167 Commits (4620776a30b9c87d0d33ac9fa57a3418be87bba7)

Author	SHA1	Message	Date
Philippe Antoine	e3cd0d073f	http2: app-layer event for userinfo in uri ... Ticket: #6426 as per RFC 9113 ":authority" MUST NOT include the deprecated userinfo subcomponent for "http" or "https" schemed URIs.	1 year ago
Philippe Antoine	46a46e5b1f	http2: event on mismatch between authority and host ... Ticket: #6425	1 year ago
Sascha Steinbiss	1f8a5874fb	rfb: never return error on unknown traffic ... We only try to parse a small subset of what is possible in RFB. Currently we only understand some standard auth schemes and stop parsing when the server-client handshake is complete. Since in IPS mode returning an error from the parser causes drops that are likely uncalled for, we do not want to return errors when we simply do not understand what happens in the traffic. This addresses Redmine #5912. Bug: #5912.	2 years ago
Philippe Antoine	f31ea90836	http: event on chunk extension ... Chunks extension are defined in rfc2616 section-3.6.1 Ticket: #6159	2 years ago
Victor Julien	d936a970ed	rules: spelling	2 years ago
Victor Julien	30a716a4ab	stream: accept and flag ack of ZWP data ... Tcp Zero Window Probes try to send a single byte payload to "probe" if the window has reopened. This single byte is, if accepted, not retransmitted.	2 years ago
Victor Julien	7ef57cc7cb	stream: support SYN/ACK with TFO only ack'ing ISN ... Not ack'ing the data.	2 years ago
Victor Julien	7bfee147ef	stream: SYN queue support ... Support case where there are multiple SYN retransmits, where each has a new timestamp. Before this patch, Suricata would only accept a SYN/ACK that matches the last timestamp. However, observed behavior is that the server may choose to only respond to the first. In IPS mode this could lead to a connection timing out as Suricata drops the SYN/ACK it considers wrong, and the server continues to retransmit it. This patch reuses the SYN/ACK queuing logic to keep a list of SYN packets and their window, timestamp, wscale and sackok settings. Then when the SYN/ACK arrives, it is first evaluated against the normal session state. But if it fails due to a timestamp mismatch, it will look for queued SYN's and see if any of them match the timestamp. If one does, the ssn is updated to use that SYN and the SYN/ACK is accepted. Bug: #5856.	2 years ago
Philippe Antoine	c1b7befb18	smb: checks against nbss records length ... When Suricata handles files over SMB, it does not wait for the NBSS record to be complete, and can stream the payload to the file... But it did not check the consistency of the SMB record length being read or written against the NBSS record length. This could lead to an evasion where an attacker crafts a SMB write with a too big Length field, and then sends its evil payload, even if the server returned an error for the write request. Ticket: #5770	2 years ago
Victor Julien	0303bb1f9c	decoder: mention removal of udp.hlen_invalid sig	2 years ago
Shivani Bhardwaj	487f59df4c	rules/decoder: fix sid for udp.len_invalid rule	2 years ago
Jason Ish	0490279a75	rules/readme: document sid ranges in source tree	2 years ago
Jason Ish	3f4dad8676	ftp: add events for command too long ... Issue: 5235	2 years ago
Shivani Bhardwaj	b5b05b8fce	rules/decoder: add udp.len_invalid rule	2 years ago
Lukas Sismis	d18e52ed93	decode-udp: Allow shorter UDP packets than the remaining payload length ... If the packet is shorter than IP payload length we no longer flag it as an invalid UDP packet. UDP packet can be therefore shorter than IP payload. Keyword "udp.hlen_invalid" became outdated as we no longer flag short UDP packets as invalid. Redmine ticket: #5693	2 years ago
Jason Ish	c98c49d4ba	dns: parse and alert on invalid opcodes ... Accept DNS messages with an invalid opcode that are otherwise valid. Such DNS message will create a parser event. This is a change of behavior, previously an invalid opcode would cause the DNS message to not be detected or parsed as DNS. Issue: #5444	2 years ago
Philippe Antoine	55c4834e4e	smb: configurable max number of transactions per flow ... Ticket: #5753	2 years ago
Victor Julien	2bc5c46158	stream/rules: disable depth rule by default	2 years ago
Philippe Antoine	11f849c3ee	protocol-change: sets event in case of failure ... Protocol change can fail if one protocol change is already occuring. Ticket: #5509	3 years ago
Jeff Lucovsky	4aa4ad3f74	stream/rules: add example rule for reassembly depth ... Issue: 3512	3 years ago
Philippe Antoine	f242fb7f22	quic: events and rules on them	3 years ago
Victor Julien	d8edea904c	stream/rules: add example rule for pkt_spurious_retransmission	3 years ago
Victor Julien	dc57460427	smb: fix event types for limit exceeded rules	3 years ago
Victor Julien	b0354437d5	smb/rules: add rules for new events	3 years ago
Sascha Steinbiss	1ba62993d5	mqtt: raise event on parse error	3 years ago
Philippe Antoine	acbe6a33a2	ssh: install app-layer events rules	3 years ago
Jason Ish	1e65324940	smb: rules for messages in the wrong direction	3 years ago
Philippe Antoine	8adf172ab8	nfs: limits the number of active transactions per flow ... Ticket: 4530	3 years ago
Philippe Antoine	a8079dc978	mqtt: limits the number of active transactions per flow ... Ticket: 4530 So, that we do not get DOS by quadratic complexity, while looking for a new pkt_id over the ever growing list of active transactions	3 years ago
Philippe Antoine	5475212f21	http2: limits the number of active transactions per flow ... Ticket: 4530 So, that we do not get DOS by quadratic complexity, while looking for a new stream id over the ever growing list of active streams	3 years ago
Philippe Antoine	df2cbd6517	http2: event for variable-length integer overflow ... http2_parse_var_uint can overflow the variable-length integer it is decoding. In this case, it now returns an error of kind LengthValue. The new function http2_parse_headers_blocks, which factorizes the code loop for headers, push promise, and continuation, will check for this specific error, and instead of erroring itself, will return the list of so far parsed headers, plus another one with HTTP2HeaderDecodeStatus::HTTP2HeaderDecodeIntegerOverflow This status is then checked by process_headers to create an app-layer event.	3 years ago
Philippe Antoine	334b1382e0	http: : fix int warnings ... Explicitly truncate file names to UINT16_MAX Before, they got implicitly truncated, meaning a UINT16_MAX + 1 file name, went to 0 file name (because of modulo 65536)	3 years ago
Philippe Antoine	e1c0725e05	doc: fix typo lenght/length	3 years ago
Philippe Antoine	6cb6225b28	tcp: rejects FIN+SYN packets as invalid ... Ticket: #4569 If a FIN+SYN packet is sent, the destination may keep the connection alive instead of starting to close it. In this case, a later SYN packet will be ignored by the destination. Previously, Suricata considered this a session reuse, and thus used the sequence number of the last SYN packet, instead of using the one of the live connection, leading to evasion. This commit errors on FIN+SYN so that they do not get processed as regular FIN packets.	3 years ago
Philippe Antoine	98f84d5a9b	http2: follow range requests ... Move the content-range parsing code to rust	3 years ago
Philippe Antoine	e82416a415	http/range: reassemble files from different flows with range ... adds a container, ie a thread safe hash table whose key is the filename keep a tree of unordered ranges, up to a memcap limit adds HTPFileOpenWithRange to handle like HTPFileOpen if there is a range : open 2 files, one for the whole reassembled, and one only for the current range	3 years ago
Philippe Antoine	ca760e305c	ipv6: decoder event on invalid length ... From RFC 2460, section 4.5, each fragment, except the last one, must have a length which is a multiple of 8	4 years ago
frank honza	f83d51d0cb	ike: set event for multiple server proposals	4 years ago
Jeff Lucovsky	1ddad0a0d6	decode/events: VNTAG decoder events	4 years ago
Andreas Herz	c93073c246	rules: add newer rule files to makefile for release tarball	4 years ago
frank honza	ecdf9f6b0b	ikev1: rename ikev2 to common ike ... Renaming was done with shell commands, git mv for moving the files and content like find -iname '*.c' | xargs sed -i 's/ikev1/ike/g' respecting the different mixes of upper/lower case.	4 years ago
Philippe Antoine	7500c29300	decode: limits the number of decoded layers ... so as to avoid overrecursion leading to stack exhaustion	4 years ago
Philippe Antoine	d861228214	http2: decompression for files ... gzip and brotli decompression for files	4 years ago
Jason Ish	8bd68478a4	rules/mqtt: renumber mqtt events to avoid conflict with ssh ... Both SSH and MQTT events were in the 2228000 range. As SSH was added first, renumber MQTT events into the 2229000 range which is free.	4 years ago
Philippe Antoine	caa7946888	smb: adds file overlap event against evasions ... Evasion scenario is - a first dummy write of one byte at offset 0 is done - the second full write of EICAR at offset 0 is then done and does not trigger detection The last write had the final value, and as we cannot "cancel" the previous write, we set an event which is then transformed into an app-layer decoder alert	4 years ago
Jason Ish	2b1bbd08a3	rules/tls: sync with changes to the TLS events ... Sync rules with event changes in commit 01aef49cbd.	5 years ago
Philippe Antoine	6694737fcf	http2: settings from http1 upgrade	5 years ago
Philippe Antoine	1422b18a99	http2: initial support	5 years ago
Sascha Steinbiss	c31360070b	rust/mqtt: add MQTT parser	5 years ago
Philippe Antoine	5a98035bac	rules: add SSH decoder events rules	5 years ago