376eddbe98
security: minor formatting and re-structuring
...
For readability.
3 months ago
68c9b63831
doc: security policy
...
Update security levels to triage less reports as critical.
Improve instructions on how to report issues.
3 months ago
614c48d3c3
ikev2: remove unused field
...
Ticket: 8415
3 months ago
2f9573f84c
doc: address config conversion note
...
Message is:
```
Converting `source_suffix = '.rst'` to `source_suffix = {'.rst': 'restructuredtext'}`.
```
3 months ago
c48bb1b26c
ftp: add rule for too many transactions
...
Issue: 8489
3 months ago
86fe20dd48
conf: add comment for ftp.max-tx
...
Add missing FTP configuration value to suricata.yaml.in showing the
default value.
Issue: 8489
3 months ago
5ddd808e9b
ftp: don't halt the flow when raising too_many_transactions
...
The first version of the event set done=true on state->curr_tx and
returned NULL when the limit hit. curr_tx is usually the active
command just received — marking it done mid-request throws off
response matching, and subsequent commands in the flow stop getting
logged.
SMB behavior is mirrored here:
Walk the tx list, find the oldest tx that isn't done, mark
it done and tag it with the event, then fall through and
create the new tx so the flow parsing continues. One stale tx gets
reaped per overflow so memory stays bounded.
Issue: 8489
3 months ago
9ea2e29581
ftp: raise too_many_transactions event on overflow
...
Other parsers (SMB, POP3, ENIP) already raise a too_many_transactions
event when a flow exceeds its per-flow transaction limit. FTP had
the limit wired up through app-layer.protocols.ftp.max-tx but just
dropped the excess transaction on the floor with a "FTP does not set
events yet..." TODO, so no event was raised when the limit was
reached.
Add the FtpEventTooManyTransactions variant, a stock rule at
sid 2232002, and raise the event from FTPTransactionCreate when the
live-tx count goes past ftp_config_maxtx.
Issue: 8489
3 months ago
aa4946547b
github-ci: check formatting and clippy on example rust plugin
3 months ago
5e2a33d080
examples: add flow callbacks to rust plugin example
...
Ticket: #8446
3 months ago
91b9dda0bf
doc: document flow life cycle callback API
...
Document for C and Rust, as the C documentation was missing.
Ticket: #8446
3 months ago
cb69fa4e53
rust/ffi: add flow lifecycle callback wrappers
...
Provide Rust friendly callback registrations for flow init, update and finish events. These
callbacks are implemented as Rust closures.
Ticket: #8446
3 months ago
d4dc8be3b2
rust: bindgen flow lifecycle callbacks
...
Ticket: #8446
3 months ago
e38888810d
detect/dcerpc: avoids FP on dcerpc.iface keyword
...
When we got a bind without the first fragment flag, and did not
set any_frag in the signature, the signature always matched,
whatever the uuid value
Ticket: 8457
3 months ago
42fbc55aac
detect-engine-analyzer: set EngineAnalysisCtx to NULL after free'ing
...
when engine-analysis is turned off in suricata.yaml
and we run suricata with --engine-analysis
suricata will try to use data from de_ctx->ea wich is
free'd in SetupEngineAnalysis() because fp_analysis and
rule_analysis is turned off and will receive SIGSEGV
with something like:
0x00007ffff7b4ac7b in _IO_new_fclose (fp=0xad96ab1cf5b38042) at ./libio/iofclose.c:48
Ticket: 8505
3 months ago
8968b1c5a1
psl: update to 2.1.206
...
Update the public suffix list to latest release.
3 months ago
5ed394b26b
rust/ffi: move AppLayerEvent to ffi
...
Ticket: 7666
3 months ago
5bbe99188b
ci: update rust version to 1.95
3 months ago
59b6de8239
rust: fix last collapsible_match warnings
...
The ones where we need to remove a debug log
3 months ago
1cdff9de8e
rust: fix collapsible_match warnings
...
warning: this `if` can be collapsed into the outer `match`
help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.95.0/index.html#collapsible_match
3 months ago
899e9f045e
ntp: expose logged fields to lua
...
This includes:
- version
- mode
- stratum
- reference_id
Ticket: #8533
3 months ago
81692dd2c1
rust/lua: add method for pushing bytes
...
Much like pushstring, but accepts an &[u8] as an argument instead of an &str.
In support of ticket #8533 .
3 months ago
eec4a44275
rules: SID allocation range is now documented in README.md
...
directly in the repo, and not in an external wiki
3 months ago
891b17277e
ci: check dist rules
...
So that we catch if we add a typo like
app-layer-event:snmp.version_mismatchZZZ;
3 months ago
d84b6789c9
ci: make doc rules validation strict
...
not finding anymore problems now
3 months ago
42123cc8d9
bittorrent: add bittorrent-events.rules file
...
Add a file containing rules to match bittorrent protocol events.
Ticket: 8421
3 months ago
cff3d6417a
snmp: add snmp-events.rules file
...
Add a file containing rules to match SNMP protocol events.
Ticket: 8421
3 months ago
72e3d7ad08
util/path: fix compile warning
...
util-path.c:251:11: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers
[-Werror,-Wincompatible-pointer-types-discards-qualifiers]
251 | char *final = strrchr(path, DIRECTORY_SEPARATOR);
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 error generated.
3 months ago
0a4685f2ab
detect/pcre: fix compile warnings
...
detect-pcre.c:419:11: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers]
419 | char *fcap = strstr(regexstr, "flow:");
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~
detect-pcre.c:420:11: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers]
420 | char *pcap = strstr(regexstr, "pkt:");
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~
detect-pcre.c:421:11: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers]
421 | char *acap = strstr(regexstr, "alert:");
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~
3 errors generated.
3 months ago
3564f2f928
detect/app-layer-protocol: fix compile warning
...
detect-app-layer-protocol.c:160:11: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers
[-Werror,-Wincompatible-pointer-types-discards-qualifiers]
160 | char *sep = strchr(arg, ',');
| ^ ~~~~~~~~~~~~~~~~
1 error generated.
3 months ago
a45a70babd
decode: fix compile warning
...
decode.c:767:19: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers
[-Werror,-Wincompatible-pointer-types-discards-qualifiers]
767 | char *dot = strchr(DEvents[i].event_name, '.');
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 error generated.
3 months ago
90ce1c54c4
datasets: fix compile warning
...
datasets.c:159:11: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers
[-Werror,-Wincompatible-pointer-types-discards-qualifiers]
159 | char *got_colon = strchr(line, ':');
| ^ ~~~~~~~~~~~~~~~~~
1 error generated.
3 months ago
5aee5ff6ed
smtp: fix compile warning
...
app-layer-smtp.c:566:14: error: initializing 'uint8_t *' (aka 'unsigned char *') with an expression of type 'const void *' discards qualifiers
[-Werror,-Wincompatible-pointer-types-discards-qualifiers]
566 | uint8_t *lf_idx = memchr(input->buf + input->consumed, 0x0a, input->len);
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 error generated.
3 months ago
c21275cab3
ftp: fix compile warnings
...
app-layer-ftp.c:278:14: error: initializing 'uint8_t *' (aka 'unsigned char *') with an expression of type 'const void *' discards qualifiers
[-Werror,-Wincompatible-pointer-types-discards-qualifiers]
278 | uint8_t *lf_idx = memchr(input->buf + input->consumed, 0x0a, input->len);
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
app-layer-ftp.c:1392:11: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers
[-Werror,-Wincompatible-pointer-types-discards-qualifiers]
1392 | char *c = strchr(buffer, '\n');
| ^ ~~~~~~~~~~~~~~~~~~~~
2 errors generated.
3 months ago
cd1c5967a5
util/logopenfile: fix compile warnings
...
util-logopenfile.c:837:11: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers]
837 | char *dot = strrchr(base, '.');
| ^ ~~~~~~~~~~~~~~~~~~
util-logopenfile.c:848:13: error: assigning to 'char *' from 'const char *' discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers]
848 | dot = strrchr(original_name, '.');
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 errors generated.
3 months ago
98979dbfe9
github-actions: bump actions/github-script from 8.0.0 to 9.0.0
...
Bumps [actions/github-script](https://github.com/actions/github-script ) from 8.0.0 to 9.0.0.
- [Release notes](https://github.com/actions/github-script/releases )
- [Commits](ed597411d8...3a2844b7e9
3 months ago
00b5c2f579
github-actions: bump actions/upload-artifact from 7.0.0 to 7.0.1
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/v7...v7.0.1 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
3 months ago
5dcdcf0de2
github-actions: bump github/codeql-action from 4.35.1 to 4.35.3
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.35.1 to 4.35.3.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Commits](https://github.com/github/codeql-action/compare/v4.35.1...v4.35.3 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.35.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
3 months ago
cce673349a
ci/scripts: check for dots and dashes in json schema keys
...
Ticket: 6502
3 months ago
54c02e1301
stats: replace dashes by underscores in app-layer protocols
...
Ticket: 6502
Forbid dashes in json keys for better use by processing tools
3 months ago
d030ea7f29
output: rename reject-target to reject_target
...
Ticket: 6502
Forbid dashes in json keys for better use by processing tools
3 months ago
18f742fdbd
schema: map NTP fields to keywords
3 months ago
cdb02a2779
rust/dns: rustfmt
3 months ago
7d66eb5f04
rust: remove unused function
...
rust_string_to_c was used when a buffer should be used as it could
contain nul-byte
3 months ago
9b12fd9f09
rust/ffi: move helper trait state_get_tx_iterator to ffi
...
Ticket: 7666
3 months ago
07f37676b6
rust/ffi: move Flags for AppLayerParserState to ffi crate
...
Ticket: 7666
3 months ago
fb20c69d8d
rust/ffi: move APP_LAYER_PARSER_OPT_X const to ffi crate
...
Ticket: 7666
3 months ago
f1c66ff6f0
rust: remove obsolete const exclusions in cbindgen
...
As these structs are now bindgened from C to suricata_sys crate
3 months ago
d81a10126e
detect/doc: remove unexisting links
...
Ticket: 8257
And add TODO comments if rules doc should be written
3 months ago
8e39539161
detect/doc: fix broken anchor links
...
Ticket: 8257
3 months ago
Juliana Fajardini
Philippe Antoine
Victor Julien
alinse-pltzr
Jeff Lucovsky
Jason Ish
Sergey Pinaev
dependabot[bot]