Every hook has a built-in default policy, but expressing anything other
than the built-in meant naming each hook explicitly.
This commit adds a `default-policy` setting that covers all hooks below it.
For any hook the most specific setting present wins.
DoParseAppSubStatePolicy() collapses into DoParseAppPolicy() as a sub state
hook only differs by an extra path segment.
Ticket: 8712
Mapping an app-layer progress state to its generic request-/response-
hook alias was hardcoded in multiple places.
This commit adds a wrapper to unify it to a single function.
It returns the config-form (hyphenated) name, or NULL for an
intermediate state.
Ticket: 8712
Previously, a rule that had firewall-only syntax or keywords would fail
the script check.
Since we can't guarantee that a firewall rule will look different than a
detection one, run rule examples against both scenarios before failing
them.
If the point is to check the docs for added changes, it makes sense to
that used binary is the one that comes with the doc changes. Thus, try
using the local binary first, before falling back to usr/bin installed
Suricata.
Introduce the tcp.session: keyword that accepts a comma-separated subset
of {setup, established, closing} and matches packets whose TCP session
state falls within the named phases.
This lets a rule writer cover the full TCP lifecycle in one rule instead
of separate flow:not_established + flow:established rules.
Changes:
- New detect-tcp-session.{c,h} with parser, match function, unit tests
- Register DETECT_TCP_SESSION in detect-engine-register.{c,h}
- Add to Makefile.am source list
- Extend engine-analyzer text output for tcp.session:
- Extend firewall.json keyword_info with tcp_session phase values
- Update flow-keywords.rst documentation
- Require TCP protocol and SIG_FLAG_REQUIRE_PACKET at setup
Ticket: 7704
IPOnly Engine does not support parsing and recording IPv6 ranges. So,
passing a range of ipv6 there just results in non-fatal errors in
parsing the IP addresses which means they fail to be added to the radix
tree struct.
Re-classify the ipv6 ranges as like_ip_only so they fall out of the
IPOnly engine and are processed per packet.
Ticket: 8847
Add accessor functions to allow NDPI and our plugin examples to access
flow fields in an opaque manner.
Provides accessors for:
- is ipv4
- is ipv6
- ip protocol
- to server packet count
- to destination packet count
Ticket: #8632
Remove the check for Flow.storage being NULL. With flex arrays, as long as the
flow is allocated, .storage will never be NULL. We do make sure the flow
is not NULL, and the storage functions are safe to the storage being
NULL.
Prevents NDPI from accessing this flow field to be less sensitive to ABI
changes with respect to data structure sizes.
Ticket: #8632
RFC 5321 says a mid-session EHLO should work just like RSET. We more or
less ignored it, which meant transaction state could carry over.
Treat a HELO/EHLO received during a transaction as RSET once the server
accepts it.
Ticket: #8715
The policy config was a flat map mixing packet hooks and app-layer
protocols: `packet-filter` next to `dns`. There was no node that meant
"the packet hooks" or "the app-layer hooks", so a setting could not be
scoped to one group.
Move each group under its own node:
packet-filter -> packet.filter
packet-pre-flow -> packet.pre-flow
packet-pre-stream -> packet.pre-stream
<proto>.<hook> -> app.<proto>.<hook>
Ticket: 8712
AppProtoToString(ALPROTO_HTTP1) returns "http", so an HTTP/1 policy had to
be written as `http:` while its rule hooks were already spelled `http1:`.
Use the same name in both places.
Ticket: 8712
To avoid back-and-forth of http1 conversion
a second query function was added to support
existing use cases.
This change will be handy for the upcoming
default-policy for firewall settings
This is required when rustc is not in a standard path. The other
cbindgen calls already had this, so it was just missed while adding the
ffi bindings, but shows up when rustc is at a path like
/usr/lib/rust-1.89/bin/rustc, but that directory is not in your path.
Disable the clippy warning for not using modern C string
literals. Ubuntu 24.04 still ships cbindgen 0.26.0 that doesn't
support these, so migrating to modern C string literals would require
Ubuntu 24.04 users wishing to build from git to install cbindgen with
cargo.
Debian 13 ships Rust 1.85 by default, Ubuntu requires installing a
specific patch to get newer then 1.75. So to support a newer MSRV,
these operating systems need different examples.
Analyzer arrays store internal IDs of the signature for an easy lookup
later from the DetectEngineCtx. However, the storage arrays were
inappropriately named as sid arrays. Make it coherent.
Bring Analyzer structs and fns to the header for later use in a wider
context.
Ticket: 8678
With an inspect window of 0xAAAAAAAB the `window * 3` guard wrapped to 1
in uint32_t arithmetic, so it passed for a 64 byte file and
content_inspected was set to `file->size - window`, an underflow.
Ticket: 8678
In FilePruneFile() `window * 3` was computed in uint32_t arithmetic.
The guard exists to ensure `file->size > window`, so on wrap around
`file->size - window` underflows and content_inspected is set to a
bogus value, breaking file inspection.
Make window uint64_t so the multiplication cannot wrap.
With this patch, the logged uuids will also have corresponding
stringified service names. The requests that will have an opnum will
have a corresponding stringified procedure name.
Feature 2727
Feature 8523
This data directly comes from Zeek @d11a8750. It was scriptually
converted to NDJSON ingestible to Suricata using serde and serde_json.
The script used for this conversion lives in
scripts/extract_dce_rpc_interfaces.py.
Part of this data within Zeek codebase comes from the MITRE BZAR
project. Hence, the LICENSE file alongwith this data consists of both
the licenses: Zeek and BZAR.
Feature 2727
Feature 8523
Philippe Antoine
Lukas Sismis
Jason Ish
Juliana Fajardini
Yash Datre
Shivani Bhardwaj
Denis Balashov