suricata

Commit Graph

Author	SHA1	Message	Date
Victor Julien	9555e3add6	rdp: fix tx id handling Tx ID handling did not take the required + 1 into account. From a report: RDP can skip cleanup because its id convention does not match the generic Rust iterator. The generic iterator in applayer.rs returns tx.id() - 1, and cleanup trusts that id when calling StateTransactionFree in app-layer-parser.c. RDP registers that iterator in rdp.rs, but RdpTransaction::id() returns the stored id unchanged in rdp.rs, while free_tx also compares against the raw stored id in rdp.rs. For a single freeable RDP tx with stored id 1, the iterator returns C id 0; cleanup calls free_tx(0), nothing is removed, then has_next == false allows min_id to advance to total_txs in app-layer-parser.c. That leaves the tx live but now below min_id, so later cleanup will not revisit it. This patch brings the handling in line with the other parsers. Bug: #8717.	4 months ago
Jason Ish	e7e837c6af	psl: update to latest version Ticket: #8147	4 months ago
Philippe Antoine	3b994e807d	detect/mqtt: bitflags do not support multi integer Ticket: 7929 As both syntaxes share comma as delimiter	4 months ago
Philippe Antoine	06855cd832	detect/nfs: nfs_procedure does not support multi integer Ticket: 7929	4 months ago
Philippe Antoine	cb0ecb1722	detect/krb5: msg_type is not a multi integer Ticket: 7929 There is only one msg_type by tx	4 months ago
Philippe Antoine	be4c036071	detect/enip: status are not multi integers Ticket: 7929	4 months ago
Philippe Antoine	e08a19a88a	detect/enip: cip_class and cip_instance are now a multi-integer Ticket: 7929 One commit as they share the same code	4 months ago
Philippe Antoine	0bdfe3f571	detect/enip: cip_attribute keyword is now a multi-integer Ticket: 7929	4 months ago
Jeff Lucovsky	5af13e3eb0	rdp: mark transactions single-directional Mark the direction into RDP transactions at creation time, so the tx carries SKIP_INSPECT for the direction it is never seen in, matching DHCP and the other single-direction parsers. This lets cleanup free completed transactions and stops a tx from being inspected (and alerting) twice, once per direction. RDP bounds its transactions to connection setup and stops parsing once bypass_parsing is set. Issue: 8621	4 months ago
Jeff Lucovsky	3f86c56c80	dhcp: mark transactions single-directional to fix tx leak DHCP is a stateless parser where each datagram is its own standalone, single-direction transaction. It was creating transactions with AppLayerTxData::new(), which leaves both SKIP_INSPECT bits clear, so the engine treats every tx as still needing inspection in both directions. For a flow that only ever carries one direction (broadcast DHCP, or a relay seeing one side), the never-observed direction's inspect bit can never be set, so AppLayerParserTransactionsCleanup() never frees the tx. The per-flow transaction Vec then grows without bound and every packet re-scans the whole list, giving O(n^2) CPU and unbounded memory on a busy DHCP aggregation point. Use AppLayerTxData::for_direction() like every other stateless parser (DNS, SNMP, NTP, IKE, KRB5, MQTT, QUIC, SIP, WebSocket, bittorrent-dht) so the tx carries SKIP_INSPECT for the direction it will never be seen in. This lets cleanup free completed transactions and also stops the tx from being inspected (and alerting) twice, once per direction. Issue: 8621	4 months ago
Philippe Antoine	a81031591e	detect/krb5: move krb5.ticket_encryption to rust Ticket: 8648	4 months ago
Philippe Antoine	8f0dbc0b63	detect/krb5: move krb5.cname and krb5.sname to rust Ticket: 8648	4 months ago
Philippe Antoine	3327cf42f0	detect/krb5: move krb5_err_code to rust Ticket: 8648 Make it a generic integer on the way	4 months ago
Jason Ish	5856ced29c	ftp: support LIST and MLSD data channels Support LIST and MLSD on the ftp data channel. Ticket: #8664	4 months ago
Philippe Antoine	89dbce1b46	detect: convert tx_progress to uint8_t	4 months ago
Philippe Antoine	52490b8c26	ftp: do not error the flow on file before port Ticket: 8659 If a client sends a SOTR/RETR command before doing a PASV/PORT command, ther server may reply 425 Use PORT or PASV first.\r\n and allow the client to continue sendinf other commands So, Suricata should not put the whole flow into error, it just sets an event, and continues to parse further	4 months ago
Jeff Lucovsky	5d007ef25e	detect/xor: add inline variable key syntax Extend the xor transform to accept a variable-position key using the 'extract <nbytes> <offset>' syntax. The engine reads <nbytes> bytes at buffer position <offset> at transform time. The optional 'offset' parameter specifies where XOR decoding starts in the buffer; bytes before that position are left unchanged. Syntax: xor:"<hex_key>" xor:extract <nbytes> <offset> xor:offset <N>,"<hex_key>" xor:offset <N>,extract <nbytes> <offset> Variable-key helpers (VariableKeyLocation, variable_key_bytes, parse_key_location, strip_keyword_prefix) are imported from the new varkey module. The variable key bytes are copied out of the inspection buffer before decoding, so an in-place transform cannot corrupt the key when the key region overlaps the decoded range. Issue: 8671	4 months ago
Jeff Lucovsky	385bd4416b	detect/transforms: add varkey module for variable-key helpers Introduce rust/src/detect/transforms/varkey.rs to centralise helpers used by transforms that read key material directly from the inspection buffer at transform time. Exported items: VariableKeyLocation { offset: u16, nbytes: u8 } variable_key_bytes bounds-checked slice into an inspection buffer strip_keyword_prefix strip 'keyword<ws>' from option strings parse_key_location parse '<nbytes> <offset>' into VariableKeyLocation All four items are pub so any transform can import them. Unit tests are included in the module. Issue: 8671	4 months ago
Philippe Antoine	e6ee69c7da	rust: format all files except the ones with #[rustfmt::skip] Ticket: 3836	4 months ago
Philippe Antoine	ca34fba00c	rust: format smb files Ticket: 3836	4 months ago
Philippe Antoine	f8ac56c591	dcerpc: remove obsolete comment	4 months ago
Philippe Antoine	aea9fd73b7	rust: format dcerpc files Ticket: 3836	4 months ago
Philippe Antoine	c6014a77a2	websocket: accepts config value with units Ticket: 8552 As was the commented out example	5 months ago
Philippe Antoine	a9e1dff4a6	conf: introduce SCConfGetNonNull Ticket: 8651 Behaves like SCConfGet but returns 0 on null value	5 months ago
Philippe Antoine	e0152178da	rust: format detect files Ticket: 3836	5 months ago
Giuseppe Longo	695b4f4a3d	sip: remove incomplete data event It's no longer useful to set an event when the data is incomplete, since an error is returned. Ticket #8524	5 months ago
Giuseppe Longo	ba5e850264	sip: make pattern matching more robust SIP and SSDP share method names like NOTIFY and SUBSCRIBE, causing SSDP traffic to be misidentified as SIP. Add a probing parser callback that checks for "SIP/" in the payload before accepting a pattern match. Example of a misidentified flow before the fix: {"timestamp":"2014-02-27T19:44:43.164211+0100","flow_id":986757542077835,"event_type":"flow","src_ip":"192.168.1.1","src_port":9489,"dest_ip":"239.255.255.250 ","dest_port":1900,"ip_v":4,"proto":"UDP","app_proto":"sip","flow":{"..."}} After the fix: {"timestamp":"2014-02-27T19:44:43.164211+0100","flow_id":986757542077835,"event_type":"flow","src_ip":"192.168.1.1","src_port":9489,"dest_ip":"239.255.255.250 ","dest_port":1900,"ip_v":4,"proto":"UDP","app_proto":"failed","flow":{"..."}} Ticket #8355	5 months ago
Shivani Bhardwaj	0345b91ddd	rust: exclude DETECT_BYTEMATH_ENDIAN_DEFAULT from bindings to deal with the failure due to cbindgen updates and mismatches in generated bindings. detect-bytemath.c:61: error: "DETECT_BYTEMATH_ENDIAN_DEFAULT" redefined [-Werror] 61 \| #define DETECT_BYTEMATH_ENDIAN_DEFAULT (uint8_t) BigEndian \| In file included from rust.h:34, from detect-bytemath.c:32: ./../rust/gen/rust-bindings.h:5071: note: this is the location of the previous definition 5071 \| #define DETECT_BYTEMATH_ENDIAN_DEFAULT BigEndian \|	5 months ago
Giuseppe Longo	88f17d7b20	detect/sctp: add sctp.chunk_type keyword Add a U8 numeric keyword to match the first SCTP chunk type in a packet with prefilter support. Ticket #4251	5 months ago
Philippe Antoine	4144d9c709	rust: format snmp files Ticket: 3836	5 months ago
Jason Ish	546209ff12	bindgen: fix include ordering At some point, bindgen include ordering changed such that AppLayerGetFileState was being bindgen'd as opaque, as the definition of StreamBufferingConfig was not available when bindgen hit AppLayerGetFileState, and bindgen processes in order. Move the util includes before the app-layer includes to fix the ordering problem, but still keep util includes grouped. The sys diff is large as many things have been re-ordered.	5 months ago
William Ling	30628e45bc	rust: replace helper with built-in Replace custom u32_as_bytes with built-in to_be_bytes Issue: 5785	5 months ago
Philippe Antoine	9318bbfbdb	rust: format tftp files Ticket: 3836	5 months ago
Philippe Antoine	9ec200e834	rust: format x509 files Ticket: 3836	5 months ago
Philippe Antoine	dd66276f82	rust: format telnet files Ticket: 3836	5 months ago
Philippe Antoine	709ad1bdf4	rust: format sip files Ticket: 3836	5 months ago
Samaresh Kumar Singh	f06bb7d43e	dhcp: support option 52 overload Per RFC 2132 the BOOTP sname and file fields can hold extra DHCP options when option 52 is present, but the parser ignored them. After parsing the main options we now look up option 52 and walk sname or file as additional option streams, appending what we find to the same options vector so the logger and detection keywords see the overloaded values too. Bug: #8538.	5 months ago
Philippe Antoine	26bb18cfaa	http2: replace state todrop with a dedicated boolean Ticket: 8518	5 months ago
Philippe Antoine	8eed90ca9d	http2: global txs are unidirectional Ticket: 8518 Meaning they will now match only once per tx instead of twice: once for each direction	5 months ago
Philippe Antoine	daf68dc36f	http2: split progress per direction Ticket: 8518 Keywords that work for HTTP2 headers match now as soon as possible A push promise is now considered like a headers frame with regards to the progress (no dedicated "reserved" progress/state) http.protocol and http.stat_msg keywords are now registered at earliest progress, since these are synthetic like "HTTP/2" and not really seen on the wire. http.request_line and http.response_line match only on data, and not on headers, since we must wait the end of headers to be sure to have the full line http2.size_update now matches at headers progress as it should http2.frametype, http2.errorcode, http2.priority now match like http2.window, when the tx is complete from both sides, as a half-closed client may still send priority, rst_stream or window_update frames	5 months ago
Philippe Antoine	8217c51126	rust: format sdp files Ticket: 3836	5 months ago
Philippe Antoine	9d9d8df4cd	rust: format rdp files Ticket: 3836	5 months ago
Philippe Antoine	7352bae890	smb: avoid unsigned overflow debug assertion As we compute a padding, we can use wrapping_add as we only care about the low-weight bit anyways	5 months ago
Giuseppe Longo	8f205bb34f	llmnr: implement logger This adds an LLMNR protocol logger that reuses existing DNS functions, following the same approach as the mDNS logger: - No grouped logging - Rdata is logged in a field that is named after the rdata type - Types are logged in lower case - Flags are logged as an array Ticket #8366	5 months ago
Giuseppe Longo	13df0f7a06	llmnr: implement parser This adds a parser for LLMNR protocol over both UDP and TCP. The parser reuses the existing DNS functions since LLMNR shares the same wire format as DNS, but implements its own protocol-specific validation: - LLMNR-specific flag checks (C, TC, T bits) - Opcode validation (only standard query opcode 0 is valid) - An Event is set if Z-flag is set, since it's must be zero per RFC4795 LLMNR transactions inherit DNS behavior where each packet creates a new state with one transaction. Ticket #8366	5 months ago
Jason Ish	3dc8b154f3	rust/ffi: add safe thread storage wrapper Add a typed ThreadStorage<T> wrapper around the thread storage bindings. Ticket: #8445	5 months ago
Jason Ish	9f40968bba	rust/ffi: bindgen thread storage Ticket: #8445	5 months ago
Jason Ish	5e0abf1572	rust/ffi: use ThreadVars wrapper in flow callbacks Update the flow init, update and finish callback registrations to pass the safe ThreadVars wrapper instead of a raw pointer. Ticket: #8598	5 months ago
Jason Ish	1cac242948	rust/ffi: use ThreadVars wrapper in eve callback Update the EVE callback registration to pass the safe ThreadVars wrapper instead of a raw pointer. Ticket: #8598	5 months ago
Jason Ish	45762aa644	rust/ffi: use ThreadVars wrapper in thread init callback Update the thread init callback registration to pass the safe ThreadVars wrapper instead of a raw pointer. Ticket: #8598	5 months ago
Jason Ish	5fe88212c3	rust/ffi: add wrapper around ThreadVars A Rust wrapper around ThreadVars to enforce Rust lifetimes to ThreadVars when used in a callback. Ticket: #8598	5 months ago
Philippe Antoine	73193c7e6a	rust: format pgsql files Ticket: 3836	5 months ago
Philippe Antoine	3bfe6cf4b9	rust: format nfs files Ticket: 3836	5 months ago
Juliana Fajardini	372cb8c692	rust/sys: update bindgen SIGMATCH_ constants Part of Ticket #8551	5 months ago
Jason Ish	144f824f17	rust/ffi: add thread init callback wrapper Ticket: #8605	5 months ago
Jason Ish	c689af0bbb	rust/ffi: bindgen thread lifecycle callbacks Ticket: #8605	5 months ago
Philippe Antoine	07112bc7ae	rust: format mqtt files Ticket: 3836	5 months ago
Philippe Antoine	844f2effa3	rust: format modbus files Ticket: 3836	5 months ago
Philippe Antoine	db019ebefe	rust: format ike files Ticket: 3836	5 months ago
Philippe Antoine	bcc1e6ae32	rust: format http2 files Ticket: 3836	5 months ago
Philippe Antoine	1070e733d8	rust: format websocket files Ticket: 3836	5 months ago
Philippe Antoine	89e5332d88	rust: format utils files Ticket: 3836	5 months ago
Philippe Antoine	edf29b0000	rust: format ssh files Ticket: 3836	5 months ago
Philippe Antoine	fe27a2159c	rust: format rfb files Ticket: 3836	5 months ago
Philippe Antoine	5cca346f16	rust: format quic files Ticket: 3836	5 months ago
Philippe Antoine	415360d9e8	rust: format ntp files Ticket: 3836	5 months ago
Philippe Antoine	fa864f9c2f	rust: format mime files Ticket: 3836	5 months ago
Philippe Antoine	2cfcaec1b0	rust: format ldap files Ticket: 3836	5 months ago
Philippe Antoine	64e7c671cc	rust: format ftp files Ticket: 3836	5 months ago
Philippe Antoine	f217e249cb	rust: format ffi files Ticket: 3836	5 months ago
Philippe Antoine	f7c14809f4	rust: format enip files Ticket: 3836	5 months ago
Philippe Antoine	e526eb8e2b	rust: format bittorrent_dht files Ticket: 3836	5 months ago
Philippe Antoine	f5ac0e201c	rust: format asn1 files Ticket: 3836	5 months ago
Philippe Antoine	1ced97bdbb	rust: format applayertemplate files Ticket: 3836	5 months ago
Philippe Antoine	efe3b16aac	rust: feature debug in main crate enables feature debug in ffi	5 months ago
Philippe Antoine	b90adcc2bb	rust/ffi: move AppLayerTxData to ffi Ticket: 7666	5 months ago
Philippe Antoine	bce88dd83f	rust: build depends on ffi/Cargo.toml.in	5 months ago
Philippe Antoine	0773fba5fd	rust/ffi: move txdata flags to ffi Ticket: 7666	5 months ago
Philippe Antoine	2525ea2e37	rust/ffi: move direction to ffi Ticket: 7666	5 months ago
Philippe Antoine	5440e41314	rust/ffi: move debug validations macros to ffi Ticket: 7666	5 months ago
Philippe Antoine	bf64b52b95	http2: better compression against decompression bombs Ticket: 8513 Suricata decides at 2 levels if a http2 flow is doing a compression bomb. There is a direct computation when one chunk of TCP data is being parsed. In this case, do not take the ratio into account, just use the size of the decompressed data, so that if we get a big chunk of TCP data like 1 MiB, and a not so high ratio of 200, we do not trigger the debug assertion in util-file.c about 64MiB The other case stays unchanged : when accumulating over the lifetile of a flow with multiple txs, take into account the compression ratio, so that a flow of many txs, having a super high (brotli) compression ratio, ends up classified as a compression bomb. (For example, having 100 txs each turning a 100 byte input into a 700 KiB one)	5 months ago
Philippe Antoine	6d437956e2	detect/transforms: dotprefix can be chained Ticket: 8537 Otherwise, it may cause a use-after-free, in case of reallocated buffer and we used the buffer inspect which was freed.	5 months ago
Philippe Antoine	2b20a436e7	detect/transforms: decompress checks earlier if it is in-place Ticket: 8536 Otherwise, it may cause a use-after-free. So, need to allocate the temporary vector, before calling SCInspectionBufferCheckAndExpand	5 months ago
Philippe Antoine	4c42998feb	detect/engine: helper to know if a transform happens in-place	5 months ago
Philippe Antoine	7bf48b02be	http2: protection against decompression bombs Ticket: 8513 During decompression, fail early if we have a big decompression ratio, and enough data. Track this data also during a tx lifetime, and even a flow/state lifetime, so that we set event and fail also if the compression bomb is split over multiple packets	5 months ago
Philippe Antoine	29e4b08647	http2: code refactoring to split big function	5 months ago
Philippe Antoine	e98d419d96	ldap: bound the number of responses Ticket: 8405	5 months ago
Victor Julien	6ebd0c3cc2	http2: check for HTTP1 protocol during upgrade path Ticket: 8492	5 months ago
Philippe Antoine	10bde66586	nfs: bound file_additional_procs to 1 Ticket: 8418 As we only need to know we saw at least one NFSPROC3_COMMIT	5 months ago
Philippe Antoine	aea7ee21b8	nfs: bound namemap by using lru Ticket: 8418	5 months ago
Philippe Antoine	a50f494ef6	nfs: bound requestmap and use lru Ticket: 8418	5 months ago
Juliana Fajardini	d442c3544c	detect: opt-in keywords for firewall mode - tls.cert_chain_len - datarep - dataset - dns.opcode Part of Ticket #8387	5 months ago
Philippe Antoine	f0e246de34	detect/mqtt: reason_code keyword is now a multi-integer Ticket: 7929 Builds a vector of the reason code in a tx to do so, except if we use the default "any", where we do not append to the vector, but just run detection while iterating	6 months ago
Philippe Antoine	614c48d3c3	ikev2: remove unused field Ticket: 8415	6 months ago
Jeff Lucovsky	9ea2e29581	ftp: raise too_many_transactions event on overflow Other parsers (SMB, POP3, ENIP) already raise a too_many_transactions event when a flow exceeds its per-flow transaction limit. FTP had the limit wired up through app-layer.protocols.ftp.max-tx but just dropped the excess transaction on the floor with a "FTP does not set events yet..." TODO, so no event was raised when the limit was reached. Add the FtpEventTooManyTransactions variant, a stock rule at sid 2232002, and raise the event from FTPTransactionCreate when the live-tx count goes past ftp_config_maxtx. Issue: 8489	6 months ago
Jason Ish	cb69fa4e53	rust/ffi: add flow lifecycle callback wrappers Provide Rust friendly callback registrations for flow init, update and finish events. These callbacks are implemented as Rust closures. Ticket: #8446	6 months ago
Jason Ish	d4dc8be3b2	rust: bindgen flow lifecycle callbacks Ticket: #8446	6 months ago
Philippe Antoine	e38888810d	detect/dcerpc: avoids FP on dcerpc.iface keyword When we got a bind without the first fragment flag, and did not set any_frag in the signature, the signature always matched, whatever the uuid value Ticket: 8457	6 months ago
Jason Ish	8968b1c5a1	psl: update to 2.1.206 Update the public suffix list to latest release.	6 months ago
Philippe Antoine	5ed394b26b	rust/ffi: move AppLayerEvent to ffi Ticket: 7666	6 months ago
Philippe Antoine	59b6de8239	rust: fix last collapsible_match warnings The ones where we need to remove a debug log	6 months ago
Philippe Antoine	1cdff9de8e	rust: fix collapsible_match warnings warning: this `if` can be collapsed into the outer `match` help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.95.0/index.html#collapsible_match	6 months ago
Jason Ish	899e9f045e	ntp: expose logged fields to lua This includes: - version - mode - stratum - reference_id Ticket: #8533	6 months ago
Jason Ish	81692dd2c1	rust/lua: add method for pushing bytes Much like pushstring, but accepts an &[u8] as an argument instead of an &str. In support of ticket #8533.	6 months ago
Jason Ish	cdb02a2779	rust/dns: rustfmt	6 months ago
Philippe Antoine	7d66eb5f04	rust: remove unused function rust_string_to_c was used when a buffer should be used as it could contain nul-byte	6 months ago
Philippe Antoine	9b12fd9f09	rust/ffi: move helper trait state_get_tx_iterator to ffi Ticket: 7666	6 months ago
Philippe Antoine	07f37676b6	rust/ffi: move Flags for AppLayerParserState to ffi crate Ticket: 7666	6 months ago
Philippe Antoine	fb20c69d8d	rust/ffi: move APP_LAYER_PARSER_OPT_X const to ffi crate Ticket: 7666	6 months ago
Philippe Antoine	f1c66ff6f0	rust: remove obsolete const exclusions in cbindgen As these structs are now bindgened from C to suricata_sys crate	6 months ago
Philippe Antoine	d81a10126e	detect/doc: remove unexisting links Ticket: 8257 And add TODO comments if rules doc should be written	6 months ago
Philippe Antoine	8e39539161	detect/doc: fix broken anchor links Ticket: 8257	6 months ago
Philippe Antoine	bd6a436893	detect/doc: fix broken files links Ticket: 8257	6 months ago
Philippe Antoine	b0e63a2c95	detect/dcerpc: move stub_data keyword to rust Ticket: 8391	6 months ago
Philippe Antoine	3d56472d16	detect: bindgen more functions To prepare to move dcerpc.stub_data keyword to full rust	6 months ago
Jeff Lucovsky	746f471382	transform/subslice: Add subslice transform Issue: 7672 The subslice transform creates a slice of the input buffer. Specify the subslice desired -- nbytes and truncate are optional: subslice: offset <,nbytes> <,truncate> offset: Specifies the starting offset for the new subslice. When negative, expresses how far from the end of the input buffer to begin. nbytes: Specifies the size of the subslice. When negative, specifies that the subslice will end that many bytes from the end of the input buffer. Nbytes must be non-zero. When nbytes is not specified, the size of the subslice will be the size of the input buffer - offset. truncate: Specify behavior when offset + nbytes exceeds buffer length. When present, trims nbytes such that offset + nbytes equals buffer length. When not present, an empty buffer is produced. Examples: subslice: 1; - The subslice will be a copy of the input buffer but omits the input buffer's first byte "This is Suricata" -> "his is Suricata" subslice: 0, 13; - The slice is created from the first 13 bytes of the input buffer "This is Suricata" -> "This is Suric" subslice: 10, -5; - The subslice is created starting at offset 10 and continues to 5 bytes before the end of the input buffer "This is Suricata" -> "r" subslice: -3; - The subslice will be the last 3 bytes of the input buffer. "This is Suricata" -> "ata"	6 months ago
Philippe Antoine	4fc6ca5d6c	detect/dcerpc: move iface keyword to rust Ticket: 8391 Use same buffer dce_generic as for dcerpc.opnum (name dce_generic is enforced by a SV test currently)	6 months ago
Philippe Antoine	9677851637	rust/ffi: move app-layer traits to ffi crate Ticket: 7666 Traits around structures defined in C and bindgened to rust	6 months ago
Philippe Antoine	f803c25f24	rust/ffi: move export_X_data_get macros to ffi crate Ticket: 7666	6 months ago
Philippe Antoine	54b6885166	rust/ffi: move conf_get_bool helper to ffi crate Ticket: 7666	6 months ago
Victor Julien	28a3337c27	rust: cargo update	6 months ago
Philippe Antoine	5f9e436c3f	detect/dcerpc: support generic integer for opnum keyword Ticket: 8179	6 months ago
Philippe Antoine	67379b009a	detect/dcerpc: move opnum keyword to rust Ticket: 8391	6 months ago
Philippe Antoine	a36af353bc	rust: bindgen SCFlowGetAppProtocol	6 months ago
Jason Ish	fd31e50954	ntp: enable keywords for firewall mode Ticket: #8394	6 months ago
Jason Ish	713e4eb900	ntp: convert reference_id to buffer and add keyword Store the NTP reference ID as raw network-order bytes so it can be exposed as a sticky buffer and matched with payload keywords. The reference ID is often a 4 character string, or an IP address and not just an integer identifier. Updates the log reference ID to be a string of colon separated hex digits as this matches what tshark does. Ticket: #8488	6 months ago
Jason Ish	991e7f3b1d	ntp: add ntp.mode keyword This keyword also accepts strings for known mode names. Ticket: #8429	6 months ago
Jason Ish	c10c482290	ntp: add ntp.stratum keyword Ticket: #8431	6 months ago
Jason Ish	ec344fe68d	ntp: add ntp.version keyword SNMP was used as a template. Ticket: #8430	6 months ago
Jason Ish	74bb525401	ntp: create tx for all modes; log version, mode and stratum Add logging for version, mode and stratum as these will be the first keywords we will add. Ticket: #8425	6 months ago
Jason Ish	879846e153	ntp: remove unused event types NotRequest and NotResponse event type have never been used. Unsolicited is also unused, however there is a rule for it so removing support would be a breaking change at this time.	6 months ago
Jason Ish	31b967b089	ntp: add transaction logging Adds basic NTP transaction logging for the current supported message types. Includes small cleanups around reference ID. Ticket: #8425	6 months ago
Victor Julien	c7cd3b17c3	snmp: minor snmp.pdu_type type cleanup	6 months ago
Victor Julien	2cef1404bc	detect/snmp: let generic keyword share the same list	6 months ago
Victor Julien	670fdabd32	detect/snmp: add snmp.trap_type keyword Implemented as a U8 integer keyword. Ticket: #8482.	6 months ago
Philippe Antoine	8ac9a62ec4	detect: enable snmp keywords for firewall mode Ticket: #8395	6 months ago
Philippe Antoine	63603fe14a	detect/snmp: sticky buffers at progress 1 Since snmp txs are created at progress 1 which is the completion, this does not change detection, except allowing firewall mode to use these keywords with generic hook like snmp:request_complete Ticket: 8395	6 months ago
Philippe Antoine	8f824458c2	detect: helper for buffer register requires progress Ticket: 8395 For protocols where tx are complete at start, that is the `tx_get_progress` function returns 1 inconditionnally, we can use the progress 1, not losing time on detection in ips mode, and getting ready for firewall mode For the other protocols (where a tx needs both a request and response for instance), keep progress 0 as was the case before	6 months ago
Jason Ish	eb46d0129e	rust/ffi: add eve callback handler Wrap the EVE callback handler with a Rust friendly variant that allows the user to register a callback as a closure which is provided an already wrapped JsonBuilder object. Ticket: #8477	6 months ago
Jason Ish	199e844a07	rust/ffi: add mark support to ffi::jsonbuilder To support Rust friendly EVE callback registration (ticket 8477).	6 months ago
Philippe Antoine	58a71d94b0	rust/ffi: move conf_get helper to ffi crate Ticket: 7666	7 months ago
Philippe Antoine	8d254f5630	dhcp/output: log app-layer metadata in alerts Ticket: 6091 log as extended	7 months ago
Philippe Antoine	db980daf5f	dhcp: standardize output code To prepare to add metadata in alerts Ticket: 6091	7 months ago
Philippe Antoine	d14af54b3b	detect/transforms: constify some callbacks arguments Ticket: 8298	7 months ago
Philippe Antoine	0a24f0afe2	smb: parse smb1 session setup with word count 13 Ticket: 5845	7 months ago
Jason Ish	98469b0f56	rust/ffi: fix clippy warnings Remove the unneeded return. The other option would be to allow it, but so far in the ffi crate we don't have any non-default allows.	7 months ago
Philippe Antoine	c53b9df5a2	rust/ffi: move detection helpers to ffi crate Ticket: 7666	7 months ago
Philippe Antoine	4f4912c042	rust: bindgen SIGMATCH_ constants	7 months ago
Philippe Antoine	2fa10052cf	websocket: check pdu opcode for reassembly Ticket: 8413 RFC 6455 Section 5.4 states Control frames (see Section 5.5) MAY be injected in the middle of a fragmented message. Control frames are identified by opcodes where the most significant bit of the opcode is 1.	7 months ago
Philippe Antoine	7b0528d85f	http2: set response_frame_size Ticket: 8410 Do not set only request_frame_size whatever the direction	7 months ago
Philippe Antoine	267c3baff7	rust/ffi: move STREAM_ constants to ffi crate Ticket: 7666 reexport them in suricata crate cbindgen them to C	7 months ago
Philippe Antoine	61c667400b	rust: remove obsolete inclusions from cbindgen.toml	7 months ago
Philippe Antoine	fd4c6d4e06	rust: remove obsolete struct exclusions in cbindgen As these structs are now in suricata_sys crate	7 months ago
Philippe Antoine	a10a818792	rust: remove obsolete constants exclusion from cbindgen.toml Completes commit `71b59f6dbe` These const are no longer defined in rust suricata crate	7 months ago
Jason Ish	dce2deee5e	rust: pin unicode-segmentation crate to 1.12.0 unicode-segmentation (used by rustyline) was updated from 1.12.0 to 1.13.1 earlier and requires a newer version of Rust. Pin to 1.12.0 which works with Rust 1.75.0.	7 months ago
Philippe Antoine	34ed8958a6	dcerpc: only log the tx interfaces Not all the state ones Ticket: 8378	7 months ago
Philippe Antoine	05a11e2897	dcerpc: store persistently contexts So that we can log and detect on interface uuids, even if AlterContext packets change one of the contexts, but other contexts are still used after it in request/responses Ticket: 8378	7 months ago
Jason Ish	9cab99fbd3	rust: rust fmt derive crate	7 months ago
Jeff Lucovsky	14ebba6382	gen/unused: Remove unused function Remove unused function is_alphanumeric_or_slash	7 months ago
Jeff Lucovsky	98070a7ace	misc/cleanup: remove rust if <cond> .... Cleanup the few instances of rust where if cond return true else false exist rg = ripgrep rg -n -U '^\sif . \{\s\n\sreturn true;\s\n\s\}\s\n\sreturn false;' rust/src/ --glob '.rs' rg -n -U '^\sif .* \{\s\n\sreturn false;\s\n\s\}\s\n\sreturn true;' rust/src/ --glob '*.rs'	7 months ago
Philippe Antoine	6587e363a3	dcerpc: use bind context_id in SMB Ticket: 8375 logger already read this variable but it was never set, and the rust compiler did not warn about this Allows to log the interface uuid when ctx_id > 0 Wireshark filter for related pcaps dcerpc.cn_ctx_id > 0 && dcerpc.pkt_type == 0	7 months ago
Philippe Antoine	2c2a3c800f	dcerpc: support multiple PDU in one parser call Ticket: 7254 With TCP, we receive a stream of data, which may contain multiple PDUs in one call	7 months ago
Philippe Antoine	db51314478	rust: rustfmt dcerpc.rs	7 months ago
Philippe Antoine	55ad2953bf	dcerpc: do not error the whole flow on unhandled packet type Ticket: 5133	7 months ago
Jason Ish	e9f8e17b16	rust/Makefile: add RUSTC and RUSTDOC to CARGO_ENV And consistently use the CARGO_ENV for all cargo calls. This allows a user to point to rust binaries that are not on their path just during ./configure, for example: PATH=/usr/lib/rust-1.89/bin:$PATH ./configure ... The full path to rustc and rustdoc will now be used, as discovered in the PATH without the user have to carry the path over to the "make" command. This was already done for cargo. Related to ticket: #8381	7 months ago
Philippe Antoine	ebe0ba4ebb	rust: limit clap verson to 4.5.57 clap 4.5.58 and further requires edition2024 which is incompatible with MSRV	7 months ago
Philippe Antoine	76d2925bdf	ldap: abandon request does not wait for a response Ticket: 8356 As such, abandon request is a complete tx	8 months ago
Philippe Antoine	784e173278	http2: bound number of http2 frames per tx Ticket: 8289 If stream.reassembly.depth is unlimited, an attacker controlling the 2 sides of a communication going through Suricata can send a transition with an infinite number of headers, until suricata OOMs Solution is to offer a configuration option to bound the number of HTTP2 frames we store in a HTTP2 transaction, and produce an anomaly if this bound is crossed	8 months ago
Philippe Antoine	49fd7001ff	smtp/mime: fix urls finding in buffering case We used to look for a full line, but as we look fot the last eol we need to use the right index in the not-reversed list	8 months ago
Philippe Antoine	8bba47aa09	smtp/mime: avoid quadratic complexity in mime_smtp_find_url_strings Ticket: 8292 When we have buffered something in ctx.decoded_line, we already looked for '\n' in it, so we do not need to run it again Otherwise, callers that supply mime_smtp_find_url_strings with a few bytes at a time without "\n", have a quadratic complexity	8 months ago
Philippe Antoine	062f56ddde	detect/http2: use ThreadCtx for all headers keywords Instead of custom inefficient "escaped" Vec Ticket: 8291	8 months ago
Philippe Antoine	4e538dfa3b	detect/http2: use ThreadCtx for http.request_header And also for http.response_header Instead of custom inefficient "escaped" Vec Ticket: 8291	8 months ago
Philippe Antoine	0933e944df	detect/http2: use ThreadCtx for http.header.raw Instead of custom inefficient "escaped" Vec Ticket: 8291	8 months ago
Philippe Antoine	711de8a5ea	detect/http2: use ThreadCtx for http.header Instead of custom inefficient "escaped" Vec Ticket: 8291	8 months ago
Philippe Antoine	52a2f2dd19	detect/http2: use ThreadCtx for http.header_names Instead of custom inefficient "escaped" Vec Ticket: 8291	8 months ago
Jason Ish	648a867049	psl: update to 2.1.197 Update the Mozilla public suffix list to 2.1.197.	8 months ago
Philippe Antoine	8e886a8ecd	krb5: use app-layer incomplete support Ticket: 3540 Ticket: 8305	8 months ago
Philippe Antoine	d77c43c79b	rust/ffi: move build_slice macro to ffi crate Ticket: 7666	8 months ago
Philippe Antoine	4a0143c8d4	rust/ffi: move cast_pointer macro to ffi crate Ticket: 7666	8 months ago
Shivani Bhardwaj	d241237c0f	Revert "dcerpc: fix consumed bytes post gap handling" This reverts commit `fc9da1c7a1`. That commit incorrectly used consumed as index of the slice passed to the Frame API. Found by oss-fuzz.	8 months ago
Jeff Lucovsky	ed882ede68	output/ipv6: Utility function to compress IPv6 addrs Issue: 7399 Utility function to compress IPv6 addresses per RFC-5952	8 months ago
Giuseppe Longo	de46f4ba9d	ldap: set invalid_data event Currently in parse_request function LdapEvent::InvalidData is not set when a request is not parsed correctly. Ticket #8258	8 months ago
Victor Julien	b55be5a44f	detect/transforms: update gunzip / zlib_deflate syntax Use standard space separated syntax.	8 months ago
Philippe Antoine	71b59f6dbe	rust/ffi: move IPPROTO_TCP to ffi and reexport in suricata Allows to reduce dependencies to full suricata crate Ticket: 7666	8 months ago
Philippe Antoine	d5ea973791	detect/ike: move ike.ike.chosen_sa_attribute keyword to rust Ticket: 8310 And increases expressivity on the way by supporting other modes than equality	8 months ago
Philippe Antoine	55333a6ca0	detect/ike: move ike.vendor keyword to rust Ticket: 8310	8 months ago
Philippe Antoine	14edd66494	detect/ike: move ike.nonce_payload keyword to rust Ticket: 8310	8 months ago
Philippe Antoine	d1213e4440	detect/ike: move ike.key_exchange_payload keyword to rust Ticket: 8310	8 months ago
Philippe Antoine	f23169c924	detect/ike: move ike.nonce_payload_length keyword to rust Ticket: 8310	8 months ago
Philippe Antoine	e85bf5be4d	detect/ike: move ike.key_exchange_payload_length keyword to rust Ticket: 8310	8 months ago
Philippe Antoine	841fe44f34	detect/ike: move ike.exchtype keyword to rust Ticket: 8310	8 months ago
Philippe Antoine	23032ebc65	detect/ike: move ike spi keywords to rust Ticket: 8310	8 months ago
Philippe Antoine	539e4ee665	detect/transforms: add zlib_deflate transform Ticket: 7846	8 months ago
Philippe Antoine	dbea660729	detect/transforms: add gunzip transform Ticket: 7846	8 months ago
Victor Julien	336a9d05ca	krb5: fix TCP record parsing A logic error in multi-record parsing meant only the first record was parsed. Bug: #8278.	8 months ago
Jason Ish	6b850dddb8	rust/ffi: JsonBuilder wrapper around C JsonBuilder API For use by plugins that need to work with JsonBuilder.	9 months ago
Jason Ish	f6b11ac855	output-eve: finish exposing to bindgen As all out output-eve.h is now exposed, merge output-eve.h and output-eve-bindgen.h back into one file, output-eve.h.	9 months ago
Jason Ish	f79158ae55	rust/sys: generate jsonbuilder bindings in sys Bindgen the Rust bindings to the C JsonBuilder API along with the rest of the Rust bindings to C. Breaking it out was probably the wrong idea. This should make it easier, and more correct to bindgen C functions that use SCJsonBuilder types.	9 months ago
Jason Ish	f951477461	rust/debug: use functions from ffi crate where possible It's not possible to use all the functions and macros from the ffi crate in the main Suricata crate, as there are conditionals around when running in test mode, and "cargo test" doesn't propagate the "cfg(test)" to test crates. Which for now means duplicating the macros and some functions.	9 months ago
Jason Ish	8b69089cb8	rust/ffi: more rust friendly plugin registration A plugin can now create a "Plugin" struct with Rust strings. The `into_raw` method converts it to a raw pointer suitable for returning during plugin registration.	9 months ago

... 2 3 4 5 6 ...

2499 Commits (e886d2d0306e7d085c0dd558a6fbc8a2457e24a3)