18365 Commits (1f58bc1a074694b0af89d62f37ee9c87414c5a16)

 

All Branches   

Search

Author	SHA1	Message	Date
Victor Julien	1f58bc1a07	detect/luaxform: disable bytes limit during setup ... During per inspection setup the buffer could already use up all the budget. Bug #8173.	10 months ago
Victor Julien	7bc4b7d713	lua/sandbox: allow disabling the bytes limit ... Meant for setting up from C, where we may use more bytes than expected. Bug: #8173.	10 months ago
Shivani Bhardwaj	30bdaa44e1	doc: add elephant.flow usage section	10 months ago
Shivani Bhardwaj	33a3448f45	detect/flow: add support for elephant flow detection ... Expose elephant flow flags on a flow via rule language. The rule keyword is defined as "flow.elephant: <dir>;" where the <dir> can expand to: - toserver - toclient - either - both Feature 8117	10 months ago
Shivani Bhardwaj	0f92583702	flow: split elephant flow detection per dir ... The tracking for elephant flow is done per direction however, the flag was set on the flow whenever either of the directions crossed the rate-limit defined in the settings. Given that the tracking was already split, it makes sense to split the detection tracking per direction as well and allow user to have a better control via rule language.	10 months ago
Shivani Bhardwaj	06eafb79d6	detect/flow-pkts: check for both dir ... The functionality of "both" can already be easily achieved by using both "toclient" and "toserver" in a rule. This just adds the ease of expression in rule. As it is added now, check the direction for the pre-existing users of direction as well.	10 months ago
Shivani Bhardwaj	77abcde9ee	rust/flow: add public wrapper for dir ... in order to be able to use it on the C side for elephant flow detection.	10 months ago
Victor Julien	cc2287beb4	tcp/tfo: set PKT_STREAM_EST flag ... Detection and logging skip a lot of work if PKT_STREAM_EST is not set. When a TFO packet with data comes in the TCP state is not yet established, but the data still needs to be considered. So for this case set the PKT_STREAM_EST flag. Bug #6744.	10 months ago
Victor Julien	8247ec65b5	features: use strcmp instead of memcmp	10 months ago
Victor Julien	4a58c84862	string-hash: use strcmp instead of memcmp	10 months ago
Victor Julien	c226626a7f	counters: use strcmp instead of memcmp	10 months ago
Victor Julien	7a794945c6	proto: use strcmp instead of memcmp	10 months ago
Victor Julien	8f655c7d8d	reference: use strcmp instead of memcmp	10 months ago
Victor Julien	3fbce40def	classification: use strcmp instead of memcmp	10 months ago
Victor Julien	5a12096dd9	spm: minor unittest cleanup	10 months ago
Victor Julien	a16c6ff6a5	memcpy: rename memcpy_tolower ... Rename to match coding style. Update callers. Minor loop cleanup.	10 months ago
Ali Saidi	c4360cd515	util: add timing assembly for arm64	10 months ago
Jason Ish	b3d45e5507	profiling: log rule profiling as json by default ... We've been forcing JSON logging in our default configuration for some time now, just make it the actual default.	11 months ago
Jason Ish	d89b35db56	conf: add SCConfNodeChildValueIsFalse to check for false value ... New function to check is a value is actually set to a false value.	11 months ago
Jason Ish	6eda4b9f59	configure: remove @e_enable_evelog@ ... Jansson/JSON has been mandatory for a long time now, so this value has evaluated to yes for many years now.	11 months ago
Jason Ish	e895cbbf58	profiling: don't enable rule profiling by default ... Update the suricata.yaml rule profiling section to not turn on rule profiling by default, as its not on by default when commented out. Also update the comments.	11 months ago
Jason Ish	aa7091f927	ebpf: ignore *.bpf ... Add the compiled .bpf programs to .gitignore.	11 months ago
Philippe Antoine	af246ae7ab	http: do not use a loop to find the tx count ... As we want the last tx Ticket: 8156 The generic function AppLayerParserGetTxCnt calls for HTTP1 Transactions.size() This function has some specific code, as we may have pre-created a tx that we do not want to count. This used to get the last tx by iterating over all the transactions waiting to find the one with max index. So, instead of using the Transactions.get function, we get the last tx out of the VecDeque and check its index.	11 months ago
Jeff Lucovsky	5c0f95faec	gen: Fix typos	11 months ago
Jeff Lucovsky	9c81f817e8	rust: bindgen update ... Issue: 7389 Update bindgen with `make update-bindgen`	11 months ago
Jeff Lucovsky	e80e881335	main/options: display level name, not numeric ... Issue: 7389 Follow-up change for verbose handling. Instead of displaying the numeric verbose level, display the level name. I.e., instead of 4, display Debug	11 months ago
Shivani Bhardwaj	a53ba4af94	detect: use PrefilterIsPrefilterableById where possible ... cocci script used: @@ identifier s, sm, DETECT_TYPE; @@ - for (sm = s->init_data->smlists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) { - switch (sm->type) { - case DETECT_TYPE: - return true; - } - } - return false; + return PrefilterIsPrefilterableById(s, DETECT_TYPE); followed by some basic cmdline manipulations to get rid of extras left.	11 months ago
Philippe Antoine	726139a539	fuzz: really restrict path for nalloc ... Ticket: 4125	11 months ago
Philippe Antoine	e305c6c9df	conf: do not exit on alloc failure ... Ticket: 6188 Just return an error	11 months ago
Philippe Antoine	6882159692	fuzz: set engine stage for conf yaml target ... Ticket: 6188 Allows allocations failures not to be fatal as in init	11 months ago
Jason Ish	50224f2ee5	rust: fix clippy warning for unused import ... While debug_validate_bug_on is still used, it does not need to be imported directly, as that macro is marked with `macro_export`, making it globally available to the crate.	11 months ago
Philippe Antoine	24405a7b76	doc: http fields in json schema ... Ticket: 6075	11 months ago
Philippe Antoine	2f39c8c099	jsonschema: remove obsolete http fields ... These were moved to array request_headers/response_headers Ticket: 6075	11 months ago
Juliana Fajardini	0ca874b678	userguide: highlight exceptions interactions ... In corner cases, we assume that a midstream exception policy could be triggered by a prior exception policy in effect. Explain this in the docs. Task #5830	11 months ago
Philippe Antoine	b7bd7f7d4c	fuzz: allocation failures with nalloc ... Ticket: 4125	11 months ago
Victor Julien	984fc260c5	github-ci: update Fedora to 43	11 months ago
Philippe Antoine	455b7d1b3b	rust: use snake case for applayer_register_protocol_detection	11 months ago
Philippe Antoine	b4d8aea0ae	rust: bindgen SCAppLayerRegisterProtocolDetection ... Ticket: 7662 Changing the struct passed to it to have the minimal number of useful fields.	11 months ago
Ambre Iooss	91c9e34419	doc/userguide: update windivert instructions ... The IPS documentation for Windows had a dead link to a PDF. Update the Windows build page to include WinDivert instructions. Documentation: #8137.	11 months ago
Ambre Iooss	3bcad5f364	windivert: upgrade to 2.0.0 ... WinDivert 2 was released in 2019. This introduced some minimal changes to some functions arguments. Bug: #8138.	11 months ago
Philippe Antoine	cf88ed518c	jsonschema: check for duplicate keys ... Ticket: 6691 And fix the one duplicate found	11 months ago
Victor Julien	365ed2a2ff	af-packet: disable hwtimestamp by default ... Add enable-hwtimestamp option to replace disable-hwtimestamp. Ticket: #7585.	11 months ago
Jeff Lucovsky	845544aad3	doc/luaxform: Clarify luaxform calling convention ... Issue: 8135 Clarify the calling convention for the Lua transform's `transform` function.	11 months ago
James Kaddu	78d8fd7b9d	output/file: validate force-hash YAML values ... Previously, the force-hash configuration for file logging silently accepted unknown or invalid hash types (e.g., 'shanani') Now, invalid values trigger FatalError. Bug OISF#4330	11 months ago
James Kaddu	354e9987e4	detect/analyzer: add details for the xbits keyword ... Add xbits keyword details. Exposes cmd, name, track, and expire properties, following the same pattern as byte_jump and flowbits. Task #6351	11 months ago
Juliana Fajardini	6c06ab6144	devguide: update backports policy for Suricata 7.0 ... Also remove mentions to `master` and `6.0x`. Task #7937	11 months ago
Juliana Fajardini	e3878042c9	stream/reassemble: use more legible FAIL macros ... Use `FAIL_IF_NOT` instead of `FAIL_IF(!` or `FAIL_IF(.... !=`	11 months ago
James Kaddu	1b18081dfb	stream/tcp/reassemble: convert unittests to FAIL/PASS API ... Updated the stream TCP reassembly unit tests to use the new FAIL/PASS API instead of the deprecated legacy assertion macros. Task OISF#6324	11 months ago
Juliana Fajardini	907f4faff8	doc/thresholding: minor fix for backoff subsection	11 months ago
Philippe Antoine	c93e69830a	detect/ssl: properly handle negation in ssl_version keyword ... Ticket: 3220 DetectSslVersionMatch did not handle properly negation. It could never match on a signatrue with ssl_version: !tls1.3 That is because, if we had such a signature and network traffic with tls1.1, we were looking into DetectSslVersionData field for tls1.1, which was not set, instead of looking at field for tls1.3 which was set with negated flag. Previous DetectSslVersionData was holding redundant information. It did not need to have it for each ssl version, but just globally. Also, it did not need to hold the version as a value in the array, as it was redundant with the index of the array.	11 months ago