With the current layout and fn calls, it was seen that once in the
beginning after the MTU was found and displayed to the user, when the
threads spawned, each thread displayed MTU info as a part of
AFPPeersListAdd fn. This happened in AF_PACKET IPS mode and led to
excessive MTU logs.
Save this info in the LiveDevice struct and avoid calling the unneeded
fns later on.
Bug 5831
The fn GetIfaceMaxPacketSize now uses LiveDevice object as a param
instead of a string. This was done to keep the logic of checking for the
device to this function itself instead of having callers first determine
whether the device exists or not.
This also falls in line with the changes made to avoid excessive MTU
logs in the following commit.
Related to redmine ticket 5831.
Includes from an "include" array were being loaded into the wrong
parent as the logic for array handing in include context was not
updated.
If we are descending into an array in include context, pass through
the current parent so the included configuration is included where it
is expected.
Bug: #6300
Ticket: #6279
If we have the smtp body beginning without headers, we need to
create the md5 context and right away and supply data to it.
Otherwise, on the next line being processed, md5_ctx will be
NULL but body_begin will have been reset to 0
A bad pattern in a rule that hyperscan would fail to compile would
exit Suricata. This could happen during a rule reload as well.
In case of a untrusted ruleset, this could potentially be used to
shut down the sensor.
Commit 7d0851b0c2 already blocks the only know case, but this patch
is more defensive.
Ticket: #6195.
- Use SPHINX_BUILD instead of HAVE_SPHINX_BUILD, as here we're
actually using the path of the program.
- Wrap some elements in [] as is done in modern idiomatic autoconf
We need a recent version of Sphinx to build the documentation in
7.0. Check for a minimum version of 3.4.3. If older, do not build the
docs which is the same behavior when sphinx-build is not found.
Bug: #6297
When comparing IPv6 addresses based on uint32_t chunks, one needs to
apply ntohl() conversion to the individual parts, otherwise on little
endian systems individual bytes are compared in the wrong order.
Avoid this all and leverage memcmp(), it'll short circuit on the first
differing byte and its return values tells us which address sorts lower.
Bug: #6276
When thread affinity is set, the NUMA configuration specified in
the napatech.ini configuration could be incorrect and then fail.
This fails before the recommended configuration is printed, which
is pretty unhelpful.
Previous implementation hardcoded up to 4 NUMA nodes.
We support arbitrary number of NUMA nodes now.
Note that this commit also removes the old SCLog logging
calls. But since the logic has changed, these have been replaced
directly with new code.
The WARN_UNUSED attribute has been added to ByteExtractStringUint8
in commit 6988168114. The return
value is now handled and appropriate errors printed.
Since f8474344cd, there is an extra
argument to SCLog which indicates the module and subsystem
identifier. The Napatech vendor code is missing this argument,
which is fixed here.
* Log vendor client identifier (dhcp option 60) if extended dhcp
logging is turned on. This required the `vendor_client_identifier` to
be added to the json schema. Validation done using an SV Test
* Added `requested_ip` to the json schema as well, since it was
missed. My SV test failed without it.
Feature #4587
Commit e7c0f0ad91 removed uses of atoi with a new number parsing
functions. This broke parsing ip-reputation data files that contained
trailing carriage returns as it was being included in the number
string to convert.
Bug: #6243.
Multi-tenancy uses loader threads that initialize detection engines. During
this, esp the AC family of MPM implementations, there is significant stack
usage. In most OS' threads have a lower stack size by default. In Linux, when
using the Musl C library, a thread by default gets 128KiB.
This patch does 2 things:
1. it centralizes the handling of the `threading.stack-size`. It it is not
longer handled by the runmodes, but called from the global initialization
logic.
2. it sets a minimum per thread stack size of 512k, unless `threading.stack-size`
is set.
Ticket: #6265.
Jeff Lucovsky
Shivani Bhardwaj
Jason Ish
Victor Julien
Juliana Fajardini
Philippe Antoine
Arne Welzel
Ralph Eastwood
Yatin Kanetkar
Thomas Winter
Philippe Antoine