suricata

Commit Graph

Author	SHA1	Message	Date
Jason Ish	5e0abf1572	rust/ffi: use ThreadVars wrapper in flow callbacks Update the flow init, update and finish callback registrations to pass the safe ThreadVars wrapper instead of a raw pointer. Ticket: #8598	3 months ago
Jason Ish	1cac242948	rust/ffi: use ThreadVars wrapper in eve callback Update the EVE callback registration to pass the safe ThreadVars wrapper instead of a raw pointer. Ticket: #8598	3 months ago
Jason Ish	45762aa644	rust/ffi: use ThreadVars wrapper in thread init callback Update the thread init callback registration to pass the safe ThreadVars wrapper instead of a raw pointer. Ticket: #8598	3 months ago
Jason Ish	5fe88212c3	rust/ffi: add wrapper around ThreadVars A Rust wrapper around ThreadVars to enforce Rust lifetimes to ThreadVars when used in a callback. Ticket: #8598	3 months ago
Philippe Antoine	73193c7e6a	rust: format pgsql files Ticket: 3836	4 months ago
Philippe Antoine	3bfe6cf4b9	rust: format nfs files Ticket: 3836	4 months ago
Juliana Fajardini	372cb8c692	rust/sys: update bindgen SIGMATCH_ constants Part of Ticket #8551	4 months ago
Jason Ish	144f824f17	rust/ffi: add thread init callback wrapper Ticket: #8605	4 months ago
Jason Ish	c689af0bbb	rust/ffi: bindgen thread lifecycle callbacks Ticket: #8605	4 months ago
Philippe Antoine	07112bc7ae	rust: format mqtt files Ticket: 3836	4 months ago
Philippe Antoine	844f2effa3	rust: format modbus files Ticket: 3836	4 months ago
Philippe Antoine	db019ebefe	rust: format ike files Ticket: 3836	4 months ago
Philippe Antoine	bcc1e6ae32	rust: format http2 files Ticket: 3836	4 months ago
Philippe Antoine	1070e733d8	rust: format websocket files Ticket: 3836	4 months ago
Philippe Antoine	89e5332d88	rust: format utils files Ticket: 3836	4 months ago
Philippe Antoine	edf29b0000	rust: format ssh files Ticket: 3836	4 months ago
Philippe Antoine	fe27a2159c	rust: format rfb files Ticket: 3836	4 months ago
Philippe Antoine	5cca346f16	rust: format quic files Ticket: 3836	4 months ago
Philippe Antoine	415360d9e8	rust: format ntp files Ticket: 3836	4 months ago
Philippe Antoine	fa864f9c2f	rust: format mime files Ticket: 3836	4 months ago
Philippe Antoine	2cfcaec1b0	rust: format ldap files Ticket: 3836	4 months ago
Philippe Antoine	64e7c671cc	rust: format ftp files Ticket: 3836	4 months ago
Philippe Antoine	f217e249cb	rust: format ffi files Ticket: 3836	4 months ago
Philippe Antoine	f7c14809f4	rust: format enip files Ticket: 3836	4 months ago
Philippe Antoine	e526eb8e2b	rust: format bittorrent_dht files Ticket: 3836	4 months ago
Philippe Antoine	f5ac0e201c	rust: format asn1 files Ticket: 3836	4 months ago
Philippe Antoine	1ced97bdbb	rust: format applayertemplate files Ticket: 3836	4 months ago
Philippe Antoine	efe3b16aac	rust: feature debug in main crate enables feature debug in ffi	4 months ago
Philippe Antoine	b90adcc2bb	rust/ffi: move AppLayerTxData to ffi Ticket: 7666	4 months ago
Philippe Antoine	bce88dd83f	rust: build depends on ffi/Cargo.toml.in	4 months ago
Philippe Antoine	0773fba5fd	rust/ffi: move txdata flags to ffi Ticket: 7666	4 months ago
Philippe Antoine	2525ea2e37	rust/ffi: move direction to ffi Ticket: 7666	4 months ago
Philippe Antoine	5440e41314	rust/ffi: move debug validations macros to ffi Ticket: 7666	4 months ago
Philippe Antoine	bf64b52b95	http2: better compression against decompression bombs Ticket: 8513 Suricata decides at 2 levels if a http2 flow is doing a compression bomb. There is a direct computation when one chunk of TCP data is being parsed. In this case, do not take the ratio into account, just use the size of the decompressed data, so that if we get a big chunk of TCP data like 1 MiB, and a not so high ratio of 200, we do not trigger the debug assertion in util-file.c about 64MiB The other case stays unchanged : when accumulating over the lifetile of a flow with multiple txs, take into account the compression ratio, so that a flow of many txs, having a super high (brotli) compression ratio, ends up classified as a compression bomb. (For example, having 100 txs each turning a 100 byte input into a 700 KiB one)	4 months ago
Philippe Antoine	6d437956e2	detect/transforms: dotprefix can be chained Ticket: 8537 Otherwise, it may cause a use-after-free, in case of reallocated buffer and we used the buffer inspect which was freed.	4 months ago
Philippe Antoine	2b20a436e7	detect/transforms: decompress checks earlier if it is in-place Ticket: 8536 Otherwise, it may cause a use-after-free. So, need to allocate the temporary vector, before calling SCInspectionBufferCheckAndExpand	4 months ago
Philippe Antoine	4c42998feb	detect/engine: helper to know if a transform happens in-place	4 months ago
Philippe Antoine	7bf48b02be	http2: protection against decompression bombs Ticket: 8513 During decompression, fail early if we have a big decompression ratio, and enough data. Track this data also during a tx lifetime, and even a flow/state lifetime, so that we set event and fail also if the compression bomb is split over multiple packets	4 months ago
Philippe Antoine	29e4b08647	http2: code refactoring to split big function	4 months ago
Philippe Antoine	e98d419d96	ldap: bound the number of responses Ticket: 8405	4 months ago
Victor Julien	6ebd0c3cc2	http2: check for HTTP1 protocol during upgrade path Ticket: 8492	4 months ago
Philippe Antoine	10bde66586	nfs: bound file_additional_procs to 1 Ticket: 8418 As we only need to know we saw at least one NFSPROC3_COMMIT	4 months ago
Philippe Antoine	aea7ee21b8	nfs: bound namemap by using lru Ticket: 8418	4 months ago
Philippe Antoine	a50f494ef6	nfs: bound requestmap and use lru Ticket: 8418	4 months ago
Juliana Fajardini	d442c3544c	detect: opt-in keywords for firewall mode - tls.cert_chain_len - datarep - dataset - dns.opcode Part of Ticket #8387	4 months ago
Philippe Antoine	f0e246de34	detect/mqtt: reason_code keyword is now a multi-integer Ticket: 7929 Builds a vector of the reason code in a tx to do so, except if we use the default "any", where we do not append to the vector, but just run detection while iterating	4 months ago
Philippe Antoine	614c48d3c3	ikev2: remove unused field Ticket: 8415	4 months ago
Jeff Lucovsky	9ea2e29581	ftp: raise too_many_transactions event on overflow Other parsers (SMB, POP3, ENIP) already raise a too_many_transactions event when a flow exceeds its per-flow transaction limit. FTP had the limit wired up through app-layer.protocols.ftp.max-tx but just dropped the excess transaction on the floor with a "FTP does not set events yet..." TODO, so no event was raised when the limit was reached. Add the FtpEventTooManyTransactions variant, a stock rule at sid 2232002, and raise the event from FTPTransactionCreate when the live-tx count goes past ftp_config_maxtx. Issue: 8489	4 months ago
Jason Ish	cb69fa4e53	rust/ffi: add flow lifecycle callback wrappers Provide Rust friendly callback registrations for flow init, update and finish events. These callbacks are implemented as Rust closures. Ticket: #8446	4 months ago
Jason Ish	d4dc8be3b2	rust: bindgen flow lifecycle callbacks Ticket: #8446	4 months ago

1 2 3 4 5 ...

2302 Commits (5e0abf1572b6bddd06a5e30233e90f25e0874dc1)