12349 Commits (1dc98cad27733171de0aa74b87a57a6ad5b968f8)

 

All Branches   

Search

Author	SHA1	Message	Date
Shivani Bhardwaj	8fd47cb84c	smtp: fix clang fmt	4 years ago
Shivani Bhardwaj	0a1747c1ba	nfs: fix comment	4 years ago
Shivani Bhardwaj	58ac9b0f38	nfs: Add rust registration function ... Get rid of the C glue code and move registration completely to Rust.	4 years ago
Shivani Bhardwaj	61fca4e9db	nfs: add missing code from rust impl of fns	4 years ago
Shivani Bhardwaj	de50ac631e	nfs: Change fn sign as per rust registration requirement ... Registering parsers in Rust requires signatures to be a certain way and compatible with C. Change signatures of all the functions. Probe fn has also been changed to return AppProto as required by the new fn signature.	4 years ago
Shivani Bhardwaj	e5c948df87	smb: Add rust registration function ... Get rid of the C glue code and move registration completely to Rust.	4 years ago
Shivani Bhardwaj	27af4bb002	smb: add missing code from rust impl of fns	4 years ago
Shivani Bhardwaj	6420df84b7	smb: Change fn sign as per rust registration requirement ... Registering parsers in Rust requires signatures to be a certain way and compatible with C. Change signatures of all the functions.	4 years ago
Shivani Bhardwaj	4d6b6b5dfe	smb: add constants	4 years ago
Shivani Bhardwaj	d1ea00521b	rust/core: Add flow flags	4 years ago
Jason Ish	222e55847c	flow: provide flags accessor function ... Add an accessor function for flow flags. To be used by Rust where the flow struct is an opaque data type.	4 years ago
Shivani Bhardwaj	cb8bd8c669	rust/applayer: add more externs	4 years ago
Victor Julien	843c4b20da	stream: check if ACK packet is outdated ... Outdated packets are ACK packets w/o data that have an ACK value lower than our last_ack and also don't have an SACK records that are new. This can happen when some packets come in later than others (possibly due to different paths taken).	4 years ago
Victor Julien	b7a79978ac	stream/sack: clean up includes	4 years ago
Victor Julien	8eccd02c94	stream/sack: minor debug improvements	4 years ago
Victor Julien	35c2a02eb8	stream: minor debug additions	4 years ago
Shivani Bhardwaj	51be8f0238	doc/dcerpc: add proto keywords	4 years ago
Sascha Steinbiss	9aedc7fd1a	mqtt: enable in config and remove misleading comment	4 years ago
Victor Julien	b08a7b9a66	stream: update memcaps in code to match config	4 years ago
Philippe Antoine	f77b027ada	app-layer/pd: review bailout conditions ... To take TCP window into account And to actually bail out if we received too much data where the limit is configured by stream.reassembly.depth	4 years ago
Victor Julien	7a114e506a	app-layer/pd: only consider actual available data ... For size limit checks consider only available data at the stream start and before any GAPS. The old check would consider too much data if there were temporary gaps, like when a data packet was in-window but (far) ahead of the expected segment.	4 years ago
Victor Julien	be1baa8cab	streaming/buffer: account sbb data size ... When tracking data track the size of the blocks so that in case of gaps we can still know how much data we hold.	4 years ago
Juliana Fajardini	b8499de498	detect/iprep: convert to FAIL/PASS API	4 years ago
Philippe Antoine	31dccd1171	modbus: do not claim to handle gaps	4 years ago
showipintbri	a39025bf24	doc: Grammar Correction	4 years ago
Shivani Bhardwaj	a17da8374a	counters: only print alerts if stats are enabled	4 years ago
Juliana Fajardini	b24fb5781b	detect: fix typos and update copyright year	4 years ago
Juliana Fajardini	a15fada727	detect: fix bug where rule without sid is accepted ... Before, if Suricata parsed a rule without a 'sid' option, instead of failing that rule, the rule was parsed and attributed a sid 0. Changes to: detect-parse: - add logic to filter out rules without sid; - change unittest which didn't have a sid, but used to pass. detect-sid: add unittest for rules without sid or with sid: 0	4 years ago
Philippe Antoine	0eefd90a93	fuzz: only build fuzz_sigpcap_aware if asked ... With the other fuzz targets, and do not build it if fuzzpcap is available but we did not want to build the fuzz targets	4 years ago
Sascha Steinbiss	d541b3d4a8	rust: fix warnings with nightly	4 years ago
Eric Leblond	2c8c043185	stream/tcp: limit ACK validation ... Only limit ACK value validation for packet where the ACK bit is set.	4 years ago
Eric Leblond	556570f7dd	stream/tcp: don't reject on bad ack ... Not using a packet for the streaming analysis when a non zero ACK value and ACK bit was unset was leading to evasion as it was possible to start a session with a SYN packet with a non zero ACK value to see the full TCP stream to escape all stream and application layer detection. This addresses CVE-2021-35063. Fixes: fa692df37 ("stream: reject broken ACK packets") Ticket: #4504.	4 years ago
Eric Leblond	0d81173d6e	stream/tcp: update ack handling logic ... Only update the ack value of a session for regular packets when the ACK bit is set.	4 years ago
Philippe Antoine	9e7ea631b2	dns: improve probing parser ... Checks opcode is valid Checks additional_rr do not exceed message length Better logic for incomplete cases	4 years ago
Victor Julien	d8d1fbe443	detect/files: fix buffer tracking with multiple files	4 years ago
Victor Julien	3c1cc1e345	mqtt: move sub/unsub limits into app-layer config	4 years ago
Sascha Steinbiss	4c0ef73bf2	detect/mqtt: add topic inspection limit ... We add a new 'mqtt.(un)subscribe-topic-match-limit' option to allow a user to specify the maximum number of topics in a MQTT SUBSCRIBE or UNSUBSCRIBE message to be evaluated in detection.	4 years ago
Philippe Antoine	33fa7ab596	smtp: null terminate before calling strtoul ... by copying in a temporary buffer as is done in ByteExtractString	4 years ago
Philippe Antoine	4d2f9cc8a0	swf: right input length for decompression	4 years ago
Philippe Antoine	6f03ee2e47	dcerpc: handles bigger inputs than 2^16 ... By comparing integers with the largest size	4 years ago
Philippe Antoine	7d0a39412b	detect: use u32 for InspectionBufferMultipleForList ... So that we do not have an endless loop casting index to u16 and having more than 65536 buffers in one transaction Changes for all protocols, even ones where it is impossible to have such a pattern, so as to avoid bad pattern copy/paste in the future	4 years ago
Victor Julien	e611adf3dc	detect: set event if max inspect buffers exceeded ... If a parser exceeds 1024 buffers we stop processing them and set a detect event instead. This is to avoid parser bugs as well as crafted bad traffic leading to resources starvation due to excessive loops.	4 years ago
Victor Julien	3dc50322db	detect: fix multi inspect buffer issue; clean up ... Fix multi inspect buffer API causing cleanup logic in the single inspect buffer paths. This could lead to a buffer overrun in the "to clear" logic. Multi buffers now use InspectionBufferSetupMulti instead of InspectionBuffer. This is enforced by a check in debug validation. Simplify the multi inspect buffer setup code and update the callers.	4 years ago
Victor Julien	23d7beb458	detect: reformat events table	4 years ago
Philippe Antoine	b3c1f2ab48	nfs: improve probing parser ... Checks credentials flavor is known	4 years ago
Philippe Antoine	0c948142b9	enip: improve probing parser ... Strict length for register sessions NOP command must have options=0	4 years ago
Philippe Antoine	8bf6530540	config: fix null dereference in MacSetRegisterFlowStorage ... Crash happens with --set outputs.eve-json.types.files.force-magic=yes	4 years ago
Philippe Antoine	39575e2cc9	modbus: use ascii character classes while parsin rule ... As the rust regex crate is unicode aware, which was not the case of the C version	4 years ago
Philippe Antoine	ef5755338f	rust: SCLogDebug is real nop when built as release ... Before, even if there were no outputs, all the arguments were evaluated, which could turn expensive All variables which are used only in certain build configurations are now prefixed by underscore to avoid warnings	4 years ago
Victor Julien	20e8f90981	http2: set Debug on structs	4 years ago