d2497790f9
detect-engine-mpm: change transforms->cnt to uint8_t
3 months ago
03bc717877
dag: wrong stats registration causes compilation errors with --enable-dag
...
Bug: 8812
3 months ago
38b4ad79a3
decode/ipv6: bound hop-by-hop option to the option area
...
The TLV loop for the IPv6 hop-by-hop and destination option headers
gates each option on (offset + 1 + ip6_optlen) > optslen. An option is
two header bytes (type, length) plus ip6_optlen data bytes, so its data
ends at offset + 1 + ip6_optlen and the bound has to be
offset + 2 + ip6_optlen.
Before: an option that declares its data running one byte past the
option area is accepted, and the Router Alert / Jumbo / Home Address
memcpy then copies sizeof(value) bytes ending one byte past the area;
when the header sits at the tail of the IPv6 payload that read goes
past the payload.
After: the option is rejected with IPV6_EXTHDR_INVALID_OPTLEN, matching
how the IPv4 option loop already bounds a full option against the
remaining length. The check stays next to the read so each option type
does not need its own guard.
Ticket: #8817 .
3 months ago
dde0d7295b
tls: improve client/server hello parsing loops
...
Bug: #8795 .
3 months ago
46880985ef
http2: find content-encoding without case-sensitivity
...
See RFC 9110 8.4.1
> All content codings are case-insensitive
Ticket: 8760
3 months ago
425b9c6777
ftp/expectation: fix ippair leak
...
Ticket: 5204
ippair use_cnt increased by AppLayerExpectationCreate calling
IPPairGetIPPairFromHash was never decreased
3 months ago
dee0f03db4
detect/modbus: move modbus keyword to rust
...
Ticket: 3195
3 months ago
3e70a79ed2
detect/nfs: move nfs.version to rust
...
Ticket: 3195
3 months ago
e976db7261
detect/template: remove template2
...
Ticket: 7278
Its usage was removed in 512bbe4de8
3 months ago
d0cc39c79a
rfb/jsonschema: add missing field
...
Ticket: 6478
3 months ago
060808f36e
github-actions: bump ossf/scorecard-action from 2.4.3 to 2.4.4
...
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action ) from 2.4.3 to 2.4.4.
- [Release notes](https://github.com/ossf/scorecard-action/releases )
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md )
- [Commits](4eaacf0543...2d1146689b
3 months ago
279317327c
github-actions: bump github/codeql-action from 4.36.2 to 4.37.3
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.36.2 to 4.37.3.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/v4.36.2...v4.37.3 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.37.3
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
3 months ago
c6164c6ef1
github-actions: bump github/codeql-action/upload-sarif
...
Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ) from 1f34ec16430d82636d18716acc7aaa6d843b35a9 to 1cd4d01d58f636bbdbffbfd3c121b3446d07e9f3.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](1f34ec1643...1cd4d01d58
3 months ago
bc04ca0f00
github-actions: bump actions/checkout from 7.0.0 to 7.0.1
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases )
- [Commits](https://github.com/actions/checkout/compare/v7...v7.0.1 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
3 months ago
050290b636
github-actions: bump vmactions/freebsd-vm from 1.5.0 to 1.5.2
...
Bumps [vmactions/freebsd-vm](https://github.com/vmactions/freebsd-vm ) from 1.5.0 to 1.5.2.
- [Release notes](https://github.com/vmactions/freebsd-vm/releases )
- [Commits](5a72679103...77ed28d336
3 months ago
e7f1692a5c
defrag: fix defrag.memuse counter reporting memcap
...
Populate defrag.memuse from DefragTrackerGetMemuse() rather than
DefragTrackerGetMemcap(), so it reports actual usage, not the cap.
Issue: 8752
3 months ago
62fdb771b0
smtp: check transaction before to-client completion
...
Make sure the transaction still exists before completing it in the
to-client direction. A pipelined RSET reply may already have completed and
freed it while a later end-of-DATA marker still refers to it.
Found by OSS-Fuzz testcase 5498180758994944.
Bug #8739 .
3 months ago
9afab955c3
conf: disable flowbits.max-per-signature by default
3 months ago
b364f28387
github-ci: update RUST_VERSION_KNOWN
...
To 1.97 as that is where we are clippy clean to.
4 months ago
e9b08dbb2d
rust: clippy fixups for 1.97
...
Mostly provided by clippy --fix, and one `.to_string()` removal where
not needed.
4 months ago
8455efd9ac
app-layer: add substate support to list hooks
...
Add substates to the --list-app-layer-hooks option.
4 months ago
8a5e8c63b2
detect: strict validation of buffers
...
Make sure that every buffer in a signature is actually used in the
setup of the engines. Reject sigs that are locked to a certain substate
and use buffers that require another.
4 months ago
89baff01c9
output/tx: allow registering logging at substate
...
Register HTTP/2 and DOH2 this way.
4 months ago
a824d97d71
detect: use sub state to select inspect engines
...
When building the per signature app_inspect list, only add engines
that match the sub state specified in the hook.
4 months ago
c5d4a250b5
detect/firewall: avoid passing state match for policy
4 months ago
9a294bf73b
app-layer: check if protocol is enabled for sub state callbacks
4 months ago
f545f06cf2
doh2: do not enable parser if http2 is disabled
...
DOH2 depends on HTTP/2, so it makes no sense to enable it separately.
It would also put the sub state handling in a weird state, as the DOH2
side reuses the registered HTTP/2 callbacks.
4 months ago
cf216b6309
http2: rename state *start to *started
...
This is to make the hook use names consistent with the default
hooks and other protocols.
4 months ago
f8f28c6f6f
detect: sync prefilter and app inspect alproto logic
...
In firewall mode the alproto logic when building prefilter and rule
engines is strict, but was out of sync between prefilter and rule app
inspect engines.
For SIGNATURE_HOOK_TYPE_APP rules the logic is strict, with an exception
for HTTP/2 and DOH2. DOH2 is not a full protocol implementation, but
rather HTTP/2 with a different alproto.
Fixes: d64954a873
4 months ago
56d9670af7
eve/alert: log sub state progress values
4 months ago
f02a427059
eve/alert: clean up state logging
4 months ago
110e74642e
detect/firewall: harden policy lookup logic
4 months ago
cfc98aeeaf
detect: add debug validation checks to assert assumptions
4 months ago
7517ba9f98
detect: give clear errors for http2 w/o substate
...
http2 states were not yet supported even if the built-in states could
already work. Clearly error out on a hook w/o substate.
4 months ago
e4176d2b9a
detect/firewall: support substate in analyzer
4 months ago
2511070a58
detect/firewall: support lte mode for substate
4 months ago
e1e24d6cb4
eve/alert: add sub state output
4 months ago
7e60c3205e
detect/alert: store sub-state in PacketAlert
...
In preparation of being able to log it.
4 months ago
17a3e0d44f
app-layer: use macro for progress ceiling
4 months ago
2e1003a026
detect: add debug validation checks
...
Check that sub state handling is correct.
4 months ago
af1c72c37e
detect/mpm: don't register engines for disabled protocols
4 months ago
3b6b381f90
detect/firewall: add default alert signature to policy object
...
Now that there is a policy hash, make the alert signature object a
member of that to avoid another hash table lookup.
4 months ago
bffea309db
detect/firewall: implement app policy as hash table
...
With substate support the fixed table approach for policies was no
longer a good fit, so convert to a hash table. The policies are stored
per alproto, sub_state, progress and direction.
4 months ago
eb87137471
detect/parse: allow bigger protocol/hook specifications
4 months ago
6a3f9bc0b0
app-layer: for sub state API treat DOH2 as HTTP/2
...
Otherwise we'd have to re-register the relevant callbacks.
4 months ago
956030452f
detect/parse: don't setup sub states if protocol doesn't support it
4 months ago
bb41ef9caf
http2: update push promise to account for stream id 0 filtering
4 months ago
c17ab6a65e
http2: set event on frame types not allowed on stream id
4 months ago
3ef0d2ce16
detect/parse: parse sub state hooks
...
Register a generic list for each sub state / progress combo.
4 months ago
116a060092
detect/firewall: policy for substates
...
For the most part hard coded for HTTP/2 for now.
4 months ago
Dmitry Uryvchikov
Stephen Donnelly
Uwez Khan
Victor Julien
Philippe Antoine
dependabot[bot]
Jeff Lucovsky
Jason Ish
Shivani Bhardwaj