2245 Commits (3564f2f92885e856bffa7d3a54db431c70805756)

Author	SHA1	Message	Date
Jason Ish	cdb02a2779	rust/dns: rustfmt	2 months ago
Philippe Antoine	7d66eb5f04	rust: remove unused function ... rust_string_to_c was used when a buffer should be used as it could contain nul-byte	2 months ago
Philippe Antoine	9b12fd9f09	rust/ffi: move helper trait state_get_tx_iterator to ffi ... Ticket: 7666	2 months ago
Philippe Antoine	07f37676b6	rust/ffi: move Flags for AppLayerParserState to ffi crate ... Ticket: 7666	2 months ago
Philippe Antoine	fb20c69d8d	rust/ffi: move APP_LAYER_PARSER_OPT_X const to ffi crate ... Ticket: 7666	2 months ago
Philippe Antoine	f1c66ff6f0	rust: remove obsolete const exclusions in cbindgen ... As these structs are now bindgened from C to suricata_sys crate	2 months ago
Philippe Antoine	d81a10126e	detect/doc: remove unexisting links ... Ticket: 8257 And add TODO comments if rules doc should be written	2 months ago
Philippe Antoine	8e39539161	detect/doc: fix broken anchor links ... Ticket: 8257	2 months ago
Philippe Antoine	bd6a436893	detect/doc: fix broken files links ... Ticket: 8257	2 months ago
Philippe Antoine	b0e63a2c95	detect/dcerpc: move stub_data keyword to rust ... Ticket: 8391	3 months ago
Philippe Antoine	3d56472d16	detect: bindgen more functions ... To prepare to move dcerpc.stub_data keyword to full rust	3 months ago
Jeff Lucovsky	746f471382	transform/subslice: Add subslice transform ... Issue: 7672 The subslice transform creates a slice of the input buffer. Specify the subslice desired -- nbytes and truncate are optional: subslice: offset <,nbytes> <,truncate> offset: Specifies the starting offset for the new subslice. When negative, expresses how far from the end of the input buffer to begin. nbytes: Specifies the size of the subslice. When negative, specifies that the subslice will end that many bytes from the end of the input buffer. Nbytes must be non-zero. When nbytes is not specified, the size of the subslice will be the size of the input buffer - offset. truncate: Specify behavior when offset + nbytes exceeds buffer length. When present, trims nbytes such that offset + nbytes equals buffer length. When not present, an empty buffer is produced. Examples: subslice: 1; - The subslice will be a copy of the input buffer but omits the input buffer's first byte "This is Suricata" -> "his is Suricata" subslice: 0, 13; - The slice is created from the first 13 bytes of the input buffer "This is Suricata" -> "This is Suric" subslice: 10, -5; - The subslice is created starting at offset 10 and continues to 5 bytes before the end of the input buffer "This is Suricata" -> "r" subslice: -3; - The subslice will be the last 3 bytes of the input buffer. "This is Suricata" -> "ata"	3 months ago
Philippe Antoine	4fc6ca5d6c	detect/dcerpc: move iface keyword to rust ... Ticket: 8391 Use same buffer dce_generic as for dcerpc.opnum (name dce_generic is enforced by a SV test currently)	3 months ago
Philippe Antoine	9677851637	rust/ffi: move app-layer traits to ffi crate ... Ticket: 7666 Traits around structures defined in C and bindgened to rust	3 months ago
Philippe Antoine	f803c25f24	rust/ffi: move export_X_data_get macros to ffi crate ... Ticket: 7666	3 months ago
Philippe Antoine	54b6885166	rust/ffi: move conf_get_bool helper to ffi crate ... Ticket: 7666	3 months ago
Victor Julien	28a3337c27	rust: cargo update	3 months ago
Philippe Antoine	5f9e436c3f	detect/dcerpc: support generic integer for opnum keyword ... Ticket: 8179	3 months ago
Philippe Antoine	67379b009a	detect/dcerpc: move opnum keyword to rust ... Ticket: 8391	3 months ago
Philippe Antoine	a36af353bc	rust: bindgen SCFlowGetAppProtocol	3 months ago
Jason Ish	fd31e50954	ntp: enable keywords for firewall mode ... Ticket: #8394	3 months ago
Jason Ish	713e4eb900	ntp: convert reference_id to buffer and add keyword ... Store the NTP reference ID as raw network-order bytes so it can be exposed as a sticky buffer and matched with payload keywords. The reference ID is often a 4 character string, or an IP address and not just an integer identifier. Updates the log reference ID to be a string of colon separated hex digits as this matches what tshark does. Ticket: #8488	3 months ago
Jason Ish	991e7f3b1d	ntp: add ntp.mode keyword ... This keyword also accepts strings for known mode names. Ticket: #8429	3 months ago
Jason Ish	c10c482290	ntp: add ntp.stratum keyword ... Ticket: #8431	3 months ago
Jason Ish	ec344fe68d	ntp: add ntp.version keyword ... SNMP was used as a template. Ticket: #8430	3 months ago
Jason Ish	74bb525401	ntp: create tx for all modes; log version, mode and stratum ... Add logging for version, mode and stratum as these will be the first keywords we will add. Ticket: #8425	3 months ago
Jason Ish	879846e153	ntp: remove unused event types ... NotRequest and NotResponse event type have never been used. Unsolicited is also unused, however there is a rule for it so removing support would be a breaking change at this time.	3 months ago
Jason Ish	31b967b089	ntp: add transaction logging ... Adds basic NTP transaction logging for the current supported message types. Includes small cleanups around reference ID. Ticket: #8425	3 months ago
Victor Julien	c7cd3b17c3	snmp: minor snmp.pdu_type type cleanup	3 months ago
Victor Julien	2cef1404bc	detect/snmp: let generic keyword share the same list	3 months ago
Victor Julien	670fdabd32	detect/snmp: add snmp.trap_type keyword ... Implemented as a U8 integer keyword. Ticket: #8482.	3 months ago
Philippe Antoine	8ac9a62ec4	detect: enable snmp keywords for firewall mode ... Ticket: #8395	3 months ago
Philippe Antoine	63603fe14a	detect/snmp: sticky buffers at progress 1 ... Since snmp txs are created at progress 1 which is the completion, this does not change detection, except allowing firewall mode to use these keywords with generic hook like snmp:request_complete Ticket: 8395	3 months ago
Philippe Antoine	8f824458c2	detect: helper for buffer register requires progress ... Ticket: 8395 For protocols where tx are complete at start, that is the `tx_get_progress` function returns 1 inconditionnally, we can use the progress 1, not losing time on detection in ips mode, and getting ready for firewall mode For the other protocols (where a tx needs both a request and response for instance), keep progress 0 as was the case before	3 months ago
Jason Ish	eb46d0129e	rust/ffi: add eve callback handler ... Wrap the EVE callback handler with a Rust friendly variant that allows the user to register a callback as a closure which is provided an already wrapped JsonBuilder object. Ticket: #8477	3 months ago
Jason Ish	199e844a07	rust/ffi: add mark support to ffi::jsonbuilder ... To support Rust friendly EVE callback registration (ticket 8477).	3 months ago
Philippe Antoine	58a71d94b0	rust/ffi: move conf_get helper to ffi crate ... Ticket: 7666	3 months ago
Philippe Antoine	8d254f5630	dhcp/output: log app-layer metadata in alerts ... Ticket: 6091 log as extended	3 months ago
Philippe Antoine	db980daf5f	dhcp: standardize output code ... To prepare to add metadata in alerts Ticket: 6091	3 months ago
Philippe Antoine	d14af54b3b	detect/transforms: constify some callbacks arguments ... Ticket: 8298	3 months ago
Philippe Antoine	0a24f0afe2	smb: parse smb1 session setup with word count 13 ... Ticket: 5845	3 months ago
Jason Ish	98469b0f56	rust/ffi: fix clippy warnings ... Remove the unneeded return. The other option would be to allow it, but so far in the ffi crate we don't have any non-default allows.	3 months ago
Philippe Antoine	c53b9df5a2	rust/ffi: move detection helpers to ffi crate ... Ticket: 7666	3 months ago
Philippe Antoine	4f4912c042	rust: bindgen SIGMATCH_ constants	3 months ago
Philippe Antoine	2fa10052cf	websocket: check pdu opcode for reassembly ... Ticket: 8413 RFC 6455 Section 5.4 states Control frames (see Section 5.5) MAY be injected in the middle of a fragmented message. Control frames are identified by opcodes where the most significant bit of the opcode is 1.	3 months ago
Philippe Antoine	7b0528d85f	http2: set response_frame_size ... Ticket: 8410 Do not set only request_frame_size whatever the direction	3 months ago
Philippe Antoine	267c3baff7	rust/ffi: move STREAM_ constants to ffi crate ... Ticket: 7666 reexport them in suricata crate cbindgen them to C	4 months ago
Philippe Antoine	61c667400b	rust: remove obsolete inclusions from cbindgen.toml	4 months ago
Philippe Antoine	fd4c6d4e06	rust: remove obsolete struct exclusions in cbindgen ... As these structs are now in suricata_sys crate	4 months ago
Philippe Antoine	a10a818792	rust: remove obsolete constants exclusion from cbindgen.toml ... Completes commit 71b59f6dbe These const are no longer defined in rust suricata crate	4 months ago