Commit Graph

2042 Commits (92c7be1cb672a0ad4e06e27450921e4fcaebe9f5)

Author SHA1 Message Date
Philippe Antoine 92c7be1cb6 rust: bindgen SCSRepCatGetByShortname
Ticket: 7667
12 months ago
Philippe Antoine 7447651fa0 output/jsonbuilder: helper function SCJbSetPrintAsciiString
To replace C PrintStringsToBuffer and avoid a stack alloc
+ copy

Ticket: 8004
1 year ago
Li Heng 1106323ae1 rust/sip: delete redundant computing codes
Delete call of is_alphanumeric where is_alphanumeric and
is_token_char are called together. Four places are modified.

Ticket: 8003
1 year ago
Jason Ish 1efe70a234 rust/ike: convert to nom 8
Ticket: #8050
1 year ago
Jason Ish f368324e87 rust/mime: convert to nom 8
Ticket: #8048
1 year ago
Jason Ish c5ef615953 rust/mqtt: convert to nom 8
Ticket: #8047
1 year ago
Jason Ish 2289069f74 rust/websocket: convert to nom 8
Ticket: #8046
1 year ago
Jason Ish 9eeefd0684 rust/bt-dht: convert to nom 8
Ticket: #8045
1 year ago
Jason Ish 399f96b07d rust/rdp: convert to nom 8
Ticket: #8044
1 year ago
Jason Ish 7c70f74942 rust/telnet: convert to nom 8
Ticket: #8043
1 year ago
Jason Ish 2ff2eb1325 rust/ssh: convert to nom 8
Ticket: #8042
1 year ago
Jason Ish baa22287b8 rust/rfb: convert to nom 8
Ticket: #8041
1 year ago
Jason Ish dcfe247467 rust/pgsql: convert to nom 8
Ticket: #8039
1 year ago
Jason Ish d25286e77a rust/enip: convert to nom 8
Ticket: #8038
1 year ago
Jason Ish d74f8522ee rust/tftp: convert to nom 8
Ticket: #8037
1 year ago
Jason Ish 4b09622ebc rust/dhcp: convert to nom 8
Ticket: #8036
1 year ago
Philippe Antoine 772bd9ca53 rust: reduce visibility of detect_parse_uint_notending
It is meant as an internal function

Also document the function
1 year ago
Philippe Antoine b636dffd5b detect: urilen keyword fails on trailing junk
Fails especailly on 1<>2 which looks like a range, but is invalid
as too small, and ended up being accepted as =1

Ticket: 8028
1 year ago
Philippe Antoine 2e9027fd5a plugins: update SC_API_VERSION to 9
So that plugins built for 8 will fail to load with 9 as there
were already breaking changes in the structures and functions
prototypes
1 year ago
Jason Ish 16d313cb8b rust/applayertemplate: convert to nom 8
Ticket: #8027
1 year ago
Jason Ish f0f4d88119 rust/sip+sdp: update to nom 8
Done together as there is a dependence of SDP by SIP.

Ticket: #8025
1 year ago
Jason Ish 58564a4b0e rust/ftp: update to nom 8
Ticket: #8026
1 year ago
Jason Ish 54cc97b78e rust/dns: convert to nom 8.0
Ticket: #8024
1 year ago
Jason Ish 16c42da57e rust: add nom8 as a dependency
For the update from nom 7 to nom 8.
1 year ago
Jason Ish 0990c9dbf6 rust: pin indexmap
Newer indexmap, pulled in by serde_json requires Rust 1.82, so pin
pack to 2.11.4 which still works with Rust 1.75.
1 year ago
Philippe Antoine dc7874b2ac rust: bindgen more http range functions used in http2
Ticket: 7667
1 year ago
Philippe Antoine 842352c190 rust: bindgen SCHttpRangeFreeBlock
Ticket: 7667
1 year ago
Philippe Antoine 93785ae357 rust: bindgen SCHTTP2MimicHttp1Request
Ticket: 7667
1 year ago
Philippe Antoine a1613fecb4 detect: tcp.flags rejects non-sensical values
ignored flags are only meaningful for equal mode
1 year ago
Philippe Antoine 31e9cb55be detect: tcp.flags unit tests improvements
Tests better the ignored flags functionality.
This functionality is only used at detection for default mode,
it is not used for any, plus or not mode.

So, have unit tests about igored flags with default mode with
both matching and non matching cases
1 year ago
Philippe Antoine d8cb00e795 detect/tcp: make tcp.flags a generic integer with bitflags
Ticket: 6724

Allows to use numerical values for example

Also fixes some unit tests that were returning 1 after goto error
FlagsTestParse05 especially took this path as
de->ignored_flags != (TH_SYN|TH_RST) was false
we had de->ignored_flags == 0xff ^ (TH_SYN|TH_RST)
And then, we had a match, instead of what the not-run code
was supposing.
1 year ago
Philippe Antoine 1f9236a6d8 detect/ipv4: make fragbits a generic uint16 bitflags keyword
Ticket: 6724

Allows to use numerical values
1 year ago
Philippe Antoine 633180c93f detect/integers: generalize support for bitflags modifier
Ticket: 6724

Allows sugar syntax for bitflags keywords.
While the expressivity does not increase, because we could already
use numerial values with all generic integer modes, this modifier
prefix is used with the strings, and follows the syntax
that is already used for fragbits and tcp.flags keyword.
1 year ago
Philippe Antoine f25194480c libhtp: fix newer clippy lints with newer MSRV 1 year ago
Jason Ish bc33bd49eb quic/crypto: remove use of GenericArray
Its not needed, and gets rid of the deprecation warnings.
1 year ago
Jason Ish bdfdf7ff33 rust: update deps with cargo-update
Suppress deprecation warnings in quick/crypto.rs about GenericArray.
1 year ago
Jason Ish 6fdf0d736b rust: update aes-gcm to 0.10.3 1 year ago
Jason Ish b9517de86e rust: update aes to 0.8.4 1 year ago
Philippe Antoine 4b69a31dc3 detect/integers: count argument for multi-integers
Ticket: 7211

Allows to count the number of elements, without matching on
individual elements
1 year ago
Philippe Antoine 3babd68af4 pop3: count retr_data into consumed
for later AppLayerResult::incomplete

Fixes: acef961645 ("pop3: improve parsing")

https://issues.oss-fuzz.com/u/1/issues/451112373

Ticket: 7994
1 year ago
Philippe Antoine 9a4a29e218 http2: fix parsing of goaway frames
There was a last stream id before the error code
As per section 6.8 of RFC 7540

Ticket: 7991
1 year ago
Philippe Antoine 7f0087f19a rust/detect: fix correct pointer type in SCDetectU32ArrayFree 1 year ago
Philippe Antoine 969739d067 detect: http2.errorcode is now a generic integer
Ticket: 7889
1 year ago
Philippe Antoine 401b2fcae6 detect: http2.frametype is now a generic integer
Ticket: 7889
1 year ago
Philippe Antoine 454f73b445 rust: EnumString derive accepts a enum_string_style parameter
So that http2.frametype and http2.errorcode can use EnumString
without changing the format, as they used UPPERCASE instead of
the default EnumString snake_case
1 year ago
Victor Julien acef961645 pop3: improve parsing
Improve multiline commands and SASL auth.

Work around missing support in crate for empty server challenge and SASL base64 data.

Ticket: #7709.
1 year ago
Jason Ish 5e2dc9ace3 ike: don't log empty server objects 1 year ago
Jason Ish 2d86412f46 ike: log attributes as objects
IKE attributes are an array of TLV style objects, this means there can
be duplicate types seen on the wire. However, Suricata logs these as a
mapping with the type as the key. This can result in the JSON
containing duplicate keys.

To address this, log the attributes as an array of objects, allow
duplicates to exist, for example:

  "client": {
    "proposals": [
      {
        "sa_life_duration": "Unknown",
        "sa_life_duration_raw": 86400,
      }
    }
  }

is now logged as:

  "client": {
    "proposals": [
      {"key": "sa_life_duration", "value": "Unknown", "raw": 86400}
    ]
  }

Also adds `"version": 2` to each IKE record to note the change of
format from previous versions.

Ticket: #7902
1 year ago
Jason Ish b543e28402 ike/detect: info log message should be debug 1 year ago
Philippe Antoine a393147415 rust: restrict visibility of reexported suricata_sys structs 1 year ago