aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
13,098 Commits
7 Branches
155 Tags
204 MiB
master
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '3051f7f23f'
${ noResults }
Commit Graph

13098 Commits (3051f7f23f245fc2029a7c61df89bb8d12f9a2ae)
 

Author SHA1 Message Date
Philippe Antoine 3051f7f23f protodetect: use both directions over UDP 
As is already done for TCP

Ticket: #2757
 3 years ago
Philippe Antoine edd163252d protodetect: be more tolerant 
Do not mask protocols on both directions with only first packet

For instance :
When the first packet is no valid DNS but on port 53 (a junk request)
second packet (error response from server) does not get checked for DNS
as first packet bit masked away DNS for both directions

Ticket: #2757
 3 years ago
Arne Welzel b6407c4253 stacktrace-on-signal: Use kill(getpid(), sig_num) 
kill(0, ...) re-raises the signal to every processes in the process
group which may impact unrelated processes.

Concretely, in our CI pipeline, a segfaulting Suricata process killed
the test driver.
 3 years ago
Jason Ish b5d1a80002 suricata.yaml: include version that generated this file 
Add a line to the configuration that says which version generated the
configuration file.  For example:

    # This configuration generated by:
    #     Suricata 7.0.0-dev

Issue: #4784
 3 years ago
Victor Julien 91b54f180d stream/segtree: improve docs, error handling 3 years ago
Victor Julien 5c76f787f9 streaming/buffer: add debug validation for 'impossible' condition 3 years ago
Victor Julien 79f0f2fde4 app-layer: make registration structure more compact 3 years ago
Victor Julien a57010d72d htp: minor format string fixes 3 years ago
Victor Julien 24d231315b datasets: constify some function args 3 years ago
Victor Julien 3444aec724 time: reduce scope of static string 3 years ago
Victor Julien 80124152c6 threshold: constify detect engine arg 3 years ago
Victor Julien 18e4e032db thash: reduce scope for var; suggested by cppcheck 3 years ago
Victor Julien 55de18c675 spm: constify badchars; suggested by cppcheck 3 years ago
Victor Julien 99f212bc8c radix: small cppcheck suggested cleanup 3 years ago
Victor Julien 750fed2101 packetpool: minor cleanup 3 years ago
Victor Julien 7b592076ff stream: minor code cleanups suggested by cppcheck 3 years ago
Victor Julien 65f54024d3 defrag: minor code cleanups suggested by cppcheck 3 years ago
Victor Julien 404face284 output/flow: no double var init 3 years ago
Victor Julien f9a5ceb0d8 smtp: minor code cleanup 3 years ago
Victor Julien a5df176956 app-layer: minor code cleanups suggested by cppcheck 3 years ago
Victor Julien 4403e7fe8e app-layer/expectation: reduce scope and init vars 3 years ago
Victor Julien 6c3222dee6 ftp: code clarifications 
src/app-layer-ftp.c:945:49: style: Parameter 'ftp_state' can be declared with const [constParameter]
static FTPTransaction *FTPGetOldestTx(FtpState *ftp_state, FTPTransaction *starttx)
                                                ^
 3 years ago
Victor Julien d484d0b45b util/byte: minor cleanup 3 years ago
Victor Julien 1957c46efc threads: remove usused code; wrap in guards 3 years ago
Victor Julien e593dda356 threads: remove unused function 3 years ago
Victor Julien b55c8909c3 unittests: wrap unittest registration in guards 3 years ago
Victor Julien 905050a053 app-layer/profiling: hide profiling code behind guards 3 years ago
Victor Julien 93050c26b3 app-layer/events: remove unused function 3 years ago
Victor Julien 893ba84c0e output/frames: fix eof var overwrite 3 years ago
Victor Julien 1282b179cc stream/reassembly: reduce scope of variable 3 years ago
Victor Julien 3f375fd444 stream/buffer: remove redundant check 3 years ago
Victor Julien 002b335b4a decode/checksums: constify pointer args 3 years ago
Victor Julien 350be6cbac detect/state: address cppcheck warnings 
src/detect-engine-state.c:127:91: style: Suspicious calculation. Please use parentheses to clarify the code. The code ''a&b?c:d'' should be written as either ''(a&b)?c:d'' or ''a&(b?c:d)''. [clarifyCalculation]
    DetectEngineStateDirection *dir_state = &state->dir_state[direction & STREAM_TOSERVER ? 0 : 1];
                                                                                          ^
src/detect-engine-state.c:194:53: style: Suspicious calculation. Please use parentheses to clarify the code. The code ''a&b?c:d'' should be written as either ''(a&b)?c:d'' or ''a&(b?c:d)''. [clarifyCalculation]
    de_state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].filestore_cnt += file_no_match;
                                                    ^
src/detect-engine-state.c:201:57: style: Suspicious calculation. Please use parentheses to clarify the code. The code ''a&b?c:d'' should be written as either ''(a&b)?c:d'' or ''a&(b?c:d)''. [clarifyCalculation]
    if (de_state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].filestore_cnt == sgh->filestore_cnt)
                                                        ^
 3 years ago
Victor Julien 4feb0529a4 detect/file: minor code cleanup 
Reduce scope where possible. Suggested by cppcheck.
 3 years ago
Victor Julien a535cc5a25 runmodes: fix more warnings 3 years ago
Victor Julien f0479987ff memcmp: no-simd no case loop can scan forward 3 years ago
Victor Julien 0fc7ba45aa memcmp: use SCMEMCMP_BYTES everywhere; general cleanups 3 years ago
Victor Julien 87c5d69437 memcmp: work around GCC 12+ 'blend' issues 
Since GCC 12 the memcmp code using `_mm_blendv_epi8` failed to work.
Inspection of the disassembled objects suggests that it simply omits
the instruction on systems that are not AVX512 capable. On AVX512
it does replace it with VPCMPB logic that appears to work.

Luckily our use of blend is actually uncessary. A simple AND is sufficient.

Bug: #5312.
 3 years ago
Victor Julien ca97ed4436 memcmp: remove unreachable code from memcmp simd 
cppcheck:

src/util-memcmp.h:281:18: warning: Identical condition 'len-offset<16', second condition is always false [identicalConditionAfterEarlyExit]
        if (diff < 16) {
                 ^
src/util-memcmp.h:280:24: note: 'diff' is assigned value 'len-offset' here.
        int diff = len - offset;
                       ^
src/util-memcmp.h:269:33: note: If condition 'len-offset<16' is true, the function will return/exit
        if (likely(len - offset < 16)) {
                                ^
src/util-memcmp.h:281:18: note: Testing identical condition 'len-offset<16'
        if (diff < 16) {
                 ^
src/util-memcmp.h:344:18: warning: Identical condition 'len-offset<16', second condition is always false [identicalConditionAfterEarlyExit]
        if (diff < 16) {
                 ^
src/util-memcmp.h:343:24: note: 'diff' is assigned value 'len-offset' here.
        int diff = len - offset;
                       ^
src/util-memcmp.h:318:33: note: If condition 'len-offset<16' is true, the function will return/exit
        if (likely(len - offset < 16)) {
                                ^
src/util-memcmp.h:344:18: note: Testing identical condition 'len-offset<16'
        if (diff < 16) {
                 ^
src/util-memcmp.h:171:18: warning: Identical condition 'len-offset<16', second condition is always false [identicalConditionAfterEarlyExit]
        if (diff < 16) {
                 ^
src/util-memcmp.h:170:24: note: 'diff' is assigned value 'len-offset' here.
        int diff = len - offset;
                       ^
src/util-memcmp.h:159:33: note: If condition 'len-offset<16' is true, the function will return/exit
        if (likely(len - offset < 16)) {
                                ^
src/util-memcmp.h:171:18: note: Testing identical condition 'len-offset<16'
        if (diff < 16) {
                 ^
src/util-memcmp.h:233:18: warning: Identical condition 'len-offset<16', second condition is always false [identicalConditionAfterEarlyExit]
        if (diff < 16) {
                 ^
src/util-memcmp.h:232:24: note: 'diff' is assigned value 'len-offset' here.
        int diff = len - offset;
                       ^
src/util-memcmp.h:208:33: note: If condition 'len-offset<16' is true, the function will return/exit
        if (likely(len - offset < 16)) {
                                ^
src/util-memcmp.h:233:18: note: Testing identical condition 'len-offset<16'
        if (diff < 16) {
                 ^
 3 years ago
Victor Julien 9bdf18a3b0 detect/iponly: fix debug compiler warning 3 years ago
Jason Ish dfe76bb905 dcerpc: convert transaction list to vecdeque 
Allows for more efficient removal from front of the list.

Ticket: #5271
 3 years ago
Jason Ish 8790968281 mqtt, rdp: fix copyright dates 3 years ago
Philippe Antoine c78722a671 rust: RustParser same fields as AppLayerParser 
So that there is no problem when crossing FFI
 3 years ago
Sascha Steinbiss af745e4cc4 configure.ac: handle undefined LEVEL1_DCACHE_LINESIZE 
On some platforms (riscv64, s390x) this value is "undefined" as returned
from getconf. We also need to handle this to avoid using the string
"undefined" blindly in further #defines.
 3 years ago
jason taylor d799956348 doc: add note about file.data and file_data 
Signed-off-by: jason taylor <jtfas90@gmail.com>
 3 years ago
jason taylor 83f2056d20 doc: update file_data to file.data keyword 
Signed-off-by: jason taylor <jtfas90@gmail.com>
 3 years ago
jason taylor cd54d0dbc8 doc: remove extra newline in order to match style 
Signed-off-by: jason taylor <jtfas90@gmail.com>
 3 years ago
jason taylor 38bd775ca0 doc: remove extraneous + characters 
Signed-off-by: jason taylor <jtfas90@gmail.com>
 3 years ago
Victor Julien 07bf921451 ftp-data: fix direction for active mode commands 
Set correct direction for PORT mode, where the server connects
to the client.

The direction is not also strictly enforced. No data in the wrong
direction will be accepted to setup the file or to be added to the
file after setup.

This also fixes files getting closed twice.

Adds some general cleanups.

Bug: #3542.
 3 years ago
Sam Muhammed 323fe1c1ac nfs3/records: Fix typo 
Fix response_lookup unittest name
 3 years ago