12 Commits (6079963f551455aaebf9d9545484eaa9b4da9a83)

Author	SHA1	Message	Date
Giuseppe Longo	1d7da06d9f	imap: implement parser ... This introduces a parser for IMAP protocol, replacing the detection-only implementation. An IMAP transaction has two states driven by the 'complete' field: - Open (complete = false): waiting for a matching tagged response. - Complete (complete = true): tagged response received, or special conditions met (BYE, server greeting). Completion logic (is_complete): - If a tagged request exists: requires a matching tagged response. - No tagged request + BYE: complete (server closing). - No tagged request + any response: complete (server greeting). Transactions are created in three places: 1. Request parser: every parsed command creates a new tx. 2. Response parser (tagged, no matching request): midstream/async; orphan tagged response gets its own tx. 3. Response parser (untagged, no incomplete tx): server greeting or unsolicited response. Once open, messages accumulate: - Request side: continuation and literal data attach to the most recent incomplete tx. - Response side: untagged responses attach to the most recent incomplete tx; tagged responses attach via find_request(tag). Literals, sent by the client (e.g. APPEND) or by the server (e.g. FETCH), are consumed incrementally and their content is not retained. Hard limits prevent unbounded growth: - IMAP_MAX_TX (256, configurable): total transactions. Exceeded: all incomplete txs force-completed with TooManyTransactions event. - IMAP_MAX_MSGS_PER_TX (512): requests per tx. Exceeded: request dropped, DataLimitReached event. - IMAP_MAX_LINES (512): response lines per tx. Exceeded: line dropped, DataLimitReached event. - IMAP_MAX_LINE_BYTES_PER_STATE (100MB): retained request and response data per flow. Exceeded: data dropped, DataLimitReached event. - IMAP_MAX_LINE_SIZE (8KB): request/response line max length. Exceeded: LineTooLong event. - Literal size: bounded by declared size in {N} specifier. IMAP_MAX_TX only is configurable limit via app-layer.protocols.imap.max-tx. Ticket #8276	21 hours ago
Giuseppe Longo	ae58cc6491	rules: add sip-events.rules ... Ticket #8524	5 months ago
Giuseppe Longo	21d35f6b37	decoder/sctp: extend decoder ... Extend the SCTP decoder to parse chunk headers after the 12-byte common header. Each chunk is validated for minimum header size and length consistency per RFC 4960 sec 3.2. Add SCTPChunkHdr and SCTPVars structs to track per-packet chunk metadata Add five new decoder events for protocol violations: - SCTP_CHUNK_TOO_SMALL: insufficient data for a chunk header - SCTP_CHUNK_LEN_INVALID: chunk length < 4 or exceeds packet - SCTP_INIT_CHUNK_NOT_ALONE: INIT/INIT_ACK bundled (RFC 4960 sec 6.10) - SCTP_INIT_WITH_NON_ZERO_VTAG: INIT with vtag != 0 (RFC 4960 sec 8.5.1) - SCTP_DATA_WITH_ZERO_VTAG: DATA chunk with vtag == 0 Ticket #4251	5 months ago
Victor Julien	2d4f1968b8	detect/firewall: support alert in default app policy ... Support `alert` as a secondary action in app-layer firewall policies. To implement this a Signature object is created per policy that uses alert, and this is stored in a hash table. When the policy is applied the signature is looked up and used in the PacketAlert. Ticket: #8566.	5 months ago
Philippe Antoine	eec4a44275	rules: SID allocation range is now documented in README.md ... directly in the repo, and not in an external wiki	6 months ago
Philippe Antoine	42123cc8d9	bittorrent: add bittorrent-events.rules file ... Add a file containing rules to match bittorrent protocol events. Ticket: 8421	6 months ago
Philippe Antoine	cff3d6417a	snmp: add snmp-events.rules file ... Add a file containing rules to match SNMP protocol events. Ticket: 8421	6 months ago
Giuseppe Longo	b6fa3c8e8c	ldap: add ldap.rules file ... Add a file containing rules to match LDAP protocol events. Ticket #8368	8 months ago
Jason Ish	933127a9a8	rules: add mdns rules	1 year ago
Alex Savage	778053876b	pop3: app-layer parser using sawp-pop3 ... This module uses the sawp-pop3 crate to parse POP3 requests and responses Features: - eve logging - events for parsable but non-RFC-compliant messages Ticket: 3243	2 years ago
Juliana Fajardini	1b6f4da23b	pgsql: add events ... Events for: - parsing error when parsing pgsql packet length - parsing error for pgsql requests (post length parsing) - parsing error for pgsql responses (post length parsing) - too many transactions Include `pgsql-events.rules` file, and PGSQL events SID range definition Task #5566	2 years ago
Jason Ish	0490279a75	rules/readme: document sid ranges in source tree	4 years ago