117 Commits (09a525659c1b081df3133266daf7c845c47cccfa)

Author	SHA1	Message	Date
Jeff Lucovsky	7bc883ef93	detect/transforms: disqualify variable-key transforms from prefilter ... A transform that derives its key material from a runtime byte_extract or byte_math variable cannot have its buffer precomputed at load time, so the content of that buffer is unusable as a fast_pattern. Add the engine plumbing to recognise such transforms and keep them out of prefilter/MPM. SignatureInitData gains a var_transform flag. RetrieveFPForSig bails out for any signature that sets it, so the signature falls back to full inspection rather than contributing an MPM pattern that can't be built ahead of time. New helpers support a transform consuming a variable: - SCSignatureSetVarTransform() raises the disqualification flag. - SCDetectByteVarResolve() resolves a byte_extract or byte_math variable by name to its runtime slot, and for a byte_extract reports its natural key width (a byte_math result has none). - SCDetectEngineThreadCtxGetByteVar() reads a byte_* variable's runtime value from the thread context. The helpers are declared in detect-engine-buffer.h so the bindgen run picks them up; the Rust bindings are regenerated to match. Issue: 7847	3 months ago
Victor Julien	95365ce05b	detect: support per tx sub states ... Support for per transaction sub states: different state machines per transaction type. Skip engines not belonging to our substate. Store tx_type in DetectTransaction. Each protocol supporting sub states will register states from 1 and up. To support: Ticket: #8386.	4 months ago
Victor Julien	b6bc025789	app-layer: start of substate API support ... Allow registration of per substate progress name mappings. Implement logic for getting sub-state names, id's. Add transaction type and end of progress values to AppLayerTxData. Introduce helpers to keep logic clean.	4 months ago
Philippe Antoine	752dae89ea	detect: add progress argument to SCDetectRegisterMpmGeneric ... Will be needed by snmp	4 months ago
Philippe Antoine	7d024a840c	rust: bindgen detect ThreadCtx keyword functions	4 months ago
Philippe Antoine	89dbce1b46	detect: convert tx_progress to uint8_t	4 months ago
Philippe Antoine	a9e1dff4a6	conf: introduce SCConfGetNonNull ... Ticket: 8651 Behaves like SCConfGet but returns 0 on null value	5 months ago
Jason Ish	546209ff12	bindgen: fix include ordering ... At some point, bindgen include ordering changed such that AppLayerGetFileState was being bindgen'd as opaque, as the definition of StreamBufferingConfig was not available when bindgen hit AppLayerGetFileState, and bindgen processes in order. Move the util includes before the app-layer includes to fix the ordering problem, but still keep util includes grouped. The sys diff is large as many things have been re-ordered.	5 months ago
Giuseppe Longo	13df0f7a06	llmnr: implement parser ... This adds a parser for LLMNR protocol over both UDP and TCP. The parser reuses the existing DNS functions since LLMNR shares the same wire format as DNS, but implements its own protocol-specific validation: - LLMNR-specific flag checks (C, TC, T bits) - Opcode validation (only standard query opcode 0 is valid) - An Event is set if Z-flag is set, since it's must be zero per RFC4795 LLMNR transactions inherit DNS behavior where each packet creates a new state with one transaction. Ticket #8366	5 months ago
Jason Ish	9f40968bba	rust/ffi: bindgen thread storage ... Ticket: #8445	5 months ago
Juliana Fajardini	372cb8c692	rust/sys: update bindgen SIGMATCH_ constants ... Part of Ticket #8551	5 months ago
Jason Ish	c689af0bbb	rust/ffi: bindgen thread lifecycle callbacks ... Ticket: #8605	5 months ago
Philippe Antoine	4c42998feb	detect/engine: helper to know if a transform happens in-place	5 months ago
Jason Ish	d4dc8be3b2	rust: bindgen flow lifecycle callbacks ... Ticket: #8446	6 months ago
Philippe Antoine	3d56472d16	detect: bindgen more functions ... To prepare to move dcerpc.stub_data keyword to full rust	6 months ago
Philippe Antoine	a36af353bc	rust: bindgen SCFlowGetAppProtocol	6 months ago
Philippe Antoine	8f824458c2	detect: helper for buffer register requires progress ... Ticket: 8395 For protocols where tx are complete at start, that is the `tx_get_progress` function returns 1 inconditionnally, we can use the progress 1, not losing time on detection in ips mode, and getting ready for firewall mode For the other protocols (where a tx needs both a request and response for instance), keep progress 0 as was the case before	7 months ago
Philippe Antoine	d14af54b3b	detect/transforms: constify some callbacks arguments ... Ticket: 8298	7 months ago
Philippe Antoine	4f4912c042	rust: bindgen SIGMATCH_ constants	7 months ago
Jason Ish	f6b11ac855	output-eve: finish exposing to bindgen ... As all out output-eve.h is now exposed, merge output-eve.h and output-eve-bindgen.h back into one file, output-eve.h.	9 months ago
Jason Ish	f79158ae55	rust/sys: generate jsonbuilder bindings in sys ... Bindgen the Rust bindings to the C JsonBuilder API along with the rest of the Rust bindings to C. Breaking it out was probably the wrong idea. This should make it easier, and more correct to bindgen C functions that use SCJsonBuilder types.	9 months ago
Jason Ish	2d0bf9a2ed	output-eve: bindgen SCEveFileType callback types	9 months ago
Jason Ish	e9611a4d7c	output-eve: bindgen SCRegisterEveFileType to Rust ... Used by Rust output plugins.	9 months ago
Jason Ish	1b182025bc	output-eve: expose SCEveFileType to Rust with bindgen ... There is an unfortunate side-affect that one has to read output-eve-bindgen.h for the documentation on this type, however, I think we can resolve that in time.	9 months ago
Philippe Antoine	df495d7e22	rust: bindgen SCDetectGetLastSMFromLists ... to use it from rust keywords	9 months ago
Victor Julien	a2e9ac21f8	flow: turn flags field into uint64_t ... Entire space is used.	9 months ago
Jason Ish	c7f806a728	rust/sys: allow unknown lints ... allow(unpredictable_function_pointer_comparisons) is needed on newer versions of Rust, but is unknown to our MSRV, so for now, allow unknown lints.	9 months ago
Philippe Antoine	364d2c077d	rust: bindgen SCAppLayerRegisterParser ... Ticket: 7662	9 months ago
Philippe Antoine	8857b78f6a	rust: move AppLayerTxData definition to C ... and bindgen it to rust Will make easier the bindgen of RustParser structure which uses a callback which uses AppLayerTxData Move also the free function to C SCAppLayerTxDataCleanup As suricata-sys crate defines AppLayerTxData for rust, It must itself implement the Drop trait, and thus, We need to define a feature surest	9 months ago
Philippe Antoine	8eaced3c1e	rust: move AppLayerResult definition to C ... and bindgen it to rust Will make easier the bindgen of RustParser structure which uses a callback which uses AppLayerResult Keep From<> impl in sys crate that defines it	9 months ago
Philippe Antoine	06f78b2a22	rust: move StreamSlice definition to C ... and bindgen it to rust Will make easier the bindgen of RustParser structure which uses a callback which uses StreamSlice	9 months ago
Philippe Antoine	41f543ca35	rust: move AppLayerGetTxIterTuple definition to C ... and bindgen it to rust Will make easier the bindgen of RustParser structure which uses a callback which uses AppLayerGetTxIterTuple	9 months ago
Philippe Antoine	64d29fcd1c	rust: move AppLayerStateData definition to C ... and bindgen it to rust, and use default trait instead of new Will make easier the bindgen of RustParser structure which uses a callback which uses AppLayerStateData	9 months ago
Philippe Antoine	76efb8af4d	rust: move AppLayerGetFileState definition to C ... and bindgen it to rust. Will make easier the bindgen of RustParser structure which uses a callback which uses AppLayerGetFileState	9 months ago
Philippe Antoine	fc23e54c6d	rust: bindgen with derive eq ... As will be needed such as AppLayerTxData	9 months ago
Philippe Antoine	7dbe033ae0	app-layer: function to register ci pattern + probe ... Ticket: 6591	9 months ago
Philippe Antoine	2cf9a327d5	detect/ssh: move ssh.hassh to rust ... Introduces helper SCDetectRegisterBufferLowerMd5Callbacks	9 months ago
Philippe Antoine	83360cfce0	detect/ssh: move ssh.hassh string to rust ... bindgen needed SCSigMatchSilentErrorEnabled on the way	9 months ago
Philippe Antoine	ea8ac2a02a	detect/ssh: move ssh.software to rust ... Adds helper function SCDetectHelperBufferProgressMpmRegister on the way	9 months ago
Philippe Antoine	c0d6747e82	app-layer: GetTxIteratorFn uses a AppLayerGetTxIterState ... Even if every current rust parser uses the u64 variant of the C union	9 months ago
Philippe Antoine	4b541b39f2	rust: move AppLayerEventType definition to C ... and bindgen it to rust. Will make easier the bindgen of RustParser structure which uses a callback which uses AppLayerEventType	9 months ago
Lukas Sismis	3e4fdb2118	misc: time unit parsing function	10 months ago
Jason Ish	d89b35db56	conf: add SCConfNodeChildValueIsFalse to check for false value ... New function to check is a value is actually set to a false value.	11 months ago
Jeff Lucovsky	9c81f817e8	rust: bindgen update ... Issue: 7389 Update bindgen with `make update-bindgen`	11 months ago
Philippe Antoine	b4d8aea0ae	rust: bindgen SCAppLayerRegisterProtocolDetection ... Ticket: 7662 Changing the struct passed to it to have the minimal number of useful fields.	11 months ago
Philippe Antoine	1329786f84	detect: new command line option : list-rule-protos ... To list the protocols we can use a in a rule header Ticket: 635	11 months ago
Philippe Antoine	15b1bf4865	rust: bindgen SCHTPFileCloseHandleRange ... Ticket: 7762	11 months ago
Philippe Antoine	cddbd0b906	rust: bindgen more file functions ... Ticket: 7762	11 months ago
Philippe Antoine	327b8b04a9	rust: bindgen with default derive ... Ticket: 7762	11 months ago
Philippe Antoine	cba13ed9b1	rust: bindgen functions needed for datasets ... Ticket: 7762	12 months ago