19146 Commits (d64954a873be3c297b3881bf22207afe95fa744f)

 

All Branches   

Search

Author	SHA1	Message	Date
Philippe Antoine	af7fad5514	detect: allocate arrays on the heap ... buffer_type_id is a u32 Ticket: 8001	5 months ago
Philippe Antoine	2eede11195	detect: clean app-layer txs when we pass the flow ... Ticket: 8619 Do not wait to run inspection on the other side of transactions as we do not run any tx detection on passing flows. Avoids accumulating txs	5 months ago
Juliana Fajardini	f8945e7a1a	yaml/firewall: expand firewall options explanation	5 months ago
Juliana Fajardini	04cfd33c59	doc/firewall: update hooks & configuration examples	5 months ago
Philippe Antoine	26bb18cfaa	http2: replace state todrop with a dedicated boolean ... Ticket: 8518	5 months ago
Philippe Antoine	8eed90ca9d	http2: global txs are unidirectional ... Ticket: 8518 Meaning they will now match only once per tx instead of twice: once for each direction	5 months ago
Philippe Antoine	daf68dc36f	http2: split progress per direction ... Ticket: 8518 Keywords that work for HTTP2 headers match now as soon as possible A push promise is now considered like a headers frame with regards to the progress (no dedicated "reserved" progress/state) http.protocol and http.stat_msg keywords are now registered at earliest progress, since these are synthetic like "HTTP/2" and not really seen on the wire. http.request_line and http.response_line match only on data, and not on headers, since we must wait the end of headers to be sure to have the full line http2.size_update now matches at headers progress as it should http2.frametype, http2.errorcode, http2.priority now match like http2.window, when the tx is complete from both sides, as a half-closed client may still send priority, rst_stream or window_update frames	5 months ago
Philippe Antoine	567e824e44	fuzz: add target for iprep ... Ticket: 3589	5 months ago
Philippe Antoine	29795be5a2	fuzz: make more unit test utilities available for fuzzing	5 months ago
Philippe Antoine	8217c51126	rust: format sdp files ... Ticket: 3836	5 months ago
Philippe Antoine	9d9d8df4cd	rust: format rdp files ... Ticket: 3836	5 months ago
Philippe Antoine	c8a86cdffa	ci: move rustfmt to a helper script	5 months ago
Philippe Antoine	7352bae890	smb: avoid unsigned overflow debug assertion ... As we compute a padding, we can use wrapping_add as we only care about the low-weight bit anyways	5 months ago
Jason Ish	7ec82740cd	github-ci: cancel previous nix workflow for branch ... On push, cancel previous nix workflows for the same branch.	5 months ago
Jason Ish	c0fd86f5b6	github-ci: close PRs updated after being opened ... Enforce our policy of requiring a new pull request whenever changes are made to an existing one. On any push to an open, non-draft pull request the workflow comments with the policy and closes the pull request.	5 months ago
Jason Ish	6687618b67	misc: remove log-cf-common ... It was only used to http-log which is now removed.	5 months ago
Jason Ish	3806bf4260	util-time: relocate timestamp format unit test from log-cf-common ... log-cf-common is not longer needed with the removal of http-log, but this test is still valid, so move until util-time.	5 months ago
Jason Ish	865b7243a0	http-log: remove support for http-log ... http-log was deprecated in Suricata 8, and marked for removal in Suricata 9.0. Ticket: #7232	5 months ago
Jason Ish	6368f6401b	qa: remove socket_to_gzip_file.py ... I'm not really what the purpose of this script is.	5 months ago
Giuseppe Longo	143774220e	doc: add llmnr ... Ticket #8366	5 months ago
Giuseppe Longo	0b20011a9f	llmnr: implement sticky buffers ... Add detection keywords for LLMNR protocol inspection: - llmnr.queries.rrname - llmnr.answers.rrname - llmnr.authorities.rrname - llmnr.additionals.rrname - llmnr.response.rrname LLMNR reuses the existing DNS functions since it follows the same protocol structure. The implementation registers LLMNR-specific keywords that leverage the DNS data extraction functions. Both to_server and to_client directions are supported. Ticket #8366	5 months ago
Giuseppe Longo	8f205bb34f	llmnr: implement logger ... This adds an LLMNR protocol logger that reuses existing DNS functions, following the same approach as the mDNS logger: - No grouped logging - Rdata is logged in a field that is named after the rdata type - Types are logged in lower case - Flags are logged as an array Ticket #8366	5 months ago
Giuseppe Longo	13df0f7a06	llmnr: implement parser ... This adds a parser for LLMNR protocol over both UDP and TCP. The parser reuses the existing DNS functions since LLMNR shares the same wire format as DNS, but implements its own protocol-specific validation: - LLMNR-specific flag checks (C, TC, T bits) - Opcode validation (only standard query opcode 0 is valid) - An Event is set if Z-flag is set, since it's must be zero per RFC4795 LLMNR transactions inherit DNS behavior where each packet creates a new state with one transaction. Ticket #8366	5 months ago
Victor Julien	9e82ff82e2	fuzz: use heap threadvars allocations ... Use new allocator to properly set up thread storage.	5 months ago
Victor Julien	cefee1390e	detect/threshold: don't double init per thread cache ... Can get called multiple times in the multi-tenancy case.	5 months ago
Victor Julien	f67dadc3d8	detect/threshold: fix unittests for storage based cache	5 months ago
Victor Julien	c27868a8c5	threshold: use seed consistently in hashing ... Use for IPv6 in the main hash. Update IPv4 thread cache to also use a seed. For this the thread initialization is done at thread init instead on the first packet. The thread ctx is no longer stored in a thread_local, but instead uses the thread storage API to store in the ThreadVars. This way it will stay active during rule reloads as well. Ticket: #8617.	5 months ago
Victor Julien	b742d58544	hash: allow registing with a seed value ... Seed value will have to be used by the caller's hash function.	5 months ago
Victor Julien	730ff5075d	threads: use threadvars memory helpers	5 months ago
Victor Julien	ad1459df72	threads: add threadvars allocator and free func ... Mostly meant to help unittests and fuzz targets alloc the storage correctly.	5 months ago
Victor Julien	b11aa94d42	decode/vlan: implement max layers for IEEE8021ah ... Ticket: #8615.	5 months ago
Victor Julien	377462ea63	defrag: decrement memuse on alloc failure ... Ticket: #8613.	5 months ago
Jason Ish	3dc8b154f3	rust/ffi: add safe thread storage wrapper ... Add a typed ThreadStorage<T> wrapper around the thread storage bindings. Ticket: #8445	5 months ago
Jason Ish	9f40968bba	rust/ffi: bindgen thread storage ... Ticket: #8445	5 months ago
Jason Ish	5e0abf1572	rust/ffi: use ThreadVars wrapper in flow callbacks ... Update the flow init, update and finish callback registrations to pass the safe ThreadVars wrapper instead of a raw pointer. Ticket: #8598	5 months ago
Jason Ish	1cac242948	rust/ffi: use ThreadVars wrapper in eve callback ... Update the EVE callback registration to pass the safe ThreadVars wrapper instead of a raw pointer. Ticket: #8598	5 months ago
Jason Ish	45762aa644	rust/ffi: use ThreadVars wrapper in thread init callback ... Update the thread init callback registration to pass the safe ThreadVars wrapper instead of a raw pointer. Ticket: #8598	5 months ago
Jason Ish	5fe88212c3	rust/ffi: add wrapper around ThreadVars ... A Rust wrapper around ThreadVars to enforce Rust lifetimes to ThreadVars when used in a callback. Ticket: #8598	5 months ago
Victor Julien	736f50600f	mpm/hs: fix compile warnings ... CC util-mpm-hs-cache.o util-mpm-hs-cache.c:301:59: error: implicit conversion loses integer precision: '__size_t' (aka 'unsigned long') to 'uint32_t' (aka 'unsigned int') [-Werror,-Wshorten-64-to-32] 301 | SCSha256Update(hasher, (const uint8_t *)ref_info, strlen(ref_info)); | ~~~~~~~~~~~~~~ ^~~~~~~~~~~~~~~~ util-mpm-hs-cache.c:310:46: error: implicit conversion loses integer precision: 'size_t' (aka 'unsigned long') to 'uint32_t' (aka 'unsigned int') [-Werror,-Wshorten-64-to-32] 310 | if (!SCSha256FinalizeToHex(hasher, hash, hash_len)) { | ~~~~~~~~~~~~~~~~~~~~~ ^~~~~~~~ 2 errors generated.	5 months ago
Victor Julien	781bd5184e	clang-format: support clang 17 ... Update Github CI runner to use it. Bump to Ubuntu 24.04 as well.	5 months ago
Victor Julien	e0b501a4b7	detect: cleanup last tx logic ... Move into DetectTransaction.	5 months ago
Victor Julien	3d00e73d91	detect: make progress values uint8_t ... Also reflect that it can be >= 48, like in prefilter.	5 months ago
Victor Julien	a9b3ad49ea	detect/firewall: minor code cleanup	5 months ago
Victor Julien	4db84cfa28	detect/firewall: clean up apply accept logic ... Use end state from tx. Handle flow control from inside the function consistently.	5 months ago
Victor Julien	68885e75e1	detect/firewall: refactor per tx rule result handling ... Break out the 3 options: match, partial match, no match for firewall into separate functions. Additionally, handle the re-match case for matches on a hook where the progress value didn't yet progress further. In this case the continue inspection logic revisits the rule and the accept needs to be re-applied.	5 months ago
Philippe Antoine	73193c7e6a	rust: format pgsql files ... Ticket: 3836	5 months ago
Philippe Antoine	3bfe6cf4b9	rust: format nfs files ... Ticket: 3836	5 months ago
Juliana Fajardini	a783007408	detect/bypass: ban bypass keyword for firewall mode ... Related to Ticket #8551	5 months ago
Juliana Fajardini	edaa912ed9	detect: ban `replace` keyword for firewall mode ... Ticket #8551	5 months ago
Juliana Fajardini	372cb8c692	rust/sys: update bindgen SIGMATCH_ constants ... Part of Ticket #8551	5 months ago