8762 Commits (0bb07b550c1f00a95e6803aba7cdeb22d637fbc2)

Author	SHA1	Message	Date
Andreas Herz	6ebb1b2cc4	rule-reload: enable rule-reload for -s and -S run as well	7 years ago
Victor Julien	3a912446ad	pcap: fix breakloop error handling ... Ticket #3004	7 years ago
Victor Julien	06d3e1d3d8	netmap: suppress format truncation warning ... CC source-netmap.o source-netmap.c: In function ‘NetmapOpen’: source-netmap.c:327:56: error: ‘%s’ directive output may be truncated writing up to 15 bytes into a region of size between 10 and 57 [-Werror=format-truncation=] snprintf(devname, sizeof(devname), "netmap:%s%s%s", ^~ ns->iface, strlen(optstr) ? "/" : "", optstr); ~~~~~~ source-netmap.c:327:9: note: ‘snprintf’ output 8 or more bytes (assuming 70) into a destination of size 64 snprintf(devname, sizeof(devname), "netmap:%s%s%s", ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ns->iface, strlen(optstr) ? "/" : "", optstr); ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ source-netmap.c:330:59: error: ‘%s’ directive output may be truncated writing up to 15 bytes into a region of size between 8 and 55 [-Werror=format-truncation=] snprintf(devname, sizeof(devname), "netmap:%s-%d%s%s", ^~ ns->iface, ring, strlen(optstr) ? "/" : "", optstr); ~~~~~~ source-netmap.c:330:9: note: ‘snprintf’ output 10 or more bytes (assuming 72) into a destination of size 64 snprintf(devname, sizeof(devname), "netmap:%s-%d%s%s", ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ns->iface, ring, strlen(optstr) ? "/" : "", optstr); ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ source-netmap.c:316:54: error: ‘snprintf’ output may be truncated before the last format character [-Werror=format-truncation=] snprintf(devname, sizeof(devname), "%s}%d%s%s", ^ source-netmap.c:316:9: note: ‘snprintf’ output 3 or more bytes (assuming 65) into a destination of size 64 snprintf(devname, sizeof(devname), "%s}%d%s%s", ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ns->iface, ring, strlen(optstr) ? "/" : "", optstr); ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors Gcc 8 with -Wformat-truncation=1	7 years ago
Victor Julien	bdd74d413b	detect/mpm: put transform into 'profile name' ... So that profiling gives more info about cost of the mpm engines when they use transforms.	7 years ago
Victor Julien	5c735f340f	detect/dns: register correct profile name	7 years ago
Victor Julien	8a59ad6096	string: making shortening function global	7 years ago
Victor Julien	26c5249574	device: break string shortening out of device shortening	7 years ago
Victor Julien	7eff6ec500	device: remove duplicate length check ... Shorten code handles all cases correctly.	7 years ago
Victor Julien	2a136c917f	detect: move includes/declarations closer to use	7 years ago
Victor Julien	bc866ff2a0	detect: fix inaccurate comments	7 years ago
Max Fillinger	4f3bb48f83	pfring: Fix kernel version in comment	7 years ago
Eric Leblond	b37554e0bc	af-packet: fix build on recent Linux kernels	7 years ago
Philippe Antoine	477328f79b	ssl: register probing for port 443 if no config	7 years ago
Shivani Bhardwaj	8c2c78f0b6	configure: Add date with rev information ... Date makes it even clearer that when was the last commit for the build that one is running. Add this info alongwith rev. Change inspired by rustc. Before ``` $ suricata -V This is Suricata version 5.0.0-dev (rev 2d217e666) ``` After ``` This is Suricata version 5.0.0-dev (2d217e666 2019-07-12) ``` Closes redmine ticket #3092	7 years ago
Jeff Lucovsky	3d5eccf084	output/json: Refactor output buffer size macro	7 years ago
Jeff Lucovsky	66c565e9e7	eve/json: Break multiline FTP responses into array ... This changeset breaks multi-line FTP responses into separate array entries. Multi-line responses are those with "text-1\r\ntext-2[...]". Each of \r\n delimited text segments is reported in the `reply` array; each text segment _may_ include a completion code; completion codes are reported in the `completion_code` array.	7 years ago
Jeff Lucovsky	9cf4e2e432	eve/ftp: Refactor and reduce logging functions	7 years ago
Jeff Lucovsky	911d423a6b	ftp: Generalize prelim positive reply ... Extend special case for reply code 150 to handle all preliminary positive reply -- reply codes with `1xy`.	7 years ago
Victor Julien	343ba45916	ftp: reply code 150 doesn't end tx	7 years ago
Victor Julien	b595da6c51	ftp: fix reply without request ... Permit picking up any reply w/o a request. Observed unsolicited server messages before connection termination. Previously the code assumed that this could only happen on connection start when there was no previously recorded command.	7 years ago
Victor Julien	dc80d520af	ftp: implement progress tracking ... Make sure FTP_STATE_FINISHED is returned for transactions that are marked 'done'. This is necessary for timely logging and inspection.	7 years ago
Victor Julien	8ae691155d	ftp: be more strict with tx type	7 years ago
Jeff Lucovsky	fb019213e7	eve/ftp: minor cleanups and fixes	7 years ago
Zach Kelly	1588cd8735	eve/ftp: Bug fix and banner capture ... 1. Correct off-by-one error in server response whitespace removal 2. Include banner response (before first command entered)	7 years ago
Jeff Lucovsky	a04b1c1664	eve/ftp: Log initial responses ... This changeset ensures that unknown commands are logged. Unknown commands are either - Banner responses when connecting to the FTP port - Commands not includes in the FtpCommands descriptor table	7 years ago
Jeff Lucovsky	2149807bd6	eve/ftp: Transaction support for unmatched requests ... Modified transaction logic to create a new transaction with each request; replies location transactions by using the oldest "open" (unmatched) transaction or the last transaction if none are open.	7 years ago
Jeff Lucovsky	1930b1f504	eve/ftp: Log FTP transactions ... This changeset includes changes that 1. Add transaction support to the FTP parser 2. Support eve json logging of FTP transactions	7 years ago
Philippe Antoine	2d217e6661	http: fixes overflow in range parsing	7 years ago
Victor Julien	5ddfc42b87	stream: fix midstream reverse flow handling ... When a TCP session is picked up from the response the flow is reversed by the protocol detection code. This would lead to duplicate logging of the response. The reason this happened was that the per stream app progress tracker was not handled correctly by the direction reversing code. While the streams were swapped the stream engine would continue to use a now outdated pointer to what had become the wrong direction. This patches fixes this by making the stream a ptr to ptr that can be updated by the protocol detection as well. In addition, the progress tracking was cleaned up and the GAP error handling in this case was improved as well.	7 years ago
Philippe Antoine	94a976d47e	ftp: removes one use of atoi ... Fixes only one small part of #3053	7 years ago
Victor Julien	66d6196e9b	pcap: code reformatting and minor cleanups	7 years ago
Victor Julien	255ab1528b	flow: minor formatting updates	7 years ago
Max Fillinger	bcc03f172a	af-packet: Always fill in vlan_id ... The vlan tag will be filled in either from the extended header (for kernel version >= 3.0) or from the packet itself. Related to https://redmine.openinfosecfoundation.org/issues/3076	7 years ago
Max Fillinger	09c54471e5	pfring: Always fill in vlan_id ... Previously, source-pfring.c would copy the vlan_id from the extended header only if vlan.use-for-tracking was enabled. This commit removes that check. Related to https://redmine.openinfosecfoundation.org/issues/3076	7 years ago
Max Fillinger	44bea80d3c	decode erspan: Always fill in vlan_id ... Fill in the vlan_id fields unconditionally. We can now remove the check for the vlan.use-for-tracking setting in decode.c. The debug log message is moved to suricata.c.	7 years ago
Max Fillinger	8d3b04b0e3	decode vlan: Always fill in vlan_id ... Since the vlan.use-for-tracking setting is now handled in flow-hash.c, we can fill in the vlan_id fields unconditionally. This makes the vlanh fields unnecessary. Related to https://redmine.openinfosecfoundation.org/issues/3076	7 years ago
Max Fillinger	cef9961f59	flow hash: Mask vlan_id if not used for tracking ... If vlan.use-for-tracking is disabled, set the vlan_id fields to 0 when hashing or comparing flows. This is done using a bitmask as suggested by Victor Julien in IRC, in order to avoid adding more branches to this code. Currently, suricata does not fill in vlan_id fields if vlan.use-for-tracking is disabled and instead leaves them at the default 0 value, so this commit makes no functional change. This change is in preparation for future commits where the vlan_ids will be always filled in. Related to https://redmine.openinfosecfoundation.org/issues/3076	7 years ago
Max Fillinger	38731d30da	flow hash: Make CMP_FLOW macro an inline function	7 years ago
Victor Julien	7ccf14bc60	runmodes: remove unused prototypes	7 years ago
Victor Julien	c12252617c	afl: fix afl-ftp causing FPE due to missing ippair	7 years ago
Victor Julien	9e70716d5a	runmodes: remove no-Rust logic	7 years ago
Victor Julien	8c6251ea6c	runmodes: simply default runmode logic	7 years ago
Victor Julien	3282fb4967	runmodes: code cleanups	7 years ago
Philippe Antoine	feda5e7392	leak: Fixes leak in AppLayerProtoDetectPMRegisterPattern ... Fixes #3070	7 years ago
Philippe Antoine	66c500eaac	leak: Fixes leak in DetectAppLayerEventPrepare	7 years ago
Philippe Antoine	684f101710	log: use SCLogError instead of fprintf	7 years ago
Philippe Antoine	19ab85f17e	leak: fixes leak in DetectAddressParse2	7 years ago
Victor Julien	8b87801b80	geoip: fix unittests w/o db present	7 years ago
Victor Julien	a7d65668ae	mem: avoid potential shadow vars with 'len' name	7 years ago
Bill Meeks	d1525c6fb8	mem: add SCStrndup() function to wrap strndup().	7 years ago
Bill Meeks	a291209e47	detect/geoip: migrate to GeoIP2 database format ... Issue #2765	7 years ago
Victor Julien	d6323ae33d	detect/mpm: improve stats reporting	7 years ago
Victor Julien	24f0092b72	detect: add ipv6.hdr sticky buffer ... Inspects IPv6 header and extension headers.	7 years ago
Victor Julien	3c9a557810	decode/ipv6: track length of ext hdrs	7 years ago
Victor Julien	9252400f68	decoder/ipv6: minor cleanups ... Remove unused field and macros. Minor code style cleanups.	7 years ago
Victor Julien	4ac327f5b5	detect/ipv4: add ipv4.hdr sticky buffer	7 years ago
Victor Julien	367e3e1895	detect/tcp/udp: minor cleanups	7 years ago
Victor Julien	4dff903b35	detect: introduce pkt mpm engines ... Instead of the hardcode L4 matching in MPM that was recently introduced, add an API similar to the AppLayer MPM and inspect engines. Share part of the registration code with the AppLayer. Implement for the tcp.hdr and udp.hdr keywords.	7 years ago
Victor Julien	14896365ef	detect: remove Threadvars argument from API calls ... Remove it as it's (almost) never used. If it is really needed it can be accessed through DetectEngineThreadCtx::tv as well.	7 years ago
Victor Julien	c1dd4534d9	detect/bsize: support transforms in case w/o content	7 years ago
Victor Julien	82de6e0659	decoder/vxlan: improvements and cleanups ... Implement port config handling. Also check both src port and dest port for tunnels that only set the destination port to the VXLAN port. At the point of the check we don't know the packet direction yet. Implement as Suricata tunnel similar to Teredo. Cleanups.	7 years ago
Henrik Lund Kramshoej	3519b011b7	decoder/vxlan: initial implementation of decoder	7 years ago
Victor Julien	35b88991c3	mem: fix shadow declaration warning ... Avoid clash by adding a leading underscore to the declaration in the macro. These temporary vars should never clash with valid variables from the code where they are called from.	7 years ago
Philippe Antoine	e30a77c5a1	warnings : Fixes integer sizes in format strings	7 years ago
Victor Julien	ba5679de0f	profiling: fix undefined profiling code use	7 years ago
Victor Julien	ac694b089a	detect: add udp.hdr sticky buffer	7 years ago
Victor Julien	bdf53f449c	detect/tcp: rename tcp keyword files	7 years ago
Victor Julien	47919fd0e4	detect/tcp: add tcp.<field> notation variants	7 years ago
Victor Julien	0cecb1c3b2	detect/prefilter: minor error handling cleanup	7 years ago
Victor Julien	35be8385eb	detect: tcp.hdr sticky buffer ... Sticky buffer to inspect the TCP header.	7 years ago
Victor Julien	47ef8f5822	detect/mpm: add l4-header support ... Prepare MPM part of the detection engine for a new type of per packet matching, where the L4 header will be inspected. Preparation for TCP header inspection keyword.	7 years ago
Victor Julien	0965afd661	detect: pkt inspect engines ... Instead of hard coded calls to the inspection logic for payload inspection and 'MATCH'-list inspection use a callback approach. This will register a callback per 'sm_list' much like how app-layer inspect engines are registered. This will allow for adding more types later without adding runtime overhead. Implement the callback for the PMATCH and MATCH logic.	7 years ago
Victor Julien	2a778e439a	detect/build: minor code cleanups	7 years ago
Victor Julien	66648df099	detect: add tcp.mss keyword ... Allows matching on TCP option MSS. Syntax: tcp.mss:<value>; tcp.mss:<value1>-<value2>; tcp.mss:<op><value>; Operator can be: >, <.	7 years ago
Jeff Lucovsky	d2fdbc7d6f	output/json: Avoid use of uninitialized value ... In JsonPacket, a Base64Decode error could cause an uninitialized variable to be used because its return value is ignored.	7 years ago
Jeff Lucovsky	a5d9d37c34	rust/parser: Extend Rust parser for event-by-id ... Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.	7 years ago
Jeff Lucovsky	294d0e8cba	snmp: Fix type	7 years ago
Jeff Lucovsky	9ccc28baeb	rust/smb: Implement get event by id	7 years ago
Victor Julien	28ed0d3a18	nfs: implement get_event_info_by_id callback	7 years ago
Victor Julien	429ca858dc	rust/gen: turn *mut*const T into const T **	7 years ago
Jeff Lucovsky	d568e7fadd	eve/logging: 2991 Optimize logging by TX ... This changeset makes changes to the TX logging path. Since the txn is passed to the TX logger, the TX can be used directly instead of through the TX id.	7 years ago
Jeff Lucovsky	488446cf37	logging/anomaly: Track event log progress ... This changeset adds a mechanism to track when individual events are logged. Transactions can be provided more than once; track events to prevent event re-logging.	7 years ago
Jeff Lucovsky	4a39d7a1ee	app-layer: Extend event container with progress	7 years ago
Jeff Lucovsky	07c05f7dd8	logging/anomaly: TX based logging addition	7 years ago
Jeff Lucovsky	36644907f5	app-layer/logging Add TX packet logging support ... Add transactional logging support for packet based loggers, like the anomaly logger.	7 years ago
Jeff Lucovsky	f7b934f83f	app-layer/logging: protocol parser updates	7 years ago
Jeff Lucovsky	49438569a2	logging: anomaly log updates	7 years ago
Jeff Lucovsky	50e23ba93a	app-layer: Initial app layer logging	7 years ago
Victor Julien	4e8d38348f	flow: no bypass manager for Windows	7 years ago
Victor Julien	287b87b81b	bypass: switch to gettimeofday	7 years ago
Victor Julien	d8614a15c6	mingw: fix compile error ... Declare _POSIX_C_SOURCE before sys/time.h to avoid: util-time.c: In function 'SCUtcTime': util-time.c:222:12: error: implicit declaration of function 'gmtime_r'; did you mean 'gmtime_s'? [-Werror=implicit-function-declaration] 222 | return gmtime_r(&timep, result); | ^~~~~~~~ | gmtime_s util-time.c:222:12: warning: returning 'int' from a function with return type 'struct tm *' makes pointer from integer without a cast [-Wint-conversion] 222 | return gmtime_r(&timep, result); | ^~~~~~~~~~~~~~~~~~~~~~~~ util-time.c: In function 'SCLocalTime': util-time.c:305:9: error: implicit declaration of function 'localtime_r'; did you mean 'localtime_s'? [-Werror=implicit-function-declaration] 305 | localtime_r(&timep, &cached_local_tm[lru]); | ^~~~~~~~~~~ | localtime_s util-time.c:321:56: warning: comparison between pointer and integer 321 | if (localtime_r(&timep, &cached_local_tm[lru]) == NULL) | ^~ cc1.exe: some warnings being treated as errors Tickets: #2994 #3051	7 years ago
Eric Leblond	6126f105ea	util-ebpf: fix creation of flow from pinned maps	7 years ago
Eric Leblond	7df3007066	af-packet: xdp pinned maps need to be read	7 years ago
Eric Leblond	4ba02830b6	flow-bypass: registration of non periodic check ... This patch adds the capability to register a set of functions without providing a periodic check function. This permit to run a task only at init.	7 years ago
Eric Leblond	3e8fd26ee3	flow-hash: real hash computation for FlowKey	7 years ago
Eric Leblond	0963fea390	util-ebpf: log bypassed flow maps count	7 years ago
Eric Leblond	7e5439bc15	bypass: add counter for local captured bypass ... Packets from captured bypassed flows that are received by Suricata before the capture method start to bypass them can represent an important part due to various buffer and insertion delay. This patch adds a two counters to know the number of packets and bytes in this case.	7 years ago
Eric Leblond	de52e78e65	bypass: flow bypass is not ebpf only	7 years ago
Eric Leblond	c938dbde27	util-ebpf: early exit if no map	7 years ago
Eric Leblond	e5d325a6ca	util-ebpf: reindex	7 years ago