suricata

Commit Graph

Author	SHA1	Message	Date
Victor Julien	9adeae07b1	decode: reformat REINIT macro	6 years ago
Victor Julien	3f4398cc90	decode: minor unittest cleanups	6 years ago
Victor Julien	bf00285d0a	proto/names: add SCTP if not defined in system If SCTP is missing from /etc/protocols, add it manually.	6 years ago
Victor Julien	c25afbccc1	json: remove unused jansson wrappers	6 years ago
Victor Julien	b6b317cae6	http: enable and fix content range tests	6 years ago
Victor Julien	a7cd765f20	app-layer/nfs: dead code removal	6 years ago
Juliana Fajardini	97350d9a2c	detect/rpc: clean up unittests - detect-rpc: convert unit tests to new FAIL/PASS API. - detect-rpc: replace SigInit with DetectEngineAppendSig for more concise code.	6 years ago
Jason Ish	512b0350a0	lua: fix coverity issue with out of scope variable Fix usage of out-of-scope variables. Introduced with the hashing and adding the guard of g_disable_hashing. To fix, just remove the guard so all variables are in scope. Hashes are not initialized here so there is no need for the guard.	6 years ago
Jeff Lucovsky	1c68f4aed6	lua/test: Test cases using SC prefix This commit adds paired test cases to ensure that the SC variant of the entry points are tested.	6 years ago
Jeff Lucovsky	c845974639	general: Correct typo	6 years ago
Jeff Lucovsky	431018d6f7	lua: Use SC prefix for Lua functions This commit adds additional Lua API interfaces to bring consistency to functions such that the `SC` prefix is available consistently across flow int and flow var functions.	6 years ago
Victor Julien	3a8ba663a9	email/md5: optimize md5 handling	6 years ago
Jason Ish	6299222c4e	email/eve: use Rust function to hash buffer to hex Use SCMd5HashBufferToHex to hash the subject to a hex string. Removes snprintf loop.	6 years ago
Jason Ish	0a3b9e0220	rust/hashing: add function to finalize md5 to hex string New function, SCMd5FinalizeToHex to finalize an md5 hash to a hex string.	6 years ago
Jason Ish	3a82153866	ja3: use SCMd5HashBufferToHex to print hash as hex Replace snprintf loop with new function that hashes a single buffer to an MD5 hex string.	6 years ago
Jason Ish	e00d21a5cb	filestore: respect g_disable_hashing If g_disable_hashing is set, behave like libnss wasn't compiled in.	6 years ago
Jason Ish	7525295e63	hashing: remove remaining HAVE_NSS guards For features, we pretend to HAVE_NSS so scripts, external tests continue to work.	6 years ago
Jason Ish	9b314bebe0	output-json-email: use Rust md5 bindings instead of libnss	6 years ago
Jason Ish	815396263b	util/mime: use Rust md5 bindings instead of libnss As the new Md5 hashing consumes its context on finalize, an bool has_md5 flag has been added to let the logger know there is an md5 hash available.	6 years ago
Jason Ish	9e14c00298	transform-sha256: use Rust sha256 bindings Use new Rust sha256 bindings insead of libnss.	6 years ago
Jason Ish	d98e34045b	transform-sha1: use Rust sha1 bindings Removes dependence on NSS.	6 years ago
Jason Ish	3d1a294bc7	util-crypt: remove ComputeSHA1 There is now a Rust replacement for ComputeSHA1 that is exposed to C as SCSha1HashBuffer.	6 years ago
Jason Ish	90dcaff41d	ssl: replace ComputeSHA1 with Rust SCSha1HashBuffer Removes the final use of internal ComputeSHA1 function.	6 years ago
Jason Ish	e0a2d10e7e	transform/md5: use Rust md5 bindings	6 years ago
Jason Ish	c2dd2c25b6	error: new disabled hashing error code Add new error code to be used when something fails due to hashing being disabled.	6 years ago
Jason Ish	f723dc1309	suricata: add --disable-hashing option The idea with a flag to disable hashing is to provide a way to get the effect of building Suricata without libnss, which is sometimes done for performance reasons.	6 years ago
Jason Ish	245a1bd4ce	suricata.c: clang-format required after new option added	6 years ago
Jason Ish	7bb917b835	suricata.c: disable clang-format on long_opts init clang-format will reformat this to have multiple options on a single line which is hard to read and I don't see a specific clang-format option to format this better. So for now, disable clang-format on this section of code.	6 years ago
Jason Ish	0321f60ebf	community-id: use Rust SHA1 to compute hash Removes use of our internal ComputeSHA1 for calculating the community ID.	6 years ago
Jason Ish	d5bf748c90	ja3: remove requirement on NSS	6 years ago
Jason Ish	e50ee7eb62	filestore: remove requirement of nss for filestore Required including NSS header in places that depended on util-file.h including it. All filestore suricata-verify tests now pass without libnss. Also enabled detect-file{md5,sha1,sha256} without NSS support.	6 years ago
Jason Ish	e4acbcbb5e	filestore: use Rust bindings for sha256/sha1/md5	6 years ago
Jason Ish	f77fd0c0cb	rust: include file cleanup The cbindgen generated header should not include rust.h as rust.h already includes the generated binding. Fixup C source code that only pulled the generated include, it should instead pull in "rust.h" which includes the generated binding plus other misc. stuff.	6 years ago
Philippe Antoine	47dd9a5ebc	signature: Fix leak in urilen parsing cf #4254	6 years ago
Victor Julien	423a5e2f6c	detect/file.data: support ftp and ftp-data	6 years ago
Victor Julien	45eddde573	detect/file.name: register inspect engine for ftp-data	6 years ago
Jeff Lucovsky	f8fef0dd05	decode/tcp: Improved handling of TFO options This commit improves handling of TCP fast open options - Option length must be in [6, 18] - Option length must be an even value	6 years ago
Gianni Tedesco	10ea60a237	detect: Validate that NOOPT options don't have optvals Without this, a simple typo between : and ; is able to hide actual bugs in rules. I discovered 2 bugs in ET open ruleset this way.	6 years ago
Gianni Tedesco	cebe15c23b	detect-fast-pattern: Mark as OPTIONAL_OPT, instead of NOOPT Also update the erroneous comment about it.	6 years ago
Eric Leblond	8d034b4163	eve/dhcp: avoid to call common logging twice	6 years ago
Joshua Lumb	9d432bbab3	threads: More descriptive startup output	6 years ago
Carl Smith	9b840104bd	lua: Make the rule action available to output scripts Useful for those that want to do custom logging from lua	6 years ago
Justin Ossevoort	320de5f43d	eve: Log tenant_id for all eve-json messages	6 years ago
Carl Smith	660b68a083	nsh: Parsing of Network Services Header and payload Support for EtherType 0x894F and basic header	6 years ago
Victor Julien	db2dbaaf40	stream/midstream: handle packet loss after SYN/ACK	6 years ago
Victor Julien	895938080f	stream/tcp: fix invalid ack events in timewait state	6 years ago
Victor Julien	49bd1f85b9	flow/timeout: fix TCP seq/ack for reversed flows When a flow is swapped it also swaps the stream trackers, so it does not make sense to reverse them during pseudo packet creation.	6 years ago
Victor Julien	3c7c361b60	detect/stream: fix async stream inspection Move raw progress forward only if detect uses stream data, indicated by the PKT_DETECT_HAS_STREAMDATA flag.	6 years ago
Victor Julien	8aa02c6d15	stream/tcp: fix async mode ACK validation	6 years ago
Philippe Antoine	8d659c6500	fuzz: improves sigpcap target with PacketPoolInit	6 years ago
Shivani Bhardwaj	6c19e7d0d4	counters: convert to FAIL/PASS API	6 years ago
Shivani Bhardwaj	7eef4e83e5	confyaml: convert to FAIL/PASS API	6 years ago
Shivani Bhardwaj	fb311e3d9d	applayer: convert to FAIL/PASS API	6 years ago
Shivani Bhardwaj	bfd956ce67	applayer/htp/xff: convert to FAIL/PASS API	6 years ago
Shivani Bhardwaj	b195ffbe18	applayer/ftp: convert to FAIL/PASS API	6 years ago
Shivani Bhardwaj	2e3d408e6f	fastlog: convert to FAIL/PASS API	6 years ago
Janani Ramjee	2d3cf11906	detect/mark: convert unittests to use PASS/FAIL API	6 years ago
Juliana Fajardini	2765bff0c5	detect/msg: convert to FAIL/PASS API Issue 4053. Adjust code formatting style (wrap long lines). Replace SigInit with DetectEngineAppendSig.	6 years ago
Sumera Priyadarsini	d4264748d8	detect: filesha1: convert unittests to use PASS/FAIL API Currently, unit tests use integer values 1 and 0 to denote pass and fail status of tests respectively. Modify the unit test detect-filesha1 to use the PASS/FAIL API instead.	6 years ago
Juliana Fajardini	d2144c0dfb	detect-sid: fail/pass api - convert unittests to new FAIL/PASS API.	6 years ago
Jason Ish	f2ab5803fb	dns: initialize log flags as an unsigned long long On 64 bit all 64 bits were being initialized, but on 32 bit only 32 bits were as it was being initialized as a long. Redmine issue: https://redmine.openinfosecfoundation.org/issues/4206	6 years ago
Victor Julien	efc9a7a398	app-layer: remove callback for completion status Since the completion status was a constant for all parsers, remove the callback logic and instead register the values themselves. This should avoid a lot of unnecessary callback calls. Update all parsers to take advantage of this.	6 years ago
Victor Julien	84385549fe	detect: remove unused arg from generic list inspect	6 years ago
Victor Julien	d694dac5a8	detect: remove inspect v1 API	6 years ago
Victor Julien	92a8d8b4f4	detect/template: convert to v2 inspect API	6 years ago
Victor Julien	494f8f2700	detect/tls: convert to v2 inspect API	6 years ago
Victor Julien	71a508000b	detect/ssh: convert to v2 inspect API	6 years ago
Victor Julien	86686eff17	detect/snmp: convert to v2 inspect API	6 years ago
Victor Julien	962230040a	detect/rfb: convert to v2 inspect API	6 years ago
Victor Julien	b11cc0fbcd	detect/nfs: convert to v2 inspect API	6 years ago
Victor Julien	15c84bf3c6	detect/lua: convert to v2 inspect API	6 years ago
Victor Julien	5062023ffe	detect/ftp: convert to v2 inspect API	6 years ago
Victor Julien	2320d62872	detect/mqtt: convert to v2 inspect API	6 years ago
Victor Julien	5611f9ddbd	detect/modbus: convert to v2 inspect API	6 years ago
Victor Julien	ce6f8605ea	detect/enip/cip: convert to v2 inspect API	6 years ago
Victor Julien	35310313de	detect/http2: inspect API v2	6 years ago
Victor Julien	67d45f7e3c	detect/krb5: use inspect api v2	6 years ago
Victor Julien	197f99a134	detect/ftpbounce: switch to inspect api v2	6 years ago
Victor Julien	0f2c94ffea	detect/files: remove unused prototypes	6 years ago
Victor Julien	e0e4454db7	detect/files: inspect api v2	6 years ago
Victor Julien	48094b05c8	detect/file: minor cleanup	6 years ago
Victor Julien	cd146adef0	detect/dnp3: convert to v2 inspect API	6 years ago
Victor Julien	9f8a8f368a	detect/dcerpc: convert to v2 inspect API	6 years ago
Victor Julien	db0665bccc	detect/dns: convert to v2 inspect API	6 years ago
Victor Julien	8c7423fcb8	detect/app-layer-event: convert to v2 inspect API	6 years ago
Victor Julien	c6c93d1d12	detect/stream: convert to inspect API v2	6 years ago
Victor Julien	51f38f6453	detect/payload: minor formatting fixup	6 years ago
Philippe Antoine	8c4e53e803	dnp3: regenerates C code with script	6 years ago
Shivani Bhardwaj	ea0936199d	output: use BASE64_BUFFER_SIZE macro Base64Encode function requires the maximum length of the output string as its last parameter. Use the macro BASE64_BUFFER_SIZE to calculate it correctly.	6 years ago
Shivani Bhardwaj	b0a6ed1e2a	datasets/string: fix buffer overflow The size of encoded_data array and the maximum output length parameter to Base64Encode function were incorrect leading to buffer overflow for certain cases. The algorithm requires at least 5 bytes of space to even convert a string of length 1. Use BASE64_BUFFER_SIZE macro to correctly calculate this output length. Set size of encoded_data array to the calculated output length.	6 years ago
Shivani Bhardwaj	02942a123a	util/crypt: Add macro for max base64encode len Maximum length of a base64 encoded string can be 33% over the actual length of the input string. The formula to best cover all the edge cases is mathematically (4 * (input_length + 2) / 3) + 1 Add a macro to calculate this for a given input length.	6 years ago
Philippe Antoine	057c4b34c8	ftp: optimize FTPGetOldestTx by starting from last handled tx Avoids DOS by quadratic complexity algorithm. Attack is 1 stack many requests/transactions (like cwd commands on a line) 2 get many answers	6 years ago
Victor Julien	a8fc481cd3	http2: avoid null pointer deref in alert output Bug #4120.	6 years ago
Philippe Antoine	096dce4bba	http2: allow filestore to work with HTTP2	6 years ago
Philippe Antoine	d5ac77ee8b	packet: set length of 0 for too big copy	6 years ago
Philippe Antoine	6d2247391e	ssl: improves keyword ssl_version parsing Removes the use of PCRE for performance Forbids empty negations after a valid pattern Forbids mixing negative and positive forms as it is irrelevant Forbids useless repetition of a version	6 years ago
Philippe Antoine	48f0c612e3	ssl: upgarde to uint32 for bytes_processed as it can overflow, and is compared with uint32 such as message_length and message_start and	6 years ago
Philippe Antoine	445e03d752	detect: null sanity checks for pkthdr Even when the rules are only applied on traffic with the protocol the structure for the protocol header can be set to NULL if there was an error parsing the header	6 years ago
Philippe Antoine	33905b0910	fuzz: check PacketCopyData return value before processing packet	6 years ago
Philippe Antoine	18d8164a27	fuzz: limit memcap for datasets when fuzzing	6 years ago
Philippe Antoine	65e232669c	dnp3: better limit for tests when fuzzing	6 years ago
Philippe Antoine	80dc6c6f1e	fuzz: improves detect proto target By mimicking assert message so as to clusterfuzz differentiates between failures	6 years ago
Victor Julien	4664444067	detect: fix inspection order with stateful rules When stateful detection rules, for which detection has already started for a previous packet, are added to the candidates array, the array is sorted to mantain the correct inspection order. However, due to a trivial error in the sort helper the array was sorted in descending instead of ascending order.	6 years ago
Victor Julien	ba781265a4	dcerpc/udp: fix transaction handling and logging Implement missing transaction handling. Fix logging wrongly casting 'state' to DCERPCState instead of DCERPCUDPState leading to crashes and malformed output. Remove unused fields from DCERPCUDPState.	6 years ago
Victor Julien	e7b5201016	detect/mpm: remove usused cleanup function	6 years ago
Victor Julien	e799357d9f	detect: optimize prefilter result handling	6 years ago
Victor Julien	ffb0945b4c	detect/prefilter: small cleanup	6 years ago
Victor Julien	14aacbd067	decode/null: fix type parsing	6 years ago
Jason Ish	76e011a5ba	dnp3: set byte order when logging dnp3 src and dst DNP3 uses little endian on the wire, for the most part this is handled as the messages are deserialize. However, the link header is a cast over raw data, so swap these bytes as they are being logged. Redmine issue: https://redmine.openinfosecfoundation.org/issues/4173	6 years ago
Philippe Antoine	65711f6bc2	app-layer: do not try to parse gaps during protocol change As this will leak the flow alstate because AppLayerParserParse relies on FlowChangeProto to know if it should allocate a new alstate	6 years ago
Philippe Antoine	89ae1a0036	detect: apply transforms to http body	6 years ago
Philippe Antoine	6b50a71d1a	app-layer: lower limit for protocol detection on protocol change So that protocol detection does not run for too long because TCPProtoDetectCheckBailConditions somehow relies on its TCP stream to start from zero, which is not the case on protocol change Adds also debug validation checks, such as both sides are known on protocol change And only sets once alproto_orig	6 years ago
Jeff Lucovsky	dabd50eeee	detect: Register icmpv4 header	6 years ago
Jeff Lucovsky	ac8532966b	detect: Add icmpv4.hdr sticky buffer This commit adds a new sticky buffer to access the ICMPv4 header.	6 years ago
Jeff Lucovsky	7cbe7c6463	detect: New enum for icmpv4 header keyword	6 years ago
Jeff Lucovsky	988bb26828	decode: Improved handling of ICMPv4 messages This commit improves handling of ICMPv4 messages, especially those with variable sized headers. This commit also adds a header length variable for use by the new sticky buffer for the header.	6 years ago
Jeff Lucovsky	828bf6d1d6	detect: Treat offset as a signed value This commit updates the detector to treat 'offset' as a signed value to be compatible with Snort.	6 years ago
Phil Young	dc5349a30c	napatech: Add Deprecation Warning Message for HBA Added a message that HBA will be deprecated in the future and removed hba from default conf file.	6 years ago
Jason Ish	8dbc774dfa	dns: eve 1 deprecation warning Redmine issue: https://redmine.openinfosecfoundation.org/issues/4137	6 years ago
Jason Ish	d8242c5d07	dns: fix leak in dns v1 logging Intermediate JsonBuilder object was not being freed. Redmine issue: https://redmine.openinfosecfoundation.org/issues/4086	6 years ago
Phil Young	fa77e02cf1	napatech: Removed restriction on use of inline mode Removed the unnecessary restriction on the use of inline mode only when bypass is enabled. Now, Inline can be used independent of bypass functionality.	6 years ago
Phil Young	789dcbd49d	napatech: Fix potential double release of packet This addresses readmine issue #4018. There was the potential for a packet buffer to be released twice in response to an error condition. This addresses this by only calling NT_NetRxRelease() when the p->ReleasePacket is called.	6 years ago
Philippe Antoine	7d594d8710	fuzz: better packet recycling in sigpcap target need especially to set datalink for every packet	6 years ago
Philippe Antoine	c93cbe66c2	fuzz: applayer target uses yaml config so that every app-layer protocol is enabled	6 years ago
Sascha Steinbiss	ea2bc4c962	eve: do not access flow storage in packet context We must make sure not to access the flow storage (e.g. keeping a MacSet) before making sure we have a flow to begin with, We can, for example, run into an alert without a flow with `ip` rules, in which case the flow might be NULL. See Redmine issue #4109.	6 years ago
Jeff Lucovsky	68418a26db	detect/file-data: Improved support for share bufs This commit improves support for shared buffer usage, i.e., when multiple rules share the file data (http) buffer and apply different combinations of transforms and fast_patterns (or none).	6 years ago
Victor Julien	0eb692e500	mingw: fix format string warnings	6 years ago
Victor Julien	ba2a9be11a	detect/mpm: fix id confusion in mpm_ctx sharing Mixing of dynamic id's and hardcoded config values could possibly lead to the settings not getting applied properly.	6 years ago
Victor Julien	82d7f64630	detect/mpm: improve transforms handling Make sure keywords with transforms get their own mpm ctx, instead of sharing it with the 'pure' version of the keyword.	6 years ago
Victor Julien	ee15bd8076	detect/mpm: rename variable to ease code review	6 years ago
Victor Julien	9f9c29a14a	dcerpc: fix stream flag handling Only hardcoded direction flags were passed to the parser, not the full range. Handle receiving an EOF flag w/o data. Bug: #3856	6 years ago
Angelo Mirabella	c72069c3b2	detect/magic: fix crash on rule reloading This changseset fixes a bug causing a segmentation fault. When rules are reloaded and a rule using libmagic matches, suricata crashes due to an improper reinitialization of the thread contexts. Bug: #3726	6 years ago
Angelo Mirabella	ea15282f47	unix-socket: fix alert metadata logging This changeset fixes a bug that was preventing suricata to dump alert metadata info when running in unix-socket mode. When running in unix-socket mode, suricata was skipping the initialization of the output modules and, as a consequence, the metadata output module was never invoked.	6 years ago
Victor Julien	62cc0c7acf	alert/syslog: fix minor compile warning	6 years ago
Victor Julien	4e925ca260	stream: harden data size handling Handle edge cases around ACKs and last_ack getting below 'app_progress', which can happen during shutdown of a flow with multiple GAPs.	6 years ago
Victor Julien	5391746518	stream: bail early if no data after a gap	6 years ago
Victor Julien	27c9280735	stream: harden data size handling	6 years ago
Victor Julien	8a08fe82d4	stream: don't send STREAM_START multiple times	6 years ago
Victor Julien	479078d377	detect/content: add more negation tests	6 years ago
Victor Julien	c41e64d637	dnp3: reword warning message	6 years ago
Victor Julien	36a93380a5	defrag: fix pthread warning on OpenBSD	6 years ago
Philippe Antoine	61d0cd1399	signature: checks protocol for file.name keyword By setting the flags as for the filename keyword (not sticky version)	6 years ago
Philippe Antoine	bde0c88984	dnp3: more precise probing for banners	6 years ago
Philippe Antoine	12dfc33e05	dnp3: fix probing test not using final null in string	6 years ago
Philippe Antoine	4706b38866	ssl: do not reuse struct session_id_length As it can be confused between SSLv2 and TLSv13 In SSLv2, this variable is not used after the function scope, so we can use a temporary variable.	6 years ago
Philippe Antoine	f9c6b60edc	detect: fix use of uninit memory in DetectDatarepParse By initializing to empty string	6 years ago
Philippe Antoine	6b735a2e57	util: fix warning about format string for integer	6 years ago
Philippe Antoine	dc7a9d2b46	util: THashInitConfig limits hash size when fuzzing	6 years ago
Philippe Antoine	dcd5e4dec9	util: THashInitConfig does not exit but return error	6 years ago
Jason Ish	2b215a45e0	enip: set unidirection transaction flag	6 years ago
Jason Ish	60ebc27c4e	app-layer: handle unidirectional transactions	6 years ago
Philippe Antoine	2eacc6a9a8	ssl: adds safety checks Ensure the client version is valid by checking hello flags Ensure no integer underflow occurs in SSLv3ParseHandshakeType	6 years ago
Jeff Lucovsky	4624e66cdd	detect/transform: Validator for compress-ws This commit adds a buffer validator for compress whitespace. Buffers containing two or more consecutive whitespace characters are invalid with this transform.	6 years ago
Jeff Lucovsky	30b1d7a9c1	detect: Correct typo	6 years ago
Jeff Lucovsky	7ab986250a	detect/file-data: Apply transforms on file_data This commit cause transforms to be applied on the sticky buffer.	6 years ago
Victor Julien	e07a4393a9	http: error check htp_list_size This avoids a potential casting to uint64_t of -1, leading to a very high upper bound of the tx loop.	6 years ago
Jeff Lucovsky	a75e9667ce	log/eve: Threaded filename change: eve.N.json This commit changes the name of the file used with threaded eve logging to better support log rotation Instead of using "eve.json.N" and creating potential issues with log rotation (which also uses a ".N" suffix), the eve logs will be named "eve.N.json" when threaded.	6 years ago
Jeff Lucovsky	73567272cd	path: SCBasename - function to return basename This commit returns the basename of a file, if it exists in the same way that `basename(1)` works.	6 years ago
Jeff Lucovsky	db9776af64	detect/rules: Fix copy/paste error This commit corrects a copy/paste error handling the `include-mpm-stats` configuration setting.	6 years ago
Jeff Lucovsky	41967a53ec	detect: Apply clang-format updates	6 years ago
Jeff Lucovsky	d911fb87b8	detect/rules: Increase array size to remove SEGV This commit changes the size of reporting variables to be dynamic based on the buffer ids in use instead of a fixed value to address a SEGV when the fixed value was less than the max buffer/type id in use.	6 years ago
Philippe Antoine	d57275fa64	protodetect: rerun probing parser if pattern matched If a pattern matches in the other direction, after probing parser finished without finding a protocol, we will rerun the probing parser, which will include the newly protocol found by its pattern	6 years ago
Philippe Antoine	5f348e9907	protodetect: runs probing parser on protocol found It a protocol is found in a first direction, we should run the probing parser, even if it is not in the known ports. That can happen for HTTP2, where client magic is detected, then server probe can be run	6 years ago
Philippe Antoine	518e0e66cb	applayer: fix a leak in protocol change TCPProtoDetect can either set f->alproto, change f->alstate and return error. When the original alstate gets freed, we shall set the pointer to NULL, as it can get reused.	6 years ago
Jeff Lucovsky	bb71eac9f9	log/anomaly: Move metadata out of anomaly section This commit moves the metadata from the anomaly object where it was incorrectly located.	6 years ago
Victor Julien	daffcc6e53	app-layer: improve depth handling Consider txs inspected and done for a direction after depth is reached for that direction.	6 years ago
Victor Julien	a5a46795bd	stream: make sure to call app-layer in case of depth reached	6 years ago
Victor Julien	8b2886635f	dcerpc/tcp: implement trunc logic When one side of the connection reaches the STREAM_DEPTH condition the parser should be aware of this. Otherwise transactions will forever be waiting for data in that direction.	6 years ago
Victor Julien	4da0d9bdea	applayer/rust: expose truncate callback	6 years ago
Victor Julien	2cfa35ccc9	app-layer: don't check tx detect flags if detect is disabled	6 years ago
Victor Julien	34e83b8acf	stream: remove GAP flag from stream This flag was checked in many places, but never set expect in 2 unittests.	6 years ago
Jeff Lucovsky	c5ace81a27	log/eve: Rename fileinfo alert object to files This commit changes the name of the "fileinfo" array in the alert object to "files" to better support legacy use of "fileinfo" in reporting and elsewhere. The "fileinfo" event type is not an array while the alert "fileinfo" member was.	6 years ago
Shivani Bhardwaj	98285177ba	datasets: use default memcap	6 years ago
Philippe Antoine	872de829ea	detect: initialize pointer before calling pcre_study So as not to check an uninitialized value Found by MSAN	6 years ago
Victor Julien	f21a4bc40e	datasets: remove experimental warning	6 years ago
Shivani Bhardwaj	1286b0a8f1	datasets: parse defaults section from yaml Datasets can now have a global defaults setting in suricata.yaml. In case the settings for memcap and hashsize are not find in the yaml or rule, this shall be the fallback. Example: datasets: defaults: memcap: 100mb hashsize: 2048 ua-seen: type: string load: datasets.csv	6 years ago
Shivani Bhardwaj	5ac94fc407	datasets: allow memcap, hashsize be set via yaml or rule It is now possible to set the memcap and hashsize via suricata.yaml and rules. Rule example: alert http any any -> any any (http.user_agent; dataset:isset,ua-seen,type string,load datasets.csv,memcap 100mb,hashsize 2048; sid:1;) suricata.yaml example: datasets: ua-seen: type: string load: datasets.csv memcap: 20mb hashsize: 2048	6 years ago
Shivani Bhardwaj	b2482d6c60	datasets: allow max possible memcap while loading While using the "load" option of datasets, it should be possible to load any file from the disk, so set the limit to highest possible.	6 years ago
Jeff Lucovsky	ce603d662f	log/eve: Ensure eve logs have sequential suffixes This commit ensures that the eve logs have sequential suffixes without gaps.	6 years ago
Jeff Lucovsky	ad2e18be3e	atomics: Add "decl and init with value" function This commit adds an interface to declare and initialize an atomic with a specific value. This can help with situations where there's no defined initialization path to set things up.	6 years ago
Jeff Lucovsky	8395a9201e	log: Ensure threaded eve honors SIGHUP This commit ensures that all logging contexts register for the file rotation mechanism (SIGHUP and configured).	6 years ago
Philippe Antoine	9b5c923327	http: disables lzma by default for HTTP	6 years ago
Philippe Antoine	7011bddf84	http2: mimic HTTP1 request from upgrade	6 years ago
Philippe Antoine	9d1b030ff0	http2: first connection upgrade from http1	6 years ago
Philippe Antoine	9185a90fc9	dnp3: fix unit tests when fuzzing	6 years ago
Philippe Antoine	82f1758573	applayer: keep running detection on protocol change ie do not stop on first try if we do not have enough data	6 years ago
Philippe Antoine	21e741795d	applayer: on protocol change, use previous state	6 years ago
Philippe Antoine	828ff2dc3c	http: removal of connect unit tests moved to suricata-verify	6 years ago
Philippe Antoine	547d6c2d78	applayer: pass parameter to StateAlloc This parameter is NULL or the pointer to the previous state for the previous protocol in the case of a protocol change, for instance from HTTP1 to HTTP2 This way, the new protocol can use the old protocol context. For instance, HTTP2 mimicks the HTTP1 request, to have a HTTP2 transaction with both request and response	6 years ago
Jason Ish	c4d0a61eca	datasets: fix dataset load path construction Test the full path instead of just the filename provided in the rule to see if it exists. Fixes the case where a rule file is loaded from a directory other than the default-rule-directory. Redmine issue: https://redmine.openinfosecfoundation.org/issues/3916	6 years ago
Philippe Antoine	9788b2ec8d	signature: frees transform options in SigMatchPrepare	6 years ago
Philippe Antoine	1674239442	detect: checks for overflow when comparing signatures priorities	6 years ago
Victor Julien	abca451901	flow: suppress Coverity FP	6 years ago
Victor Julien	204302cbac	flow: minor code cleanup	6 years ago
Victor Julien	42ce297e0e	flow: turn BUG_ON into debug check	6 years ago
Eric Leblond	6494abc6b1	ebpf: fix invalid description in doc string	6 years ago
Victor Julien	6492fe0841	detect/app-layer-events: improve warnings/errors Improve handling of outdated events that are no longer supported by the engine.	6 years ago
Victor Julien	8cd82486e2	flow/bypass: don't bypass on flow timeout pseudo packets	6 years ago
Jason Ish	cc2c7b731a	rule parsing: valid that input rule string is UTF8 Before parsing a rule string, validate that it is UTF-8 first. Related Redmine issue: https://redmine.openinfosecfoundation.org/issues/3850	6 years ago
Jason Ish	583593aa1b	http/eve: use set_string_from_bytes where appropriate The JsonBuilder set_string_from_bytes will escape unprintable characters in the output stream. Using BytesToStringBuffer can generate invalid UTF-8 which prevents the conversion from a C string to a Rust string.	6 years ago

... 2 3 4 5 6 ...

10040 Commits (6fe8bce3b0c653df8e72bdb81bc235672386b8b1)