suricata

Commit Graph

Author	SHA1	Message	Date
Jason Ish	f0f4d88119	rust/sip+sdp: update to nom 8 Done together as there is a dependence of SDP by SIP. Ticket: #8025	1 year ago
Jason Ish	58564a4b0e	rust/ftp: update to nom 8 Ticket: #8026	1 year ago
Jason Ish	54cc97b78e	rust/dns: convert to nom 8.0 Ticket: #8024	1 year ago
Jason Ish	16c42da57e	rust: add nom8 as a dependency For the update from nom 7 to nom 8.	1 year ago
Jason Ish	0990c9dbf6	rust: pin indexmap Newer indexmap, pulled in by serde_json requires Rust 1.82, so pin pack to 2.11.4 which still works with Rust 1.75.	1 year ago
Philippe Antoine	dc7874b2ac	rust: bindgen more http range functions used in http2 Ticket: 7667	1 year ago
Philippe Antoine	842352c190	rust: bindgen SCHttpRangeFreeBlock Ticket: 7667	1 year ago
Philippe Antoine	93785ae357	rust: bindgen SCHTTP2MimicHttp1Request Ticket: 7667	1 year ago
Philippe Antoine	a1613fecb4	detect: tcp.flags rejects non-sensical values ignored flags are only meaningful for equal mode	1 year ago
Philippe Antoine	31e9cb55be	detect: tcp.flags unit tests improvements Tests better the ignored flags functionality. This functionality is only used at detection for default mode, it is not used for any, plus or not mode. So, have unit tests about igored flags with default mode with both matching and non matching cases	1 year ago
Philippe Antoine	d8cb00e795	detect/tcp: make tcp.flags a generic integer with bitflags Ticket: 6724 Allows to use numerical values for example Also fixes some unit tests that were returning 1 after goto error FlagsTestParse05 especially took this path as de->ignored_flags != (TH_SYN\|TH_RST) was false we had de->ignored_flags == 0xff ^ (TH_SYN\|TH_RST) And then, we had a match, instead of what the not-run code was supposing.	1 year ago
Philippe Antoine	1f9236a6d8	detect/ipv4: make fragbits a generic uint16 bitflags keyword Ticket: 6724 Allows to use numerical values	1 year ago
Philippe Antoine	633180c93f	detect/integers: generalize support for bitflags modifier Ticket: 6724 Allows sugar syntax for bitflags keywords. While the expressivity does not increase, because we could already use numerial values with all generic integer modes, this modifier prefix is used with the strings, and follows the syntax that is already used for fragbits and tcp.flags keyword.	1 year ago
Philippe Antoine	f25194480c	libhtp: fix newer clippy lints with newer MSRV	1 year ago
Jason Ish	bc33bd49eb	quic/crypto: remove use of GenericArray Its not needed, and gets rid of the deprecation warnings.	1 year ago
Jason Ish	bdfdf7ff33	rust: update deps with cargo-update Suppress deprecation warnings in quick/crypto.rs about GenericArray.	1 year ago
Jason Ish	6fdf0d736b	rust: update aes-gcm to 0.10.3	1 year ago
Jason Ish	b9517de86e	rust: update aes to 0.8.4	1 year ago
Philippe Antoine	4b69a31dc3	detect/integers: count argument for multi-integers Ticket: 7211 Allows to count the number of elements, without matching on individual elements	1 year ago
Philippe Antoine	3babd68af4	pop3: count retr_data into consumed for later AppLayerResult::incomplete Fixes: `acef961645` ("pop3: improve parsing") https://issues.oss-fuzz.com/u/1/issues/451112373 Ticket: 7994	1 year ago
Philippe Antoine	9a4a29e218	http2: fix parsing of goaway frames There was a last stream id before the error code As per section 6.8 of RFC 7540 Ticket: 7991	1 year ago
Philippe Antoine	7f0087f19a	rust/detect: fix correct pointer type in SCDetectU32ArrayFree	1 year ago
Philippe Antoine	969739d067	detect: http2.errorcode is now a generic integer Ticket: 7889	1 year ago
Philippe Antoine	401b2fcae6	detect: http2.frametype is now a generic integer Ticket: 7889	1 year ago
Philippe Antoine	454f73b445	rust: EnumString derive accepts a enum_string_style parameter So that http2.frametype and http2.errorcode can use EnumString without changing the format, as they used UPPERCASE instead of the default EnumString snake_case	1 year ago
Victor Julien	acef961645	pop3: improve parsing Improve multiline commands and SASL auth. Work around missing support in crate for empty server challenge and SASL base64 data. Ticket: #7709.	1 year ago
Jason Ish	5e2dc9ace3	ike: don't log empty server objects	1 year ago
Jason Ish	2d86412f46	ike: log attributes as objects IKE attributes are an array of TLV style objects, this means there can be duplicate types seen on the wire. However, Suricata logs these as a mapping with the type as the key. This can result in the JSON containing duplicate keys. To address this, log the attributes as an array of objects, allow duplicates to exist, for example: "client": { "proposals": [ { "sa_life_duration": "Unknown", "sa_life_duration_raw": 86400, } } } is now logged as: "client": { "proposals": [ {"key": "sa_life_duration", "value": "Unknown", "raw": 86400} ] } Also adds `"version": 2` to each IKE record to note the change of format from previous versions. Ticket: #7902	1 year ago
Jason Ish	b543e28402	ike/detect: info log message should be debug	1 year ago
Philippe Antoine	a393147415	rust: restrict visibility of reexported suricata_sys structs	1 year ago
Philippe Antoine	fa322e3dc2	rust: remove unneeded cbindgen exclusions	1 year ago
Philippe Antoine	958344787f	rust: bindgen FileAppendData Ticket: 7667	1 year ago
Philippe Antoine	811d28cc6b	rust: bindgen util-spm-bs.h for SCBasicSearchNocaseIndex Ticket: 7667	1 year ago
Jeff Lucovsky	0e547b9519	rust/conf: Accept xiB unit suffixes Update the memval to recognize - kb and kib - mb and mib - gb and gib as equivalent.	1 year ago
Philippe Antoine	56e08c9134	mime: retain some stateful data for quoted-printable In case a sequence like =3D is split over 2 calls to SCSmtpMimeParseLine Ticket: 7950	1 year ago
Victor Julien	870b40220c	rust: cargo update	1 year ago
Philippe Antoine	096ba42ce9	detect/integers: add some meaningful error messages To help rule writers	1 year ago
Philippe Antoine	4f7fc25a1a	detect/dnp3: make dnp3.ind a generic uint16 bitflags keyword Ticket: 6724 Allows operations such as negation	1 year ago
Philippe Antoine	c1917dec21	detect/integers: make mqtt use generic detect_parse_uint_bitflags Ticket: 6724	1 year ago
Philippe Antoine	867f5bfa21	detect/integers: generic detect_parse_uint_bitflags Ticket: 6724 This will ease other keywords with bitflags, by having a generic function + an association between flag string and bit value.	1 year ago
Philippe Antoine	3641b4eda1	detect/nfs: move nfs_procedure to rust Make it able to use strings on the way Ticket: 6723	1 year ago
Philippe Antoine	9869fb776b	detect/snmp: pdu_type keyword now accepts strings Ticket: 6723	1 year ago
Philippe Antoine	0553dfa814	detect/krb5: move krb5_msg_type to rust Makes it a generic u32 on the way Unit tests are covered by SV tests Ticket: 6723	1 year ago
Philippe Antoine	24503b0ead	rust: move file functions out of SuricataContext Ticket: 7667	1 year ago
Philippe Antoine	1f084f8cb7	rust: move HttpRangeFreeBlock out of SuricataContext Ticket: 7667	1 year ago
Philippe Antoine	828a6bdbf8	rust: bindgen SCLogMessage Ticket: 7667	1 year ago
Philippe Antoine	cc845dccdb	rust: bindgen GenericVarFree Ticket: 7667	1 year ago
Philippe Antoine	b00788af8b	rust: bindgen SCAppLayerParserTriggerRawStreamInspection Ticket: 7667	1 year ago
Philippe Antoine	c52121586a	rust: move AppLayerEvents funcs out of RustContext Ticket: 7667 just use it directly, with bindgen, and cfg not test	1 year ago
Philippe Antoine	bf6b8510fe	rust: move DetectEngineStateFree out of RustContext Ticket: 7667 just use it directly, with bindgen, and cfg not test	1 year ago
Philippe Antoine	573dd2367e	rust: bindgen SCFileFlowFlagsToFlags Ticket: 7667	1 year ago
Philippe Antoine	6fa85d18f0	rust: reenable lint unused_doc_comment With just local exceptions	1 year ago
Philippe Antoine	b59086210f	rust: bindgen flow ffi API Ticket: 7667	1 year ago
Philippe Antoine	bbf1424371	rust: bindgen MpmAddPatternCI Ticket: 7667	1 year ago
Philippe Antoine	c391451f19	rust: begin to bindgen app-layer-register.h Ticket: 7667	1 year ago
Philippe Antoine	95483228d2	detect: list-keywords cli shows integers with bitflags Ticket: 7875	1 year ago
Philippe Antoine	53d9569dfb	detect: list-keywords cli shows integers with enums Ticket: 7875	1 year ago
Philippe Antoine	da486af881	detect: list-keywords cli shows integers Ticket: 7875	1 year ago
Philippe Antoine	68017d3fe1	detect: grow SigTableElmt flags to u32 to be later able to store information about keywords being about integers	1 year ago
Philippe Antoine	b298bce0e7	detect: list-keywords cli shows multi-buffers Ticket: 7571	1 year ago
Philippe Antoine	cb9ab951b9	detect/integers: subslice for multi-integers	1 year ago
Philippe Antoine	82f0e725a2	detect/integers: index or_absent and or_oob To match if array is empty, or index is out of bounds	1 year ago
Philippe Antoine	1480cf47ab	detect/integers: nb index to match a specific number of times For example dns.rrtype: !A,nb>3 will match if we have more than 3 dns records which are not A	1 year ago
Philippe Antoine	6f848eeaaf	detect/integers: all1 index to match only on non-empty arrays	1 year ago
Philippe Antoine	dd81cfa733	detect/uint: wait for end of progress to match on all As is done for absent keyword for instance	1 year ago
Philippe Antoine	5add185f22	http2/detect: http2.window can now use index Ticket: 7480	1 year ago
Philippe Antoine	83868778b9	http2/detect: http2.priority can now use index Ticket: 7480	1 year ago
Philippe Antoine	9fc407fd75	mqtt/detect: mqtt.type can now use index Ticket: 7480	1 year ago
Philippe Antoine	c0988252ba	dns/detect: rrtype can now use index Ticket: 7480	1 year ago
Philippe Antoine	d8c1f8e7be	rust/detect: generic detect_uint_match_at_index and make ldap use it Ticket: 7480 No behavior change, just code restyling	1 year ago
Philippe Antoine	7effcb7835	rust/ldap: use Vec instead of Vecdeque as we do not pop Ticket: 7480 May have a behavior change, but only in terms of performance	1 year ago
Philippe Antoine	f555f02ed4	rust/detect: generic detect_parse_array_uint_enum And make ldap use it Ticket: 7480 No behavior change, just code restyling	1 year ago
Philippe Antoine	c6d3857793	rust/detect: create generic DetectUintArrayData And make ldap use them Ticket: 7480 No behavior change, just code restyling	1 year ago
Philippe Antoine	e01d19889e	rust/detect: move DetectUintIndex definition to generic file Ticket: 7480 No behavior change, just code restyling	1 year ago
Philippe Antoine	ef6ce7d701	detect: rename LdapIndex to something generic to be able to use it outside of ldap Ticket: 7480 No behavior change, just code restyling	1 year ago
Philippe Antoine	2ed7a85356	rust: rustfmt detect uint	1 year ago
Alice Akaki	8e0b0ef35f	detect: add email.body_md5 keyword email.body_md5 matches on md5 hash generated from email body This keyword maps to the EVE field email.body_md5 It is a sticky buffer Supports prefiltering Ticket: #7587	1 year ago
Alice Akaki	6c88cc1e0c	detect/mime: fix detect mime nits Return 0 if .to_str() fails in functions SCDetectMimeEmailGetData and SCDetectMimeEmailGetDataArray Fixes: `431822c` ("detect: add email.from") `96e461f` ("detect: add email.received keyword")	1 year ago
Alice Akaki	4f1cc19f25	mime/smtp: Change md5_result type from GenericArray<u8, U16> to String	1 year ago
Victor Julien	96ae693b44	version: start work on 9.0.0	1 year ago
Shivani Bhardwaj	0d65d35c92	version: start development towards 8.0.2	1 year ago
Jason Ish	2444feed0d	release: 8.0.1; update changelog	1 year ago
Jason Ish	6d74656bef	rust: respect RUSTC and CARGO env vars like CC To support alternative cargo and rustc programs (such as cargo-1.82), respect CARGO and RUSTC environment variables during ./configure much like CC. RUSTFMT is also respected as that is required for the tests, and Cargo can't figure this out like it can for rustc (perhaps a bug in the packaging). For cbindgen, we have also have to make sure the cargo environment variable is set for each invocation. To build with Ubuntu's Rust 1.82 packaging: CARGO=cargo-1.82 RUSTC=rustc-1.82 RUSTDOC=rustdoc-1.82 \ ./configure Note that setting RUSTDOC is only required for commands like "make check" to pass. Ticket: #7877	1 year ago
Jason Ish	db945aec83	rust: bindgen requires rustfmt Bindgen will use rustfmt after generating the bindings, but this will fail if rustfmt is not installed. Only run bindgen if rustfmt is installed.	1 year ago
Jason Ish	4d4198dccc	rust: update tracing-subscriber Address https://rustsec.org/advisories/RUSTSEC-2025-0055.	1 year ago
Jason Ish	3b9dfe620d	rust: pin time crate to 0.3.41 0.3.42 introduces dependencies that require Rust 1.81.	1 year ago
Philippe Antoine	be605ba2de	htp: use transactions right get function Not the VecDeque one Ticket: 7803	1 year ago
Philippe Antoine	d0a513df6a	detect/integers: support kibibyte unit Ticket: 7869	1 year ago
Philippe Antoine	2a17ab6d88	http: generate no anomaly for identity encoding Ticket: 7843	1 year ago
Jeff Lucovsky	03d676531a	detect/from_base64: Support keyword w/no opts Issue: 7853 Support the use of `from_base64` with no optional values. In this case, the default values for: - mode RFC4648 - offset: 0 - bytes: buffer size will be used.	1 year ago
Jason Ish	b93a27722c	rust: fix mismatched_lifetime_syntaxes warning Fix new warning present in Rust 1.89. warning: hiding a lifetime that's elided elsewhere is confusing --> src/ldap/types.rs:191:30 = help: the same lifetime is referred to in inconsistent ways, making the signature confusing = note: `#[warn(mismatched_lifetime_syntaxes)]` on by default help: use `'_` for type paths	1 year ago
Philippe Antoine	fe9da8acd6	http2: do not log empty objects for request or response Ticket: 7741	1 year ago
Philippe Antoine	11c549211e	snmp: fix the possibility to disable the parser Ticket: 7820 Do not register anything, not even ALPROTO_SNMP "snmp" string if parser is disabled	1 year ago
Shivani Bhardwaj	e4b3b75b23	version: start development towards 8.0.1	1 year ago
Shivani Bhardwaj	9956286fb8	release: 8.0.0; update changelog	1 year ago
Philippe Antoine	fa8d3a4ccb	http2: do not set file flags for global txs Global txs means here txs with stream id 0, used for connection control messages.	1 year ago
Philippe Antoine	349c21af2c	http2: mark old txs as updated As is done in the other case a few lines below	1 year ago
Philippe Antoine	1d6d331752	http2: forbid data on stream 0 Ticket: 7658 Suricata will not handle well if we open a file for this tx, do not close it, but set the transaction state to completed. RFC 9113 section 6.1 states: If a DATA frame is received whose Stream Identifier field is 0x00, the recipient MUST respond with a connection error (Section 5.4.1) of type PROTOCOL_ERROR.	1 year ago
Jason Ish	c204ddb3e5	rust/Makefile: sort filenames Misc cleanup as these lists are growing.	1 year ago
Jason Ish	f68b06798f	rust/htp: follow suricata versioning Have htp follow Suricata versioning so we don't have to worry about version updates as it changes. For example, between 8.0.0-beta1 and 8.0.0-rc1 there were changes to the htp, however the version stayed at 2.0.0 making it impossible to publish these changes to crates.io.	1 year ago

1 2 3 4 5 ...

2072 Commits (5f754b11a6cbe530ce9becdb3278729739b32669)