suricata

Commit Graph

Author	SHA1	Message	Date
Alice Akaki	cdb043810f	detect: add ldap.request.operation ldap.request.operation matches on Lightweight Directory Access Protocol request operations This keyword maps to the eve field ldap.request.operation It is an unsigned 8-bit integer Doesn't support prefiltering Ticket: #7453	1 month ago
Alice Akaki	824c5d4f06	rustfmt: rust/src/ldap/types.rs	1 month ago
Philippe Antoine	b0db4e2dbe	http: aliases for htp opaque htp_header_t In preparation of libhtp rust	1 month ago
Philippe Antoine	a0e44ebb17	http: use even more aliases for htp opaque htp_tx_t For request and response headers In preparation of libhtp rust	1 month ago
Philippe Antoine	82e31e14c0	http: use alias for htp opaque htp_tx_t In preparation of libhtp rust This occurence was missed in `23050d70ed`	1 month ago
Philippe Antoine	9a8e377a7a	http: include htp-libhtp.h from header Instead of C files requiring it. In preparation of libhtp rust, to minimize the final commit.	1 month ago
Victor Julien	d6b56929d3	detect: set mpm/prefilter during signature parsing In preparation of flowbit prefilter work that needs this info earlier. Track potential prefilter sm's to avoid unnecessary looping during setup.	1 month ago
Jason Ish	5d9fad5edf	rust/ssh: rustfmt	1 month ago
Jason Ish	9c87ac1b9b	ssh: cleanup rust visibility and naming Remove pub and no_mangle from non-exported functions and rename to Rust as-needed. Ticket: 7498	1 month ago
Jason Ish	f8d27992f7	rust/ntp: rustfmt	1 month ago
Jason Ish	f023b3a6f1	ntp: cleanup visibility and naming Remove pub and no_mangle from non-exported functions and rename to Rust as-needed. Ticket: 7498	1 month ago
Jason Ish	4cca135793	pgsql: cleanup visibility and naming Remove pub and no_mangle from non-exported functions and rename to Rust style as needed. Ticket: 7498	1 month ago
Jason Ish	a7f7dc5296	rust/dhcp: rustfmt	1 month ago
Jason Ish	c5089ac5f4	dhcp: cleanup visibility and naming - remove "rs_" prefix from functions that are not exported - prefix exported functions with "SC" - don't export functions that are only used by pointer Ticket: 7498	1 month ago
Jason Ish	c86b2608aa	rust/applayer: clean visibility of export macros Both the macros export_tx_data_get and export_state_data_get can generate non-pub functions as the function they generate is only used as a pointer during registration. Remove "pub" and "no_mangle" from the generated functions and update the names of the generated functions to follow Rust rules as they are no longer exported into the global C namespace. Ticket: 7498	1 month ago
Jason Ish	c93bba8e2c	rust/transforms: remove no_mangle from non-pub functions Ticket: 7498	1 month ago
Jason Ish	f370afb5bd	rust/ldap: cleanup no_mangle and extern C pub functions If a function is extern "C" and not pub, remove no_mangle so its not exposed as-is into the global name space. Ticket: 7498	1 month ago
Eric Leblond	8ae7054f1f	decode/tcp: fix some macros Ticket: #7509	1 month ago
Philippe Antoine	78715a5f3f	smtp: recognize if client initiated TLS Ticket: 7469	1 month ago
Philippe Antoine	b5094b00b6	protodetect: finish probing parser sooner Ticket: 7495 We want to finish also if we tested all the expected protocols in mask, or if we tested even more. There can be one more protocol coming from pe0, which can be the protocol already found in the other direction.	1 month ago
Jeff Lucovsky	95e8427bae	gen: Remove _AL_ usage in detect keywords This commit removes the `_AL_` usage in detect keywords for improved readability. Some of the HTTP rule keywords already had counterparts without using "_AL_". These rule keywords are the legacy content modifier keywords that now have sticky buffer equivalents. For these, "_AL_" was removed and a suffix was added to the #define: src/detect-engine-register.h:151: DETECT_HTTP_COOKIE_CM src/detect-engine-register.h:153: DETECT_HTTP_METHOD_CM src/detect-engine-register.h:161: DETECT_HTTP_HEADER_CM src/detect-engine-register.h:173: DETECT_HTTP_RAW_HEADER_CM src/detect-engine-register.h:175: DETECT_HTTP_URI_CM src/detect-engine-register.h:179: DETECT_HTTP_STAT_MSG_CM src/detect-engine-register.h:181: DETECT_HTTP_STAT_CODE_CM src/detect-engine-register.h:185: DETECT_HTTP_HOST_CM	1 month ago
Jason Ish	c207cfc67e	rust/detect: remove nested unsafe around keyword registration Just a cleanup, I'm not sure why Rust wasn't warning on these nested/unneeded unsafe's.	1 month ago
Jason Ish	2bcc66da58	rust/log: move rust log and debug utils to debug module Move Rust logging, and debug_validation to a debug module to mirrow the C side.	1 month ago
Jason Ish	f62be374ea	rust/direction: move direction to own file (cleanup) Move the implementation of Direction to its own file, direction.rs.	1 month ago
Jason Ish	7ef4caf90e	rust/flow: move flow support to its own file (cleanup) Move the Rust Flow support from core.rs to flow.rs.	1 month ago
Philippe Antoine	23050d70ed	http: aliases for htp opaque htp_tx_t In preparation of libhtp rust	1 month ago
Philippe Antoine	8f6795d049	rust: remove unneeded mut for tx in detect Detection does not change transactions, it reads only.	1 month ago
Philippe Antoine	af4e1e8888	rust: remove unneeded mut for tx in loggers Loggers do not change transactions, they read only.	1 month ago
Philippe Antoine	5ee6e7cef0	http: aliases for htp progresses In preparation of libhtp rust	1 month ago
Philippe Antoine	8c612246c1	http: aliases for htp protocol versions In preparation of libhtp rust	1 month ago
Philippe Antoine	ef133942e8	http: aliases for htp stream states In preparation of libhtp rust	1 month ago
Philippe Antoine	a4479c03f6	http: aliases for htp methods In preparation of libhtp rust	1 month ago
Philippe Antoine	604b625616	http: aliases for htp auths In preparation of libhtp rust	1 month ago
Philippe Antoine	fcfc10c95f	http: aliases for htp flags In preparation of libhtp rust	1 month ago
Philippe Antoine	b482ae3f04	http: aliases for htp server personalities In preparation of libhtp rust	1 month ago
Philippe Antoine	99ab3f7dc7	http: aliases for htp statuses In preparation of libhtp rust	1 month ago
Philippe Antoine	edfe0ccbe1	ldap: implement abandon request Ticket: #7477	2 months ago
Philippe Antoine	770a75911f	ldap: update ldap-parser crate so that we can implement abandon request support Ticket: #7477	2 months ago
Alice Akaki	078c6469a0	detect: add vlan.layers keyword vlan.layers matches on the number of VLAN layers per packet It is an unsigned 8-bit integer Valid range = [0-3] Supports prefiltering Ticket: #1065	2 months ago
Alice Akaki	b1c2643c87	detect: add vlan.id keyword vlan.id matches on Virtual Local Area Network IDs It is an unsigned 16-bit integer Valid range = [0-4095] Supports prefiltering Ticket: #1065	2 months ago
Philippe Antoine	637708acb4	fuzz: remove unused macro	2 months ago
Philippe Antoine	a92212d6e5	fuzz: better init for signature parsing harness It needs app-layer registration for the names	2 months ago
Philippe Antoine	eab212b0be	plugins: app-layer plugins Ticket: 5053	2 months ago
Philippe Antoine	ae1a4ef757	app-layer: make number of alprotos dynamic Ticket: 5053 The names are now dynamically registered at runtime. The AppProto alproto enum identifiers are still static for now. This is the final step before app-layer plugins.	2 months ago
Philippe Antoine	e6be049c5d	app-layer: move ALPROTO_FAILED definition Because some alprotos will remain static and defined as a constant, such as ALPROTO_UNKNOWN=0, or ALPROTO_FAILED. The regular already used protocols keep for now their static identifier such as ALPROTO_SNMP, but this could be made more dynamic in a later commit. ALPROTO_FAILED was used in comparison and these needed to change to use either ALPROTO_MAX or use standard function AppProtoIsValid	2 months ago
Jason Ish	05853fb8d5	lua/datasets: factor out into its own file This is mainly for header sanitization to avoid pulling in detect modules into the Lua sandbox definition. Plus if we namespace modules with names like "suricata.dataset", it probably makes sense to keep those modules in their own files.	2 months ago
Jason Ish	e397f21019	lua/datasets: rework to be a "required" module Re-work the Lua dataset lib to be required into a user script like: local dataset = require("suricata.data") The main difference from loading it into global space is providing a custom require function (as we removed it in the sandbox) and load it on demand, returning a table to the module.	2 months ago
Victor Julien	ccebae6ec0	detect/lua: add support for datasets dataset.new create a dataset object in lua <dataset>:get gets a reference to an existing dataset <dataset>:add returns 1 if a new entry was added returns 0 if entry was already in the set Example: ``` function init (args) local needs = {} needs["packet"] = tostring(true) return needs end function thread_init (args) conn_new, dataset.new() ret, err conn_new:get("conn-seen") if err ~= nil then SCLogWarning("dataset warning: " .. err) return 0 end end function match (args) ipver, srcip, dstip, proto, sp, dp = SCFlowTuple() str = ipver .. ":<" .. srcip .. ">:<" .. dstip .. ">:" .. dp ret, err = conn_new:add(str, #str); if ret == 1 then SCLogInfo(str .. " => " .. ret) end return ret end ``` Ticket: #7243.	2 months ago
Victor Julien	e89ab4f88a	detect/lua: add thread_init Add optional `thread_init` function support. This function is called per script, per thread to allow a user to initialize the lua state.	2 months ago
Victor Julien	c3e61e07f0	detect/lua: improve stack dumping Only useful when debugging. Add a prefix and a stack size indication.	2 months ago

... 2 3 4 5 6 ...

16787 Commits (dd344bd07c1ff0c7cec006064a9e542532591801) All Branches Search

16787 Commits (dd344bd07c1ff0c7cec006064a9e542532591801)

All Branches