Open Information Security Foundation

02/14/2025

10:25 PM Suricata Bug #7552: applayer: misdetection if response is seen first without request

S-V tests that indicate the bug
https://github.com/OISF/suricata-verify/pull/2292 Alice da Silva Akaki

02/13/2025

02:31 PM Suricata Bug #7552 (New): applayer: misdetection if response is seen first without request

Transaction gets cleaned by AppLayerParserTransactionsCleanup before detection is run in the to_client direction when... Alice da Silva Akaki

02/12/2025

03:17 PM Suricata Feature #7513 (Closed): detect/integers: add support for negated strings when enum is used

Merged:
SU: https://github.com/OISF/suricata/pull/12516
SV: https://github.com/OISF/suricata-verify/pull/2271 Alice da Silva Akaki

02/11/2025

09:06 AM Suricata Feature #7532 (In Progress): detect: add keywords for LDAPResult

PRs for review:
SU: https://github.com/OISF/suricata/pull/12555
SV: https://github.com/OISF/suricata-verify/pull/2282 Alice da Silva Akaki

02/03/2025

08:04 PM Suricata Feature #7532: detect: add keywords for LDAPResult

Philippe Antoine wrote in #note-3:
> There is no ldap.request.result_code it is only in responses right ?
yes, it... Alice da Silva Akaki

01/31/2025

10:10 PM Suricata Feature #7539 (New): detect: add keyword ldap.mod_dn_request.new_rdn

Eve field to match:
ldap.request.mod_dn_request.new_rdn Alice da Silva Akaki

10:08 PM Suricata Feature #7538 (New): detect: keyword ldap.modify_request.operation

Is an enumeration
Eve fields to match:
ldap.request.modify_request.changes[].operation Alice da Silva Akaki

10:04 PM Suricata Feature #7537 (New): detect: add keywords for SearchRequest

ldap.search_request.scope, enum
ldap.search_request.deref_alias, enum
ldap.search_request.size_limit, integer [0-65... Alice da Silva Akaki

09:57 PM Suricata Feature #7536 (New): detect: add keywords for BindRequest

ldap.bind_request.version, an integer between 1 and 127
ldap.bind_request.authentication, enum + an octet string
... Alice da Silva Akaki

09:53 PM Suricata Feature #7535 (New): detect: add ldap.search_request.filter and also log the filter

Filter is an Abstract Syntax Tree (AST)
Doesn't look like it's logged in json.schema Alice da Silva Akaki