suricata

Commit Graph

Author	SHA1	Message	Date
Philippe Antoine	bd6a436893	detect/doc: fix broken files links Ticket: 8257	4 months ago
Philippe Antoine	b0e63a2c95	detect/dcerpc: move stub_data keyword to rust Ticket: 8391	5 months ago
Philippe Antoine	3d56472d16	detect: bindgen more functions To prepare to move dcerpc.stub_data keyword to full rust	5 months ago
Jeff Lucovsky	746f471382	transform/subslice: Add subslice transform Issue: 7672 The subslice transform creates a slice of the input buffer. Specify the subslice desired -- nbytes and truncate are optional: subslice: offset <,nbytes> <,truncate> offset: Specifies the starting offset for the new subslice. When negative, expresses how far from the end of the input buffer to begin. nbytes: Specifies the size of the subslice. When negative, specifies that the subslice will end that many bytes from the end of the input buffer. Nbytes must be non-zero. When nbytes is not specified, the size of the subslice will be the size of the input buffer - offset. truncate: Specify behavior when offset + nbytes exceeds buffer length. When present, trims nbytes such that offset + nbytes equals buffer length. When not present, an empty buffer is produced. Examples: subslice: 1; - The subslice will be a copy of the input buffer but omits the input buffer's first byte "This is Suricata" -> "his is Suricata" subslice: 0, 13; - The slice is created from the first 13 bytes of the input buffer "This is Suricata" -> "This is Suric" subslice: 10, -5; - The subslice is created starting at offset 10 and continues to 5 bytes before the end of the input buffer "This is Suricata" -> "r" subslice: -3; - The subslice will be the last 3 bytes of the input buffer. "This is Suricata" -> "ata"	5 months ago
Philippe Antoine	4fc6ca5d6c	detect/dcerpc: move iface keyword to rust Ticket: 8391 Use same buffer dce_generic as for dcerpc.opnum (name dce_generic is enforced by a SV test currently)	5 months ago
Philippe Antoine	9677851637	rust/ffi: move app-layer traits to ffi crate Ticket: 7666 Traits around structures defined in C and bindgened to rust	5 months ago
Philippe Antoine	f803c25f24	rust/ffi: move export_X_data_get macros to ffi crate Ticket: 7666	5 months ago
Philippe Antoine	54b6885166	rust/ffi: move conf_get_bool helper to ffi crate Ticket: 7666	5 months ago
Victor Julien	28a3337c27	rust: cargo update	5 months ago
Philippe Antoine	5f9e436c3f	detect/dcerpc: support generic integer for opnum keyword Ticket: 8179	5 months ago
Philippe Antoine	67379b009a	detect/dcerpc: move opnum keyword to rust Ticket: 8391	5 months ago
Philippe Antoine	a36af353bc	rust: bindgen SCFlowGetAppProtocol	5 months ago
Jason Ish	fd31e50954	ntp: enable keywords for firewall mode Ticket: #8394	5 months ago
Jason Ish	713e4eb900	ntp: convert reference_id to buffer and add keyword Store the NTP reference ID as raw network-order bytes so it can be exposed as a sticky buffer and matched with payload keywords. The reference ID is often a 4 character string, or an IP address and not just an integer identifier. Updates the log reference ID to be a string of colon separated hex digits as this matches what tshark does. Ticket: #8488	5 months ago
Jason Ish	991e7f3b1d	ntp: add ntp.mode keyword This keyword also accepts strings for known mode names. Ticket: #8429	5 months ago
Jason Ish	c10c482290	ntp: add ntp.stratum keyword Ticket: #8431	5 months ago
Jason Ish	ec344fe68d	ntp: add ntp.version keyword SNMP was used as a template. Ticket: #8430	5 months ago
Jason Ish	74bb525401	ntp: create tx for all modes; log version, mode and stratum Add logging for version, mode and stratum as these will be the first keywords we will add. Ticket: #8425	5 months ago
Jason Ish	879846e153	ntp: remove unused event types NotRequest and NotResponse event type have never been used. Unsolicited is also unused, however there is a rule for it so removing support would be a breaking change at this time.	5 months ago
Jason Ish	31b967b089	ntp: add transaction logging Adds basic NTP transaction logging for the current supported message types. Includes small cleanups around reference ID. Ticket: #8425	5 months ago
Victor Julien	c7cd3b17c3	snmp: minor snmp.pdu_type type cleanup	5 months ago
Victor Julien	2cef1404bc	detect/snmp: let generic keyword share the same list	5 months ago
Victor Julien	670fdabd32	detect/snmp: add snmp.trap_type keyword Implemented as a U8 integer keyword. Ticket: #8482.	5 months ago
Philippe Antoine	8ac9a62ec4	detect: enable snmp keywords for firewall mode Ticket: #8395	5 months ago
Philippe Antoine	63603fe14a	detect/snmp: sticky buffers at progress 1 Since snmp txs are created at progress 1 which is the completion, this does not change detection, except allowing firewall mode to use these keywords with generic hook like snmp:request_complete Ticket: 8395	5 months ago
Philippe Antoine	8f824458c2	detect: helper for buffer register requires progress Ticket: 8395 For protocols where tx are complete at start, that is the `tx_get_progress` function returns 1 inconditionnally, we can use the progress 1, not losing time on detection in ips mode, and getting ready for firewall mode For the other protocols (where a tx needs both a request and response for instance), keep progress 0 as was the case before	5 months ago
Jason Ish	eb46d0129e	rust/ffi: add eve callback handler Wrap the EVE callback handler with a Rust friendly variant that allows the user to register a callback as a closure which is provided an already wrapped JsonBuilder object. Ticket: #8477	5 months ago
Jason Ish	199e844a07	rust/ffi: add mark support to ffi::jsonbuilder To support Rust friendly EVE callback registration (ticket 8477).	5 months ago
Philippe Antoine	58a71d94b0	rust/ffi: move conf_get helper to ffi crate Ticket: 7666	5 months ago
Philippe Antoine	8d254f5630	dhcp/output: log app-layer metadata in alerts Ticket: 6091 log as extended	5 months ago
Philippe Antoine	db980daf5f	dhcp: standardize output code To prepare to add metadata in alerts Ticket: 6091	5 months ago
Philippe Antoine	d14af54b3b	detect/transforms: constify some callbacks arguments Ticket: 8298	5 months ago
Philippe Antoine	0a24f0afe2	smb: parse smb1 session setup with word count 13 Ticket: 5845	5 months ago
Jason Ish	98469b0f56	rust/ffi: fix clippy warnings Remove the unneeded return. The other option would be to allow it, but so far in the ffi crate we don't have any non-default allows.	5 months ago
Philippe Antoine	c53b9df5a2	rust/ffi: move detection helpers to ffi crate Ticket: 7666	5 months ago
Philippe Antoine	4f4912c042	rust: bindgen SIGMATCH_ constants	5 months ago
Philippe Antoine	2fa10052cf	websocket: check pdu opcode for reassembly Ticket: 8413 RFC 6455 Section 5.4 states Control frames (see Section 5.5) MAY be injected in the middle of a fragmented message. Control frames are identified by opcodes where the most significant bit of the opcode is 1.	5 months ago
Philippe Antoine	7b0528d85f	http2: set response_frame_size Ticket: 8410 Do not set only request_frame_size whatever the direction	5 months ago
Philippe Antoine	267c3baff7	rust/ffi: move STREAM_ constants to ffi crate Ticket: 7666 reexport them in suricata crate cbindgen them to C	6 months ago
Philippe Antoine	61c667400b	rust: remove obsolete inclusions from cbindgen.toml	6 months ago
Philippe Antoine	fd4c6d4e06	rust: remove obsolete struct exclusions in cbindgen As these structs are now in suricata_sys crate	6 months ago
Philippe Antoine	a10a818792	rust: remove obsolete constants exclusion from cbindgen.toml Completes commit `71b59f6dbe` These const are no longer defined in rust suricata crate	6 months ago
Jason Ish	dce2deee5e	rust: pin unicode-segmentation crate to 1.12.0 unicode-segmentation (used by rustyline) was updated from 1.12.0 to 1.13.1 earlier and requires a newer version of Rust. Pin to 1.12.0 which works with Rust 1.75.0.	6 months ago
Philippe Antoine	34ed8958a6	dcerpc: only log the tx interfaces Not all the state ones Ticket: 8378	6 months ago
Philippe Antoine	05a11e2897	dcerpc: store persistently contexts So that we can log and detect on interface uuids, even if AlterContext packets change one of the contexts, but other contexts are still used after it in request/responses Ticket: 8378	6 months ago
Jason Ish	9cab99fbd3	rust: rust fmt derive crate	6 months ago
Jeff Lucovsky	14ebba6382	gen/unused: Remove unused function Remove unused function is_alphanumeric_or_slash	6 months ago
Jeff Lucovsky	98070a7ace	misc/cleanup: remove rust if <cond> .... Cleanup the few instances of rust where if cond return true else false exist rg = ripgrep rg -n -U '^\sif . \{\s\n\sreturn true;\s\n\s\}\s\n\sreturn false;' rust/src/ --glob '.rs' rg -n -U '^\sif .* \{\s\n\sreturn false;\s\n\s\}\s\n\sreturn true;' rust/src/ --glob '*.rs'	6 months ago
Philippe Antoine	6587e363a3	dcerpc: use bind context_id in SMB Ticket: 8375 logger already read this variable but it was never set, and the rust compiler did not warn about this Allows to log the interface uuid when ctx_id > 0 Wireshark filter for related pcaps dcerpc.cn_ctx_id > 0 && dcerpc.pkt_type == 0	6 months ago
Philippe Antoine	2c2a3c800f	dcerpc: support multiple PDU in one parser call Ticket: 7254 With TCP, we receive a stream of data, which may contain multiple PDUs in one call	6 months ago

1 2 3 4 5 ...

2237 Commits (bd6a436893ca94bb9f96732cea835d172a3734ed)