56e10fd3b2
misc: Remove duplicate function declarations
...
Ticket: #7297
4 months ago
98cd2411b6
detect/analyzer: add more details for the tcp window keyword
...
Ticket: 6352
4 months ago
5d8252117f
mqtt: double-check detection directions
...
Ticket: #7323
4 months ago
377d4705e1
mqtt: add reason code support for SUBACK
...
Ticket: #7323
4 months ago
b1e7917d4f
eve: threadinit/deinit callbacks are optional for filetypes
...
Only call ThreadInit and ThreadDeinit for custom eve filetypes if they
exist. They are not required by all filetypes.
Ticket: #7359
4 months ago
292c218a48
app-layer: remove ALPROTO_TEST and tests
...
These tests purpose seems to have been lost.
Registering a alproto with a parser function that always fails,
and just testing that AppLayerParserParse returned -1...
We would get the same result without registering a parser function,
or using ALPROTO_FAILED as argument to AppLayerParserParse
The comment says "Test the deallocation of app layer parser memory
on occurrence of error in the parsing process."
but I do not see how this is tested.
4 months ago
3a7eef8121
lua: update to newer lua crate
...
This crate lets us instruct it where to copy the header files instead
of our Makefile trying to find the correct ones and copying them into
place.
Can prevent the simultaneous copy errors sometimes seen on a make
without a clean.
4 months ago
9ffb2cd7dd
misc: fix build of rules profiling
...
The patch a0fc2b8628
4 months ago
89aa5253d6
Makefile.cvs: remove, not used
4 months ago
a0fc2b8628
misc: Remove duplicate function declarations
...
Ticket: #7297
4 months ago
e44b2effd0
util/var-name: switch to SCTime_t
4 months ago
0e21c71490
threads: track wall clock time precisely
...
Issue warning if thread sleeps for a long time.
4 months ago
5bb2132bb8
time: add SCTIME_CMP_EQ
4 months ago
f0c4f9d64b
util/hash-string: fix compile warning
...
Clang 19:
util-hash-string.c:41:16: error: implicit conversion loses integer precision: 'unsigned long' to 'int' [-Werror,-Wshorten-64-to-32]
41 | int len1 = strlen((char *)data1);
| ~~~~ ^~~~~~~~~~~~~~~~~~~~~
util-hash-string.c:42:16: error: implicit conversion loses integer precision: 'unsigned long' to 'int' [-Werror,-Wshorten-64-to-32]
42 | int len2 = strlen((char *)data2);
| ~~~~ ^~~~~~~~~~~~~~~~~~~~~
2 errors generated.
4 months ago
270e19191b
time: add gettimeofday wrapper for SCTime_t
4 months ago
bdc0df8454
time: remove unused function
...
It tripped up cppcheck:
src/util-time.h:124:35: error: syntax error [syntaxError]
return !timercmp(first, second, >);
4 months ago
3f85addaac
stream: track pcap log segments timestamp with SCTime_t
...
This is a more compact time format.
4 months ago
a739d7623b
eve/tls: don't construct const from other const
...
Some compiler/platform combinations don't like creating one const from
another as it can't guarantee the other is defined, resulting in the
following compile error:
output-json-tls.c:102:5: error: initializer element is not constant
BASIC_FIELDS |
^~~~~~~~~~~~
Fixes commit 377989df6c
4 months ago
175e690222
dpdk/hw_offload: add support for vlan stripping
...
Utilize DPDK API for hardware vlan stripping if supported by NIC.
Ticket: 7330
4 months ago
e22c2a2332
applayer/htp: convert to new FAIL/PASS API
...
Ticket: #6935
4 months ago
d4a3ee163d
misc: remove unneeded headers
...
Remove unneeded headers from worked on in previous commits, just
simple ones flagged by clangd.
4 months ago
ab6dcb3fc1
app-layer: use uint8_t consistent for event IDs
...
Introduce a common function for mapping names to IDs that performs
bounds checking.
Note: For event IDs in the enum that are larger than a uint8_t, -1
will be returned instead of -4. -4 has special meaning during
signature parsin that means requirements were not met. -4 has no
special handling prior to requirements, or the meaning has been lost.
4 months ago
5e563b0c8b
detect/analyzer: add more details for flow_age
...
Ticket: #6312
4 months ago
285cc29ec0
redis: add automatic trimming support for streams
4 months ago
d3d9f1c395
redis: implement XADD stream support
...
Ticket: #7082
4 months ago
1860aa81e6
userguide: fix integer keyword matches list format
...
List wasn't being properly rendered.
4 months ago
45384ef969
rust/applayer: use c_int as return type for get_info_by_id
...
Rust was using i8 as the return type, while C uses int. As of Rust
1.82, the return value is turned to garbage over the FFI boundary.
Ticket: #7338
4 months ago
b44fc62e60
eve/schema: add missing field "code" anomaly events
4 months ago
30806ce2b7
eve/tls: use BIT_U64 for flags
...
Minor cleanup.
4 months ago
2462d9d4cf
eve/tls: remove unused SC_ATOMIC_EXTERN
4 months ago
cc519beb91
suricata.yaml: add missing custom tls fields
...
Also update the suricata.yaml in the userguide.
4 months ago
714ada136c
eve/tls: cleanup headers; update copyright year
4 months ago
377989df6c
eve/tls: reimplement basic and extended logging in terms of custom
...
Will prevent custom logging options getting out of sync with whats
available in extended.
Ticket: #7333
4 months ago
2e788408c0
eve/tls: remove broken check for ja3 being enabled
...
During EVE TLS setup, a broken check for Ja3 being enabled led to Ja3
being disabled, but only in custom mode. This check is not needed, if
Ja3 is disabled, it won't be available, and won't be logged.
This is required to implement "extended" in terms of "custom" fields.
4 months ago
6a185a8f96
eve/tls: add alpn logging to custom output
...
Adds custom fields "client_alpns" and "server_alpns".
Ticket: #7333
4 months ago
3ddd9e2512
eve/tls: disable clang formatting around tls_fields array
4 months ago
799822c3db
profiling: Correct profiling data array size
...
The profiling arrays are incorrectly sized by the number of thread
modules. Since they contain app-layer protocol data, they should be
sized by ALPROTO_MAX.
4 months ago
b5fcf16d97
enip/detect: remove double registration of enip_command keyword
...
As found with
./src/suricata --list-keywords | sort | uniq -c | awk '$1 > 1'
4 months ago
55b922ceed
tls/conf: clarify usage of custom vs extended logs
...
Since enabling custom logging will replace the extended logging, thus
possibly leading to certain fields disappearing from the logs, mention
this aspect.
Related to
Bug #7333
5 months ago
69fe5121a1
tls: fix duplicate EVE field (issuerdn)
...
Wrong function call caused `issuerdn` to be logged when
`subjectaltname` was enabled, for custom logging, only.
Bug #7332
5 months ago
2eefc4dac8
schema/tls: add missing custom fields chain/cert
...
Task #7287
5 months ago
7ae522f16a
github-actions: bump github/codeql-action from 3.26.12 to 3.26.13
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.26.12 to 3.26.13.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Commits](https://github.com/github/codeql-action/compare/v3.26.12...v3.26.13 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
5 months ago
37fa2a6775
detect: rename port whitelisting to priority
...
This was done following the fact that this setting was historically
named incorrectly. The purpose of the setting was always to define the
ports that will be prioritized and have rule groups associated w them on
priority. Rename all occurences of this to correctly reflect the purpose
of the setting.
5 months ago
abbdeed931
detect/engine: rename fn, add comments
5 months ago
f8a5c91448
detect/proto: use BIT macros instead of expr
5 months ago
86c1e458f9
detect/engine: use combined flags for TCP
5 months ago
285113a1e5
github-actions: bump actions/checkout from 4.2.0 to 4.2.1
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 4.2.0 to 4.2.1.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](d632683dd7...eef61447b9
5 months ago
9e0151cce5
github-actions: bump github/codeql-action from 3.26.10 to 3.26.12
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.26.10 to 3.26.12.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Commits](https://github.com/github/codeql-action/compare/v3.26.10...v3.26.12 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
5 months ago
4ad45fc8d0
github-actions: bump actions/upload-artifact from 4.4.0 to 4.4.3
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 4.4.0 to 4.4.3.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](50769540e7...b4b15b8c7c
5 months ago
fa1addae64
detect/analyzer: add more details for icmp_id
...
Ticket: #6360
5 months ago
Nancy Enos
Sascha Steinbiss
Jason Ish
Philippe Antoine
Eric Leblond
Victor Julien
Adam Kiripolsky
Alice Akaki
Juliana Fajardini
Jeff Lucovsky
dependabot[bot]
Shivani Bhardwaj