2209 Commits (42a85c37f129cd984d77de19c6316fa245275457)

Author	SHA1	Message	Date
Philippe Antoine	58a71d94b0	rust/ffi: move conf_get helper to ffi crate ... Ticket: 7666	4 months ago
Philippe Antoine	8d254f5630	dhcp/output: log app-layer metadata in alerts ... Ticket: 6091 log as extended	4 months ago
Philippe Antoine	db980daf5f	dhcp: standardize output code ... To prepare to add metadata in alerts Ticket: 6091	4 months ago
Philippe Antoine	d14af54b3b	detect/transforms: constify some callbacks arguments ... Ticket: 8298	4 months ago
Philippe Antoine	0a24f0afe2	smb: parse smb1 session setup with word count 13 ... Ticket: 5845	4 months ago
Jason Ish	98469b0f56	rust/ffi: fix clippy warnings ... Remove the unneeded return. The other option would be to allow it, but so far in the ffi crate we don't have any non-default allows.	4 months ago
Philippe Antoine	c53b9df5a2	rust/ffi: move detection helpers to ffi crate ... Ticket: 7666	4 months ago
Philippe Antoine	4f4912c042	rust: bindgen SIGMATCH_ constants	4 months ago
Philippe Antoine	2fa10052cf	websocket: check pdu opcode for reassembly ... Ticket: 8413 RFC 6455 Section 5.4 states Control frames (see Section 5.5) MAY be injected in the middle of a fragmented message. Control frames are identified by opcodes where the most significant bit of the opcode is 1.	4 months ago
Philippe Antoine	7b0528d85f	http2: set response_frame_size ... Ticket: 8410 Do not set only request_frame_size whatever the direction	4 months ago
Philippe Antoine	267c3baff7	rust/ffi: move STREAM_ constants to ffi crate ... Ticket: 7666 reexport them in suricata crate cbindgen them to C	5 months ago
Philippe Antoine	61c667400b	rust: remove obsolete inclusions from cbindgen.toml	5 months ago
Philippe Antoine	fd4c6d4e06	rust: remove obsolete struct exclusions in cbindgen ... As these structs are now in suricata_sys crate	5 months ago
Philippe Antoine	a10a818792	rust: remove obsolete constants exclusion from cbindgen.toml ... Completes commit 71b59f6dbe These const are no longer defined in rust suricata crate	5 months ago
Jason Ish	dce2deee5e	rust: pin unicode-segmentation crate to 1.12.0 ... unicode-segmentation (used by rustyline) was updated from 1.12.0 to 1.13.1 earlier and requires a newer version of Rust. Pin to 1.12.0 which works with Rust 1.75.0.	5 months ago
Philippe Antoine	34ed8958a6	dcerpc: only log the tx interfaces ... Not all the state ones Ticket: 8378	5 months ago
Philippe Antoine	05a11e2897	dcerpc: store persistently contexts ... So that we can log and detect on interface uuids, even if AlterContext packets change one of the contexts, but other contexts are still used after it in request/responses Ticket: 8378	5 months ago
Jason Ish	9cab99fbd3	rust: rust fmt derive crate	5 months ago
Jeff Lucovsky	14ebba6382	gen/unused: Remove unused function ... Remove unused function is_alphanumeric_or_slash	5 months ago
Jeff Lucovsky	98070a7ace	misc/cleanup: remove rust if <cond> .... ... Cleanup the few instances of rust where if cond return true else false exist rg = ripgrep rg -n -U '^\s*if .* \{\s*\n\s*return true;\s*\n\s*\}\s*\n\s*return false;' rust/src/ --glob '*.rs' rg -n -U '^\s*if .* \{\s*\n\s*return false;\s*\n\s*\}\s*\n\s*return true;' rust/src/ --glob '*.rs'	5 months ago
Philippe Antoine	6587e363a3	dcerpc: use bind context_id in SMB ... Ticket: 8375 logger already read this variable but it was never set, and the rust compiler did not warn about this Allows to log the interface uuid when ctx_id > 0 Wireshark filter for related pcaps dcerpc.cn_ctx_id > 0 && dcerpc.pkt_type == 0	5 months ago
Philippe Antoine	2c2a3c800f	dcerpc: support multiple PDU in one parser call ... Ticket: 7254 With TCP, we receive a stream of data, which may contain multiple PDUs in one call	5 months ago
Philippe Antoine	db51314478	rust: rustfmt dcerpc.rs	5 months ago
Philippe Antoine	55ad2953bf	dcerpc: do not error the whole flow on unhandled packet type ... Ticket: 5133	5 months ago
Jason Ish	e9f8e17b16	rust/Makefile: add RUSTC and RUSTDOC to CARGO_ENV ... And consistently use the CARGO_ENV for all cargo calls. This allows a user to point to rust binaries that are not on their path just during ./configure, for example: PATH=/usr/lib/rust-1.89/bin:$PATH ./configure ... The full path to rustc and rustdoc will now be used, as discovered in the PATH without the user have to carry the path over to the "make" command. This was already done for cargo. Related to ticket: #8381	5 months ago
Philippe Antoine	ebe0ba4ebb	rust: limit clap verson to 4.5.57 ... clap 4.5.58 and further requires edition2024 which is incompatible with MSRV	5 months ago
Philippe Antoine	76d2925bdf	ldap: abandon request does not wait for a response ... Ticket: 8356 As such, abandon request is a complete tx	5 months ago
Philippe Antoine	784e173278	http2: bound number of http2 frames per tx ... Ticket: 8289 If stream.reassembly.depth is unlimited, an attacker controlling the 2 sides of a communication going through Suricata can send a transition with an infinite number of headers, until suricata OOMs Solution is to offer a configuration option to bound the number of HTTP2 frames we store in a HTTP2 transaction, and produce an anomaly if this bound is crossed	5 months ago
Philippe Antoine	49fd7001ff	smtp/mime: fix urls finding in buffering case ... We used to look for a full line, but as we look fot the last eol we need to use the right index in the not-reversed list	5 months ago
Philippe Antoine	8bba47aa09	smtp/mime: avoid quadratic complexity in mime_smtp_find_url_strings ... Ticket: 8292 When we have buffered something in ctx.decoded_line, we already looked for '\n' in it, so we do not need to run it again Otherwise, callers that supply mime_smtp_find_url_strings with a few bytes at a time without "\n", have a quadratic complexity	5 months ago
Philippe Antoine	062f56ddde	detect/http2: use ThreadCtx for all headers keywords ... Instead of custom inefficient "escaped" Vec Ticket: 8291	5 months ago
Philippe Antoine	4e538dfa3b	detect/http2: use ThreadCtx for http.request_header ... And also for http.response_header Instead of custom inefficient "escaped" Vec Ticket: 8291	5 months ago
Philippe Antoine	0933e944df	detect/http2: use ThreadCtx for http.header.raw ... Instead of custom inefficient "escaped" Vec Ticket: 8291	5 months ago
Philippe Antoine	711de8a5ea	detect/http2: use ThreadCtx for http.header ... Instead of custom inefficient "escaped" Vec Ticket: 8291	5 months ago
Philippe Antoine	52a2f2dd19	detect/http2: use ThreadCtx for http.header_names ... Instead of custom inefficient "escaped" Vec Ticket: 8291	5 months ago
Jason Ish	648a867049	psl: update to 2.1.197 ... Update the Mozilla public suffix list to 2.1.197.	5 months ago
Philippe Antoine	8e886a8ecd	krb5: use app-layer incomplete support ... Ticket: 3540 Ticket: 8305	5 months ago
Philippe Antoine	d77c43c79b	rust/ffi: move build_slice macro to ffi crate ... Ticket: 7666	5 months ago
Philippe Antoine	4a0143c8d4	rust/ffi: move cast_pointer macro to ffi crate ... Ticket: 7666	5 months ago
Shivani Bhardwaj	d241237c0f	Revert "dcerpc: fix consumed bytes post gap handling" ... This reverts commit fc9da1c7a1. That commit incorrectly used consumed as index of the slice passed to the Frame API. Found by oss-fuzz.	5 months ago
Jeff Lucovsky	ed882ede68	output/ipv6: Utility function to compress IPv6 addrs ... Issue: 7399 Utility function to compress IPv6 addresses per RFC-5952	5 months ago
Giuseppe Longo	de46f4ba9d	ldap: set invalid_data event ... Currently in parse_request function LdapEvent::InvalidData is not set when a request is not parsed correctly. Ticket #8258	5 months ago
Victor Julien	b55be5a44f	detect/transforms: update gunzip / zlib_deflate syntax ... Use standard space separated syntax.	5 months ago
Philippe Antoine	71b59f6dbe	rust/ffi: move IPPROTO_TCP to ffi ... and reexport in suricata Allows to reduce dependencies to full suricata crate Ticket: 7666	6 months ago
Philippe Antoine	d5ea973791	detect/ike: move ike.ike.chosen_sa_attribute keyword to rust ... Ticket: 8310 And increases expressivity on the way by supporting other modes than equality	6 months ago
Philippe Antoine	55333a6ca0	detect/ike: move ike.vendor keyword to rust ... Ticket: 8310	6 months ago
Philippe Antoine	14edd66494	detect/ike: move ike.nonce_payload keyword to rust ... Ticket: 8310	6 months ago
Philippe Antoine	d1213e4440	detect/ike: move ike.key_exchange_payload keyword to rust ... Ticket: 8310	6 months ago
Philippe Antoine	f23169c924	detect/ike: move ike.nonce_payload_length keyword to rust ... Ticket: 8310	6 months ago
Philippe Antoine	e85bf5be4d	detect/ike: move ike.key_exchange_payload_length keyword to rust ... Ticket: 8310	6 months ago