Philippe Antoine
47dd9a5ebc
signature: Fix leak in urilen parsing
...
cf #4254
4 years ago
Victor Julien
423a5e2f6c
detect/file.data: support ftp and ftp-data
4 years ago
Victor Julien
45eddde573
detect/file.name: register inspect engine for ftp-data
4 years ago
Jeff Lucovsky
f8fef0dd05
decode/tcp: Improved handling of TFO options
...
This commit improves handling of TCP fast open options
- Option length must be in [6, 18]
- Option length must be an even value
4 years ago
Gianni Tedesco
10ea60a237
detect: Validate that NOOPT options don't have optvals
...
Without this, a simple typo between : and ; is able to hide actual bugs
in rules.
I discovered 2 bugs in ET open ruleset this way.
4 years ago
Gianni Tedesco
cebe15c23b
detect-fast-pattern: Mark as OPTIONAL_OPT, instead of NOOPT
...
Also update the erroneous comment about it.
4 years ago
Sascha Steinbiss
f78f444a5e
doc: build all manpages
4 years ago
Eric Leblond
dfe5785bfa
ebpf: avoid need of 32 bit header
...
Compilation of xdp_lb.c was failing in some case with the following
error:
/usr/include/x86_64-linux-gnu/gnu/stubs.h:7:11: fatal error: 'gnu/stubs-32.h' file not found
This patch add some define to be able to skip recursive inclusion of
header files leading to the problem.
4 years ago
Juliana Fajardini
e33bbee9b7
nbss: add parser tests
...
Add tests to parse_nbss_record and parse_nbss_record_partial
4 years ago
Eric Leblond
8d034b4163
eve/dhcp: avoid to call common logging twice
4 years ago
Joshua Lumb
9d432bbab3
threads: More descriptive startup output
4 years ago
Carl Smith
9b840104bd
lua: Make the rule action available to output scripts
...
Useful for those that want to do custom logging from lua
4 years ago
Justin Ossevoort
320de5f43d
eve: Log tenant_id for all eve-json messages
4 years ago
Carl Smith
660b68a083
nsh: Parsing of Network Services Header and payload
...
Support for EtherType 0x894F and basic header
4 years ago
Victor Julien
db2dbaaf40
stream/midstream: handle packet loss after SYN/ACK
4 years ago
Victor Julien
895938080f
stream/tcp: fix invalid ack events in timewait state
4 years ago
Victor Julien
49bd1f85b9
flow/timeout: fix TCP seq/ack for reversed flows
...
When a flow is swapped it also swaps the stream trackers, so it does
not make sense to reverse them during pseudo packet creation.
4 years ago
Victor Julien
3c7c361b60
detect/stream: fix async stream inspection
...
Move raw progress forward only if detect uses stream data, indicated
by the PKT_DETECT_HAS_STREAMDATA flag.
4 years ago
Victor Julien
8aa02c6d15
stream/tcp: fix async mode ACK validation
4 years ago
Philippe Antoine
8d659c6500
fuzz: improves sigpcap target with PacketPoolInit
4 years ago
Victor Julien
372fc26739
ci: buildbot is decommissioned, so remove prscript refs
4 years ago
Jason Ish
49ca070446
github-ci: use a unique id for the commit check cargo cache
...
All builds have been using the same cache id for ~/.cargo which
could lead us to conflict situations which is what I think we are
seeing with the commit-check job.
4 years ago
Shivani Bhardwaj
6c19e7d0d4
counters: convert to FAIL/PASS API
4 years ago
Shivani Bhardwaj
7eef4e83e5
confyaml: convert to FAIL/PASS API
4 years ago
Shivani Bhardwaj
fb311e3d9d
applayer: convert to FAIL/PASS API
4 years ago
Shivani Bhardwaj
bfd956ce67
applayer/htp/xff: convert to FAIL/PASS API
4 years ago
Shivani Bhardwaj
b195ffbe18
applayer/ftp: convert to FAIL/PASS API
4 years ago
Shivani Bhardwaj
2e3d408e6f
fastlog: convert to FAIL/PASS API
4 years ago
Janani Ramjee
2d3cf11906
detect/mark: convert unittests to use PASS/FAIL API
4 years ago
Juliana Fajardini
2765bff0c5
detect/msg: convert to FAIL/PASS API
...
Issue 4053. Adjust code formatting style (wrap long lines).
Replace SigInit with DetectEngineAppendSig.
4 years ago
Sumera Priyadarsini
d4264748d8
detect: filesha1: convert unittests to use PASS/FAIL API
...
Currently, unit tests use integer values 1 and 0 to denote pass
and fail status of tests respectively. Modify the unit test
detect-filesha1 to use the PASS/FAIL API instead.
4 years ago
Juliana Fajardini
5226ba1c15
Rust: generic files definition
...
Issue: Optimization 3825
- filecontainer: add Files structure, to replace/unify SMBFiles,
NFSFiles and HTTP2Files
- smb/files: delete SMBFiles implementation
- smb/smb: replace SMBFiles with Files
- nfs/nfs: delete NFSFiles implementation, replace its former
declarations with Files' ones
- http2/http2: replace HTTP2Files with Files
- http2/mod: Delete reference to file files.rs
- http2/files: Delete
4 years ago
Juliana Fajardini
d2144c0dfb
detect-sid: fail/pass api
...
- convert unittests to new FAIL/PASS API.
4 years ago
Jason Ish
f09536a936
github-ci: fix centos 8 build
...
The "PowerTools" repo that we need to enable has been renamed
to "powertools".
4 years ago
Jason Ish
f2ab5803fb
dns: initialize log flags as an unsigned long long
...
On 64 bit all 64 bits were being initialized, but on 32 bit
only 32 bits were as it was being initialized as a long.
Redmine issue:
https://redmine.openinfosecfoundation.org/issues/4206
4 years ago
Sascha Steinbiss
a4556c9427
dns: use rest() for NULL parsing
4 years ago
Sascha Steinbiss
81b206a5f4
dns: add test for SRV
4 years ago
Sascha Steinbiss
15c42e0d83
doc: add documentation for SRV DNS JSON structure
4 years ago
Sascha Steinbiss
08a6f1441a
dns: parse SRV records
4 years ago
Antti Tönkyrä
f3ad7f14fa
dns: add rdata logging for NS rrtype
4 years ago
Simon Dugas
4336a0e739
dns: log rdata for NULL record type
...
Logs the rdata for a NULL record type as a printable string.
4 years ago
Jason Ish
858ab07775
github-ci: add sccache to per-commit check
...
Also use the pre-build cbindgen binary.
Hopefully speeds up the build process.
4 years ago
Victor Julien
efc9a7a398
app-layer: remove callback for completion status
...
Since the completion status was a constant for all parsers, remove the
callback logic and instead register the values themselves. This should
avoid a lot of unnecessary callback calls.
Update all parsers to take advantage of this.
4 years ago
Victor Julien
84385549fe
detect: remove unused arg from generic list inspect
4 years ago
Victor Julien
d694dac5a8
detect: remove inspect v1 API
4 years ago
Victor Julien
92a8d8b4f4
detect/template: convert to v2 inspect API
4 years ago
Victor Julien
494f8f2700
detect/tls: convert to v2 inspect API
4 years ago
Victor Julien
71a508000b
detect/ssh: convert to v2 inspect API
4 years ago
Victor Julien
86686eff17
detect/snmp: convert to v2 inspect API
4 years ago
Victor Julien
962230040a
detect/rfb: convert to v2 inspect API
4 years ago