19118 Commits (823322cb1c71d90529eb5af3f8da369c7dc69684)

 

All Branches   

Search

Author	SHA1	Message	Date
Victor Julien	8572088b0f	eve/alert: firewall default policy logging improvements ... Add firewall.hook to indicate the hook that the policy was set on. Ticket: #8566.	4 months ago
Victor Julien	dc4c22e906	detect/firewall: support alert in packet default policy ... Support `alert` as a secondary action in packet firewall policies. To implement this a Signature object is created per policy that uses alert, and this is stored in a array table. When the policy is applied the signature is looked up and used in the PacketAlert. Ticket: #8566.	4 months ago
Victor Julien	2d4f1968b8	detect/firewall: support alert in default app policy ... Support `alert` as a secondary action in app-layer firewall policies. To implement this a Signature object is created per policy that uses alert, and this is stored in a hash table. When the policy is applied the signature is looked up and used in the PacketAlert. Ticket: #8566.	4 months ago
Victor Julien	6e037d9783	detect/analyzer: log firewall lte rule for prior states as well	4 months ago
Victor Julien	71a6a9a746	detect/firewall: limit auto accept notation ... Limit to accept:flow, accept:tx and accept:hook.	4 months ago
Victor Julien	651afba883	detect/firewall: implement initial state range support ... Allow a single rule to accept a hook and the hooks prior to it. Example: accept:flow tls:<client_hello_done ... \ tls.sni; content:"suricata.io"; endswith; This will evaluate the SNI at the client_hello_done hook, but will act as if there is a `accept:hook tls:client_in_progress ...` as well. Implementation is currently specific to this `<` operator. During parsing the sig gets flagged for this case. During setup this has 3 main effects: 1. prefilter is disabled as we need to eval this right at the first state (0) 2. for state 0 a non-PF "prefilter" engine is setup to make sure the rule is flagged for evaluation 3. In the Signature::app_inspect list a dummy inspect engine is registered per state before Signature::app_progress_hook The matching logic is building on the stateful rule handling. The stateful rule handling can now tell the inspection loop that a partial match occured. For this rule type the partial match will act as a match with action accept:hook. Next app updates will then use the continue detection logic to continue the stateful match. When that fully matches, the final actions are applied, like accept:flow or accept:tx. Ticket: #8472.	4 months ago
Victor Julien	f6dc772677	detect/firewall: fix last for progress handling ... In last_for_progress handling set accept only on packet if it was also triggered on the last tx. If there are more transactions, the accept can be set later (if policy allows).	4 months ago
Juliana Fajardini	6933602050	detect/parse: convert Notice Log into Debug	4 months ago
Juliana Fajardini	040369ed1a	qa/live: update tests for fw stats counters ... Part of Ticket #7699	4 months ago
Juliana Fajardini	8a8574b149	exceptions: add dedicated flow drop reason ... To better control stats counters.	4 months ago
Juliana Fajardini	312967f291	detect: add flow drop by firewall as drop reason ... To track flow drops triggered by the firewall. Add flow drop by firewall as drop reason. As part of Ticket #7699	4 months ago
Juliana Fajardini	0acb136b40	schema: expand stats.ips.replaced explanation ... As this is a less obvious counter.	4 months ago
Juliana Fajardini	234172a93c	docs: add firewall stats doc ... Related to Ticket #7699	4 months ago
Juliana Fajardini	5b488feef5	detect/firewall: add dedicated stats counters ... Add a `firewall` stats counter aggregator for all firewall-related stats. De-overload "detect.alert_queue_overflow", by adding "firewall.discarded_alerts" to account for discarded drops in Firewall mode. Add Debug statements for tracking corner cases where it can be difficult to know where a drop is coming from. Added counters: - stats.firewall.blocked - stats.firewall.accepted - stats.firewall.rejected - stats.firewall.drop_reason.default_app_policy - stats.firewall.drop_reason.default_packet_policy - stats.firewall.drop_reason.flow_drop - stats.firewall.drop_reason.pre_flow_hook - stats.firewall.drop_reason.pre_stream_hook - stats.firewall.drop_reason.rules - stats.firewall.discarded_alerts Ticket #7699	4 months ago
Juliana Fajardini	32d89072d2	docs/configuration: add firewall mode settings ... Partly related to Ticket #7699	4 months ago
Jason Ish	b366665ad8	doc: document rust thread life cycle api ... Ticket: #8605	4 months ago
Jason Ish	144f824f17	rust/ffi: add thread init callback wrapper ... Ticket: #8605	4 months ago
Jason Ish	c689af0bbb	rust/ffi: bindgen thread lifecycle callbacks ... Ticket: #8605	4 months ago
Jason Ish	f269e22b67	github-ci: add coverage reporting for the rust example plugin ... Should help reporting coverage on the ffi wrappers only used by plugins.	4 months ago
Jason Ish	e1a2a36ee7	examples/plugins/rust: misc cleanups ... - Remove registration helper - Limit function visibility	4 months ago
Philippe Antoine	07112bc7ae	rust: format mqtt files ... Ticket: 3836	4 months ago
Philippe Antoine	844f2effa3	rust: format modbus files ... Ticket: 3836	4 months ago
Philippe Antoine	db019ebefe	rust: format ike files ... Ticket: 3836	4 months ago
jason taylor	da827322ba	doc: minor ebpf doc update for fedora/rhel ... Signed-off-by: jason taylor <jtfas90@proton.me>	4 months ago
Victor Julien	54322f38f8	common: fix cppcheck syntax error	4 months ago
Victor Julien	bd198231a0	util/port-interval-tree: suppress cppcheck false positives	4 months ago
Victor Julien	f138a64ad7	debug/validate: remove redundant checks ... Pointed out by cppcheck.	4 months ago
Victor Julien	9869e9b9f5	detect/port: workaround cppcheck warning	4 months ago
Victor Julien	0af57040d9	detect/address: workaround cppcheck warning	4 months ago
Philippe Antoine	bcc1e6ae32	rust: format http2 files ... Ticket: 3836	4 months ago
Jeff Lucovsky	cc6fbcd5dd	etc/schema: add missing ftp fields ... Add ftp detect keywords to metadata Issue: 7502, 7503, 7507, 7505, 7508, 7506	4 months ago
Philippe Antoine	a35760db9b	rust: enforce already formatted directories in CI	4 months ago
Philippe Antoine	1070e733d8	rust: format websocket files ... Ticket: 3836	4 months ago
Philippe Antoine	89e5332d88	rust: format utils files ... Ticket: 3836	4 months ago
Philippe Antoine	edf29b0000	rust: format ssh files ... Ticket: 3836	4 months ago
Philippe Antoine	fe27a2159c	rust: format rfb files ... Ticket: 3836	4 months ago
Philippe Antoine	5cca346f16	rust: format quic files ... Ticket: 3836	4 months ago
Philippe Antoine	415360d9e8	rust: format ntp files ... Ticket: 3836	4 months ago
Philippe Antoine	fa864f9c2f	rust: format mime files ... Ticket: 3836	4 months ago
Philippe Antoine	2cfcaec1b0	rust: format ldap files ... Ticket: 3836	4 months ago
Philippe Antoine	64e7c671cc	rust: format ftp files ... Ticket: 3836	4 months ago
Philippe Antoine	f217e249cb	rust: format ffi files ... Ticket: 3836	4 months ago
Philippe Antoine	f7c14809f4	rust: format enip files ... Ticket: 3836	4 months ago
Philippe Antoine	e526eb8e2b	rust: format bittorrent_dht files ... Ticket: 3836	4 months ago
Philippe Antoine	f5ac0e201c	rust: format asn1 files ... Ticket: 3836	4 months ago
Philippe Antoine	1ced97bdbb	rust: format applayertemplate files ... Ticket: 3836	4 months ago
Sergey Pinaev	d55114e6d7	detect-engine-analyzer: remove unnecessary check ... Always make sure, that smd is not NULL, as we dereference it a few lines below and base64_data for instance is forbidden as a fast_pattern Ticket: 8504	4 months ago
Promise Charles	5c9602bcf2	suricata: add error about missing runmode ... If a runmode is missing but other params are passed on the commandline, issue an error. Ticket: #5711 Signed-off-by: Promise Charles <descencybobby@gmail.com>	4 months ago
Jason Ish	57f76a2462	github-ci: update Fedora builds to Fedora 44	4 months ago
Philippe Antoine	87db89ea4e	fuzz: extend fuzz_siginit to do engine-rule-analysis	4 months ago