suricata

Commit Graph

Author	SHA1	Message	Date
Philippe Antoine	bf64b52b95	http2: better compression against decompression bombs Ticket: 8513 Suricata decides at 2 levels if a http2 flow is doing a compression bomb. There is a direct computation when one chunk of TCP data is being parsed. In this case, do not take the ratio into account, just use the size of the decompressed data, so that if we get a big chunk of TCP data like 1 MiB, and a not so high ratio of 200, we do not trigger the debug assertion in util-file.c about 64MiB The other case stays unchanged : when accumulating over the lifetile of a flow with multiple txs, take into account the compression ratio, so that a flow of many txs, having a super high (brotli) compression ratio, ends up classified as a compression bomb. (For example, having 100 txs each turning a 100 byte input into a 700 KiB one)	5 months ago
Philippe Antoine	6d437956e2	detect/transforms: dotprefix can be chained Ticket: 8537 Otherwise, it may cause a use-after-free, in case of reallocated buffer and we used the buffer inspect which was freed.	5 months ago
Philippe Antoine	2b20a436e7	detect/transforms: decompress checks earlier if it is in-place Ticket: 8536 Otherwise, it may cause a use-after-free. So, need to allocate the temporary vector, before calling SCInspectionBufferCheckAndExpand	5 months ago
Philippe Antoine	4c42998feb	detect/engine: helper to know if a transform happens in-place	5 months ago
Philippe Antoine	7bf48b02be	http2: protection against decompression bombs Ticket: 8513 During decompression, fail early if we have a big decompression ratio, and enough data. Track this data also during a tx lifetime, and even a flow/state lifetime, so that we set event and fail also if the compression bomb is split over multiple packets	5 months ago
Philippe Antoine	29e4b08647	http2: code refactoring to split big function	5 months ago
Philippe Antoine	e98d419d96	ldap: bound the number of responses Ticket: 8405	5 months ago
Victor Julien	6ebd0c3cc2	http2: check for HTTP1 protocol during upgrade path Ticket: 8492	5 months ago
Philippe Antoine	10bde66586	nfs: bound file_additional_procs to 1 Ticket: 8418 As we only need to know we saw at least one NFSPROC3_COMMIT	5 months ago
Philippe Antoine	aea7ee21b8	nfs: bound namemap by using lru Ticket: 8418	5 months ago
Philippe Antoine	a50f494ef6	nfs: bound requestmap and use lru Ticket: 8418	5 months ago
Juliana Fajardini	d442c3544c	detect: opt-in keywords for firewall mode - tls.cert_chain_len - datarep - dataset - dns.opcode Part of Ticket #8387	5 months ago
Philippe Antoine	f0e246de34	detect/mqtt: reason_code keyword is now a multi-integer Ticket: 7929 Builds a vector of the reason code in a tx to do so, except if we use the default "any", where we do not append to the vector, but just run detection while iterating	6 months ago
Philippe Antoine	614c48d3c3	ikev2: remove unused field Ticket: 8415	6 months ago
Jeff Lucovsky	9ea2e29581	ftp: raise too_many_transactions event on overflow Other parsers (SMB, POP3, ENIP) already raise a too_many_transactions event when a flow exceeds its per-flow transaction limit. FTP had the limit wired up through app-layer.protocols.ftp.max-tx but just dropped the excess transaction on the floor with a "FTP does not set events yet..." TODO, so no event was raised when the limit was reached. Add the FtpEventTooManyTransactions variant, a stock rule at sid 2232002, and raise the event from FTPTransactionCreate when the live-tx count goes past ftp_config_maxtx. Issue: 8489	6 months ago
Jason Ish	cb69fa4e53	rust/ffi: add flow lifecycle callback wrappers Provide Rust friendly callback registrations for flow init, update and finish events. These callbacks are implemented as Rust closures. Ticket: #8446	6 months ago
Jason Ish	d4dc8be3b2	rust: bindgen flow lifecycle callbacks Ticket: #8446	6 months ago
Philippe Antoine	e38888810d	detect/dcerpc: avoids FP on dcerpc.iface keyword When we got a bind without the first fragment flag, and did not set any_frag in the signature, the signature always matched, whatever the uuid value Ticket: 8457	6 months ago
Jason Ish	8968b1c5a1	psl: update to 2.1.206 Update the public suffix list to latest release.	6 months ago
Philippe Antoine	5ed394b26b	rust/ffi: move AppLayerEvent to ffi Ticket: 7666	6 months ago
Philippe Antoine	59b6de8239	rust: fix last collapsible_match warnings The ones where we need to remove a debug log	6 months ago
Philippe Antoine	1cdff9de8e	rust: fix collapsible_match warnings warning: this `if` can be collapsed into the outer `match` help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.95.0/index.html#collapsible_match	6 months ago
Jason Ish	899e9f045e	ntp: expose logged fields to lua This includes: - version - mode - stratum - reference_id Ticket: #8533	6 months ago
Jason Ish	81692dd2c1	rust/lua: add method for pushing bytes Much like pushstring, but accepts an &[u8] as an argument instead of an &str. In support of ticket #8533.	6 months ago
Jason Ish	cdb02a2779	rust/dns: rustfmt	6 months ago
Philippe Antoine	7d66eb5f04	rust: remove unused function rust_string_to_c was used when a buffer should be used as it could contain nul-byte	6 months ago
Philippe Antoine	9b12fd9f09	rust/ffi: move helper trait state_get_tx_iterator to ffi Ticket: 7666	6 months ago
Philippe Antoine	07f37676b6	rust/ffi: move Flags for AppLayerParserState to ffi crate Ticket: 7666	6 months ago
Philippe Antoine	fb20c69d8d	rust/ffi: move APP_LAYER_PARSER_OPT_X const to ffi crate Ticket: 7666	6 months ago
Philippe Antoine	f1c66ff6f0	rust: remove obsolete const exclusions in cbindgen As these structs are now bindgened from C to suricata_sys crate	6 months ago
Philippe Antoine	d81a10126e	detect/doc: remove unexisting links Ticket: 8257 And add TODO comments if rules doc should be written	6 months ago
Philippe Antoine	8e39539161	detect/doc: fix broken anchor links Ticket: 8257	6 months ago
Philippe Antoine	bd6a436893	detect/doc: fix broken files links Ticket: 8257	6 months ago
Philippe Antoine	b0e63a2c95	detect/dcerpc: move stub_data keyword to rust Ticket: 8391	6 months ago
Philippe Antoine	3d56472d16	detect: bindgen more functions To prepare to move dcerpc.stub_data keyword to full rust	6 months ago
Jeff Lucovsky	746f471382	transform/subslice: Add subslice transform Issue: 7672 The subslice transform creates a slice of the input buffer. Specify the subslice desired -- nbytes and truncate are optional: subslice: offset <,nbytes> <,truncate> offset: Specifies the starting offset for the new subslice. When negative, expresses how far from the end of the input buffer to begin. nbytes: Specifies the size of the subslice. When negative, specifies that the subslice will end that many bytes from the end of the input buffer. Nbytes must be non-zero. When nbytes is not specified, the size of the subslice will be the size of the input buffer - offset. truncate: Specify behavior when offset + nbytes exceeds buffer length. When present, trims nbytes such that offset + nbytes equals buffer length. When not present, an empty buffer is produced. Examples: subslice: 1; - The subslice will be a copy of the input buffer but omits the input buffer's first byte "This is Suricata" -> "his is Suricata" subslice: 0, 13; - The slice is created from the first 13 bytes of the input buffer "This is Suricata" -> "This is Suric" subslice: 10, -5; - The subslice is created starting at offset 10 and continues to 5 bytes before the end of the input buffer "This is Suricata" -> "r" subslice: -3; - The subslice will be the last 3 bytes of the input buffer. "This is Suricata" -> "ata"	6 months ago
Philippe Antoine	4fc6ca5d6c	detect/dcerpc: move iface keyword to rust Ticket: 8391 Use same buffer dce_generic as for dcerpc.opnum (name dce_generic is enforced by a SV test currently)	6 months ago
Philippe Antoine	9677851637	rust/ffi: move app-layer traits to ffi crate Ticket: 7666 Traits around structures defined in C and bindgened to rust	6 months ago
Philippe Antoine	f803c25f24	rust/ffi: move export_X_data_get macros to ffi crate Ticket: 7666	6 months ago
Philippe Antoine	54b6885166	rust/ffi: move conf_get_bool helper to ffi crate Ticket: 7666	6 months ago
Victor Julien	28a3337c27	rust: cargo update	6 months ago
Philippe Antoine	5f9e436c3f	detect/dcerpc: support generic integer for opnum keyword Ticket: 8179	6 months ago
Philippe Antoine	67379b009a	detect/dcerpc: move opnum keyword to rust Ticket: 8391	6 months ago
Philippe Antoine	a36af353bc	rust: bindgen SCFlowGetAppProtocol	6 months ago
Jason Ish	fd31e50954	ntp: enable keywords for firewall mode Ticket: #8394	6 months ago
Jason Ish	713e4eb900	ntp: convert reference_id to buffer and add keyword Store the NTP reference ID as raw network-order bytes so it can be exposed as a sticky buffer and matched with payload keywords. The reference ID is often a 4 character string, or an IP address and not just an integer identifier. Updates the log reference ID to be a string of colon separated hex digits as this matches what tshark does. Ticket: #8488	6 months ago
Jason Ish	991e7f3b1d	ntp: add ntp.mode keyword This keyword also accepts strings for known mode names. Ticket: #8429	6 months ago
Jason Ish	c10c482290	ntp: add ntp.stratum keyword Ticket: #8431	6 months ago
Jason Ish	ec344fe68d	ntp: add ntp.version keyword SNMP was used as a template. Ticket: #8430	6 months ago
Jason Ish	74bb525401	ntp: create tx for all modes; log version, mode and stratum Add logging for version, mode and stratum as these will be the first keywords we will add. Ticket: #8425	6 months ago

1 2 3 4 5 ...

2269 Commits (474788fd497ea175e2335b9f64e964d6321ec60a)