Philippe Antoine
92c7be1cb6
rust: bindgen SCSRepCatGetByShortname
...
Ticket: 7667
12 months ago
Philippe Antoine
7447651fa0
output/jsonbuilder: helper function SCJbSetPrintAsciiString
...
To replace C PrintStringsToBuffer and avoid a stack alloc
+ copy
Ticket: 8004
1 year ago
Li Heng
1106323ae1
rust/sip: delete redundant computing codes
...
Delete call of is_alphanumeric where is_alphanumeric and
is_token_char are called together. Four places are modified.
Ticket: 8003
1 year ago
Jason Ish
1efe70a234
rust/ike: convert to nom 8
...
Ticket: #8050
1 year ago
Jason Ish
f368324e87
rust/mime: convert to nom 8
...
Ticket: #8048
1 year ago
Jason Ish
c5ef615953
rust/mqtt: convert to nom 8
...
Ticket: #8047
1 year ago
Jason Ish
2289069f74
rust/websocket: convert to nom 8
...
Ticket: #8046
1 year ago
Jason Ish
9eeefd0684
rust/bt-dht: convert to nom 8
...
Ticket: #8045
1 year ago
Jason Ish
399f96b07d
rust/rdp: convert to nom 8
...
Ticket: #8044
1 year ago
Jason Ish
7c70f74942
rust/telnet: convert to nom 8
...
Ticket: #8043
1 year ago
Jason Ish
2ff2eb1325
rust/ssh: convert to nom 8
...
Ticket: #8042
1 year ago
Jason Ish
baa22287b8
rust/rfb: convert to nom 8
...
Ticket: #8041
1 year ago
Jason Ish
dcfe247467
rust/pgsql: convert to nom 8
...
Ticket: #8039
1 year ago
Jason Ish
d25286e77a
rust/enip: convert to nom 8
...
Ticket: #8038
1 year ago
Jason Ish
d74f8522ee
rust/tftp: convert to nom 8
...
Ticket: #8037
1 year ago
Jason Ish
4b09622ebc
rust/dhcp: convert to nom 8
...
Ticket: #8036
1 year ago
Philippe Antoine
772bd9ca53
rust: reduce visibility of detect_parse_uint_notending
...
It is meant as an internal function
Also document the function
1 year ago
Philippe Antoine
b636dffd5b
detect: urilen keyword fails on trailing junk
...
Fails especailly on 1<>2 which looks like a range, but is invalid
as too small, and ended up being accepted as =1
Ticket: 8028
1 year ago
Philippe Antoine
2e9027fd5a
plugins: update SC_API_VERSION to 9
...
So that plugins built for 8 will fail to load with 9 as there
were already breaking changes in the structures and functions
prototypes
1 year ago
Jason Ish
16d313cb8b
rust/applayertemplate: convert to nom 8
...
Ticket: #8027
1 year ago
Jason Ish
f0f4d88119
rust/sip+sdp: update to nom 8
...
Done together as there is a dependence of SDP by SIP.
Ticket: #8025
1 year ago
Jason Ish
58564a4b0e
rust/ftp: update to nom 8
...
Ticket: #8026
1 year ago
Jason Ish
54cc97b78e
rust/dns: convert to nom 8.0
...
Ticket: #8024
1 year ago
Jason Ish
16c42da57e
rust: add nom8 as a dependency
...
For the update from nom 7 to nom 8.
1 year ago
Jason Ish
0990c9dbf6
rust: pin indexmap
...
Newer indexmap, pulled in by serde_json requires Rust 1.82, so pin
pack to 2.11.4 which still works with Rust 1.75.
1 year ago
Philippe Antoine
dc7874b2ac
rust: bindgen more http range functions used in http2
...
Ticket: 7667
1 year ago
Philippe Antoine
842352c190
rust: bindgen SCHttpRangeFreeBlock
...
Ticket: 7667
1 year ago
Philippe Antoine
93785ae357
rust: bindgen SCHTTP2MimicHttp1Request
...
Ticket: 7667
1 year ago
Philippe Antoine
a1613fecb4
detect: tcp.flags rejects non-sensical values
...
ignored flags are only meaningful for equal mode
1 year ago
Philippe Antoine
31e9cb55be
detect: tcp.flags unit tests improvements
...
Tests better the ignored flags functionality.
This functionality is only used at detection for default mode,
it is not used for any, plus or not mode.
So, have unit tests about igored flags with default mode with
both matching and non matching cases
1 year ago
Philippe Antoine
d8cb00e795
detect/tcp: make tcp.flags a generic integer with bitflags
...
Ticket: 6724
Allows to use numerical values for example
Also fixes some unit tests that were returning 1 after goto error
FlagsTestParse05 especially took this path as
de->ignored_flags != (TH_SYN|TH_RST) was false
we had de->ignored_flags == 0xff ^ (TH_SYN|TH_RST)
And then, we had a match, instead of what the not-run code
was supposing.
1 year ago
Philippe Antoine
1f9236a6d8
detect/ipv4: make fragbits a generic uint16 bitflags keyword
...
Ticket: 6724
Allows to use numerical values
1 year ago
Philippe Antoine
633180c93f
detect/integers: generalize support for bitflags modifier
...
Ticket: 6724
Allows sugar syntax for bitflags keywords.
While the expressivity does not increase, because we could already
use numerial values with all generic integer modes, this modifier
prefix is used with the strings, and follows the syntax
that is already used for fragbits and tcp.flags keyword.
1 year ago
Philippe Antoine
f25194480c
libhtp: fix newer clippy lints with newer MSRV
1 year ago
Jason Ish
bc33bd49eb
quic/crypto: remove use of GenericArray
...
Its not needed, and gets rid of the deprecation warnings.
1 year ago
Jason Ish
bdfdf7ff33
rust: update deps with cargo-update
...
Suppress deprecation warnings in quick/crypto.rs about GenericArray.
1 year ago
Jason Ish
6fdf0d736b
rust: update aes-gcm to 0.10.3
1 year ago
Jason Ish
b9517de86e
rust: update aes to 0.8.4
1 year ago
Philippe Antoine
4b69a31dc3
detect/integers: count argument for multi-integers
...
Ticket: 7211
Allows to count the number of elements, without matching on
individual elements
1 year ago
Philippe Antoine
3babd68af4
pop3: count retr_data into consumed
...
for later AppLayerResult::incomplete
Fixes: acef961645 ("pop3: improve parsing")
https://issues.oss-fuzz.com/u/1/issues/451112373
Ticket: 7994
1 year ago
Philippe Antoine
9a4a29e218
http2: fix parsing of goaway frames
...
There was a last stream id before the error code
As per section 6.8 of RFC 7540
Ticket: 7991
1 year ago
Philippe Antoine
7f0087f19a
rust/detect: fix correct pointer type in SCDetectU32ArrayFree
1 year ago
Philippe Antoine
969739d067
detect: http2.errorcode is now a generic integer
...
Ticket: 7889
1 year ago
Philippe Antoine
401b2fcae6
detect: http2.frametype is now a generic integer
...
Ticket: 7889
1 year ago
Philippe Antoine
454f73b445
rust: EnumString derive accepts a enum_string_style parameter
...
So that http2.frametype and http2.errorcode can use EnumString
without changing the format, as they used UPPERCASE instead of
the default EnumString snake_case
1 year ago
Victor Julien
acef961645
pop3: improve parsing
...
Improve multiline commands and SASL auth.
Work around missing support in crate for empty server challenge and SASL base64 data.
Ticket: #7709 .
1 year ago
Jason Ish
5e2dc9ace3
ike: don't log empty server objects
1 year ago
Jason Ish
2d86412f46
ike: log attributes as objects
...
IKE attributes are an array of TLV style objects, this means there can
be duplicate types seen on the wire. However, Suricata logs these as a
mapping with the type as the key. This can result in the JSON
containing duplicate keys.
To address this, log the attributes as an array of objects, allow
duplicates to exist, for example:
"client": {
"proposals": [
{
"sa_life_duration": "Unknown",
"sa_life_duration_raw": 86400,
}
}
}
is now logged as:
"client": {
"proposals": [
{"key": "sa_life_duration", "value": "Unknown", "raw": 86400}
]
}
Also adds `"version": 2` to each IKE record to note the change of
format from previous versions.
Ticket: #7902
1 year ago
Jason Ish
b543e28402
ike/detect: info log message should be debug
1 year ago
Philippe Antoine
a393147415
rust: restrict visibility of reexported suricata_sys structs
1 year ago