Debian 13 ships Rust 1.85 by default, Ubuntu requires installing a
specific patch to get newer then 1.75. So to support a newer MSRV,
these operating systems need different examples.
Analyzer arrays store internal IDs of the signature for an easy lookup
later from the DetectEngineCtx. However, the storage arrays were
inappropriately named as sid arrays. Make it coherent.
Bring Analyzer structs and fns to the header for later use in a wider
context.
Ticket: 8678
With an inspect window of 0xAAAAAAAB the `window * 3` guard wrapped to 1
in uint32_t arithmetic, so it passed for a 64 byte file and
content_inspected was set to `file->size - window`, an underflow.
Ticket: 8678
In FilePruneFile() `window * 3` was computed in uint32_t arithmetic.
The guard exists to ensure `file->size > window`, so on wrap around
`file->size - window` underflows and content_inspected is set to a
bogus value, breaking file inspection.
Make window uint64_t so the multiplication cannot wrap.
With this patch, the logged uuids will also have corresponding
stringified service names. The requests that will have an opnum will
have a corresponding stringified procedure name.
Feature 2727
Feature 8523
This data directly comes from Zeek @d11a8750. It was scriptually
converted to NDJSON ingestible to Suricata using serde and serde_json.
The script used for this conversion lives in
scripts/extract_dce_rpc_interfaces.py.
Part of this data within Zeek codebase comes from the MITRE BZAR
project. Hence, the LICENSE file alongwith this data consists of both
the licenses: Zeek and BZAR.
Feature 2727
Feature 8523
SMTPGetLine assigned response frames to the current transaction even when a
queued reply belonged to an older transaction.
Use the queued command owner so frame EVE output and frame-based detection
receive the correct transaction id.
Includes some re-org to avoid prototypes for static functions.
Ticket: #8741
A BDAT command that failed to parse, such as "BDAT 5 X", returned -1,
disabling SMTP parsing for the rest of the flow. A server may reject the
command and continue the session, leaving following messages
uninspected.
Instead raise a decoder event and queue the command as an ordinary
command.
Ticket: #8741
Track the BDAT LAST marker so the final chunk and its reply complete the
transaction in each direction, preventing a following MAIL FROM from
being merged into the previous transaction.
Ticket: #8741
Ticket: 8797
Add check to rlen value read from ERF record to avoid potential infinite loop, must be >= dag_record_length (16).
Similar check exists in source_erf_file already.
RUSTSEC-2026-0253 in the lru crate requires that items we put in the
lru have a drop implementation that may panic, and we catch
that panic. The current items we put in the lru cache do not have a drop
implementation, and we treat panic's as fatal so will not run into the
issue presented in RUSTSEC-2026-0253.
The TLV loop for the IPv6 hop-by-hop and destination option headers
gates each option on (offset + 1 + ip6_optlen) > optslen. An option is
two header bytes (type, length) plus ip6_optlen data bytes, so its data
ends at offset + 1 + ip6_optlen and the bound has to be
offset + 2 + ip6_optlen.
Before: an option that declares its data running one byte past the
option area is accepted, and the Router Alert / Jumbo / Home Address
memcpy then copies sizeof(value) bytes ending one byte past the area;
when the header sits at the tail of the IPv6 payload that read goes
past the payload.
After: the option is rejected with IPV6_EXTHDR_INVALID_OPTLEN, matching
how the IPv4 option loop already bounds a full option against the
remaining length. The check stays next to the read so each option type
does not need its own guard.
Ticket: #8817.
Make sure the transaction still exists before completing it in the
to-client direction. A pipelined RSET reply may already have completed and
freed it while a later end-of-DATA marker still refers to it.
Found by OSS-Fuzz testcase 5498180758994944.
Bug #8739.
Make sure that every buffer in a signature is actually used in the
setup of the engines. Reject sigs that are locked to a certain substate
and use buffers that require another.
DOH2 depends on HTTP/2, so it makes no sense to enable it separately.
It would also put the sub state handling in a weird state, as the DOH2
side reuses the registered HTTP/2 callbacks.
In firewall mode the alproto logic when building prefilter and rule
engines is strict, but was out of sync between prefilter and rule app
inspect engines.
For SIGNATURE_HOOK_TYPE_APP rules the logic is strict, with an exception
for HTTP/2 and DOH2. DOH2 is not a full protocol implementation, but
rather HTTP/2 with a different alproto.
Fixes: d64954a873 ("detect: don't register unrelated inspect engines")
Jason Ish
Shivani Bhardwaj
Denis Balashov
Stephen Donnelly
Dmitry Uryvchikov
Uwez Khan
Victor Julien
Philippe Antoine
dependabot[bot]
Jeff Lucovsky