suricata

Commit Graph

Author	SHA1	Message	Date
Philippe Antoine	aea9fd73b7	rust: format dcerpc files Ticket: 3836	4 weeks ago
Philippe Antoine	c6014a77a2	websocket: accepts config value with units Ticket: 8552 As was the commented out example	1 month ago
Philippe Antoine	a9e1dff4a6	conf: introduce SCConfGetNonNull Ticket: 8651 Behaves like SCConfGet but returns 0 on null value	1 month ago
Philippe Antoine	e0152178da	rust: format detect files Ticket: 3836	1 month ago
Giuseppe Longo	695b4f4a3d	sip: remove incomplete data event It's no longer useful to set an event when the data is incomplete, since an error is returned. Ticket #8524	1 month ago
Giuseppe Longo	ba5e850264	sip: make pattern matching more robust SIP and SSDP share method names like NOTIFY and SUBSCRIBE, causing SSDP traffic to be misidentified as SIP. Add a probing parser callback that checks for "SIP/" in the payload before accepting a pattern match. Example of a misidentified flow before the fix: {"timestamp":"2014-02-27T19:44:43.164211+0100","flow_id":986757542077835,"event_type":"flow","src_ip":"192.168.1.1","src_port":9489,"dest_ip":"239.255.255.250 ","dest_port":1900,"ip_v":4,"proto":"UDP","app_proto":"sip","flow":{"..."}} After the fix: {"timestamp":"2014-02-27T19:44:43.164211+0100","flow_id":986757542077835,"event_type":"flow","src_ip":"192.168.1.1","src_port":9489,"dest_ip":"239.255.255.250 ","dest_port":1900,"ip_v":4,"proto":"UDP","app_proto":"failed","flow":{"..."}} Ticket #8355	1 month ago
Shivani Bhardwaj	0345b91ddd	rust: exclude DETECT_BYTEMATH_ENDIAN_DEFAULT from bindings to deal with the failure due to cbindgen updates and mismatches in generated bindings. detect-bytemath.c:61: error: "DETECT_BYTEMATH_ENDIAN_DEFAULT" redefined [-Werror] 61 \| #define DETECT_BYTEMATH_ENDIAN_DEFAULT (uint8_t) BigEndian \| In file included from rust.h:34, from detect-bytemath.c:32: ./../rust/gen/rust-bindings.h:5071: note: this is the location of the previous definition 5071 \| #define DETECT_BYTEMATH_ENDIAN_DEFAULT BigEndian \|	1 month ago
Giuseppe Longo	88f17d7b20	detect/sctp: add sctp.chunk_type keyword Add a U8 numeric keyword to match the first SCTP chunk type in a packet with prefilter support. Ticket #4251	1 month ago
Philippe Antoine	4144d9c709	rust: format snmp files Ticket: 3836	1 month ago
Jason Ish	546209ff12	bindgen: fix include ordering At some point, bindgen include ordering changed such that AppLayerGetFileState was being bindgen'd as opaque, as the definition of StreamBufferingConfig was not available when bindgen hit AppLayerGetFileState, and bindgen processes in order. Move the util includes before the app-layer includes to fix the ordering problem, but still keep util includes grouped. The sys diff is large as many things have been re-ordered.	1 month ago
William Ling	30628e45bc	rust: replace helper with built-in Replace custom u32_as_bytes with built-in to_be_bytes Issue: 5785	1 month ago
Philippe Antoine	9318bbfbdb	rust: format tftp files Ticket: 3836	1 month ago
Philippe Antoine	9ec200e834	rust: format x509 files Ticket: 3836	1 month ago
Philippe Antoine	dd66276f82	rust: format telnet files Ticket: 3836	1 month ago
Philippe Antoine	709ad1bdf4	rust: format sip files Ticket: 3836	1 month ago
Samaresh Kumar Singh	f06bb7d43e	dhcp: support option 52 overload Per RFC 2132 the BOOTP sname and file fields can hold extra DHCP options when option 52 is present, but the parser ignored them. After parsing the main options we now look up option 52 and walk sname or file as additional option streams, appending what we find to the same options vector so the logger and detection keywords see the overloaded values too. Bug: #8538.	1 month ago
Philippe Antoine	26bb18cfaa	http2: replace state todrop with a dedicated boolean Ticket: 8518	1 month ago
Philippe Antoine	8eed90ca9d	http2: global txs are unidirectional Ticket: 8518 Meaning they will now match only once per tx instead of twice: once for each direction	1 month ago
Philippe Antoine	daf68dc36f	http2: split progress per direction Ticket: 8518 Keywords that work for HTTP2 headers match now as soon as possible A push promise is now considered like a headers frame with regards to the progress (no dedicated "reserved" progress/state) http.protocol and http.stat_msg keywords are now registered at earliest progress, since these are synthetic like "HTTP/2" and not really seen on the wire. http.request_line and http.response_line match only on data, and not on headers, since we must wait the end of headers to be sure to have the full line http2.size_update now matches at headers progress as it should http2.frametype, http2.errorcode, http2.priority now match like http2.window, when the tx is complete from both sides, as a half-closed client may still send priority, rst_stream or window_update frames	1 month ago
Philippe Antoine	8217c51126	rust: format sdp files Ticket: 3836	1 month ago
Philippe Antoine	9d9d8df4cd	rust: format rdp files Ticket: 3836	1 month ago
Philippe Antoine	7352bae890	smb: avoid unsigned overflow debug assertion As we compute a padding, we can use wrapping_add as we only care about the low-weight bit anyways	1 month ago
Giuseppe Longo	8f205bb34f	llmnr: implement logger This adds an LLMNR protocol logger that reuses existing DNS functions, following the same approach as the mDNS logger: - No grouped logging - Rdata is logged in a field that is named after the rdata type - Types are logged in lower case - Flags are logged as an array Ticket #8366	1 month ago
Giuseppe Longo	13df0f7a06	llmnr: implement parser This adds a parser for LLMNR protocol over both UDP and TCP. The parser reuses the existing DNS functions since LLMNR shares the same wire format as DNS, but implements its own protocol-specific validation: - LLMNR-specific flag checks (C, TC, T bits) - Opcode validation (only standard query opcode 0 is valid) - An Event is set if Z-flag is set, since it's must be zero per RFC4795 LLMNR transactions inherit DNS behavior where each packet creates a new state with one transaction. Ticket #8366	1 month ago
Jason Ish	3dc8b154f3	rust/ffi: add safe thread storage wrapper Add a typed ThreadStorage<T> wrapper around the thread storage bindings. Ticket: #8445	1 month ago
Jason Ish	9f40968bba	rust/ffi: bindgen thread storage Ticket: #8445	1 month ago
Jason Ish	5e0abf1572	rust/ffi: use ThreadVars wrapper in flow callbacks Update the flow init, update and finish callback registrations to pass the safe ThreadVars wrapper instead of a raw pointer. Ticket: #8598	1 month ago
Jason Ish	1cac242948	rust/ffi: use ThreadVars wrapper in eve callback Update the EVE callback registration to pass the safe ThreadVars wrapper instead of a raw pointer. Ticket: #8598	1 month ago
Jason Ish	45762aa644	rust/ffi: use ThreadVars wrapper in thread init callback Update the thread init callback registration to pass the safe ThreadVars wrapper instead of a raw pointer. Ticket: #8598	1 month ago
Jason Ish	5fe88212c3	rust/ffi: add wrapper around ThreadVars A Rust wrapper around ThreadVars to enforce Rust lifetimes to ThreadVars when used in a callback. Ticket: #8598	1 month ago
Philippe Antoine	73193c7e6a	rust: format pgsql files Ticket: 3836	2 months ago
Philippe Antoine	3bfe6cf4b9	rust: format nfs files Ticket: 3836	2 months ago
Juliana Fajardini	372cb8c692	rust/sys: update bindgen SIGMATCH_ constants Part of Ticket #8551	2 months ago
Jason Ish	144f824f17	rust/ffi: add thread init callback wrapper Ticket: #8605	2 months ago
Jason Ish	c689af0bbb	rust/ffi: bindgen thread lifecycle callbacks Ticket: #8605	2 months ago
Philippe Antoine	07112bc7ae	rust: format mqtt files Ticket: 3836	2 months ago
Philippe Antoine	844f2effa3	rust: format modbus files Ticket: 3836	2 months ago
Philippe Antoine	db019ebefe	rust: format ike files Ticket: 3836	2 months ago
Philippe Antoine	bcc1e6ae32	rust: format http2 files Ticket: 3836	2 months ago
Philippe Antoine	1070e733d8	rust: format websocket files Ticket: 3836	2 months ago
Philippe Antoine	89e5332d88	rust: format utils files Ticket: 3836	2 months ago
Philippe Antoine	edf29b0000	rust: format ssh files Ticket: 3836	2 months ago
Philippe Antoine	fe27a2159c	rust: format rfb files Ticket: 3836	2 months ago
Philippe Antoine	5cca346f16	rust: format quic files Ticket: 3836	2 months ago
Philippe Antoine	415360d9e8	rust: format ntp files Ticket: 3836	2 months ago
Philippe Antoine	fa864f9c2f	rust: format mime files Ticket: 3836	2 months ago
Philippe Antoine	2cfcaec1b0	rust: format ldap files Ticket: 3836	2 months ago
Philippe Antoine	64e7c671cc	rust: format ftp files Ticket: 3836	2 months ago
Philippe Antoine	f217e249cb	rust: format ffi files Ticket: 3836	2 months ago
Philippe Antoine	f7c14809f4	rust: format enip files Ticket: 3836	2 months ago

1 2 3 4 5 ...

2328 Commits (aea9fd73b7e28b83d86c7f049a4c0ccfdaf98711)