7d6bc60abb
doc/userguide: document ftp max-line-length
3 years ago
cf8ed576e0
ftp: truncate command data that is too long
...
FTP control commands will be buffered forever until a new line is seen,
this can lead to memory exhaustion in Suricata.
To fix, set an upper bound, 4096 bytes on the size of the command that
is saved in the transaction. The input continues to be parsed to find
the end of the command so the parser can continue to move onto the next
command.
The result is that the command data in the transaction is truncated,
which also shows up in the ftp transaction logs.
This value is configurable with the max-line-length field in the ftp
app-layer.protocols section.
As FTP doesn't have events at this time, add a new fields to eve-log
that specificy if the request, or the response has been truncated.
Ticket #5024
3 years ago
cedffdf14c
protocol: forbids concurrent protocol upgrades
...
Ticket: 5243
When switching from SMTP to TLS, and getting HTTP1 instead of
expected TLS, and HTTP1 requesting upgrade to HTTP2, we do not
overwrite the alproto_orig value so as not to have type confusion
in AppLayerParserStateProtoCleanup
3 years ago
0623ada24d
dns: better error handling when parsing names
...
The DNS name parser will error out with an error even if the
error is incomplete. Instead of manually generating errors,
use '?' to let the nom error ripple up the error handling chain.
The reason this wasn't done in the first place is this code
predates the ? operator, or we were not aware of it at the time.
This prevents the case where probing fails when there is enough data to
parse the header, but not enough to complete name parser. In such a case
a parse error is returned (instead of incomplete) resulting in the
payload not being detected as DNS.
Ticket #5034
3 years ago
27679a12aa
dns: don't parse a full request during probe if not enough data
...
If there is more data than a header, but not enough for a complete DNS
message, the hostname parser could return an error causing the probe to
fail on valid DNS messages.
So only parse the complete message if we have enough input data. This is
reliable for TCP as DNS messages are prefixed, but for UDP its just
going to be the size of the input buffer presented to the parser, so
incomplete could still happen.
Ticket #5034
3 years ago
2a89185f04
github-actions: bump actions/upload-artifact from 1 to 3
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 1 to 3.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/v1...6673cd052c4cd6fcf4b4e6e60ea986c889389535 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
3 years ago
f5408ec2d7
detect/frame: fix frame detect registration
...
Rewrite keyword parser.
Duplicate short names could lead to buffer confusion and memory leaks.
Bug: #5238 .
3 years ago
b0354437d5
smb/rules: add rules for new events
3 years ago
976748b777
doc/smb: add resource limits section
3 years ago
fc9b65d8d3
smb2: validate negotiate read/write max sizes
...
Raise event if they exceed the configured limit.
3 years ago
4be8334c9e
smb2: allow limiting in-flight data size/cnt
...
Allow limiting in-flight out or order data chunks per size or count.
Implemented for read and writes separately:
app-layer.protocols.smb.max-write-queue-size
app-layer.protocols.smb.max-write-queue-cnt
app-layer.protocols.smb.max-read-queue-size
app-layer.protocols.smb.max-read-queue-cnt
3 years ago
2c5ad8858e
filetracker: track total queued data (in_flight)
...
As well as expose number of chunks.
3 years ago
90d4b8e438
smb: log max read/write sizes
3 years ago
5bcc4162f7
smb2: add options for max read/write size
...
Add options for the max read/write size accepted by the parser.
3 years ago
f28888513a
smb2: track max read/write size and enforce its values
3 years ago
594acec5dc
smb: minor function cleanup
...
Remove used argument from `filetracker_newchunk()`. We're not
using fill_bytes with smb.
3 years ago
c7a474c725
filetracker: make FileChunk private
3 years ago
276cae5d73
github-actions: bump codecov/codecov-action from 2.1.0 to 3
...
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action ) from 2.1.0 to 3.
- [Release notes](https://github.com/codecov/codecov-action/releases )
- [Changelog](https://github.com/codecov/codecov-action/blob/master/CHANGELOG.md )
- [Commits](f32b3a3741...e3c560433a
3 years ago
725e1b6e4c
github-actions: bump github/codeql-action from 1.0.26 to 2.1.8
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 1.0.26 to 2.1.8.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](5f53256358...1ed1437484
3 years ago
fe444011bc
github-actions: bump actions/cache from 2.1.7 to 3.0.2
...
Bumps [actions/cache](https://github.com/actions/cache ) from 2.1.7 to 3.0.2.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](937d244753...48af2dc4a9
3 years ago
14125d7361
github-actions: bump actions/download-artifact from 2 to 3
...
Bumps [actions/download-artifact](https://github.com/actions/download-artifact ) from 2 to 3.
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](https://github.com/actions/download-artifact/compare/v2...fb598a63ae348fa914e94cd0ff38f362e927b741 )
---
updated-dependencies:
- dependency-name: actions/download-artifact
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
3 years ago
ebcf6b6acf
github-actions: bump ossf/scorecard-action from 1.0.1 to 1.0.4
...
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action ) from 1.0.1 to 1.0.4.
- [Release notes](https://github.com/ossf/scorecard-action/releases )
- [Commits](e3e75cf2ff...c1aec4ac82
3 years ago
af90478167
detect/frames: reduce severity of validation check
3 years ago
28898dbfb8
dependabot: monitor github actions
3 years ago
ad9c8fab25
github-ci: set safe directory before reset
...
While the latest checkout action does set the "safe.directory"
parameter, it doesn't appear to stick for the following "git fetch", so
call this command again.
3 years ago
57a6f30431
github-ci: pin checkout action to latest release
3 years ago
3b13008c1b
mqtt: fix consumed bytes computation for truncated msg
...
Ticket: 5268
3 years ago
3a7d09edfc
detect/frame: get data using stream callback
...
Inspect only data that has already been consumed by the
app-layer parser. This allows for simpler progress tracking.
3 years ago
ffe036e881
frame: introduce entry for getting stream data for frame
3 years ago
96bc11d0d0
stream: make raw data handling more generally usable
...
Move raw detection logic out of main StreamReassembleRawDo() so that
it can be reused for other parts of the engine.
The caller now has to specify a right edge of the data.
3 years ago
afb97d1dee
stream: add offset to raw stream callback
...
This gives the called function to understand where it is in the
stream.
3 years ago
205bc1e288
app-layer: disable stream app tracking on no parser
...
If protocol has no parser enabled or implemented, disable the app
progress tracking in the stream engine to reduce the workload in
the stream engine.
3 years ago
8ecf7e403e
source: pcap timestamp microsecond consistency
...
That is it should be less than 1 000 000.
Have the same for fuzz targets where the bug came from.
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44177
3 years ago
704bc878ea
dcerpc: store consumed_bytes as i32
...
As it can grow bigger than u16
3 years ago
dfd17e9acc
ike: fix integer underflow in parse_proposal
...
By not restricting a usize to i16
3 years ago
dccf2e4c30
detect: config checks alstate before getting tx
...
Ticket: 4972
As is done in detect-lua-extensions.
We can have a flow with alproto unknown, no state, and therefore
cannot run AppLayerParserGetTx which could try to run a NULL
function
3 years ago
45d1a9ae77
detect: faster linked list copy
...
In DetectAppLayerInspectEngineCopyListToDetectCtx
Avoid quadratic complexity by remembering last element
of the linked list we are inserting into
3 years ago
2a22b4ca1f
flow: fix integer warnings
...
Ticket: 4516
3 years ago
1cc9762b6a
host/ippair: fix integer warnings
...
Ticket: 4516
3 years ago
b1eaa1e8cd
util: using size_t len for byte utils
...
Ticket: 4516
Like ByteExtractStringUint64, because most of their inputs come
from strlen which returns a size_t
3 years ago
f30975fb16
app-layer: fix integer warnings
...
Ticket: 4516
3 years ago
1c8559b3ab
debug: support %m output format again
...
Use thread local storage to avoid the previous dead lock issues.
3 years ago
ce4e543719
threading: simplify thread name logic
3 years ago
93d5bce0aa
rust: update regex & memchr dependencies
...
Bug: #5260 .
3 years ago
053a9d2e68
smb/ntlmssp: add stricter len/offset validation
3 years ago
3e48881b78
smb: prevents integer underflow
...
Ticket: 5246
If msg_id is 0, we cannot find the previous request
3 years ago
e72036f12f
smb: ntlmssp domain_blob_offset underflow check
...
Ticket: 5246
3 years ago
817a5001a5
smb: check on param parsing
...
Ticket: 5246
so as not to overflow u16
3 years ago
013fb2dde3
frames: remove dead condition in eof check
3 years ago
86e8611f5e
app-layer: don't switch dir if proto already known
3 years ago
Jason Ish
Philippe Antoine
dependabot[bot]
Victor Julien