aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
19,665 Commits
8 Branches
174 Tags
248 MiB
main
main-8.0.x
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.7
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '5a5dcdab3e'
${ noResults }
Commit Graph

81 Commits (5a5dcdab3ed7da488efd58eb20e8cde43391f2c3)

Author SHA1 Message Date
Philippe Antoine 5a5dcdab3e http2/doc: list possible values for enum keywords 
Ticket: 8675
 3 weeks ago
Philippe Antoine 96c6ba6f76 http2/detect: avoids use-after-free with Http2ThreadMultiBuf 
Ticket: 9003

When a single tx is getting inspected by rules having
http.response_header keyword both with a transform and without
a transform, the code went like this :

Http2ThreadMultiBuf structure contains a list (Vec) of buffers
(Vec<u8>) and owns these Vec<u8> (they are not owned by the tx).

For the first list_id, we computed each buffer for a http2 header
and put them in these Http2ThreadMultiBuf structure.

But for the second list_id, the code began by freeing the memory
of these http2 headers, and reallocated new buffers (Vec<u8>)
and recomputed each buffer.

After these rounds, which may happen in DetectRunPrefilterTx,
the buffers might need further checks, hence the use-after-free.

Now, the code does not free and allocate a new buffer, it just rewrites
the old one, as is done for HTTP1.
 2 months ago
Philippe Antoine f5e44ced1e http2: use host header for http.host keyword 
if :authority header is absent

Ticket: 8774
 2 months ago
Philippe Antoine b0b353d0c0 http2: host normalization handles ipv6 address 
And does not consider automatically a port after first colon

Ticket: 8778
 2 months ago
Philippe Antoine 52c01543c9 http2: code cleanup for http2_normalize_host 
Just separate the steps in parsing, and deduplicate code
 2 months ago
Victor Julien 7ebc699df0 http2: split transaction state machines 
Split into 2 sub-states:
- stream, which has the "HTTP" requests and responses, including DOH2
- global, which has the settings and other global or control handling

Introduce a simpler progress tracking for the global sub state:
- HTTP2ProgGlobalStart and HTTP2ProgGlobalComplete.

The stream sub state uses the same state machine as before.

Ticket: #8386.
 4 months ago
Philippe Antoine 5fe920ec42 detect: make Http2ThreadBuf a generic DetectThreadBuf 
to be used by snmp and other
 4 months ago
Philippe Antoine daf68dc36f http2: split progress per direction 
Ticket: 8518

Keywords that work for HTTP2 headers match now as soon as possible

A push promise is now considered like a headers frame with regards
to the progress (no dedicated "reserved" progress/state)

http.protocol and http.stat_msg keywords are now registered at
earliest progress, since these are synthetic like "HTTP/2" and
not really seen on the wire.

http.request_line and http.response_line match only on data,
and not on headers, since we must wait the end of headers
to be sure to have the full line

http2.size_update now matches at headers progress as it should

http2.frametype, http2.errorcode, http2.priority now match like
http2.window, when the tx is complete from both sides, as a
half-closed client may still send priority, rst_stream
or window_update frames
 5 months ago
Philippe Antoine 062f56ddde detect/http2: use ThreadCtx for all headers keywords 
Instead of custom inefficient "escaped" Vec

Ticket: 8291
 8 months ago
Philippe Antoine 4e538dfa3b detect/http2: use ThreadCtx for http.request_header 
And also for http.response_header

Instead of custom inefficient "escaped" Vec

Ticket: 8291
 8 months ago
Philippe Antoine 0933e944df detect/http2: use ThreadCtx for http.header.raw 
Instead of custom inefficient "escaped" Vec

Ticket: 8291
 8 months ago
Philippe Antoine 711de8a5ea detect/http2: use ThreadCtx for http.header 
Instead of custom inefficient "escaped" Vec

Ticket: 8291
 8 months ago
Philippe Antoine 52a2f2dd19 detect/http2: use ThreadCtx for http.header_names 
Instead of custom inefficient "escaped" Vec

Ticket: 8291
 8 months ago
Philippe Antoine 969739d067 detect: http2.errorcode is now a generic integer 
Ticket: 7889
 1 year ago
Philippe Antoine 401b2fcae6 detect: http2.frametype is now a generic integer 
Ticket: 7889
 1 year ago
Philippe Antoine dd81cfa733 detect/uint: wait for end of progress to match on all 
As is done for absent keyword for instance
 1 year ago
Philippe Antoine 5add185f22 http2/detect: http2.window can now use index 
Ticket: 7480
 1 year ago
Philippe Antoine 83868778b9 http2/detect: http2.priority can now use index 
Ticket: 7480
 1 year ago
Philippe Antoine 0d82e905bc rust: bindgen DetectHelperMultiBufferMpmRegister 
Ticket: 7667
 1 year ago
Jason Ish 717e06e351 rust/http2: replace rs_ naming with SC 2 years ago
Philippe Antoine 8ecc3efdc8 detect/multi-buf: harmonize wrapper 
Introduce DetectGetMultiData which does the generic wrapping,
including the transforms.

And let each keyword do just the getter.
 2 years ago
Jason Ish 77b94b8713 rust: fixes for breaking change on deranged crate 
Deranged v0.4.1 (a dependency of the time crate) has implemented
PartialOrd for some integer types that conflict with the
implementation in the standard library creating an ambiguity as such
implementation are global. For more info see
https://github.com/jhpratt/deranged/issues/18.

To fix, use "::from" directly, instead of using .into() which is where
we run into amgibuity.
 2 years ago
Jason Ish f62be374ea rust/direction: move direction to own file (cleanup) 
Move the implementation of Direction to its own file, direction.rs.
 2 years ago
Philippe Antoine 8f6795d049 rust: remove unneeded mut for tx in detect 
Detection does not change transactions, it reads only.
 2 years ago
Jason Ish b1c26dccf3 http2: rename event variant to match rule 
Rename InvalidHTTP1Settings to InvalidHttp1Settings so it gets the
expected name transformation of "invalid_http1_settings".

Ticket: #7361
 2 years ago
Shivani Bhardwaj e93743a094 rust/base64: upgrade crate to latest 
base64 crate is updated to the latest version 0.22.1. This came with
several API changes which are applied to the code. The old calls have
been replaced with the newer calls.

This was done following the availability of better fns to directly
decode into slices/vectors as needed and also that previous version was
too old.
Along with this change, update the Cargo.lock.in to reflect all changes
in the package versions.

Task 7219
 2 years ago
Philippe Antoine 564f685eea rust: fix byte_char_slices clippy warnings 
warning: can be more succinctly written as a byte str
   --> src/mime/smtp.rs:762:37
    |
762 |     mime_smtp_find_url_strings(ctx, &[b'\n']);
    |                                     ^^^^^^^^ help: try: `b"\n"`
    |
    = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#byte_char_slices
    = note: `#[warn(clippy::byte_char_slices)]` on by default
 2 years ago
Philippe Antoine 29d9dc2729 http2: rustfmt 2 years ago
Philippe Antoine 647e878f7c detect: helper function for multibuffer 2 years ago
Philippe Antoine 5bd17934df http2: do not expand duplicate headers 
Ticket: 7104

As this can cause a big mamory allocation due to the quadratic
nature of the HPACK compression.
 2 years ago
Philippe Antoine 390f09692e http2: use a reference counter for headers 
Ticket: 6892

As HTTP hpack header compression allows one single byte to
express a previously seen arbitrary-size header block (name+value)
we should avoid to copy the vectors data, but just point
to the same data, while reamining memory safe, even in the case
of later headers eviction from the dybnamic table.

Rust std solution is Rc, and the use of clone, so long as the
data is accessed by only one thread.
 3 years ago
Philippe Antoine 80abc22f64 http2: limit number of concurrent transactions 
Ticket: 6481

Instead of just setting the old transactions to a drop state so
that they get later cleaned up by Suricata, fail creating new ones.

This is because one call to app-layer parsing can create many
transactions, and quadratic complexity could happen in one
single app-layer parsing because of find_or_create_tx
 3 years ago
Philippe Antoine 1b5e04bee3 http2: do not have leading space for response line 
Ticket: 6547
 3 years ago
Philippe Antoine 6249722589 http2: normalize host when there is user info 
Ticket: 6479
 3 years ago
Philippe Antoine 7256ec8a6e detect/http2: do not escape ':' in header name or value 
for keywords http.request_header and http.response_header

Ticket: #5780
 3 years ago
Philippe Antoine 5391f0a8a0 detect: http_response_line for HTTP2 
Ticket: #4067

Synthetized as HTTP/2 <STAT>\r\n
 4 years ago
Philippe Antoine 0dca8cc796 detect: http_request_line support for HTTP2 
Ticket: #4067

Synthetized as <METHOD> <URI> HTTP/2\r\n
 4 years ago
Victor Julien ee7ed99b6f rust: spelling 4 years ago
Jason Ish 7ba2dadc7f rust/clippy: fix lint: upper_case_acronyms 4 years ago
Jason Ish 3044565cf4 rust/clippy: fix lint: needless_range_loop 4 years ago
Jason Ish f15ffbc869 rust/clippy: fix lint: single_match 
Allow this lint in some cases where a match statement adds clarity.
 4 years ago
Philippe Antoine bc287018e5 rust: cargo clippy --all-features --fix --allow-no-vcs 4 years ago
Jason Ish 04f0ee0151 rust: fix clippy lints for clippy::unnecessary_cast 4 years ago
Jason Ish 119e02cf81 rust: fix clippy lints for clippy::collapsible_if 4 years ago
Jason Ish 572505870a rust: fix clippy lints for clippy::collapsible_else_if 4 years ago
Jason Ish 565da0d0af rust: fix clippy lints for clippy::redundant_field_names 4 years ago
Jason Ish f342d4aacd rust: fix clippy lints for clippy::len_zero 4 years ago
Jason Ish 5e5401d3e9 rust: fix clippy lints for clippy::char_lit_as_u8 4 years ago
Jason Ish 29a4a7fddc rust: fix clippy lints for clippy::assign_op_pattern 4 years ago
Jason Ish c5b26e2043 rust: fix clippy ling for needless borrows 
Cleanup needless borrows found by clippy. This fix done automatically by
`cargo clippy --fix`.
 4 years ago