aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
18,970 Commits
8 Branches
174 Tags
251 MiB
main
main-8.0.x
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.7
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '57f76a2462'
${ noResults }
Commit Graph

2275 Commits (57f76a2462d01092de2a548ff8ef2221ff8a8bde)

Author SHA1 Message Date
Philippe Antoine efe3b16aac rust: feature debug in main crate enables feature debug in ffi 5 months ago
Philippe Antoine b90adcc2bb rust/ffi: move AppLayerTxData to ffi 
Ticket: 7666
 5 months ago
Philippe Antoine bce88dd83f rust: build depends on ffi/Cargo.toml.in 5 months ago
Philippe Antoine 0773fba5fd rust/ffi: move txdata flags to ffi 
Ticket: 7666
 5 months ago
Philippe Antoine 2525ea2e37 rust/ffi: move direction to ffi 
Ticket: 7666
 5 months ago
Philippe Antoine 5440e41314 rust/ffi: move debug validations macros to ffi 
Ticket: 7666
 5 months ago
Philippe Antoine bf64b52b95 http2: better compression against decompression bombs 
Ticket: 8513

Suricata decides at 2 levels if a http2 flow is doing a compression
bomb.

There is a direct computation when one chunk of TCP data
is being parsed.
In this case, do not take the ratio into account, just use the size
of the decompressed data, so that if we get a big chunk of TCP data
like 1 MiB, and a not so high ratio of 200, we do not trigger
the debug assertion in util-file.c about 64MiB

The other case stays unchanged : when accumulating over the lifetile of
a flow with multiple txs, take into account the compression ratio,
so that a flow of many txs, having a super high (brotli) compression
ratio, ends up classified as a compression bomb.
(For example, having 100 txs each turning a 100 byte input into a 700 KiB
one)
 5 months ago
Philippe Antoine 6d437956e2 detect/transforms: dotprefix can be chained 
Ticket: 8537

Otherwise, it may cause a use-after-free, in case of reallocated
buffer and we used the buffer inspect which was freed.
 5 months ago
Philippe Antoine 2b20a436e7 detect/transforms: decompress checks earlier if it is in-place 
Ticket: 8536

Otherwise, it may cause a use-after-free.

So, need to allocate the temporary vector, before calling
SCInspectionBufferCheckAndExpand
 5 months ago
Philippe Antoine 4c42998feb detect/engine: helper to know if a transform happens in-place 5 months ago
Philippe Antoine 7bf48b02be http2: protection against decompression bombs 
Ticket: 8513

During decompression, fail early if we have a big decompression
ratio, and enough data.
Track this data also during a tx lifetime, and even a flow/state
lifetime, so that we set event and fail also if the compression
bomb is split over multiple packets
 5 months ago
Philippe Antoine 29e4b08647 http2: code refactoring to split big function 5 months ago
Philippe Antoine e98d419d96 ldap: bound the number of responses 
Ticket: 8405
 5 months ago
Victor Julien 6ebd0c3cc2 http2: check for HTTP1 protocol during upgrade path 
Ticket: 8492
 5 months ago
Philippe Antoine 10bde66586 nfs: bound file_additional_procs to 1 
Ticket: 8418

As we only need to know we saw at least one NFSPROC3_COMMIT
 5 months ago
Philippe Antoine aea7ee21b8 nfs: bound namemap by using lru 
Ticket: 8418
 5 months ago
Philippe Antoine a50f494ef6 nfs: bound requestmap and use lru 
Ticket: 8418
 5 months ago
Juliana Fajardini d442c3544c detect: opt-in keywords for firewall mode 
- tls.cert_chain_len
- datarep
- dataset
- dns.opcode

Part of
Ticket #8387
 5 months ago
Philippe Antoine f0e246de34 detect/mqtt: reason_code keyword is now a multi-integer 
Ticket: 7929

Builds a vector of the reason code in a tx to do so,
except if we use the default "any", where we do not append
to the vector, but just run detection while iterating
 6 months ago
Philippe Antoine 614c48d3c3 ikev2: remove unused field 
Ticket: 8415
 6 months ago
Jeff Lucovsky 9ea2e29581 ftp: raise too_many_transactions event on overflow 
Other parsers (SMB, POP3, ENIP) already raise a too_many_transactions
event when a flow exceeds its per-flow transaction limit. FTP had
the limit wired up through app-layer.protocols.ftp.max-tx but just
dropped the excess transaction on the floor with a "FTP does not set
events yet..." TODO, so no event was raised when the limit was
reached.

Add the FtpEventTooManyTransactions variant, a stock rule at
sid 2232002, and raise the event from FTPTransactionCreate when the
live-tx count goes past ftp_config_maxtx.

Issue: 8489
 6 months ago
Jason Ish cb69fa4e53 rust/ffi: add flow lifecycle callback wrappers 
Provide Rust friendly callback registrations for flow init, update and finish events. These
callbacks are implemented as Rust closures.

Ticket: #8446
 6 months ago
Jason Ish d4dc8be3b2 rust: bindgen flow lifecycle callbacks 
Ticket: #8446
 6 months ago
Philippe Antoine e38888810d detect/dcerpc: avoids FP on dcerpc.iface keyword 
When we got a bind without the first fragment flag, and did not
set any_frag in the signature, the signature always matched,
whatever the uuid value

Ticket: 8457
 6 months ago
Jason Ish 8968b1c5a1 psl: update to 2.1.206 
Update the public suffix list to latest release.
 6 months ago
Philippe Antoine 5ed394b26b rust/ffi: move AppLayerEvent to ffi 
Ticket: 7666
 6 months ago
Philippe Antoine 59b6de8239 rust: fix last collapsible_match warnings 
The ones where we need to remove a debug log
 6 months ago
Philippe Antoine 1cdff9de8e rust: fix collapsible_match warnings 
warning: this `if` can be collapsed into the outer `match`
help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.95.0/index.html#collapsible_match
 6 months ago
Jason Ish 899e9f045e ntp: expose logged fields to lua 
This includes:
- version
- mode
- stratum
- reference_id

Ticket: #8533
 6 months ago
Jason Ish 81692dd2c1 rust/lua: add method for pushing bytes 
Much like pushstring, but accepts an &[u8] as an argument instead of an &str.

In support of ticket #8533.
 6 months ago
Jason Ish cdb02a2779 rust/dns: rustfmt 6 months ago
Philippe Antoine 7d66eb5f04 rust: remove unused function 
rust_string_to_c was used when a buffer should be used as it could
contain nul-byte
 6 months ago
Philippe Antoine 9b12fd9f09 rust/ffi: move helper trait state_get_tx_iterator to ffi 
Ticket: 7666
 6 months ago
Philippe Antoine 07f37676b6 rust/ffi: move Flags for AppLayerParserState to ffi crate 
Ticket: 7666
 6 months ago
Philippe Antoine fb20c69d8d rust/ffi: move APP_LAYER_PARSER_OPT_X const to ffi crate 
Ticket: 7666
 6 months ago
Philippe Antoine f1c66ff6f0 rust: remove obsolete const exclusions in cbindgen 
As these structs are now bindgened from C to suricata_sys crate
 6 months ago
Philippe Antoine d81a10126e detect/doc: remove unexisting links 
Ticket: 8257

And add TODO comments if rules doc should be written
 6 months ago
Philippe Antoine 8e39539161 detect/doc: fix broken anchor links 
Ticket: 8257
 6 months ago
Philippe Antoine bd6a436893 detect/doc: fix broken files links 
Ticket: 8257
 6 months ago
Philippe Antoine b0e63a2c95 detect/dcerpc: move stub_data keyword to rust 
Ticket: 8391
 6 months ago
Philippe Antoine 3d56472d16 detect: bindgen more functions 
To prepare to move dcerpc.stub_data keyword to full rust
 6 months ago
Jeff Lucovsky 746f471382 transform/subslice: Add subslice transform 
Issue: 7672

The subslice transform creates a slice of the input buffer.

Specify the subslice desired -- nbytes and truncate are optional:
        subslice: offset <,nbytes> <,truncate>

offset: Specifies the starting offset for the new subslice. When
negative, expresses how far from the end of the input buffer to begin.

nbytes: Specifies the size of the subslice. When negative, specifies
that the subslice will end that many bytes from the end of the input
buffer. Nbytes must be non-zero.

When nbytes is not specified, the size of the subslice will be the size
of the input buffer - offset.

truncate: Specify behavior when offset + nbytes exceeds buffer length.
When present, trims nbytes such that offset + nbytes equals buffer
length. When not present, an empty buffer is produced.

Examples:
        subslice: 1;     - The subslice will be a copy of the input
            buffer but omits the input buffer's first byte
            "This is Suricata" -> "his is Suricata"
        subslice: 0, 13; - The slice is created from the first 13 bytes
            of the input buffer
            "This is Suricata" -> "This is Suric"
        subslice: 10, -5; - The subslice is created starting at offset 10
            and continues to 5 bytes before the end of the input buffer
            "This is Suricata" -> "r"
        subslice: -3; - The subslice will be the last 3 bytes of the
            input buffer.
            "This is Suricata" -> "ata"
 6 months ago
Philippe Antoine 4fc6ca5d6c detect/dcerpc: move iface keyword to rust 
Ticket: 8391

Use same buffer dce_generic as for dcerpc.opnum
(name dce_generic is enforced by a SV test currently)
 6 months ago
Philippe Antoine 9677851637 rust/ffi: move app-layer traits to ffi crate 
Ticket: 7666

Traits around structures defined in C and bindgened to rust
 6 months ago
Philippe Antoine f803c25f24 rust/ffi: move export_X_data_get macros to ffi crate 
Ticket: 7666
 6 months ago
Philippe Antoine 54b6885166 rust/ffi: move conf_get_bool helper to ffi crate 
Ticket: 7666
 6 months ago
Victor Julien 28a3337c27 rust: cargo update 6 months ago
Philippe Antoine 5f9e436c3f detect/dcerpc: support generic integer for opnum keyword 
Ticket: 8179
 6 months ago
Philippe Antoine 67379b009a detect/dcerpc: move opnum keyword to rust 
Ticket: 8391
 6 months ago
Philippe Antoine a36af353bc rust: bindgen SCFlowGetAppProtocol 6 months ago