Next/20211213/v3

doc/userguide/configuration/suricata-yaml.rst

@@ -998,7 +998,7 @@ the option prealloc_sessions instructs Suricata to keep a number of
 sessions ready in memory.
 
 A TCP-session starts with the three-way-handshake. After that, data
-can be send en received. A session can last a long time. It can happen
+can be sent and received. A session can last a long time. It can happen
 that Suricata will be started after a few TCP sessions have already been
 started. This way, Suricata misses the original setup of those
 sessions. This setup always includes a lot of information. If you want

rust/src/common.rs

@@ -1,6 +1,27 @@
 use std::ffi::CString;
 use std::os::raw::c_char;
 
+pub mod nom7 {
+    use nom7::bytes::streaming::{tag, take_until};
+    use nom7::error::ParseError;
+    use nom7::IResult;
+
+    /// Reimplementation of `take_until_and_consume` for nom 7
+    ///
+    /// `take_until` does not consume the matched tag, and
+    /// `take_until_and_consume` was removed in nom 7. This function
+    /// provides an implementation (specialized for `&[u8]`).
+    pub fn take_until_and_consume<'a, E: ParseError<&'a [u8]>>(t: &'a [u8])
+         -> impl Fn(&'a [u8]) -> IResult<&'a [u8], &'a [u8], E>
+    {
+        move |i: &'a [u8]| {
+            let (i, res) = take_until(t)(i)?;
+            let (i, _) = tag(t)(i)?;
+            Ok((i, res))
+        }
+    }
+}
+
 #[macro_export]
 macro_rules! take_until_and_consume (
  ( $i:expr, $needle:expr ) => (

rust/src/smb/dcerpc_records.rs

@@ -16,11 +16,15 @@
  */
 
 use crate::smb::error::SmbError;
-use nom;
-use nom::IResult;
-use nom::combinator::rest;
-use nom::number::Endianness;
-use nom::number::streaming::{be_u16, le_u8, le_u16, le_u32};
+use nom7::bits::{bits, streaming::take as take_bits};
+use nom7::bytes::streaming::take;
+use nom7::combinator::{cond, rest};
+use nom7::error::Error;
+use nom7::multi::count;
+use nom7::number::Endianness;
+use nom7::number::streaming::{be_u16, le_u8, le_u16, le_u32, u16, u32};
+use nom7::sequence::tuple;
+use nom7::{Err, IResult};
 
 #[derive(Debug,PartialEq)]
 pub struct DceRpcResponseRecord<'a> {
@@ -33,15 +37,12 @@ pub fn parse_dcerpc_response_record(i:&[u8], frag_len: u16 )
     -> IResult<&[u8], DceRpcResponseRecord, SmbError>
 {
     if frag_len < 24 {
-        return Err(nom::Err::Error(SmbError::RecordTooSmall));
+        return Err(Err::Error(SmbError::RecordTooSmall));
     }
-    do_parse!(i,
-                take!(8)
-            >>  data:take!(frag_len - 24)
-            >> (DceRpcResponseRecord {
-                    data:data,
-               })
-    )
+    let (i, _) = take(8_usize)(i)?;
+    let (i, data) = take(frag_len - 24)(i)?;
+    let record = DceRpcResponseRecord { data };
+    Ok((i, record))
 }
 
 #[derive(Debug,PartialEq)]
@@ -56,18 +57,14 @@ pub fn parse_dcerpc_request_record(i:&[u8], frag_len: u16, little: bool)
     -> IResult<&[u8], DceRpcRequestRecord, SmbError>
 {
     if frag_len < 24 {
-        return Err(nom::Err::Error(SmbError::RecordTooSmall));
+        return Err(Err::Error(SmbError::RecordTooSmall));
     }
-    do_parse!(i,
-                take!(6)
-            >>  endian: value!(if little { Endianness::Little } else { Endianness::Big })
-            >>  opnum: u16!(endian)
-            >>  data:take!(frag_len - 24)
-            >> (DceRpcRequestRecord {
-                    opnum:opnum,
-                    data:data,
-               })
-    )
+    let (i, _) = take(6_usize)(i)?;
+    let endian = if little { Endianness::Little } else { Endianness::Big };
+    let (i, opnum) = u16(endian)(i)?;
+    let (i, data) = take(frag_len - 24)(i)?;
+    let record = DceRpcRequestRecord { opnum, data };
+    Ok((i, record))
 }
 
 #[derive(Debug,PartialEq)]
@@ -77,71 +74,71 @@ pub struct DceRpcBindIface<'a> {
     pub ver_min: u16,
 }
 
-named!(pub parse_dcerpc_bind_iface<DceRpcBindIface>,
-    do_parse!(
-            _ctx_id: le_u16
-        >>  _num_trans_items: le_u8
-        >>  take!(1) // reserved
-        >>  interface: take!(16)
-        >>  ver: le_u16
-        >>  ver_min: le_u16
-        >>  take!(20)
-        >> (DceRpcBindIface {
-                iface:interface,
-                ver:ver,
-                ver_min:ver_min,
-            })
-));
-
-named!(pub parse_dcerpc_bind_iface_big<DceRpcBindIface>,
-    do_parse!(
-            _ctx_id: le_u16
-        >>  _num_trans_items: le_u8
-        >>  take!(1) // reserved
-        >>  interface: take!(16)
-        >>  ver_min: be_u16
-        >>  ver: be_u16
-        >>  take!(20)
-        >> (DceRpcBindIface {
-                iface:interface,
-                ver:ver,
-                ver_min:ver_min,
-            })
-));
+pub fn parse_dcerpc_bind_iface(i: &[u8]) -> IResult<&[u8], DceRpcBindIface> {
+    let (i, _ctx_id) = le_u16(i)?;
+    let (i, _num_trans_items) = le_u8(i)?;
+    let (i, _) = take(1_usize)(i)?; // reserved
+    let (i, interface) = take(16_usize)(i)?;
+    let (i, ver) = le_u16(i)?;
+    let (i, ver_min) = le_u16(i)?;
+    let (i, _) = take(20_usize)(i)?;
+    let res = DceRpcBindIface {
+        iface:interface,
+        ver,
+        ver_min,
+    };
+    Ok((i, res))
+}
+
+pub fn parse_dcerpc_bind_iface_big(i: &[u8]) -> IResult<&[u8], DceRpcBindIface> {
+    let (i, _ctx_id) = le_u16(i)?;
+    let (i, _num_trans_items) = le_u8(i)?;
+    let (i, _) = take(1_usize)(i)?; // reserved
+    let (i, interface) = take(16_usize)(i)?;
+    let (i, ver_min) = be_u16(i)?;
+    let (i, ver) = be_u16(i)?;
+    let (i, _) = take(20_usize)(i)?;
+    let res = DceRpcBindIface {
+        iface:interface,
+        ver,
+        ver_min,
+    };
+    Ok((i, res))
+}
 
 #[derive(Debug,PartialEq)]
 pub struct DceRpcBindRecord<'a> {
     pub num_ctx_items: u8,
     pub ifaces: Vec<DceRpcBindIface<'a>>,
 }
 
-named!(pub parse_dcerpc_bind_record<DceRpcBindRecord>,
-    do_parse!(
-            _max_xmit_frag: le_u16
-        >>  _max_recv_frag: le_u16
-        >>  _assoc_group: take!(4)
-        >>  num_ctx_items: le_u8
-        >>  take!(3) // reserved
-        >>  ifaces: count!(parse_dcerpc_bind_iface, num_ctx_items as usize)
-        >> (DceRpcBindRecord {
-                num_ctx_items:num_ctx_items,
-                ifaces:ifaces,
-           })
-));
-
-named!(pub parse_dcerpc_bind_record_big<DceRpcBindRecord>,
-    do_parse!(
-            _max_xmit_frag: be_u16
-        >>  _max_recv_frag: be_u16
-        >>  _assoc_group: take!(4)
-        >>  num_ctx_items: le_u8
-        >>  take!(3) // reserved
-        >>  ifaces: count!(parse_dcerpc_bind_iface_big, num_ctx_items as usize)
-        >> (DceRpcBindRecord {
-                num_ctx_items:num_ctx_items,
-                ifaces:ifaces,
-           })
-));
+pub fn parse_dcerpc_bind_record(i: &[u8]) -> IResult<&[u8], DceRpcBindRecord> {
+    let (i, _max_xmit_frag) = le_u16(i)?;
+    let (i, _max_recv_frag) = le_u16(i)?;
+    let (i, _assoc_group) = take(4_usize)(i)?;
+    let (i, num_ctx_items) = le_u8(i)?;
+    let (i, _) = take(3_usize)(i)?; // reserved
+    let (i, ifaces) = count(parse_dcerpc_bind_iface, num_ctx_items as usize)(i)?;
+    let record = DceRpcBindRecord {
+        num_ctx_items,
+        ifaces,
+    };
+    Ok((i, record))
+}
+
+pub fn parse_dcerpc_bind_record_big(i: &[u8]) -> IResult<&[u8], DceRpcBindRecord> {
+    let (i, _max_xmit_frag) = be_u16(i)?;
+    let (i, _max_recv_frag) = be_u16(i)?;
+    let (i, _assoc_group) = take(4_usize)(i)?;
+    let (i, num_ctx_items) = le_u8(i)?;
+    let (i, _) = take(3_usize)(i)?; // reserved
+    let (i, ifaces) = count(parse_dcerpc_bind_iface_big, num_ctx_items as usize)(i)?;
+    let record = DceRpcBindRecord {
+        num_ctx_items,
+        ifaces,
+    };
+    Ok((i, record))
+}
 
 #[derive(Debug,PartialEq)]
 pub struct DceRpcBindAckResult<'a> {
@@ -151,42 +148,42 @@ pub struct DceRpcBindAckResult<'a> {
     pub syntax_version: u32,
 }
 
-named!(pub parse_dcerpc_bindack_result<DceRpcBindAckResult>,
-    do_parse!(
-            ack_result: le_u16
-        >>  ack_reason: le_u16
-        >>  transfer_syntax: take!(16)
-        >>  syntax_version: le_u32
-        >> (DceRpcBindAckResult {
-                ack_result:ack_result,
-                ack_reason:ack_reason,
-                transfer_syntax:transfer_syntax,
-                syntax_version:syntax_version,
-            })
-));
+pub fn parse_dcerpc_bindack_result(i: &[u8]) -> IResult<&[u8], DceRpcBindAckResult> {
+    let (i, ack_result) = le_u16(i)?;
+    let (i, ack_reason) = le_u16(i)?;
+    let (i, transfer_syntax) = take(16_usize)(i)?;
+    let (i, syntax_version) = le_u32(i)?;
+    let res = DceRpcBindAckResult {
+        ack_result,
+        ack_reason,
+        transfer_syntax,
+        syntax_version,
+    };
+    Ok((i, res))
+}
 
 #[derive(Debug,PartialEq)]
 pub struct DceRpcBindAckRecord<'a> {
     pub num_results: u8,
     pub results: Vec<DceRpcBindAckResult<'a>>,
 }
 
-named!(pub parse_dcerpc_bindack_record<DceRpcBindAckRecord>,
-    do_parse!(
-            _max_xmit_frag: le_u16
-        >>  _max_recv_frag: le_u16
-        >>  _assoc_group: take!(4)
-        >>  sec_addr_len: le_u16
-        >>  take!(sec_addr_len)
-        >>  cond!((sec_addr_len+2) % 4 != 0, take!(4 - (sec_addr_len+2) % 4))
-        >>  num_results: le_u8
-        >>  take!(3) // padding
-        >>  results: count!(parse_dcerpc_bindack_result, num_results as usize)
-        >> (DceRpcBindAckRecord {
-                num_results:num_results,
-                results:results,
-           })
-));
+pub fn parse_dcerpc_bindack_record(i: &[u8]) -> IResult<&[u8], DceRpcBindAckRecord> {
+    let (i, _max_xmit_frag) = le_u16(i)?;
+    let (i, _max_recv_frag) = le_u16(i)?;
+    let (i, _assoc_group) = take(4_usize)(i)?;
+    let (i, sec_addr_len) = le_u16(i)?;
+    let (i, _) = take(sec_addr_len)(i)?;
+    let (i, _) = cond((sec_addr_len+2) % 4 != 0, take(4 - (sec_addr_len+2) % 4))(i)?;
+    let (i, num_results) = le_u8(i)?;
+    let (i, _) = take(3_usize)(i)?; // padding
+    let (i, results) = count(parse_dcerpc_bindack_result, num_results as usize)(i)?;
+    let record = DceRpcBindAckRecord {
+        num_results,
+        results,
+    };
+    Ok((i, record))
+}
 
 #[derive(Debug,PartialEq)]
 pub struct DceRpcRecord<'a> {
@@ -207,42 +204,42 @@ pub struct DceRpcRecord<'a> {
 }
 
 fn parse_dcerpc_flags1(i:&[u8]) -> IResult<&[u8],(u8,u8,u8)> {
-    bits!(i,
-        tuple!(
-            take_bits!(6u8),
-            take_bits!(1u8),   // last (1)
-            take_bits!(1u8)))  // first (2)
+    bits::<_, _, Error<(&[u8], usize)>, _, _>(tuple((
+        take_bits(6u8),
+        take_bits(1u8),   // last (1)
+        take_bits(1u8),
+    )))(i)
 }
 
 fn parse_dcerpc_flags2(i:&[u8]) -> IResult<&[u8],(u32,u32,u32)> {
-    bits!(i,
-        tuple!(
-            take_bits!(3u32),
-            take_bits!(1u32),     // endianess
-            take_bits!(28u32)))
-}
-
-named!(pub parse_dcerpc_record<DceRpcRecord>,
-    do_parse!(
-            version_major: le_u8
-        >>  version_minor: le_u8
-        >>  packet_type: le_u8
-        >>  packet_flags: parse_dcerpc_flags1
-        >>  data_rep: parse_dcerpc_flags2
-        >>  endian: value!(if data_rep.1 == 0 { Endianness::Big } else { Endianness::Little })
-        >>  frag_len: u16!(endian)
-        >>  _auth: u16!(endian)
-        >>  call_id: u32!(endian)
-        >>  data:rest
-        >> (DceRpcRecord {
-                version_major:version_major,
-                version_minor:version_minor,
-                packet_type:packet_type,
-                first_frag:packet_flags.2==1,
-                last_frag:packet_flags.1==1,
-                frag_len: frag_len,
-                little_endian:data_rep.1==1,
-                call_id:call_id,
-                data:data,
-           })
-));
+    bits::<_, _, Error<(&[u8], usize)>, _, _>(tuple((
+       take_bits(3u32),
+       take_bits(1u32),     // endianess
+       take_bits(28u32),
+    )))(i)
+}
+
+pub fn parse_dcerpc_record(i: &[u8]) -> IResult<&[u8], DceRpcRecord> {
+    let (i, version_major) = le_u8(i)?;
+    let (i, version_minor) = le_u8(i)?;
+    let (i, packet_type) = le_u8(i)?;
+    let (i, packet_flags) = parse_dcerpc_flags1(i)?;
+    let (i, data_rep) = parse_dcerpc_flags2(i)?;
+    let endian = if data_rep.1 == 0 { Endianness::Big } else { Endianness::Little };
+    let (i, frag_len) = u16(endian)(i)?;
+    let (i, _auth) = u16(endian)(i)?;
+    let (i, call_id) = u32(endian)(i)?;
+    let (i, data) = rest(i)?;
+    let record = DceRpcRecord {
+        version_major,
+        version_minor,
+        packet_type,
+        first_frag: packet_flags.2 == 1,
+        last_frag: packet_flags.1 == 1,
+        frag_len,
+        little_endian: data_rep.1 == 1,
+        call_id,
+        data,
+    };
+    Ok((i, record))
+}

rust/src/smb/error.rs

@@ -16,7 +16,7 @@
  */
 
 // Author: Pierre Chifflier <chifflier@wzdftpd.net>
-use nom::error::{ErrorKind, ParseError};
+use nom7::error::{ErrorKind, ParseError};
 
 #[derive(Debug)]
 pub enum SmbError {