aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
19,175 Commits
8 Branches
174 Tags
255 MiB
main
main-8.0.x
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.7
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '79ef58be12'
${ noResults }
Commit Graph

2079 Commits (79ef58be12a3be48ab6312f4468d8597ec2fa578)

Author SHA1 Message Date
Philippe Antoine 8857b78f6a rust: move AppLayerTxData definition to C 
and bindgen it to rust

Will make easier the bindgen of RustParser structure which uses
a callback which uses AppLayerTxData

Move also the free function to C SCAppLayerTxDataCleanup
As suricata-sys crate defines AppLayerTxData for rust,
It must itself implement the Drop trait, and thus,
We need to define a feature surest
 9 months ago
Philippe Antoine 8eaced3c1e rust: move AppLayerResult definition to C 
and bindgen it to rust

Will make easier the bindgen of RustParser structure which uses
a callback which uses AppLayerResult

Keep From<> impl in sys crate that defines it
 9 months ago
Philippe Antoine 06f78b2a22 rust: move StreamSlice definition to C 
and bindgen it to rust

Will make easier the bindgen of RustParser structure which uses
a callback which uses StreamSlice
 9 months ago
Philippe Antoine 41f543ca35 rust: move AppLayerGetTxIterTuple definition to C 
and bindgen it to rust

Will make easier the bindgen of RustParser structure which uses
a callback which uses AppLayerGetTxIterTuple
 9 months ago
Philippe Antoine 64d29fcd1c rust: move AppLayerStateData definition to C 
and bindgen it to rust, and use default trait instead of new

Will make easier the bindgen of RustParser structure which uses
a callback which uses AppLayerStateData
 9 months ago
Philippe Antoine 76efb8af4d rust: move AppLayerGetFileState definition to C 
and bindgen it to rust.

Will make easier the bindgen of RustParser structure which uses
a callback which uses AppLayerGetFileState
 9 months ago
Shivani Bhardwaj d4008a6508 dcerpc: remove bad tests 
Unittests test_parse_bind_pdu_infinite_loop and
test_parse_bindack_pdu_infinite_loop seem to have artificially made up
header which does not hold up to the strict calculations enforced by the
parser now. Their headers mark the fraglens as 64 and 72 respectively
which are not enough to hold the kind of bind(ack) items that are expected.
It worked so far as the parser passed the entire input slice around but
with the bugfix for issue 7546, the input passed around is strictly
restricted to the fraglen parsed in the header.

Bug 7546
 9 months ago
Shivani Bhardwaj ed1bd8624e dcerpc: use fraglen from header 
So far, the fraglen defined in the header was used inconsistently in
certain places to define bounds on input length. Make it consistent by
making sure that only a slice up until fraglen is passed around as that
is the maximum length the fragment should have.
With the help of Applayer::incomplete API, the case when the
stream_slice passed to the parser is smaller than the header defined
fraglen is already handled.

Bug 7546
 9 months ago
Shivani Bhardwaj fc9da1c7a1 dcerpc: fix consumed bytes post gap handling 
The parser could receive an input that consists of arbitrary data post
gap. This is handled in the beginning of the fn handle_input_data.
However, the rest of the calculation does not take into account the
bytes that were consumed at this stage. Fix the indices and calculations
to consider a new DCERPC fragment beginning post these consumed bytes.
 9 months ago
Philippe Antoine 9a52bbcbe9 detect/quic: move quic.cyu.hash to rust 
Ticket: 8255
 9 months ago
Philippe Antoine 01610aabe7 detect/quic: move quic.cyu.string to rust 
Ticket: 8255
 9 months ago
Philippe Antoine ee4d4a14d5 detect/quic: move quic.ua to rust 
Ticket: 8255
 9 months ago
Philippe Antoine 9ba9fdcb87 detect/quic: move quic.sni to rust 
Ticket: 8255
 9 months ago
Philippe Antoine 907e71a984 detect/quic: move quic.version to rust 
Ticket: 8255
 9 months ago
Philippe Antoine 2cf9a327d5 detect/ssh: move ssh.hassh to rust 
Introduces helper SCDetectRegisterBufferLowerMd5Callbacks
 9 months ago
Philippe Antoine 83360cfce0 detect/ssh: move ssh.hassh string to rust 
bindgen needed SCSigMatchSilentErrorEnabled on the way
 9 months ago
Philippe Antoine 02cb0f2ac2 rust: fix unnecessary_unwrap warnings 
warning: called `unwrap` on `rd.pipe` after checking its variant with `is_some`
   --> src/smb/smb1.rs:858:28
    |
857 |             if rd.pipe.is_some() {
    |             -------------------- help: try: `if let Some(<item>) = rd.pipe`
858 |                 let pipe = rd.pipe.unwrap();
    |                            ^^^^^^^^^^^^^^^^
    |
    = help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.93.0/index.html#unnecessary_unwrap
    = note: `#[warn(clippy::unnecessary_unwrap)]` on by default
 9 months ago
Philippe Antoine cafc398355 dcerpc: consume bytes after gap resync 
Ticket: 7567

Re-applies commit 8c3bd3e8a0
which was reverted in f64aec9d11
 9 months ago
Philippe Antoine 54cc752cf9 ssh: hassh can be truly disabled 
Rules will not re-enable it

Ticket: 8223
 10 months ago
Philippe Antoine 458211dcf2 detect/ssh: move ssh.proto to rust 10 months ago
Philippe Antoine 9cfc1cc557 detect/ssh: move obsolete keywords to rust 10 months ago
Philippe Antoine ea8ac2a02a detect/ssh: move ssh.software to rust 
Adds helper function SCDetectHelperBufferProgressMpmRegister on the way
 10 months ago
Philippe Antoine c0d6747e82 app-layer: GetTxIteratorFn uses a AppLayerGetTxIterState 
Even if every current rust parser uses the u64 variant of the C union
 10 months ago
Philippe Antoine 4b541b39f2 rust: move AppLayerEventType definition to C 
and bindgen it to rust.

Will make easier the bindgen of RustParser structure which uses
a callback which uses AppLayerEventType
 10 months ago
Philippe Antoine c960b7d7c1 app-layer: AppLayerParserFPtr uses a mut pointer to local storage 
So, fix the fn prototype in rust ParseFn
 10 months ago
Philippe Antoine f470ee448b quic: use standard tx iterator code 
Will make bindgen life easier

As the fn prototype should not have istate: &mut u64
but a *mut AppLayerGetTxIterState which is an union with a u64
 10 months ago
Philippe Antoine 076fcd61cd bittorrent: use standard tx iterator code 
Will make bindgen life easier

As the fn prototype should not have istate: &mut u64
but a *mut AppLayerGetTxIterState which is an union with a u64
 10 months ago
Philippe Antoine 1a546936c7 rust: AppLayerTxConfig uses Default impl 10 months ago
Philippe Antoine 4e64de3b3b rust: remove wrapper LoggerFlags struct definition 
just use an u32 out of the box.
Will make bindgen like easier
 10 months ago
Philippe Antoine f663be5983 rust: define every RustParser fn pointer unsafe 
That is what bindgen will do
 10 months ago
Lukas Sismis 3e4fdb2118 misc: time unit parsing function 10 months ago
Philippe Antoine 5bb9a0c3af dcerpc/tcp: fix fragmentation handling 
Really count the fragments, and set it done when last was received
 10 months ago
Philippe Antoine f64aec9d11 dcerpc: use different header for different directions 
Header handling is wrong in the case
packet A to server is fragmented (return AppLayerResult::incomplete)
packet B is to client, but uses the header of the to_server packet

Bug 7547
 10 months ago
Philippe Antoine 1832b50506 nfs: log read/write/rename whatever the nfs version 
These were previously logged correctly only for nfs v3

Now, the correct opcodes are used for v2 and v4 as well

Ticket: 8222
 10 months ago
Philippe Antoine b0850efd67 rust: from_str implementation for EncryptionHandling 
To move non-specific quic code to the right place
 10 months ago
Philippe Antoine 89b6ab6730 rust: rename EncryptionHandling 
as it is no longer specific to SSH
 10 months ago
Philippe Antoine 7acfea57a9 rust: move EncryptionHandling definition to its own file 
as it is not specific to ssh anymore
 10 months ago
Philippe Antoine 7422c97bf2 quic: encryption-handling config parameters 
Ticket: 8116
 10 months ago
Philippe Antoine a48200b9e5 dcerpc: use saturating_add to count fragments 
And do not overflow if we have traffic with more than 65K fragments
 10 months ago
Shivani Bhardwaj e412215af9 dcerpc: add upper limit on stub data 
DCERPC parsers had no upper bounds when it came to extending the stub
data buffer. Traffic can be crafted to bypass some internal parser
conditions to create an indefinite buffering in the stub_data array that
can make Suricata crash.

Add a default limit of 1MiB and make it configurable for the user.

Security 8182

Co-authored-by: Philippe Antoine <pantoine@oisf.net>
 10 months ago
Shivani Bhardwaj 1d7b0d9b7a tls/subjectaltname: use byte arr instead of string 
TLS parsers use x509-parser crate which parses X.509 certificates that
use ASN.1 DER encoding that can allow arbitrary byte sequences. An
attacker could inject null byte in a certificate anywhere to stump the
common language parsers terminating the string at a null byte leading to
a bypass of a possibly malicious certificate.

So far, the rust TLS parser for "subjectaltname" used a pattern that involved:
-> Get ASN.1 DER encoded raw data from the x509-parser crate
-> Convert this raw data to a decoded string (Rust)
-> Convert the Rust string to CString
-- The problem lies here. CString only accepts proper strings/byte
buffers and converts it into an owned C-compatible, null-terminated
string. However, if any null byte occurs in the string passed to the
CString then it panics.
In the rust TLS parser, this panic is handled by returning NULL.

This means that the parser will error out during the decoding of the
certificate. However, Suricata must be able to detect the null byte
injection attack being an IDS/IPS.

Hence, replace all such string patterns w.r.t. TLS SAN with a byte
array.

Bug 7887
 10 months ago
Shivani Bhardwaj 24f5b7dab2 tls/serial: use byte array instead of string 
Bug 7887
 10 months ago
Shivani Bhardwaj f025e07191 tls/issuerdn: use byte array instead of string 
TLS parsers use x509-parser crate which parses X.509 certificates that
use ASN.1 DER encoding that can allow arbitrary byte sequences. An
attacker could inject null byte in a certificate anywhere to stump the
common language parsers terminating the string at a null byte leading to
a bypass of a possibly malicious certificate.

So far, the rust TLS parser for "issuerdn" used a pattern that involved:
-> Get ASN.1 DER encoded raw data from the x509-parser crate
-> Convert this raw data to a decoded string (Rust)
-> Convert the Rust string to CString
-- The problem lies here. CString only accepts proper strings/byte
buffers and converts it into an owned C-compatible, null-terminated
string. However, if any null byte occurs in the string passed to the
CString then it panics.
In the rust TLS parser, this panic is handled by returning NULL.

This means that the parser will error out during the decoding of the
certificate. However, Suricata must be able to detect the null byte
injection attack being an IDS/IPS.

Hence, replace all such string patterns w.r.t. TLS IssuerDN with a byte
array.

Bug 7887
 10 months ago
Shivani Bhardwaj 77c21b05d2 tls/subject: use byte array instead of string 
TLS parsers use x509-parser crate which parses X.509 certificates that
use ASN.1 DER encoding that can allow arbitrary byte sequences. An
attacker could inject null byte in a certificate anywhere to stump the
common language parsers terminating the string at a null byte leading to
a bypass of a possibly malicious certificate.

So far, the rust TLS parser for "Subject" used a pattern that involved:
-> Get ASN.1 DER encoded raw data from the x509-parser crate
-> Convert this raw data to a decoded string (Rust)
-> Convert the Rust string to CString
-- The problem lies here. CString only accepts proper strings/byte
buffers and converts it into an owned C-compatible, null-terminated
string. However, if any null byte occurs in the string passed to the
CString then it panics.
In the rust TLS parser, this panic is handled by returning NULL.

This means that the parser will error out during the decoding of the
certificate. However, Suricata must be able to detect the null byte
injection attack being an IDS/IPS.

Hence, replace all such string patterns w.r.t. TLS Subject with a byte
array.

Bug 7887
 10 months ago
Shivani Bhardwaj 06eafb79d6 detect/flow-pkts: check for both dir 
The functionality of "both" can already be easily achieved by using both
"toclient" and "toserver" in a rule. This just adds the ease of
expression in rule. As it is added now, check the direction for the
pre-existing users of direction as well.
 10 months ago
Shivani Bhardwaj 77abcde9ee rust/flow: add public wrapper for dir 
in order to be able to use it on the C side for elephant flow detection.
 10 months ago
Jason Ish 50224f2ee5 rust: fix clippy warning for unused import 
While debug_validate_bug_on is still used, it does not need to be
imported directly, as that macro is marked with `macro_export`, making
it globally available to the crate.
 11 months ago
Philippe Antoine 455b7d1b3b rust: use snake case for applayer_register_protocol_detection 11 months ago
Philippe Antoine b4d8aea0ae rust: bindgen SCAppLayerRegisterProtocolDetection 
Ticket: 7662

Changing the struct passed to it to have the minimal number
of useful fields.
 11 months ago
Philippe Antoine 2349f19977 nfs: use nfsv2 procedure names with nfs_procedure keyword 
Ticket: 5140
 11 months ago
Jhonny Sousa 257ed82dbd nfs: Fix NFSv2 STATFS procedure parsing 
Ticket: #5140
 11 months ago
Philippe Antoine 15b1bf4865 rust: bindgen SCHTPFileCloseHandleRange 
Ticket: 7762
 11 months ago
Philippe Antoine cddbd0b906 rust: bindgen more file functions 
Ticket: 7762
 11 months ago
Victor Julien 80d5afe91b pop3: AUTH command handling improvements 
Better track the state so it's known when to expect a base64 request
message. Also better validate the base64.

Ticket: #7994.
 11 months ago
Victor Julien 2973eded56 pop3: convert to nom 8 
Ticket: #8127.
 11 months ago
Victor Julien da2db65f62 pop3: rustfmt 11 months ago
Jason Ish 83d8b1d2f8 quic: update to nom 8.0 
Ticket: #8140
 11 months ago
Philippe Antoine 32ce3d29be detect/krb: use flag u32 for krb5_msg_type 11 months ago
Jason Ish ef9cd7beff rust/smb: convert to nom 8 
Ticket: #8089
 12 months ago
Jason Ish 02045e1d62 rust/dcerpc: convert to nom 8 
Ticket: #8093
 12 months ago
Jason Ish 25c98af0e8 rust/detect: convert remaining detection rule parsers to nom 8 
Ticket: #8051
 12 months ago
Jason Ish dea3f9e260 rust/detect: convert error.rs and dependent parsers to nom 8 
Ticket: #8051
 12 months ago
Jason Ish efc32dea41 rust/detect: convert uint nom 8 
And users of uint directly impacted by this change.

Ticket: #8051
 12 months ago
Jason Ish cf604751de rust/util: convert to nom 8 
Ticket: #8088
 12 months ago
Jason Ish 1e01d5adca rust/conf: convert to nom 8 
Ticket: #8087
 12 months ago
Jason Ish c6e8932740 rust/asn1: convert to nom 8 
Ticket: #8086
 12 months ago
Jason Ish 59f8fb30a8 rust/ftp: fix clippy warning 
error: implicitly casting the result of `from_raw_parts_mut` to `*mut [u8]`
        --> src/ftp/response.rs:107:31
 12 months ago
Philippe Antoine cba13ed9b1 rust: bindgen functions needed for datasets 
Ticket: 7762
 12 months ago
Philippe Antoine 12892ba010 rust: bindgen functions neede for features 
Ticket: 7762
 12 months ago
Jeff Lucovsky e1bf5cb1f3 nfs: Support EXCLUSIVE4_1 flag 
Issue: 8006

Support the EXCLUSIVE4_1 create mode added to NFS 4.1
 12 months ago
Philippe Antoine 79e66f76e6 detect: icmp_id is now a generic integer 
Ticket: 7889
 12 months ago
Philippe Antoine 85fa894425 detect: dnp3.func is now a generic integer 
Ticket: 7889
 12 months ago
Philippe Antoine c61f1cb6d0 detect/integers: rename index all1 to all 
And all to all_or_absent

Ticket: 7929
 12 months ago
Philippe Antoine eb5a2d646b detect/vlan: move vlan.id keyword to generic integer 
Ticket: 7929
 12 months ago
Philippe Antoine 439f96dea7 rust: bindgen frames functions 
Ticket: 7667
 12 months ago
Philippe Antoine 92c7be1cb6 rust: bindgen SCSRepCatGetByShortname 
Ticket: 7667
 12 months ago
Philippe Antoine 7447651fa0 output/jsonbuilder: helper function SCJbSetPrintAsciiString 
To replace C PrintStringsToBuffer and avoid a stack alloc
+ copy

Ticket: 8004
 1 year ago
Li Heng 1106323ae1 rust/sip: delete redundant computing codes 
Delete call of is_alphanumeric where is_alphanumeric and
is_token_char are called together. Four places are modified.

Ticket: 8003
 1 year ago
Jason Ish 1efe70a234 rust/ike: convert to nom 8 
Ticket: #8050
 1 year ago
Jason Ish f368324e87 rust/mime: convert to nom 8 
Ticket: #8048
 1 year ago
Jason Ish c5ef615953 rust/mqtt: convert to nom 8 
Ticket: #8047
 1 year ago
Jason Ish 2289069f74 rust/websocket: convert to nom 8 
Ticket: #8046
 1 year ago
Jason Ish 9eeefd0684 rust/bt-dht: convert to nom 8 
Ticket: #8045
 1 year ago
Jason Ish 399f96b07d rust/rdp: convert to nom 8 
Ticket: #8044
 1 year ago
Jason Ish 7c70f74942 rust/telnet: convert to nom 8 
Ticket: #8043
 1 year ago
Jason Ish 2ff2eb1325 rust/ssh: convert to nom 8 
Ticket: #8042
 1 year ago
Jason Ish baa22287b8 rust/rfb: convert to nom 8 
Ticket: #8041
 1 year ago
Jason Ish dcfe247467 rust/pgsql: convert to nom 8 
Ticket: #8039
 1 year ago
Jason Ish d25286e77a rust/enip: convert to nom 8 
Ticket: #8038
 1 year ago
Jason Ish d74f8522ee rust/tftp: convert to nom 8 
Ticket: #8037
 1 year ago
Jason Ish 4b09622ebc rust/dhcp: convert to nom 8 
Ticket: #8036
 1 year ago
Philippe Antoine 772bd9ca53 rust: reduce visibility of detect_parse_uint_notending 
It is meant as an internal function

Also document the function
 1 year ago
Philippe Antoine b636dffd5b detect: urilen keyword fails on trailing junk 
Fails especailly on 1<>2 which looks like a range, but is invalid
as too small, and ended up being accepted as =1

Ticket: 8028
 1 year ago
Jason Ish 16d313cb8b rust/applayertemplate: convert to nom 8 
Ticket: #8027
 1 year ago
Jason Ish f0f4d88119 rust/sip+sdp: update to nom 8 
Done together as there is a dependence of SDP by SIP.

Ticket: #8025
 1 year ago
Jason Ish 58564a4b0e rust/ftp: update to nom 8 
Ticket: #8026
 1 year ago
Jason Ish 54cc97b78e rust/dns: convert to nom 8.0 
Ticket: #8024
 1 year ago
Philippe Antoine dc7874b2ac rust: bindgen more http range functions used in http2 
Ticket: 7667
 1 year ago
Philippe Antoine 842352c190 rust: bindgen SCHttpRangeFreeBlock 
Ticket: 7667
 1 year ago
Philippe Antoine 93785ae357 rust: bindgen SCHTTP2MimicHttp1Request 
Ticket: 7667
 1 year ago
Philippe Antoine a1613fecb4 detect: tcp.flags rejects non-sensical values 
ignored flags are only meaningful for equal mode
 1 year ago
Philippe Antoine d8cb00e795 detect/tcp: make tcp.flags a generic integer with bitflags 
Ticket: 6724

Allows to use numerical values for example

Also fixes some unit tests that were returning 1 after goto error
FlagsTestParse05 especially took this path as
de->ignored_flags != (TH_SYN|TH_RST) was false
we had de->ignored_flags == 0xff ^ (TH_SYN|TH_RST)
And then, we had a match, instead of what the not-run code
was supposing.
 1 year ago
Philippe Antoine 1f9236a6d8 detect/ipv4: make fragbits a generic uint16 bitflags keyword 
Ticket: 6724

Allows to use numerical values
 1 year ago
Philippe Antoine 633180c93f detect/integers: generalize support for bitflags modifier 
Ticket: 6724

Allows sugar syntax for bitflags keywords.
While the expressivity does not increase, because we could already
use numerial values with all generic integer modes, this modifier
prefix is used with the strings, and follows the syntax
that is already used for fragbits and tcp.flags keyword.
 1 year ago
Jason Ish bc33bd49eb quic/crypto: remove use of GenericArray 
Its not needed, and gets rid of the deprecation warnings.
 1 year ago
Jason Ish bdfdf7ff33 rust: update deps with cargo-update 
Suppress deprecation warnings in quick/crypto.rs about GenericArray.
 1 year ago
Jason Ish 6fdf0d736b rust: update aes-gcm to 0.10.3 1 year ago
Jason Ish b9517de86e rust: update aes to 0.8.4 1 year ago
Philippe Antoine 4b69a31dc3 detect/integers: count argument for multi-integers 
Ticket: 7211

Allows to count the number of elements, without matching on
individual elements
 1 year ago
Philippe Antoine 3babd68af4 pop3: count retr_data into consumed 
for later AppLayerResult::incomplete

Fixes: acef961645 ("pop3: improve parsing")

https://issues.oss-fuzz.com/u/1/issues/451112373

Ticket: 7994
 1 year ago
Philippe Antoine 9a4a29e218 http2: fix parsing of goaway frames 
There was a last stream id before the error code
As per section 6.8 of RFC 7540

Ticket: 7991
 1 year ago
Philippe Antoine 7f0087f19a rust/detect: fix correct pointer type in SCDetectU32ArrayFree 1 year ago
Philippe Antoine 969739d067 detect: http2.errorcode is now a generic integer 
Ticket: 7889
 1 year ago
Philippe Antoine 401b2fcae6 detect: http2.frametype is now a generic integer 
Ticket: 7889
 1 year ago
Philippe Antoine 454f73b445 rust: EnumString derive accepts a enum_string_style parameter 
So that http2.frametype and http2.errorcode can use EnumString
without changing the format, as they used UPPERCASE instead of
the default EnumString snake_case
 1 year ago
Victor Julien acef961645 pop3: improve parsing 
Improve multiline commands and SASL auth.

Work around missing support in crate for empty server challenge and SASL base64 data.

Ticket: #7709.
 1 year ago
Jason Ish 5e2dc9ace3 ike: don't log empty server objects 1 year ago
Jason Ish 2d86412f46 ike: log attributes as objects 
IKE attributes are an array of TLV style objects, this means there can
be duplicate types seen on the wire. However, Suricata logs these as a
mapping with the type as the key. This can result in the JSON
containing duplicate keys.

To address this, log the attributes as an array of objects, allow
duplicates to exist, for example:

  "client": {
    "proposals": [
      {
        "sa_life_duration": "Unknown",
        "sa_life_duration_raw": 86400,
      }
    }
  }

is now logged as:

  "client": {
    "proposals": [
      {"key": "sa_life_duration", "value": "Unknown", "raw": 86400}
    ]
  }

Also adds `"version": 2` to each IKE record to note the change of
format from previous versions.

Ticket: #7902
 1 year ago
Jason Ish b543e28402 ike/detect: info log message should be debug 1 year ago
Philippe Antoine a393147415 rust: restrict visibility of reexported suricata_sys structs 1 year ago
Philippe Antoine 958344787f rust: bindgen FileAppendData 
Ticket: 7667
 1 year ago
Philippe Antoine 811d28cc6b rust: bindgen util-spm-bs.h 
for SCBasicSearchNocaseIndex

Ticket: 7667
 1 year ago
Jeff Lucovsky 0e547b9519 rust/conf: Accept xiB unit suffixes 
Update the memval to recognize
- kb and kib
- mb and mib
- gb and gib
as equivalent.
 1 year ago
Philippe Antoine 56e08c9134 mime: retain some stateful data for quoted-printable 
In case a sequence like =3D is split over 2 calls to SCSmtpMimeParseLine

Ticket: 7950
 1 year ago
Philippe Antoine 096ba42ce9 detect/integers: add some meaningful error messages 
To help rule writers
 1 year ago
Philippe Antoine 4f7fc25a1a detect/dnp3: make dnp3.ind a generic uint16 bitflags keyword 
Ticket: 6724

Allows operations such as negation
 1 year ago
Philippe Antoine c1917dec21 detect/integers: make mqtt use generic detect_parse_uint_bitflags 
Ticket: 6724
 1 year ago
Philippe Antoine 867f5bfa21 detect/integers: generic detect_parse_uint_bitflags 
Ticket: 6724

This will ease other keywords with bitflags, by having a generic
function + an association between flag string and bit value.
 1 year ago
Philippe Antoine 3641b4eda1 detect/nfs: move nfs_procedure to rust 
Make it able to use strings on the way

Ticket: 6723
 1 year ago
Philippe Antoine 9869fb776b detect/snmp: pdu_type keyword now accepts strings 
Ticket: 6723
 1 year ago
Philippe Antoine 0553dfa814 detect/krb5: move krb5_msg_type to rust 
Makes it a generic u32 on the way

Unit tests are covered by SV tests

Ticket: 6723
 1 year ago
Philippe Antoine 24503b0ead rust: move file functions out of SuricataContext 
Ticket: 7667
 1 year ago
Philippe Antoine 1f084f8cb7 rust: move HttpRangeFreeBlock out of SuricataContext 
Ticket: 7667
 1 year ago
Philippe Antoine 828a6bdbf8 rust: bindgen SCLogMessage 
Ticket: 7667
 1 year ago
Philippe Antoine cc845dccdb rust: bindgen GenericVarFree 
Ticket: 7667
 1 year ago
Philippe Antoine b00788af8b rust: bindgen SCAppLayerParserTriggerRawStreamInspection 
Ticket: 7667
 1 year ago
Philippe Antoine c52121586a rust: move AppLayerEvents funcs out of RustContext 
Ticket: 7667

just use it directly, with bindgen, and cfg not test
 1 year ago
Philippe Antoine bf6b8510fe rust: move DetectEngineStateFree out of RustContext 
Ticket: 7667

just use it directly, with bindgen, and cfg not test
 1 year ago
Philippe Antoine 573dd2367e rust: bindgen SCFileFlowFlagsToFlags 
Ticket: 7667
 1 year ago
Philippe Antoine 6fa85d18f0 rust: reenable lint unused_doc_comment 
With just local exceptions
 1 year ago
Philippe Antoine b59086210f rust: bindgen flow ffi API 
Ticket: 7667
 1 year ago
Philippe Antoine bbf1424371 rust: bindgen MpmAddPatternCI 
Ticket: 7667
 1 year ago
Philippe Antoine c391451f19 rust: begin to bindgen app-layer-register.h 
Ticket: 7667
 1 year ago
Philippe Antoine 95483228d2 detect: list-keywords cli shows integers with bitflags 
Ticket: 7875
 1 year ago
Philippe Antoine 53d9569dfb detect: list-keywords cli shows integers with enums 
Ticket: 7875
 1 year ago
Philippe Antoine da486af881 detect: list-keywords cli shows integers 
Ticket: 7875
 1 year ago
Philippe Antoine 68017d3fe1 detect: grow SigTableElmt flags to u32 
to be later able to store information about keywords being about
integers
 1 year ago
Philippe Antoine b298bce0e7 detect: list-keywords cli shows multi-buffers 
Ticket: 7571
 1 year ago
Philippe Antoine cb9ab951b9 detect/integers: subslice for multi-integers 1 year ago
Philippe Antoine 82f0e725a2 detect/integers: index or_absent and or_oob 
To match if array is empty, or index is out of bounds
 1 year ago
Philippe Antoine 1480cf47ab detect/integers: nb index to match a specific number of times 
For example
dns.rrtype: !A,nb>3
will match if we have more than 3 dns records which are not A
 1 year ago
Philippe Antoine 6f848eeaaf detect/integers: all1 index to match only on non-empty arrays 1 year ago
Philippe Antoine dd81cfa733 detect/uint: wait for end of progress to match on all 
As is done for absent keyword for instance
 1 year ago
Philippe Antoine 5add185f22 http2/detect: http2.window can now use index 
Ticket: 7480
 1 year ago
Philippe Antoine 83868778b9 http2/detect: http2.priority can now use index 
Ticket: 7480
 1 year ago
Philippe Antoine 9fc407fd75 mqtt/detect: mqtt.type can now use index 
Ticket: 7480
 1 year ago
Philippe Antoine c0988252ba dns/detect: rrtype can now use index 
Ticket: 7480
 1 year ago
Philippe Antoine d8c1f8e7be rust/detect: generic detect_uint_match_at_index 
and make ldap use it

Ticket: 7480

No behavior change, just code restyling
 1 year ago
Philippe Antoine 7effcb7835 rust/ldap: use Vec instead of Vecdeque 
as we do not pop

Ticket: 7480

May have a behavior change, but only in terms of performance
 1 year ago
Philippe Antoine f555f02ed4 rust/detect: generic detect_parse_array_uint_enum 
And make ldap use it

Ticket: 7480

No behavior change, just code restyling
 1 year ago
Philippe Antoine c6d3857793 rust/detect: create generic DetectUintArrayData 
And make ldap use them

Ticket: 7480

No behavior change, just code restyling
 1 year ago
Philippe Antoine e01d19889e rust/detect: move DetectUintIndex definition to generic file 
Ticket: 7480

No behavior change, just code restyling
 1 year ago
Philippe Antoine ef6ce7d701 detect: rename LdapIndex to something generic 
to be able to use it outside of ldap

Ticket: 7480

No behavior change, just code restyling
 1 year ago
Philippe Antoine 2ed7a85356 rust: rustfmt detect uint 1 year ago
Alice Akaki 8e0b0ef35f detect: add email.body_md5 keyword 
email.body_md5 matches on md5 hash generated from email body
This keyword maps to the EVE field email.body_md5
It is a sticky buffer
Supports prefiltering

Ticket: #7587
 1 year ago
Alice Akaki 6c88cc1e0c detect/mime: fix detect mime nits 
Return 0 if .to_str() fails in functions
SCDetectMimeEmailGetData and SCDetectMimeEmailGetDataArray

Fixes:
431822c ("detect: add email.from")
96e461f ("detect: add email.received keyword")
 1 year ago
Alice Akaki 4f1cc19f25 mime/smtp: Change md5_result type from GenericArray<u8, U16> to String 1 year ago
Philippe Antoine d0a513df6a detect/integers: support kibibyte unit 
Ticket: 7869
 1 year ago
Jeff Lucovsky 03d676531a detect/from_base64: Support keyword w/no opts 
Issue: 7853

Support the use of `from_base64` with no optional values. In this case,
the default values for:
- mode RFC4648
- offset: 0
- bytes: buffer size
will be used.
 1 year ago
Jason Ish b93a27722c rust: fix mismatched_lifetime_syntaxes warning 
Fix new warning present in Rust 1.89.

warning: hiding a lifetime that's elided elsewhere is confusing
   --> src/ldap/types.rs:191:30
    = help: the same lifetime is referred to in inconsistent ways, making the signature confusing
    = note: `#[warn(mismatched_lifetime_syntaxes)]` on by default
help: use `'_` for type paths
 1 year ago
Philippe Antoine fe9da8acd6 http2: do not log empty objects for request or response 
Ticket: 7741
 1 year ago
Philippe Antoine 11c549211e snmp: fix the possibility to disable the parser 
Ticket: 7820

Do not register anything, not even ALPROTO_SNMP "snmp" string
if parser is disabled
 1 year ago
Philippe Antoine fa8d3a4ccb http2: do not set file flags for global txs 
Global txs means here txs with stream id 0, used for connection control
messages.
 1 year ago
Philippe Antoine 349c21af2c http2: mark old txs as updated 
As is done in the other case a few lines below
 1 year ago
Philippe Antoine 1d6d331752 http2: forbid data on stream 0 
Ticket: 7658

Suricata will not handle well if we open a file for this tx,
do not close it, but set the transaction state to completed.

RFC 9113 section 6.1 states:

If a DATA frame is received whose Stream Identifier field is 0x00,
the recipient MUST respond with a connection error (Section 5.4.1)
 of type PROTOCOL_ERROR.
 1 year ago
Philippe Antoine 10150e95ad rust: allow collapsible_else_if for debug logs 
see https://github.com/rust-lang/rust-clippy/issues/15158
 1 year ago
Jeff Lucovsky 7e713cb45a detect/analyzer: Support u8 types 
Issue: 6359

Support JSON output of u8 types
 1 year ago
Philippe Antoine bca6cbfb04 rust: fix prototype for AppLayerParserTriggerRawStreamInspection 
Ticket: 7762

As it modifies the flow indeed
 1 year ago
Philippe Antoine 59a5b53809 util/mpm: constify arg 
and make rust version use the correct integer type

Ticket: 7762
 1 year ago
Pierre Chifflier adcee8d7b5 ldap: avoid unneeded renaming of variables 1 year ago
Pierre Chifflier ebc1678c5c ldap: fix clippy warnings (unneded conversions) 1 year ago
Pierre Chifflier bda22c1f4a ldap: factorize code and remove duplicated structs, use ldap_parser where relevant 1 year ago
Pierre Chifflier c152c5c7e0 ldap: update ldap-parser to 0.5.0 1 year ago
Philippe Antoine 6dbc421825 rust: bindgen AppLayerParserConfParserEnabled 
Ticket: 7667
 1 year ago
Philippe Antoine 49b2a2be5d rust: bindgen SCAppLayerParserRegisterLogger 
Ticket: 7667
 1 year ago
Philippe Antoine 7bfef2e1e8 rust: bindgen AppLayerParserRegisterParserAcceptableDataDirection 
Ticket: 7667
 1 year ago
Philippe Antoine 1ff4dbfc24 rust: bindgen AppLayerParserSetStreamDepth 
Ticket: 7667
 1 year ago
Philippe Antoine b29d46d81f rust: bindgen SCAppLayerParserStateIssetFlag 
Ticket: 7667
 1 year ago
Philippe Antoine 6d56beffef rust: bindgen AppLayerParserStateSetFlag 
Ticket: 7667
 1 year ago
Shivani Bhardwaj 16eb56aa73 sip: fix inspection direction 1 year ago
Jason Ish f0411c079d rust: fix compiler warning for confusing lifetimes 
For example:

error: lifetime flowing from input to output with different syntax can be confusing
   --> htp/src/headers.rs:475:16
    |
475 | fn null(input: &[u8]) -> IResult<&[u8], ParsedBytes> {
    |                ^^^^^             -----  ----------- the lifetimes get resolved as `'_`
    |                |                 |
    |                |                 the lifetimes get resolved as `'_`
    |                this lifetime flows to the output
    |
note: the lint level is defined here
   --> htp/src/lib.rs:3:9

This currently only happens when using the Rust nightly compiler, which
we use for our fuzz builds.
 1 year ago
Jason Ish 332bc6a05b rust: fix new clippy issues with MSRV update 1 year ago
Jeff Lucovsky a292670443 detect/entropy: Add calculated entropy value to flowvars 
When the entropy keyword is used, record the calculated entropy value to
a flow variable for logging use.
 1 year ago
Philippe Antoine 79544d0f1e rust: remove some unneeded cbindgen:ignore 
Ticket: 7667
 1 year ago
Philippe Antoine 7bb0c94ae9 rust: bindgen app-layer-detect-proto.h 
Ticket: 7667
 1 year ago
Juliana Fajardini 765041dcdd pgsql: fix clippy warnings 1 year ago
Juliana Fajardini be47de4f6d pgsql: fix typo in comment that changed meaning 1 year ago
Juliana Fajardini 88fdfb9d5a pgsql: debug validation on duplicated request msgs 
There shouldn't be duplicated messages in the requests Vec. And thus
the parser shouldn't log duplicated keys nor messages. Add debug
validations to ensure this.

With PGSQL's current state machine, most frontend/ client messages will
lead to the creation of a new transaction - which would prevent
duplicated messages being pushed to the requests array and reaching the
logger.

The current exceptions for that are:

- CopyDataIn
- CopyDone
- CopyFail

Thus, debug statements were added for those cases.

CopyDone and CopyFail, per the documentation, shouldn't be seen
duplicated on the wire for the same transaction. CopyDataIn -- yes, but
we consolidate those, so the expectation is that they won't be
duplicated in the requests array or when reaching the logger either.

Related to
Task #7645
 1 year ago
Juliana Fajardini f4439c520c pgsql: separate request completion and state type 
Since some of state types could indicate a request completion, don't
process them in if/else statements.

Related to
Task #7645
 1 year ago
Juliana Fajardini 68acc0cfcb pgsql: be more strict with pub usage 
Review pub visibility to:
Make it pub crate-only wherever possible.
Remove pub altogether where not-needed.
 1 year ago