This commit reduces the changes associated with adding the v14 api to
6.0.x
During the preparation of this commit, issues in the original backport
were corrected
- Failure to release a lock under error conditions
- Typo in an CPP ifdef
- Incorrect target for goto statement in an error handling case.
Issue: 5744
The unit test for content |aa bz| transforms in place the string
str to replace the 2 characters aa by one character 0xaa
Then, when z is not recognized as a valid hexadeicmal character,
the whole modified string is printed out, inclusing the non-ascii
0xaa
Ticket: #5558
(cherry picked from commit b281199e9a)
This package likely needs to be installed when starting with an Ubuntu
container or other minimal Ubuntu install.
Ticket: #5616
(cherry picked from commit 0a4e3d0f82)
After a gap in a file transaction, the file tracker is truncated. However
this did not clear any stored out of order chunks from memory or stop more
chunks to be stored, leading to accumulation of a large number of chunks.
This patches fixes this be clearing the stored chunks on trunc. It also
makes sure no more chunks are stored in the tracker after the trunc.
Bug: #5781.
(cherry picked from commit a24d7dc45c)
Tested on Fedora 37 with clang 15.
util-strlcatu.c:45:8: error: a function definition without a prototype is deprecated in all versions of C and is not supported in C2x [-Werror,-Wdeprecated-non-prototype]
size_t strlcat(dst, src, siz)
^
1 error generated.
(cherry picked from commit 41ca206fdf)
Tested on Fedora 37 with clang 15.
datasets.c:852:9: error: variable 'n' set but not used [-Werror,-Wunused-but-set-variable]
int n = 0;
^
1 error generated.
(cherry picked from commit 1bc6976a06)
Tested on Fedora 37 with clang 15.
app-layer.c:1055:27: error: a function declaration without a prototype is deprecated in all versions of C [-Werror,-Wstrict-prototypes]
void AppLayerSetupCounters()
^
void
app-layer.c:1176:29: error: a function declaration without a prototype is deprecated in all versions of C [-Werror,-Wstrict-prototypes]
void AppLayerDeSetupCounters()
^
void
2 errors generated.
(cherry picked from commit ebd8728219)
In the case port_line is first allocated and port_line_len is set,
Then a second request reaches memcap and frees port_line,
port_line_len should also be reset, because both will get used
by the response parsing.
Ticket: #5701
(cherry picked from commit 1660172a8b)
As of Rust 1.66 with strict mode enabled, a for loop over an option is
now an error. Replace the last occurrence of this pattern with an "if
let" statement.
implicit conversion loses integer precision: 'int' to 'uint16_t'
because C shifts << translates automatically to signed integers
(cherry picked from commit ae6abd8ca3)
Make sure to exit the parser early on incomplete header data.
Additionally, make sure to not create duplicated tls frames in this
case.
Add a debug validation check for the header parser parsing too much
data, which should never happen.
(cherry picked from commit 1701a6b14c)
Improve unknown record handling. Inspired by Wireshark 'unknown record'
handling, we take a best effort approach for records with unknown content
types in TLS versions 1.0, 1.1 and 1.2.
Improve record length check and set 'invalid_record_length' event instead
of 'invalid_tls_header'.
(cherry picked from commit 69be41b241)
These tests are incompatible with the incomplete API usage and should
have been pcap based tests in the first place.
(cherry picked from commit 214e466b29)
TCP Buffering is now done in the app-layer using the incomplete API, on
the SSL/TLS record level. TLS level fragmentation will be implemented
separately.
(cherry picked from commit bcaf0f6f7d)
To avoid overhead of stream buffering for records we don't do
much with anyway, pass through application records instead of
buffering the entire record in the stream engine.
(cherry picked from commit 6076a51511)
The TLS record header is parsed in streaming mode still, but once the
record size is known we tell the app-layer API to give us the full
record.
Ticket: #5481
(cherry picked from commit 129fcb5c72)
Issue: 4581
This commit improves the runtime performance of rules with
tls.fingerprint by using the inspection logic from tls.cert_fingerprint.
(cherry picked from commit 63745a7879)
The check meant to see if the ip address part of the ip/cidr combo
was more specific than needed wasn't fully implemented, leading to
warnings being issued on completely valid and correct input.
This patch implements the same logic as in IPv4. If the ip address
as specified is different from the ip after the mask has been applied,
a warning is displayed.
Bug: #5747.
(cherry picked from commit 991f9fde32)
Fuzzing highlighted an issue where a command sequence on the same file
id triggered a logging issue:
file data for id N
close id N
file data for id N
If this happened in a single blob of data passed to the parser, the
existing file tx would be reused, the file "reopened", confusing the
file logging logic. This would trigger a debug assert.
This patch makes sure a new file tx is created for the file data
coming in after the first file tx is closed.
Bug: #5567.
(cherry picked from commit 45eb038e63)
Jeff Lucovsky
Philippe Antoine
Jason Ish
Victor Julien
jason taylor
Philippe Antoine
Jeff Lucovsky
Sascha Steinbiss