19077 Commits (143774220eaa066606832473f42e1bc021db99da)

 

All Branches   

Search

Author	SHA1	Message	Date
Giuseppe Longo	143774220e	doc: add llmnr ... Ticket #8366	1 month ago
Giuseppe Longo	0b20011a9f	llmnr: implement sticky buffers ... Add detection keywords for LLMNR protocol inspection: - llmnr.queries.rrname - llmnr.answers.rrname - llmnr.authorities.rrname - llmnr.additionals.rrname - llmnr.response.rrname LLMNR reuses the existing DNS functions since it follows the same protocol structure. The implementation registers LLMNR-specific keywords that leverage the DNS data extraction functions. Both to_server and to_client directions are supported. Ticket #8366	1 month ago
Giuseppe Longo	8f205bb34f	llmnr: implement logger ... This adds an LLMNR protocol logger that reuses existing DNS functions, following the same approach as the mDNS logger: - No grouped logging - Rdata is logged in a field that is named after the rdata type - Types are logged in lower case - Flags are logged as an array Ticket #8366	1 month ago
Giuseppe Longo	13df0f7a06	llmnr: implement parser ... This adds a parser for LLMNR protocol over both UDP and TCP. The parser reuses the existing DNS functions since LLMNR shares the same wire format as DNS, but implements its own protocol-specific validation: - LLMNR-specific flag checks (C, TC, T bits) - Opcode validation (only standard query opcode 0 is valid) - An Event is set if Z-flag is set, since it's must be zero per RFC4795 LLMNR transactions inherit DNS behavior where each packet creates a new state with one transaction. Ticket #8366	1 month ago
Victor Julien	9e82ff82e2	fuzz: use heap threadvars allocations ... Use new allocator to properly set up thread storage.	1 month ago
Victor Julien	cefee1390e	detect/threshold: don't double init per thread cache ... Can get called multiple times in the multi-tenancy case.	1 month ago
Victor Julien	f67dadc3d8	detect/threshold: fix unittests for storage based cache	1 month ago
Victor Julien	c27868a8c5	threshold: use seed consistently in hashing ... Use for IPv6 in the main hash. Update IPv4 thread cache to also use a seed. For this the thread initialization is done at thread init instead on the first packet. The thread ctx is no longer stored in a thread_local, but instead uses the thread storage API to store in the ThreadVars. This way it will stay active during rule reloads as well. Ticket: #8617.	1 month ago
Victor Julien	b742d58544	hash: allow registing with a seed value ... Seed value will have to be used by the caller's hash function.	1 month ago
Victor Julien	730ff5075d	threads: use threadvars memory helpers	1 month ago
Victor Julien	ad1459df72	threads: add threadvars allocator and free func ... Mostly meant to help unittests and fuzz targets alloc the storage correctly.	1 month ago
Victor Julien	b11aa94d42	decode/vlan: implement max layers for IEEE8021ah ... Ticket: #8615.	1 month ago
Victor Julien	377462ea63	defrag: decrement memuse on alloc failure ... Ticket: #8613.	1 month ago
Jason Ish	3dc8b154f3	rust/ffi: add safe thread storage wrapper ... Add a typed ThreadStorage<T> wrapper around the thread storage bindings. Ticket: #8445	1 month ago
Jason Ish	9f40968bba	rust/ffi: bindgen thread storage ... Ticket: #8445	1 month ago
Jason Ish	5e0abf1572	rust/ffi: use ThreadVars wrapper in flow callbacks ... Update the flow init, update and finish callback registrations to pass the safe ThreadVars wrapper instead of a raw pointer. Ticket: #8598	1 month ago
Jason Ish	1cac242948	rust/ffi: use ThreadVars wrapper in eve callback ... Update the EVE callback registration to pass the safe ThreadVars wrapper instead of a raw pointer. Ticket: #8598	1 month ago
Jason Ish	45762aa644	rust/ffi: use ThreadVars wrapper in thread init callback ... Update the thread init callback registration to pass the safe ThreadVars wrapper instead of a raw pointer. Ticket: #8598	1 month ago
Jason Ish	5fe88212c3	rust/ffi: add wrapper around ThreadVars ... A Rust wrapper around ThreadVars to enforce Rust lifetimes to ThreadVars when used in a callback. Ticket: #8598	1 month ago
Victor Julien	736f50600f	mpm/hs: fix compile warnings ... CC util-mpm-hs-cache.o util-mpm-hs-cache.c:301:59: error: implicit conversion loses integer precision: '__size_t' (aka 'unsigned long') to 'uint32_t' (aka 'unsigned int') [-Werror,-Wshorten-64-to-32] 301 | SCSha256Update(hasher, (const uint8_t *)ref_info, strlen(ref_info)); | ~~~~~~~~~~~~~~ ^~~~~~~~~~~~~~~~ util-mpm-hs-cache.c:310:46: error: implicit conversion loses integer precision: 'size_t' (aka 'unsigned long') to 'uint32_t' (aka 'unsigned int') [-Werror,-Wshorten-64-to-32] 310 | if (!SCSha256FinalizeToHex(hasher, hash, hash_len)) { | ~~~~~~~~~~~~~~~~~~~~~ ^~~~~~~~ 2 errors generated.	1 month ago
Victor Julien	781bd5184e	clang-format: support clang 17 ... Update Github CI runner to use it. Bump to Ubuntu 24.04 as well.	1 month ago
Victor Julien	e0b501a4b7	detect: cleanup last tx logic ... Move into DetectTransaction.	1 month ago
Victor Julien	3d00e73d91	detect: make progress values uint8_t ... Also reflect that it can be >= 48, like in prefilter.	1 month ago
Victor Julien	a9b3ad49ea	detect/firewall: minor code cleanup	1 month ago
Victor Julien	4db84cfa28	detect/firewall: clean up apply accept logic ... Use end state from tx. Handle flow control from inside the function consistently.	1 month ago
Victor Julien	68885e75e1	detect/firewall: refactor per tx rule result handling ... Break out the 3 options: match, partial match, no match for firewall into separate functions. Additionally, handle the re-match case for matches on a hook where the progress value didn't yet progress further. In this case the continue inspection logic revisits the rule and the accept needs to be re-applied.	1 month ago
Philippe Antoine	73193c7e6a	rust: format pgsql files ... Ticket: 3836	1 month ago
Philippe Antoine	3bfe6cf4b9	rust: format nfs files ... Ticket: 3836	1 month ago
Juliana Fajardini	a783007408	detect/bypass: ban bypass keyword for firewall mode ... Related to Ticket #8551	1 month ago
Juliana Fajardini	edaa912ed9	detect: ban `replace` keyword for firewall mode ... Ticket #8551	1 month ago
Juliana Fajardini	372cb8c692	rust/sys: update bindgen SIGMATCH_ constants ... Part of Ticket #8551	1 month ago
Juliana Fajardini	6e71ff3013	detect/parse: allow banning keywords with fw mode ... Related to Ticket #8551	1 month ago
Juliana Fajardini	04a7674512	detect/parse: allow banning keywords from fw rules ... Related to Ticket #8551	1 month ago
Philippe Antoine	e089ac9775	util/mpm-ac: preallocate on the heap rather than stack ... Ticket: 8001 As the the size of the allocation can get large	1 month ago
Philippe Antoine	dc5185e355	util/mpm-ac-ks: preallocate on the heap rather than stack ... Ticket: 8001 As the the size of the allocation can get large	1 month ago
Philippe Antoine	94a3e03903	util/mpm: add MpmCtx argument to MpmInitThreadCtx ... Ticket: 8001 Will allow algorithms such as ac to use the MpmCtx, especially the number of patterns, to preallocate some structures. For detect engine PatternMatchThreadPrepare, create a dummy MpmCtx out of all the MpmCtx in the DetectEngineCtx, and get the max value for the number of patterns	1 month ago
Philippe Antoine	25bf59f238	util/spm: explicit needle_len is u16 ... So, stack allocation is bounded Ticket: 8001	1 month ago
Victor Julien	9c76480ac3	detect/firewall: further simplify flow control ... For the last for progress case we can just break on a firewall drop. For the accept:flow and accept:tx cases the next sig (if any) will check the flow/tx flag and manage flow control from there.	2 months ago
Victor Julien	0a84015214	doc/userguide: add new constructs to firewall examples	2 months ago
Victor Julien	8728f9ffc0	doc/userguide: document firewall lte rule support	2 months ago
Victor Julien	ac59883c26	doc/userguide: fix default policies for pre_* hooks ... Minor other cleanups.	2 months ago
Victor Julien	da6af0879e	doc: update firewall design ... Bring in line with recent changes.	2 months ago
Victor Julien	bb6dc93789	detect/firewall: clean up per rule run check	2 months ago
Victor Julien	035e8bc851	detect/firewall: minor flow control cleanup	2 months ago
Victor Julien	bb7aff36a8	detect/firewall: simplify pre-check flow ... Simplify pre-check logic. Pre-check takes care of enforcing FLOW_ACTION_ACCEPT, APP_LAYER_TX_ACCEPT and default policy enforcement before the current rule's hook. This should be done in firewall mode for each rule regardless whether it is a firewall or TD rule. No need to track verdict state anymore.	2 months ago
Victor Julien	68f73302ce	detect/firewall: clean up tx inspection loop	2 months ago
Victor Julien	a86fe01cc3	detect/firewall: consolidate action handling ... Step towards consolidating all action handling into a central location.	2 months ago
Victor Julien	1ad9c3ec29	detect/firewall: clean up pre-check policy logic	2 months ago
Victor Julien	52967c69ec	detect/firewall: fix accept:tx,alert in default policy	2 months ago
Victor Julien	247c6a2333	detect/firewall: inject alert before default policy ... If default policy is invoked because of missing rules for next hooks, make sure to inject an alert before the next hook policies might do so.	2 months ago