suricata

Commit Graph

Author	SHA1	Message	Date
Juliana Fajardini	0fc9ade7a9	pgsql: fix uint overflow and optimizations Fuzzers found a possible integer overflow bug when parsing response messages. To fix that, removed the case where we incremented the parsed field length and created a new message type for situations where Suri parsers an Unknown message. This is good because there may happen that an unknown message to Suri is valid, and in this case, we would still be able to log it. Philippe Antoine found the bug while fuzzing with rust debug assertions. Bug #5016	3 years ago
Juliana Fajardini	8daa79513a	pgsql: fix clippy is_null usage warning	3 years ago
Philippe Antoine	d2f00ac824	dcerpc: use wrappingadd for padding parsing As we compute a modulo, we can safely wrap around even if there is an overflow Ticket: #5301	3 years ago
Philippe Antoine	464ff80c6a	smb: protocol detection on pattern without midstream To recognize a protocol, Suricata first looks for patterns, which can be confirmed by a probing parser. If this does not work, Suricata can try to run some probing parsers on some ports. This is the case for SMB. This commit makes handling the confirming and the probing paser differently even if they share much code. The confirmation parser knows that a pattern has been found. So, it must not do the midstream case of looking for this pattern in the whole buffer, but only check it at the beginning. But it must reverse direction if needed.	3 years ago
Victor Julien	dc57460427	smb: fix event types for limit exceeded rules	3 years ago
Jason Ish	0623ada24d	dns: better error handling when parsing names The DNS name parser will error out with an error even if the error is incomplete. Instead of manually generating errors, use '?' to let the nom error ripple up the error handling chain. The reason this wasn't done in the first place is this code predates the ? operator, or we were not aware of it at the time. This prevents the case where probing fails when there is enough data to parse the header, but not enough to complete name parser. In such a case a parse error is returned (instead of incomplete) resulting in the payload not being detected as DNS. Ticket #5034	3 years ago
Jason Ish	27679a12aa	dns: don't parse a full request during probe if not enough data If there is more data than a header, but not enough for a complete DNS message, the hostname parser could return an error causing the probe to fail on valid DNS messages. So only parse the complete message if we have enough input data. This is reliable for TCP as DNS messages are prefixed, but for UDP its just going to be the size of the input buffer presented to the parser, so incomplete could still happen. Ticket #5034	3 years ago
Victor Julien	fc9b65d8d3	smb2: validate negotiate read/write max sizes Raise event if they exceed the configured limit.	3 years ago
Victor Julien	4be8334c9e	smb2: allow limiting in-flight data size/cnt Allow limiting in-flight out or order data chunks per size or count. Implemented for read and writes separately: app-layer.protocols.smb.max-write-queue-size app-layer.protocols.smb.max-write-queue-cnt app-layer.protocols.smb.max-read-queue-size app-layer.protocols.smb.max-read-queue-cnt	3 years ago
Victor Julien	2c5ad8858e	filetracker: track total queued data (in_flight) As well as expose number of chunks.	3 years ago
Victor Julien	90d4b8e438	smb: log max read/write sizes	3 years ago
Victor Julien	5bcc4162f7	smb2: add options for max read/write size Add options for the max read/write size accepted by the parser.	3 years ago
Victor Julien	f28888513a	smb2: track max read/write size and enforce its values	3 years ago
Victor Julien	594acec5dc	smb: minor function cleanup Remove used argument from `filetracker_newchunk()`. We're not using fill_bytes with smb.	3 years ago
Victor Julien	c7a474c725	filetracker: make FileChunk private	3 years ago
Philippe Antoine	3b13008c1b	mqtt: fix consumed bytes computation for truncated msg Ticket: 5268	3 years ago
Philippe Antoine	704bc878ea	dcerpc: store consumed_bytes as i32 As it can grow bigger than u16	3 years ago
Philippe Antoine	dfd17e9acc	ike: fix integer underflow in parse_proposal By not restricting a usize to i16	3 years ago
Victor Julien	93d5bce0aa	rust: update regex & memchr dependencies Bug: #5260.	3 years ago
Victor Julien	053a9d2e68	smb/ntlmssp: add stricter len/offset validation	3 years ago
Philippe Antoine	3e48881b78	smb: prevents integer underflow Ticket: 5246 If msg_id is 0, we cannot find the previous request	3 years ago
Philippe Antoine	e72036f12f	smb: ntlmssp domain_blob_offset underflow check Ticket: 5246	3 years ago
Philippe Antoine	817a5001a5	smb: check on param parsing Ticket: 5246 so as not to overflow u16	3 years ago
Sascha Steinbiss	7eb279ac53	mqtt: remove redundant "where" keyword	3 years ago
Sascha Steinbiss	d63e5b8c51	mqtt: make some functions non-public	3 years ago
Sascha Steinbiss	2a3ed9a6ae	mqtt: rustfmt	3 years ago
Sascha Steinbiss	1ba62993d5	mqtt: raise event on parse error	3 years ago
Sascha Steinbiss	5618273ef4	mqtt: ensure we do not request extra data after buffering This addresses Redmine bug #5018 by ensuring that the parser never requests additional data via the Incomplete error, but to raise an actual parse error, since it is supposed to have all the data as specified by the message length in the header already.	3 years ago
Victor Julien	6d30f4442c	http2: fix file accounting for ranged files Increment files_opened for tx that 'gets' reassembled ranged file	3 years ago
Victor Julien	b336882008	smb1: apply close to direction Instead of closing files in both direction when receiving a close request, close only toserver files for the request and close toclient on receiving a response.	3 years ago
Victor Julien	b9cd502249	smb: convert 'close' parser to function	3 years ago
Sam Muhammed	3a490fb16c	nfs: Implement frames Feature #4872 Frames: - RPC Frames: Generic over TCP/UDP - rpc.pdu - rpc.hdr - rpc.data - rpc.creds -- for rpc calls - NFSv2, NFSv3 - nfs.pdu - nfs.status -- for nfs responses - NFSv4 Only Frames - nfs4.pdu - nfs4.hdr - nfs4.ops -- for compound request/response operations - nfs4.status -- for nfs4 responses RPC tcp/udp frames created with separate registeration functions e.g: add_rpc_tcp_tc_frames() add_rpc_udp_tc_frames()	3 years ago
Sam Muhammed	d090dcbce9	rpc: Improve rpc_record struct Add creds_len field to rpc_record needed for rpc.creds frame length calculation	3 years ago
Sam Muhammed	8064a5348d	rust/nfs4: Add NFSPROC4_DESTROY_CLIENTID op parsers	3 years ago
Sam Muhammed	9d1fad28a7	rust/nfs4: Add NFSPROC4_DESTROY_SESSION op parsers Also add respective request unittest test_nfs4_request_destroy_session()	3 years ago
Sam Muhammed	ff81cad4f1	rust/nfs4: Add NFSPROC4_LAYOUTRETURN op parsers Also add respective request unittest test_nfs4_request_layoutreturn()	3 years ago
Sam Muhammed	073244a0b8	rust/nfs4: Add NFSPROC4_GETDEVINFO op parsers Also add respective response/request unittests test_nfs4_response_getdevinfo() test_nfs4_request_getdevinfo()	3 years ago
Sam Muhammed	ff54a6d9d5	rust/nfs4: Add NFSPROC4_LAYOUTGET op parsers Also add respective response/request unittests test_nfs4_response_layoutget() test_nfs4_request_layoutget()	3 years ago
Sam Muhammed	3d542fcc67	rust/nfs4: Add NFSPROC4_SECINFO_NO_NAME op parsers	3 years ago
Sam Muhammed	b35d635ac7	rust/nfs4: Add NFSPROC4_RECLAIM_COMPLETE op parsers	3 years ago
Sam Muhammed	2a41b46eca	rust/nfs4: Add NFSPROC4_CREATE_SESSION op parsers Also add respective response/request unittests test_nfs4_request_create_session() test_nfs4_response_create_session()	3 years ago
Sam Muhammed	0a69c66153	rust/nfs4: Add NFSPROC4_EXCHANGEID response parser Also add test_nfs4_response_exchangeid() unittest	3 years ago
Sam Muhammed	fe7a49b737	rust/nfs4: improve NFSPROC4_OPEN op parser Improve nfs4_res_open() parser to reflect other file-delegation types Reflect the changes on test_nfs4_response_open() unittest	3 years ago
Jason Ish	2341f47755	smb: handle records in the wrong direction If an SMB record is seen in the wrong direction, set an event on the PDU frame and don't process the record in the state. No error is returned, so the next record will be processed.	3 years ago
Jason Ish	09e2d3b216	smb: expose smb1 request/reply flags with a method Adds `.is_request()` and `.is_reply()` to check if a SMB record flags say the message is a request or a reply.	3 years ago
Jason Ish	7b659489c8	smb: fix smb2 header flag parsing The bits were being parsed in the order they're displayed in Wireshark, rather than the order they were being seen on the wire, resulting in direction and async being 0 more often than they should be. Instead of bits, take the 4 bytes as an le_u32 and just use bit masks to extract what we need into a struct, I think its easier to reason about this way when comparing to the Microsoft documentation.	3 years ago
Philippe Antoine	bfcd6cb46a	range: validity check when end is bigger than size Ticket: 5132 Down the line, HttpRangeOpenFileAux assumes the range has a valid value when doing buflen = end - start + 1;	3 years ago
Victor Julien	07b1100713	nfs: clean up partial record handling There should be no remaining data after parsing the partial RPC record, so don't handle it but instead add a debug validation bug on. Successful processing for NFSv3 read/write records returns AppLayerResult::ok() directly as all data is consumed.	3 years ago
Victor Julien	d85b77cad0	nfs3: improve read validation; fix partial handling	3 years ago
Victor Julien	4418fc1b02	nfs3: fix partial write record handling	3 years ago

1 2 3 4 5 ...

966 Commits (0fc9ade7a9f672560a276bb40d97cf07ee89dbac)