You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
|
|
|
|
ruledir = $(datadir)/suricata/rules
|
|
|
|
|
|
|
|
|
|
dist_rule_DATA = \
|
|
|
|
|
app-layer-events.rules \
|
|
|
|
|
bittorrent-events.rules \
|
|
|
|
|
decoder-events.rules \
|
|
|
|
|
dhcp-events.rules \
|
|
|
|
|
dnp3-events.rules \
|
|
|
|
|
dns-events.rules \
|
enip: convert to rust
Ticket: 3958
- transactions are now bidirectional
- there is a logger
- gap support is improved with probing for resync
- frames support
- app-layer events
- enip_command keyword accepts now string enumeration as values.
- add enip.status keyword
- add keywords :
enip.product_name, enip.protocol_version, enip.revision,
enip.identity_status, enip.state, enip.serial, enip.product_code,
enip.device_type, enip.vendor_id, enip.capabilities,
enip.cip_attribute, enip.cip_class, enip.cip_instance,
enip.cip_status, enip.cip_extendedstatus
3 years ago
|
|
|
enip-events.rules \
|
|
|
|
|
files.rules \
|
|
|
|
|
ftp-events.rules \
|
|
|
|
|
http-events.rules \
|
|
|
|
|
http2-events.rules \
|
imap: implement parser
This introduces a parser for IMAP protocol, replacing the
detection-only implementation.
An IMAP transaction has two states driven by the 'complete' field:
- Open (complete = false): waiting for a matching tagged response.
- Complete (complete = true): tagged response received, or special
conditions met (BYE, server greeting).
Completion logic (is_complete):
- If a tagged request exists: requires a matching tagged response.
- No tagged request + BYE: complete (server closing).
- No tagged request + any response: complete (server greeting).
Transactions are created in three places:
1. Request parser: every parsed command creates a new tx.
2. Response parser (tagged, no matching request): midstream/async;
orphan tagged response gets its own tx.
3. Response parser (untagged, no incomplete tx): server greeting or
unsolicited response.
Once open, messages accumulate:
- Request side: continuation and literal data attach to the most
recent incomplete tx.
- Response side: untagged responses attach to the most recent
incomplete tx; tagged responses attach via find_request(tag).
Literals, sent by the client (e.g. APPEND) or by the server (e.g.
FETCH), are consumed incrementally and their content is not retained.
Hard limits prevent unbounded growth:
- IMAP_MAX_TX (256, configurable): total transactions. Exceeded:
all incomplete txs force-completed with TooManyTransactions event.
- IMAP_MAX_MSGS_PER_TX (512): requests per tx. Exceeded: request
dropped, DataLimitReached event.
- IMAP_MAX_LINES (512): response lines per tx. Exceeded: line
dropped, DataLimitReached event.
- IMAP_MAX_LINE_BYTES_PER_STATE (100MB): retained request and
response data per flow. Exceeded: data dropped, DataLimitReached
event.
- IMAP_MAX_LINE_SIZE (8KB): request/response line max length.
Exceeded: LineTooLong event.
- Literal size: bounded by declared size in {N} specifier.
IMAP_MAX_TX only is configurable limit via app-layer.protocols.imap.max-tx.
Ticket #8276
9 months ago
|
|
|
imap-events.rules \
|
|
|
|
|
ipsec-events.rules \
|
|
|
|
|
kerberos-events.rules \
|
|
|
|
|
ldap-events.rules \
|
|
|
|
|
mdns-events.rules \
|
|
|
|
|
modbus-events.rules \
|
|
|
|
|
mqtt-events.rules \
|
|
|
|
|
nfs-events.rules \
|
|
|
|
|
ntp-events.rules \
|
|
|
|
|
pgsql-events.rules \
|
|
|
|
|
pop3-events.rules \
|
|
|
|
|
quic-events.rules \
|
|
|
|
|
rfb-events.rules \
|
|
|
|
|
sctp-events.rules \
|
|
|
|
|
sip-events.rules \
|
|
|
|
|
smb-events.rules \
|
|
|
|
|
smtp-events.rules \
|
|
|
|
|
snmp-events.rules \
|
|
|
|
|
ssh-events.rules \
|
|
|
|
|
stream-events.rules \
|
|
|
|
|
tls-events.rules \
|
|
|
|
|
websocket-events.rules
|
