aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
13,427 Commits
8 Branches
174 Tags
255 MiB
main
main-8.0.x
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.7
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '78045d3bbf'
${ noResults }
Commit Graph

10889 Commits (78045d3bbf20ab1ce7e36705e644b4720755b693)

Author SHA1 Message Date
Victor Julien aa31d2193f counters: add StatsDecr 4 years ago
Victor Julien 88edc8630c flow/manager: add flow.mgr.rows_sec counter 4 years ago
Victor Julien f271fb4575 flow/recycler: bring back pthread_cond_t sleep 
Bug #4379.
 4 years ago
Victor Julien 633e6cf09e flow/recycler: minor code cleanups 4 years ago
Victor Julien 73138809e2 flow/manager: move counters into util func 4 years ago
Victor Julien 0c048d3e5c flow/manager: minor code cleanups 4 years ago
Victor Julien 7f4e120a97 flow/manager: remove debug and dead code 4 years ago
Victor Julien e6ac2e4e8a flow/manager: sleep handled by pthread_cond_t again 
Use only in live mode to allow FM to respond quickly to time
increases in offline mode.

Bug #4379.
 4 years ago
Victor Julien 39141a8836 time: add timeradd implementation 
timeradd isn't available on MinGW.
 4 years ago
Victor Julien e9d2417e0f flow/manager: adaptive hash eviction timing 
The flow manager scans the hash table in chunks based on the flow timeout
settings. In the default config this will lead to a full hash pass every
240 seconds. Under pressure, this will lead to a large amount of memory
still in use by flows waiting to be evicted, or evicted flows waiting to
be freed.

This patch implements a new adaptive logic to the timing and amount of
work that is done by the flow manager. It takes the memcap budgets and
calculates the proportion of the memcap budgets in use. It takes the max
in-use percentage, and adapts the flow manager behavior based on that.

The memcaps considered are:
    flow, stream, stream-reassembly and app-layer-http

The percentage in use, is inversely applies to the time the flow manager
takes for a full hash pass. In addition, it is also applied to the chunk
size and the sleep time.

Example: tcp.reassembly_memuse is at 90% of the memcap and normal flow
hash pass is 240s. Hash pass time will be:

    240 * (100 - 90) / 100 = 24s

Chunk size and sleep time will automatically be updated for this.

Adds various counters.

Bug: #4650.
Bug: #4808.
 4 years ago
Michael Tremer f50af12068 stream: tcp: Handle retransmitted SYN with TSval 
For connections that use TCP timestamps for which the first SYN packet
does not reach the server, any replies to retransmitted SYNs will be
tropped.

This is happening in StateSynSentValidateTimestamp, where the timestamp
value in a SYN-ACK packet must match the one from the SYN packet.
However, since the server never received the first SYN packet, it will
respond with an updated timestamp from any of the following SYN packets.

The timestamp value inside suricata is not being updated at any time
which should happen. This patch fixes that problem.

Bug: #4376.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 4 years ago
Victor Julien 8109b0017e detect/dcerpc: simplify keyword validation 
Now that the engine understands the relation between SMB and DCERPC better
we can get rid of some of the special case handling in keywords.
 4 years ago
Victor Julien 8d20b40cdd detect/content: fix FNs due to bad depth calc 
When trying to propegate the depth/offset, within/distance chains
a logic error would set too a restrictive depth on a pattern that
followed more than one "unchained" patterns.

Bug: #5162.
 4 years ago
Victor Julien 50d02ebc05 detect/content: simplify int bounds checking 
Use a macro to validate the ranges for overflows. This removes
the clutter of all the checks and warnings, and also no longer
puts the state machine in an undefined state when hitting such
a condition.
 4 years ago
Victor Julien a83f02d4cd detect/dcerpc: apply dcerpc to smb as well 
So 'alert dcerpc' also matches if the DCERPC is over SMB.

Explicitly refuse smb keywords for the 'dcerpc' app proto setting:
`alert dceprc ... smb.share; ...` is rejected.

Remove a now useless special case in the stateless rule processing
matching for dcerpc/smb.

Bug: #5208.
 4 years ago
Philippe Antoine e692530021 event: only sets APPLAYER_UNEXPECTED_PROTOCOL once 
If f->alproto == ALPROTO_UNKNOWN, we do not know the new protocol
yet, so we do not set the event yet.
 4 years ago
Philippe Antoine b0298dd046 events: reset logged event 
Otherwise, if we log a first app_layer_event, then reset
with AppLayerDecoderEventsResetEvents for a new packet,
then get another event, it does not get logged

Ticket: #5391
 4 years ago
Philippe Antoine eb1c2a6083 smb: use default stream-depth 0 by default 
As broken by commit e5c948df87

Ticket: #5390
 4 years ago
Philippe Antoine 7acdece7d0 util: fix integer warnings in mime decoding 
Ticket: #4516
 4 years ago
Philippe Antoine 9d6e5558f1 defrag: do not cast pkt len to u16 
as it can overflow
 4 years ago
Philippe Antoine b8524e70d9 detect: change InspectEngineFuncPtr2 to return uint8_t 4 years ago
Philippe Antoine c5cf2967b3 detect: fix integer warnings 
Ticket: #4516
 4 years ago
Philippe Antoine ac8fb553a1 detect: fix integer warnings for content 
Ticket: #4516
 4 years ago
Philippe Antoine 57fb183d32 detect: fix integer warnings for app-layer-event 
Ticket: #4516
 4 years ago
Philippe Antoine 79d7edb3e0 ftp: fix integer warning 
Ticket: #4516
 4 years ago
Victor Julien df2e408d96 detect/threshold: fix offline time handling issue 
Due to the TIMEVAL_DIFF_SEC calculating the delta into an unsigned
integer, it would underflow to a high positive value leading to
and incorrect result if the packet timestamp was below the timestamp
for the threshold entry. In normal conditions this shouldn't happen,
but in offline mode each thread has its own concept of time which
might differ significantly based on the pcap. In this case the
overflow would be very common.

Changing it to a signed value calculation triggered fuzz undefined
behavior if the packet timeval was very high, so this patch takes a
new approach where it no longer calculates a diff but sets up the
"seconds" value we compare against as a timeval itself, and uses
that to compare.

Fixes: 9fafc1031c ("time: Add TIMEVAL_EARLIER and TIMEVAL_DIFF_SEC macros.")
Fixes: 82dc61f4c3 ("detect/threshold: Refactor threshold calculation to handle by_rule and by_both.")

Uses add `timeradd` specific version where available.

Bug: #5386.
 4 years ago
Victor Julien fea374626a stream/midstream: fix double flow reverse case 
In the case of midstream SYN/ACK pickup, we reverse the flow based on
the SYN/ACK. If we then later get traffic that appears to be in the
reverse direction based on the app-layer, we would reverse it again.
This isn't correct. When we have the SYN/ACK we know the flow's real
direction.
 4 years ago
Lukas Sismis 8845c07a90 bypass: af-packet: fix memory leak - reassign of EBPFBypassData 
AF-Packet bypass function in some situations allocates EBPF bypass data
for an already bypassed flow and assigns it to the flow without any checks

Issue: #5368
 4 years ago
Lukas Sismis 05797c45bb bypass: fix memory leak - reassign of FlowBypassInfo 
In some situations bypass callback is called on already bypassed
flow. This allocates FlowBypassInfo structure for the flow but
does not check if the flow already has one.

Issue: #5368
 4 years ago
Victor Julien 2486d29adb napatech: fix conf API call 4 years ago
Victor Julien 8580499ded exceptions: initial exception-policy implementation 
Adds a framework for setting exception policies. These would be called
when the engine reaches some kind of exception condition, like hitting
a memcap or some traffic processing error.

The policy gives control over what should happen next: drop the packet,
drop the packet and flow, bypass, etc.

Implements the policy for:

    stream: If stream session or reassembly memcaps are hit call the
    memcap policy on the packet and flow.

    flow: Apply policy when memcap is reached and no flow could be
    freed up.

    defrag: Apply policy when no tracker could be picked up.

    app-layer: Apply ppolicy if a parser reaches an error state.

All options default to 'ignore', which means the default behavior
is unchanged.

Adds commandline options: add simulation options for exceptions. These
are only exposed if compiled with `--enable-debug`.

Ticket: #5214.
Ticket: #5215.
Ticket: #5216.
Ticket: #5218.
Ticket: #5194.
 4 years ago
Victor Julien 4567995678 decode: add pass action wrapper 4 years ago
Victor Julien d81ad78444 decode: turn no payload/packet inspect macros into funcs 
Remove unused unset macros.
 4 years ago
Victor Julien 0035673208 eve/drop: log drop reason 
Ticket: #5202.
 4 years ago
Victor Julien 55fb2d5d2d stream/tests: remove bad test; update failing test to new behavior 4 years ago
Victor Julien 2d64ec6585 stream: clarify error handling comment 4 years ago
Victor Julien b6cf79901a stream/reassemble: clarify error handling 4 years ago
Victor Julien f34845858c stream: remove now unused tcp.insert_list_fail counter 4 years ago
Victor Julien 13554f7e44 stream/segtree: simplify error handling 
Now that spurious retransmissions don't propegate into the reassembly
code, error handling can be simplified.
 4 years ago
Victor Julien cc4e8f0936 stream: detect spurious retransmissions early 4 years ago
Victor Julien 84448d3bae tests: remove unnecessary flow locks 
Added once to satisfy debug validation, but we don't mix unittests
and debug validation anymore.

    sed -i -E '/.*FLOWLOCK_.*LOCK/d' *.c
 4 years ago
Victor Julien 579547c849 smtp: minor line loop cleanup 4 years ago
Victor Julien 96bb67f474 smtp: remove defunct check for line with single LF 
Don't fix it as DATA processing needs all the bytes.
 4 years ago
Victor Julien a2924b7141 smtp: constify line arguments where possible 4 years ago
Victor Julien e0d5878e49 smtp: move current line out of state 4 years ago
Victor Julien 1451bd62a6 smtp: move input out of state 4 years ago
Victor Julien 77fae275ef smtp: turn assertions in to debug asserts 4 years ago
Victor Julien 3a631085bb smtp: simplify preprocess loop 4 years ago
Victor Julien 30e47b2171 mime/base64: decode cleanups and simplification 
Addresses edge case: > 4 bytes at the end of the input with 2 or more
spaces.

Changes length type for remainder processing to allow for much longer
lines, which can happen in practice.

Adds a series of debug validation checks with real error handling
as well, to assist the fuzzer to find more edge cases.
 4 years ago
Victor Julien 92cd95b416 base64: no special case for nul char 
Let it be handled like other invalid input.
 4 years ago
Shivani Bhardwaj 5b27619778 base64: make decoder handle decoded data space constraints 
So far, it was the job of caller to send the bae64 decoder a perfect
block of data and take care of the destination buffer (decoded data)
size. Now, make it the decoder's job to take care of any space
constraints that the destination buffer may have and return accordingly.

Also, handle space characters in base64 encoded data as per RFC 2045.

Update MIME parser accordingly to handle the base64 data.

Ticket: 5315
 4 years ago
Shivani Bhardwaj cb01cc6929 base64: add Base64Ecode enum 4 years ago
Shivani Bhardwaj 9131d1d857 base64: add Base64Mode enum 4 years ago
Shivani Bhardwaj 1e3282f363 smtp: treat CR as a line terminator 
The ideal line terminator for an SMTP line is <CRLF>. But, given that
bare LF is still allowed by many systems despite the prohibition by
standards, we have to consider that. In order to simplify things, we
consider bare CR as line terminators as well while updating the
delimiter parameter correctly if they were to be followed by a LF
immediately or as a part of next fragment.

This takes care of some edge cases that made base64 decoder error out
because unexpected data was sent to it at times.

Ticket: 5316
 4 years ago
Philippe Antoine d1a4dae36b detect: use generic integer functions for streamsize 
By the way, adds the prefilter feature

Ticket: #2697
Ticket: #4112
 4 years ago
Philippe Antoine 35b6dcec7e detect: use generic integer functions for filesize 
Ticket: #4112
 4 years ago
Philippe Antoine bfdf5b1952 detect: use generic integer functions for tcp mss 
Ticket: #4112
 4 years ago
Philippe Antoine 025b510cac detect: use generic integer functions for template2 4 years ago
Philippe Antoine 261eebba12 detect: use generic integer functions for ttl 
Ticket: #4112
 4 years ago
Philippe Antoine 2b0be91f28 detect: use generic integer functions for dsize 
Ticket: #4112
 4 years ago
Philippe Antoine f29b43defd detect: rust generic functions for integers 
Move it away from http2 to generic core crate.
And use it for DCERPC (and SMB)

And remove the C version.
Main change in API is the free function is not free itself, but
a rust wrapper around unbox.

Ticket: #4112
 4 years ago
Philippe Antoine c4d9cb02ec util: better hex print function 
Without dangerous snprintf pattern identified by CodeQL
even if this pattern is not a problem in those precise cases,
it may easily get copy pasted in a dangerous place, so better
get rid of it and make CodeQL happy
 4 years ago
Philippe Antoine 6058792bee rust: make suricata context const 
So that it is read only and its pointers do not get modified
 4 years ago
Philippe Antoine 5a00acece2 ftp: remove temporary fields from state 
As input, input_len and direction only last for the scope of
one call of AppLayerParserParse, it is not necessary to keep them
in FtpState which lives longer, so we consume less memory.
 4 years ago
Jason Ish c8a5207083 detect: introduce "like" ip-only signature type 
Rules that look like they should be IP-only but contain a negated rule
address are now marked with an LIKE_IPONLY flag. This is so they are
treated like IPONLY rules with respect to flow action, but don't
interfere with other IPONLY processing like using the radix tree.

Ticket: #5361
 4 years ago
Philippe Antoine d5abaf0b38 decode: fix integer warning 
Newly introduced warning.
Regular cast as value is checked just before.

Ticket: #4516
 4 years ago
Philippe Antoine 717e51b7cf defrag: fix integer warnings 
Ticket: #4516
 4 years ago
Philippe Antoine 2d761810db rust: cbindgen first verifies existing bindings 
So as not to recompile every C file inclusing rust.h
 4 years ago
Philippe Antoine ced96a8aad detect: parsing avoiding infinite loop 
by comparing size_t to strlen result
Instead of uint16_t which would loop

Ticket: #5310
 4 years ago
Philippe Antoine 875eb58fb0 file: use functions on fd to avoid toctou 
Ticket: #5308
 4 years ago
Philippe Antoine ecb8dd4de0 util: check for unsigned overflow in rohash 
To make CodeQL happy
 4 years ago
Jason Ish adda8801d8 conf: remove ConfGetValue 
All uses of ConfGetValue are satisfied by ConfGet
 4 years ago
Philippe Antoine 5bd19135b0 util: remove malloc from streaming buffer config 
as it is unused
 4 years ago
Victor Julien ebf0629615 log-pcap: remove tunnel locks 
The tunnel lock mutex only "protects" the tunnel synchronization,
not the packet data, length or datalink fields.
 4 years ago
Victor Julien e7ab96c389 nflog: fix datalink compile issue 4 years ago
Juliana Fajardini 43d28f251f util/action: convert unittests to FAIL/PASS API 
Task #5371
 4 years ago
Juliana Fajardini 9b9b6aa2ce util/action: unittests clean-up (to sv tests) 
Removing all unittests that work better as suricata-verify tests.

Task #5371
 4 years ago
Victor Julien 4ed6c928aa unittest: minor helper cleanup 4 years ago
Victor Julien 41b5364511 detect/parse: cleanup test 4 years ago
Victor Julien a437dde739 detect: parsing test cleanups/improvements 4 years ago
Victor Julien e738b10e23 host-os-info: add test to show mixed ipv4/ipv6 4 years ago
Victor Julien f3d887310c rule/vars: clean up tests 4 years ago
Victor Julien 1b65af2867 detect/iponly: minor code cleanup 4 years ago
Victor Julien beecc1890f detect/iponly: include postmatch in determination 4 years ago
Victor Julien 4b097460c2 detect/iponly: simplify handling of 'any' parsing 4 years ago
Victor Julien ffef10c5d7 detect: address parsing variable rename to match code style 4 years ago
Victor Julien 51ef6f4e3a detect/iponly: remove unused code 4 years ago
Victor Julien f4f63ebff8 stream: add packet header outside of lock 4 years ago
Victor Julien 419920288c log/pcap: open handles outside of lock 4 years ago
Scott Jordan c751c45850 log/pcap: add buffer timeout 
Set timeout for pcap log so that packets do not sit
in buffer. Set default to one second.
 4 years ago
Scott Jordan 2bf3172dd1 stream: memcap tracking for TcpSegment alloc 4 years ago
Eric Leblond 47a5e6356d log/pcap: handle case of multiple link types 4 years ago
Eric Leblond 2c2fc6cd91 flow: set datalink for pseudo packet 
Set pseudo packet datalink to the global one. This fixes the case
where the pcap handle is open with information coming from a
pseudo packet. Without this, we did end up in most cases with
an Ethernet packet being written in a Raw pcap.
 4 years ago
Eric Leblond 1c2fba57f8 suricata: introduce global linktype 
As Suricata is not supporting pcap-ng we have to stick with one single
datalink type for the capture if ever we want to do pcap logging.
Assuming this, this patch introduces a function to set the link
type globally. This will be used with pcap conditional logging
to get the logging of TCP segments with the correct link type.
 4 years ago
Eric Leblond 584136ecb7 log/pcap: log segments for pseudo packets 4 years ago
Eric Leblond 8f0ef48e82 log/pcap: fix conditional pcap in tag mode 
We were missing the first packet when using condition pcap logging
in tag mode as it was not tagged. As a result we were not getting
the stream data triggering the alert in the pcap file.
 4 years ago
Eric Leblond 9f4d59b3f7 detect/tag: add a tag for first packet 
We may need to know that a packet has been tagged but is the
first one (and thus is not tagged).
 4 years ago
Scott Jordan 6cfc3343e7 log/pcap: dump segments of both sides of tcp session. 
This patch updates tcp segment dumping to dump segments
from both sides of the session in order when capturing
alerts and tags.
 4 years ago
Eric Leblond faab853685 log/pcap and eve/alert: get pcap filename to support multi mode 
This patch adds a function to get the current pcap file name that
will be used to current packet. This patch also  updates EVE
alerts to add pcap output filename when pcap capture is done in
multi or normal mode.
 4 years ago
Eric Leblond 2317fd83ef log/pcap: fix typo in error message 4 years ago
Eric Leblond 3908166f91 stream: count realloc in memcap 
TCP memory cap was not taking into account the memory that can
be used by realloc of Packet headers in TCP segments.
 4 years ago
Eric Leblond 0f14c55e52 log/pcap: update copyright date 4 years ago
Eric Leblond 58ef7bcdee log/pcap: introduce tag as logging condition 
This patch adds the tag as logging condition. If this option is
used all tagged packets are written to the pcap.
 4 years ago
Eric Leblond 626fce0712 log/pcap: fix some indentation and white spaces 4 years ago
Eric Leblond cc04eef007 log/pcap: add support for tunnel logging 
In alert mode, we need to write the root packet to the pcap
file instead of the packet that did trigger the alert.
 4 years ago
Eric Leblond e7b1c52c1c log/pcap: add existing stream logging 
This patch update the alert mode of pcap logging.

It uses the packet header data added to the TCP segments
to build packets corresponding to the acked data that did trigger
the alert. It then write it to the pcap file before starting to
dump all packet for the flow that did alert.
 4 years ago
Eric Leblond b416a4455c stream: conditionally add packet header to segment 
This patch optionally adds packet header to the TCP segment
and update the for each segment function by changing the
callback.

This patch is based on the work by Scott Jordan <scottfgjordan@gmail.com>
 4 years ago
Eric Leblond 435557ee7f detect: add flag when packet is first with alert 
We add a flag to packet to be able to know if this packet was the
first one to get alerts on the flow.
 4 years ago
Eric Leblond 412ca5d64c log/pcap: add PcapWrite function 
It will be used later when multiple writing operations will be
necessary.
 4 years ago
Eric Leblond 4cab5e5262 log/pcap: conditional logging 
Add an option to only write to pcap packets with alerts and flow
that have alerted.
 4 years ago
Jason Ish 3ea6572e22 rules: use primary default-rule-path if set on command line 
When reloading rules, respect `--set default-rule-path=...` from the
command line if set.

Previously the rule reload would always take the default-rule-path from
the configuration file, even if overrided on the command line.

Issue: #1911
 5 years ago
Juliana Fajardini 28ac75b505 detect/alert: directly increment alerts.discarded 
In the unlikely case of AlertQueueExpand failure, we were incrementing
the discarded alerts stats in AlertQueueAppend via the Packet member in the
DetectEngineThreadCtx, which may not be initialized yet.

Bug #5353
 5 years ago
Philippe Antoine 3051f7f23f protodetect: use both directions over UDP 
As is already done for TCP

Ticket: #2757
 5 years ago
Philippe Antoine edd163252d protodetect: be more tolerant 
Do not mask protocols on both directions with only first packet

For instance :
When the first packet is no valid DNS but on port 53 (a junk request)
second packet (error response from server) does not get checked for DNS
as first packet bit masked away DNS for both directions

Ticket: #2757
 5 years ago
Arne Welzel b6407c4253 stacktrace-on-signal: Use kill(getpid(), sig_num) 
kill(0, ...) re-raises the signal to every processes in the process
group which may impact unrelated processes.

Concretely, in our CI pipeline, a segfaulting Suricata process killed
the test driver.
 5 years ago
Victor Julien 91b54f180d stream/segtree: improve docs, error handling 5 years ago
Victor Julien 5c76f787f9 streaming/buffer: add debug validation for 'impossible' condition 5 years ago
Victor Julien 79f0f2fde4 app-layer: make registration structure more compact 5 years ago
Victor Julien a57010d72d htp: minor format string fixes 5 years ago
Victor Julien 24d231315b datasets: constify some function args 5 years ago
Victor Julien 3444aec724 time: reduce scope of static string 5 years ago
Victor Julien 80124152c6 threshold: constify detect engine arg 5 years ago
Victor Julien 18e4e032db thash: reduce scope for var; suggested by cppcheck 5 years ago
Victor Julien 55de18c675 spm: constify badchars; suggested by cppcheck 5 years ago
Victor Julien 99f212bc8c radix: small cppcheck suggested cleanup 5 years ago
Victor Julien 750fed2101 packetpool: minor cleanup 5 years ago
Victor Julien 7b592076ff stream: minor code cleanups suggested by cppcheck 5 years ago
Victor Julien 65f54024d3 defrag: minor code cleanups suggested by cppcheck 5 years ago
Victor Julien 404face284 output/flow: no double var init 5 years ago
Victor Julien f9a5ceb0d8 smtp: minor code cleanup 5 years ago
Victor Julien a5df176956 app-layer: minor code cleanups suggested by cppcheck 5 years ago
Victor Julien 4403e7fe8e app-layer/expectation: reduce scope and init vars 5 years ago
Victor Julien 6c3222dee6 ftp: code clarifications 
src/app-layer-ftp.c:945:49: style: Parameter 'ftp_state' can be declared with const [constParameter]
static FTPTransaction *FTPGetOldestTx(FtpState *ftp_state, FTPTransaction *starttx)
                                                ^
 5 years ago
Victor Julien d484d0b45b util/byte: minor cleanup 5 years ago
Victor Julien 1957c46efc threads: remove usused code; wrap in guards 5 years ago
Victor Julien e593dda356 threads: remove unused function 5 years ago
Victor Julien b55c8909c3 unittests: wrap unittest registration in guards 5 years ago
Victor Julien 905050a053 app-layer/profiling: hide profiling code behind guards 5 years ago
Victor Julien 93050c26b3 app-layer/events: remove unused function 5 years ago
Victor Julien 893ba84c0e output/frames: fix eof var overwrite 5 years ago
Victor Julien 1282b179cc stream/reassembly: reduce scope of variable 5 years ago
Victor Julien 3f375fd444 stream/buffer: remove redundant check 5 years ago
Victor Julien 002b335b4a decode/checksums: constify pointer args 5 years ago
Victor Julien 350be6cbac detect/state: address cppcheck warnings 
src/detect-engine-state.c:127:91: style: Suspicious calculation. Please use parentheses to clarify the code. The code ''a&b?c:d'' should be written as either ''(a&b)?c:d'' or ''a&(b?c:d)''. [clarifyCalculation]
    DetectEngineStateDirection *dir_state = &state->dir_state[direction & STREAM_TOSERVER ? 0 : 1];
                                                                                          ^
src/detect-engine-state.c:194:53: style: Suspicious calculation. Please use parentheses to clarify the code. The code ''a&b?c:d'' should be written as either ''(a&b)?c:d'' or ''a&(b?c:d)''. [clarifyCalculation]
    de_state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].filestore_cnt += file_no_match;
                                                    ^
src/detect-engine-state.c:201:57: style: Suspicious calculation. Please use parentheses to clarify the code. The code ''a&b?c:d'' should be written as either ''(a&b)?c:d'' or ''a&(b?c:d)''. [clarifyCalculation]
    if (de_state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].filestore_cnt == sgh->filestore_cnt)
                                                        ^
 5 years ago
Victor Julien 4feb0529a4 detect/file: minor code cleanup 
Reduce scope where possible. Suggested by cppcheck.
 5 years ago
Victor Julien a535cc5a25 runmodes: fix more warnings 5 years ago
Victor Julien f0479987ff memcmp: no-simd no case loop can scan forward 5 years ago
Victor Julien 0fc7ba45aa memcmp: use SCMEMCMP_BYTES everywhere; general cleanups 5 years ago
Victor Julien 87c5d69437 memcmp: work around GCC 12+ 'blend' issues 
Since GCC 12 the memcmp code using `_mm_blendv_epi8` failed to work.
Inspection of the disassembled objects suggests that it simply omits
the instruction on systems that are not AVX512 capable. On AVX512
it does replace it with VPCMPB logic that appears to work.

Luckily our use of blend is actually uncessary. A simple AND is sufficient.

Bug: #5312.
 5 years ago
Victor Julien ca97ed4436 memcmp: remove unreachable code from memcmp simd 
cppcheck:

src/util-memcmp.h:281:18: warning: Identical condition 'len-offset<16', second condition is always false [identicalConditionAfterEarlyExit]
        if (diff < 16) {
                 ^
src/util-memcmp.h:280:24: note: 'diff' is assigned value 'len-offset' here.
        int diff = len - offset;
                       ^
src/util-memcmp.h:269:33: note: If condition 'len-offset<16' is true, the function will return/exit
        if (likely(len - offset < 16)) {
                                ^
src/util-memcmp.h:281:18: note: Testing identical condition 'len-offset<16'
        if (diff < 16) {
                 ^
src/util-memcmp.h:344:18: warning: Identical condition 'len-offset<16', second condition is always false [identicalConditionAfterEarlyExit]
        if (diff < 16) {
                 ^
src/util-memcmp.h:343:24: note: 'diff' is assigned value 'len-offset' here.
        int diff = len - offset;
                       ^
src/util-memcmp.h:318:33: note: If condition 'len-offset<16' is true, the function will return/exit
        if (likely(len - offset < 16)) {
                                ^
src/util-memcmp.h:344:18: note: Testing identical condition 'len-offset<16'
        if (diff < 16) {
                 ^
src/util-memcmp.h:171:18: warning: Identical condition 'len-offset<16', second condition is always false [identicalConditionAfterEarlyExit]
        if (diff < 16) {
                 ^
src/util-memcmp.h:170:24: note: 'diff' is assigned value 'len-offset' here.
        int diff = len - offset;
                       ^
src/util-memcmp.h:159:33: note: If condition 'len-offset<16' is true, the function will return/exit
        if (likely(len - offset < 16)) {
                                ^
src/util-memcmp.h:171:18: note: Testing identical condition 'len-offset<16'
        if (diff < 16) {
                 ^
src/util-memcmp.h:233:18: warning: Identical condition 'len-offset<16', second condition is always false [identicalConditionAfterEarlyExit]
        if (diff < 16) {
                 ^
src/util-memcmp.h:232:24: note: 'diff' is assigned value 'len-offset' here.
        int diff = len - offset;
                       ^
src/util-memcmp.h:208:33: note: If condition 'len-offset<16' is true, the function will return/exit
        if (likely(len - offset < 16)) {
                                ^
src/util-memcmp.h:233:18: note: Testing identical condition 'len-offset<16'
        if (diff < 16) {
                 ^
 5 years ago