suricata

Commit Graph

Author	SHA1	Message	Date
Shivani Bhardwaj	e412215af9	dcerpc: add upper limit on stub data DCERPC parsers had no upper bounds when it came to extending the stub data buffer. Traffic can be crafted to bypass some internal parser conditions to create an indefinite buffering in the stub_data array that can make Suricata crash. Add a default limit of 1MiB and make it configurable for the user. Security 8182 Co-authored-by: Philippe Antoine <pantoine@oisf.net>	10 months ago
Philippe Antoine	fa5a4a994a	http: limit the number of folded lines per header Ticket: 8201 Limits the quadratic complexity if each packet, restarting the header parsing, just adds a new folded line. This was previously bounded by the configurable max header length	10 months ago
Philippe Antoine	f2a45c4216	http: do not use recursion in decompression just loop and iterate Ticket: 8185	10 months ago
Shivani Bhardwaj	1d7b0d9b7a	tls/subjectaltname: use byte arr instead of string TLS parsers use x509-parser crate which parses X.509 certificates that use ASN.1 DER encoding that can allow arbitrary byte sequences. An attacker could inject null byte in a certificate anywhere to stump the common language parsers terminating the string at a null byte leading to a bypass of a possibly malicious certificate. So far, the rust TLS parser for "subjectaltname" used a pattern that involved: -> Get ASN.1 DER encoded raw data from the x509-parser crate -> Convert this raw data to a decoded string (Rust) -> Convert the Rust string to CString -- The problem lies here. CString only accepts proper strings/byte buffers and converts it into an owned C-compatible, null-terminated string. However, if any null byte occurs in the string passed to the CString then it panics. In the rust TLS parser, this panic is handled by returning NULL. This means that the parser will error out during the decoding of the certificate. However, Suricata must be able to detect the null byte injection attack being an IDS/IPS. Hence, replace all such string patterns w.r.t. TLS SAN with a byte array. Bug 7887	10 months ago
Shivani Bhardwaj	24f5b7dab2	tls/serial: use byte array instead of string Bug 7887	10 months ago
Shivani Bhardwaj	f025e07191	tls/issuerdn: use byte array instead of string TLS parsers use x509-parser crate which parses X.509 certificates that use ASN.1 DER encoding that can allow arbitrary byte sequences. An attacker could inject null byte in a certificate anywhere to stump the common language parsers terminating the string at a null byte leading to a bypass of a possibly malicious certificate. So far, the rust TLS parser for "issuerdn" used a pattern that involved: -> Get ASN.1 DER encoded raw data from the x509-parser crate -> Convert this raw data to a decoded string (Rust) -> Convert the Rust string to CString -- The problem lies here. CString only accepts proper strings/byte buffers and converts it into an owned C-compatible, null-terminated string. However, if any null byte occurs in the string passed to the CString then it panics. In the rust TLS parser, this panic is handled by returning NULL. This means that the parser will error out during the decoding of the certificate. However, Suricata must be able to detect the null byte injection attack being an IDS/IPS. Hence, replace all such string patterns w.r.t. TLS IssuerDN with a byte array. Bug 7887	10 months ago
Shivani Bhardwaj	77c21b05d2	tls/subject: use byte array instead of string TLS parsers use x509-parser crate which parses X.509 certificates that use ASN.1 DER encoding that can allow arbitrary byte sequences. An attacker could inject null byte in a certificate anywhere to stump the common language parsers terminating the string at a null byte leading to a bypass of a possibly malicious certificate. So far, the rust TLS parser for "Subject" used a pattern that involved: -> Get ASN.1 DER encoded raw data from the x509-parser crate -> Convert this raw data to a decoded string (Rust) -> Convert the Rust string to CString -- The problem lies here. CString only accepts proper strings/byte buffers and converts it into an owned C-compatible, null-terminated string. However, if any null byte occurs in the string passed to the CString then it panics. In the rust TLS parser, this panic is handled by returning NULL. This means that the parser will error out during the decoding of the certificate. However, Suricata must be able to detect the null byte injection attack being an IDS/IPS. Hence, replace all such string patterns w.r.t. TLS Subject with a byte array. Bug 7887	10 months ago
Shivani Bhardwaj	06eafb79d6	detect/flow-pkts: check for both dir The functionality of "both" can already be easily achieved by using both "toclient" and "toserver" in a rule. This just adds the ease of expression in rule. As it is added now, check the direction for the pre-existing users of direction as well.	10 months ago
Shivani Bhardwaj	77abcde9ee	rust/flow: add public wrapper for dir in order to be able to use it on the C side for elephant flow detection.	10 months ago
Jason Ish	d89b35db56	conf: add SCConfNodeChildValueIsFalse to check for false value New function to check is a value is actually set to a false value.	11 months ago
Philippe Antoine	af246ae7ab	http: do not use a loop to find the tx count As we want the last tx Ticket: 8156 The generic function AppLayerParserGetTxCnt calls for HTTP1 Transactions.size() This function has some specific code, as we may have pre-created a tx that we do not want to count. This used to get the last tx by iterating over all the transactions waiting to find the one with max index. So, instead of using the Transactions.get function, we get the last tx out of the VecDeque and check its index.	11 months ago
Jeff Lucovsky	9c81f817e8	rust: bindgen update Issue: 7389 Update bindgen with `make update-bindgen`	11 months ago
Jason Ish	50224f2ee5	rust: fix clippy warning for unused import While debug_validate_bug_on is still used, it does not need to be imported directly, as that macro is marked with `macro_export`, making it globally available to the crate.	11 months ago
Philippe Antoine	455b7d1b3b	rust: use snake case for applayer_register_protocol_detection	11 months ago
Philippe Antoine	b4d8aea0ae	rust: bindgen SCAppLayerRegisterProtocolDetection Ticket: 7662 Changing the struct passed to it to have the minimal number of useful fields.	11 months ago
Philippe Antoine	1329786f84	detect: new command line option : list-rule-protos To list the protocols we can use a in a rule header Ticket: 635	11 months ago
Philippe Antoine	2349f19977	nfs: use nfsv2 procedure names with nfs_procedure keyword Ticket: 5140	11 months ago
Jhonny Sousa	257ed82dbd	nfs: Fix NFSv2 STATFS procedure parsing Ticket: #5140	11 months ago
Philippe Antoine	15b1bf4865	rust: bindgen SCHTPFileCloseHandleRange Ticket: 7762	11 months ago
Philippe Antoine	cddbd0b906	rust: bindgen more file functions Ticket: 7762	11 months ago
Philippe Antoine	327b8b04a9	rust: bindgen with default derive Ticket: 7762	11 months ago
Victor Julien	80d5afe91b	pop3: AUTH command handling improvements Better track the state so it's known when to expect a base64 request message. Also better validate the base64. Ticket: #7994.	11 months ago
Victor Julien	2973eded56	pop3: convert to nom 8 Ticket: #8127.	11 months ago
Victor Julien	da2db65f62	pop3: rustfmt	11 months ago
Jason Ish	83d8b1d2f8	quic: update to nom 8.0 Ticket: #8140	11 months ago
Philippe Antoine	32ce3d29be	detect/krb: use flag u32 for krb5_msg_type	11 months ago
Jason Ish	a9eee5dfd9	rust/htp: convert to nom 8 Ticket: #8090	12 months ago
Jason Ish	ef9cd7beff	rust/smb: convert to nom 8 Ticket: #8089	12 months ago
Jason Ish	02045e1d62	rust/dcerpc: convert to nom 8 Ticket: #8093	12 months ago
Jason Ish	25c98af0e8	rust/detect: convert remaining detection rule parsers to nom 8 Ticket: #8051	12 months ago
Jason Ish	dea3f9e260	rust/detect: convert error.rs and dependent parsers to nom 8 Ticket: #8051	12 months ago
Jason Ish	efc32dea41	rust/detect: convert uint nom 8 And users of uint directly impacted by this change. Ticket: #8051	12 months ago
Jason Ish	cf604751de	rust/util: convert to nom 8 Ticket: #8088	12 months ago
Jason Ish	1e01d5adca	rust/conf: convert to nom 8 Ticket: #8087	12 months ago
Jason Ish	c6e8932740	rust/asn1: convert to nom 8 Ticket: #8086	12 months ago
Jason Ish	59f8fb30a8	rust/ftp: fix clippy warning error: implicitly casting the result of `from_raw_parts_mut` to `*mut [u8]` --> src/ftp/response.rs:107:31	12 months ago
Philippe Antoine	cba13ed9b1	rust: bindgen functions needed for datasets Ticket: 7762	12 months ago
Philippe Antoine	12892ba010	rust: bindgen functions neede for features Ticket: 7762	12 months ago
Jeff Lucovsky	e1bf5cb1f3	nfs: Support EXCLUSIVE4_1 flag Issue: 8006 Support the EXCLUSIVE4_1 create mode added to NFS 4.1	12 months ago
Philippe Antoine	79e66f76e6	detect: icmp_id is now a generic integer Ticket: 7889	12 months ago
Philippe Antoine	85fa894425	detect: dnp3.func is now a generic integer Ticket: 7889	12 months ago
Philippe Antoine	f2b6540c52	htp: bound decompression Ticket: 7980 Usage of Vec<u8> instead of Box<u8> gave the ability to callers to grow the buffer (indefinitely) This was regressed in `16fee33368` Additionnaly, use rust WriteZero instead of WouldBlock as a more fitting error when cursor is full, as that error kind is the one tested by callers.	12 months ago
Philippe Antoine	c61f1cb6d0	detect/integers: rename index all1 to all And all to all_or_absent Ticket: 7929	12 months ago
Philippe Antoine	eb5a2d646b	detect/vlan: move vlan.id keyword to generic integer Ticket: 7929	12 months ago
Li Heng	c141c55bc6	snmp: can be set to detection-only Realloc alp_ctx.ctxs when a dynamic alproto is registered and g_alproto_max increases. So dynamic alproto can be treated as real/normal ones. And app-layer switch can be set to any value of no/deteciton-only/yes. Ticket: 8000	12 months ago
Philippe Antoine	439f96dea7	rust: bindgen frames functions Ticket: 7667	12 months ago
Philippe Antoine	92c7be1cb6	rust: bindgen SCSRepCatGetByShortname Ticket: 7667	12 months ago
Philippe Antoine	7447651fa0	output/jsonbuilder: helper function SCJbSetPrintAsciiString To replace C PrintStringsToBuffer and avoid a stack alloc + copy Ticket: 8004	1 year ago
Li Heng	1106323ae1	rust/sip: delete redundant computing codes Delete call of is_alphanumeric where is_alphanumeric and is_token_char are called together. Four places are modified. Ticket: 8003	1 year ago
Jason Ish	1efe70a234	rust/ike: convert to nom 8 Ticket: #8050	1 year ago
Jason Ish	f368324e87	rust/mime: convert to nom 8 Ticket: #8048	1 year ago
Jason Ish	c5ef615953	rust/mqtt: convert to nom 8 Ticket: #8047	1 year ago
Jason Ish	2289069f74	rust/websocket: convert to nom 8 Ticket: #8046	1 year ago
Jason Ish	9eeefd0684	rust/bt-dht: convert to nom 8 Ticket: #8045	1 year ago
Jason Ish	399f96b07d	rust/rdp: convert to nom 8 Ticket: #8044	1 year ago
Jason Ish	7c70f74942	rust/telnet: convert to nom 8 Ticket: #8043	1 year ago
Jason Ish	2ff2eb1325	rust/ssh: convert to nom 8 Ticket: #8042	1 year ago
Jason Ish	baa22287b8	rust/rfb: convert to nom 8 Ticket: #8041	1 year ago
Jason Ish	dcfe247467	rust/pgsql: convert to nom 8 Ticket: #8039	1 year ago
Jason Ish	d25286e77a	rust/enip: convert to nom 8 Ticket: #8038	1 year ago
Jason Ish	d74f8522ee	rust/tftp: convert to nom 8 Ticket: #8037	1 year ago
Jason Ish	4b09622ebc	rust/dhcp: convert to nom 8 Ticket: #8036	1 year ago
Philippe Antoine	772bd9ca53	rust: reduce visibility of detect_parse_uint_notending It is meant as an internal function Also document the function	1 year ago
Philippe Antoine	b636dffd5b	detect: urilen keyword fails on trailing junk Fails especailly on 1<>2 which looks like a range, but is invalid as too small, and ended up being accepted as =1 Ticket: 8028	1 year ago
Philippe Antoine	2e9027fd5a	plugins: update SC_API_VERSION to 9 So that plugins built for 8 will fail to load with 9 as there were already breaking changes in the structures and functions prototypes	1 year ago
Jason Ish	16d313cb8b	rust/applayertemplate: convert to nom 8 Ticket: #8027	1 year ago
Jason Ish	f0f4d88119	rust/sip+sdp: update to nom 8 Done together as there is a dependence of SDP by SIP. Ticket: #8025	1 year ago
Jason Ish	58564a4b0e	rust/ftp: update to nom 8 Ticket: #8026	1 year ago
Jason Ish	54cc97b78e	rust/dns: convert to nom 8.0 Ticket: #8024	1 year ago
Jason Ish	16c42da57e	rust: add nom8 as a dependency For the update from nom 7 to nom 8.	1 year ago
Jason Ish	0990c9dbf6	rust: pin indexmap Newer indexmap, pulled in by serde_json requires Rust 1.82, so pin pack to 2.11.4 which still works with Rust 1.75.	1 year ago
Philippe Antoine	dc7874b2ac	rust: bindgen more http range functions used in http2 Ticket: 7667	1 year ago
Philippe Antoine	842352c190	rust: bindgen SCHttpRangeFreeBlock Ticket: 7667	1 year ago
Philippe Antoine	93785ae357	rust: bindgen SCHTTP2MimicHttp1Request Ticket: 7667	1 year ago
Philippe Antoine	a1613fecb4	detect: tcp.flags rejects non-sensical values ignored flags are only meaningful for equal mode	1 year ago
Philippe Antoine	31e9cb55be	detect: tcp.flags unit tests improvements Tests better the ignored flags functionality. This functionality is only used at detection for default mode, it is not used for any, plus or not mode. So, have unit tests about igored flags with default mode with both matching and non matching cases	1 year ago
Philippe Antoine	d8cb00e795	detect/tcp: make tcp.flags a generic integer with bitflags Ticket: 6724 Allows to use numerical values for example Also fixes some unit tests that were returning 1 after goto error FlagsTestParse05 especially took this path as de->ignored_flags != (TH_SYN\|TH_RST) was false we had de->ignored_flags == 0xff ^ (TH_SYN\|TH_RST) And then, we had a match, instead of what the not-run code was supposing.	1 year ago
Philippe Antoine	1f9236a6d8	detect/ipv4: make fragbits a generic uint16 bitflags keyword Ticket: 6724 Allows to use numerical values	1 year ago
Philippe Antoine	633180c93f	detect/integers: generalize support for bitflags modifier Ticket: 6724 Allows sugar syntax for bitflags keywords. While the expressivity does not increase, because we could already use numerial values with all generic integer modes, this modifier prefix is used with the strings, and follows the syntax that is already used for fragbits and tcp.flags keyword.	1 year ago
Philippe Antoine	f25194480c	libhtp: fix newer clippy lints with newer MSRV	1 year ago
Jason Ish	bc33bd49eb	quic/crypto: remove use of GenericArray Its not needed, and gets rid of the deprecation warnings.	1 year ago
Jason Ish	bdfdf7ff33	rust: update deps with cargo-update Suppress deprecation warnings in quick/crypto.rs about GenericArray.	1 year ago
Jason Ish	6fdf0d736b	rust: update aes-gcm to 0.10.3	1 year ago
Jason Ish	b9517de86e	rust: update aes to 0.8.4	1 year ago
Philippe Antoine	4b69a31dc3	detect/integers: count argument for multi-integers Ticket: 7211 Allows to count the number of elements, without matching on individual elements	1 year ago
Philippe Antoine	3babd68af4	pop3: count retr_data into consumed for later AppLayerResult::incomplete Fixes: `acef961645` ("pop3: improve parsing") https://issues.oss-fuzz.com/u/1/issues/451112373 Ticket: 7994	1 year ago
Philippe Antoine	9a4a29e218	http2: fix parsing of goaway frames There was a last stream id before the error code As per section 6.8 of RFC 7540 Ticket: 7991	1 year ago
Philippe Antoine	7f0087f19a	rust/detect: fix correct pointer type in SCDetectU32ArrayFree	1 year ago
Philippe Antoine	969739d067	detect: http2.errorcode is now a generic integer Ticket: 7889	1 year ago
Philippe Antoine	401b2fcae6	detect: http2.frametype is now a generic integer Ticket: 7889	1 year ago
Philippe Antoine	454f73b445	rust: EnumString derive accepts a enum_string_style parameter So that http2.frametype and http2.errorcode can use EnumString without changing the format, as they used UPPERCASE instead of the default EnumString snake_case	1 year ago
Victor Julien	acef961645	pop3: improve parsing Improve multiline commands and SASL auth. Work around missing support in crate for empty server challenge and SASL base64 data. Ticket: #7709.	1 year ago
Jason Ish	5e2dc9ace3	ike: don't log empty server objects	1 year ago
Jason Ish	2d86412f46	ike: log attributes as objects IKE attributes are an array of TLV style objects, this means there can be duplicate types seen on the wire. However, Suricata logs these as a mapping with the type as the key. This can result in the JSON containing duplicate keys. To address this, log the attributes as an array of objects, allow duplicates to exist, for example: "client": { "proposals": [ { "sa_life_duration": "Unknown", "sa_life_duration_raw": 86400, } } } is now logged as: "client": { "proposals": [ {"key": "sa_life_duration", "value": "Unknown", "raw": 86400} ] } Also adds `"version": 2` to each IKE record to note the change of format from previous versions. Ticket: #7902	1 year ago
Jason Ish	b543e28402	ike/detect: info log message should be debug	1 year ago
Philippe Antoine	a393147415	rust: restrict visibility of reexported suricata_sys structs	1 year ago
Philippe Antoine	fa322e3dc2	rust: remove unneeded cbindgen exclusions	1 year ago
Philippe Antoine	958344787f	rust: bindgen FileAppendData Ticket: 7667	1 year ago
Philippe Antoine	811d28cc6b	rust: bindgen util-spm-bs.h for SCBasicSearchNocaseIndex Ticket: 7667	1 year ago
Jeff Lucovsky	0e547b9519	rust/conf: Accept xiB unit suffixes Update the memval to recognize - kb and kib - mb and mib - gb and gib as equivalent.	1 year ago

1 2 3 4 5 ...

2138 Commits (20afd63cbd46931d38c236ffe02dc17bc17a80fc)