Light

rusticata / rusticata Goto Github PK

View Code? Open in Web Editor NEW

95.0 95.0 14.0 219 KB

Rusticata: Rust parsers for Suricata (test code)

License: GNU Lesser General Public License v2.1

Rust 100.00%

rusticata's Introduction

Rusticata

Overview

Rusticata is a test crate for network protocol parsers written in Rust.

It was written to show to feasibility of the implementation of safe and efficient parsers in suricata. The real parsing code is now part of suricata (starting from version 4.0), and must be configured using the --enable-rust flag.

This project is now a playground for testing parsers, features and code.

This project is based on:

nom a Rust parser combinator framework
Many parsers from the rusticata project

Build

Run cargo build for a build in debug mode, cargo build --release for release mode.

Use cargo install to install the library, or set the LD_LIBRARY_PATH environment variable.

Testing

rusticata is mostly used to decode application layers in the pcap-analyzer project. See its documentation for examples.

License

This library is licensed under the GNU Lesser General Public License version 2.1, or (at your option) any later version.

rusticata's People

Contributors

Stargazers

Watchers

Forkers

bobsaintcool nicompte benzeng chixsh anthonykasza copslock xiongzx lxc1121 dk47os3r gongfchen sabriabri88 fwu313 icodein pillowtrucker

rusticata's Issues

Rust JA3 Crate

Hello! Not sure if this is the right place for this, but I wrote a JA3 hash (TLS client fingerprinting) library in Rust using your team's tls-parser crate. Just wanted to say thank you! I was also wondering if such a crate could be used by rusticata/suricata?

RUSTSEC-2020-0159: Potential segfault in `localtime_r` invocations

Potential segfault in localtime_r invocations

Details
Package	`chrono`
Version	`0.4.19`
URL	chronotope/chrono#499
Date	2020-11-10

Impact

Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.

Workarounds

No workarounds are known.

References

time-rs/time#293

See advisory page for additional details.

nom version mismatched caused compile problems

Compiling rand_core v0.3.0
Compiling libc v0.2.43
Compiling siphasher v0.2.3
Compiling version_check v0.1.5
Compiling num-traits v0.2.6
Compiling cfg-if v0.1.5
Compiling cookie-factory v0.2.4
Compiling rand_core v0.2.2
Compiling memchr v1.0.2
Compiling phf_shared v0.7.23
Compiling memchr v2.1.0
Compiling log v0.4.5
Compiling rand v0.5.5

Compiling nom v3.2.1

Compiling phf v0.7.23
Compiling log v0.3.9
Compiling phf_generator v0.7.23
Compiling rusticata-macros v0.3.3
Compiling num-traits v0.1.43
Compiling phf_codegen v0.7.23

Compiling nom v4.0.0

Compiling enum_primitive v0.1.1
Compiling tls-parser v0.5.0
Compiling rusticata-macros v1.0.0
Compiling ntp-parser v0.1.5
Compiling ssh-parser v0.1.2

In the same project 2 versions of nom were used,and caused a lot of compile errors

Naive Doubt regarding the Rust parsers

can i use this project to validate the syntax of rules that are to be send across to suricata?
my intend is this; have a restful interface post the rule sets which gets validated using the above code.
is my understanding/question flawed?

[Request]Update documentation

Hi,
On the README you are requesting to install pcap-parse, but apparently this has been deprecated in favor of pcap-analyzer. It would be good to mention that section is deprectaed and pcap-analyzer is the crate to install.
Also, is there some function pcap-parse does that pcap-analyzer doesn't support?

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.