aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
18,703 Commits
8 Branches
174 Tags
255 MiB
main
main-8.0.x
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.7
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'f4668b7132'
${ noResults }
Commit Graph

2189 Commits (f4668b7132b50e7efc3445f7fde08bb2df1259fe)

Author SHA1 Message Date
Philippe Antoine 6587e363a3 dcerpc: use bind context_id in SMB 
Ticket: 8375

logger already read this variable but it was never set, and
the rust compiler did not warn about this

Allows to log the interface uuid when ctx_id > 0

Wireshark filter for related pcaps
dcerpc.cn_ctx_id > 0 && dcerpc.pkt_type == 0
 8 months ago
Philippe Antoine 2c2a3c800f dcerpc: support multiple PDU in one parser call 
Ticket: 7254

With TCP, we receive a stream of data, which may contain multiple
PDUs in one call
 8 months ago
Philippe Antoine db51314478 rust: rustfmt dcerpc.rs 8 months ago
Philippe Antoine 55ad2953bf dcerpc: do not error the whole flow on unhandled packet type 
Ticket: 5133
 8 months ago
Jason Ish e9f8e17b16 rust/Makefile: add RUSTC and RUSTDOC to CARGO_ENV 
And consistently use the CARGO_ENV for all cargo calls.

This allows a user to point to rust binaries that are not on their
path just during ./configure, for example:

  PATH=/usr/lib/rust-1.89/bin:$PATH ./configure ...

The full path to rustc and rustdoc will now be used, as discovered in
the PATH without the user have to carry the path over to the "make"
command. This was already done for cargo.

Related to ticket: #8381
 8 months ago
Philippe Antoine ebe0ba4ebb rust: limit clap verson to 4.5.57 
clap 4.5.58 and further requires edition2024 which is incompatible with MSRV
 8 months ago
Philippe Antoine 76d2925bdf ldap: abandon request does not wait for a response 
Ticket: 8356

As such, abandon request is a complete tx
 8 months ago
Philippe Antoine 784e173278 http2: bound number of http2 frames per tx 
Ticket: 8289

If stream.reassembly.depth is unlimited,
an attacker controlling the 2 sides of a communication going through Suricata
can send a transition with an infinite number of headers, until suricata OOMs

Solution is to offer a configuration option to bound the number
of HTTP2 frames we store in a HTTP2 transaction, and produce an
anomaly if this bound is crossed
 8 months ago
Philippe Antoine 49fd7001ff smtp/mime: fix urls finding in buffering case 
We used to look for a full line, but as we look fot the last eol
we need to use the right index in the not-reversed list
 8 months ago
Philippe Antoine 8bba47aa09 smtp/mime: avoid quadratic complexity in mime_smtp_find_url_strings 
Ticket: 8292

When we have buffered something in ctx.decoded_line,
we already looked for '\n' in it, so we do not need to run it again

Otherwise, callers that supply mime_smtp_find_url_strings with
a few bytes at a time without "\n", have a quadratic
complexity
 8 months ago
Philippe Antoine 062f56ddde detect/http2: use ThreadCtx for all headers keywords 
Instead of custom inefficient "escaped" Vec

Ticket: 8291
 8 months ago
Philippe Antoine 4e538dfa3b detect/http2: use ThreadCtx for http.request_header 
And also for http.response_header

Instead of custom inefficient "escaped" Vec

Ticket: 8291
 8 months ago
Philippe Antoine 0933e944df detect/http2: use ThreadCtx for http.header.raw 
Instead of custom inefficient "escaped" Vec

Ticket: 8291
 8 months ago
Philippe Antoine 711de8a5ea detect/http2: use ThreadCtx for http.header 
Instead of custom inefficient "escaped" Vec

Ticket: 8291
 8 months ago
Philippe Antoine 52a2f2dd19 detect/http2: use ThreadCtx for http.header_names 
Instead of custom inefficient "escaped" Vec

Ticket: 8291
 8 months ago
Jason Ish 648a867049 psl: update to 2.1.197 
Update the Mozilla public suffix list to 2.1.197.
 8 months ago
Philippe Antoine 8e886a8ecd krb5: use app-layer incomplete support 
Ticket: 3540
Ticket: 8305
 8 months ago
Philippe Antoine d77c43c79b rust/ffi: move build_slice macro to ffi crate 
Ticket: 7666
 8 months ago
Philippe Antoine 4a0143c8d4 rust/ffi: move cast_pointer macro to ffi crate 
Ticket: 7666
 8 months ago
Shivani Bhardwaj d241237c0f Revert "dcerpc: fix consumed bytes post gap handling" 
This reverts commit fc9da1c7a1.

That commit incorrectly used consumed as index of the slice passed to
the Frame API.
Found by oss-fuzz.
 8 months ago
Jeff Lucovsky ed882ede68 output/ipv6: Utility function to compress IPv6 addrs 
Issue: 7399

Utility function to compress IPv6 addresses per RFC-5952
 8 months ago
Giuseppe Longo de46f4ba9d ldap: set invalid_data event 
Currently in parse_request function LdapEvent::InvalidData is not set when a
request is not parsed correctly.

Ticket #8258
 8 months ago
Victor Julien b55be5a44f detect/transforms: update gunzip / zlib_deflate syntax 
Use standard space separated syntax.
 8 months ago
Philippe Antoine 71b59f6dbe rust/ffi: move IPPROTO_TCP to ffi 
and reexport in suricata

Allows to reduce dependencies to full suricata crate

Ticket: 7666
 8 months ago
Philippe Antoine d5ea973791 detect/ike: move ike.ike.chosen_sa_attribute keyword to rust 
Ticket: 8310

And increases expressivity on the way by supporting other modes
than equality
 8 months ago
Philippe Antoine 55333a6ca0 detect/ike: move ike.vendor keyword to rust 
Ticket: 8310
 8 months ago
Philippe Antoine 14edd66494 detect/ike: move ike.nonce_payload keyword to rust 
Ticket: 8310
 8 months ago
Philippe Antoine d1213e4440 detect/ike: move ike.key_exchange_payload keyword to rust 
Ticket: 8310
 8 months ago
Philippe Antoine f23169c924 detect/ike: move ike.nonce_payload_length keyword to rust 
Ticket: 8310
 8 months ago
Philippe Antoine e85bf5be4d detect/ike: move ike.key_exchange_payload_length keyword to rust 
Ticket: 8310
 8 months ago
Philippe Antoine 841fe44f34 detect/ike: move ike.exchtype keyword to rust 
Ticket: 8310
 8 months ago
Philippe Antoine 23032ebc65 detect/ike: move ike spi keywords to rust 
Ticket: 8310
 8 months ago
Philippe Antoine 539e4ee665 detect/transforms: add zlib_deflate transform 
Ticket: 7846
 8 months ago
Philippe Antoine dbea660729 detect/transforms: add gunzip transform 
Ticket: 7846
 8 months ago
Victor Julien 336a9d05ca krb5: fix TCP record parsing 
A logic error in multi-record parsing meant only the first record was parsed.

Bug: #8278.
 8 months ago
Jason Ish 6b850dddb8 rust/ffi: JsonBuilder wrapper around C JsonBuilder API 
For use by plugins that need to work with JsonBuilder.
 9 months ago
Jason Ish f6b11ac855 output-eve: finish exposing to bindgen 
As all out output-eve.h is now exposed, merge output-eve.h and
output-eve-bindgen.h back into one file, output-eve.h.
 9 months ago
Jason Ish f79158ae55 rust/sys: generate jsonbuilder bindings in sys 
Bindgen the Rust bindings to the C JsonBuilder API along with the rest
of the Rust bindings to C. Breaking it out was probably the wrong
idea.

This should make it easier, and more correct to bindgen C functions
that use SCJsonBuilder types.
 9 months ago
Jason Ish f951477461 rust/debug: use functions from ffi crate where possible 
It's not possible to use all the functions and macros from the ffi crate
in the main Suricata crate, as there are conditionals around when
running in test mode, and "cargo test" doesn't propagate the "cfg(test)"
to test crates.

Which for now means duplicating the macros and some functions.
 9 months ago
Jason Ish 8b69089cb8 rust/ffi: more rust friendly plugin registration 
A plugin can now create a "Plugin" struct with Rust strings.  The
`into_raw` method converts it to a raw pointer suitable for returning
during plugin registration.
 9 months ago
Jason Ish 0999530726 rust/ffi: rust wrapper around eve filetype registration 9 months ago
Jason Ish 2d0bf9a2ed output-eve: bindgen SCEveFileType callback types 9 months ago
Jason Ish b4db7bdaee rust/ffi: add logging (debug) wrappers 
Mostly a copy of Suricata core's logging wrappers into the ffi crate.

These are not yet used by Suricata-core as they do require the
Suricata library to be available, which is not the case with tests. And
the `cfg(test)` parameter is not passed through to sub-crates.

However, this does allow a plugin (or library) to call the logging
macros without depending on the "suricata" crate.

Ticket: #7666
 9 months ago
Jason Ish 2c51744ccc rust/ffi: stub out a rust ffi crate 
This crate is for Rust wrappers around the -sys crate which includes
only raw bindings. This is the place to add nice wrappers around those
bindings, however it should remain clear of dependencies on the main
Suricata core crates.

Ticket: #7666
 9 months ago
Jason Ish e9611a4d7c output-eve: bindgen SCRegisterEveFileType to Rust 
Used by Rust output plugins.
 9 months ago
Jason Ish 1b182025bc output-eve: expose SCEveFileType to Rust with bindgen 
There is an unfortunate side-affect that one has to read
output-eve-bindgen.h for the documentation on this type, however, I
think we can resolve that in time.
 9 months ago
Philippe Antoine 536242341b detect/smb: move smb.version keyword to rust 
Ticket: 8267
 9 months ago
Philippe Antoine df495d7e22 rust: bindgen SCDetectGetLastSMFromLists 
to use it from rust keywords
 9 months ago
Philippe Antoine 697c641400 detect/smb: move smb share and named_pipe keywords to rust 
Ticket: 8267
 9 months ago
Philippe Antoine 667f8b2eb7 detect/smb: move smb ntlmssp keywords to rust 
Ticket: 8267
 9 months ago