11340 Commits (67634c561c7d2ad6a8202a3925768d7f392c0140)

Author	SHA1	Message	Date
Victor Julien	67634c561c	time: don't log debug messages from debug logging ... Bug: #5835. Fixes: 31793aface ("time: Replace struct timeval with scalar value")	4 years ago
Victor Julien	977c5ea719	detect: initialize empty buffers	4 years ago
Victor Julien	abf1ac8e01	stream/regions: improve region shrinking ... Handle failure on shrink. Keep size multiple of configured buf_size setting.	4 years ago
Victor Julien	d6b4c90225	streaming/sbb: propegate allocation errors	4 years ago
Victor Julien	cdab91df8a	streaming: remove unused function	4 years ago
Victor Julien	93c9594dd8	stream/tcp: allow tcp session reuse on null sessions ... When a "stream starter" packet finds an existing TCP flow, the flow will be evaluated for reuse. The following scenario wasn't handled well: 1. Suricata starts after a tool has just stopped using lots of connections (e.g. ab stress testing a webserver) 2. even though the client is closed already, the server is still doing connection cleanup sending many FINs and later RSTs 3. Suricata creates flows for these packets, but no TCP sessions 4. client resumes testing, creating flows that have the same 5 tuple as the flows created for the FIN/RST packets 5. Suricata refuses to "reuse" the flows as the condition "tcp flow w/o session" is not considered valid for session reuse 6. new TCP connection is not properly tracked and evaluated in parsing and detection There may be other vectors into this, like a flow w/o session because of memcap issues. Bug: #5843.	4 years ago
Victor Julien	e8ce5f3430	streaming/regions: fix consolidation cornercases ... Incorrect "end" region for consolidation was selected if the "dst" would be expanded to overlap with it. Fix list handling when the first region to consider (src_start) was not the list start. Bug: #5833. Bug: #5834.	4 years ago
Victor Julien	d5409a0b29	streaming: grow more conservatively ... Don't grow to next multiple of cfg->buf_size if size is already a multiple of buf_size.	4 years ago
Victor Julien	63ceb0567d	streaming: minor debug logging improvement	4 years ago
Victor Julien	5e5da81cca	exception/policy: add more info on defaults ... Be more informative where a exception value came from: defaults, master switch or an explicit setting.	4 years ago
Victor Julien	a5547564b6	stream/midstream: add bug number to policy warning	4 years ago
Victor Julien	3fcc19e78c	exception/policy: 'auto' sets IPS to 'drop-flow' ... In IPS mode set all exception policies to drop-flow by default, both in the default yaml and if no `exception-policy` is defined.	4 years ago
Victor Julien	0863544d83	exception/policy: fix formatting issues	4 years ago
Victor Julien	a6723bca7c	flow: enforce flow assumption ... Enforce assumption that packets in ThreadVars::decode_pq have no flow attached to it because this is only true for packets while they are in the FlowWorker.	4 years ago
Victor Julien	66ed3ae6e4	flow/mgr: remove flows_timeout_inuse counter	4 years ago
Victor Julien	0592e57df5	flow: rearrange Flow struct to be more compact	4 years ago
Victor Julien	7951d8a14f	flow: remove use_cnt ... Packets only ever reference the flow while holding its lock. This means than any code possibly evicting the flow will have to wait for the existing users to complete their work. Therefore the use_cnt serves no function anymore and can be removed.	4 years ago
Victor Julien	a2dc9a40e7	flowworker: don't keep unnecessary flow reference ... Flow stream/detect/log flush packets, don't hold on to the flow beyond the flow worker module.	4 years ago
Victor Julien	3ca37008d7	stream: remove unused pseudo packet function	4 years ago
Jason Ish	6344501dba	tls: fix date logging for dates before 1970 ... The Rust time crate used by the x509-parser crate represents dates before 1970 as negative numbers which do not survive the conversion to SCTime_t and formatting with the current time formatting functions. Instead of fixing our formatting functions to handle such dates, create a Rust function for logging TLS dates directly to JSON using the time crate that handles such dates properly. Also add a FFI function for formatting to a provided C buffer for the legacy tls-log. Issue: 5817	4 years ago
Victor Julien	9e41075d5d	detect/frames: improve IPS and GAP handling ... Inspect individual chunks in lossy traffic. Don't use the frame idx as the inspection buffer idx. Engines are running per frame, so multi inspection can be used for stream chunks instead. Ticket: #4977.	4 years ago
Victor Julien	6fcf48d09a	detect/frames: handle duplicate sigs in candidates ... Prefilter engines run on each stream chunk in a lossy stream, so we can get the same sid in the list multiple times.	4 years ago
Victor Julien	8ff2543343	stream: add util to get absolute right edge of data	4 years ago
Victor Julien	a95934b5ee	detect/frames: reduce scope of private function	4 years ago
Victor Julien	652de0cc99	output: move function name in non-release output	4 years ago
Victor Julien	f834377c5f	detect/tls.certs: improve buffer init logic	4 years ago
Victor Julien	aa4a128fb0	detect/quic: update buffer initialization logic	4 years ago
Victor Julien	6f1574276f	detect/mqtt: update buffer initialization logic	4 years ago
Victor Julien	83e97a9283	detect/krb5.sname: update buffer initialization logic	4 years ago
Victor Julien	d3675d5197	detect/krb5.cname: update buffer initialization logic	4 years ago
Victor Julien	849f1cf1b8	detect/ike.vendor: update buffer initialization logic	4 years ago
Victor Julien	158e648d87	detect/http2: update buffer initialization logic	4 years ago
Victor Julien	5e783a01fe	detect/file.name: update buffer initialization logic	4 years ago
Victor Julien	576bfc6bf0	detect/file.magic: update buffer initialization logic	4 years ago
Victor Julien	50fd691efb	detect/file.data: update buffer initialization logic	4 years ago
Victor Julien	9c34e82471	detect/http.uri: update buffer initialization logic	4 years ago
Victor Julien	f6fd1b017f	detect/dce.stub_data: update buffer initialization logic	4 years ago
Victor Julien	e31ead9bc2	detect/dns: update buffer initialization logic	4 years ago
Victor Julien	70125a29f6	detect/buffer: add initialized flag to simplify buffer logic	4 years ago
Jeff Lucovsky	c1c67536b6	decode/stat: Add decode counters for unknown/arp ... Issue: 5761 This commit adds statistics for ARP and unknown ethertype packets for diagnostic purposes.	4 years ago
Philippe Antoine	e3105a6614	ftp: adds a config option ftp-hash for autofp-scheduler ... This allows ftp-data and ftp flows to be processed by the same thread. Otherwise, there may be a concurrency issue where the would-be ftp-data flow is first processed, and thus not recognized as such. And the ftp flow gets processed later and the expectation coming from it is never found. To do so, the flow hash gets used as usual, except for flows that may be either ftp or ftp-data, that is either one port is 21, or both ports are high ones. Ticket: #5205	4 years ago
Philippe Antoine	c1f615b8d2	src: fix coverity warning about sizeof ... CID: 1520601 CID: 1520602 > In this particular case sizeof (char **) happens to be equal to sizeof (char *), but this is not a portable assumption.	4 years ago
Jason Ish	84d1ed58bb	config: check return value of dotted override ... Fixes commit fbb0d2b0f4.	4 years ago
Jason Ish	3f4dad8676	ftp: add events for command too long ... Issue: 5235	4 years ago
Jason Ish	dcfa6a6002	suricata: allow additional include files on command line ... Add a new command line option, --include. This will merge additional configuration files into the configuration specified in the main suricata.yaml. It can be provided multiple times and the files will be included in the order they appear on the command line. Ticket: 3912	4 years ago
Jason Ish	cb1ae92a1b	yaml-loader: add test for fully qualified override ... Also set the parent node for regular nodes on creation as this is useful in unit-tests to verify the parent of a node.	4 years ago
Jason Ish	fbb0d2b0f4	config: allow fully qualified overrides ... Allow configuration parameters to be overrided usually a fully qualified name such as: vars.address-groups.HOME_NET: "7.1.2.0/24" In configuration files (including "include" files). This allows the overriding of a specific value deeply nested in the configuration without having to redefine the complete top-layer object. Ticket: 4783	4 years ago
Philippe Antoine	9cb0bc3332	util/landlock: check return values for ConfGet ... CID 1514671 CID 1514669	4 years ago
Shivani Bhardwaj	f941ceae2b	decode/udp: fix payload_len calculation ... Fix payload_len calculation post removal of the condition that returned error code if the length to the decode fn did not match the length of header from the UDP packet. Bug 5379	4 years ago
Shivani Bhardwaj	eebdfe9a3e	decode/events: add event type UDP_LEN_INVALID	4 years ago