19176 Commits (7cb64cc20f0002be7c21e53528aa0a02abdbea5d)

 

All Branches   

Search

Author	SHA1	Message	Date
Victor Julien	57b16c964e	detect/firewall: drop in fw mode does not include alert ... In TD mode the drop action also includes alert. In firewall mode it should not to stay in line with accept. Ticket: #8601.	5 months ago
Victor Julien	f1090da254	detect/firewall: log alert for app default with alert ... Fix missing alert on drop:flow,alert	5 months ago
Victor Julien	485f5243d5	detect/firewall: improve handle fw alert handling ... More clearly define the relationship between PacketAlerts for firewall and threat detection events. Also no longer count firewall_discarded if drop rule came before a another rule, causing the later rule to not be evaluated/alerted. When packet:filter and app:filter alert appear in a single alert queue, handle accept:hook by keeping track of the detect_table.	5 months ago
Victor Julien	7e9402a2e0	detect/alert: fix suppressed drop handling ... If drop was issued for suppressed rule, still consider it for the next alert.	5 months ago
Victor Julien	508bb71d78	detect: minor action handling cleanup ... Don't run exact same check twice.	5 months ago
Victor Julien	9bcf0f332b	detect/firewall: fix TD drop:flow after FW accept:flow ... Threat detection can drop a flow that is but in accept:flow by the firewall.	5 months ago
Victor Julien	ecf2161f3b	detect/firewall: fixup debug message	5 months ago
Victor Julien	fb9747df8e	detect/firewall: minor code cleanup	5 months ago
Victor Julien	8572088b0f	eve/alert: firewall default policy logging improvements ... Add firewall.hook to indicate the hook that the policy was set on. Ticket: #8566.	5 months ago
Victor Julien	dc4c22e906	detect/firewall: support alert in packet default policy ... Support `alert` as a secondary action in packet firewall policies. To implement this a Signature object is created per policy that uses alert, and this is stored in a array table. When the policy is applied the signature is looked up and used in the PacketAlert. Ticket: #8566.	5 months ago
Victor Julien	2d4f1968b8	detect/firewall: support alert in default app policy ... Support `alert` as a secondary action in app-layer firewall policies. To implement this a Signature object is created per policy that uses alert, and this is stored in a hash table. When the policy is applied the signature is looked up and used in the PacketAlert. Ticket: #8566.	5 months ago
Victor Julien	6e037d9783	detect/analyzer: log firewall lte rule for prior states as well	5 months ago
Victor Julien	71a6a9a746	detect/firewall: limit auto accept notation ... Limit to accept:flow, accept:tx and accept:hook.	5 months ago
Victor Julien	651afba883	detect/firewall: implement initial state range support ... Allow a single rule to accept a hook and the hooks prior to it. Example: accept:flow tls:<client_hello_done ... \ tls.sni; content:"suricata.io"; endswith; This will evaluate the SNI at the client_hello_done hook, but will act as if there is a `accept:hook tls:client_in_progress ...` as well. Implementation is currently specific to this `<` operator. During parsing the sig gets flagged for this case. During setup this has 3 main effects: 1. prefilter is disabled as we need to eval this right at the first state (0) 2. for state 0 a non-PF "prefilter" engine is setup to make sure the rule is flagged for evaluation 3. In the Signature::app_inspect list a dummy inspect engine is registered per state before Signature::app_progress_hook The matching logic is building on the stateful rule handling. The stateful rule handling can now tell the inspection loop that a partial match occured. For this rule type the partial match will act as a match with action accept:hook. Next app updates will then use the continue detection logic to continue the stateful match. When that fully matches, the final actions are applied, like accept:flow or accept:tx. Ticket: #8472.	5 months ago
Victor Julien	f6dc772677	detect/firewall: fix last for progress handling ... In last_for_progress handling set accept only on packet if it was also triggered on the last tx. If there are more transactions, the accept can be set later (if policy allows).	5 months ago
Juliana Fajardini	6933602050	detect/parse: convert Notice Log into Debug	5 months ago
Juliana Fajardini	040369ed1a	qa/live: update tests for fw stats counters ... Part of Ticket #7699	5 months ago
Juliana Fajardini	8a8574b149	exceptions: add dedicated flow drop reason ... To better control stats counters.	5 months ago
Juliana Fajardini	312967f291	detect: add flow drop by firewall as drop reason ... To track flow drops triggered by the firewall. Add flow drop by firewall as drop reason. As part of Ticket #7699	5 months ago
Juliana Fajardini	0acb136b40	schema: expand stats.ips.replaced explanation ... As this is a less obvious counter.	5 months ago
Juliana Fajardini	234172a93c	docs: add firewall stats doc ... Related to Ticket #7699	5 months ago
Juliana Fajardini	5b488feef5	detect/firewall: add dedicated stats counters ... Add a `firewall` stats counter aggregator for all firewall-related stats. De-overload "detect.alert_queue_overflow", by adding "firewall.discarded_alerts" to account for discarded drops in Firewall mode. Add Debug statements for tracking corner cases where it can be difficult to know where a drop is coming from. Added counters: - stats.firewall.blocked - stats.firewall.accepted - stats.firewall.rejected - stats.firewall.drop_reason.default_app_policy - stats.firewall.drop_reason.default_packet_policy - stats.firewall.drop_reason.flow_drop - stats.firewall.drop_reason.pre_flow_hook - stats.firewall.drop_reason.pre_stream_hook - stats.firewall.drop_reason.rules - stats.firewall.discarded_alerts Ticket #7699	5 months ago
Juliana Fajardini	32d89072d2	docs/configuration: add firewall mode settings ... Partly related to Ticket #7699	5 months ago
Jason Ish	b366665ad8	doc: document rust thread life cycle api ... Ticket: #8605	5 months ago
Jason Ish	144f824f17	rust/ffi: add thread init callback wrapper ... Ticket: #8605	5 months ago
Jason Ish	c689af0bbb	rust/ffi: bindgen thread lifecycle callbacks ... Ticket: #8605	5 months ago
Jason Ish	f269e22b67	github-ci: add coverage reporting for the rust example plugin ... Should help reporting coverage on the ffi wrappers only used by plugins.	5 months ago
Jason Ish	e1a2a36ee7	examples/plugins/rust: misc cleanups ... - Remove registration helper - Limit function visibility	5 months ago
Philippe Antoine	07112bc7ae	rust: format mqtt files ... Ticket: 3836	5 months ago
Philippe Antoine	844f2effa3	rust: format modbus files ... Ticket: 3836	5 months ago
Philippe Antoine	db019ebefe	rust: format ike files ... Ticket: 3836	5 months ago
jason taylor	da827322ba	doc: minor ebpf doc update for fedora/rhel ... Signed-off-by: jason taylor <jtfas90@proton.me>	5 months ago
Victor Julien	54322f38f8	common: fix cppcheck syntax error	5 months ago
Victor Julien	bd198231a0	util/port-interval-tree: suppress cppcheck false positives	5 months ago
Victor Julien	f138a64ad7	debug/validate: remove redundant checks ... Pointed out by cppcheck.	5 months ago
Victor Julien	9869e9b9f5	detect/port: workaround cppcheck warning	5 months ago
Victor Julien	0af57040d9	detect/address: workaround cppcheck warning	5 months ago
Philippe Antoine	bcc1e6ae32	rust: format http2 files ... Ticket: 3836	5 months ago
Jeff Lucovsky	cc6fbcd5dd	etc/schema: add missing ftp fields ... Add ftp detect keywords to metadata Issue: 7502, 7503, 7507, 7505, 7508, 7506	5 months ago
Philippe Antoine	a35760db9b	rust: enforce already formatted directories in CI	5 months ago
Philippe Antoine	1070e733d8	rust: format websocket files ... Ticket: 3836	5 months ago
Philippe Antoine	89e5332d88	rust: format utils files ... Ticket: 3836	5 months ago
Philippe Antoine	edf29b0000	rust: format ssh files ... Ticket: 3836	5 months ago
Philippe Antoine	fe27a2159c	rust: format rfb files ... Ticket: 3836	5 months ago
Philippe Antoine	5cca346f16	rust: format quic files ... Ticket: 3836	5 months ago
Philippe Antoine	415360d9e8	rust: format ntp files ... Ticket: 3836	5 months ago
Philippe Antoine	fa864f9c2f	rust: format mime files ... Ticket: 3836	5 months ago
Philippe Antoine	2cfcaec1b0	rust: format ldap files ... Ticket: 3836	5 months ago
Philippe Antoine	64e7c671cc	rust: format ftp files ... Ticket: 3836	5 months ago
Philippe Antoine	f217e249cb	rust: format ffi files ... Ticket: 3836	5 months ago