10889 Commits (78045d3bbf20ab1ce7e36705e644b4720755b693)

Author	SHA1	Message	Date
Shivani Bhardwaj	78045d3bbf	tls/sni: remove unused fn declaration	4 years ago
Shivani Bhardwaj	42c3f418c6	tls: add tls.random* keywords ... Add tls.random keyword that matches on the 32 bytes of the TLS random field for client as well as server. Add tls.random_time keyword that matches on the first 4 bytes of the TLS random field for client as well as server. Add tls.random_bytes keyword that matches on the last 28 bytes of the TLS random field for client as well as server. All these are sticky buffers. Feature 5190	4 years ago
Philippe Antoine	e587f6792a	detect: support file.data for HTTP1 to server ... That is file sent with POST or PUT Ticket: #4144	4 years ago
Victor Julien	50f8779128	flow-manager: reduce burstiness in adaptive timing ... Previous adaptive model would have a large time range when scanning the hash when not so busy. In the default case it would take up to 4 minutes for a full hash scan. In case of sudden increase in business, where the hash would fill up rapidily during a few seconds, the flow manager would be forced to suddenly consider a much larger slice of the hash leading to a burst of work. This burst would increase pressure on the rest of the system leading to packet loss as the worker threads would be overloaded with flow housekeeping tasks. This patch reduces the max scan time to 10 seconds, and ramps up quickly to increase the slice of the hash scanned.	4 years ago
Juliana Fajardini	58ef3cde7a	exceptions: error out when invalid policy is used ... Before, if an invalid value was passed as exception policy, Suricata would log a warning and set the exception policy to "ignore". This is a very different result, than, say, dropping or bypassing a midstream flow. Task #5504	4 years ago
Philippe Antoine	61b73416e2	detect: transforms check for 0-sized buffer ... So as to avoid undefined behavior with a 0-sized variable length array Ticket: #5521	4 years ago
Philippe Antoine	d1ebf320f7	fuzz: disable enip detection based on source port ... So as to avoid fuzzing detecting protocol polyglots with enip	4 years ago
Philippe Antoine	617c9fb7e5	fuzz: remove check about max transactions ... Suricata can indeed pipeline many HTTP1 transactions	4 years ago
Victor Julien	b01c311c1d	profiling: fix implicit-int-float-conversion warnings	4 years ago
Victor Julien	aa09d5f556	packetpool: ifdef debug check	4 years ago
Juliana Fajardini	e7727c3744	decode: remove unused macros, replace w/ functions ... With the recent changes, these macros weren't being used anymore. Related to Bug #5458	4 years ago
Juliana Fajardini	d07a6c6174	stream/tcp: remove repeated header declaration ... StreamTcpRegisterTests was being declared twice.	4 years ago
Juliana Fajardini	f897761ecb	detect/alert: add unittests to check packet action ... Add unittests to check that packet flags are correctly updated after detection finds drop or reject rules that match. Related to Bug #5458	4 years ago
Juliana Fajardini	abd595d695	decode: validate if dropped packet has drop reason ... Related to Bug #5458	4 years ago
Juliana Fajardini	1f54e8611a	detect/alert: ensure reject action is applied ... Bug 5458 states that the reject action is no longer working. While SV tests that use the reject action still pass, it indeed seems that a regression has happened with commit aa93984, because while the function that applies rule actions to the flow (RuleActionToFlow) does check for the reject action, the newly added function PacketApply SignatureActions only checks for ACTION_DROP or ACTION_PASS when deciding to call RuleActionToFlow. Bug #5458	4 years ago
Juliana Fajardini	1774ff18a6	decode: make PacketDrop use action as parameter ... A Packet may be dropped due to several different reasons. This change adds action as a parameter, so we can update the packet action when we drop it, instead of setting it to drop. Related to Bug #5458	4 years ago
Eric Leblond	01bf0ad43d	luajit: fix unittests build ... When building with the following options: ./configure CC=clang --enable-luajit --enable-geoip --enable-unittests There is a build failure: runmode-unittests.c:234:9: error: implicit declaration of function 'LuajitSetupStatesPool' is invalid in C99 [-Werror,-Wimplicit-function-declaration] if (LuajitSetupStatesPool() != 0) {	4 years ago
Philippe Antoine	11f849c3ee	protocol-change: sets event in case of failure ... Protocol change can fail if one protocol change is already occuring. Ticket: #5509	4 years ago
Philippe Antoine	461725a9bf	dhcp: adds leasetime keyword ... As it is logged Ticket: #5435	4 years ago
Jason Ish	f1f43cba5e	app-layer: don't wrap around on port 65535 ... A port value of 65535 caused the port value to wrap-around to 0 resulting in an infinite loop. Fixes: 53fc70a9a7 ("protodetect: fix int warnings")	4 years ago
Juliana Fajardini	c81b78fd1c	detect/parse: test sig parsing for more actions ... Our unittests were only covering sig parsing for alert actions. As in environments without LibNet the reject action will not work, we must ensure that our parser properly fails in such cases, instead of silently accepting an unsupported action. Added tests for the reject and drop action. Task #5496	4 years ago
Eric Leblond	954e3e1f3f	smtp/mime: fix url extraction when no config is set	4 years ago
Eric Leblond	ad6c2f1411	eve/email: log existing url type ... MIME parsing was setting flag on URL to indicate their estimated type. This patch attach the information to the email object so the user can extract interesting email directly: ``` "email": { "status": "PARSE_DONE", "from": "Eric Leblond <regit@regit.org>", "to": [ "eric@regit.org" ], "has_ipv6_url": false, "has_ipv4_url": false, "has_exe_url": true, "url": [ "http://www.toto.com", "http://perdu.com.", "https://hacke.me/pown.exe" ] } ```	4 years ago
Eric Leblond	767d2cc9ba	util/mime: add some extensions to exe list	4 years ago
Benjamin Wilkins	57ef80f5ec	lua: Expose byte extract to lua match scripts ... Allow lua match scripts to access variables defined in rule by byte_extract or byte_math Issue: 2871	4 years ago
Eric Leblond	debdff0375	detect/tls: fix descriptions ... Most keywords were presented as content modifiers when they were in fact sticky buffers.	4 years ago
Victor Julien	5fbec8ca67	netmap: fix includes	4 years ago
Philippe Antoine	489ac003b2	detect/krb: no more wrapper around DetectEngineInspectGenericList	4 years ago
Philippe Antoine	5c7b5c5fb5	krb: detection for ticket encryption ... As is done for logging. Ticket: #5442	4 years ago
Victor Julien	5fec07b87d	flow: minor compiler warnings ... flow-util.c: In function 'FlowEndCountersRegister': flow-util.c:294:34: warning: 'name' may be used uninitialized in this function [-Wmaybe-uninitialized] 294 | fec->flow_tcp_state[i] = StatsRegisterCounter(name, t); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~	4 years ago
Jeff Lucovsky	e133ab029e	stream/event: Trigger stream reassembly event ... Issue: 3512 This commit triggers the stream reassembly depth reached event.	4 years ago
Jeff Lucovsky	1d8cc7791d	general: Typo fixup	4 years ago
Jeff Lucovsky	6a039ab316	stream/event: New reassembly depth event ... Issue: 3512 This commit adds a stream event triggered when the stream assembly depth is reached.	4 years ago
Philippe Antoine	e1e03c25c9	ci: update to macos latest	4 years ago
Philippe Antoine	018fef5ef8	quic: ja3 computation and logging and detection ... Logging as is done in TLS. Detection using the generic generic ja3.string keyword Ticket: #5143	4 years ago
Juliana Fajardini	5f4bcfe313	detect/engine: fix typos in assorted files	4 years ago
Juliana Fajardini	58928b249d	commandline: add alert-queue expand failure option ... For testing purposes. Meant to simulate a reallocation failure when dynamically growing the alert queue in DetectEngineThreadCtx, so we can check that Suri's behavior doesn't break under such circumstances. Task #5319	4 years ago
Victor Julien	ebc2714e07	nflog: fix missing util-time include; cleanups	4 years ago
Victor Julien	09c0128138	nflog: update copyright years	4 years ago
Jeff Lucovsky	e566563875	classification/config: Propagate validation errors ... Issue: #4554 This commit modifies the workflow to propagate classification parsing errors when in test mode. When not in test mode, errors continue to be displayed but they do not halt Suricata execution.	4 years ago
Jeff Lucovsky	2621c90ea1	classification/config: Raise error on validation errors ... This commit adds logic which raises an error if parse errors occur while loading classification.config Issue: 4554	4 years ago
Philippe Antoine	83a8cd80b2	detect: remove wrappers around DetectEngineInspectGenericList	4 years ago
Scott Jordan	7eaf1688b5	stream: fix StreamTcpSegmentForSession missing segments ... Bugfix, segment traversal was being initialized at root node, but should have been started at the min node. Bug resulted in captures missing segments left of root node.	4 years ago
Victor Julien	ad3e68f378	detect/file: minor cleanups	4 years ago
Victor Julien	af145ad125	detect/file: reduce scope of keyword data structures	4 years ago
Victor Julien	73eb7744d8	detect/file: update copyright years	4 years ago
Victor Julien	6f8ca41eb3	detect/cip: cleanup includes	4 years ago
Philippe Antoine	16fc78645d	dnp3: do not log empty objects array ... Ticket: #5167	4 years ago
Philippe Antoine	da0be16d36	output: do not log empty arrays for sid ... Ticket: #5167	4 years ago
Philippe Antoine	adeb1fdfc3	threads: cleaner code with one instruction per line ... As reported by Shchelk	4 years ago