcerpc: fix gap handling This patch addresses issues discovered by redmine ticket 3896. With the approach of finding latest record, there was a chance that no record was found at all and consumed + needed became input length. e.g. input_len = 1000 input = 01 05 00 02 00 03 a5 56 00 00 ..... There exists no \|05 00\| identifier in the rest of the record. After having parsed \|05 00\|, there was a search for another record with the leftover data. Current data length at this point would be 997. Since the identifier was not found in the data, we calculate the consumed bytes at this point i.e. consumed = current_data.len() - 1 which would be 996. Needed bytes still stay at a constant of 2. So, consumed + needed = 996 + 2 = 998 which is lesser than initial input length of 1000 and hence the assertion fails. There could be two fixes to this problem. 1. Finding the latest record but making use of the last found record in case no new record was found. 2. Always use the earliest record. This patch takes the approach (2). It also makes sure that the gap and current direction are the same.	4 years ago
Philippe Antoine	4f963717f8	fuzz: better configure checks for MSAN building More compatible check for rust nightly Checks for CARGO_BUILD_TARGET Builds release or debug mode independently	4 years ago
Victor Julien	5d985c4271	dcerpc: implement tx free function	4 years ago
Victor Julien	8b2886635f	dcerpc/tcp: implement trunc logic When one side of the connection reaches the STREAM_DEPTH condition the parser should be aware of this. Otherwise transactions will forever be waiting for data in that direction.	4 years ago
Victor Julien	4da0d9bdea	applayer/rust: expose truncate callback	4 years ago
Shivani Bhardwaj	301454e9e4	dcerpc: fix datatypes while handling stub data	4 years ago
Shivani Bhardwaj	3fd9a3d420	dcerpc: fix datatype for stub data len	4 years ago
Philippe Antoine	222b386102	rust: rebuilds std when building fuzzers so as to have MSAN working	4 years ago
Philippe Antoine	15447cc672	dceprc: signature rust check with is_char_boundary before calling split_at which would panic	4 years ago
Philippe Antoine	6694737fcf	http2: settings from http1 upgrade	4 years ago
Philippe Antoine	7011bddf84	http2: mimic HTTP1 request from upgrade	4 years ago
Philippe Antoine	9d1b030ff0	http2: first connection upgrade from http1	4 years ago
Philippe Antoine	547d6c2d78	applayer: pass parameter to StateAlloc This parameter is NULL or the pointer to the previous state for the previous protocol in the case of a protocol change, for instance from HTTP1 to HTTP2 This way, the new protocol can use the old protocol context. For instance, HTTP2 mimicks the HTTP1 request, to have a HTTP2 transaction with both request and response	4 years ago
Sascha Steinbiss	ed9fed4958	mqtt: add some extra tests for varint parsing	4 years ago
Philippe Antoine	1a88df7e88	http2: handles incomplete frames after banner To signal incomplete data, we must return the number of consumed bytes. When we get a banner and some records, we have to take into account the number of bytes already consumed by the banner parsing before reaching an incomplete record.	4 years ago
Philippe Antoine	7ab9a01db2	mqtt: limit size of variable integer	4 years ago
Philippe Antoine	e3b28bcf2a	http2: returns error in case of index 0 As is documented in RFC 7541, section 6.1 The index value of 0 is not used. It MUST be treated as a decoding error if found in an indexed header field representation.	4 years ago
Jason Ish	e9fec043b5	rust/util: expose function to test strings for valid UTF-8 rs_check_utf8 will check that the provided string is valid UTF-8 by converting it to a Rust string and returning true or false.	4 years ago
Simon Dugas	7f26246ce1	dns: parse and log fields for SOA record type Added `dns_parse_rdata_soa` to parse SOA fields into an `DNSRDataSOA` struct. Added logging for answer and authority SOA records in both version 1 & 2, as well as grouped formats.	4 years ago
Simon Dugas	af498fd840	dns: use nom's rest to take all remaining rdata Using nom's `rest` combinator eliminates the need to call the do_parse macro for parsing a single element.	4 years ago
Simon Dugas	8005f50647	dns: refactor to handle more rdata formats Represent rdata as `DNSRData` enum variants instead of `Vec<u8>`. This will allow parsing/logging of more complex formats like SOA.	4 years ago

... 3 4 5 6 7 ...

982 Commits (f0479987ff6f5321613395a8bf1a5eb38530b977)