suricata

Commit Graph

Author	SHA1	Message	Date
Philippe Antoine	8217c51126	rust: format sdp files Ticket: 3836	5 months ago
Philippe Antoine	9d9d8df4cd	rust: format rdp files Ticket: 3836	5 months ago
Philippe Antoine	7352bae890	smb: avoid unsigned overflow debug assertion As we compute a padding, we can use wrapping_add as we only care about the low-weight bit anyways	5 months ago
Giuseppe Longo	8f205bb34f	llmnr: implement logger This adds an LLMNR protocol logger that reuses existing DNS functions, following the same approach as the mDNS logger: - No grouped logging - Rdata is logged in a field that is named after the rdata type - Types are logged in lower case - Flags are logged as an array Ticket #8366	5 months ago
Giuseppe Longo	13df0f7a06	llmnr: implement parser This adds a parser for LLMNR protocol over both UDP and TCP. The parser reuses the existing DNS functions since LLMNR shares the same wire format as DNS, but implements its own protocol-specific validation: - LLMNR-specific flag checks (C, TC, T bits) - Opcode validation (only standard query opcode 0 is valid) - An Event is set if Z-flag is set, since it's must be zero per RFC4795 LLMNR transactions inherit DNS behavior where each packet creates a new state with one transaction. Ticket #8366	5 months ago
Jason Ish	3dc8b154f3	rust/ffi: add safe thread storage wrapper Add a typed ThreadStorage<T> wrapper around the thread storage bindings. Ticket: #8445	5 months ago
Jason Ish	9f40968bba	rust/ffi: bindgen thread storage Ticket: #8445	5 months ago
Jason Ish	5e0abf1572	rust/ffi: use ThreadVars wrapper in flow callbacks Update the flow init, update and finish callback registrations to pass the safe ThreadVars wrapper instead of a raw pointer. Ticket: #8598	5 months ago
Jason Ish	1cac242948	rust/ffi: use ThreadVars wrapper in eve callback Update the EVE callback registration to pass the safe ThreadVars wrapper instead of a raw pointer. Ticket: #8598	5 months ago
Jason Ish	45762aa644	rust/ffi: use ThreadVars wrapper in thread init callback Update the thread init callback registration to pass the safe ThreadVars wrapper instead of a raw pointer. Ticket: #8598	5 months ago
Jason Ish	5fe88212c3	rust/ffi: add wrapper around ThreadVars A Rust wrapper around ThreadVars to enforce Rust lifetimes to ThreadVars when used in a callback. Ticket: #8598	5 months ago
Philippe Antoine	73193c7e6a	rust: format pgsql files Ticket: 3836	5 months ago
Philippe Antoine	3bfe6cf4b9	rust: format nfs files Ticket: 3836	5 months ago
Juliana Fajardini	372cb8c692	rust/sys: update bindgen SIGMATCH_ constants Part of Ticket #8551	5 months ago
Jason Ish	144f824f17	rust/ffi: add thread init callback wrapper Ticket: #8605	5 months ago
Jason Ish	c689af0bbb	rust/ffi: bindgen thread lifecycle callbacks Ticket: #8605	5 months ago
Philippe Antoine	07112bc7ae	rust: format mqtt files Ticket: 3836	5 months ago
Philippe Antoine	844f2effa3	rust: format modbus files Ticket: 3836	5 months ago
Philippe Antoine	db019ebefe	rust: format ike files Ticket: 3836	5 months ago
Philippe Antoine	bcc1e6ae32	rust: format http2 files Ticket: 3836	5 months ago
Philippe Antoine	1070e733d8	rust: format websocket files Ticket: 3836	5 months ago
Philippe Antoine	89e5332d88	rust: format utils files Ticket: 3836	5 months ago
Philippe Antoine	edf29b0000	rust: format ssh files Ticket: 3836	5 months ago
Philippe Antoine	fe27a2159c	rust: format rfb files Ticket: 3836	5 months ago
Philippe Antoine	5cca346f16	rust: format quic files Ticket: 3836	5 months ago
Philippe Antoine	415360d9e8	rust: format ntp files Ticket: 3836	5 months ago
Philippe Antoine	fa864f9c2f	rust: format mime files Ticket: 3836	5 months ago
Philippe Antoine	2cfcaec1b0	rust: format ldap files Ticket: 3836	5 months ago
Philippe Antoine	64e7c671cc	rust: format ftp files Ticket: 3836	5 months ago
Philippe Antoine	f217e249cb	rust: format ffi files Ticket: 3836	5 months ago
Philippe Antoine	f7c14809f4	rust: format enip files Ticket: 3836	5 months ago
Philippe Antoine	e526eb8e2b	rust: format bittorrent_dht files Ticket: 3836	5 months ago
Philippe Antoine	f5ac0e201c	rust: format asn1 files Ticket: 3836	5 months ago
Philippe Antoine	1ced97bdbb	rust: format applayertemplate files Ticket: 3836	5 months ago
Philippe Antoine	efe3b16aac	rust: feature debug in main crate enables feature debug in ffi	5 months ago
Philippe Antoine	b90adcc2bb	rust/ffi: move AppLayerTxData to ffi Ticket: 7666	5 months ago
Philippe Antoine	bce88dd83f	rust: build depends on ffi/Cargo.toml.in	5 months ago
Philippe Antoine	0773fba5fd	rust/ffi: move txdata flags to ffi Ticket: 7666	5 months ago
Philippe Antoine	2525ea2e37	rust/ffi: move direction to ffi Ticket: 7666	5 months ago
Philippe Antoine	5440e41314	rust/ffi: move debug validations macros to ffi Ticket: 7666	5 months ago
Philippe Antoine	bf64b52b95	http2: better compression against decompression bombs Ticket: 8513 Suricata decides at 2 levels if a http2 flow is doing a compression bomb. There is a direct computation when one chunk of TCP data is being parsed. In this case, do not take the ratio into account, just use the size of the decompressed data, so that if we get a big chunk of TCP data like 1 MiB, and a not so high ratio of 200, we do not trigger the debug assertion in util-file.c about 64MiB The other case stays unchanged : when accumulating over the lifetile of a flow with multiple txs, take into account the compression ratio, so that a flow of many txs, having a super high (brotli) compression ratio, ends up classified as a compression bomb. (For example, having 100 txs each turning a 100 byte input into a 700 KiB one)	5 months ago
Philippe Antoine	6d437956e2	detect/transforms: dotprefix can be chained Ticket: 8537 Otherwise, it may cause a use-after-free, in case of reallocated buffer and we used the buffer inspect which was freed.	5 months ago
Philippe Antoine	2b20a436e7	detect/transforms: decompress checks earlier if it is in-place Ticket: 8536 Otherwise, it may cause a use-after-free. So, need to allocate the temporary vector, before calling SCInspectionBufferCheckAndExpand	5 months ago
Philippe Antoine	4c42998feb	detect/engine: helper to know if a transform happens in-place	5 months ago
Philippe Antoine	7bf48b02be	http2: protection against decompression bombs Ticket: 8513 During decompression, fail early if we have a big decompression ratio, and enough data. Track this data also during a tx lifetime, and even a flow/state lifetime, so that we set event and fail also if the compression bomb is split over multiple packets	6 months ago
Philippe Antoine	29e4b08647	http2: code refactoring to split big function	6 months ago
Philippe Antoine	e98d419d96	ldap: bound the number of responses Ticket: 8405	6 months ago
Victor Julien	6ebd0c3cc2	http2: check for HTTP1 protocol during upgrade path Ticket: 8492	6 months ago
Philippe Antoine	10bde66586	nfs: bound file_additional_procs to 1 Ticket: 8418 As we only need to know we saw at least one NFSPROC3_COMMIT	6 months ago
Philippe Antoine	aea7ee21b8	nfs: bound namemap by using lru Ticket: 8418	6 months ago

1 2 3 4 5 ...

2309 Commits (567e824e4455cb55066922db124fd4c842b92ef5)