Commit Graph

1696 Commits (5e94be63ced9c6acab4175ed41d1928f61b5edf1)

Author SHA1 Message Date
Jeff Lucovsky 8e373e46a3 decode/datalink: Add datalink value/name logic
Issue: 6954

Add Rust based logic that maintains a hash map of link type values and
their associated output names.
4 months ago
Jason Ish bfd6c29f5a detect: SC prefix for extern pub Rust functions
Ticket: #7498
4 months ago
Jason Ish 27fd2fe74b snmp: rust naming and visibility cleanups
Ticket: #7498
4 months ago
Alice Akaki 7750129c65 mime/email: log date and subject fields 4 months ago
Victor Julien 834378ff88 detect: per tx detect flags to a u8 progress value
Reduce per tx space for tracking detection/prefilter progress. Instead
of a per direction u64 of flags, where each bit reflected a progress
value, use a simple u8 to track the linear progression through the
progress values. Use an offset to allow 0 to mean no value.

Add flags field as well to track "skip detect" and "inspect complete".
4 months ago
Victor Julien 1542bcdc67 app-layer: add helper for AppLayerTxData cleanup 4 months ago
Philippe Antoine c164cfcf6b plugins: check version for all plugins 4 months ago
Philippe Antoine 5742df3783 plugins: bind constant SC_PLUGIN_API_VERSION 4 months ago
Philippe Antoine 52862e50be plugin: constify some fields
including the tx parameter to the logger function
4 months ago
Philippe Antoine 1db49487a1 rust/detect: extend visibility of SIGMATH_NOOPT
so that it can be used by plugins

Avoid export by cbindgen as this constant is also defined in C
4 months ago
Philippe Antoine 2fa3a9fe62 template: rustfmt
and use generic logger callback prototype with later cast

and do some other small modifications so that the plugin
has less diff
4 months ago
Alice Akaki 7ba4ebdc2c detect: add email.cc keyword
email.cc matches on MIME EMAIL Carbon Copy
This keyword maps to the EVE field email.cc[]
It is a sticky buffer
Supports prefiltering

Ticket: #7588
4 months ago
Jason Ish 77b94b8713 rust: fixes for breaking change on deranged crate
Deranged v0.4.1 (a dependency of the time crate) has implemented
PartialOrd for some integer types that conflict with the
implementation in the standard library creating an ambiguity as such
implementation are global. For more info see
https://github.com/jhpratt/deranged/issues/18.

To fix, use "::from" directly, instead of using .into() which is where
we run into amgibuity.
4 months ago
Juliana Fajardini c595bfed87 pgsql/parser: use fn for length parsing...
... there was still one parser missing this conversion.
4 months ago
Jason Ish 7568b8020d dns: stop renaming DNSTransaction to RSDNSTransaction
Not needed anymore as there is no DNSTransaction in the C src to
conflict.
4 months ago
Jason Ish 1206c1c5af lua: convert dns function into suricata.dns lib
Notable changes from the previous API:
- rcode will return the rcode as an integer
- rcode_string will return the string representation

Also fixes an issue where an rcode of 0 was returned as nil.

Ticket: #7602
4 months ago
Alice Akaki 90aab0d62f detect: add email.from
email.from matches on MIME EMAIL FROM
This keyword maps to the EVE field email.from
It is a sticky buffer
Supports prefiltering

Ticket: #7592
4 months ago
Alice Akaki 90cf59ac71 rustfmt: rust/src/mime/smtp.rs 4 months ago
Jason Ish 66e47a1983 rust: pin once_cell to work with Rust 1.67.1
Clap uses once_cell which recently released v1.20 which updated its
MSRV to 1.70. Locally pin once_cell to 1.20.3 to maintain our MSRV.
5 months ago
Bryan Benson 15da9d783e rust: Update sawp dependencies to 0.13.1 due to SPDX license compatibility. 5 months ago
Jason Ish 870bf73380 dns: refactor function to get rrname to be safe
Make the function safe by returning a reference to the DNSName object,
the unsafe C wrapper can do the conversion to pointers.
5 months ago
Nathan Scrivens 07632fdf4e dns: add dns.response sticky buffer
Feature: 7012
Add dns.response sticky buffer to match on dns response fields.
Add rust functions to return dns response packet data.
Unit tests verifying signature matching.
5 months ago
Alice Akaki 137f7fe652 detect: add ldap.responses.message
ldap.responses.message matches on LDAPResult error message
This keyword maps the following eve fields:
ldap.responses[].bind_response.message
ldap.responses[].search_result_done.message
ldap.responses[].modify_response.message
ldap.responses[].add_response.message
ldap.responses[].del_response.message
ldap.responses[].mod_dn_response.message
ldap.responses[].compare_response.message
ldap.responses[].extended_response.message
It is a sticky buffer
Supports prefiltering

Ticket: #7532
5 months ago
Alice Akaki 84605db01d detect: add ldap.responses.result_code
ldap.responses.result_code matches on LDAP result code
This keyword maps the following eve fields:
ldap.responses[].bind_response.result_code
ldap.responses[].search_result_done.result_code
ldap.responses[].modify_response.result_code
ldap.responses[].add_response.result_code
ldap.responses[].del_response.result_code
ldap.responses[].mod_dn_response.result_code
ldap.responses[].compare_response.result_code
ldap.responses[].extended_response.result_code
It is an unsigned 32-bit integer
Doesn't support prefiltering

Ticket: #7532
5 months ago
Alice Akaki d827728661 ldap: create a generic funtion to match integer responses 5 months ago
Alice Akaki bfa3558cf0 ldap: refactor function aux_ldap_parse_protocol_resp_op
Split code to create a generic function that parses LdapIndex
5 months ago
Alice Akaki caffde9428 ldap: rename DetectLdapRespData struct to be more specific 5 months ago
Alice Akaki 599d33c5bf ldap: return empty buffer in ldap_tx_get_responses_dn
Funciton ldap_tx_get_responses_dn returns empty buffer in case
the response doesn't contain the distinguished name field

Fixes: 73ae6e997f ("detect: add ldap.responses.dn")
5 months ago
Alice Akaki 82ca3e667b ldap: fix LDAPDN nits
Change variable name 'req' to 'resp' in function ldap_tx_get_responses_dn and documentation nits

Fixes:
73ae6e997f ("detect: add ldap.responses.dn")
16dcee46fc ("detect: add ldap.request.dn")
5 months ago
Alice Akaki 3b6106e8f4 ldap: apply rustfmt
Fixes: 4554c4778d ("rust: use AppProto from generated bindings instead of duplicating")
5 months ago
Jason Ish 2e52e9501f mqtt: naming and visibility cleanups
- remove rs_prefix, replace with SC if needed
- remove pub and no_mangle where not needed
- remove some unused functions and fields

Related to ticket: #7498
5 months ago
Jason Ish 0fe11cdfe5 enip: remove rs_ prefix
Related to ticket: #7498
5 months ago
Jason Ish c726d67bb0 dcerpc: visibility and naming cleanups
- replace rs_ prefixed names with SC
- remove no_mangle and pub where not needed
- remove some unused functions

Related to ticket: #7498
5 months ago
Jason Ish f0116c3a6b bittorrent: no_mangle, pub and naming cleanups
- Remove rs_prefix
- Remove no_mangle and pub when not needed

Related to ticket: #7498
5 months ago
Jason Ish 05dd607f34 rust: use CBINDGEN variable and not "cbindgen"
This uses the cbindgen found during ./configure, and not the one
found on the path during "make", which while often the same, aren't
always the same.

Ticket: #6384
5 months ago
Jeff Lucovsky 9b088ed018 applayer/ftp: Misc cleanup
Issue: 4082

Small fixups.
5 months ago
Jeff Lucovsky b7d240fb14 applayer/ftp: Move MPM declaration
This commit moves the MPM fn declaration into core.rs making it
available for other Rust modules.

Issue: 4082
5 months ago
Jeff Lucovsky 4d0cf8a8fa app-layer/ftp: Fixup state values
Issue: 4082

Fixup the incorrect state values -- they should be the default enum
values to match the pre-Rust implementation.
5 months ago
Jason Ish 8fa347410e suricatactl: rust version of suricatactl 5 months ago
Jason Ish 8115669602 suricatasc: a Rust implementation of suricatasc
This is a re-implementation of suricatasc program in Rust that
attempts to be a 100% drop-in replacement.
5 months ago
Jason Ish c33bebd630 rust: remove allow of static mutables
As references to static mutables are highly discouraged, remove the
global suppressing of the compiler warning. Each use case can be
suppressed as needed.

Ticket: #7417
5 months ago
Jason Ish 4a2f10d235 smb: wrap read access to static mutables in function
Simply wrapping in a function removes static_mut_refs compiler
warning.

Ticket: #7417
5 months ago
Jason Ish d8c080b268 smtp: suppress static_mut_refs where needed
Allows us to get rid of the global supression.

Ticket: #7417
5 months ago
Jason Ish 9ed5b4c002 smtp: remove SCMimeSmtpConfigExtractUrlsSchemeReset
It doesn't appear to be needed. The vec being cleared is only set once
per run, so never needs to be cleared.

Removes one point where we have to supress the static_mut_refs compiler
warning.

Ticket: #7417
5 months ago
Jeff Lucovsky dd344bd07c ftp: Move config file handling to Rust
Issue: 4082

Move the configuration file handling to Rust.

These changes will no longer terminate Suricata when there's an invalid
value for ftp.memcap. Like earlier Suricata releases, an error message
is logged "Invalid value <value> for ftp.memcap" but Suricata will no
longer terminate execution. It will use a default value of "0" instead.
5 months ago
Jeff Lucovsky f0410c93d0 ftp: convert enumerations to Rust
As part of the effort to convert the FTP/FTPDATA parser to rust, move
the enums from C to rust.

Issue: 4082
5 months ago
Philippe Antoine 8c3bd3e8a0 dcerpc: consume bytes after gap resync
Ticket: 7567

After a gap, we search a new record that may start later than
the beginning of current stream slice.
If so, consume the first bytes before the start of the record,
so that AppLayerResult::incomplete can be consistent and not
trigger assertion !((res.needed + res.consumed < input_len))
5 months ago
Philippe Antoine 3bc2a14fbf rust: fix clippy 1.85 precedence warnings
warning: operator precedence can trip the unwary
   --> src/jsonbuilder.rs:781:36
    |
781 |                 buf[offset] = HEX[(x >> 4 & 0xf) as usize];
    |                                    ^^^^^^^^^^^^ help: consider parenthesizing your expression: `(x >> 4) & 0xf`
    |
    = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#precedence
    = note: `#[warn(clippy::precedence)]` on by default
5 months ago
Philippe Antoine 726de5520f quic: discard late retry packets
Ticket: 7556

See RFC 9000 section 17.2.5.2 :
After the client has received and processed an Initial
or Retry packet from the server,
it MUST discard any subsequent Retry packets that it receives.
5 months ago
Shivani Bhardwaj a551674eae dcerpc: add iface to dcerpc request event
so as to avoid extra steps for correlation among events to find
this information.

Feature 7565
5 months ago