e38888810d
detect/dcerpc: avoids FP on dcerpc.iface keyword
...
When we got a bind without the first fragment flag, and did not
set any_frag in the signature, the signature always matched,
whatever the uuid value
Ticket: 8457
2 months ago
42fbc55aac
detect-engine-analyzer: set EngineAnalysisCtx to NULL after free'ing
...
when engine-analysis is turned off in suricata.yaml
and we run suricata with --engine-analysis
suricata will try to use data from de_ctx->ea wich is
free'd in SetupEngineAnalysis() because fp_analysis and
rule_analysis is turned off and will receive SIGSEGV
with something like:
0x00007ffff7b4ac7b in _IO_new_fclose (fp=0xad96ab1cf5b38042) at ./libio/iofclose.c:48
Ticket: 8505
2 months ago
8968b1c5a1
psl: update to 2.1.206
...
Update the public suffix list to latest release.
2 months ago
5ed394b26b
rust/ffi: move AppLayerEvent to ffi
...
Ticket: 7666
2 months ago
5bbe99188b
ci: update rust version to 1.95
2 months ago
59b6de8239
rust: fix last collapsible_match warnings
...
The ones where we need to remove a debug log
2 months ago
1cdff9de8e
rust: fix collapsible_match warnings
...
warning: this `if` can be collapsed into the outer `match`
help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.95.0/index.html#collapsible_match
2 months ago
899e9f045e
ntp: expose logged fields to lua
...
This includes:
- version
- mode
- stratum
- reference_id
Ticket: #8533
2 months ago
81692dd2c1
rust/lua: add method for pushing bytes
...
Much like pushstring, but accepts an &[u8] as an argument instead of an &str.
In support of ticket #8533 .
2 months ago
eec4a44275
rules: SID allocation range is now documented in README.md
...
directly in the repo, and not in an external wiki
2 months ago
891b17277e
ci: check dist rules
...
So that we catch if we add a typo like
app-layer-event:snmp.version_mismatchZZZ;
2 months ago
d84b6789c9
ci: make doc rules validation strict
...
not finding anymore problems now
2 months ago
42123cc8d9
bittorrent: add bittorrent-events.rules file
...
Add a file containing rules to match bittorrent protocol events.
Ticket: 8421
2 months ago
cff3d6417a
snmp: add snmp-events.rules file
...
Add a file containing rules to match SNMP protocol events.
Ticket: 8421
2 months ago
72e3d7ad08
util/path: fix compile warning
...
util-path.c:251:11: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers
[-Werror,-Wincompatible-pointer-types-discards-qualifiers]
251 | char *final = strrchr(path, DIRECTORY_SEPARATOR);
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 error generated.
3 months ago
0a4685f2ab
detect/pcre: fix compile warnings
...
detect-pcre.c:419:11: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers]
419 | char *fcap = strstr(regexstr, "flow:");
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~
detect-pcre.c:420:11: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers]
420 | char *pcap = strstr(regexstr, "pkt:");
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~
detect-pcre.c:421:11: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers]
421 | char *acap = strstr(regexstr, "alert:");
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~
3 errors generated.
3 months ago
3564f2f928
detect/app-layer-protocol: fix compile warning
...
detect-app-layer-protocol.c:160:11: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers
[-Werror,-Wincompatible-pointer-types-discards-qualifiers]
160 | char *sep = strchr(arg, ',');
| ^ ~~~~~~~~~~~~~~~~
1 error generated.
3 months ago
a45a70babd
decode: fix compile warning
...
decode.c:767:19: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers
[-Werror,-Wincompatible-pointer-types-discards-qualifiers]
767 | char *dot = strchr(DEvents[i].event_name, '.');
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 error generated.
3 months ago
90ce1c54c4
datasets: fix compile warning
...
datasets.c:159:11: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers
[-Werror,-Wincompatible-pointer-types-discards-qualifiers]
159 | char *got_colon = strchr(line, ':');
| ^ ~~~~~~~~~~~~~~~~~
1 error generated.
3 months ago
5aee5ff6ed
smtp: fix compile warning
...
app-layer-smtp.c:566:14: error: initializing 'uint8_t *' (aka 'unsigned char *') with an expression of type 'const void *' discards qualifiers
[-Werror,-Wincompatible-pointer-types-discards-qualifiers]
566 | uint8_t *lf_idx = memchr(input->buf + input->consumed, 0x0a, input->len);
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 error generated.
3 months ago
c21275cab3
ftp: fix compile warnings
...
app-layer-ftp.c:278:14: error: initializing 'uint8_t *' (aka 'unsigned char *') with an expression of type 'const void *' discards qualifiers
[-Werror,-Wincompatible-pointer-types-discards-qualifiers]
278 | uint8_t *lf_idx = memchr(input->buf + input->consumed, 0x0a, input->len);
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
app-layer-ftp.c:1392:11: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers
[-Werror,-Wincompatible-pointer-types-discards-qualifiers]
1392 | char *c = strchr(buffer, '\n');
| ^ ~~~~~~~~~~~~~~~~~~~~
2 errors generated.
3 months ago
cd1c5967a5
util/logopenfile: fix compile warnings
...
util-logopenfile.c:837:11: error: initializing 'char *' with an expression of type 'const char *' discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers]
837 | char *dot = strrchr(base, '.');
| ^ ~~~~~~~~~~~~~~~~~~
util-logopenfile.c:848:13: error: assigning to 'char *' from 'const char *' discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers]
848 | dot = strrchr(original_name, '.');
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 errors generated.
3 months ago
98979dbfe9
github-actions: bump actions/github-script from 8.0.0 to 9.0.0
...
Bumps [actions/github-script](https://github.com/actions/github-script ) from 8.0.0 to 9.0.0.
- [Release notes](https://github.com/actions/github-script/releases )
- [Commits](ed597411d8...3a2844b7e9
3 months ago
00b5c2f579
github-actions: bump actions/upload-artifact from 7.0.0 to 7.0.1
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/v7...v7.0.1 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
3 months ago
5dcdcf0de2
github-actions: bump github/codeql-action from 4.35.1 to 4.35.3
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.35.1 to 4.35.3.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Commits](https://github.com/github/codeql-action/compare/v4.35.1...v4.35.3 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.35.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
3 months ago
cce673349a
ci/scripts: check for dots and dashes in json schema keys
...
Ticket: 6502
3 months ago
54c02e1301
stats: replace dashes by underscores in app-layer protocols
...
Ticket: 6502
Forbid dashes in json keys for better use by processing tools
3 months ago
d030ea7f29
output: rename reject-target to reject_target
...
Ticket: 6502
Forbid dashes in json keys for better use by processing tools
3 months ago
18f742fdbd
schema: map NTP fields to keywords
3 months ago
cdb02a2779
rust/dns: rustfmt
3 months ago
7d66eb5f04
rust: remove unused function
...
rust_string_to_c was used when a buffer should be used as it could
contain nul-byte
3 months ago
9b12fd9f09
rust/ffi: move helper trait state_get_tx_iterator to ffi
...
Ticket: 7666
3 months ago
07f37676b6
rust/ffi: move Flags for AppLayerParserState to ffi crate
...
Ticket: 7666
3 months ago
fb20c69d8d
rust/ffi: move APP_LAYER_PARSER_OPT_X const to ffi crate
...
Ticket: 7666
3 months ago
f1c66ff6f0
rust: remove obsolete const exclusions in cbindgen
...
As these structs are now bindgened from C to suricata_sys crate
3 months ago
d81a10126e
detect/doc: remove unexisting links
...
Ticket: 8257
And add TODO comments if rules doc should be written
3 months ago
8e39539161
detect/doc: fix broken anchor links
...
Ticket: 8257
3 months ago
bd6a436893
detect/doc: fix broken files links
...
Ticket: 8257
3 months ago
adc0f18463
doc/ci: check keyword links
...
Ticket: 8257
3 months ago
b0e63a2c95
detect/dcerpc: move stub_data keyword to rust
...
Ticket: 8391
3 months ago
3d56472d16
detect: bindgen more functions
...
To prepare to move dcerpc.stub_data keyword to full rust
3 months ago
ef884b009a
detect/dcerpc: move dcepayload unit tests to SV
...
Ticket: 8391
3 months ago
cfb1626212
detect/dcerpc: move dce-stub-data unit tests to SV
...
Ticket: 8391
3 months ago
1721ba1ba5
doc/subslice: Document the subslice transform
...
Add documentation for the subslice transform.
Issue: 7672
3 months ago
746f471382
transform/subslice: Add subslice transform
...
Issue: 7672
The subslice transform creates a slice of the input buffer.
Specify the subslice desired -- nbytes and truncate are optional:
subslice: offset <,nbytes> <,truncate>
offset: Specifies the starting offset for the new subslice. When
negative, expresses how far from the end of the input buffer to begin.
nbytes: Specifies the size of the subslice. When negative, specifies
that the subslice will end that many bytes from the end of the input
buffer. Nbytes must be non-zero.
When nbytes is not specified, the size of the subslice will be the size
of the input buffer - offset.
truncate: Specify behavior when offset + nbytes exceeds buffer length.
When present, trims nbytes such that offset + nbytes equals buffer
length. When not present, an empty buffer is produced.
Examples:
subslice: 1; - The subslice will be a copy of the input
buffer but omits the input buffer's first byte
"This is Suricata" -> "his is Suricata"
subslice: 0, 13; - The slice is created from the first 13 bytes
of the input buffer
"This is Suricata" -> "This is Suric"
subslice: 10, -5; - The subslice is created starting at offset 10
and continues to 5 bytes before the end of the input buffer
"This is Suricata" -> "r"
subslice: -3; - The subslice will be the last 3 bytes of the
input buffer.
"This is Suricata" -> "ata"
3 months ago
7e326f291a
detect: (m)dns keywords even with "alert udp"
...
Ticket: 8501
(m)dns.*.rrname keywords required the rules to start with
alert (m)dns
and refused to load if the rule started with generic alert ip or
alert udp, with error message
Error: detect-parse: invalid alproto 0
3 months ago
64f003190d
doc: move more rules to dedicated css container
...
Ticket: 8372
Also remove dead code from script checking the rules
3 months ago
e0d10c0513
scripts: remove dead code in check-doc-rules
3 months ago
4fc6ca5d6c
detect/dcerpc: move iface keyword to rust
...
Ticket: 8391
Use same buffer dce_generic as for dcerpc.opnum
(name dce_generic is enforced by a SV test currently)
3 months ago
d1481af94e
ssl: convert memcpy to strlcpy to avoid flto issue
...
When using ASAN, flto=auto and compiling on a platform that supports
AVX-512, this memcpy is optimized as its exactly 64 bytes. However, when
using ASAN, there is a fake stack that may not be 64 bytes aligned, and
this AVX write lands on an unaligned byte, causing a crash.
Use strlcpy avoids this optimization as it needs to find the NUL byte.
3 months ago
Philippe Antoine
Sergey Pinaev
Jason Ish
Victor Julien
dependabot[bot]
Jeff Lucovsky