aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
18,671 Commits
8 Branches
174 Tags
248 MiB
main
main-8.0.x
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.7
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '2658a366ad'
${ noResults }
Commit Graph

18671 Commits (2658a366ad61cfd3eb774dfe604cff706dd60c7f)
 

Author SHA1 Message Date
Victor Julien 2658a366ad qa: move live tests into qa/live dir 
They are not github specific.
 8 months ago
Victor Julien cb24430a0a firewall: don't overwrite with ips mode 
When a capture method set IPS mode, it could overwrite already set Firewall mode.

Ticket #8311.
 8 months ago
Antoine Abou Faysal 29834e3917 plugins/ndpi: guard against NULL f->storage in all callbacks 8 months ago
Giuseppe Longo a072ca02be suricata.yaml: add missing modbus logger 
Ticket #8347
 8 months ago
Philippe Antoine d77c43c79b rust/ffi: move build_slice macro to ffi crate 
Ticket: 7666
 8 months ago
Philippe Antoine 4a0143c8d4 rust/ffi: move cast_pointer macro to ffi crate 
Ticket: 7666
 8 months ago
Philippe Antoine aae154874b src/detect: remove unneeded variables 
just use the constant
 8 months ago
Philippe Antoine 65993d4a41 util/lua: remove unneeded variable 
just use the constant
 8 months ago
Philippe Antoine 70bc077433 util: check name length of proposed data directory 
Before doing stack allocation

Ticket: 8001
 8 months ago
Philippe Antoine 27c28cc456 util: remove unneeded stack allocation in HexToRaw 
Ticket: 8001
 8 months ago
Philippe Antoine 2cb8ba5bec output: debug validation before stack allocation 
A rule size has a global bound, which bounds the references
parsed in it.

Ticket: 8001
 8 months ago
Lukas Sismis 6ec9e5c957 hs: address coverity warning in a reference string 
Move the locking mechanism outside of the getter function and hold the
lock until the reference string is no longer reused.

** CID 1682023:       Concurrent data access violations  (MISSING_LOCK)
/src/util-mpm-hs-cache.c: 139           in HSGetReferenceDbInfo()
 8 months ago
Jason Ish f711e57e8e examples/lib/live: a lib example with live capture 
Simple libpcap example for live capture. Allows listening on multiple
interfaces to show how multiple threads (workers) can be used.

Ticket: #8096
 8 months ago
Jason Ish 8c7172e707 lib: remove the built-in library run-mode 
This run-mode does not allow for capture ThreadVars to be created at
the appropriate place in the application life cycle. Instead,
applications should register their own custom run-mode.

Ticket: #8259
 8 months ago
Jason Ish 7dd23392cc examples/lib/cplusplus: simplfy, make more like the simple example 
To prep for the removal of the lib runmode, simplify this C++ example
to match our simple example. We don't yet have the C++ compatible
headers to allow for a C++ app to register its own custom runmode.
 8 months ago
Jason Ish 445de77c71 examples/lib/custom: use own custom run mode 
Debug validation revealed that library ThreadVars were being
created *after* the threads were sealed. And the only way to create
your ThreadVars that fits within the current application life-cycle is
to create them in your own custom run mode.

This is likely a better model for users who are bringing their own
packets and threads anyways, as they are essentially providing their
own capture method, and all capture methods provide their own run
mode. They're also using their own threads, which means adapting to
their own threading model.

This is suitable for a backport to 8.0. But for 9.0 we can go further
and remove the built-in library run mode, which will be done in a
follow-up commit.

Ticket: #8259
 8 months ago
Jason Ish 02e4399059 github-ci: add debug validation to almalinux 10 build 
After the distcheck, this build doesn't need unittests, so add
debug-validation, as this can trigger assertions in our lib examples
that are tested in this job

This triggers a debug-validation error in the custom library example.

Ticket: #8259
 8 months ago
Victor Julien 56514f3be8 openbsd: pledge before allowing threads to continue 
Avoids a race condition with pcap file directory mode.

Ticket: #8300.
 8 months ago
Philippe Antoine 1e0f344ab7 doc: be more precise for decompress transforms 
Ticket: 7846
 8 months ago
Victor Julien 9cecd29fd4 detect/parse: convert test to fail/pass 8 months ago
Victor Julien 3068089762 github-ci: disable libmagic on macos 
5.47 is currently breaking CI, so disable during investigation.

Related to ticket #8342.
 8 months ago
Philippe Antoine 7e97dfd521 detect: replace stack alloc by member of DetectEngineThreadCtx 
To avoid running a big (when many signatures) stack allocation
on each detection loop with postmatches

Ticket: 8001
 8 months ago
Philippe Antoine b7a3a6b167 detect/pcre: add debug validations 
Before stack allocation

Ticket: 8001
 8 months ago
Philippe Antoine 4849d34325 detect/parse: debug validation before stack allocation 
A rule size has a global bound

Ticket: 8001
 8 months ago
Philippe Antoine db64462b1d detect/metadata: add debug validation 
Before stack allocation

Ticket: 8001
 8 months ago
Jason Ish 03f767a094 github-ci: re-enable rpm jobs 8 months ago
Victor Julien a4aa056884 detect/parse: convert test to fail/pass 8 months ago
Victor Julien 33ddbc3244 github-ci: use --skip-branches in coverage consistently 
Completes 02f6340972.
 8 months ago
Shivani Bhardwaj d241237c0f Revert "dcerpc: fix consumed bytes post gap handling" 
This reverts commit fc9da1c7a1.

That commit incorrectly used consumed as index of the slice passed to
the Frame API.
Found by oss-fuzz.
 8 months ago
Jeff Lucovsky 5a3a2d5fd1 doc/output: Document the IPv6 display behavior 
Issue: 7399

Document the IPv6 display behavior and how to display IPv6 addresses in
their compressed form (per RFC-5952).
 8 months ago
Jeff Lucovsky 809fb56612 output/log: IPv6 addr display per cfg 
When configured, display the compressed form of the IPv6 address.

Issue: 7399
 8 months ago
Jeff Lucovsky 4af77975e3 output/log: ipv6-compress member to file context 
Issue: 7399

Add compress ipv6 setting to file context.
 8 months ago
Jeff Lucovsky 20b8829867 output/eve: EVE output to use IPv6 compress cfg 
Issue: 7399

Determine the EVE IPv6 address display and use that when generating
external display representation.
 8 months ago
Jeff Lucovsky ed882ede68 output/ipv6: Utility function to compress IPv6 addrs 
Issue: 7399

Utility function to compress IPv6 addresses per RFC-5952
 8 months ago
Shivani Bhardwaj 0e345c93ca app-layer: check ipproto enabled setting first 
If the key `app-layer.protocols.PROTO.enabled` is present, the protocol
is enabled for all carrier protocols. This is not ideal.
Only if the key `app-layer.protocols.PROTO.enabled` is missing, an
attempt is made to look for a setting specific to the ipproto passed
at the time of registration e.g.
`app-layer.protocols.PROTO.udp.enabled`.

By default, check for carrier proto specific setting. If it is not
found, then fall back to the generic setting.
Issue a warning in case an inconsistent combination of global and
ipproto specific setting is found.

Bug 8205
 8 months ago
dependabot[bot] 8df4e10018 github-actions: bump actions/download-artifact from 7.0.0 to 8.0.0 
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 7.0.0 to 8.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](37930b1c2a...70fc10c6e5)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 8 months ago
dependabot[bot] 202d1e26c3 github-actions: bump github/codeql-action from 4.32.3 to 4.32.4 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.32.3 to 4.32.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Commits](https://github.com/github/codeql-action/compare/v4.32.3...v4.32.4)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.32.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 8 months ago
dependabot[bot] cfde322f06 github-actions: bump actions/upload-artifact from 6.0.0 to 7.0.0 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6.0.0 to 7.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 8 months ago
Giuseppe Longo de46f4ba9d ldap: set invalid_data event 
Currently in parse_request function LdapEvent::InvalidData is not set when a
request is not parsed correctly.

Ticket #8258
 8 months ago
Victor Julien 2480f8c038 doc: fix dcerpc.opnum documentation 
Docs were claiming greater than, less than, etc. support even though this was never supported.

Fixes: 51be8f0238 ("doc/dcerpc: add proto keywords")

Ticket: #8330.
 8 months ago
Victor Julien b55be5a44f detect/transforms: update gunzip / zlib_deflate syntax 
Use standard space separated syntax.
 8 months ago
Victor Julien fe3cce895c doc/userguide: add igmp keyword docs 8 months ago
Victor Julien 7e6fd09e90 doc/userguide: add missing ipopts values 8 months ago
Victor Julien 086c27a07f decoder/igmp: add decoder events 8 months ago
Victor Julien 94c16d8915 eve/igmp: add schema support for alert records 8 months ago
Victor Julien 791e7c1924 detect/tcp.flags: minor code cleanup 8 months ago
Victor Julien e916fc3ba4 detect: add igmp.type keyword 8 months ago
Victor Julien 6a1389acff detect: add igmp.hdr keyword 8 months ago
Victor Julien d652b7ef62 decoder/igmp: detect RGMP (RFC 3488) 
RGMP is a dialect of IGMP that uses the same protocol structure,
but with some different values for the fields.

Detect this and log it differently.
 8 months ago
Victor Julien 18f699cb97 detect/ipopts: add qs and rtralt options 
Reordering of table and switch to match switch in parser.
 8 months ago