suricata

Commit Graph

Author	SHA1	Message	Date
Philippe Antoine	8e886a8ecd	krb5: use app-layer incomplete support Ticket: 3540 Ticket: 8305	4 months ago
Philippe Antoine	d77c43c79b	rust/ffi: move build_slice macro to ffi crate Ticket: 7666	4 months ago
Philippe Antoine	4a0143c8d4	rust/ffi: move cast_pointer macro to ffi crate Ticket: 7666	4 months ago
Shivani Bhardwaj	d241237c0f	Revert "dcerpc: fix consumed bytes post gap handling" This reverts commit `fc9da1c7a1`. That commit incorrectly used consumed as index of the slice passed to the Frame API. Found by oss-fuzz.	4 months ago
Jeff Lucovsky	ed882ede68	output/ipv6: Utility function to compress IPv6 addrs Issue: 7399 Utility function to compress IPv6 addresses per RFC-5952	4 months ago
Giuseppe Longo	de46f4ba9d	ldap: set invalid_data event Currently in parse_request function LdapEvent::InvalidData is not set when a request is not parsed correctly. Ticket #8258	4 months ago
Victor Julien	b55be5a44f	detect/transforms: update gunzip / zlib_deflate syntax Use standard space separated syntax.	4 months ago
Philippe Antoine	71b59f6dbe	rust/ffi: move IPPROTO_TCP to ffi and reexport in suricata Allows to reduce dependencies to full suricata crate Ticket: 7666	5 months ago
Philippe Antoine	d5ea973791	detect/ike: move ike.ike.chosen_sa_attribute keyword to rust Ticket: 8310 And increases expressivity on the way by supporting other modes than equality	5 months ago
Philippe Antoine	55333a6ca0	detect/ike: move ike.vendor keyword to rust Ticket: 8310	5 months ago
Philippe Antoine	14edd66494	detect/ike: move ike.nonce_payload keyword to rust Ticket: 8310	5 months ago
Philippe Antoine	d1213e4440	detect/ike: move ike.key_exchange_payload keyword to rust Ticket: 8310	5 months ago
Philippe Antoine	f23169c924	detect/ike: move ike.nonce_payload_length keyword to rust Ticket: 8310	5 months ago
Philippe Antoine	e85bf5be4d	detect/ike: move ike.key_exchange_payload_length keyword to rust Ticket: 8310	5 months ago
Philippe Antoine	841fe44f34	detect/ike: move ike.exchtype keyword to rust Ticket: 8310	5 months ago
Philippe Antoine	23032ebc65	detect/ike: move ike spi keywords to rust Ticket: 8310	5 months ago
Philippe Antoine	539e4ee665	detect/transforms: add zlib_deflate transform Ticket: 7846	5 months ago
Philippe Antoine	dbea660729	detect/transforms: add gunzip transform Ticket: 7846	5 months ago
Victor Julien	336a9d05ca	krb5: fix TCP record parsing A logic error in multi-record parsing meant only the first record was parsed. Bug: #8278.	5 months ago
Jason Ish	6b850dddb8	rust/ffi: JsonBuilder wrapper around C JsonBuilder API For use by plugins that need to work with JsonBuilder.	5 months ago
Jason Ish	f6b11ac855	output-eve: finish exposing to bindgen As all out output-eve.h is now exposed, merge output-eve.h and output-eve-bindgen.h back into one file, output-eve.h.	5 months ago
Jason Ish	f79158ae55	rust/sys: generate jsonbuilder bindings in sys Bindgen the Rust bindings to the C JsonBuilder API along with the rest of the Rust bindings to C. Breaking it out was probably the wrong idea. This should make it easier, and more correct to bindgen C functions that use SCJsonBuilder types.	5 months ago
Jason Ish	f951477461	rust/debug: use functions from ffi crate where possible It's not possible to use all the functions and macros from the ffi crate in the main Suricata crate, as there are conditionals around when running in test mode, and "cargo test" doesn't propagate the "cfg(test)" to test crates. Which for now means duplicating the macros and some functions.	5 months ago
Jason Ish	8b69089cb8	rust/ffi: more rust friendly plugin registration A plugin can now create a "Plugin" struct with Rust strings. The `into_raw` method converts it to a raw pointer suitable for returning during plugin registration.	5 months ago
Jason Ish	0999530726	rust/ffi: rust wrapper around eve filetype registration	5 months ago
Jason Ish	2d0bf9a2ed	output-eve: bindgen SCEveFileType callback types	5 months ago
Jason Ish	b4db7bdaee	rust/ffi: add logging (debug) wrappers Mostly a copy of Suricata core's logging wrappers into the ffi crate. These are not yet used by Suricata-core as they do require the Suricata library to be available, which is not the case with tests. And the `cfg(test)` parameter is not passed through to sub-crates. However, this does allow a plugin (or library) to call the logging macros without depending on the "suricata" crate. Ticket: #7666	5 months ago
Jason Ish	2c51744ccc	rust/ffi: stub out a rust ffi crate This crate is for Rust wrappers around the -sys crate which includes only raw bindings. This is the place to add nice wrappers around those bindings, however it should remain clear of dependencies on the main Suricata core crates. Ticket: #7666	5 months ago
Jason Ish	e9611a4d7c	output-eve: bindgen SCRegisterEveFileType to Rust Used by Rust output plugins.	5 months ago
Jason Ish	1b182025bc	output-eve: expose SCEveFileType to Rust with bindgen There is an unfortunate side-affect that one has to read output-eve-bindgen.h for the documentation on this type, however, I think we can resolve that in time.	5 months ago
Philippe Antoine	536242341b	detect/smb: move smb.version keyword to rust Ticket: 8267	5 months ago
Philippe Antoine	df495d7e22	rust: bindgen SCDetectGetLastSMFromLists to use it from rust keywords	5 months ago
Philippe Antoine	697c641400	detect/smb: move smb share and named_pipe keywords to rust Ticket: 8267	5 months ago
Philippe Antoine	667f8b2eb7	detect/smb: move smb ntlmssp keywords to rust Ticket: 8267	5 months ago
Victor Julien	a2e9ac21f8	flow: turn flags field into uint64_t Entire space is used.	5 months ago
Jason Ish	b0c912588c	mqtt/detect: fix mqtt_parse_bool return type Previously we were boxing a u8 and returning it as a pointer to a boolean. While this is probably not an issue itself, the value 2 was allowed to be converted to a boolean, which is undefined behavior in Rust.	5 months ago
Jason Ish	b9e0f9cc8b	rfb/detect: fix rfb_parse_sec_result return type The data parsed is a u32, but returned as DetectUintData<u8>, then later free'd as a DetectUintData<u32>.	5 months ago
Jason Ish	8b2a7ac47c	nfs/detect: fix nfs_procedure_parse return type Was returning DetectNfsProcedureData as a pointer to DetectUintData<u32>, and free'ing it as such.	5 months ago
Jason Ish	e474e45429	dns/detect: fix rcode return type The parsed DNS rcode was being returned as a DetectUintData<u8>, but is parsed, and free'd as a u16. So return a DetectUintData<u16>.	5 months ago
Jason Ish	c7f806a728	rust/sys: allow unknown lints allow(unpredictable_function_pointer_comparisons) is needed on newer versions of Rust, but is unknown to our MSRV, so for now, allow unknown lints.	5 months ago
Philippe Antoine	364d2c077d	rust: bindgen SCAppLayerRegisterParser Ticket: 7662	5 months ago
Philippe Antoine	8401417a84	app-layer: remove some obsolete forward declarations and reorder definitions	5 months ago
Philippe Antoine	8857b78f6a	rust: move AppLayerTxData definition to C and bindgen it to rust Will make easier the bindgen of RustParser structure which uses a callback which uses AppLayerTxData Move also the free function to C SCAppLayerTxDataCleanup As suricata-sys crate defines AppLayerTxData for rust, It must itself implement the Drop trait, and thus, We need to define a feature surest	5 months ago
Philippe Antoine	8eaced3c1e	rust: move AppLayerResult definition to C and bindgen it to rust Will make easier the bindgen of RustParser structure which uses a callback which uses AppLayerResult Keep From<> impl in sys crate that defines it	5 months ago
Philippe Antoine	06f78b2a22	rust: move StreamSlice definition to C and bindgen it to rust Will make easier the bindgen of RustParser structure which uses a callback which uses StreamSlice	5 months ago
Philippe Antoine	41f543ca35	rust: move AppLayerGetTxIterTuple definition to C and bindgen it to rust Will make easier the bindgen of RustParser structure which uses a callback which uses AppLayerGetTxIterTuple	5 months ago
Philippe Antoine	64d29fcd1c	rust: move AppLayerStateData definition to C and bindgen it to rust, and use default trait instead of new Will make easier the bindgen of RustParser structure which uses a callback which uses AppLayerStateData	5 months ago
Philippe Antoine	76efb8af4d	rust: move AppLayerGetFileState definition to C and bindgen it to rust. Will make easier the bindgen of RustParser structure which uses a callback which uses AppLayerGetFileState	5 months ago
Philippe Antoine	fc23e54c6d	rust: bindgen with derive eq As will be needed such as AppLayerTxData	5 months ago
Shivani Bhardwaj	d4008a6508	dcerpc: remove bad tests Unittests test_parse_bind_pdu_infinite_loop and test_parse_bindack_pdu_infinite_loop seem to have artificially made up header which does not hold up to the strict calculations enforced by the parser now. Their headers mark the fraglens as 64 and 72 respectively which are not enough to hold the kind of bind(ack) items that are expected. It worked so far as the parser passed the entire input slice around but with the bugfix for issue 7546, the input passed around is strictly restricted to the fraglen parsed in the header. Bug 7546	5 months ago
Shivani Bhardwaj	ed1bd8624e	dcerpc: use fraglen from header So far, the fraglen defined in the header was used inconsistently in certain places to define bounds on input length. Make it consistent by making sure that only a slice up until fraglen is passed around as that is the maximum length the fragment should have. With the help of Applayer::incomplete API, the case when the stream_slice passed to the parser is smaller than the header defined fraglen is already handled. Bug 7546	5 months ago
Shivani Bhardwaj	fc9da1c7a1	dcerpc: fix consumed bytes post gap handling The parser could receive an input that consists of arbitrary data post gap. This is handled in the beginning of the fn handle_input_data. However, the rest of the calculation does not take into account the bytes that were consumed at this stage. Fix the indices and calculations to consider a new DCERPC fragment beginning post these consumed bytes.	5 months ago
Philippe Antoine	9a52bbcbe9	detect/quic: move quic.cyu.hash to rust Ticket: 8255	5 months ago
Philippe Antoine	01610aabe7	detect/quic: move quic.cyu.string to rust Ticket: 8255	5 months ago
Philippe Antoine	ee4d4a14d5	detect/quic: move quic.ua to rust Ticket: 8255	5 months ago
Philippe Antoine	9ba9fdcb87	detect/quic: move quic.sni to rust Ticket: 8255	5 months ago
Philippe Antoine	907e71a984	detect/quic: move quic.version to rust Ticket: 8255	5 months ago
Philippe Antoine	7dbe033ae0	app-layer: function to register ci pattern + probe Ticket: 6591	5 months ago
Philippe Antoine	2cf9a327d5	detect/ssh: move ssh.hassh to rust Introduces helper SCDetectRegisterBufferLowerMd5Callbacks	5 months ago
Philippe Antoine	83360cfce0	detect/ssh: move ssh.hassh string to rust bindgen needed SCSigMatchSilentErrorEnabled on the way	5 months ago
Philippe Antoine	02cb0f2ac2	rust: fix unnecessary_unwrap warnings warning: called `unwrap` on `rd.pipe` after checking its variant with `is_some` --> src/smb/smb1.rs:858:28 \| 857 \| if rd.pipe.is_some() { \| -------------------- help: try: `if let Some(<item>) = rd.pipe` 858 \| let pipe = rd.pipe.unwrap(); \| ^^^^^^^^^^^^^^^^ \| = help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.93.0/index.html#unnecessary_unwrap = note: `#[warn(clippy::unnecessary_unwrap)]` on by default	6 months ago
Philippe Antoine	cafc398355	dcerpc: consume bytes after gap resync Ticket: 7567 Re-applies commit `8c3bd3e8a0` which was reverted in `f64aec9d11`	6 months ago
Philippe Antoine	54cc752cf9	ssh: hassh can be truly disabled Rules will not re-enable it Ticket: 8223	6 months ago
Philippe Antoine	458211dcf2	detect/ssh: move ssh.proto to rust	6 months ago
Philippe Antoine	9cfc1cc557	detect/ssh: move obsolete keywords to rust	6 months ago
Philippe Antoine	ea8ac2a02a	detect/ssh: move ssh.software to rust Adds helper function SCDetectHelperBufferProgressMpmRegister on the way	6 months ago
Philippe Antoine	c0d6747e82	app-layer: GetTxIteratorFn uses a AppLayerGetTxIterState Even if every current rust parser uses the u64 variant of the C union	6 months ago
Philippe Antoine	4b541b39f2	rust: move AppLayerEventType definition to C and bindgen it to rust. Will make easier the bindgen of RustParser structure which uses a callback which uses AppLayerEventType	6 months ago
Philippe Antoine	c960b7d7c1	app-layer: AppLayerParserFPtr uses a mut pointer to local storage So, fix the fn prototype in rust ParseFn	6 months ago
Philippe Antoine	f470ee448b	quic: use standard tx iterator code Will make bindgen life easier As the fn prototype should not have istate: &mut u64 but a *mut AppLayerGetTxIterState which is an union with a u64	6 months ago
Philippe Antoine	076fcd61cd	bittorrent: use standard tx iterator code Will make bindgen life easier As the fn prototype should not have istate: &mut u64 but a *mut AppLayerGetTxIterState which is an union with a u64	6 months ago
Philippe Antoine	1a546936c7	rust: AppLayerTxConfig uses Default impl	6 months ago
Philippe Antoine	4e64de3b3b	rust: remove wrapper LoggerFlags struct definition just use an u32 out of the box. Will make bindgen like easier	6 months ago
Philippe Antoine	f663be5983	rust: define every RustParser fn pointer unsafe That is what bindgen will do	6 months ago
Lukas Sismis	3e4fdb2118	misc: time unit parsing function	6 months ago
Philippe Antoine	5bb9a0c3af	dcerpc/tcp: fix fragmentation handling Really count the fragments, and set it done when last was received	6 months ago
Philippe Antoine	f64aec9d11	dcerpc: use different header for different directions Header handling is wrong in the case packet A to server is fragmented (return AppLayerResult::incomplete) packet B is to client, but uses the header of the to_server packet Bug 7547	6 months ago
Philippe Antoine	1832b50506	nfs: log read/write/rename whatever the nfs version These were previously logged correctly only for nfs v3 Now, the correct opcodes are used for v2 and v4 as well Ticket: 8222	6 months ago
Philippe Antoine	b0850efd67	rust: from_str implementation for EncryptionHandling To move non-specific quic code to the right place	6 months ago
Philippe Antoine	89b6ab6730	rust: rename EncryptionHandling as it is no longer specific to SSH	6 months ago
Philippe Antoine	7acfea57a9	rust: move EncryptionHandling definition to its own file as it is not specific to ssh anymore	6 months ago
Philippe Antoine	7422c97bf2	quic: encryption-handling config parameters Ticket: 8116	6 months ago
Victor Julien	ff3def130c	rust/htp: formatting fixup	6 months ago
Victor Julien	b1fe6a4ceb	rust: update lru to 0.16.3; update lock RUSTSEC-2026-0002 Ticket: #8210.	6 months ago
Philippe Antoine	a48200b9e5	dcerpc: use saturating_add to count fragments And do not overflow if we have traffic with more than 65K fragments	6 months ago
Shivani Bhardwaj	e412215af9	dcerpc: add upper limit on stub data DCERPC parsers had no upper bounds when it came to extending the stub data buffer. Traffic can be crafted to bypass some internal parser conditions to create an indefinite buffering in the stub_data array that can make Suricata crash. Add a default limit of 1MiB and make it configurable for the user. Security 8182 Co-authored-by: Philippe Antoine <pantoine@oisf.net>	6 months ago
Philippe Antoine	fa5a4a994a	http: limit the number of folded lines per header Ticket: 8201 Limits the quadratic complexity if each packet, restarting the header parsing, just adds a new folded line. This was previously bounded by the configurable max header length	6 months ago
Philippe Antoine	f2a45c4216	http: do not use recursion in decompression just loop and iterate Ticket: 8185	6 months ago
Shivani Bhardwaj	1d7b0d9b7a	tls/subjectaltname: use byte arr instead of string TLS parsers use x509-parser crate which parses X.509 certificates that use ASN.1 DER encoding that can allow arbitrary byte sequences. An attacker could inject null byte in a certificate anywhere to stump the common language parsers terminating the string at a null byte leading to a bypass of a possibly malicious certificate. So far, the rust TLS parser for "subjectaltname" used a pattern that involved: -> Get ASN.1 DER encoded raw data from the x509-parser crate -> Convert this raw data to a decoded string (Rust) -> Convert the Rust string to CString -- The problem lies here. CString only accepts proper strings/byte buffers and converts it into an owned C-compatible, null-terminated string. However, if any null byte occurs in the string passed to the CString then it panics. In the rust TLS parser, this panic is handled by returning NULL. This means that the parser will error out during the decoding of the certificate. However, Suricata must be able to detect the null byte injection attack being an IDS/IPS. Hence, replace all such string patterns w.r.t. TLS SAN with a byte array. Bug 7887	6 months ago
Shivani Bhardwaj	24f5b7dab2	tls/serial: use byte array instead of string Bug 7887	6 months ago
Shivani Bhardwaj	f025e07191	tls/issuerdn: use byte array instead of string TLS parsers use x509-parser crate which parses X.509 certificates that use ASN.1 DER encoding that can allow arbitrary byte sequences. An attacker could inject null byte in a certificate anywhere to stump the common language parsers terminating the string at a null byte leading to a bypass of a possibly malicious certificate. So far, the rust TLS parser for "issuerdn" used a pattern that involved: -> Get ASN.1 DER encoded raw data from the x509-parser crate -> Convert this raw data to a decoded string (Rust) -> Convert the Rust string to CString -- The problem lies here. CString only accepts proper strings/byte buffers and converts it into an owned C-compatible, null-terminated string. However, if any null byte occurs in the string passed to the CString then it panics. In the rust TLS parser, this panic is handled by returning NULL. This means that the parser will error out during the decoding of the certificate. However, Suricata must be able to detect the null byte injection attack being an IDS/IPS. Hence, replace all such string patterns w.r.t. TLS IssuerDN with a byte array. Bug 7887	6 months ago
Shivani Bhardwaj	77c21b05d2	tls/subject: use byte array instead of string TLS parsers use x509-parser crate which parses X.509 certificates that use ASN.1 DER encoding that can allow arbitrary byte sequences. An attacker could inject null byte in a certificate anywhere to stump the common language parsers terminating the string at a null byte leading to a bypass of a possibly malicious certificate. So far, the rust TLS parser for "Subject" used a pattern that involved: -> Get ASN.1 DER encoded raw data from the x509-parser crate -> Convert this raw data to a decoded string (Rust) -> Convert the Rust string to CString -- The problem lies here. CString only accepts proper strings/byte buffers and converts it into an owned C-compatible, null-terminated string. However, if any null byte occurs in the string passed to the CString then it panics. In the rust TLS parser, this panic is handled by returning NULL. This means that the parser will error out during the decoding of the certificate. However, Suricata must be able to detect the null byte injection attack being an IDS/IPS. Hence, replace all such string patterns w.r.t. TLS Subject with a byte array. Bug 7887	6 months ago
Shivani Bhardwaj	06eafb79d6	detect/flow-pkts: check for both dir The functionality of "both" can already be easily achieved by using both "toclient" and "toserver" in a rule. This just adds the ease of expression in rule. As it is added now, check the direction for the pre-existing users of direction as well.	7 months ago
Shivani Bhardwaj	77abcde9ee	rust/flow: add public wrapper for dir in order to be able to use it on the C side for elephant flow detection.	7 months ago
Jason Ish	d89b35db56	conf: add SCConfNodeChildValueIsFalse to check for false value New function to check is a value is actually set to a false value.	7 months ago
Philippe Antoine	af246ae7ab	http: do not use a loop to find the tx count As we want the last tx Ticket: 8156 The generic function AppLayerParserGetTxCnt calls for HTTP1 Transactions.size() This function has some specific code, as we may have pre-created a tx that we do not want to count. This used to get the last tx by iterating over all the transactions waiting to find the one with max index. So, instead of using the Transactions.get function, we get the last tx out of the VecDeque and check its index.	7 months ago
Jeff Lucovsky	9c81f817e8	rust: bindgen update Issue: 7389 Update bindgen with `make update-bindgen`	7 months ago
Jason Ish	50224f2ee5	rust: fix clippy warning for unused import While debug_validate_bug_on is still used, it does not need to be imported directly, as that macro is marked with `macro_export`, making it globally available to the crate.	7 months ago
Philippe Antoine	455b7d1b3b	rust: use snake case for applayer_register_protocol_detection	7 months ago
Philippe Antoine	b4d8aea0ae	rust: bindgen SCAppLayerRegisterProtocolDetection Ticket: 7662 Changing the struct passed to it to have the minimal number of useful fields.	7 months ago
Philippe Antoine	1329786f84	detect: new command line option : list-rule-protos To list the protocols we can use a in a rule header Ticket: 635	7 months ago
Philippe Antoine	2349f19977	nfs: use nfsv2 procedure names with nfs_procedure keyword Ticket: 5140	7 months ago
Jhonny Sousa	257ed82dbd	nfs: Fix NFSv2 STATFS procedure parsing Ticket: #5140	7 months ago
Philippe Antoine	15b1bf4865	rust: bindgen SCHTPFileCloseHandleRange Ticket: 7762	8 months ago
Philippe Antoine	cddbd0b906	rust: bindgen more file functions Ticket: 7762	8 months ago
Philippe Antoine	327b8b04a9	rust: bindgen with default derive Ticket: 7762	8 months ago
Victor Julien	80d5afe91b	pop3: AUTH command handling improvements Better track the state so it's known when to expect a base64 request message. Also better validate the base64. Ticket: #7994.	8 months ago
Victor Julien	2973eded56	pop3: convert to nom 8 Ticket: #8127.	8 months ago
Victor Julien	da2db65f62	pop3: rustfmt	8 months ago
Jason Ish	83d8b1d2f8	quic: update to nom 8.0 Ticket: #8140	8 months ago
Philippe Antoine	32ce3d29be	detect/krb: use flag u32 for krb5_msg_type	8 months ago
Jason Ish	a9eee5dfd9	rust/htp: convert to nom 8 Ticket: #8090	8 months ago
Jason Ish	ef9cd7beff	rust/smb: convert to nom 8 Ticket: #8089	8 months ago
Jason Ish	02045e1d62	rust/dcerpc: convert to nom 8 Ticket: #8093	8 months ago
Jason Ish	25c98af0e8	rust/detect: convert remaining detection rule parsers to nom 8 Ticket: #8051	8 months ago
Jason Ish	dea3f9e260	rust/detect: convert error.rs and dependent parsers to nom 8 Ticket: #8051	8 months ago
Jason Ish	efc32dea41	rust/detect: convert uint nom 8 And users of uint directly impacted by this change. Ticket: #8051	8 months ago
Jason Ish	cf604751de	rust/util: convert to nom 8 Ticket: #8088	8 months ago
Jason Ish	1e01d5adca	rust/conf: convert to nom 8 Ticket: #8087	8 months ago
Jason Ish	c6e8932740	rust/asn1: convert to nom 8 Ticket: #8086	8 months ago
Jason Ish	59f8fb30a8	rust/ftp: fix clippy warning error: implicitly casting the result of `from_raw_parts_mut` to `*mut [u8]` --> src/ftp/response.rs:107:31	8 months ago
Philippe Antoine	cba13ed9b1	rust: bindgen functions needed for datasets Ticket: 7762	8 months ago
Philippe Antoine	12892ba010	rust: bindgen functions neede for features Ticket: 7762	8 months ago
Jeff Lucovsky	e1bf5cb1f3	nfs: Support EXCLUSIVE4_1 flag Issue: 8006 Support the EXCLUSIVE4_1 create mode added to NFS 4.1	8 months ago
Philippe Antoine	79e66f76e6	detect: icmp_id is now a generic integer Ticket: 7889	8 months ago
Philippe Antoine	85fa894425	detect: dnp3.func is now a generic integer Ticket: 7889	8 months ago
Philippe Antoine	f2b6540c52	htp: bound decompression Ticket: 7980 Usage of Vec<u8> instead of Box<u8> gave the ability to callers to grow the buffer (indefinitely) This was regressed in `16fee33368` Additionnaly, use rust WriteZero instead of WouldBlock as a more fitting error when cursor is full, as that error kind is the one tested by callers.	8 months ago
Philippe Antoine	c61f1cb6d0	detect/integers: rename index all1 to all And all to all_or_absent Ticket: 7929	8 months ago
Philippe Antoine	eb5a2d646b	detect/vlan: move vlan.id keyword to generic integer Ticket: 7929	8 months ago
Li Heng	c141c55bc6	snmp: can be set to detection-only Realloc alp_ctx.ctxs when a dynamic alproto is registered and g_alproto_max increases. So dynamic alproto can be treated as real/normal ones. And app-layer switch can be set to any value of no/deteciton-only/yes. Ticket: 8000	8 months ago
Philippe Antoine	439f96dea7	rust: bindgen frames functions Ticket: 7667	8 months ago
Philippe Antoine	92c7be1cb6	rust: bindgen SCSRepCatGetByShortname Ticket: 7667	8 months ago
Philippe Antoine	7447651fa0	output/jsonbuilder: helper function SCJbSetPrintAsciiString To replace C PrintStringsToBuffer and avoid a stack alloc + copy Ticket: 8004	8 months ago
Li Heng	1106323ae1	rust/sip: delete redundant computing codes Delete call of is_alphanumeric where is_alphanumeric and is_token_char are called together. Four places are modified. Ticket: 8003	8 months ago
Jason Ish	1efe70a234	rust/ike: convert to nom 8 Ticket: #8050	9 months ago
Jason Ish	f368324e87	rust/mime: convert to nom 8 Ticket: #8048	9 months ago
Jason Ish	c5ef615953	rust/mqtt: convert to nom 8 Ticket: #8047	9 months ago
Jason Ish	2289069f74	rust/websocket: convert to nom 8 Ticket: #8046	9 months ago
Jason Ish	9eeefd0684	rust/bt-dht: convert to nom 8 Ticket: #8045	9 months ago
Jason Ish	399f96b07d	rust/rdp: convert to nom 8 Ticket: #8044	9 months ago
Jason Ish	7c70f74942	rust/telnet: convert to nom 8 Ticket: #8043	9 months ago
Jason Ish	2ff2eb1325	rust/ssh: convert to nom 8 Ticket: #8042	9 months ago
Jason Ish	baa22287b8	rust/rfb: convert to nom 8 Ticket: #8041	9 months ago
Jason Ish	dcfe247467	rust/pgsql: convert to nom 8 Ticket: #8039	9 months ago
Jason Ish	d25286e77a	rust/enip: convert to nom 8 Ticket: #8038	9 months ago
Jason Ish	d74f8522ee	rust/tftp: convert to nom 8 Ticket: #8037	9 months ago
Jason Ish	4b09622ebc	rust/dhcp: convert to nom 8 Ticket: #8036	9 months ago
Philippe Antoine	772bd9ca53	rust: reduce visibility of detect_parse_uint_notending It is meant as an internal function Also document the function	9 months ago
Philippe Antoine	b636dffd5b	detect: urilen keyword fails on trailing junk Fails especailly on 1<>2 which looks like a range, but is invalid as too small, and ended up being accepted as =1 Ticket: 8028	9 months ago
Philippe Antoine	2e9027fd5a	plugins: update SC_API_VERSION to 9 So that plugins built for 8 will fail to load with 9 as there were already breaking changes in the structures and functions prototypes	9 months ago
Jason Ish	16d313cb8b	rust/applayertemplate: convert to nom 8 Ticket: #8027	9 months ago
Jason Ish	f0f4d88119	rust/sip+sdp: update to nom 8 Done together as there is a dependence of SDP by SIP. Ticket: #8025	9 months ago
Jason Ish	58564a4b0e	rust/ftp: update to nom 8 Ticket: #8026	9 months ago
Jason Ish	54cc97b78e	rust/dns: convert to nom 8.0 Ticket: #8024	9 months ago
Jason Ish	16c42da57e	rust: add nom8 as a dependency For the update from nom 7 to nom 8.	9 months ago
Jason Ish	0990c9dbf6	rust: pin indexmap Newer indexmap, pulled in by serde_json requires Rust 1.82, so pin pack to 2.11.4 which still works with Rust 1.75.	9 months ago
Philippe Antoine	dc7874b2ac	rust: bindgen more http range functions used in http2 Ticket: 7667	9 months ago
Philippe Antoine	842352c190	rust: bindgen SCHttpRangeFreeBlock Ticket: 7667	9 months ago
Philippe Antoine	93785ae357	rust: bindgen SCHTTP2MimicHttp1Request Ticket: 7667	9 months ago
Philippe Antoine	a1613fecb4	detect: tcp.flags rejects non-sensical values ignored flags are only meaningful for equal mode	9 months ago
Philippe Antoine	31e9cb55be	detect: tcp.flags unit tests improvements Tests better the ignored flags functionality. This functionality is only used at detection for default mode, it is not used for any, plus or not mode. So, have unit tests about igored flags with default mode with both matching and non matching cases	9 months ago
Philippe Antoine	d8cb00e795	detect/tcp: make tcp.flags a generic integer with bitflags Ticket: 6724 Allows to use numerical values for example Also fixes some unit tests that were returning 1 after goto error FlagsTestParse05 especially took this path as de->ignored_flags != (TH_SYN\|TH_RST) was false we had de->ignored_flags == 0xff ^ (TH_SYN\|TH_RST) And then, we had a match, instead of what the not-run code was supposing.	9 months ago
Philippe Antoine	1f9236a6d8	detect/ipv4: make fragbits a generic uint16 bitflags keyword Ticket: 6724 Allows to use numerical values	9 months ago
Philippe Antoine	633180c93f	detect/integers: generalize support for bitflags modifier Ticket: 6724 Allows sugar syntax for bitflags keywords. While the expressivity does not increase, because we could already use numerial values with all generic integer modes, this modifier prefix is used with the strings, and follows the syntax that is already used for fragbits and tcp.flags keyword.	9 months ago
Philippe Antoine	f25194480c	libhtp: fix newer clippy lints with newer MSRV	9 months ago
Jason Ish	bc33bd49eb	quic/crypto: remove use of GenericArray Its not needed, and gets rid of the deprecation warnings.	9 months ago
Jason Ish	bdfdf7ff33	rust: update deps with cargo-update Suppress deprecation warnings in quick/crypto.rs about GenericArray.	9 months ago
Jason Ish	6fdf0d736b	rust: update aes-gcm to 0.10.3	9 months ago
Jason Ish	b9517de86e	rust: update aes to 0.8.4	9 months ago
Philippe Antoine	4b69a31dc3	detect/integers: count argument for multi-integers Ticket: 7211 Allows to count the number of elements, without matching on individual elements	9 months ago
Philippe Antoine	3babd68af4	pop3: count retr_data into consumed for later AppLayerResult::incomplete Fixes: `acef961645` ("pop3: improve parsing") https://issues.oss-fuzz.com/u/1/issues/451112373 Ticket: 7994	9 months ago
Philippe Antoine	9a4a29e218	http2: fix parsing of goaway frames There was a last stream id before the error code As per section 6.8 of RFC 7540 Ticket: 7991	9 months ago
Philippe Antoine	7f0087f19a	rust/detect: fix correct pointer type in SCDetectU32ArrayFree	9 months ago
Philippe Antoine	969739d067	detect: http2.errorcode is now a generic integer Ticket: 7889	9 months ago
Philippe Antoine	401b2fcae6	detect: http2.frametype is now a generic integer Ticket: 7889	9 months ago
Philippe Antoine	454f73b445	rust: EnumString derive accepts a enum_string_style parameter So that http2.frametype and http2.errorcode can use EnumString without changing the format, as they used UPPERCASE instead of the default EnumString snake_case	9 months ago
Victor Julien	acef961645	pop3: improve parsing Improve multiline commands and SASL auth. Work around missing support in crate for empty server challenge and SASL base64 data. Ticket: #7709.	9 months ago
Jason Ish	5e2dc9ace3	ike: don't log empty server objects	9 months ago
Jason Ish	2d86412f46	ike: log attributes as objects IKE attributes are an array of TLV style objects, this means there can be duplicate types seen on the wire. However, Suricata logs these as a mapping with the type as the key. This can result in the JSON containing duplicate keys. To address this, log the attributes as an array of objects, allow duplicates to exist, for example: "client": { "proposals": [ { "sa_life_duration": "Unknown", "sa_life_duration_raw": 86400, } } } is now logged as: "client": { "proposals": [ {"key": "sa_life_duration", "value": "Unknown", "raw": 86400} ] } Also adds `"version": 2` to each IKE record to note the change of format from previous versions. Ticket: #7902	9 months ago
Jason Ish	b543e28402	ike/detect: info log message should be debug	9 months ago
Philippe Antoine	a393147415	rust: restrict visibility of reexported suricata_sys structs	9 months ago
Philippe Antoine	fa322e3dc2	rust: remove unneeded cbindgen exclusions	9 months ago
Philippe Antoine	958344787f	rust: bindgen FileAppendData Ticket: 7667	9 months ago
Philippe Antoine	811d28cc6b	rust: bindgen util-spm-bs.h for SCBasicSearchNocaseIndex Ticket: 7667	9 months ago
Jeff Lucovsky	0e547b9519	rust/conf: Accept xiB unit suffixes Update the memval to recognize - kb and kib - mb and mib - gb and gib as equivalent.	9 months ago
Philippe Antoine	56e08c9134	mime: retain some stateful data for quoted-printable In case a sequence like =3D is split over 2 calls to SCSmtpMimeParseLine Ticket: 7950	9 months ago
Victor Julien	870b40220c	rust: cargo update	10 months ago
Philippe Antoine	096ba42ce9	detect/integers: add some meaningful error messages To help rule writers	10 months ago
Philippe Antoine	4f7fc25a1a	detect/dnp3: make dnp3.ind a generic uint16 bitflags keyword Ticket: 6724 Allows operations such as negation	10 months ago
Philippe Antoine	c1917dec21	detect/integers: make mqtt use generic detect_parse_uint_bitflags Ticket: 6724	10 months ago
Philippe Antoine	867f5bfa21	detect/integers: generic detect_parse_uint_bitflags Ticket: 6724 This will ease other keywords with bitflags, by having a generic function + an association between flag string and bit value.	10 months ago
Philippe Antoine	3641b4eda1	detect/nfs: move nfs_procedure to rust Make it able to use strings on the way Ticket: 6723	10 months ago
Philippe Antoine	9869fb776b	detect/snmp: pdu_type keyword now accepts strings Ticket: 6723	10 months ago
Philippe Antoine	0553dfa814	detect/krb5: move krb5_msg_type to rust Makes it a generic u32 on the way Unit tests are covered by SV tests Ticket: 6723	10 months ago
Philippe Antoine	24503b0ead	rust: move file functions out of SuricataContext Ticket: 7667	10 months ago
Philippe Antoine	1f084f8cb7	rust: move HttpRangeFreeBlock out of SuricataContext Ticket: 7667	10 months ago
Philippe Antoine	828a6bdbf8	rust: bindgen SCLogMessage Ticket: 7667	10 months ago
Philippe Antoine	cc845dccdb	rust: bindgen GenericVarFree Ticket: 7667	10 months ago
Philippe Antoine	b00788af8b	rust: bindgen SCAppLayerParserTriggerRawStreamInspection Ticket: 7667	10 months ago
Philippe Antoine	c52121586a	rust: move AppLayerEvents funcs out of RustContext Ticket: 7667 just use it directly, with bindgen, and cfg not test	10 months ago
Philippe Antoine	bf6b8510fe	rust: move DetectEngineStateFree out of RustContext Ticket: 7667 just use it directly, with bindgen, and cfg not test	10 months ago
Philippe Antoine	573dd2367e	rust: bindgen SCFileFlowFlagsToFlags Ticket: 7667	10 months ago
Philippe Antoine	6fa85d18f0	rust: reenable lint unused_doc_comment With just local exceptions	10 months ago
Philippe Antoine	b59086210f	rust: bindgen flow ffi API Ticket: 7667	10 months ago
Philippe Antoine	bbf1424371	rust: bindgen MpmAddPatternCI Ticket: 7667	10 months ago
Philippe Antoine	c391451f19	rust: begin to bindgen app-layer-register.h Ticket: 7667	10 months ago
Philippe Antoine	95483228d2	detect: list-keywords cli shows integers with bitflags Ticket: 7875	10 months ago
Philippe Antoine	53d9569dfb	detect: list-keywords cli shows integers with enums Ticket: 7875	10 months ago
Philippe Antoine	da486af881	detect: list-keywords cli shows integers Ticket: 7875	10 months ago
Philippe Antoine	68017d3fe1	detect: grow SigTableElmt flags to u32 to be later able to store information about keywords being about integers	10 months ago
Philippe Antoine	b298bce0e7	detect: list-keywords cli shows multi-buffers Ticket: 7571	10 months ago
Philippe Antoine	cb9ab951b9	detect/integers: subslice for multi-integers	10 months ago
Philippe Antoine	82f0e725a2	detect/integers: index or_absent and or_oob To match if array is empty, or index is out of bounds	10 months ago
Philippe Antoine	1480cf47ab	detect/integers: nb index to match a specific number of times For example dns.rrtype: !A,nb>3 will match if we have more than 3 dns records which are not A	10 months ago
Philippe Antoine	6f848eeaaf	detect/integers: all1 index to match only on non-empty arrays	10 months ago
Philippe Antoine	dd81cfa733	detect/uint: wait for end of progress to match on all As is done for absent keyword for instance	10 months ago
Philippe Antoine	5add185f22	http2/detect: http2.window can now use index Ticket: 7480	10 months ago
Philippe Antoine	83868778b9	http2/detect: http2.priority can now use index Ticket: 7480	10 months ago
Philippe Antoine	9fc407fd75	mqtt/detect: mqtt.type can now use index Ticket: 7480	10 months ago
Philippe Antoine	c0988252ba	dns/detect: rrtype can now use index Ticket: 7480	10 months ago
Philippe Antoine	d8c1f8e7be	rust/detect: generic detect_uint_match_at_index and make ldap use it Ticket: 7480 No behavior change, just code restyling	10 months ago
Philippe Antoine	7effcb7835	rust/ldap: use Vec instead of Vecdeque as we do not pop Ticket: 7480 May have a behavior change, but only in terms of performance	10 months ago
Philippe Antoine	f555f02ed4	rust/detect: generic detect_parse_array_uint_enum And make ldap use it Ticket: 7480 No behavior change, just code restyling	10 months ago
Philippe Antoine	c6d3857793	rust/detect: create generic DetectUintArrayData And make ldap use them Ticket: 7480 No behavior change, just code restyling	10 months ago
Philippe Antoine	e01d19889e	rust/detect: move DetectUintIndex definition to generic file Ticket: 7480 No behavior change, just code restyling	10 months ago
Philippe Antoine	ef6ce7d701	detect: rename LdapIndex to something generic to be able to use it outside of ldap Ticket: 7480 No behavior change, just code restyling	10 months ago
Philippe Antoine	2ed7a85356	rust: rustfmt detect uint	10 months ago
Alice Akaki	8e0b0ef35f	detect: add email.body_md5 keyword email.body_md5 matches on md5 hash generated from email body This keyword maps to the EVE field email.body_md5 It is a sticky buffer Supports prefiltering Ticket: #7587	10 months ago
Alice Akaki	6c88cc1e0c	detect/mime: fix detect mime nits Return 0 if .to_str() fails in functions SCDetectMimeEmailGetData and SCDetectMimeEmailGetDataArray Fixes: `431822c` ("detect: add email.from") `96e461f` ("detect: add email.received keyword")	10 months ago
Alice Akaki	4f1cc19f25	mime/smtp: Change md5_result type from GenericArray<u8, U16> to String	10 months ago
Victor Julien	96ae693b44	version: start work on 9.0.0	10 months ago
Shivani Bhardwaj	0d65d35c92	version: start development towards 8.0.2	10 months ago
Jason Ish	2444feed0d	release: 8.0.1; update changelog	10 months ago
Jason Ish	6d74656bef	rust: respect RUSTC and CARGO env vars like CC To support alternative cargo and rustc programs (such as cargo-1.82), respect CARGO and RUSTC environment variables during ./configure much like CC. RUSTFMT is also respected as that is required for the tests, and Cargo can't figure this out like it can for rustc (perhaps a bug in the packaging). For cbindgen, we have also have to make sure the cargo environment variable is set for each invocation. To build with Ubuntu's Rust 1.82 packaging: CARGO=cargo-1.82 RUSTC=rustc-1.82 RUSTDOC=rustdoc-1.82 \ ./configure Note that setting RUSTDOC is only required for commands like "make check" to pass. Ticket: #7877	10 months ago
Jason Ish	db945aec83	rust: bindgen requires rustfmt Bindgen will use rustfmt after generating the bindings, but this will fail if rustfmt is not installed. Only run bindgen if rustfmt is installed.	10 months ago
Jason Ish	4d4198dccc	rust: update tracing-subscriber Address https://rustsec.org/advisories/RUSTSEC-2025-0055.	10 months ago
Jason Ish	3b9dfe620d	rust: pin time crate to 0.3.41 0.3.42 introduces dependencies that require Rust 1.81.	10 months ago
Philippe Antoine	be605ba2de	htp: use transactions right get function Not the VecDeque one Ticket: 7803	11 months ago
Philippe Antoine	d0a513df6a	detect/integers: support kibibyte unit Ticket: 7869	11 months ago
Philippe Antoine	2a17ab6d88	http: generate no anomaly for identity encoding Ticket: 7843	11 months ago
Jeff Lucovsky	03d676531a	detect/from_base64: Support keyword w/no opts Issue: 7853 Support the use of `from_base64` with no optional values. In this case, the default values for: - mode RFC4648 - offset: 0 - bytes: buffer size will be used.	11 months ago
Jason Ish	b93a27722c	rust: fix mismatched_lifetime_syntaxes warning Fix new warning present in Rust 1.89. warning: hiding a lifetime that's elided elsewhere is confusing --> src/ldap/types.rs:191:30 = help: the same lifetime is referred to in inconsistent ways, making the signature confusing = note: `#[warn(mismatched_lifetime_syntaxes)]` on by default help: use `'_` for type paths	11 months ago
Philippe Antoine	fe9da8acd6	http2: do not log empty objects for request or response Ticket: 7741	12 months ago
Philippe Antoine	11c549211e	snmp: fix the possibility to disable the parser Ticket: 7820 Do not register anything, not even ALPROTO_SNMP "snmp" string if parser is disabled	12 months ago
Shivani Bhardwaj	e4b3b75b23	version: start development towards 8.0.1	1 year ago
Shivani Bhardwaj	9956286fb8	release: 8.0.0; update changelog	1 year ago
Philippe Antoine	fa8d3a4ccb	http2: do not set file flags for global txs Global txs means here txs with stream id 0, used for connection control messages.	1 year ago
Philippe Antoine	349c21af2c	http2: mark old txs as updated As is done in the other case a few lines below	1 year ago
Philippe Antoine	1d6d331752	http2: forbid data on stream 0 Ticket: 7658 Suricata will not handle well if we open a file for this tx, do not close it, but set the transaction state to completed. RFC 9113 section 6.1 states: If a DATA frame is received whose Stream Identifier field is 0x00, the recipient MUST respond with a connection error (Section 5.4.1) of type PROTOCOL_ERROR.	1 year ago
Jason Ish	c204ddb3e5	rust/Makefile: sort filenames Misc cleanup as these lists are growing.	1 year ago

... 3 4 5 6 7 ...

2373 Commits (main)