aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
18,531 Commits
8 Branches
174 Tags
255 MiB
main
main-8.0.x
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.7
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '20afd63cbd'
${ noResults }
Commit Graph

2138 Commits (20afd63cbd46931d38c236ffe02dc17bc17a80fc)

Author SHA1 Message Date
Jason Ish b0c912588c mqtt/detect: fix mqtt_parse_bool return type 
Previously we were boxing a u8 and returning it as a pointer to a
boolean. While this is probably not an issue itself, the value 2 was
allowed to be converted to a boolean, which is undefined behavior in
Rust.
 9 months ago
Jason Ish b9e0f9cc8b rfb/detect: fix rfb_parse_sec_result return type 
The data parsed is a u32, but returned as DetectUintData<u8>, then
later free'd as a DetectUintData<u32>.
 9 months ago
Jason Ish 8b2a7ac47c nfs/detect: fix nfs_procedure_parse return type 
Was returning DetectNfsProcedureData as a pointer to
DetectUintData<u32>, and free'ing it as such.
 9 months ago
Jason Ish e474e45429 dns/detect: fix rcode return type 
The parsed DNS rcode was being returned as a DetectUintData<u8>, but is
parsed, and free'd as a u16. So return a DetectUintData<u16>.
 9 months ago
Jason Ish c7f806a728 rust/sys: allow unknown lints 
allow(unpredictable_function_pointer_comparisons) is needed on newer
versions of Rust, but is unknown to our MSRV, so for now, allow unknown
lints.
 9 months ago
Philippe Antoine 364d2c077d rust: bindgen SCAppLayerRegisterParser 
Ticket: 7662
 9 months ago
Philippe Antoine 8401417a84 app-layer: remove some obsolete forward declarations 
and reorder definitions
 9 months ago
Philippe Antoine 8857b78f6a rust: move AppLayerTxData definition to C 
and bindgen it to rust

Will make easier the bindgen of RustParser structure which uses
a callback which uses AppLayerTxData

Move also the free function to C SCAppLayerTxDataCleanup
As suricata-sys crate defines AppLayerTxData for rust,
It must itself implement the Drop trait, and thus,
We need to define a feature surest
 9 months ago
Philippe Antoine 8eaced3c1e rust: move AppLayerResult definition to C 
and bindgen it to rust

Will make easier the bindgen of RustParser structure which uses
a callback which uses AppLayerResult

Keep From<> impl in sys crate that defines it
 9 months ago
Philippe Antoine 06f78b2a22 rust: move StreamSlice definition to C 
and bindgen it to rust

Will make easier the bindgen of RustParser structure which uses
a callback which uses StreamSlice
 9 months ago
Philippe Antoine 41f543ca35 rust: move AppLayerGetTxIterTuple definition to C 
and bindgen it to rust

Will make easier the bindgen of RustParser structure which uses
a callback which uses AppLayerGetTxIterTuple
 9 months ago
Philippe Antoine 64d29fcd1c rust: move AppLayerStateData definition to C 
and bindgen it to rust, and use default trait instead of new

Will make easier the bindgen of RustParser structure which uses
a callback which uses AppLayerStateData
 9 months ago
Philippe Antoine 76efb8af4d rust: move AppLayerGetFileState definition to C 
and bindgen it to rust.

Will make easier the bindgen of RustParser structure which uses
a callback which uses AppLayerGetFileState
 9 months ago
Philippe Antoine fc23e54c6d rust: bindgen with derive eq 
As will be needed such as AppLayerTxData
 9 months ago
Shivani Bhardwaj d4008a6508 dcerpc: remove bad tests 
Unittests test_parse_bind_pdu_infinite_loop and
test_parse_bindack_pdu_infinite_loop seem to have artificially made up
header which does not hold up to the strict calculations enforced by the
parser now. Their headers mark the fraglens as 64 and 72 respectively
which are not enough to hold the kind of bind(ack) items that are expected.
It worked so far as the parser passed the entire input slice around but
with the bugfix for issue 7546, the input passed around is strictly
restricted to the fraglen parsed in the header.

Bug 7546
 9 months ago
Shivani Bhardwaj ed1bd8624e dcerpc: use fraglen from header 
So far, the fraglen defined in the header was used inconsistently in
certain places to define bounds on input length. Make it consistent by
making sure that only a slice up until fraglen is passed around as that
is the maximum length the fragment should have.
With the help of Applayer::incomplete API, the case when the
stream_slice passed to the parser is smaller than the header defined
fraglen is already handled.

Bug 7546
 9 months ago
Shivani Bhardwaj fc9da1c7a1 dcerpc: fix consumed bytes post gap handling 
The parser could receive an input that consists of arbitrary data post
gap. This is handled in the beginning of the fn handle_input_data.
However, the rest of the calculation does not take into account the
bytes that were consumed at this stage. Fix the indices and calculations
to consider a new DCERPC fragment beginning post these consumed bytes.
 9 months ago
Philippe Antoine 9a52bbcbe9 detect/quic: move quic.cyu.hash to rust 
Ticket: 8255
 9 months ago
Philippe Antoine 01610aabe7 detect/quic: move quic.cyu.string to rust 
Ticket: 8255
 9 months ago
Philippe Antoine ee4d4a14d5 detect/quic: move quic.ua to rust 
Ticket: 8255
 9 months ago
Philippe Antoine 9ba9fdcb87 detect/quic: move quic.sni to rust 
Ticket: 8255
 9 months ago
Philippe Antoine 907e71a984 detect/quic: move quic.version to rust 
Ticket: 8255
 9 months ago
Philippe Antoine 7dbe033ae0 app-layer: function to register ci pattern + probe 
Ticket: 6591
 9 months ago
Philippe Antoine 2cf9a327d5 detect/ssh: move ssh.hassh to rust 
Introduces helper SCDetectRegisterBufferLowerMd5Callbacks
 9 months ago
Philippe Antoine 83360cfce0 detect/ssh: move ssh.hassh string to rust 
bindgen needed SCSigMatchSilentErrorEnabled on the way
 9 months ago
Philippe Antoine 02cb0f2ac2 rust: fix unnecessary_unwrap warnings 
warning: called `unwrap` on `rd.pipe` after checking its variant with `is_some`
   --> src/smb/smb1.rs:858:28
    |
857 |             if rd.pipe.is_some() {
    |             -------------------- help: try: `if let Some(<item>) = rd.pipe`
858 |                 let pipe = rd.pipe.unwrap();
    |                            ^^^^^^^^^^^^^^^^
    |
    = help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.93.0/index.html#unnecessary_unwrap
    = note: `#[warn(clippy::unnecessary_unwrap)]` on by default
 9 months ago
Philippe Antoine cafc398355 dcerpc: consume bytes after gap resync 
Ticket: 7567

Re-applies commit 8c3bd3e8a0
which was reverted in f64aec9d11
 9 months ago
Philippe Antoine 54cc752cf9 ssh: hassh can be truly disabled 
Rules will not re-enable it

Ticket: 8223
 9 months ago
Philippe Antoine 458211dcf2 detect/ssh: move ssh.proto to rust 9 months ago
Philippe Antoine 9cfc1cc557 detect/ssh: move obsolete keywords to rust 9 months ago
Philippe Antoine ea8ac2a02a detect/ssh: move ssh.software to rust 
Adds helper function SCDetectHelperBufferProgressMpmRegister on the way
 9 months ago
Philippe Antoine c0d6747e82 app-layer: GetTxIteratorFn uses a AppLayerGetTxIterState 
Even if every current rust parser uses the u64 variant of the C union
 9 months ago
Philippe Antoine 4b541b39f2 rust: move AppLayerEventType definition to C 
and bindgen it to rust.

Will make easier the bindgen of RustParser structure which uses
a callback which uses AppLayerEventType
 9 months ago
Philippe Antoine c960b7d7c1 app-layer: AppLayerParserFPtr uses a mut pointer to local storage 
So, fix the fn prototype in rust ParseFn
 9 months ago
Philippe Antoine f470ee448b quic: use standard tx iterator code 
Will make bindgen life easier

As the fn prototype should not have istate: &mut u64
but a *mut AppLayerGetTxIterState which is an union with a u64
 9 months ago
Philippe Antoine 076fcd61cd bittorrent: use standard tx iterator code 
Will make bindgen life easier

As the fn prototype should not have istate: &mut u64
but a *mut AppLayerGetTxIterState which is an union with a u64
 9 months ago
Philippe Antoine 1a546936c7 rust: AppLayerTxConfig uses Default impl 9 months ago
Philippe Antoine 4e64de3b3b rust: remove wrapper LoggerFlags struct definition 
just use an u32 out of the box.
Will make bindgen like easier
 9 months ago
Philippe Antoine f663be5983 rust: define every RustParser fn pointer unsafe 
That is what bindgen will do
 9 months ago
Lukas Sismis 3e4fdb2118 misc: time unit parsing function 10 months ago
Philippe Antoine 5bb9a0c3af dcerpc/tcp: fix fragmentation handling 
Really count the fragments, and set it done when last was received
 10 months ago
Philippe Antoine f64aec9d11 dcerpc: use different header for different directions 
Header handling is wrong in the case
packet A to server is fragmented (return AppLayerResult::incomplete)
packet B is to client, but uses the header of the to_server packet

Bug 7547
 10 months ago
Philippe Antoine 1832b50506 nfs: log read/write/rename whatever the nfs version 
These were previously logged correctly only for nfs v3

Now, the correct opcodes are used for v2 and v4 as well

Ticket: 8222
 10 months ago
Philippe Antoine b0850efd67 rust: from_str implementation for EncryptionHandling 
To move non-specific quic code to the right place
 10 months ago
Philippe Antoine 89b6ab6730 rust: rename EncryptionHandling 
as it is no longer specific to SSH
 10 months ago
Philippe Antoine 7acfea57a9 rust: move EncryptionHandling definition to its own file 
as it is not specific to ssh anymore
 10 months ago
Philippe Antoine 7422c97bf2 quic: encryption-handling config parameters 
Ticket: 8116
 10 months ago
Victor Julien ff3def130c rust/htp: formatting fixup 10 months ago
Victor Julien b1fe6a4ceb rust: update lru to 0.16.3; update lock 
RUSTSEC-2026-0002

Ticket: #8210.
 10 months ago
Philippe Antoine a48200b9e5 dcerpc: use saturating_add to count fragments 
And do not overflow if we have traffic with more than 65K fragments
 10 months ago