suricata

Commit Graph

Author	SHA1	Message	Date
Philippe Antoine	c57052181c	snmp: rustfmt detect.rs	3 years ago
Philippe Antoine	c7214be99b	snmp: adds usm keyword as is logged Ticker: #5416	3 years ago
Philippe Antoine	eb1c2a6083	smb: use default stream-depth 0 by default As broken by commit `e5c948df87` Ticket: #5390	3 years ago
Philippe Antoine	c585be338c	nfs: fix arbitrary allocation Bug introduced by https://github.com/OISF/suricata/pull/7111 Nom's count begins by allocating a Vector, which leads to arbitrary allocation due to flavors_cnt coming from network, and not even being checked against i.len() Ticket: #5237	3 years ago
Philippe Antoine	26dc70648c	dns: remove unused events field from state found overflowing by oss-fuzz	3 years ago
Philippe Antoine	d1a4dae36b	detect: use generic integer functions for streamsize By the way, adds the prefilter feature Ticket: #2697 Ticket: #4112	3 years ago
Philippe Antoine	35b6dcec7e	detect: use generic integer functions for filesize Ticket: #4112	3 years ago
Philippe Antoine	f29b43defd	detect: rust generic functions for integers Move it away from http2 to generic core crate. And use it for DCERPC (and SMB) And remove the C version. Main change in API is the free function is not free itself, but a rust wrapper around unbox. Ticket: #4112	3 years ago
Philippe Antoine	c4d9cb02ec	util: better hex print function Without dangerous snprintf pattern identified by CodeQL even if this pattern is not a problem in those precise cases, it may easily get copy pasted in a dangerous place, so better get rid of it and make CodeQL happy	3 years ago
Philippe Antoine	6058792bee	rust: make suricata context const So that it is read only and its pointers do not get modified	3 years ago
Philippe Antoine	6224e283fa	modbus: bump up rust crate version So that probing parser is more strict and does not accept unknown function code as valid modbus. Ticket: #5377	3 years ago
Philippe Antoine	2d761810db	rust: cbindgen first verifies existing bindings So as not to recompile every C file inclusing rust.h	3 years ago
Juliana Fajardini	6ccc01a79c	rust: fix doc comments that trigger rust warnings Rust generates warnings that are treated as errors for documentation blocks before `extern` blocks.	3 years ago
Philippe Antoine	d745d28d4a	dcerpc: use vecdeque tx iterator Ticket: #5321	3 years ago
Jason Ish	dfe76bb905	dcerpc: convert transaction list to vecdeque Allows for more efficient removal from front of the list. Ticket: #5271	3 years ago
Jason Ish	8790968281	mqtt, rdp: fix copyright dates	3 years ago
Philippe Antoine	c78722a671	rust: RustParser same fields as AppLayerParser So that there is no problem when crossing FFI	3 years ago
Sam Muhammed	323fe1c1ac	nfs3/records: Fix typo Fix response_lookup unittest name	3 years ago
Jason Ish	b8b6a17a5b	dns: add pdu frame Adds a PDU frame to the DNS parser. For UDP this is the DNS payload portion of the DNS packet, for TCP this is the payload minus the leading legth field. Ticket: 4984	3 years ago
Jason Ish	8d1840f595	frames(rust): don't call into C if running Rust unit tests Wrap the calls behind frames to C code if a `cfg!(not(test))` so they don't get compiled when running Rust unit tests. Linkage to C functions is not yet available for Rust unit tests, and this will keep the check out of individual parsers. Ticket: 4984	3 years ago
Jason Ish	c74ea3840d	frames (rust): method to create StreamSlice from slice Useful in unit test for function that require a StreamSlice.	3 years ago
Jason Ish	d712a8b29d	eve/dns: remove dns v1 logging Removal of DNS v1 logging was scheduled to be removed in May 2022. Ticket: #4157	3 years ago
Jason Ish	e319d31c14	template(rust): convert transaction list to vecdeque Allows for more efficient removal from front of the list. Ticket: #5298	3 years ago
Jason Ish	9b0b2beac1	pgsql: convert transaction list to vecdeque Allows for more efficient removal from front of the list. Ticket: #5297	3 years ago
Jason Ish	2db84726ad	http2: convert transaction list to vecdeque Allows for more efficient removal from front of the list. Ticket: #5296	3 years ago
Jason Ish	4e0ad5e0bd	rdp: convert transaction list to vecdeque Allows for more efficient removal from front of the list. Ticket: #5295	3 years ago
Jason Ish	3b422e25f3	mqtt: convert transaction list to vecdeque Allows for more efficient removal from front. Ticket: #5294	3 years ago
Jason Ish	3189414788	dns: convert transaction list to vecdeque Allows for more efficient removal from front of the list. Ticket: #5277	3 years ago
Jason Ish	7b11b4d3a1	app-layer: more generic state trait Instead of a method that is required to return a slice of transactions, use 2 methods, one to return the number of transactions in the collection, and another to get a transaction by its index in the collection. This allows for the transaction collection to not be a contiguous array and instead can be a VecDeque, or possibly another collection type that supports retrieval by index. Ticket #5278	3 years ago
Juliana Fajardini	bbd9a2ff1a	pgsql: apply clippy fixes	3 years ago
Juliana Fajardini	0fc9ade7a9	pgsql: fix uint overflow and optimizations Fuzzers found a possible integer overflow bug when parsing response messages. To fix that, removed the case where we incremented the parsed field length and created a new message type for situations where Suri parsers an Unknown message. This is good because there may happen that an unknown message to Suri is valid, and in this case, we would still be able to log it. Philippe Antoine found the bug while fuzzing with rust debug assertions. Bug #5016	3 years ago
Juliana Fajardini	8daa79513a	pgsql: fix clippy is_null usage warning	3 years ago
Philippe Antoine	d2f00ac824	dcerpc: use wrappingadd for padding parsing As we compute a modulo, we can safely wrap around even if there is an overflow Ticket: #5301	3 years ago
Philippe Antoine	464ff80c6a	smb: protocol detection on pattern without midstream To recognize a protocol, Suricata first looks for patterns, which can be confirmed by a probing parser. If this does not work, Suricata can try to run some probing parsers on some ports. This is the case for SMB. This commit makes handling the confirming and the probing paser differently even if they share much code. The confirmation parser knows that a pattern has been found. So, it must not do the midstream case of looking for this pattern in the whole buffer, but only check it at the beginning. But it must reverse direction if needed.	3 years ago
Victor Julien	dc57460427	smb: fix event types for limit exceeded rules	3 years ago
Jason Ish	0623ada24d	dns: better error handling when parsing names The DNS name parser will error out with an error even if the error is incomplete. Instead of manually generating errors, use '?' to let the nom error ripple up the error handling chain. The reason this wasn't done in the first place is this code predates the ? operator, or we were not aware of it at the time. This prevents the case where probing fails when there is enough data to parse the header, but not enough to complete name parser. In such a case a parse error is returned (instead of incomplete) resulting in the payload not being detected as DNS. Ticket #5034	3 years ago
Jason Ish	27679a12aa	dns: don't parse a full request during probe if not enough data If there is more data than a header, but not enough for a complete DNS message, the hostname parser could return an error causing the probe to fail on valid DNS messages. So only parse the complete message if we have enough input data. This is reliable for TCP as DNS messages are prefixed, but for UDP its just going to be the size of the input buffer presented to the parser, so incomplete could still happen. Ticket #5034	3 years ago
Victor Julien	fc9b65d8d3	smb2: validate negotiate read/write max sizes Raise event if they exceed the configured limit.	3 years ago
Victor Julien	4be8334c9e	smb2: allow limiting in-flight data size/cnt Allow limiting in-flight out or order data chunks per size or count. Implemented for read and writes separately: app-layer.protocols.smb.max-write-queue-size app-layer.protocols.smb.max-write-queue-cnt app-layer.protocols.smb.max-read-queue-size app-layer.protocols.smb.max-read-queue-cnt	3 years ago
Victor Julien	2c5ad8858e	filetracker: track total queued data (in_flight) As well as expose number of chunks.	3 years ago
Victor Julien	90d4b8e438	smb: log max read/write sizes	3 years ago
Victor Julien	5bcc4162f7	smb2: add options for max read/write size Add options for the max read/write size accepted by the parser.	3 years ago
Victor Julien	f28888513a	smb2: track max read/write size and enforce its values	3 years ago
Victor Julien	594acec5dc	smb: minor function cleanup Remove used argument from `filetracker_newchunk()`. We're not using fill_bytes with smb.	3 years ago
Victor Julien	c7a474c725	filetracker: make FileChunk private	3 years ago
Philippe Antoine	3b13008c1b	mqtt: fix consumed bytes computation for truncated msg Ticket: 5268	3 years ago
Philippe Antoine	704bc878ea	dcerpc: store consumed_bytes as i32 As it can grow bigger than u16	3 years ago
Philippe Antoine	dfd17e9acc	ike: fix integer underflow in parse_proposal By not restricting a usize to i16	3 years ago
Victor Julien	93d5bce0aa	rust: update regex & memchr dependencies Bug: #5260.	3 years ago
Victor Julien	053a9d2e68	smb/ntlmssp: add stricter len/offset validation	3 years ago

1 2 3 4 5 ...

996 Commits (34e0a384ad85333d51e06b0397e2dbc1e2fe8262)