th_entry is resized using ThresholdHashRealloc() every time a rule with
a threshold using by_rule tracking is added. The problem is that this is
done before the rules are reordered, so occasionally a rule with by_rule
tracking gets a higher signature number (after reordering) than the
number of th_entries allocated, causing Suricata to crash.
This commit fixes this by allocating th_entries after all the rules are
loaded and reordered.
Backtrace from core dump:
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x000000000051b381 in ThresholdHandlePacket (p=p@entry=0x7fb0080f3960, lookup_tsh=0x51, new_tsh=new_tsh@entry=0x7fb016c316e0, td=td@entry=0x14adedf0, sid=9800979, gid=1, pa=0x7fb0080f3b18)
at detect-engine-threshold.c:415
415>---- if (TIMEVAL_DIFF_SEC(p->ts, lookup_tsh->tv1) < td->seconds) {
Bug #4503.
(cherry picked from commit 2a326421aa)
As part of commit ea15282f47,
some initialization was moved to happen even in unix socket mode,
however, this initialization does setup some loggers that can only have
one instance enabled (anomaly, drop, file-store).
This will cause these loggers to error out on the first pcap, but work
on subsequent runs of the pcap as some deinitialization is done after
each pcap.
This fix just runs the post pcap-file deinitialization routine to
reset some of the initialization done on startup, like is done after
running each pcap in unix socket mode.
Redmine issue:
https://redmine.openinfosecfoundation.org/issues/4225
Additionally this prevents alerts from being logged two times
on the first run of a pcap through the unix socket:
Redmine issue:
https://redmine.openinfosecfoundation.org/issues/4434
(cherry picked from commit 488d5fb342)
Including the whole directory results in .deps files ending up
in the distribution archive which shouldn't be there. Instead
we have to list all the test sources individually.
Backport of 70b21df756.
Adding the already consumed bytes
In case an incomplete tls handshake is handled with/after
a refular rdp t123_tpkt
(cherry picked from commit 6da9a37285)
Currently the ICMP emergency-bypassed value defined in suricata.conf is
overwriting the UDP value rather than correctly setting it for ICMP.
This commit corrects this bug so that the ICMP value can be set as
expected.
(cherry picked from commit 7fb56a9075)
This commit improves performance when parsing threshold.config by
removing a loop-invariant to create a one-time object with the parsed
address(es).
Then, as needed, copies of this object are made as the suppression
rule(s) are processed.
(cherry picked from commit 02ceac8b8d)
This commit adds a function to make a deep copy of a DetectThresholdData
object.
The function is used when parsing threshold.config items to make a
one-time object and then add copies as needed.
(cherry picked from commit e873632a28)
When adding the alert to a drop record make sure the add the highest
priority.
It would until now add all drops from high to low prio, effectively
overwriting the record each time.
Ticket #4397
(cherry picked from commit 398ebf9345)
At least on FreeBSD, some other include is including "sys/queue.h"
which results in FreeBSDs /usr/include/sys/queue.h being picked
up and setting __SYS_QUEUE_H__ so our queue.h is not picked up.
But the FreeBSD queue.h does not have the CIRCLEQ definitions. To
fix just include our queue.h first, which also sets __SYS_QUEUE_H__
preventing the system one from being picked up.
(cherry picked from commit d4554ec6bb)
A unidirection protocol parser should only have its transactions
marked as "skipped" if it is skipped in both the TS and TC
directions, otherwise unidir transactions are always considered
skipped and the cleanup will never updates its minimum id.
Redmine issue:
https://redmine.openinfosecfoundation.org/issues/4437
(cherry picked from commit afaa18c5ad)
Philippe Antoine
Mats Klepsland
Jason Ish
Victor Julien
Jeff Lucovsky
Shivani Bhardwaj
Luke Coughlan