aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
18,675 Commits
8 Branches
173 Tags
193 MiB
main-8.0.x
main
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '0cb88d6260'
${ noResults }
Commit Graph

2172 Commits (0cb88d62604202cdeea6a2ed1b36b84b7fdd4bbf)

Author SHA1 Message Date
Philippe Antoine d77c43c79b rust/ffi: move build_slice macro to ffi crate 
Ticket: 7666
 5 months ago
Philippe Antoine 4a0143c8d4 rust/ffi: move cast_pointer macro to ffi crate 
Ticket: 7666
 5 months ago
Shivani Bhardwaj d241237c0f Revert "dcerpc: fix consumed bytes post gap handling" 
This reverts commit fc9da1c7a1.

That commit incorrectly used consumed as index of the slice passed to
the Frame API.
Found by oss-fuzz.
 5 months ago
Jeff Lucovsky ed882ede68 output/ipv6: Utility function to compress IPv6 addrs 
Issue: 7399

Utility function to compress IPv6 addresses per RFC-5952
 5 months ago
Giuseppe Longo de46f4ba9d ldap: set invalid_data event 
Currently in parse_request function LdapEvent::InvalidData is not set when a
request is not parsed correctly.

Ticket #8258
 5 months ago
Victor Julien b55be5a44f detect/transforms: update gunzip / zlib_deflate syntax 
Use standard space separated syntax.
 5 months ago
Philippe Antoine 71b59f6dbe rust/ffi: move IPPROTO_TCP to ffi 
and reexport in suricata

Allows to reduce dependencies to full suricata crate

Ticket: 7666
 5 months ago
Philippe Antoine d5ea973791 detect/ike: move ike.ike.chosen_sa_attribute keyword to rust 
Ticket: 8310

And increases expressivity on the way by supporting other modes
than equality
 6 months ago
Philippe Antoine 55333a6ca0 detect/ike: move ike.vendor keyword to rust 
Ticket: 8310
 6 months ago
Philippe Antoine 14edd66494 detect/ike: move ike.nonce_payload keyword to rust 
Ticket: 8310
 6 months ago
Philippe Antoine d1213e4440 detect/ike: move ike.key_exchange_payload keyword to rust 
Ticket: 8310
 6 months ago
Philippe Antoine f23169c924 detect/ike: move ike.nonce_payload_length keyword to rust 
Ticket: 8310
 6 months ago
Philippe Antoine e85bf5be4d detect/ike: move ike.key_exchange_payload_length keyword to rust 
Ticket: 8310
 6 months ago
Philippe Antoine 841fe44f34 detect/ike: move ike.exchtype keyword to rust 
Ticket: 8310
 6 months ago
Philippe Antoine 23032ebc65 detect/ike: move ike spi keywords to rust 
Ticket: 8310
 6 months ago
Philippe Antoine 539e4ee665 detect/transforms: add zlib_deflate transform 
Ticket: 7846
 6 months ago
Philippe Antoine dbea660729 detect/transforms: add gunzip transform 
Ticket: 7846
 6 months ago
Victor Julien 336a9d05ca krb5: fix TCP record parsing 
A logic error in multi-record parsing meant only the first record was parsed.

Bug: #8278.
 6 months ago
Jason Ish 6b850dddb8 rust/ffi: JsonBuilder wrapper around C JsonBuilder API 
For use by plugins that need to work with JsonBuilder.
 6 months ago
Jason Ish f6b11ac855 output-eve: finish exposing to bindgen 
As all out output-eve.h is now exposed, merge output-eve.h and
output-eve-bindgen.h back into one file, output-eve.h.
 6 months ago
Jason Ish f79158ae55 rust/sys: generate jsonbuilder bindings in sys 
Bindgen the Rust bindings to the C JsonBuilder API along with the rest
of the Rust bindings to C. Breaking it out was probably the wrong
idea.

This should make it easier, and more correct to bindgen C functions
that use SCJsonBuilder types.
 6 months ago
Jason Ish f951477461 rust/debug: use functions from ffi crate where possible 
It's not possible to use all the functions and macros from the ffi crate
in the main Suricata crate, as there are conditionals around when
running in test mode, and "cargo test" doesn't propagate the "cfg(test)"
to test crates.

Which for now means duplicating the macros and some functions.
 6 months ago
Jason Ish 8b69089cb8 rust/ffi: more rust friendly plugin registration 
A plugin can now create a "Plugin" struct with Rust strings.  The
`into_raw` method converts it to a raw pointer suitable for returning
during plugin registration.
 6 months ago
Jason Ish 0999530726 rust/ffi: rust wrapper around eve filetype registration 6 months ago
Jason Ish 2d0bf9a2ed output-eve: bindgen SCEveFileType callback types 6 months ago
Jason Ish b4db7bdaee rust/ffi: add logging (debug) wrappers 
Mostly a copy of Suricata core's logging wrappers into the ffi crate.

These are not yet used by Suricata-core as they do require the
Suricata library to be available, which is not the case with tests. And
the `cfg(test)` parameter is not passed through to sub-crates.

However, this does allow a plugin (or library) to call the logging
macros without depending on the "suricata" crate.

Ticket: #7666
 6 months ago
Jason Ish 2c51744ccc rust/ffi: stub out a rust ffi crate 
This crate is for Rust wrappers around the -sys crate which includes
only raw bindings. This is the place to add nice wrappers around those
bindings, however it should remain clear of dependencies on the main
Suricata core crates.

Ticket: #7666
 6 months ago
Jason Ish e9611a4d7c output-eve: bindgen SCRegisterEveFileType to Rust 
Used by Rust output plugins.
 6 months ago
Jason Ish 1b182025bc output-eve: expose SCEveFileType to Rust with bindgen 
There is an unfortunate side-affect that one has to read
output-eve-bindgen.h for the documentation on this type, however, I
think we can resolve that in time.
 6 months ago
Philippe Antoine 536242341b detect/smb: move smb.version keyword to rust 
Ticket: 8267
 6 months ago
Philippe Antoine df495d7e22 rust: bindgen SCDetectGetLastSMFromLists 
to use it from rust keywords
 6 months ago
Philippe Antoine 697c641400 detect/smb: move smb share and named_pipe keywords to rust 
Ticket: 8267
 6 months ago
Philippe Antoine 667f8b2eb7 detect/smb: move smb ntlmssp keywords to rust 
Ticket: 8267
 6 months ago
Victor Julien a2e9ac21f8 flow: turn flags field into uint64_t 
Entire space is used.
 6 months ago
Jason Ish b0c912588c mqtt/detect: fix mqtt_parse_bool return type 
Previously we were boxing a u8 and returning it as a pointer to a
boolean. While this is probably not an issue itself, the value 2 was
allowed to be converted to a boolean, which is undefined behavior in
Rust.
 6 months ago
Jason Ish b9e0f9cc8b rfb/detect: fix rfb_parse_sec_result return type 
The data parsed is a u32, but returned as DetectUintData<u8>, then
later free'd as a DetectUintData<u32>.
 6 months ago
Jason Ish 8b2a7ac47c nfs/detect: fix nfs_procedure_parse return type 
Was returning DetectNfsProcedureData as a pointer to
DetectUintData<u32>, and free'ing it as such.
 6 months ago
Jason Ish e474e45429 dns/detect: fix rcode return type 
The parsed DNS rcode was being returned as a DetectUintData<u8>, but is
parsed, and free'd as a u16. So return a DetectUintData<u16>.
 6 months ago
Jason Ish c7f806a728 rust/sys: allow unknown lints 
allow(unpredictable_function_pointer_comparisons) is needed on newer
versions of Rust, but is unknown to our MSRV, so for now, allow unknown
lints.
 6 months ago
Philippe Antoine 364d2c077d rust: bindgen SCAppLayerRegisterParser 
Ticket: 7662
 6 months ago
Philippe Antoine 8401417a84 app-layer: remove some obsolete forward declarations 
and reorder definitions
 6 months ago
Philippe Antoine 8857b78f6a rust: move AppLayerTxData definition to C 
and bindgen it to rust

Will make easier the bindgen of RustParser structure which uses
a callback which uses AppLayerTxData

Move also the free function to C SCAppLayerTxDataCleanup
As suricata-sys crate defines AppLayerTxData for rust,
It must itself implement the Drop trait, and thus,
We need to define a feature surest
 6 months ago
Philippe Antoine 8eaced3c1e rust: move AppLayerResult definition to C 
and bindgen it to rust

Will make easier the bindgen of RustParser structure which uses
a callback which uses AppLayerResult

Keep From<> impl in sys crate that defines it
 6 months ago
Philippe Antoine 06f78b2a22 rust: move StreamSlice definition to C 
and bindgen it to rust

Will make easier the bindgen of RustParser structure which uses
a callback which uses StreamSlice
 6 months ago
Philippe Antoine 41f543ca35 rust: move AppLayerGetTxIterTuple definition to C 
and bindgen it to rust

Will make easier the bindgen of RustParser structure which uses
a callback which uses AppLayerGetTxIterTuple
 6 months ago
Philippe Antoine 64d29fcd1c rust: move AppLayerStateData definition to C 
and bindgen it to rust, and use default trait instead of new

Will make easier the bindgen of RustParser structure which uses
a callback which uses AppLayerStateData
 6 months ago
Philippe Antoine 76efb8af4d rust: move AppLayerGetFileState definition to C 
and bindgen it to rust.

Will make easier the bindgen of RustParser structure which uses
a callback which uses AppLayerGetFileState
 6 months ago
Philippe Antoine fc23e54c6d rust: bindgen with derive eq 
As will be needed such as AppLayerTxData
 6 months ago
Shivani Bhardwaj d4008a6508 dcerpc: remove bad tests 
Unittests test_parse_bind_pdu_infinite_loop and
test_parse_bindack_pdu_infinite_loop seem to have artificially made up
header which does not hold up to the strict calculations enforced by the
parser now. Their headers mark the fraglens as 64 and 72 respectively
which are not enough to hold the kind of bind(ack) items that are expected.
It worked so far as the parser passed the entire input slice around but
with the bugfix for issue 7546, the input passed around is strictly
restricted to the fraglen parsed in the header.

Bug 7546
 6 months ago
Shivani Bhardwaj ed1bd8624e dcerpc: use fraglen from header 
So far, the fraglen defined in the header was used inconsistently in
certain places to define bounds on input length. Make it consistent by
making sure that only a slice up until fraglen is passed around as that
is the maximum length the fragment should have.
With the help of Applayer::incomplete API, the case when the
stream_slice passed to the parser is smaller than the header defined
fraglen is already handled.

Bug 7546
 6 months ago