suricata

Commit Graph

Author	SHA1	Message	Date
Philippe Antoine	c6014a77a2	websocket: accepts config value with units Ticket: 8552 As was the commented out example	5 months ago
Philippe Antoine	e0152178da	rust: format detect files Ticket: 3836	5 months ago
Giuseppe Longo	695b4f4a3d	sip: remove incomplete data event It's no longer useful to set an event when the data is incomplete, since an error is returned. Ticket #8524	5 months ago
Giuseppe Longo	ba5e850264	sip: make pattern matching more robust SIP and SSDP share method names like NOTIFY and SUBSCRIBE, causing SSDP traffic to be misidentified as SIP. Add a probing parser callback that checks for "SIP/" in the payload before accepting a pattern match. Example of a misidentified flow before the fix: {"timestamp":"2014-02-27T19:44:43.164211+0100","flow_id":986757542077835,"event_type":"flow","src_ip":"192.168.1.1","src_port":9489,"dest_ip":"239.255.255.250 ","dest_port":1900,"ip_v":4,"proto":"UDP","app_proto":"sip","flow":{"..."}} After the fix: {"timestamp":"2014-02-27T19:44:43.164211+0100","flow_id":986757542077835,"event_type":"flow","src_ip":"192.168.1.1","src_port":9489,"dest_ip":"239.255.255.250 ","dest_port":1900,"ip_v":4,"proto":"UDP","app_proto":"failed","flow":{"..."}} Ticket #8355	5 months ago
Giuseppe Longo	88f17d7b20	detect/sctp: add sctp.chunk_type keyword Add a U8 numeric keyword to match the first SCTP chunk type in a packet with prefilter support. Ticket #4251	5 months ago
Philippe Antoine	4144d9c709	rust: format snmp files Ticket: 3836	5 months ago
William Ling	30628e45bc	rust: replace helper with built-in Replace custom u32_as_bytes with built-in to_be_bytes Issue: 5785	5 months ago
Philippe Antoine	9318bbfbdb	rust: format tftp files Ticket: 3836	5 months ago
Philippe Antoine	9ec200e834	rust: format x509 files Ticket: 3836	5 months ago
Philippe Antoine	dd66276f82	rust: format telnet files Ticket: 3836	5 months ago
Philippe Antoine	709ad1bdf4	rust: format sip files Ticket: 3836	5 months ago
Samaresh Kumar Singh	f06bb7d43e	dhcp: support option 52 overload Per RFC 2132 the BOOTP sname and file fields can hold extra DHCP options when option 52 is present, but the parser ignored them. After parsing the main options we now look up option 52 and walk sname or file as additional option streams, appending what we find to the same options vector so the logger and detection keywords see the overloaded values too. Bug: #8538.	5 months ago
Philippe Antoine	26bb18cfaa	http2: replace state todrop with a dedicated boolean Ticket: 8518	5 months ago
Philippe Antoine	8eed90ca9d	http2: global txs are unidirectional Ticket: 8518 Meaning they will now match only once per tx instead of twice: once for each direction	5 months ago
Philippe Antoine	daf68dc36f	http2: split progress per direction Ticket: 8518 Keywords that work for HTTP2 headers match now as soon as possible A push promise is now considered like a headers frame with regards to the progress (no dedicated "reserved" progress/state) http.protocol and http.stat_msg keywords are now registered at earliest progress, since these are synthetic like "HTTP/2" and not really seen on the wire. http.request_line and http.response_line match only on data, and not on headers, since we must wait the end of headers to be sure to have the full line http2.size_update now matches at headers progress as it should http2.frametype, http2.errorcode, http2.priority now match like http2.window, when the tx is complete from both sides, as a half-closed client may still send priority, rst_stream or window_update frames	5 months ago
Philippe Antoine	8217c51126	rust: format sdp files Ticket: 3836	5 months ago
Philippe Antoine	9d9d8df4cd	rust: format rdp files Ticket: 3836	5 months ago
Philippe Antoine	7352bae890	smb: avoid unsigned overflow debug assertion As we compute a padding, we can use wrapping_add as we only care about the low-weight bit anyways	5 months ago
Giuseppe Longo	8f205bb34f	llmnr: implement logger This adds an LLMNR protocol logger that reuses existing DNS functions, following the same approach as the mDNS logger: - No grouped logging - Rdata is logged in a field that is named after the rdata type - Types are logged in lower case - Flags are logged as an array Ticket #8366	5 months ago
Giuseppe Longo	13df0f7a06	llmnr: implement parser This adds a parser for LLMNR protocol over both UDP and TCP. The parser reuses the existing DNS functions since LLMNR shares the same wire format as DNS, but implements its own protocol-specific validation: - LLMNR-specific flag checks (C, TC, T bits) - Opcode validation (only standard query opcode 0 is valid) - An Event is set if Z-flag is set, since it's must be zero per RFC4795 LLMNR transactions inherit DNS behavior where each packet creates a new state with one transaction. Ticket #8366	5 months ago
Philippe Antoine	73193c7e6a	rust: format pgsql files Ticket: 3836	5 months ago
Philippe Antoine	3bfe6cf4b9	rust: format nfs files Ticket: 3836	5 months ago
Philippe Antoine	07112bc7ae	rust: format mqtt files Ticket: 3836	5 months ago
Philippe Antoine	844f2effa3	rust: format modbus files Ticket: 3836	5 months ago
Philippe Antoine	db019ebefe	rust: format ike files Ticket: 3836	5 months ago
Philippe Antoine	bcc1e6ae32	rust: format http2 files Ticket: 3836	5 months ago
Philippe Antoine	1070e733d8	rust: format websocket files Ticket: 3836	5 months ago
Philippe Antoine	89e5332d88	rust: format utils files Ticket: 3836	5 months ago
Philippe Antoine	edf29b0000	rust: format ssh files Ticket: 3836	5 months ago
Philippe Antoine	fe27a2159c	rust: format rfb files Ticket: 3836	5 months ago
Philippe Antoine	5cca346f16	rust: format quic files Ticket: 3836	5 months ago
Philippe Antoine	415360d9e8	rust: format ntp files Ticket: 3836	5 months ago
Philippe Antoine	fa864f9c2f	rust: format mime files Ticket: 3836	5 months ago
Philippe Antoine	2cfcaec1b0	rust: format ldap files Ticket: 3836	5 months ago
Philippe Antoine	64e7c671cc	rust: format ftp files Ticket: 3836	5 months ago
Philippe Antoine	f217e249cb	rust: format ffi files Ticket: 3836	5 months ago
Philippe Antoine	f7c14809f4	rust: format enip files Ticket: 3836	5 months ago
Philippe Antoine	e526eb8e2b	rust: format bittorrent_dht files Ticket: 3836	5 months ago
Philippe Antoine	f5ac0e201c	rust: format asn1 files Ticket: 3836	5 months ago
Philippe Antoine	1ced97bdbb	rust: format applayertemplate files Ticket: 3836	5 months ago
Philippe Antoine	b90adcc2bb	rust/ffi: move AppLayerTxData to ffi Ticket: 7666	5 months ago
Philippe Antoine	0773fba5fd	rust/ffi: move txdata flags to ffi Ticket: 7666	5 months ago
Philippe Antoine	2525ea2e37	rust/ffi: move direction to ffi Ticket: 7666	5 months ago
Philippe Antoine	5440e41314	rust/ffi: move debug validations macros to ffi Ticket: 7666	5 months ago
Philippe Antoine	bf64b52b95	http2: better compression against decompression bombs Ticket: 8513 Suricata decides at 2 levels if a http2 flow is doing a compression bomb. There is a direct computation when one chunk of TCP data is being parsed. In this case, do not take the ratio into account, just use the size of the decompressed data, so that if we get a big chunk of TCP data like 1 MiB, and a not so high ratio of 200, we do not trigger the debug assertion in util-file.c about 64MiB The other case stays unchanged : when accumulating over the lifetile of a flow with multiple txs, take into account the compression ratio, so that a flow of many txs, having a super high (brotli) compression ratio, ends up classified as a compression bomb. (For example, having 100 txs each turning a 100 byte input into a 700 KiB one)	5 months ago
Philippe Antoine	6d437956e2	detect/transforms: dotprefix can be chained Ticket: 8537 Otherwise, it may cause a use-after-free, in case of reallocated buffer and we used the buffer inspect which was freed.	5 months ago
Philippe Antoine	2b20a436e7	detect/transforms: decompress checks earlier if it is in-place Ticket: 8536 Otherwise, it may cause a use-after-free. So, need to allocate the temporary vector, before calling SCInspectionBufferCheckAndExpand	5 months ago
Philippe Antoine	7bf48b02be	http2: protection against decompression bombs Ticket: 8513 During decompression, fail early if we have a big decompression ratio, and enough data. Track this data also during a tx lifetime, and even a flow/state lifetime, so that we set event and fail also if the compression bomb is split over multiple packets	6 months ago
Philippe Antoine	29e4b08647	http2: code refactoring to split big function	6 months ago
Philippe Antoine	e98d419d96	ldap: bound the number of responses Ticket: 8405	6 months ago

1 2 3 4 5 ...

2079 Commits (79ef58be12a3be48ab6312f4468d8597ec2fa578)