suricata

Commit Graph

Author	SHA1	Message	Date
Philippe Antoine	9b12fd9f09	rust/ffi: move helper trait state_get_tx_iterator to ffi Ticket: 7666	3 months ago
Philippe Antoine	07f37676b6	rust/ffi: move Flags for AppLayerParserState to ffi crate Ticket: 7666	3 months ago
Philippe Antoine	fb20c69d8d	rust/ffi: move APP_LAYER_PARSER_OPT_X const to ffi crate Ticket: 7666	3 months ago
Philippe Antoine	f1c66ff6f0	rust: remove obsolete const exclusions in cbindgen As these structs are now bindgened from C to suricata_sys crate	3 months ago
Philippe Antoine	d81a10126e	detect/doc: remove unexisting links Ticket: 8257 And add TODO comments if rules doc should be written	3 months ago
Philippe Antoine	8e39539161	detect/doc: fix broken anchor links Ticket: 8257	3 months ago
Philippe Antoine	bd6a436893	detect/doc: fix broken files links Ticket: 8257	3 months ago
Philippe Antoine	b0e63a2c95	detect/dcerpc: move stub_data keyword to rust Ticket: 8391	3 months ago
Philippe Antoine	3d56472d16	detect: bindgen more functions To prepare to move dcerpc.stub_data keyword to full rust	3 months ago
Jeff Lucovsky	746f471382	transform/subslice: Add subslice transform Issue: 7672 The subslice transform creates a slice of the input buffer. Specify the subslice desired -- nbytes and truncate are optional: subslice: offset <,nbytes> <,truncate> offset: Specifies the starting offset for the new subslice. When negative, expresses how far from the end of the input buffer to begin. nbytes: Specifies the size of the subslice. When negative, specifies that the subslice will end that many bytes from the end of the input buffer. Nbytes must be non-zero. When nbytes is not specified, the size of the subslice will be the size of the input buffer - offset. truncate: Specify behavior when offset + nbytes exceeds buffer length. When present, trims nbytes such that offset + nbytes equals buffer length. When not present, an empty buffer is produced. Examples: subslice: 1; - The subslice will be a copy of the input buffer but omits the input buffer's first byte "This is Suricata" -> "his is Suricata" subslice: 0, 13; - The slice is created from the first 13 bytes of the input buffer "This is Suricata" -> "This is Suric" subslice: 10, -5; - The subslice is created starting at offset 10 and continues to 5 bytes before the end of the input buffer "This is Suricata" -> "r" subslice: -3; - The subslice will be the last 3 bytes of the input buffer. "This is Suricata" -> "ata"	3 months ago
Philippe Antoine	4fc6ca5d6c	detect/dcerpc: move iface keyword to rust Ticket: 8391 Use same buffer dce_generic as for dcerpc.opnum (name dce_generic is enforced by a SV test currently)	3 months ago
Philippe Antoine	9677851637	rust/ffi: move app-layer traits to ffi crate Ticket: 7666 Traits around structures defined in C and bindgened to rust	4 months ago
Philippe Antoine	f803c25f24	rust/ffi: move export_X_data_get macros to ffi crate Ticket: 7666	4 months ago
Philippe Antoine	54b6885166	rust/ffi: move conf_get_bool helper to ffi crate Ticket: 7666	4 months ago
Victor Julien	28a3337c27	rust: cargo update	4 months ago
Philippe Antoine	5f9e436c3f	detect/dcerpc: support generic integer for opnum keyword Ticket: 8179	4 months ago
Philippe Antoine	67379b009a	detect/dcerpc: move opnum keyword to rust Ticket: 8391	4 months ago
Philippe Antoine	a36af353bc	rust: bindgen SCFlowGetAppProtocol	4 months ago
Jason Ish	fd31e50954	ntp: enable keywords for firewall mode Ticket: #8394	4 months ago
Jason Ish	713e4eb900	ntp: convert reference_id to buffer and add keyword Store the NTP reference ID as raw network-order bytes so it can be exposed as a sticky buffer and matched with payload keywords. The reference ID is often a 4 character string, or an IP address and not just an integer identifier. Updates the log reference ID to be a string of colon separated hex digits as this matches what tshark does. Ticket: #8488	4 months ago
Jason Ish	991e7f3b1d	ntp: add ntp.mode keyword This keyword also accepts strings for known mode names. Ticket: #8429	4 months ago
Jason Ish	c10c482290	ntp: add ntp.stratum keyword Ticket: #8431	4 months ago
Jason Ish	ec344fe68d	ntp: add ntp.version keyword SNMP was used as a template. Ticket: #8430	4 months ago
Jason Ish	74bb525401	ntp: create tx for all modes; log version, mode and stratum Add logging for version, mode and stratum as these will be the first keywords we will add. Ticket: #8425	4 months ago
Jason Ish	879846e153	ntp: remove unused event types NotRequest and NotResponse event type have never been used. Unsolicited is also unused, however there is a rule for it so removing support would be a breaking change at this time.	4 months ago
Jason Ish	31b967b089	ntp: add transaction logging Adds basic NTP transaction logging for the current supported message types. Includes small cleanups around reference ID. Ticket: #8425	4 months ago
Victor Julien	c7cd3b17c3	snmp: minor snmp.pdu_type type cleanup	4 months ago
Victor Julien	2cef1404bc	detect/snmp: let generic keyword share the same list	4 months ago
Victor Julien	670fdabd32	detect/snmp: add snmp.trap_type keyword Implemented as a U8 integer keyword. Ticket: #8482.	4 months ago
Philippe Antoine	8ac9a62ec4	detect: enable snmp keywords for firewall mode Ticket: #8395	4 months ago
Philippe Antoine	63603fe14a	detect/snmp: sticky buffers at progress 1 Since snmp txs are created at progress 1 which is the completion, this does not change detection, except allowing firewall mode to use these keywords with generic hook like snmp:request_complete Ticket: 8395	4 months ago
Philippe Antoine	8f824458c2	detect: helper for buffer register requires progress Ticket: 8395 For protocols where tx are complete at start, that is the `tx_get_progress` function returns 1 inconditionnally, we can use the progress 1, not losing time on detection in ips mode, and getting ready for firewall mode For the other protocols (where a tx needs both a request and response for instance), keep progress 0 as was the case before	4 months ago
Jason Ish	eb46d0129e	rust/ffi: add eve callback handler Wrap the EVE callback handler with a Rust friendly variant that allows the user to register a callback as a closure which is provided an already wrapped JsonBuilder object. Ticket: #8477	4 months ago
Jason Ish	199e844a07	rust/ffi: add mark support to ffi::jsonbuilder To support Rust friendly EVE callback registration (ticket 8477).	4 months ago
Philippe Antoine	58a71d94b0	rust/ffi: move conf_get helper to ffi crate Ticket: 7666	4 months ago
Philippe Antoine	8d254f5630	dhcp/output: log app-layer metadata in alerts Ticket: 6091 log as extended	4 months ago
Philippe Antoine	db980daf5f	dhcp: standardize output code To prepare to add metadata in alerts Ticket: 6091	4 months ago
Philippe Antoine	d14af54b3b	detect/transforms: constify some callbacks arguments Ticket: 8298	4 months ago
Philippe Antoine	0a24f0afe2	smb: parse smb1 session setup with word count 13 Ticket: 5845	4 months ago
Jason Ish	98469b0f56	rust/ffi: fix clippy warnings Remove the unneeded return. The other option would be to allow it, but so far in the ffi crate we don't have any non-default allows.	4 months ago
Philippe Antoine	c53b9df5a2	rust/ffi: move detection helpers to ffi crate Ticket: 7666	4 months ago
Philippe Antoine	4f4912c042	rust: bindgen SIGMATCH_ constants	4 months ago
Philippe Antoine	2fa10052cf	websocket: check pdu opcode for reassembly Ticket: 8413 RFC 6455 Section 5.4 states Control frames (see Section 5.5) MAY be injected in the middle of a fragmented message. Control frames are identified by opcodes where the most significant bit of the opcode is 1.	4 months ago
Philippe Antoine	7b0528d85f	http2: set response_frame_size Ticket: 8410 Do not set only request_frame_size whatever the direction	4 months ago
Philippe Antoine	267c3baff7	rust/ffi: move STREAM_ constants to ffi crate Ticket: 7666 reexport them in suricata crate cbindgen them to C	5 months ago
Philippe Antoine	61c667400b	rust: remove obsolete inclusions from cbindgen.toml	5 months ago
Philippe Antoine	fd4c6d4e06	rust: remove obsolete struct exclusions in cbindgen As these structs are now in suricata_sys crate	5 months ago
Philippe Antoine	a10a818792	rust: remove obsolete constants exclusion from cbindgen.toml Completes commit `71b59f6dbe` These const are no longer defined in rust suricata crate	5 months ago
Jason Ish	dce2deee5e	rust: pin unicode-segmentation crate to 1.12.0 unicode-segmentation (used by rustyline) was updated from 1.12.0 to 1.13.1 earlier and requires a newer version of Rust. Pin to 1.12.0 which works with Rust 1.75.0.	5 months ago
Philippe Antoine	34ed8958a6	dcerpc: only log the tx interfaces Not all the state ones Ticket: 8378	5 months ago
Philippe Antoine	05a11e2897	dcerpc: store persistently contexts So that we can log and detect on interface uuids, even if AlterContext packets change one of the contexts, but other contexts are still used after it in request/responses Ticket: 8378	5 months ago
Jason Ish	9cab99fbd3	rust: rust fmt derive crate	5 months ago
Jeff Lucovsky	14ebba6382	gen/unused: Remove unused function Remove unused function is_alphanumeric_or_slash	5 months ago
Jeff Lucovsky	98070a7ace	misc/cleanup: remove rust if <cond> .... Cleanup the few instances of rust where if cond return true else false exist rg = ripgrep rg -n -U '^\sif . \{\s\n\sreturn true;\s\n\s\}\s\n\sreturn false;' rust/src/ --glob '.rs' rg -n -U '^\sif .* \{\s\n\sreturn false;\s\n\s\}\s\n\sreturn true;' rust/src/ --glob '*.rs'	5 months ago
Philippe Antoine	6587e363a3	dcerpc: use bind context_id in SMB Ticket: 8375 logger already read this variable but it was never set, and the rust compiler did not warn about this Allows to log the interface uuid when ctx_id > 0 Wireshark filter for related pcaps dcerpc.cn_ctx_id > 0 && dcerpc.pkt_type == 0	5 months ago
Philippe Antoine	2c2a3c800f	dcerpc: support multiple PDU in one parser call Ticket: 7254 With TCP, we receive a stream of data, which may contain multiple PDUs in one call	5 months ago
Philippe Antoine	db51314478	rust: rustfmt dcerpc.rs	5 months ago
Philippe Antoine	55ad2953bf	dcerpc: do not error the whole flow on unhandled packet type Ticket: 5133	5 months ago
Jason Ish	e9f8e17b16	rust/Makefile: add RUSTC and RUSTDOC to CARGO_ENV And consistently use the CARGO_ENV for all cargo calls. This allows a user to point to rust binaries that are not on their path just during ./configure, for example: PATH=/usr/lib/rust-1.89/bin:$PATH ./configure ... The full path to rustc and rustdoc will now be used, as discovered in the PATH without the user have to carry the path over to the "make" command. This was already done for cargo. Related to ticket: #8381	5 months ago
Philippe Antoine	ebe0ba4ebb	rust: limit clap verson to 4.5.57 clap 4.5.58 and further requires edition2024 which is incompatible with MSRV	5 months ago
Philippe Antoine	76d2925bdf	ldap: abandon request does not wait for a response Ticket: 8356 As such, abandon request is a complete tx	5 months ago
Philippe Antoine	784e173278	http2: bound number of http2 frames per tx Ticket: 8289 If stream.reassembly.depth is unlimited, an attacker controlling the 2 sides of a communication going through Suricata can send a transition with an infinite number of headers, until suricata OOMs Solution is to offer a configuration option to bound the number of HTTP2 frames we store in a HTTP2 transaction, and produce an anomaly if this bound is crossed	5 months ago
Philippe Antoine	49fd7001ff	smtp/mime: fix urls finding in buffering case We used to look for a full line, but as we look fot the last eol we need to use the right index in the not-reversed list	5 months ago
Philippe Antoine	8bba47aa09	smtp/mime: avoid quadratic complexity in mime_smtp_find_url_strings Ticket: 8292 When we have buffered something in ctx.decoded_line, we already looked for '\n' in it, so we do not need to run it again Otherwise, callers that supply mime_smtp_find_url_strings with a few bytes at a time without "\n", have a quadratic complexity	5 months ago
Philippe Antoine	062f56ddde	detect/http2: use ThreadCtx for all headers keywords Instead of custom inefficient "escaped" Vec Ticket: 8291	5 months ago
Philippe Antoine	4e538dfa3b	detect/http2: use ThreadCtx for http.request_header And also for http.response_header Instead of custom inefficient "escaped" Vec Ticket: 8291	5 months ago
Philippe Antoine	0933e944df	detect/http2: use ThreadCtx for http.header.raw Instead of custom inefficient "escaped" Vec Ticket: 8291	5 months ago
Philippe Antoine	711de8a5ea	detect/http2: use ThreadCtx for http.header Instead of custom inefficient "escaped" Vec Ticket: 8291	5 months ago
Philippe Antoine	52a2f2dd19	detect/http2: use ThreadCtx for http.header_names Instead of custom inefficient "escaped" Vec Ticket: 8291	5 months ago
Jason Ish	648a867049	psl: update to 2.1.197 Update the Mozilla public suffix list to 2.1.197.	5 months ago
Philippe Antoine	8e886a8ecd	krb5: use app-layer incomplete support Ticket: 3540 Ticket: 8305	5 months ago
Philippe Antoine	d77c43c79b	rust/ffi: move build_slice macro to ffi crate Ticket: 7666	5 months ago
Philippe Antoine	4a0143c8d4	rust/ffi: move cast_pointer macro to ffi crate Ticket: 7666	5 months ago
Shivani Bhardwaj	d241237c0f	Revert "dcerpc: fix consumed bytes post gap handling" This reverts commit `fc9da1c7a1`. That commit incorrectly used consumed as index of the slice passed to the Frame API. Found by oss-fuzz.	5 months ago
Jeff Lucovsky	ed882ede68	output/ipv6: Utility function to compress IPv6 addrs Issue: 7399 Utility function to compress IPv6 addresses per RFC-5952	5 months ago
Giuseppe Longo	de46f4ba9d	ldap: set invalid_data event Currently in parse_request function LdapEvent::InvalidData is not set when a request is not parsed correctly. Ticket #8258	5 months ago
Victor Julien	b55be5a44f	detect/transforms: update gunzip / zlib_deflate syntax Use standard space separated syntax.	5 months ago
Philippe Antoine	71b59f6dbe	rust/ffi: move IPPROTO_TCP to ffi and reexport in suricata Allows to reduce dependencies to full suricata crate Ticket: 7666	6 months ago
Philippe Antoine	d5ea973791	detect/ike: move ike.ike.chosen_sa_attribute keyword to rust Ticket: 8310 And increases expressivity on the way by supporting other modes than equality	6 months ago
Philippe Antoine	55333a6ca0	detect/ike: move ike.vendor keyword to rust Ticket: 8310	6 months ago
Philippe Antoine	14edd66494	detect/ike: move ike.nonce_payload keyword to rust Ticket: 8310	6 months ago
Philippe Antoine	d1213e4440	detect/ike: move ike.key_exchange_payload keyword to rust Ticket: 8310	6 months ago
Philippe Antoine	f23169c924	detect/ike: move ike.nonce_payload_length keyword to rust Ticket: 8310	6 months ago
Philippe Antoine	e85bf5be4d	detect/ike: move ike.key_exchange_payload_length keyword to rust Ticket: 8310	6 months ago
Philippe Antoine	841fe44f34	detect/ike: move ike.exchtype keyword to rust Ticket: 8310	6 months ago
Philippe Antoine	23032ebc65	detect/ike: move ike spi keywords to rust Ticket: 8310	6 months ago
Philippe Antoine	539e4ee665	detect/transforms: add zlib_deflate transform Ticket: 7846	6 months ago
Philippe Antoine	dbea660729	detect/transforms: add gunzip transform Ticket: 7846	6 months ago
Victor Julien	336a9d05ca	krb5: fix TCP record parsing A logic error in multi-record parsing meant only the first record was parsed. Bug: #8278.	6 months ago
Jason Ish	6b850dddb8	rust/ffi: JsonBuilder wrapper around C JsonBuilder API For use by plugins that need to work with JsonBuilder.	6 months ago
Jason Ish	f6b11ac855	output-eve: finish exposing to bindgen As all out output-eve.h is now exposed, merge output-eve.h and output-eve-bindgen.h back into one file, output-eve.h.	6 months ago
Jason Ish	f79158ae55	rust/sys: generate jsonbuilder bindings in sys Bindgen the Rust bindings to the C JsonBuilder API along with the rest of the Rust bindings to C. Breaking it out was probably the wrong idea. This should make it easier, and more correct to bindgen C functions that use SCJsonBuilder types.	6 months ago
Jason Ish	f951477461	rust/debug: use functions from ffi crate where possible It's not possible to use all the functions and macros from the ffi crate in the main Suricata crate, as there are conditionals around when running in test mode, and "cargo test" doesn't propagate the "cfg(test)" to test crates. Which for now means duplicating the macros and some functions.	6 months ago
Jason Ish	8b69089cb8	rust/ffi: more rust friendly plugin registration A plugin can now create a "Plugin" struct with Rust strings. The `into_raw` method converts it to a raw pointer suitable for returning during plugin registration.	6 months ago
Jason Ish	0999530726	rust/ffi: rust wrapper around eve filetype registration	6 months ago
Jason Ish	2d0bf9a2ed	output-eve: bindgen SCEveFileType callback types	6 months ago
Jason Ish	b4db7bdaee	rust/ffi: add logging (debug) wrappers Mostly a copy of Suricata core's logging wrappers into the ffi crate. These are not yet used by Suricata-core as they do require the Suricata library to be available, which is not the case with tests. And the `cfg(test)` parameter is not passed through to sub-crates. However, this does allow a plugin (or library) to call the logging macros without depending on the "suricata" crate. Ticket: #7666	6 months ago
Jason Ish	2c51744ccc	rust/ffi: stub out a rust ffi crate This crate is for Rust wrappers around the -sys crate which includes only raw bindings. This is the place to add nice wrappers around those bindings, however it should remain clear of dependencies on the main Suricata core crates. Ticket: #7666	6 months ago
Jason Ish	e9611a4d7c	output-eve: bindgen SCRegisterEveFileType to Rust Used by Rust output plugins.	6 months ago
Jason Ish	1b182025bc	output-eve: expose SCEveFileType to Rust with bindgen There is an unfortunate side-affect that one has to read output-eve-bindgen.h for the documentation on this type, however, I think we can resolve that in time.	6 months ago
Philippe Antoine	536242341b	detect/smb: move smb.version keyword to rust Ticket: 8267	6 months ago
Philippe Antoine	df495d7e22	rust: bindgen SCDetectGetLastSMFromLists to use it from rust keywords	6 months ago
Philippe Antoine	697c641400	detect/smb: move smb share and named_pipe keywords to rust Ticket: 8267	6 months ago
Philippe Antoine	667f8b2eb7	detect/smb: move smb ntlmssp keywords to rust Ticket: 8267	6 months ago
Victor Julien	a2e9ac21f8	flow: turn flags field into uint64_t Entire space is used.	6 months ago
Jason Ish	b0c912588c	mqtt/detect: fix mqtt_parse_bool return type Previously we were boxing a u8 and returning it as a pointer to a boolean. While this is probably not an issue itself, the value 2 was allowed to be converted to a boolean, which is undefined behavior in Rust.	6 months ago
Jason Ish	b9e0f9cc8b	rfb/detect: fix rfb_parse_sec_result return type The data parsed is a u32, but returned as DetectUintData<u8>, then later free'd as a DetectUintData<u32>.	6 months ago
Jason Ish	8b2a7ac47c	nfs/detect: fix nfs_procedure_parse return type Was returning DetectNfsProcedureData as a pointer to DetectUintData<u32>, and free'ing it as such.	6 months ago
Jason Ish	e474e45429	dns/detect: fix rcode return type The parsed DNS rcode was being returned as a DetectUintData<u8>, but is parsed, and free'd as a u16. So return a DetectUintData<u16>.	6 months ago
Jason Ish	c7f806a728	rust/sys: allow unknown lints allow(unpredictable_function_pointer_comparisons) is needed on newer versions of Rust, but is unknown to our MSRV, so for now, allow unknown lints.	6 months ago
Philippe Antoine	364d2c077d	rust: bindgen SCAppLayerRegisterParser Ticket: 7662	6 months ago
Philippe Antoine	8401417a84	app-layer: remove some obsolete forward declarations and reorder definitions	6 months ago
Philippe Antoine	8857b78f6a	rust: move AppLayerTxData definition to C and bindgen it to rust Will make easier the bindgen of RustParser structure which uses a callback which uses AppLayerTxData Move also the free function to C SCAppLayerTxDataCleanup As suricata-sys crate defines AppLayerTxData for rust, It must itself implement the Drop trait, and thus, We need to define a feature surest	6 months ago
Philippe Antoine	8eaced3c1e	rust: move AppLayerResult definition to C and bindgen it to rust Will make easier the bindgen of RustParser structure which uses a callback which uses AppLayerResult Keep From<> impl in sys crate that defines it	6 months ago
Philippe Antoine	06f78b2a22	rust: move StreamSlice definition to C and bindgen it to rust Will make easier the bindgen of RustParser structure which uses a callback which uses StreamSlice	6 months ago
Philippe Antoine	41f543ca35	rust: move AppLayerGetTxIterTuple definition to C and bindgen it to rust Will make easier the bindgen of RustParser structure which uses a callback which uses AppLayerGetTxIterTuple	6 months ago
Philippe Antoine	64d29fcd1c	rust: move AppLayerStateData definition to C and bindgen it to rust, and use default trait instead of new Will make easier the bindgen of RustParser structure which uses a callback which uses AppLayerStateData	6 months ago
Philippe Antoine	76efb8af4d	rust: move AppLayerGetFileState definition to C and bindgen it to rust. Will make easier the bindgen of RustParser structure which uses a callback which uses AppLayerGetFileState	6 months ago
Philippe Antoine	fc23e54c6d	rust: bindgen with derive eq As will be needed such as AppLayerTxData	6 months ago
Shivani Bhardwaj	d4008a6508	dcerpc: remove bad tests Unittests test_parse_bind_pdu_infinite_loop and test_parse_bindack_pdu_infinite_loop seem to have artificially made up header which does not hold up to the strict calculations enforced by the parser now. Their headers mark the fraglens as 64 and 72 respectively which are not enough to hold the kind of bind(ack) items that are expected. It worked so far as the parser passed the entire input slice around but with the bugfix for issue 7546, the input passed around is strictly restricted to the fraglen parsed in the header. Bug 7546	6 months ago
Shivani Bhardwaj	ed1bd8624e	dcerpc: use fraglen from header So far, the fraglen defined in the header was used inconsistently in certain places to define bounds on input length. Make it consistent by making sure that only a slice up until fraglen is passed around as that is the maximum length the fragment should have. With the help of Applayer::incomplete API, the case when the stream_slice passed to the parser is smaller than the header defined fraglen is already handled. Bug 7546	6 months ago
Shivani Bhardwaj	fc9da1c7a1	dcerpc: fix consumed bytes post gap handling The parser could receive an input that consists of arbitrary data post gap. This is handled in the beginning of the fn handle_input_data. However, the rest of the calculation does not take into account the bytes that were consumed at this stage. Fix the indices and calculations to consider a new DCERPC fragment beginning post these consumed bytes.	6 months ago
Philippe Antoine	9a52bbcbe9	detect/quic: move quic.cyu.hash to rust Ticket: 8255	6 months ago
Philippe Antoine	01610aabe7	detect/quic: move quic.cyu.string to rust Ticket: 8255	6 months ago
Philippe Antoine	ee4d4a14d5	detect/quic: move quic.ua to rust Ticket: 8255	6 months ago
Philippe Antoine	9ba9fdcb87	detect/quic: move quic.sni to rust Ticket: 8255	6 months ago
Philippe Antoine	907e71a984	detect/quic: move quic.version to rust Ticket: 8255	6 months ago
Philippe Antoine	7dbe033ae0	app-layer: function to register ci pattern + probe Ticket: 6591	6 months ago
Philippe Antoine	2cf9a327d5	detect/ssh: move ssh.hassh to rust Introduces helper SCDetectRegisterBufferLowerMd5Callbacks	6 months ago
Philippe Antoine	83360cfce0	detect/ssh: move ssh.hassh string to rust bindgen needed SCSigMatchSilentErrorEnabled on the way	6 months ago
Philippe Antoine	02cb0f2ac2	rust: fix unnecessary_unwrap warnings warning: called `unwrap` on `rd.pipe` after checking its variant with `is_some` --> src/smb/smb1.rs:858:28 \| 857 \| if rd.pipe.is_some() { \| -------------------- help: try: `if let Some(<item>) = rd.pipe` 858 \| let pipe = rd.pipe.unwrap(); \| ^^^^^^^^^^^^^^^^ \| = help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.93.0/index.html#unnecessary_unwrap = note: `#[warn(clippy::unnecessary_unwrap)]` on by default	7 months ago
Philippe Antoine	cafc398355	dcerpc: consume bytes after gap resync Ticket: 7567 Re-applies commit `8c3bd3e8a0` which was reverted in `f64aec9d11`	7 months ago
Philippe Antoine	54cc752cf9	ssh: hassh can be truly disabled Rules will not re-enable it Ticket: 8223	7 months ago
Philippe Antoine	458211dcf2	detect/ssh: move ssh.proto to rust	7 months ago
Philippe Antoine	9cfc1cc557	detect/ssh: move obsolete keywords to rust	7 months ago
Philippe Antoine	ea8ac2a02a	detect/ssh: move ssh.software to rust Adds helper function SCDetectHelperBufferProgressMpmRegister on the way	7 months ago
Philippe Antoine	c0d6747e82	app-layer: GetTxIteratorFn uses a AppLayerGetTxIterState Even if every current rust parser uses the u64 variant of the C union	7 months ago
Philippe Antoine	4b541b39f2	rust: move AppLayerEventType definition to C and bindgen it to rust. Will make easier the bindgen of RustParser structure which uses a callback which uses AppLayerEventType	7 months ago
Philippe Antoine	c960b7d7c1	app-layer: AppLayerParserFPtr uses a mut pointer to local storage So, fix the fn prototype in rust ParseFn	7 months ago
Philippe Antoine	f470ee448b	quic: use standard tx iterator code Will make bindgen life easier As the fn prototype should not have istate: &mut u64 but a *mut AppLayerGetTxIterState which is an union with a u64	7 months ago
Philippe Antoine	076fcd61cd	bittorrent: use standard tx iterator code Will make bindgen life easier As the fn prototype should not have istate: &mut u64 but a *mut AppLayerGetTxIterState which is an union with a u64	7 months ago
Philippe Antoine	1a546936c7	rust: AppLayerTxConfig uses Default impl	7 months ago
Philippe Antoine	4e64de3b3b	rust: remove wrapper LoggerFlags struct definition just use an u32 out of the box. Will make bindgen like easier	7 months ago
Philippe Antoine	f663be5983	rust: define every RustParser fn pointer unsafe That is what bindgen will do	7 months ago
Lukas Sismis	3e4fdb2118	misc: time unit parsing function	7 months ago
Philippe Antoine	5bb9a0c3af	dcerpc/tcp: fix fragmentation handling Really count the fragments, and set it done when last was received	7 months ago
Philippe Antoine	f64aec9d11	dcerpc: use different header for different directions Header handling is wrong in the case packet A to server is fragmented (return AppLayerResult::incomplete) packet B is to client, but uses the header of the to_server packet Bug 7547	7 months ago
Philippe Antoine	1832b50506	nfs: log read/write/rename whatever the nfs version These were previously logged correctly only for nfs v3 Now, the correct opcodes are used for v2 and v4 as well Ticket: 8222	7 months ago
Philippe Antoine	b0850efd67	rust: from_str implementation for EncryptionHandling To move non-specific quic code to the right place	7 months ago
Philippe Antoine	89b6ab6730	rust: rename EncryptionHandling as it is no longer specific to SSH	7 months ago

1 2 3 4 5 ...

2343 Commits (e08a19a88ae5ce2962f87f7b2492807099e0b76a)