b55be5a44f
detect/transforms: update gunzip / zlib_deflate syntax
...
Use standard space separated syntax.
5 months ago
fe3cce895c
doc/userguide: add igmp keyword docs
5 months ago
7e6fd09e90
doc/userguide: add missing ipopts values
5 months ago
086c27a07f
decoder/igmp: add decoder events
5 months ago
94c16d8915
eve/igmp: add schema support for alert records
5 months ago
791e7c1924
detect/tcp.flags: minor code cleanup
5 months ago
e916fc3ba4
detect: add igmp.type keyword
5 months ago
6a1389acff
detect: add igmp.hdr keyword
5 months ago
d652b7ef62
decoder/igmp: detect RGMP (RFC 3488)
...
RGMP is a dialect of IGMP that uses the same protocol structure,
but with some different values for the fields.
Detect this and log it differently.
5 months ago
18f699cb97
detect/ipopts: add qs and rtralt options
...
Reordering of table and switch to match switch in parser.
5 months ago
190ed2e8ed
detect/csum: add igmp-csum keyword to match checksum
...
Add rule to decoder-events.rules to match on bad checksums.
5 months ago
c54bc8bc8b
detect/proto: add igmp support
...
So 'alert igmp ...' can work.
5 months ago
1b7cc2b323
decoder/igmp: initial decoder support for IGMP
...
Basic v1, v2 and v3 header validation.
Ticket: #8262 .
5 months ago
90823fa90e
devguide: add policy on patches w unasigned ticket
5 months ago
d4434ef4e8
dpdk: add live run test suite
...
Add live tests to verify that mempool, mempool cache sizes, and
potentially other DPDK features are initialized correctly during the
startup.
Follows up on bugs found in mempool settings on real/bonded devices.
The tests are placed in the new folder qa/live/ after a comment
in https://github.com/OISF/suricata/pull/14896 which indicated other
live tests are going to be moved there as well.
Ticket: 8320
5 months ago
ecd15a6c7e
dpdk: scale mempool size to the number of bond members
...
DPDK interface which were added to bond and had auto-calculated
mempool size didn't have enough space as the configured
descriptors and the derived mempool only considered one interface
per YAML node entry.
DPDK Bonding PMD allows for multiple interface to cooperate and
therefore, needs more space.
Ticket: 8125
5 months ago
ea853e92a3
dpdk: fix mempool sizing to always yield 2^n -1
...
Following DPDK's recommendation to size mempool to 2^n - 1,
the current implementation was flawed for certain combos,
e.g. mp_size 1023 and 1 queue, which resulted to 1022.
5 months ago
109742932a
dpdk: honor cache size setting
...
Previously, the interface initialization always recalculated
cache size according to the per-queue computed mempool size.
Ticket: 8123
5 months ago
d640719413
hs: include HS platform info in cache file hash
...
Hash Hyperscan installation info (version, CPU features, mode)
into the cache filename. A Hyperscan upgrade or platform change
would now produce a different filename, so stale caches from an
older installation are never opened.
Ticket: 8325
5 months ago
2e7b12dda4
hs: validate cached database against current HS installation
...
After deserializing a cached Hyperscan database, verify that its
version, CPU features, and mode match the current Hyperscan
installation by comparing hs_database_info output against a
reference database. Reject loading incompatible caches.
Ticket: 8325
5 months ago
0cdc77b707
hs: use binary mode for cache file I/O
...
HSSaveCache wrote serialized Hyperscan databases using text mode ("w")
while HSReadStream already read them with binary mode ("rb").
Matched file reading modes to the binary format and simplified
write-size check.
Ticket: 8325
5 months ago
d754b28717
hs: remove redundant file handle in HSLoadCache
...
HSLoadCache opened the cache file but never used the resulting handle
for reading. The actual read was done by HSReadStream which opened
the same file independently.
Removed the unused fopen/fclose pair and flattened the control flow.
Ticket: 8325
5 months ago
569ba3d26f
hs/cache: cleaner and more detailed output
...
Reduce logging level of a minor informational message.
Split tracking of pruning by age and by version and log those
separately, where the logging only appears if something has been
removed.
Ticket: 8322
5 months ago
66473f6ad7
doc: add more public datasets
...
Add:
- UNSW-NB15
- CIC-IDS2017
- CSE-CIC-IDS2018
- CIC-DDoS2019
Update formatting for better display.
5 months ago
e69b732d1c
af-xdp: address compile warnings
...
runmode-af-xdp.c:119:52: error: implicit conversion loses integer precision: 'const int' to 'uint16_t' (aka 'unsigned short') [-Werror,-Wimplicit-int-conversion]
119 | aconf->threads = (nr_cores <= nr_queues) ? nr_cores : nr_queues;
| ~ ^~~~~~~~
runmode-af-xdp.c:119:63: error: implicit conversion loses integer precision: 'const int' to 'uint16_t' (aka 'unsigned short') [-Werror,-Wimplicit-int-conversion]
119 | aconf->threads = (nr_cores <= nr_queues) ? nr_cores : nr_queues;
| ~ ^~~~~~~~~
runmode-af-xdp.c:135:26: error: implicit conversion loses integer precision: 'const int' to 'uint16_t' (aka 'unsigned short') [-Werror,-Wimplicit-int-conversion]
135 | aconf->threads = nr_queues;
| ~ ^~~~~~~~~
runmode-af-xdp.c:268:41: error: implicit conversion loses integer precision: 'intmax_t' (aka 'long') to 'uint32_t' (aka 'unsigned int') [-Werror,-Wshorten-64-to-32]
268 | aconf->busy_poll_time = conf_val_int;
| ~ ^~~~~~~~~~~~
runmode-af-xdp.c:275:43: error: implicit conversion loses integer precision: 'intmax_t' (aka 'long') to 'uint32_t' (aka 'unsigned int') [-Werror,-Wshorten-64-to-32]
275 | aconf->busy_poll_budget = conf_val_int;
| ~ ^~~~~~~~~~~~
runmode-af-xdp.c:282:40: error: implicit conversion loses integer precision: 'intmax_t' (aka 'long') to 'uint32_t' (aka 'unsigned int') [-Werror,-Wshorten-64-to-32]
282 | aconf->gro_flush_timeout = conf_val_int;
| ~ ^~~~~~~~~~~~
runmode-af-xdp.c:287:43: error: implicit conversion loses integer precision: 'intmax_t' (aka 'long') to 'uint32_t' (aka 'unsigned int') [-Werror,-Wshorten-64-to-32]
287 | aconf->napi_defer_hard_irqs = conf_val_int;
| ~ ^~~~~~~~~~~~
7 errors generated.
source-af-xdp.c:426:24: error: implicit conversion loses integer precision: 'int' to 'uint8_t' (aka 'unsigned char') [-Werror,-Wimplicit-int-conversion]
426 | ptv->afxdp_state = state;
| ~ ^~~~~
source-af-xdp.c:642:44: error: implicit conversion loses integer precision: 'uint32_t' (aka 'unsigned int') to '__u16' (aka 'unsigned short') [-Werror,-Wimplicit-int-conversion]
642 | ptv->xsk.cfg.bind_flags = afxdpconfig->bind_flags;
| ~ ~~~~~~~~~~~~~^~~~~~~~~~
2 errors generated.
5 months ago
edc19a15ad
detect/parse: convert unittest to fail/pass API
5 months ago
02f6340972
github-ci: update cov builds
...
Use --skip-branches to avoid countless partial coverage in unittests.
Update from 22.04 to 24.04 and llvm 15 to 19 to support --skip-branches.
5 months ago
ccd1df99fd
github-ci: add coveralls coverage uploads
6 months ago
accaf68615
github-ci: fix cov-ut profile file collision
6 months ago
65e87949c8
github-ci: ignore /github from coverage output
6 months ago
8c99759dfe
github-ci: ignore /usr and /rustc in coverage
6 months ago
d3b6bae140
github-ci: upload lcov coverage artifacts
6 months ago
e991375b04
github-ci: for codecov netns check, account for cargo build dir
...
It's not in /root/ like with container based builds.
6 months ago
e6513b5117
codecov: upload lcov reports to codecov
...
Seems to fix our issues with codecov.io.
6 months ago
71b59f6dbe
rust/ffi: move IPPROTO_TCP to ffi
...
and reexport in suricata
Allows to reduce dependencies to full suricata crate
Ticket: 7666
6 months ago
2a90cef318
plugin: reduce dependency on suricata crate
...
Ticket: 7666
The end goal is to remove all dependencies on suricata and just
use suricata_sys or suricata_ffi
For now, make usage of what is already available
6 months ago
926fde859e
userguide: fix Deprecations, warn about syslog
...
The Deprecation note on Syslog was partly conveying the opposite
message, and we were missing a deprecation notice on the Syslog output
section.
6 months ago
d5ea973791
detect/ike: move ike.ike.chosen_sa_attribute keyword to rust
...
Ticket: 8310
And increases expressivity on the way by supporting other modes
than equality
6 months ago
55333a6ca0
detect/ike: move ike.vendor keyword to rust
...
Ticket: 8310
6 months ago
14edd66494
detect/ike: move ike.nonce_payload keyword to rust
...
Ticket: 8310
6 months ago
d1213e4440
detect/ike: move ike.key_exchange_payload keyword to rust
...
Ticket: 8310
6 months ago
f23169c924
detect/ike: move ike.nonce_payload_length keyword to rust
...
Ticket: 8310
6 months ago
e85bf5be4d
detect/ike: move ike.key_exchange_payload_length keyword to rust
...
Ticket: 8310
6 months ago
841fe44f34
detect/ike: move ike.exchtype keyword to rust
...
Ticket: 8310
6 months ago
23032ebc65
detect/ike: move ike spi keywords to rust
...
Ticket: 8310
6 months ago
28ba93e60c
ndpi: minor optimization
...
Check protocol before doing more expensive work.
6 months ago
278da4bc6a
npdi: fix null pointer deref in detect keywords
...
Check for the existence of a flow before calling FlowGetStorageById() on it.
Ticket: #8308 .
6 months ago
723aa21e6f
misc: update copyright years
...
For files edited during
Task #7885
6 months ago
dc4d805908
exceptions: s/DEBUG/QA_SIMULATION build flag
...
Task #7885
6 months ago
5edb5a5d1a
build-scopes: add QA_SIMULATION mode
...
For qa-simulation scenarios, especially for testing purposes.
Task #7885
6 months ago
Victor Julien
Juliana Fajardini
Lukas Sismis
Jason Ish
Philippe Antoine