15312 Commits (3b8ed937d723d553c0ff486b4ba28a2b14beed06)

 

All Branches   

Search

Author	SHA1	Message	Date
Victor Julien	3b8ed937d7	detect: remove DCERPC mask logic ... Added nothing over alproto check already in place.	1 year ago
Victor Julien	44a8bf463e	detect/rule-header: use bool type ... Update frame prototype as well, to match already returned true/false values.	1 year ago
Victor Julien	72841be050	detect/rule-header: minor code cleanups	1 year ago
Victor Julien	5c6089f93f	detect/address: refactor match array building	1 year ago
Victor Julien	7b2d6b6894	detect/address: minor cleanup	1 year ago
Victor Julien	96aee6434f	mpm/ac: pointer hygene	1 year ago
Victor Julien	aad403d87d	mpm/hs: improve pointer hygene	1 year ago
Victor Julien	11bf60aa3a	detect/mpm: minor cleanup	1 year ago
Victor Julien	db2484276e	detect: shrink sgh to have all runtime members on one cache line	1 year ago
Victor Julien	91f153fb1d	detect: constify flow flags in tx rule inspect	1 year ago
Victor Julien	e4550bee0a	detect: minor cleanup for rule group get function	1 year ago
Victor Julien	fd4ca53eb7	app-layer: micro optimization for AppProtoEquals ... Add most common condition first.	1 year ago
Victor Julien	88cc999184	detect/bsize: constify keyword args during size check	1 year ago
Victor Julien	e06d2c402a	detect/content: limits prop comment cleanup	1 year ago
Victor Julien	4f0f7b1969	detect/dsize: minor code cleanup	1 year ago
Victor Julien	2b3ec34de8	detect: use do { } while loop for app engine loop	1 year ago
Victor Julien	2911656d6c	detect/content: fix offset for negative distance ... Fix offset calculation on sigs with negative distance. Can lead to FN in certain cases. Bug: #6661.	1 year ago
Victor Julien	18eafb622f	detect/content-inspect: add more tests	1 year ago
Victor Julien	0172c01dc2	spm/bm: minor code cleanups; constification	1 year ago
Victor Julien	4a6a3dc296	mpm: UNITTESTS guard for RegisterUnittests func	1 year ago
Victor Julien	ea5cf44fc2	mpm: remove unused flags field	1 year ago
Victor Julien	4558c5c515	detect/http_server_body: modernize test	1 year ago
Victor Julien	bd66504a43	detect: implement --qa-skip-prefilter ... Option meant for testing performance of rule engine w/o prefilter optimizations.	1 year ago
Victor Julien	222dcf776e	detect/content-inspect: add negation tests ... Test mixing of negation, endswith and depth.	1 year ago
Victor Julien	fd75aca1a1	detect/bytetest: remove unused Match function ... All matching is done as part of content inspection.	1 year ago
Victor Julien	f2e9c258c4	detect/pcre: remove unused match member ... pcre2_match_data is created per thread when needed.	1 year ago
Victor Julien	3e8db97687	detect/bytemath: fix u32 buffer size logic ... Remove u16 cast. Remove debug assert for u16 size. In 83ed2c3b97 the input was changed to u32	1 year ago
Victor Julien	eca6639a82	detect/pcre: localize match limit option parsing ... No need to put it into a per ctx flag.	1 year ago
Victor Julien	18dfa69364	detect/pcre: remove unused opts field	1 year ago
Victor Julien	9dc35fbd00	detect/pcre: put commonly used members on first cache line	1 year ago
Victor Julien	e3f2b3418a	detect/content-inspect: use of replace keyword is rare ... Hint compiler about this.	1 year ago
Victor Julien	bcb2b50cfc	detect/profiling: improve pcap reading performance ... When reading a pcap, packet time can move much faster than wall clock time. This would trigger many more profile syncs than before. As the sync is using a lock to synchronize with other threads, this is an expensive operation. Bug: #6619. Fixes: b591813b86 ("profiling/rules: reduce sync logic scope")	1 year ago
Juliana Fajardini	8d3de85edd	pgsql: fix u16 overflow in query data_row ... Found by oss-fuzz with quadfuzz. Cf https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63113 According to PostgreSQL documentation the maximum number of rows can be the maximum of tuples that can fit onto max u32 pages - 4,294,967,295 (cf https://www.postgresql.org/docs/current/limits.html). Some rough calculations for that indicate that this could go over max u32, so updating the data_row data type to u64. Bug #6389	1 year ago
Philippe Antoine	4933b817aa	doc: fix byte_test examples ... As this keyword has 4 mandatory arguments, and some examples had only three... Ticket: 6629	1 year ago
Juliana Fajardini	a37fa62710	devguide: explain example-rule container usage ... Have these options documented, so that whoever writes rule-related documentation can easily know what they could use to make the doc look better.	1 year ago
Philippe Antoine	d3218385e9	detect: case-insensitive comparison for requires ... Ticket: 6656	1 year ago
Philippe Antoine	673d13d445	rust: allow clippy::items_after_test_module ... As clippy began to complain about jsonbuilder.rs	1 year ago
Juliana Fajardini	fc2acf8cb0	devguide: fix main channels list ... Sphinx and RtD sometimes render lists in weird ways. The communication channels list barely looked like one, at all...	1 year ago
Juliana Fajardini	d15877b2c0	devguide: update branches, refer to backports guide ... Update the list of active branches to include 7 renaming and new master, link to backports document.	1 year ago
Juliana Fajardini	9fbdfd219c	devguide: add chapter with backports guide ... Task #6568	1 year ago
Juliana Fajardini	de8bffd244	devguide: doc from behavior changes needs ticket # ... If a commit introduces code that changes Suricata behavior, the related documentation changes should go in a separate commit, but refer to the same ticket number. This reduces the chances of said changes being lost if there are backports while still keeping the backporting process a bit less bulky, for each commit. Related to Task #6568	1 year ago
Juliana Fajardini	71e4ca81ef	devguide: reorganize pr-workflow section ... This section seemed to aim both at PR reviewers and PR authors at the same time, even though some info is probably of low value for contributors. Created new section for PR reviewers and maintainers, and kept the info for PR authors separated. Also highlighted information on requested changes and stale PRs.	1 year ago
Juliana Fajardini	08eb67f74c	devguide: make 'contributing' a chapter ... This could be justified from a semantic point of view, and also can help in bringing more attention to where this information is, as it is less hidden, now. Also add Dev Guide as one of our resources in our Readme.	1 year ago
Jeff Lucovsky	f12e026696	mqtt: Move conf code to rust ... Issue: 6387 This commit moves the configuration logic to Rust.	1 year ago
Jason Ish	b453eea150	stats: add rules skipped ... Rule skipped is a count of the number of rules that are skipped due to missing requirements. Feature: #6637	1 year ago
Jason Ish	5cc872fa1a	rust.h: don't include util-file.h, not needed	1 year ago
Jason Ish	71bbba9248	detect-parse: parse sid in pre-scan ... During the pre-scan for "requires", also parse the SID if possible. If the rule fails high level parsing (syntax), the SID will not be parsed. But every keyword other than "sid" and "requires" should expect to be provided with a parsed sid.	1 year ago
Jason Ish	435c03172e	requires: pre-scan rule for requires expressions ... Add a "pre-scan" rule parse that will check for requires statement. It will return a special error code (-4) if the requires fails due to missing requirements. Syntactic errors will also abort parsing here. Feature: #5972	1 year ago
Jason Ish	5d5b0509a5	requires: add requires keyword ... Add a new rule keyword "requires" that allows a rule to require specific Suricata versions and/or Suricata features to be enabled. Example: requires: feature geoip, version >= 7.0.0, version < 8; requires: version >= 7.0.3 < 8 requires: version >= 7.0.3 < 8 | >= 8.0.3 Feature: #5972 Co-authored-by: Philippe Antoine <pantoine@oisf.net>	1 year ago
Jason Ish	15ed51f9b8	feature: provide a Rust binding to the feature API ... As the feature module is not available for Rust unit tests, a mock version is also provided.	1 year ago