5bbe99188b
ci: update rust version to 1.95
2 months ago
59b6de8239
rust: fix last collapsible_match warnings
...
The ones where we need to remove a debug log
2 months ago
1cdff9de8e
rust: fix collapsible_match warnings
...
warning: this `if` can be collapsed into the outer `match`
help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.95.0/index.html#collapsible_match
2 months ago
899e9f045e
ntp: expose logged fields to lua
...
This includes:
- version
- mode
- stratum
- reference_id
Ticket: #8533
2 months ago
81692dd2c1
rust/lua: add method for pushing bytes
...
Much like pushstring, but accepts an &[u8] as an argument instead of an &str.
In support of ticket #8533 .
2 months ago
eec4a44275
rules: SID allocation range is now documented in README.md
...
directly in the repo, and not in an external wiki
2 months ago
891b17277e
ci: check dist rules
...
So that we catch if we add a typo like
app-layer-event:snmp.version_mismatchZZZ;
2 months ago
d84b6789c9
ci: make doc rules validation strict
...
not finding anymore problems now
2 months ago
42123cc8d9
bittorrent: add bittorrent-events.rules file
...
Add a file containing rules to match bittorrent protocol events.
Ticket: 8421
2 months ago
cff3d6417a
snmp: add snmp-events.rules file
...
Add a file containing rules to match SNMP protocol events.
Ticket: 8421
2 months ago
72e3d7ad08
util/path: fix compile warning
...
util-path.c:251:11: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers
[-Werror,-Wincompatible-pointer-types-discards-qualifiers]
251 | char *final = strrchr(path, DIRECTORY_SEPARATOR);
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 error generated.
2 months ago
0a4685f2ab
detect/pcre: fix compile warnings
...
detect-pcre.c:419:11: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers]
419 | char *fcap = strstr(regexstr, "flow:");
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~
detect-pcre.c:420:11: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers]
420 | char *pcap = strstr(regexstr, "pkt:");
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~
detect-pcre.c:421:11: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers]
421 | char *acap = strstr(regexstr, "alert:");
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~
3 errors generated.
2 months ago
3564f2f928
detect/app-layer-protocol: fix compile warning
...
detect-app-layer-protocol.c:160:11: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers
[-Werror,-Wincompatible-pointer-types-discards-qualifiers]
160 | char *sep = strchr(arg, ',');
| ^ ~~~~~~~~~~~~~~~~
1 error generated.
2 months ago
a45a70babd
decode: fix compile warning
...
decode.c:767:19: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers
[-Werror,-Wincompatible-pointer-types-discards-qualifiers]
767 | char *dot = strchr(DEvents[i].event_name, '.');
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 error generated.
2 months ago
90ce1c54c4
datasets: fix compile warning
...
datasets.c:159:11: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers
[-Werror,-Wincompatible-pointer-types-discards-qualifiers]
159 | char *got_colon = strchr(line, ':');
| ^ ~~~~~~~~~~~~~~~~~
1 error generated.
2 months ago
5aee5ff6ed
smtp: fix compile warning
...
app-layer-smtp.c:566:14: error: initializing 'uint8_t *' (aka 'unsigned char *') with an expression of type 'const void *' discards qualifiers
[-Werror,-Wincompatible-pointer-types-discards-qualifiers]
566 | uint8_t *lf_idx = memchr(input->buf + input->consumed, 0x0a, input->len);
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 error generated.
2 months ago
c21275cab3
ftp: fix compile warnings
...
app-layer-ftp.c:278:14: error: initializing 'uint8_t *' (aka 'unsigned char *') with an expression of type 'const void *' discards qualifiers
[-Werror,-Wincompatible-pointer-types-discards-qualifiers]
278 | uint8_t *lf_idx = memchr(input->buf + input->consumed, 0x0a, input->len);
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
app-layer-ftp.c:1392:11: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers
[-Werror,-Wincompatible-pointer-types-discards-qualifiers]
1392 | char *c = strchr(buffer, '\n');
| ^ ~~~~~~~~~~~~~~~~~~~~
2 errors generated.
2 months ago
cd1c5967a5
util/logopenfile: fix compile warnings
...
util-logopenfile.c:837:11: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers]
837 | char *dot = strrchr(base, '.');
| ^ ~~~~~~~~~~~~~~~~~~
util-logopenfile.c:848:13: error: assigning to 'char *' from 'const char *' discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers]
848 | dot = strrchr(original_name, '.');
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 errors generated.
2 months ago
98979dbfe9
github-actions: bump actions/github-script from 8.0.0 to 9.0.0
...
Bumps [actions/github-script](https://github.com/actions/github-script ) from 8.0.0 to 9.0.0.
- [Release notes](https://github.com/actions/github-script/releases )
- [Commits](ed597411d8...3a2844b7e9
2 months ago
00b5c2f579
github-actions: bump actions/upload-artifact from 7.0.0 to 7.0.1
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/v7...v7.0.1 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2 months ago
5dcdcf0de2
github-actions: bump github/codeql-action from 4.35.1 to 4.35.3
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.35.1 to 4.35.3.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Commits](https://github.com/github/codeql-action/compare/v4.35.1...v4.35.3 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.35.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2 months ago
cce673349a
ci/scripts: check for dots and dashes in json schema keys
...
Ticket: 6502
2 months ago
54c02e1301
stats: replace dashes by underscores in app-layer protocols
...
Ticket: 6502
Forbid dashes in json keys for better use by processing tools
2 months ago
d030ea7f29
output: rename reject-target to reject_target
...
Ticket: 6502
Forbid dashes in json keys for better use by processing tools
2 months ago
18f742fdbd
schema: map NTP fields to keywords
2 months ago
cdb02a2779
rust/dns: rustfmt
2 months ago
7d66eb5f04
rust: remove unused function
...
rust_string_to_c was used when a buffer should be used as it could
contain nul-byte
2 months ago
9b12fd9f09
rust/ffi: move helper trait state_get_tx_iterator to ffi
...
Ticket: 7666
2 months ago
07f37676b6
rust/ffi: move Flags for AppLayerParserState to ffi crate
...
Ticket: 7666
2 months ago
fb20c69d8d
rust/ffi: move APP_LAYER_PARSER_OPT_X const to ffi crate
...
Ticket: 7666
2 months ago
f1c66ff6f0
rust: remove obsolete const exclusions in cbindgen
...
As these structs are now bindgened from C to suricata_sys crate
2 months ago
d81a10126e
detect/doc: remove unexisting links
...
Ticket: 8257
And add TODO comments if rules doc should be written
2 months ago
8e39539161
detect/doc: fix broken anchor links
...
Ticket: 8257
2 months ago
bd6a436893
detect/doc: fix broken files links
...
Ticket: 8257
2 months ago
adc0f18463
doc/ci: check keyword links
...
Ticket: 8257
2 months ago
b0e63a2c95
detect/dcerpc: move stub_data keyword to rust
...
Ticket: 8391
2 months ago
3d56472d16
detect: bindgen more functions
...
To prepare to move dcerpc.stub_data keyword to full rust
2 months ago
ef884b009a
detect/dcerpc: move dcepayload unit tests to SV
...
Ticket: 8391
2 months ago
cfb1626212
detect/dcerpc: move dce-stub-data unit tests to SV
...
Ticket: 8391
2 months ago
1721ba1ba5
doc/subslice: Document the subslice transform
...
Add documentation for the subslice transform.
Issue: 7672
2 months ago
746f471382
transform/subslice: Add subslice transform
...
Issue: 7672
The subslice transform creates a slice of the input buffer.
Specify the subslice desired -- nbytes and truncate are optional:
subslice: offset <,nbytes> <,truncate>
offset: Specifies the starting offset for the new subslice. When
negative, expresses how far from the end of the input buffer to begin.
nbytes: Specifies the size of the subslice. When negative, specifies
that the subslice will end that many bytes from the end of the input
buffer. Nbytes must be non-zero.
When nbytes is not specified, the size of the subslice will be the size
of the input buffer - offset.
truncate: Specify behavior when offset + nbytes exceeds buffer length.
When present, trims nbytes such that offset + nbytes equals buffer
length. When not present, an empty buffer is produced.
Examples:
subslice: 1; - The subslice will be a copy of the input
buffer but omits the input buffer's first byte
"This is Suricata" -> "his is Suricata"
subslice: 0, 13; - The slice is created from the first 13 bytes
of the input buffer
"This is Suricata" -> "This is Suric"
subslice: 10, -5; - The subslice is created starting at offset 10
and continues to 5 bytes before the end of the input buffer
"This is Suricata" -> "r"
subslice: -3; - The subslice will be the last 3 bytes of the
input buffer.
"This is Suricata" -> "ata"
2 months ago
7e326f291a
detect: (m)dns keywords even with "alert udp"
...
Ticket: 8501
(m)dns.*.rrname keywords required the rules to start with
alert (m)dns
and refused to load if the rule started with generic alert ip or
alert udp, with error message
Error: detect-parse: invalid alproto 0
3 months ago
64f003190d
doc: move more rules to dedicated css container
...
Ticket: 8372
Also remove dead code from script checking the rules
3 months ago
e0d10c0513
scripts: remove dead code in check-doc-rules
3 months ago
4fc6ca5d6c
detect/dcerpc: move iface keyword to rust
...
Ticket: 8391
Use same buffer dce_generic as for dcerpc.opnum
(name dce_generic is enforced by a SV test currently)
3 months ago
d1481af94e
ssl: convert memcpy to strlcpy to avoid flto issue
...
When using ASAN, flto=auto and compiling on a platform that supports
AVX-512, this memcpy is optimized as its exactly 64 bytes. However, when
using ASAN, there is a fake stack that may not be 64 bytes aligned, and
this AVX write lands on an unaligned byte, causing a crash.
Use strlcpy avoids this optimization as it needs to find the NUL byte.
3 months ago
9677851637
rust/ffi: move app-layer traits to ffi crate
...
Ticket: 7666
Traits around structures defined in C and bindgened to rust
3 months ago
f803c25f24
rust/ffi: move export_X_data_get macros to ffi crate
...
Ticket: 7666
3 months ago
54b6885166
rust/ffi: move conf_get_bool helper to ffi crate
...
Ticket: 7666
3 months ago
be2d80a8e7
ftp-data: check direction before finished state
...
Ticket: 6813
So, in the case we have a ftp-data flow with data to client as
expected, but after to_client side completes (with timeout for
example), the client sends some data to server,
In this case, we want to check first the direction, and bail out,
then do the assertion check about the finished state.
3 months ago
Philippe Antoine
Jason Ish
Victor Julien
dependabot[bot]
Jeff Lucovsky