19347 Commits (7bc883ef939ed4ec1283afb62aaea0a5bad9abce)

 

All Branches   

Search

Author	SHA1	Message	Date
Jeff Lucovsky	7bc883ef93	detect/transforms: disqualify variable-key transforms from prefilter ... A transform that derives its key material from a runtime byte_extract or byte_math variable cannot have its buffer precomputed at load time, so the content of that buffer is unusable as a fast_pattern. Add the engine plumbing to recognise such transforms and keep them out of prefilter/MPM. SignatureInitData gains a var_transform flag. RetrieveFPForSig bails out for any signature that sets it, so the signature falls back to full inspection rather than contributing an MPM pattern that can't be built ahead of time. New helpers support a transform consuming a variable: - SCSignatureSetVarTransform() raises the disqualification flag. - SCDetectByteVarResolve() resolves a byte_extract or byte_math variable by name to its runtime slot, and for a byte_extract reports its natural key width (a byte_math result has none). - SCDetectEngineThreadCtxGetByteVar() reads a byte_* variable's runtime value from the thread context. The helpers are declared in detect-engine-buffer.h so the bindgen run picks them up; the Rust bindings are regenerated to match. Issue: 7847	3 months ago
Victor Julien	8455efd9ac	app-layer: add substate support to list hooks ... Add substates to the --list-app-layer-hooks option.	4 months ago
Victor Julien	8a5e8c63b2	detect: strict validation of buffers ... Make sure that every buffer in a signature is actually used in the setup of the engines. Reject sigs that are locked to a certain substate and use buffers that require another.	4 months ago
Victor Julien	89baff01c9	output/tx: allow registering logging at substate ... Register HTTP/2 and DOH2 this way.	4 months ago
Victor Julien	a824d97d71	detect: use sub state to select inspect engines ... When building the per signature app_inspect list, only add engines that match the sub state specified in the hook.	4 months ago
Victor Julien	c5d4a250b5	detect/firewall: avoid passing state match for policy	4 months ago
Victor Julien	9a294bf73b	app-layer: check if protocol is enabled for sub state callbacks	4 months ago
Victor Julien	f545f06cf2	doh2: do not enable parser if http2 is disabled ... DOH2 depends on HTTP/2, so it makes no sense to enable it separately. It would also put the sub state handling in a weird state, as the DOH2 side reuses the registered HTTP/2 callbacks.	4 months ago
Victor Julien	cf216b6309	http2: rename state *start to *started ... This is to make the hook use names consistent with the default hooks and other protocols.	4 months ago
Victor Julien	f8f28c6f6f	detect: sync prefilter and app inspect alproto logic ... In firewall mode the alproto logic when building prefilter and rule engines is strict, but was out of sync between prefilter and rule app inspect engines. For SIGNATURE_HOOK_TYPE_APP rules the logic is strict, with an exception for HTTP/2 and DOH2. DOH2 is not a full protocol implementation, but rather HTTP/2 with a different alproto. Fixes: d64954a873 ("detect: don't register unrelated inspect engines")	4 months ago
Victor Julien	56d9670af7	eve/alert: log sub state progress values	4 months ago
Victor Julien	f02a427059	eve/alert: clean up state logging	4 months ago
Victor Julien	110e74642e	detect/firewall: harden policy lookup logic	4 months ago
Victor Julien	cfc98aeeaf	detect: add debug validation checks to assert assumptions	4 months ago
Victor Julien	7517ba9f98	detect: give clear errors for http2 w/o substate ... http2 states were not yet supported even if the built-in states could already work. Clearly error out on a hook w/o substate.	4 months ago
Victor Julien	e4176d2b9a	detect/firewall: support substate in analyzer	4 months ago
Victor Julien	2511070a58	detect/firewall: support lte mode for substate	4 months ago
Victor Julien	e1e24d6cb4	eve/alert: add sub state output	4 months ago
Victor Julien	7e60c3205e	detect/alert: store sub-state in PacketAlert ... In preparation of being able to log it.	4 months ago
Victor Julien	17a3e0d44f	app-layer: use macro for progress ceiling	4 months ago
Victor Julien	2e1003a026	detect: add debug validation checks ... Check that sub state handling is correct.	4 months ago
Victor Julien	af1c72c37e	detect/mpm: don't register engines for disabled protocols	4 months ago
Victor Julien	3b6b381f90	detect/firewall: add default alert signature to policy object ... Now that there is a policy hash, make the alert signature object a member of that to avoid another hash table lookup.	4 months ago
Victor Julien	bffea309db	detect/firewall: implement app policy as hash table ... With substate support the fixed table approach for policies was no longer a good fit, so convert to a hash table. The policies are stored per alproto, sub_state, progress and direction.	4 months ago
Victor Julien	eb87137471	detect/parse: allow bigger protocol/hook specifications	4 months ago
Victor Julien	6a3f9bc0b0	app-layer: for sub state API treat DOH2 as HTTP/2 ... Otherwise we'd have to re-register the relevant callbacks.	4 months ago
Victor Julien	956030452f	detect/parse: don't setup sub states if protocol doesn't support it	4 months ago
Victor Julien	bb41ef9caf	http2: update push promise to account for stream id 0 filtering	4 months ago
Victor Julien	c17ab6a65e	http2: set event on frame types not allowed on stream id	4 months ago
Victor Julien	3ef0d2ce16	detect/parse: parse sub state hooks ... Register a generic list for each sub state / progress combo.	4 months ago
Victor Julien	116a060092	detect/firewall: policy for substates ... For the most part hard coded for HTTP/2 for now.	4 months ago
Victor Julien	63b8143577	http2: register names for states per sub-state	4 months ago
Victor Julien	14100d795c	http2: mark HTTP2TxProgress and HTTP2TxGlobalProgress as AppLayerState	4 months ago
Victor Julien	cedb836d01	output/dns: update for DOH2 change	4 months ago
Victor Julien	5735b87c3a	detect: change how DOH2 inspection works ... DNS/HTTP2 no longer automatically registers all keywords also for DOH2. Instead, the DNS keywords and HTTP/2 stream keywords are registered for DOH2 explicitly as well. - flow alproto DOH2 + engine DOH2 -> inspect inner DNS - flow alproto DOH2 + engine HTTP2 -> inspect outer HTTP/2 - flow alproto DOH2 + engine UNKNOWN -> inspect outer HTTP/2	4 months ago
Victor Julien	17953d2355	detect/http: register keywords for HTTP/2 ... Now that HTTP keywords are no longer automatically registered for HTTP/2, register them manually.	4 months ago
Victor Julien	b36ec146aa	detect/dns: register keywords for DOH2 as well ... Now that DNS keywords are no longer registered for DOH2, the keywords need to manually registered for DOH2.	4 months ago
Victor Julien	1bb843d83f	detect/http2: don't double register engines ... Each keyword supporting DOH2 must register explicitly	4 months ago
Victor Julien	416b9c12ae	detect/file: register http/2 with sub-state	4 months ago
Victor Julien	c943de4fac	detect/parse: initial http2 substate support ... Hard coded for now.	4 months ago
Victor Julien	7ebc699df0	http2: split transaction state machines ... Split into 2 sub-states: - stream, which has the "HTTP" requests and responses, including DOH2 - global, which has the settings and other global or control handling Introduce a simpler progress tracking for the global sub state: - HTTP2ProgGlobalStart and HTTP2ProgGlobalComplete. The stream sub state uses the same state machine as before. Ticket: #8386.	4 months ago
Victor Julien	2f41e0ef2d	output/tx: support substate completion flags	4 months ago
Victor Julien	67e2cb538a	detect/app-layer-event: support sub-state progress handling	4 months ago
Victor Julien	59e2c5a40c	detect/parse: initial substate support	4 months ago
Victor Julien	95365ce05b	detect: support per tx sub states ... Support for per transaction sub states: different state machines per transaction type. Skip engines not belonging to our substate. Store tx_type in DetectTransaction. Each protocol supporting sub states will register states from 1 and up. To support: Ticket: #8386.	4 months ago
Victor Julien	b6bc025789	app-layer: start of substate API support ... Allow registration of per substate progress name mappings. Implement logic for getting sub-state names, id's. Add transaction type and end of progress values to AppLayerTxData. Introduce helpers to keep logic clean.	4 months ago
Shivani Bhardwaj	06db2e2698	detect/flowbits: add max usage per signature limit ... Add a limit on the maximum number of times flowbits keyword that can be used in a signature. Task 8596	4 months ago
Shivani Bhardwaj	3462b126a3	detect: add max_flowbits option ... Also move field around to pack holes and align the struct better. Task 8596	4 months ago
Jason Ish	842b14ee1f	smtp: don't create transaction for trailing quit ... Also ensures that a quit or rset without a helo still creates a tx. Ticket: #8728	4 months ago
Jason Ish	e2a62dd1c0	smtp: handle pipelined replies on owning tx ... Track the transaction id for each queued SMTP command so replies can update the transaction that created the command instead of always using the current transaction. Ticket: #8393	4 months ago