suricata

Commit Graph

Author	SHA1	Message	Date
Philippe Antoine	673d13d445	rust: allow clippy::items_after_test_module As clippy began to complain about jsonbuilder.rs	2 years ago
Jeff Lucovsky	f12e026696	mqtt: Move conf code to rust Issue: 6387 This commit moves the configuration logic to Rust.	2 years ago
Jason Ish	5d5b0509a5	requires: add requires keyword Add a new rule keyword "requires" that allows a rule to require specific Suricata versions and/or Suricata features to be enabled. Example: requires: feature geoip, version >= 7.0.0, version < 8; requires: version >= 7.0.3 < 8 requires: version >= 7.0.3 < 8 \| >= 8.0.3 Feature: #5972 Co-authored-by: Philippe Antoine <pantoine@oisf.net>	2 years ago
Jason Ish	15ed51f9b8	feature: provide a Rust binding to the feature API As the feature module is not available for Rust unit tests, a mock version is also provided.	2 years ago
Juliana Fajardini	1afb485dfa	pgsql: remove unused msg field The `ConsolidatedDataRow` struct had a `length` field that wasn't truly used. Related to Bug #6389	2 years ago
Juliana Fajardini	30ac77ce65	pgsql: add cancel request message A CanceldRequest can occur after any query request, and is sent over a new connection, leading to a new flow. It won't take any reply, but, if processed by the backend, will lead to an ErrorResponse. Task #6577	2 years ago
Juliana Fajardini	7fa8bbfe43	pgsql: extract length validation into function This is called so many times that it seems to make sense that we use a function for this.	2 years ago
Victor Julien	b8440a0917	jsonbuilder: add set_int for signed ints Bug: #6615	2 years ago
Jason Ish	f91122e0e8	dns: replace usage of rs_dns_tx_get_query_name with SCDnsTxGetQueryName SCDnsTxGetQueryName was introduced to allow for getting the query name in responses as well as requests, so covers the functionality of rs_dns_tx_get_query_name.	2 years ago
Jason Ish	482325e28b	dns: add dns.query.name sticky buffer This buffer is much like dns.query_name but allows for detection in both directions. Feature: #6497	2 years ago
Jason Ish	5f99abb0cb	dns: add dns.answer.name keyword This sticky buffer will allow content matching on the answer names. While ansers typically only occur in DNS responses, we allow the buffer to be used in request context as well as the request message format allows it. Feature: #6496	2 years ago
Jason Ish	9464d0b14a	dns: consolidate DNSRequest and DNSResponse to DNSMessage DNS request and response messages follow the same format so there is no reason not to use the same data structure for each. While its unlikely to see fields like answers in a request, the message format does not disallow them, so it might be interesting data to have the ability to log.	2 years ago
Jason Ish	e2d7a7f877	dns: rustfmt with latest stable	2 years ago
Jason Ish	4620776a30	rustfmt: replace deprecated fn_args_layout with fn_params_layout	2 years ago
Philippe Antoine	1b5e04bee3	http2: do not have leading space for response line Ticket: 6547	2 years ago
Juliana Fajardini	bdec2d8ea8	pgsql: don't log password msg if password disabled If the logging of the password is disabled, there isn't much point in logging the password message itself.	2 years ago
Juliana Fajardini	9aeeac532e	pgsql: remove probe_ts function With the changes in the probing_ts function, this other one could become obsolete. Remove it, and directly call `parser::parse_request` when checking for gaps, instead.	2 years ago
Juliana Fajardini	53d29f652a	pgsql: remove unused error handling call	2 years ago
Juliana Fajardini	afd6e4dc41	pgsql: don't log unknown message type	2 years ago
Juliana Fajardini	4f85d06192	pgsql: fix probing functions Some non-pgsql traffic seen by Suricata is mistankenly identified as pgsql, as the probing function is too generic. Now, if the parser sees an unknown message type, even if it looks like pgsql, it will fail. Bug #6080	2 years ago
Juliana Fajardini	1ac5d97259	pgsql: add unknonwn frontend message type We had unkonwn message type for the backend, but not the frontend messages. It's important to better identify those to improve pgsql probing functions. Related to Bug #6080	2 years ago
Victor Julien	d3ccff5822	detect/asn1: handle in PMATCH Since the asn1 keyword is processing payload data, move the handling of the keyword into the PMATCH with content inspection. Use u32 as buffer length in the Rust FFI	2 years ago
Victor Julien	132fe57ac6	rust: add copyright header to common.rs	2 years ago
Philippe Antoine	e38b9de6a2	output/krb5: have krb5 properties in alerts Ticket: 5977	2 years ago
Philippe Antoine	8a09bff0aa	output/tftp: have tftp properties in alerts Ticket: 6501	2 years ago
Philippe Antoine	0b6b015e26	output/alert: rewrite code for app-layer properties Especially fix setup-app-layer script to not forget this part This allows, for simple loggers, to have a unique definition of the actual logging function with the jsonbuilder. This way, alerts, files, and app-layer event can share the code to output the same data. Ticket: #3827	2 years ago
Philippe Antoine	90c17652a3	rust: remove unused Ticket: #4083	2 years ago
Sascha Steinbiss	0c55fe3515	detect: add mqtt.connect.protocolstring Ticket: OISF#6396	2 years ago
Philippe Antoine	e3cd0d073f	http2: app-layer event for userinfo in uri Ticket: #6426 as per RFC 9113 ":authority" MUST NOT include the deprecated userinfo subcomponent for "http" or "https" schemed URIs.	2 years ago
Philippe Antoine	6249722589	http2: normalize host when there is user info Ticket: 6479	2 years ago
Philippe Antoine	b6cd66f41d	http2: update brotli crate Fixes debug assertion found by oss-fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63144	2 years ago
Philippe Antoine	46a46e5b1f	http2: event on mismatch between authority and host Ticket: #6425	2 years ago
Philippe Antoine	ae72ce77fa	detect: parse units for integers Ticket: #6423 Especially for filesize, instead of just a number, a signature can use a number and a unit such as kb, mb or Gb	2 years ago
Daniel Olatunji	54de0450f4	rust: remove cbindgen:ignore on frames module This directive is no longer required, and does mess up the rustdoc description of the module.	2 years ago
Daniel Olatunji	5c0af0b203	rust/doc: add docstring to rust module files. Issue: #4584	2 years ago
Philippe Antoine	14a4c6c696	rust: update brotli decompressor crate cf https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59687	2 years ago
Philippe Antoine	9157070907	quic: v2 support per rfc 9369 Ticket: #4968	2 years ago
Yatin Kanetkar	b67ff4badf	dhcp: Log Vendor Client Identifier (dhcp option 60) * Log vendor client identifier (dhcp option 60) if extended dhcp logging is turned on. This required the `vendor_client_identifier` to be added to the json schema. Validation done using an SV Test * Added `requested_ip` to the json schema as well, since it was missed. My SV test failed without it. Feature #4587	2 years ago
Philippe Antoine	5bdbc1a313	rdp: do not use zero-bit bitflag cf https://docs.rs/bitflags/latest/bitflags/#zero-bit-flags As warned by clippy 1.72.0	2 years ago
Philippe Antoine	b235e85c68	rust: fix clippy warnings for version 1.72.0 Includes using the right prototype for C SRepCatGetByShortname	2 years ago
Victor Julien	89f1837625	rust: update cargo.lock	2 years ago
Shivani Bhardwaj	8770431986	dcerpc: accept ALTER_CONTEXT as a valid request So far, if only the starting request was a DCERPC request, it would be considered DCERPC traffic. Since ALTER_CONTEXT is a valid request type, it should be accepted too. Reported and patch proposed in the following Redmine ticket by InterNALXz. Bug 6191	2 years ago
Victor Julien	389f166d78	file: remove FILE_USE_DETECT flag All implementations were converted to use the logic, so the flag itself can be removed.	2 years ago
Shivani Bhardwaj	d4e674b390	rust: fix clippy warnings	2 years ago
Victor Julien	0068b81269	rust: update cargo.lock	2 years ago
Philippe Antoine	60db5e981c	http2: do not append data after closing file Ticket: #6211 Completes commit `02dece5db5` Once a http2 stream has end of stream flag, we close the file. If we see new data frames with this stream id, the new_chunk function should ignore them as the file was already closed.	2 years ago
Jeff Lucovsky	690b65ae88	detect/byte_math: Permit var name for bytes value Issue: 6145 Modifications to permit a variable name to be used for the byte_math bytes value.	2 years ago
Philippe Antoine	02dece5db5	http2: file tracker is initialized when file is closed Ticket: #6130 This avoids quadratic complexity by having http2_range_key_get looking in a growing number of frames	2 years ago
Sascha Steinbiss	1521b77edd	rfb: also set unimplemented auth types	2 years ago
Sascha Steinbiss	1606aca881	rfb: ensure logging of incompletely parsed txs	2 years ago

1 2 3 4 5 ...

1332 Commits (d3218385e942a4a01f3938f0cd7050f5dc7c9a6f)