11267 Commits (72dab0a8b75fabef3a1edeb59644231c26232c62)

 

All Branches   

Search

Author	SHA1	Message	Date
Jeff Lucovsky	64912104b3	detect/content: Validate content byte array ... This commit checks whether the content byte array is compatible with the transforms, if any, for the rule.	5 years ago
Jeff Lucovsky	197a593078	detect: Add transform validation api ... This commit extends the API with a function that validates arguments against the transforms for the SM list (if any).	5 years ago
Jeff Lucovsky	0189ff998f	detect/transform: Add validation function ... This commit adds a function to pre-validate buffers. If a content buffer contains whitespace, the validation fails.	5 years ago
Jeff Lucovsky	a4132d8e0f	detect/transform: Add transform "validate" function ... This commit adds an (optional) entry for a validation function. The validation function, if present, will be used during rule processing. Its role is to determine if the arguments are compatible with the transform. E.g., a content string of "this string has whitespace" is not compatible with the `strip_whitespace` transform.	5 years ago
Jason Ish	114b7e5cd9	dhcp/eve: remove erroneous jsonbuilder close ... The JsonBuilder was being closed to early.	5 years ago
Jason Ish	07e88a7479	jsonbuilder: add debug_validate to state ... If debug validation is enabled, panic on invalid state errors. For example, calling close on an already closed jsonbuilder object.	5 years ago
Jason Ish	ca6b70ea1b	rust: macro debug_validate_fail to fail with message ... Add a new debug_validate macro that unconditionally panics with a message. Useful in Rust pattern matching.	5 years ago
Jeff Lucovsky	4127c5fcc8	output/fileinfo: Optimize filename output ... This commit optimizes the JSON preparation of the file name by eliminating the temporary copy before adding to the Json builder buffer.	5 years ago
Jeff Lucovsky	0d298d47a1	output/rdp: Include common output options ... This commit will cause common metadata values and the community id to be included in log output when configured.	5 years ago
Jeff Lucovsky	ef3840e256	output/dhcp: Include common output options ... This commit will cause common metadata values and the community id to be included in log output when configured.	5 years ago
Jeff Lucovsky	c6c4936a20	output/smb: Include common output options ... This commit will cause common metadata values and the community id to be included in log output when configured.	5 years ago
Jeff Lucovsky	414bb25c93	output/tftp: Include common options ... This commit will cause common metadata values and the community id to be included in log output when configured.	5 years ago
Angelo Mirabella	0cdc009da1	detect/http_raw_header: Correct type mismatch ... This changeset fixes a bug on the computation of the buffer lenght for raw http headers. The bug is due to a mismatch on the data type of the length (uint8_t vs uint32_t) and it was causing signature misses.	5 years ago
Victor Julien	06f414d66d	doc/manpage: improve intro, add examples	5 years ago
Victor Julien	37d228dae0	rule/parse: minor action parsing cleanup	5 years ago
Victor Julien	75727c05e0	doc/manpage: add --reject-dev option	5 years ago
Victor Julien	82ac72782d	doc/userguide: update app-proto list	5 years ago
Victor Julien	e6330c354d	doc/userguide: list valid rule actions	5 years ago
Victor Julien	14e1a342ac	reject: support single vlan layer ... Support sending RST/ICMP errors for packet with a single VLAN header.	5 years ago
Victor Julien	9f3f07dd97	reject: get MTU for reject-dev and use it	5 years ago
Victor Julien	498ae0180b	reject: minor optimization of reset entry code	5 years ago
Victor Julien	279865b145	reject: remove L3 from function names	5 years ago
Victor Julien	c594d0c1ad	reject: allow configuration of the reject interface ... Using the '--reject-dev <dev>' commandline option. This is a global option that applies to all 'reject' actions. If the interface specified is using ethernet, libnet will use the faster L2 (link) layer. Suricata sets up the ethernet header based on the packet. When the interface is specified, cache libnet_t ctx for (much) better performance.	5 years ago
Victor Julien	604aa65c80	reject: don't respond to tunnel packets	5 years ago
Victor Julien	a6ed9b11d5	reject: check tcp header sooner to avoid potential leak	5 years ago
Victor Julien	1b042cf108	reject: optimize and simplify run test	5 years ago
Victor Julien	66257f37eb	reject: never return error ... Errors by thread modules are not handled.	5 years ago
Jason Ish	b8d1677b9c	file-hash-common: fix rule_file truncation ... Loading file hash lists uses dirname(3) on the de_ctx->rule_file which modifies the contents, removing the last part of the path. So on subsequent calls the rule_file no longer contains the rule_file, but instead just the directory name. Mostly noticed when using "-S" with rule files outside of the default-rule-path which requires more hunting for the rule file.	5 years ago
Jeff Lucovsky	648bd5afff	output/ftp: Use "Eve" prefix with FTP helpers ... This commit changes the prefix of the FTP helper routines from Json to Eve.	5 years ago
Jeff Lucovsky	1f19ab1013	output/eve: Remove unused helper function ... This commit removes an unused helper function no longer required/used after conversion to JsonBuilder.	5 years ago
Jeff Lucovsky	03de315bc2	ftp/eve: Convert FTP logging to use JsonBuilder ... This commit converts the FTP logging mechanisms to use JsonBuilder.	5 years ago
Shivani Bhardwaj	a7535099b4	smb/eve: convert to jsonbuilder ... Closes redmine ticket 3712.	5 years ago
Jeff Lucovsky	d14a14fa13	output/anomaly: Use helpers for string output	5 years ago
Jeff Lucovsky	9097df3a3b	output/flow: Use helpers for string output	5 years ago
Jeff Lucovsky	ff92745851	output/json: Include fileinfo in alerts ... This commit adds fileinfo to alerts when `metadata` is configured.	5 years ago
Jeff Lucovsky	cc99f95ecd	json: macro for setting formatted false value	5 years ago
Jeff Lucovsky	ae50d1a225	output/json: Refactor file output helper ... This commit creates a common file output helper function based on the logic in output-file-info.c:BuildBuildFileInfoRecord The refactored helper will be used to create "fileinfo" information during the alert output path.	5 years ago
Shivani Bhardwaj	f2dbee4787	util: check if parsed data is in range	5 years ago
Shivani Bhardwaj	2162c52b17	src: remove multiple uses of atoi ... atoi() and related functions lack a mechanism for reporting errors for invalid values. Replace them with calls to the appropriate ByteExtractString* and StringParse* functions. Partially closes redmine ticket #3053.	5 years ago
Shivani Bhardwaj	271e33fbaa	affinity: Convert nb_threads to uint32_t	5 years ago
Shivani Bhardwaj	a516435443	napatech: make stream_id uint8_t	5 years ago
Shivani Bhardwaj	f4c9d33923	redis: Change port type to uint16_t	5 years ago
Jason Ish	639f3d265e	rust: lock to nom 5.1.1 ... 5.1.2 pulls in dependencies that don't build on Rust 1.34.	5 years ago
Victor Julien	79681bf655	app-layer: remove old MPMId API calls ... Had been deprecated and non-functional since 2017.	5 years ago
Jason Ish	74053f43cb	json: macros for setting formatted true and string values ... JB_SET_TRUE(jb, key), and JB_SET_STRING(string, key, val) are C macros around jb_set_formatted to set static string and true values as a (micro) optimization.	5 years ago
Jason Ish	a545cdef6a	jsonbuilder: setter for formatted data ... Create a method to set preformatted data that contains the key and the value already formatted. This is an optimization for static data.	5 years ago
Jason Ish	e3b7c58218	jsonbuilder: export {set,append}_string_from_bytes to C	5 years ago
Jason Ish	f184bcc10e	jsonbuilder: use Box::from_raw instead of transmute to free ... I think this is a bad use of transmute, while the end result is the same, Box::from_raw is more correct as we created this pointer with Box::into_raw.	5 years ago
Philippe Antoine	e5d4332ede	signature: adds file flag for file_data keyword ... So that SigValidate can check if a protocol not supporting files was set after this keyword	5 years ago
Philippe Antoine	baf5f52f22	ssh/eve: convert to jsonbuilder	5 years ago