2262 Commits (38d41e6fa60fc2fdb0fc069a3cb788c989bb8082)

Author	SHA1	Message	Date
Victor Julien	6ebd0c3cc2	http2: check for HTTP1 protocol during upgrade path ... Ticket: 8492	4 months ago
Philippe Antoine	10bde66586	nfs: bound file_additional_procs to 1 ... Ticket: 8418 As we only need to know we saw at least one NFSPROC3_COMMIT	4 months ago
Philippe Antoine	aea7ee21b8	nfs: bound namemap by using lru ... Ticket: 8418	4 months ago
Philippe Antoine	a50f494ef6	nfs: bound requestmap and use lru ... Ticket: 8418	4 months ago
Juliana Fajardini	d442c3544c	detect: opt-in keywords for firewall mode ... - tls.cert_chain_len - datarep - dataset - dns.opcode Part of Ticket #8387	4 months ago
Philippe Antoine	f0e246de34	detect/mqtt: reason_code keyword is now a multi-integer ... Ticket: 7929 Builds a vector of the reason code in a tx to do so, except if we use the default "any", where we do not append to the vector, but just run detection while iterating	4 months ago
Philippe Antoine	614c48d3c3	ikev2: remove unused field ... Ticket: 8415	4 months ago
Jeff Lucovsky	9ea2e29581	ftp: raise too_many_transactions event on overflow ... Other parsers (SMB, POP3, ENIP) already raise a too_many_transactions event when a flow exceeds its per-flow transaction limit. FTP had the limit wired up through app-layer.protocols.ftp.max-tx but just dropped the excess transaction on the floor with a "FTP does not set events yet..." TODO, so no event was raised when the limit was reached. Add the FtpEventTooManyTransactions variant, a stock rule at sid 2232002, and raise the event from FTPTransactionCreate when the live-tx count goes past ftp_config_maxtx. Issue: 8489	4 months ago
Jason Ish	cb69fa4e53	rust/ffi: add flow lifecycle callback wrappers ... Provide Rust friendly callback registrations for flow init, update and finish events. These callbacks are implemented as Rust closures. Ticket: #8446	4 months ago
Jason Ish	d4dc8be3b2	rust: bindgen flow lifecycle callbacks ... Ticket: #8446	4 months ago
Philippe Antoine	e38888810d	detect/dcerpc: avoids FP on dcerpc.iface keyword ... When we got a bind without the first fragment flag, and did not set any_frag in the signature, the signature always matched, whatever the uuid value Ticket: 8457	4 months ago
Jason Ish	8968b1c5a1	psl: update to 2.1.206 ... Update the public suffix list to latest release.	4 months ago
Philippe Antoine	5ed394b26b	rust/ffi: move AppLayerEvent to ffi ... Ticket: 7666	4 months ago
Philippe Antoine	59b6de8239	rust: fix last collapsible_match warnings ... The ones where we need to remove a debug log	4 months ago
Philippe Antoine	1cdff9de8e	rust: fix collapsible_match warnings ... warning: this `if` can be collapsed into the outer `match` help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.95.0/index.html#collapsible_match	4 months ago
Jason Ish	899e9f045e	ntp: expose logged fields to lua ... This includes: - version - mode - stratum - reference_id Ticket: #8533	4 months ago
Jason Ish	81692dd2c1	rust/lua: add method for pushing bytes ... Much like pushstring, but accepts an &[u8] as an argument instead of an &str. In support of ticket #8533.	4 months ago
Jason Ish	cdb02a2779	rust/dns: rustfmt	4 months ago
Philippe Antoine	7d66eb5f04	rust: remove unused function ... rust_string_to_c was used when a buffer should be used as it could contain nul-byte	4 months ago
Philippe Antoine	9b12fd9f09	rust/ffi: move helper trait state_get_tx_iterator to ffi ... Ticket: 7666	4 months ago
Philippe Antoine	07f37676b6	rust/ffi: move Flags for AppLayerParserState to ffi crate ... Ticket: 7666	4 months ago
Philippe Antoine	fb20c69d8d	rust/ffi: move APP_LAYER_PARSER_OPT_X const to ffi crate ... Ticket: 7666	4 months ago
Philippe Antoine	f1c66ff6f0	rust: remove obsolete const exclusions in cbindgen ... As these structs are now bindgened from C to suricata_sys crate	4 months ago
Philippe Antoine	d81a10126e	detect/doc: remove unexisting links ... Ticket: 8257 And add TODO comments if rules doc should be written	4 months ago
Philippe Antoine	8e39539161	detect/doc: fix broken anchor links ... Ticket: 8257	4 months ago
Philippe Antoine	bd6a436893	detect/doc: fix broken files links ... Ticket: 8257	4 months ago
Philippe Antoine	b0e63a2c95	detect/dcerpc: move stub_data keyword to rust ... Ticket: 8391	5 months ago
Philippe Antoine	3d56472d16	detect: bindgen more functions ... To prepare to move dcerpc.stub_data keyword to full rust	5 months ago
Jeff Lucovsky	746f471382	transform/subslice: Add subslice transform ... Issue: 7672 The subslice transform creates a slice of the input buffer. Specify the subslice desired -- nbytes and truncate are optional: subslice: offset <,nbytes> <,truncate> offset: Specifies the starting offset for the new subslice. When negative, expresses how far from the end of the input buffer to begin. nbytes: Specifies the size of the subslice. When negative, specifies that the subslice will end that many bytes from the end of the input buffer. Nbytes must be non-zero. When nbytes is not specified, the size of the subslice will be the size of the input buffer - offset. truncate: Specify behavior when offset + nbytes exceeds buffer length. When present, trims nbytes such that offset + nbytes equals buffer length. When not present, an empty buffer is produced. Examples: subslice: 1; - The subslice will be a copy of the input buffer but omits the input buffer's first byte "This is Suricata" -> "his is Suricata" subslice: 0, 13; - The slice is created from the first 13 bytes of the input buffer "This is Suricata" -> "This is Suric" subslice: 10, -5; - The subslice is created starting at offset 10 and continues to 5 bytes before the end of the input buffer "This is Suricata" -> "r" subslice: -3; - The subslice will be the last 3 bytes of the input buffer. "This is Suricata" -> "ata"	5 months ago
Philippe Antoine	4fc6ca5d6c	detect/dcerpc: move iface keyword to rust ... Ticket: 8391 Use same buffer dce_generic as for dcerpc.opnum (name dce_generic is enforced by a SV test currently)	5 months ago
Philippe Antoine	9677851637	rust/ffi: move app-layer traits to ffi crate ... Ticket: 7666 Traits around structures defined in C and bindgened to rust	5 months ago
Philippe Antoine	f803c25f24	rust/ffi: move export_X_data_get macros to ffi crate ... Ticket: 7666	5 months ago
Philippe Antoine	54b6885166	rust/ffi: move conf_get_bool helper to ffi crate ... Ticket: 7666	5 months ago
Victor Julien	28a3337c27	rust: cargo update	5 months ago
Philippe Antoine	5f9e436c3f	detect/dcerpc: support generic integer for opnum keyword ... Ticket: 8179	5 months ago
Philippe Antoine	67379b009a	detect/dcerpc: move opnum keyword to rust ... Ticket: 8391	5 months ago
Philippe Antoine	a36af353bc	rust: bindgen SCFlowGetAppProtocol	5 months ago
Jason Ish	fd31e50954	ntp: enable keywords for firewall mode ... Ticket: #8394	5 months ago
Jason Ish	713e4eb900	ntp: convert reference_id to buffer and add keyword ... Store the NTP reference ID as raw network-order bytes so it can be exposed as a sticky buffer and matched with payload keywords. The reference ID is often a 4 character string, or an IP address and not just an integer identifier. Updates the log reference ID to be a string of colon separated hex digits as this matches what tshark does. Ticket: #8488	5 months ago
Jason Ish	991e7f3b1d	ntp: add ntp.mode keyword ... This keyword also accepts strings for known mode names. Ticket: #8429	5 months ago
Jason Ish	c10c482290	ntp: add ntp.stratum keyword ... Ticket: #8431	5 months ago
Jason Ish	ec344fe68d	ntp: add ntp.version keyword ... SNMP was used as a template. Ticket: #8430	5 months ago
Jason Ish	74bb525401	ntp: create tx for all modes; log version, mode and stratum ... Add logging for version, mode and stratum as these will be the first keywords we will add. Ticket: #8425	5 months ago
Jason Ish	879846e153	ntp: remove unused event types ... NotRequest and NotResponse event type have never been used. Unsolicited is also unused, however there is a rule for it so removing support would be a breaking change at this time.	5 months ago
Jason Ish	31b967b089	ntp: add transaction logging ... Adds basic NTP transaction logging for the current supported message types. Includes small cleanups around reference ID. Ticket: #8425	5 months ago
Victor Julien	c7cd3b17c3	snmp: minor snmp.pdu_type type cleanup	5 months ago
Victor Julien	2cef1404bc	detect/snmp: let generic keyword share the same list	5 months ago
Victor Julien	670fdabd32	detect/snmp: add snmp.trap_type keyword ... Implemented as a U8 integer keyword. Ticket: #8482.	5 months ago
Philippe Antoine	8ac9a62ec4	detect: enable snmp keywords for firewall mode ... Ticket: #8395	5 months ago
Philippe Antoine	63603fe14a	detect/snmp: sticky buffers at progress 1 ... Since snmp txs are created at progress 1 which is the completion, this does not change detection, except allowing firewall mode to use these keywords with generic hook like snmp:request_complete Ticket: 8395	5 months ago