aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
18,198 Commits
8 Branches
173 Tags
194 MiB
main
main-8.0.x
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '2a7eb5d062'
${ noResults }
Commit Graph

18198 Commits (2a7eb5d062e9735096a7b9ad765725061a747fcb)
 

Author SHA1 Message Date
Victor Julien 2a7eb5d062 detect/threshold: set missing alert flag in rate_filter 
ACTION_ALERT is supposed to be set now, but wasn't for rate_filter.
This becomes important in a follow up patch where only PacketAlert
entries with `action` `ACTION_ALERT` are logged in alert logging.
 9 months ago
Victor Julien bccdb445ff eve/verdict: clean up packet action checking 
Get action from packet just once.
 9 months ago
Philippe Antoine b8411fcc8d output/http: log content-type like other headers 
Ticket: 8056

Avoid stack allocation.
Do not handle null and ; especially
 9 months ago
Philippe Antoine acc051ac94 unix-socket: return after closing on too long 
Avoids later use after free

Ticket: 8063
 9 months ago
Philippe Antoine a84addb771 util/swf: move allocation from stack to heap 
As it can overflow the stack

Ticket: 8055
 9 months ago
Philippe Antoine f2b6540c52 htp: bound decompression 
Ticket: 7980

Usage of Vec<u8> instead of Box<u8> gave the ability to callers
to grow the buffer (indefinitely)
This was regressed in 16fee33368

Additionnaly, use rust WriteZero instead of WouldBlock as a more
fitting error when cursor is full, as that error kind is the
one tested by callers.
 9 months ago
Philippe Antoine c61f1cb6d0 detect/integers: rename index all1 to all 
And all to all_or_absent

Ticket: 7929
 9 months ago
Philippe Antoine eb5a2d646b detect/vlan: move vlan.id keyword to generic integer 
Ticket: 7929
 9 months ago
Li Heng c141c55bc6 snmp: can be set to detection-only 
Realloc alp_ctx.ctxs when a dynamic alproto is registered and
g_alproto_max increases. So dynamic alproto can be treated as
real/normal ones. And app-layer switch can be set to any value
of no/deteciton-only/yes.

Ticket: 8000
 9 months ago
Philippe Antoine 439f96dea7 rust: bindgen frames functions 
Ticket: 7667
 9 months ago
Philippe Antoine 92c7be1cb6 rust: bindgen SCSRepCatGetByShortname 
Ticket: 7667
 9 months ago
Ezra Adeyinka 368ef839de detect/address: switch tests to FAIL/PASS API 
Ticket: #4023
 9 months ago
Shivani Bhardwaj bb1ed16408 src: check retval of VarNameStoreRegister 
VarNameStoreRegister can return 0 in case of any error conditions.
Handle this case in all the users of this function. It is an unlikely
event so add branch assistance accordingly.

Bug 8054
 9 months ago
Shivani Bhardwaj 6b3c21a4e6 detect/xbits: use correct Free fn 
Most call sites use a casula SCFree fn to get rid of the DetectXbitsData
in case of an error. However, if a varname is also registered, that must
be unregistered too. Fix all the free calls by replacing them with the
appropriate DetectXbitFree fn.
 9 months ago
Shivani Bhardwaj 13c8724ae0 detect/xbits: remove unneeded cast to check ptr validity 9 months ago
Shivani Bhardwaj dad883406d detect/xbits: use calloc to avoid undefined behavior 9 months ago
Shivani Bhardwaj a23add0194 detect/lua: remove extra NULL check 
The fn DetectLuaFree checks if the pointer (DetectLuaData) passed to it
is valid. So, the checks for NULL in the call sites can safely be
removed.
 9 months ago
Shivani Bhardwaj 71339c459e detect/flowvar: remove extra NULL check 
The fn DetectFlowvarDataFree checks if the pointer (DetectFlowvarData)
passed to it is valid. So, the checks for NULL in the call sites can
safely be removed.
 9 months ago
Shivani Bhardwaj 7c9fad27fc detect/flowint: clean up free fn 9 months ago
Shivani Bhardwaj bc8bf865ae detect/flowint: remove extra NULL check 
The fn DetectFlowintFree checks if the pointer (DetectFlowintData)
passed to it is valid. So, the checks for NULL in the call sites can
safely be removed.
 9 months ago
Shivani Bhardwaj 59944c7787 detect/flowint: use calloc to avoid undefined behavior 9 months ago
Shivani Bhardwaj e5994deb23 util/varname: check id before unregister 
In case of an error a varname id is set to 0. Ideally, it shouldn't be
found in the hash table lookup but add a check anyway to avoid obtaining
the mutex lock and performing the lookup.
 9 months ago
Victor Julien ec65fd430e exception-policy: rename 'reject-both' to 'rejectboth' 
To align it with the rule action.
 9 months ago
Andreas Dolp fcbae97a1f python/Makefile.am: fix file permissions of python/suricata/config/defaults.py 
The install command, by default, sets 0755 if -m is not specified, so the
file python/suricata/config/defaults.py will be marked as an executable,
though it isn't.
 9 months ago
dependabot[bot] 5f138891b2 github-actions: bump github/codeql-action from 3.30.5 to 4.31.2 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.30.5 to 4.31.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Commits](https://github.com/github/codeql-action/compare/v3.30.5...v4.31.2)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.31.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 9 months ago
dependabot[bot] 2609860884 github-actions: bump actions/download-artifact from 5.0.0 to 6.0.0 
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 5.0.0 to 6.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](634f93cb29...018cc2cf5b)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 9 months ago
dependabot[bot] a6505395c6
github-actions: bump actions/upload-artifact from 4 to 5 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 5.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 9 months ago
Jason Ish cdd4ea0f11 doc/devguide: document eve callback 
Document the callback for adding additional data to EVE.

Ticket: #4708
 9 months ago
Jason Ish 9fffc09ad7 doc/devguide: document eve file types 
Ticket: #4708
 9 months ago
Philippe Antoine 7447651fa0 output/jsonbuilder: helper function SCJbSetPrintAsciiString 
To replace C PrintStringsToBuffer and avoid a stack alloc
+ copy

Ticket: 8004
 9 months ago
Jason Ish 7e705269e0 requirements.txt: use suricata-update master 
Master makes sense for Suricata main branch as we are on a ways out on a
release.
 9 months ago
Victor Julien 52fd61dffd lua: remove luajit pushlstring workaround 
81ee6f5aad ("lua: push correct length back through ScFlowvarGet, work around valgrind warning")
added a workaround for valgrind warnings in pushing a string buffer
into the lua state. This is no longer needed as tested with both
address sanitizer and valgrind.
 9 months ago
Li Heng 1106323ae1 rust/sip: delete redundant computing codes 
Delete call of is_alphanumeric where is_alphanumeric and
is_token_char are called together. Four places are modified.

Ticket: 8003
 9 months ago
Victor Julien 0c4a8fd183 doc/userguide: document reject-both expection policy 
Ticket: #5974.
 9 months ago
Victor Julien acb769291a exception-policy: add 'reject-both' option 
Allow rejecting both sides of a connection. Has the same support
as regular reject (which is essentially rejectsrc).

Ticket: #5974.
 9 months ago
Juliana Fajardini 6b75b937ff output/eve: fix typos 
To accompany documentation work done in

Task #4708
 9 months ago
Jhonny Sousa 051bc324d6 detect/base64_data: Convert unittests to FAIL/PASS API 
Ticket: #6320
 9 months ago
Jason Ish 1efe70a234 rust/ike: convert to nom 8 
Ticket: #8050
 9 months ago
Jason Ish f368324e87 rust/mime: convert to nom 8 
Ticket: #8048
 9 months ago
Jason Ish c5ef615953 rust/mqtt: convert to nom 8 
Ticket: #8047
 9 months ago
Jason Ish 2289069f74 rust/websocket: convert to nom 8 
Ticket: #8046
 9 months ago
Jason Ish 9eeefd0684 rust/bt-dht: convert to nom 8 
Ticket: #8045
 9 months ago
Jason Ish 399f96b07d rust/rdp: convert to nom 8 
Ticket: #8044
 9 months ago
Jason Ish 7c70f74942 rust/telnet: convert to nom 8 
Ticket: #8043
 9 months ago
Jason Ish 2ff2eb1325 rust/ssh: convert to nom 8 
Ticket: #8042
 9 months ago
Jason Ish baa22287b8 rust/rfb: convert to nom 8 
Ticket: #8041
 9 months ago
Jason Ish dcfe247467 rust/pgsql: convert to nom 8 
Ticket: #8039
 9 months ago
Jason Ish d25286e77a rust/enip: convert to nom 8 
Ticket: #8038
 9 months ago
Jason Ish d74f8522ee rust/tftp: convert to nom 8 
Ticket: #8037
 9 months ago
Jason Ish 4b09622ebc rust/dhcp: convert to nom 8 
Ticket: #8036
 9 months ago