suricata

Commit Graph

Author	SHA1	Message	Date
Giuseppe Longo	ba5e850264	sip: make pattern matching more robust SIP and SSDP share method names like NOTIFY and SUBSCRIBE, causing SSDP traffic to be misidentified as SIP. Add a probing parser callback that checks for "SIP/" in the payload before accepting a pattern match. Example of a misidentified flow before the fix: {"timestamp":"2014-02-27T19:44:43.164211+0100","flow_id":986757542077835,"event_type":"flow","src_ip":"192.168.1.1","src_port":9489,"dest_ip":"239.255.255.250 ","dest_port":1900,"ip_v":4,"proto":"UDP","app_proto":"sip","flow":{"..."}} After the fix: {"timestamp":"2014-02-27T19:44:43.164211+0100","flow_id":986757542077835,"event_type":"flow","src_ip":"192.168.1.1","src_port":9489,"dest_ip":"239.255.255.250 ","dest_port":1900,"ip_v":4,"proto":"UDP","app_proto":"failed","flow":{"..."}} Ticket #8355	1 month ago
Shivani Bhardwaj	0345b91ddd	rust: exclude DETECT_BYTEMATH_ENDIAN_DEFAULT from bindings to deal with the failure due to cbindgen updates and mismatches in generated bindings. detect-bytemath.c:61: error: "DETECT_BYTEMATH_ENDIAN_DEFAULT" redefined [-Werror] 61 \| #define DETECT_BYTEMATH_ENDIAN_DEFAULT (uint8_t) BigEndian \| In file included from rust.h:34, from detect-bytemath.c:32: ./../rust/gen/rust-bindings.h:5071: note: this is the location of the previous definition 5071 \| #define DETECT_BYTEMATH_ENDIAN_DEFAULT BigEndian \|	1 month ago
Giuseppe Longo	88f17d7b20	detect/sctp: add sctp.chunk_type keyword Add a U8 numeric keyword to match the first SCTP chunk type in a packet with prefilter support. Ticket #4251	1 month ago
Philippe Antoine	4144d9c709	rust: format snmp files Ticket: 3836	1 month ago
Jason Ish	546209ff12	bindgen: fix include ordering At some point, bindgen include ordering changed such that AppLayerGetFileState was being bindgen'd as opaque, as the definition of StreamBufferingConfig was not available when bindgen hit AppLayerGetFileState, and bindgen processes in order. Move the util includes before the app-layer includes to fix the ordering problem, but still keep util includes grouped. The sys diff is large as many things have been re-ordered.	1 month ago
William Ling	30628e45bc	rust: replace helper with built-in Replace custom u32_as_bytes with built-in to_be_bytes Issue: 5785	1 month ago
Philippe Antoine	9318bbfbdb	rust: format tftp files Ticket: 3836	1 month ago
Philippe Antoine	9ec200e834	rust: format x509 files Ticket: 3836	1 month ago
Philippe Antoine	dd66276f82	rust: format telnet files Ticket: 3836	1 month ago
Philippe Antoine	709ad1bdf4	rust: format sip files Ticket: 3836	1 month ago
Samaresh Kumar Singh	f06bb7d43e	dhcp: support option 52 overload Per RFC 2132 the BOOTP sname and file fields can hold extra DHCP options when option 52 is present, but the parser ignored them. After parsing the main options we now look up option 52 and walk sname or file as additional option streams, appending what we find to the same options vector so the logger and detection keywords see the overloaded values too. Bug: #8538.	1 month ago
Philippe Antoine	26bb18cfaa	http2: replace state todrop with a dedicated boolean Ticket: 8518	1 month ago
Philippe Antoine	8eed90ca9d	http2: global txs are unidirectional Ticket: 8518 Meaning they will now match only once per tx instead of twice: once for each direction	1 month ago
Philippe Antoine	daf68dc36f	http2: split progress per direction Ticket: 8518 Keywords that work for HTTP2 headers match now as soon as possible A push promise is now considered like a headers frame with regards to the progress (no dedicated "reserved" progress/state) http.protocol and http.stat_msg keywords are now registered at earliest progress, since these are synthetic like "HTTP/2" and not really seen on the wire. http.request_line and http.response_line match only on data, and not on headers, since we must wait the end of headers to be sure to have the full line http2.size_update now matches at headers progress as it should http2.frametype, http2.errorcode, http2.priority now match like http2.window, when the tx is complete from both sides, as a half-closed client may still send priority, rst_stream or window_update frames	1 month ago
Philippe Antoine	8217c51126	rust: format sdp files Ticket: 3836	1 month ago
Philippe Antoine	9d9d8df4cd	rust: format rdp files Ticket: 3836	1 month ago
Philippe Antoine	7352bae890	smb: avoid unsigned overflow debug assertion As we compute a padding, we can use wrapping_add as we only care about the low-weight bit anyways	1 month ago
Giuseppe Longo	8f205bb34f	llmnr: implement logger This adds an LLMNR protocol logger that reuses existing DNS functions, following the same approach as the mDNS logger: - No grouped logging - Rdata is logged in a field that is named after the rdata type - Types are logged in lower case - Flags are logged as an array Ticket #8366	1 month ago
Giuseppe Longo	13df0f7a06	llmnr: implement parser This adds a parser for LLMNR protocol over both UDP and TCP. The parser reuses the existing DNS functions since LLMNR shares the same wire format as DNS, but implements its own protocol-specific validation: - LLMNR-specific flag checks (C, TC, T bits) - Opcode validation (only standard query opcode 0 is valid) - An Event is set if Z-flag is set, since it's must be zero per RFC4795 LLMNR transactions inherit DNS behavior where each packet creates a new state with one transaction. Ticket #8366	1 month ago
Jason Ish	3dc8b154f3	rust/ffi: add safe thread storage wrapper Add a typed ThreadStorage<T> wrapper around the thread storage bindings. Ticket: #8445	1 month ago
Jason Ish	9f40968bba	rust/ffi: bindgen thread storage Ticket: #8445	1 month ago
Jason Ish	5e0abf1572	rust/ffi: use ThreadVars wrapper in flow callbacks Update the flow init, update and finish callback registrations to pass the safe ThreadVars wrapper instead of a raw pointer. Ticket: #8598	1 month ago
Jason Ish	1cac242948	rust/ffi: use ThreadVars wrapper in eve callback Update the EVE callback registration to pass the safe ThreadVars wrapper instead of a raw pointer. Ticket: #8598	1 month ago
Jason Ish	45762aa644	rust/ffi: use ThreadVars wrapper in thread init callback Update the thread init callback registration to pass the safe ThreadVars wrapper instead of a raw pointer. Ticket: #8598	1 month ago
Jason Ish	5fe88212c3	rust/ffi: add wrapper around ThreadVars A Rust wrapper around ThreadVars to enforce Rust lifetimes to ThreadVars when used in a callback. Ticket: #8598	1 month ago
Philippe Antoine	73193c7e6a	rust: format pgsql files Ticket: 3836	1 month ago
Philippe Antoine	3bfe6cf4b9	rust: format nfs files Ticket: 3836	1 month ago
Juliana Fajardini	372cb8c692	rust/sys: update bindgen SIGMATCH_ constants Part of Ticket #8551	1 month ago
Jason Ish	144f824f17	rust/ffi: add thread init callback wrapper Ticket: #8605	1 month ago
Jason Ish	c689af0bbb	rust/ffi: bindgen thread lifecycle callbacks Ticket: #8605	1 month ago
Philippe Antoine	07112bc7ae	rust: format mqtt files Ticket: 3836	1 month ago
Philippe Antoine	844f2effa3	rust: format modbus files Ticket: 3836	1 month ago
Philippe Antoine	db019ebefe	rust: format ike files Ticket: 3836	1 month ago
Philippe Antoine	bcc1e6ae32	rust: format http2 files Ticket: 3836	2 months ago
Philippe Antoine	1070e733d8	rust: format websocket files Ticket: 3836	2 months ago
Philippe Antoine	89e5332d88	rust: format utils files Ticket: 3836	2 months ago
Philippe Antoine	edf29b0000	rust: format ssh files Ticket: 3836	2 months ago
Philippe Antoine	fe27a2159c	rust: format rfb files Ticket: 3836	2 months ago
Philippe Antoine	5cca346f16	rust: format quic files Ticket: 3836	2 months ago
Philippe Antoine	415360d9e8	rust: format ntp files Ticket: 3836	2 months ago
Philippe Antoine	fa864f9c2f	rust: format mime files Ticket: 3836	2 months ago
Philippe Antoine	2cfcaec1b0	rust: format ldap files Ticket: 3836	2 months ago
Philippe Antoine	64e7c671cc	rust: format ftp files Ticket: 3836	2 months ago
Philippe Antoine	f217e249cb	rust: format ffi files Ticket: 3836	2 months ago
Philippe Antoine	f7c14809f4	rust: format enip files Ticket: 3836	2 months ago
Philippe Antoine	e526eb8e2b	rust: format bittorrent_dht files Ticket: 3836	2 months ago
Philippe Antoine	f5ac0e201c	rust: format asn1 files Ticket: 3836	2 months ago
Philippe Antoine	1ced97bdbb	rust: format applayertemplate files Ticket: 3836	2 months ago
Philippe Antoine	efe3b16aac	rust: feature debug in main crate enables feature debug in ffi	2 months ago
Philippe Antoine	b90adcc2bb	rust/ffi: move AppLayerTxData to ffi Ticket: 7666	2 months ago
Philippe Antoine	bce88dd83f	rust: build depends on ffi/Cargo.toml.in	2 months ago
Philippe Antoine	0773fba5fd	rust/ffi: move txdata flags to ffi Ticket: 7666	2 months ago
Philippe Antoine	2525ea2e37	rust/ffi: move direction to ffi Ticket: 7666	2 months ago
Philippe Antoine	5440e41314	rust/ffi: move debug validations macros to ffi Ticket: 7666	2 months ago
Philippe Antoine	bf64b52b95	http2: better compression against decompression bombs Ticket: 8513 Suricata decides at 2 levels if a http2 flow is doing a compression bomb. There is a direct computation when one chunk of TCP data is being parsed. In this case, do not take the ratio into account, just use the size of the decompressed data, so that if we get a big chunk of TCP data like 1 MiB, and a not so high ratio of 200, we do not trigger the debug assertion in util-file.c about 64MiB The other case stays unchanged : when accumulating over the lifetile of a flow with multiple txs, take into account the compression ratio, so that a flow of many txs, having a super high (brotli) compression ratio, ends up classified as a compression bomb. (For example, having 100 txs each turning a 100 byte input into a 700 KiB one)	2 months ago
Philippe Antoine	6d437956e2	detect/transforms: dotprefix can be chained Ticket: 8537 Otherwise, it may cause a use-after-free, in case of reallocated buffer and we used the buffer inspect which was freed.	2 months ago
Philippe Antoine	2b20a436e7	detect/transforms: decompress checks earlier if it is in-place Ticket: 8536 Otherwise, it may cause a use-after-free. So, need to allocate the temporary vector, before calling SCInspectionBufferCheckAndExpand	2 months ago
Philippe Antoine	4c42998feb	detect/engine: helper to know if a transform happens in-place	2 months ago
Philippe Antoine	7bf48b02be	http2: protection against decompression bombs Ticket: 8513 During decompression, fail early if we have a big decompression ratio, and enough data. Track this data also during a tx lifetime, and even a flow/state lifetime, so that we set event and fail also if the compression bomb is split over multiple packets	2 months ago
Philippe Antoine	29e4b08647	http2: code refactoring to split big function	2 months ago
Philippe Antoine	e98d419d96	ldap: bound the number of responses Ticket: 8405	2 months ago
Victor Julien	6ebd0c3cc2	http2: check for HTTP1 protocol during upgrade path Ticket: 8492	2 months ago
Philippe Antoine	10bde66586	nfs: bound file_additional_procs to 1 Ticket: 8418 As we only need to know we saw at least one NFSPROC3_COMMIT	2 months ago
Philippe Antoine	aea7ee21b8	nfs: bound namemap by using lru Ticket: 8418	2 months ago
Philippe Antoine	a50f494ef6	nfs: bound requestmap and use lru Ticket: 8418	2 months ago
Juliana Fajardini	d442c3544c	detect: opt-in keywords for firewall mode - tls.cert_chain_len - datarep - dataset - dns.opcode Part of Ticket #8387	2 months ago
Philippe Antoine	f0e246de34	detect/mqtt: reason_code keyword is now a multi-integer Ticket: 7929 Builds a vector of the reason code in a tx to do so, except if we use the default "any", where we do not append to the vector, but just run detection while iterating	2 months ago
Philippe Antoine	614c48d3c3	ikev2: remove unused field Ticket: 8415	2 months ago
Jeff Lucovsky	9ea2e29581	ftp: raise too_many_transactions event on overflow Other parsers (SMB, POP3, ENIP) already raise a too_many_transactions event when a flow exceeds its per-flow transaction limit. FTP had the limit wired up through app-layer.protocols.ftp.max-tx but just dropped the excess transaction on the floor with a "FTP does not set events yet..." TODO, so no event was raised when the limit was reached. Add the FtpEventTooManyTransactions variant, a stock rule at sid 2232002, and raise the event from FTPTransactionCreate when the live-tx count goes past ftp_config_maxtx. Issue: 8489	2 months ago
Jason Ish	cb69fa4e53	rust/ffi: add flow lifecycle callback wrappers Provide Rust friendly callback registrations for flow init, update and finish events. These callbacks are implemented as Rust closures. Ticket: #8446	2 months ago
Jason Ish	d4dc8be3b2	rust: bindgen flow lifecycle callbacks Ticket: #8446	2 months ago
Philippe Antoine	e38888810d	detect/dcerpc: avoids FP on dcerpc.iface keyword When we got a bind without the first fragment flag, and did not set any_frag in the signature, the signature always matched, whatever the uuid value Ticket: 8457	2 months ago
Jason Ish	8968b1c5a1	psl: update to 2.1.206 Update the public suffix list to latest release.	2 months ago
Philippe Antoine	5ed394b26b	rust/ffi: move AppLayerEvent to ffi Ticket: 7666	2 months ago
Philippe Antoine	59b6de8239	rust: fix last collapsible_match warnings The ones where we need to remove a debug log	2 months ago
Philippe Antoine	1cdff9de8e	rust: fix collapsible_match warnings warning: this `if` can be collapsed into the outer `match` help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.95.0/index.html#collapsible_match	2 months ago
Jason Ish	899e9f045e	ntp: expose logged fields to lua This includes: - version - mode - stratum - reference_id Ticket: #8533	2 months ago
Jason Ish	81692dd2c1	rust/lua: add method for pushing bytes Much like pushstring, but accepts an &[u8] as an argument instead of an &str. In support of ticket #8533.	2 months ago
Jason Ish	cdb02a2779	rust/dns: rustfmt	2 months ago
Philippe Antoine	7d66eb5f04	rust: remove unused function rust_string_to_c was used when a buffer should be used as it could contain nul-byte	2 months ago
Philippe Antoine	9b12fd9f09	rust/ffi: move helper trait state_get_tx_iterator to ffi Ticket: 7666	2 months ago
Philippe Antoine	07f37676b6	rust/ffi: move Flags for AppLayerParserState to ffi crate Ticket: 7666	2 months ago
Philippe Antoine	fb20c69d8d	rust/ffi: move APP_LAYER_PARSER_OPT_X const to ffi crate Ticket: 7666	2 months ago
Philippe Antoine	f1c66ff6f0	rust: remove obsolete const exclusions in cbindgen As these structs are now bindgened from C to suricata_sys crate	2 months ago
Philippe Antoine	d81a10126e	detect/doc: remove unexisting links Ticket: 8257 And add TODO comments if rules doc should be written	2 months ago
Philippe Antoine	8e39539161	detect/doc: fix broken anchor links Ticket: 8257	2 months ago
Philippe Antoine	bd6a436893	detect/doc: fix broken files links Ticket: 8257	2 months ago
Philippe Antoine	b0e63a2c95	detect/dcerpc: move stub_data keyword to rust Ticket: 8391	2 months ago
Philippe Antoine	3d56472d16	detect: bindgen more functions To prepare to move dcerpc.stub_data keyword to full rust	2 months ago
Jeff Lucovsky	746f471382	transform/subslice: Add subslice transform Issue: 7672 The subslice transform creates a slice of the input buffer. Specify the subslice desired -- nbytes and truncate are optional: subslice: offset <,nbytes> <,truncate> offset: Specifies the starting offset for the new subslice. When negative, expresses how far from the end of the input buffer to begin. nbytes: Specifies the size of the subslice. When negative, specifies that the subslice will end that many bytes from the end of the input buffer. Nbytes must be non-zero. When nbytes is not specified, the size of the subslice will be the size of the input buffer - offset. truncate: Specify behavior when offset + nbytes exceeds buffer length. When present, trims nbytes such that offset + nbytes equals buffer length. When not present, an empty buffer is produced. Examples: subslice: 1; - The subslice will be a copy of the input buffer but omits the input buffer's first byte "This is Suricata" -> "his is Suricata" subslice: 0, 13; - The slice is created from the first 13 bytes of the input buffer "This is Suricata" -> "This is Suric" subslice: 10, -5; - The subslice is created starting at offset 10 and continues to 5 bytes before the end of the input buffer "This is Suricata" -> "r" subslice: -3; - The subslice will be the last 3 bytes of the input buffer. "This is Suricata" -> "ata"	2 months ago
Philippe Antoine	4fc6ca5d6c	detect/dcerpc: move iface keyword to rust Ticket: 8391 Use same buffer dce_generic as for dcerpc.opnum (name dce_generic is enforced by a SV test currently)	3 months ago
Philippe Antoine	9677851637	rust/ffi: move app-layer traits to ffi crate Ticket: 7666 Traits around structures defined in C and bindgened to rust	3 months ago
Philippe Antoine	f803c25f24	rust/ffi: move export_X_data_get macros to ffi crate Ticket: 7666	3 months ago
Philippe Antoine	54b6885166	rust/ffi: move conf_get_bool helper to ffi crate Ticket: 7666	3 months ago
Victor Julien	28a3337c27	rust: cargo update	3 months ago
Philippe Antoine	5f9e436c3f	detect/dcerpc: support generic integer for opnum keyword Ticket: 8179	3 months ago
Philippe Antoine	67379b009a	detect/dcerpc: move opnum keyword to rust Ticket: 8391	3 months ago
Philippe Antoine	a36af353bc	rust: bindgen SCFlowGetAppProtocol	3 months ago
Jason Ish	fd31e50954	ntp: enable keywords for firewall mode Ticket: #8394	3 months ago
Jason Ish	713e4eb900	ntp: convert reference_id to buffer and add keyword Store the NTP reference ID as raw network-order bytes so it can be exposed as a sticky buffer and matched with payload keywords. The reference ID is often a 4 character string, or an IP address and not just an integer identifier. Updates the log reference ID to be a string of colon separated hex digits as this matches what tshark does. Ticket: #8488	3 months ago

1 2 3 4 5 ...

2373 Commits (main)