Add accessor functions to allow NDPI and our plugin examples to access
flow fields in an opaque manner.
Provides accessors for:
- is ipv4
- is ipv6
- ip protocol
- to server packet count
- to destination packet count
Ticket: #8632
Remove the check for Flow.storage being NULL. With flex arrays, as long as the
flow is allocated, .storage will never be NULL. We do make sure the flow
is not NULL, and the storage functions are safe to the storage being
NULL.
Prevents NDPI from accessing this flow field to be less sensitive to ABI
changes with respect to data structure sizes.
Ticket: #8632
RFC 5321 says a mid-session EHLO should work just like RSET. We more or
less ignored it, which meant transaction state could carry over.
Treat a HELO/EHLO received during a transaction as RSET once the server
accepts it.
Ticket: #8715
The policy config was a flat map mixing packet hooks and app-layer
protocols: `packet-filter` next to `dns`. There was no node that meant
"the packet hooks" or "the app-layer hooks", so a setting could not be
scoped to one group.
Move each group under its own node:
packet-filter -> packet.filter
packet-pre-flow -> packet.pre-flow
packet-pre-stream -> packet.pre-stream
<proto>.<hook> -> app.<proto>.<hook>
Ticket: 8712
AppProtoToString(ALPROTO_HTTP1) returns "http", so an HTTP/1 policy had to
be written as `http:` while its rule hooks were already spelled `http1:`.
Use the same name in both places.
Ticket: 8712
To avoid back-and-forth of http1 conversion
a second query function was added to support
existing use cases.
This change will be handy for the upcoming
default-policy for firewall settings
This is required when rustc is not in a standard path. The other
cbindgen calls already had this, so it was just missed while adding the
ffi bindings, but shows up when rustc is at a path like
/usr/lib/rust-1.89/bin/rustc, but that directory is not in your path.
Disable the clippy warning for not using modern C string
literals. Ubuntu 24.04 still ships cbindgen 0.26.0 that doesn't
support these, so migrating to modern C string literals would require
Ubuntu 24.04 users wishing to build from git to install cbindgen with
cargo.
Debian 13 ships Rust 1.85 by default, Ubuntu requires installing a
specific patch to get newer then 1.75. So to support a newer MSRV,
these operating systems need different examples.
Analyzer arrays store internal IDs of the signature for an easy lookup
later from the DetectEngineCtx. However, the storage arrays were
inappropriately named as sid arrays. Make it coherent.
Bring Analyzer structs and fns to the header for later use in a wider
context.
Ticket: 8678
With an inspect window of 0xAAAAAAAB the `window * 3` guard wrapped to 1
in uint32_t arithmetic, so it passed for a 64 byte file and
content_inspected was set to `file->size - window`, an underflow.
Ticket: 8678
In FilePruneFile() `window * 3` was computed in uint32_t arithmetic.
The guard exists to ensure `file->size > window`, so on wrap around
`file->size - window` underflows and content_inspected is set to a
bogus value, breaking file inspection.
Make window uint64_t so the multiplication cannot wrap.
With this patch, the logged uuids will also have corresponding
stringified service names. The requests that will have an opnum will
have a corresponding stringified procedure name.
Feature 2727
Feature 8523
This data directly comes from Zeek @d11a8750. It was scriptually
converted to NDJSON ingestible to Suricata using serde and serde_json.
The script used for this conversion lives in
scripts/extract_dce_rpc_interfaces.py.
Part of this data within Zeek codebase comes from the MITRE BZAR
project. Hence, the LICENSE file alongwith this data consists of both
the licenses: Zeek and BZAR.
Feature 2727
Feature 8523
SMTPGetLine assigned response frames to the current transaction even when a
queued reply belonged to an older transaction.
Use the queued command owner so frame EVE output and frame-based detection
receive the correct transaction id.
Includes some re-org to avoid prototypes for static functions.
Ticket: #8741
A BDAT command that failed to parse, such as "BDAT 5 X", returned -1,
disabling SMTP parsing for the rest of the flow. A server may reject the
command and continue the session, leaving following messages
uninspected.
Instead raise a decoder event and queue the command as an ordinary
command.
Ticket: #8741
Track the BDAT LAST marker so the final chunk and its reply complete the
transaction in each direction, preventing a following MAIL FROM from
being merged into the previous transaction.
Ticket: #8741
Ticket: 8797
Add check to rlen value read from ERF record to avoid potential infinite loop, must be >= dag_record_length (16).
Similar check exists in source_erf_file already.
RUSTSEC-2026-0253 in the lru crate requires that items we put in the
lru have a drop implementation that may panic, and we catch
that panic. The current items we put in the lru cache do not have a drop
implementation, and we treat panic's as fatal so will not run into the
issue presented in RUSTSEC-2026-0253.
The TLV loop for the IPv6 hop-by-hop and destination option headers
gates each option on (offset + 1 + ip6_optlen) > optslen. An option is
two header bytes (type, length) plus ip6_optlen data bytes, so its data
ends at offset + 1 + ip6_optlen and the bound has to be
offset + 2 + ip6_optlen.
Before: an option that declares its data running one byte past the
option area is accepted, and the Router Alert / Jumbo / Home Address
memcpy then copies sizeof(value) bytes ending one byte past the area;
when the header sits at the tail of the IPv6 payload that read goes
past the payload.
After: the option is rejected with IPV6_EXTHDR_INVALID_OPTLEN, matching
how the IPv4 option loop already bounds a full option against the
remaining length. The check stays next to the read so each option type
does not need its own guard.
Ticket: #8817.
Jason Ish
Lukas Sismis
Shivani Bhardwaj
Denis Balashov
Stephen Donnelly
Dmitry Uryvchikov
Uwez Khan
Victor Julien
Philippe Antoine
dependabot[bot]