239 Commits (5aac489bc473e947746221b873a65c8be8700cf0)

Author	SHA1	Message	Date
Philippe Antoine	b8275da9d0	dns/doc: list possible values for enum keywords ... Ticket: 8675	3 weeks ago
Jason Ish	b71178b667	lua/dns: handle OPT answers like TXT records ... In "tx:answers()" don't attempt to push each OPT as its own string, instead concatenate into one string like we do with TXT. The previous method was broken and didn't work anyways, so we're not breaking something that previously worked. Ticket: 8843	2 months ago
Jason Ish	bddf04d99b	dns: fix TCP request gap resync ... Ticket: #8842	2 months ago
Victor Julien	b36ec146aa	detect/dns: register keywords for DOH2 as well ... Now that DNS keywords are no longer registered for DOH2, the keywords need to manually registered for DOH2.	4 months ago
Giuseppe Longo	13df0f7a06	llmnr: implement parser ... This adds a parser for LLMNR protocol over both UDP and TCP. The parser reuses the existing DNS functions since LLMNR shares the same wire format as DNS, but implements its own protocol-specific validation: - LLMNR-specific flag checks (C, TC, T bits) - Opcode validation (only standard query opcode 0 is valid) - An Event is set if Z-flag is set, since it's must be zero per RFC4795 LLMNR transactions inherit DNS behavior where each packet creates a new state with one transaction. Ticket #8366	5 months ago
Juliana Fajardini	d442c3544c	detect: opt-in keywords for firewall mode ... - tls.cert_chain_len - datarep - dataset - dns.opcode Part of Ticket #8387	5 months ago
Jason Ish	cdb02a2779	rust/dns: rustfmt	6 months ago
Philippe Antoine	8e39539161	detect/doc: fix broken anchor links ... Ticket: 8257	6 months ago
Philippe Antoine	bd6a436893	detect/doc: fix broken files links ... Ticket: 8257	6 months ago
Philippe Antoine	8f824458c2	detect: helper for buffer register requires progress ... Ticket: 8395 For protocols where tx are complete at start, that is the `tx_get_progress` function returns 1 inconditionnally, we can use the progress 1, not losing time on detection in ips mode, and getting ready for firewall mode For the other protocols (where a tx needs both a request and response for instance), keep progress 0 as was the case before	6 months ago
Jason Ish	e474e45429	dns/detect: fix rcode return type ... The parsed DNS rcode was being returned as a DetectUintData<u8>, but is parsed, and free'd as a u16. So return a DetectUintData<u16>.	9 months ago
Philippe Antoine	8857b78f6a	rust: move AppLayerTxData definition to C ... and bindgen it to rust Will make easier the bindgen of RustParser structure which uses a callback which uses AppLayerTxData Move also the free function to C SCAppLayerTxDataCleanup As suricata-sys crate defines AppLayerTxData for rust, It must itself implement the Drop trait, and thus, We need to define a feature surest	9 months ago
Philippe Antoine	c960b7d7c1	app-layer: AppLayerParserFPtr uses a mut pointer to local storage ... So, fix the fn prototype in rust ParseFn	9 months ago
Philippe Antoine	455b7d1b3b	rust: use snake case for applayer_register_protocol_detection	11 months ago
Philippe Antoine	439f96dea7	rust: bindgen frames functions ... Ticket: 7667	12 months ago
Jason Ish	54cc97b78e	rust/dns: convert to nom 8.0 ... Ticket: #8024	1 year ago
Philippe Antoine	53d9569dfb	detect: list-keywords cli shows integers with enums ... Ticket: 7875	1 year ago
Philippe Antoine	da486af881	detect: list-keywords cli shows integers ... Ticket: 7875	1 year ago
Philippe Antoine	b298bce0e7	detect: list-keywords cli shows multi-buffers ... Ticket: 7571	1 year ago
Philippe Antoine	dd81cfa733	detect/uint: wait for end of progress to match on all ... As is done for absent keyword for instance	1 year ago
Philippe Antoine	c0988252ba	dns/detect: rrtype can now use index ... Ticket: 7480	1 year ago
Philippe Antoine	bca6cbfb04	rust: fix prototype for AppLayerParserTriggerRawStreamInspection ... Ticket: 7762 As it modifies the flow indeed	1 year ago
Philippe Antoine	6dbc421825	rust: bindgen AppLayerParserConfParserEnabled ... Ticket: 7667	1 year ago
Philippe Antoine	b29d46d81f	rust: bindgen SCAppLayerParserStateIssetFlag ... Ticket: 7667	1 year ago
Philippe Antoine	7bb0c94ae9	rust: bindgen app-layer-detect-proto.h ... Ticket: 7667	1 year ago
Jason Ish	4a655053e8	mdns: add mdns parser, logger and detection ... The mDNS support is based heavily on the DNS support, reusing the existing DNS parser where possible. This meant adding variations on DNS, as mDNS is a little different. Mainly being that *all* mDNS traffic is to_server, yet there is still the concept of request and responses. Keywords added are: - mdns.queries.rrname - mdns.answers.rrname - mdns.additionals.rrname - mdns.authorities.rrname - mdns.response.rrname They are mostly in-line with the DNS keywords, except mdns.answers.rdata which is a better than that mdns.response.rrname, as its actually looking at the rdata, and not rrnames. mDNS has its own logger that differs from the DNS logger: - No grouped logging - In answers/additionals/authorities, the rdata is logged in a field that is named after the rdata type. For example, "txt" data is no longer logged in the "rdata" field, but instead a "txt" field. We currently already did this in DNS for fields that were not a single buffer, like SOA, SRV, etc. So this makes things more consistent. And gives query like semantics that the "grouped" object was trying to provide. - Types are logged in lower case ("txt" instead of "TXT") - Flags are logged as an array: "flags": ["aa", "z"] Ticket: #3952	1 year ago
Jason Ish	de88d8ec48	dns: parse multiple txt segments into an array ... A DNS TXT answer record can actually be made of up multiple TXT entries in a single record. Suricata currently expands these into multiple TXT records, however that is not very representative of the actualy DNS message. Instead, if a TXT record contains multiple labels, parse them into an array. We still expand multiple TXT segements into multiple TXT records at logging time for compatibility, but this will allow something like MDNS to log more accurately to the protocol.	1 year ago
Shivani Bhardwaj	35cef72b44	stream: rename TriggerRawStreamReassembly ... The functions around TriggerRawStreamReassembly are misnomers in the current layout of the code. The functions were named appropriately when they were created as per the structural and logical layout of the code at the time. These functions in today's code are being used to track, update and trigger progress of inspection in the raw stream only. Hence, rename them to TriggerRawStreamInspection.	1 year ago
Philippe Antoine	a2b5225612	rust: bindgen SCSigMatchAppendSMToList ... Ticket: 7667	1 year ago
Philippe Antoine	78034b218d	rust: bindgen SCDetectSignatureSetAppProto ... Ticket: 7667	1 year ago
Philippe Antoine	13449344e8	rust: bindgen SCDetectHelperKeywordRegister ... Ticket: 7667	1 year ago
Philippe Antoine	f909bbba68	rust: bindgen SCDetectHelperKeywordAliasRegister ... Ticket: 7667	1 year ago
Philippe Antoine	a7448a0c16	rust: bindgen SCDetectHelperBufferRegister ... Ticket: 7667	1 year ago
Philippe Antoine	0d82e905bc	rust: bindgen DetectHelperMultiBufferMpmRegister ... Ticket: 7667	1 year ago
Philippe Antoine	dfa4df9f54	rust: bindgen SCDetectHelperMultiBufferProgressMpmRegister ... Ticket: 7667	1 year ago
Jason Ish	1f30746e07	rust/dns: rs_ prefix name cleanup	2 years ago
Philippe Antoine	033e0480cf	detect/single-buf: helper with more explicit direction	2 years ago
Philippe Antoine	dadf9012fc	rust: bindgen detect-engine-buffer.h ... Ticket: 7667 And prefix SCDetectBufferSetActiveList to be exported Allows less use of suricata crate in plugin as we get the functions prototypes from suricata_sys and they are more correct.	2 years ago
Philippe Antoine	808f8a877a	detect/multi-buf: helper with more explicit direction	2 years ago
Philippe Antoine	8ecc3efdc8	detect/multi-buf: harmonize wrapper ... Introduce DetectGetMultiData which does the generic wrapping, including the transforms. And let each keyword do just the getter.	2 years ago
Philippe Antoine	aa7f926ff4	detect: rust helper to register sticky buffer	2 years ago
Philippe Antoine	96afdce283	detect: rename SCSigTableElmt to SCSigTableAppLiteElmt	2 years ago
Philippe Antoine	8757ad5fd3	detect/dns: support string for dns.rrtype ... Ticket: 6723	2 years ago
Philippe Antoine	44a6f7f8ca	detect/dns: support string for dns.rcode ... Ticket: 6723	2 years ago
Philippe Antoine	9814b698c8	detect/dns: move keywords to rust ... Ticket: 7529 Ticket: 3725 Adds url for dns.opcode on the way	2 years ago
Victor Julien	add7d3fcf5	app-layer: API for mapping progress name vs id	2 years ago
Jason Ish	77b94b8713	rust: fixes for breaking change on deranged crate ... Deranged v0.4.1 (a dependency of the time crate) has implemented PartialOrd for some integer types that conflict with the implementation in the standard library creating an ambiguity as such implementation are global. For more info see https://github.com/jhpratt/deranged/issues/18. To fix, use "::from" directly, instead of using .into() which is where we run into amgibuity.	2 years ago
Jason Ish	7568b8020d	dns: stop renaming DNSTransaction to RSDNSTransaction ... Not needed anymore as there is no DNSTransaction in the C src to conflict.	2 years ago
Jason Ish	1206c1c5af	lua: convert dns function into suricata.dns lib ... Notable changes from the previous API: - rcode will return the rcode as an integer - rcode_string will return the string representation Also fixes an issue where an rcode of 0 was returned as nil. Ticket: #7602	2 years ago
Jason Ish	870bf73380	dns: refactor function to get rrname to be safe ... Make the function safe by returning a reference to the DNSName object, the unsafe C wrapper can do the conversion to pointers.	2 years ago