Ticket: 5204
ippair use_cnt increased by AppLayerExpectationCreate calling
IPPairGetIPPairFromHash was never decreased
(cherry picked from commit 425b9c6777)
Add a minimal, non-intrusive config option firewall.policies.accept-arp
to allow ARP packets to be accepted in firewall mode without requiring
ARP detection rules. Default is false to preserve current behavior.
Ticket: #8314.
IPOnly Engine does not support parsing and recording IPv6 ranges. So,
passing a range of ipv6 there just results in non-fatal errors in
parsing the IP addresses which means they fail to be added to the radix
tree struct.
Re-classify the ipv6 ranges as like_ip_only so they fall out of the
IPOnly engine and are processed per packet.
Ticket: 8847
(cherry picked from commit 63daa73032)
The policy config was a flat map mixing packet hooks and app-layer
protocols: `packet-filter` next to `dns`. There was no node that meant
"the packet hooks" or "the app-layer hooks", so a setting could not be
scoped to one group.
Move each group under its own node:
packet-filter -> packet.filter
packet-pre-flow -> packet.pre-flow
packet-pre-stream -> packet.pre-stream
<proto>.<hook> -> app.<proto>.<hook>
Ticket: 8770
(cherry picked from commit b82b4496af)
AppProtoToString(ALPROTO_HTTP1) returns "http", so an HTTP/1 policy had to
be written as `http:` while its rule hooks were already spelled `http1:`.
Use the same name in both places.
Ticket: 8770
(cherry picked from commit 04c9fd9e22)
To avoid back-and-forth of http1 conversion
a second query function was added to support
existing use cases.
This change will be handy for the upcoming
default-policy for firewall settings
(cherry picked from commit 3adbd677e8)
RUSTSEC-2026-0253 in the lru crate requires that items we put in the
lru have a drop implementation that may panic, and we catch
that panic. The current items we put in the lru cache do not have a drop
implementation, and we treat panic's as fatal so will not run into the
issue presented in RUSTSEC-2026-0253.
RFC 5321 says a mid-session EHLO should work just like RSET. We more or
less ignored it, which meant transaction state could carry over.
Treat a HELO/EHLO received during a transaction as RSET once the server
accepts it.
Ticket: #8715
(cherry picked from commit 0be6e345fd)
SMTPGetLine assigned response frames to the current transaction even when a
queued reply belonged to an older transaction.
Use the queued command owner so frame EVE output and frame-based detection
receive the correct transaction id.
Includes some re-org to avoid prototypes for static functions.
Ticket: #8741
(cherry picked from commit 57ae57152c)
A BDAT command that failed to parse, such as "BDAT 5 X", returned -1,
disabling SMTP parsing for the rest of the flow. A server may reject the
command and continue the session, leaving following messages
uninspected.
Instead raise a decoder event and queue the command as an ordinary
command.
Ticket: #8741
(cherry picked from commit 60e0df6530)
Track the BDAT LAST marker so the final chunk and its reply complete the
transaction in each direction, preventing a following MAIL FROM from
being merged into the previous transaction.
Ticket: #8741
(cherry picked from commit ec0fec1a37)
Make sure the transaction still exists before completing it in the
to-client direction. A pipelined RSET reply may already have completed and
freed it while a later end-of-DATA marker still refers to it.
Found by OSS-Fuzz testcase 5498180758994944.
Bug #8739.
(cherry picked from commit 62fdb771b0)
Track the transaction id for each queued SMTP command so replies can update the
transaction that created the command instead of always using the current
transaction.
Ticket: #8393
(cherry picked from commit e2a62dd1c0)
Add directionality to completion states, and replace tx->done by checking for
both directions being complete.
This means that the transaction is now not complete until the server responds
to the clients of data marker, previously the tx was completed when the client
send end of data without waiting for the server response.
This keeps smtp:response_complete from being exposed before the server response
is parsed.
Ticket: #8393
(cherry picked from commit 7b31f41878)
Add minimal SMTP progress states to support envelope validation before
moving to data.
Update SMTP, file and email keywords to hook into the appropriate
states.
Purposefully kept minimal for now as to not break the current idea of an
SMTP transaction, which is probably not ideal for firewall mode.
Ticket: #8393
(cherry picked from commit c2728eee01)
Ticket: 8385
Add a new match subdomain option that enables blocking a domain and all its subdomains using datasets.
(cherry picked from commit a3ab00e920)
Ticket: 8797
Add check to rlen value read from ERF record to avoid potential infinite loop, must be >= dag_record_length (16).
Similar check exists in source_erf_file already.
(cherry picked from commit a37b75a8ba)
Populate defrag.memuse from DefragTrackerGetMemuse() rather than
DefragTrackerGetMemcap(), so it reports actual usage, not the cap.
Issue: 8752
(cherry picked from commit e7f1692a5c)
Fix how error messages are printed in a case error occurs in the ebpf
flow table code. The log flag g_flowv4_ok was inverted,
so the error messages were never printed.
The fix follows g_flowv6_ok flag code structure.
Ticket: 8704
(cherry picked from commit 74bc0feb1a)
Switch check whether BypassedCheckFuncInit was registered to
check whether BypassedCheckFunc was registered.
Ticket: 8473
(cherry picked from commit 0a8e3132c2)
Ticket: 8592
Fixes: 5ddd808e9b ("ftp: don't halt the flow when raising
too_many_transactions")
In the case we receive a big chunk of TCP data, we end up
creating much more than max-tx transactions, and have
quadratic complexity on this packet, even if all
these transactions get cleaned up at the end of the processing
of this packet.
(cherry picked from commit 82c4190558)
Ticket: 8694
Otherwise, a flow full of small compression bombs is too slow
to process.
When the threshold is reached, decompression is skipped for the
rest of the flow.
(cherry picked from commit 392b6aee29)
Ticket: 8725
So that multiple HTTP2 DATA frames with EndOfStream flag set,
do not make the buffer grow, while processing it each time,
resulting in quadratic complexity
(cherry picked from commit 1731805967)
Ticket: 8629
When we are in async-oneside mode, we see only one direction
of the traffic, and should not wait for the other direction
before cleaning up a transaction.
(cherry picked from commit 7ec9d72d28)
new_tx() now refuses to create a transaction when the list is already at
SMB_MAX_TX, returning None instead of a transaction. Every creation path --
the new_*_tx helpers and their callers across smb1/smb2/dcerpc/session/
files/ioctl -- propagates that, so no single input can create more than the
limit, including a compound SMB2 request that chains many PDUs in one
record. When the list is full the parser puts the flow into an error state
and stops processing it.
This replaces the previous force-completion of old transactions, which did
not reliably bound the list and could leave transactions unreclaimable on
asymmetric flows. The now-unused tx_index_completed bookkeeping is removed.
Issue: 8629
(cherry picked from commit c8f68b0e4f)
Ticket: 8558
Do not accept an IPv6 as an IPv4 (even if the hash is likely
different in the first place)
Do the check also for ESP, and ebpf
(cherry picked from commit bc41dcc854)
Ticket: 8649
Fully resets all the fields before tackling an ecapsulated message
to avoid evasion, due to the encoding of the upper file
leaking into the next one...
(cherry picked from commit 4985eb9dae)
Body lengths were stored as u16, so a SIP body of 65536 bytes truncated
body_len to 0 and the RequestBody/ResponseBody frame was never created,
letting body content evade inspection. Widen the framing fields to u32.
Ticket #8582
(cherry picked from commit 499995bf0e)
Fix Flow Manager error when flows were not being timed out
in case flow.hash-size < 10.
This happened because calculation of variable rows_per_sec in
flow-manager.c rounded the value to zero.
This commit ensures that variable rows_per_sec is at least 1.
Ticket: 8710
(cherry picked from commit b8d7f894be)
Tx ID handling did not take the required + 1 into account.
From a report:
RDP can skip cleanup because its id convention does not match the
generic Rust iterator. The generic iterator in applayer.rs returns
tx.id() - 1, and cleanup trusts that id when calling StateTransactionFree
in app-layer-parser.c. RDP registers that iterator in rdp.rs, but
RdpTransaction::id() returns the stored id unchanged in rdp.rs, while
free_tx also compares against the raw stored id in rdp.rs. For a single
freeable RDP tx with stored id 1, the iterator returns C id 0; cleanup
calls free_tx(0), nothing is removed, then has_next == false allows
min_id to advance to total_txs in app-layer-parser.c. That leaves the
tx live but now below min_id, so later cleanup will not revisit it.
This patch brings the handling in line with the other parsers.
Bug: #8717.
(cherry picked from commit 9555e3add6)
In firewall mode, a accept:hook or accept:tx needs to lead to a accept
packet when the action is applied to the last TX. For this the code
relied of the `DetectTransaction::is_last` field, where the assumption
was that there would always be an inspection on the last transaction.
This assumption was wrong however, as transactions can be skipped for a
few reasons: not updated, fully inspected, unidirectional for the other
direction. This would cause the accept not be applied to the packet,
leading to a default drop.
The reason this wasn't noticed before is that until now the work had
focused on protocols that used sequential transactions (http/tls),
and/or short lived sequential unidir transactions (dns)
This patch addresses the issue by making a simple assumption: if the
last available transaction in the main detection loop is skipped, it
means it has been accepted before. Therefore we can apply the "accept
packet" logic in this case.
Bug: #8698.
(cherry picked from commit 9e31a21aba)
Treat dyn_port 0 as an absent value so numeric comparisons do not
match FTP transactions without a negotiated data port.
Ticket: #8392
(cherry picked from commit e560db9d1f)
Philippe Antoine
Victor Julien
Shivani Bhardwaj
Lukas Sismis
Jason Ish
Antoine Abou Faysal
Stephen Donnelly
Jeff Lucovsky
Adam Kiripolsky
Giuseppe Longo