Commit Graph

75 Commits (5bb9a0c3af7c4b2635ddffbe62fc1bca9e007e69)

Author SHA1 Message Date
Jason Ish d89b35db56 conf: add SCConfNodeChildValueIsFalse to check for false value
New function to check is a value is actually set to a false value.
11 months ago
Jeff Lucovsky 9c81f817e8 rust: bindgen update
Issue: 7389

Update bindgen with `make update-bindgen`
11 months ago
Philippe Antoine b4d8aea0ae rust: bindgen SCAppLayerRegisterProtocolDetection
Ticket: 7662

Changing the struct passed to it to have the minimal number
of useful fields.
11 months ago
Philippe Antoine 1329786f84 detect: new command line option : list-rule-protos
To list the protocols we can use a in a rule header

Ticket: 635
11 months ago
Philippe Antoine 15b1bf4865 rust: bindgen SCHTPFileCloseHandleRange
Ticket: 7762
11 months ago
Philippe Antoine cddbd0b906 rust: bindgen more file functions
Ticket: 7762
11 months ago
Philippe Antoine 327b8b04a9 rust: bindgen with default derive
Ticket: 7762
11 months ago
Philippe Antoine cba13ed9b1 rust: bindgen functions needed for datasets
Ticket: 7762
12 months ago
Philippe Antoine 12892ba010 rust: bindgen functions neede for features
Ticket: 7762
12 months ago
Li Heng c141c55bc6 snmp: can be set to detection-only
Realloc alp_ctx.ctxs when a dynamic alproto is registered and
g_alproto_max increases. So dynamic alproto can be treated as
real/normal ones. And app-layer switch can be set to any value
of no/deteciton-only/yes.

Ticket: 8000
12 months ago
Philippe Antoine 439f96dea7 rust: bindgen frames functions
Ticket: 7667
12 months ago
Philippe Antoine 92c7be1cb6 rust: bindgen SCSRepCatGetByShortname
Ticket: 7667
12 months ago
Philippe Antoine 7447651fa0 output/jsonbuilder: helper function SCJbSetPrintAsciiString
To replace C PrintStringsToBuffer and avoid a stack alloc
+ copy

Ticket: 8004
1 year ago
Philippe Antoine 2e9027fd5a plugins: update SC_API_VERSION to 9
So that plugins built for 8 will fail to load with 9 as there
were already breaking changes in the structures and functions
prototypes
1 year ago
Philippe Antoine dc7874b2ac rust: bindgen more http range functions used in http2
Ticket: 7667
1 year ago
Philippe Antoine 842352c190 rust: bindgen SCHttpRangeFreeBlock
Ticket: 7667
1 year ago
Philippe Antoine 93785ae357 rust: bindgen SCHTTP2MimicHttp1Request
Ticket: 7667
1 year ago
Philippe Antoine 958344787f rust: bindgen FileAppendData
Ticket: 7667
1 year ago
Philippe Antoine 811d28cc6b rust: bindgen util-spm-bs.h
for SCBasicSearchNocaseIndex

Ticket: 7667
1 year ago
Philippe Antoine 828a6bdbf8 rust: bindgen SCLogMessage
Ticket: 7667
1 year ago
Philippe Antoine cc845dccdb rust: bindgen GenericVarFree
Ticket: 7667
1 year ago
Philippe Antoine b00788af8b rust: bindgen SCAppLayerParserTriggerRawStreamInspection
Ticket: 7667
1 year ago
Philippe Antoine c52121586a rust: move AppLayerEvents funcs out of RustContext
Ticket: 7667

just use it directly, with bindgen, and cfg not test
1 year ago
Philippe Antoine bf6b8510fe rust: move DetectEngineStateFree out of RustContext
Ticket: 7667

just use it directly, with bindgen, and cfg not test
1 year ago
Philippe Antoine 573dd2367e rust: bindgen SCFileFlowFlagsToFlags
Ticket: 7667
1 year ago
Philippe Antoine b59086210f rust: bindgen flow ffi API
Ticket: 7667
1 year ago
Philippe Antoine bbf1424371 rust: bindgen MpmAddPatternCI
Ticket: 7667
1 year ago
Philippe Antoine c391451f19 rust: begin to bindgen app-layer-register.h
Ticket: 7667
1 year ago
Philippe Antoine 68017d3fe1 detect: grow SigTableElmt flags to u32
to be later able to store information about keywords being about
integers
1 year ago
Victor Julien 96ae693b44 version: start work on 9.0.0 1 year ago
Shivani Bhardwaj 0d65d35c92 version: start development towards 8.0.2 1 year ago
Jason Ish 2444feed0d release: 8.0.1; update changelog 1 year ago
Shivani Bhardwaj e4b3b75b23 version: start development towards 8.0.1 1 year ago
Shivani Bhardwaj 9956286fb8 release: 8.0.0; update changelog 1 year ago
Shivani Bhardwaj 6a6104304d version: start development towards 8.0.0 1 year ago
Shivani Bhardwaj cdfebcdc9c release: 8.0.0-rc1; update changelog 1 year ago
Philippe Antoine 6dbc421825 rust: bindgen AppLayerParserConfParserEnabled
Ticket: 7667
1 year ago
Philippe Antoine 49b2a2be5d rust: bindgen SCAppLayerParserRegisterLogger
Ticket: 7667
1 year ago
Philippe Antoine 7bfef2e1e8 rust: bindgen AppLayerParserRegisterParserAcceptableDataDirection
Ticket: 7667
1 year ago
Philippe Antoine 1ff4dbfc24 rust: bindgen AppLayerParserSetStreamDepth
Ticket: 7667
1 year ago
Philippe Antoine b29d46d81f rust: bindgen SCAppLayerParserStateIssetFlag
Ticket: 7667
1 year ago
Philippe Antoine 6d56beffef rust: bindgen AppLayerParserStateSetFlag
Ticket: 7667
1 year ago
Philippe Antoine 7bb0c94ae9 rust: bindgen app-layer-detect-proto.h
Ticket: 7667
1 year ago
Jason Ish 4a655053e8 mdns: add mdns parser, logger and detection
The mDNS support is based heavily on the DNS support, reusing the
existing DNS parser where possible. This meant adding variations on
DNS, as mDNS is a little different. Mainly being that *all* mDNS
traffic is to_server, yet there is still the concept of request and
responses.

Keywords added are:
- mdns.queries.rrname
- mdns.answers.rrname
- mdns.additionals.rrname
- mdns.authorities.rrname
- mdns.response.rrname

They are mostly in-line with the DNS keywords, except
mdns.answers.rdata which is a better than that mdns.response.rrname,
as its actually looking at the rdata, and not rrnames.

mDNS has its own logger that differs from the DNS logger:

- No grouped logging

- In answers/additionals/authorities, the rdata is logged in a field
  that is named after the rdata type. For example, "txt" data is no
  longer logged in the "rdata" field, but instead a "txt" field. We
  currently already did this in DNS for fields that were not a single
  buffer, like SOA, SRV, etc. So this makes things more consistent. And
  gives query like semantics that the "grouped" object was trying to
  provide.

- Types are logged in lower case ("txt" instead of "TXT")

- Flags are logged as an array: "flags": ["aa", "z"]

Ticket: #3952
1 year ago
Philippe Antoine 6bc86230a5 rust: bindgen part of util-debug.h
Ticket: 7667

Especially SCLogLevel whose enum redef is removed in rust
1 year ago
Philippe Antoine a2b5225612 rust: bindgen SCSigMatchAppendSMToList
Ticket: 7667
1 year ago
Philippe Antoine 78034b218d rust: bindgen SCDetectSignatureSetAppProto
Ticket: 7667
1 year ago
Philippe Antoine dc20129195 rust: bindgen SCDetectHelperBufferMpmRegister
Ticket: 7667
1 year ago
Jeff Lucovsky 07205ab057 detect/xform: Support transform identity data
Transforms that support optional strings, like from_base64 and
pcrexform, should also support identity-strings to treat transforms with
like transform options as the same.

This commit adds transform identity data handling:
- When computing a hash, include identity data from the transform
- When comparing, include the identity data from the transforms
- Omitting the "options" ptr from the transform hash/compare
- Modify xor, pcrexform and from_base64 to supply identification data for
  disambiguation in the compare/hash logic.
1 year ago
Philippe Antoine 4af3bd9c91 rust: bindgen SCDetectHelperKeywordSetCleanCString
Ticket: 7667
1 year ago