Commit Graph

18312 Commits (9095eb9b228192d5a67419fd69cf51716217108c)
 

Author SHA1 Message Date
Philippe Antoine 3cb873e3bc ci: check script eve-parity is working 9 months ago
Philippe Antoine 1df568300c doc/jsonschema: use dnp3_func instead of its alias 9 months ago
Philippe Antoine 273e9f55eb scripts: eve-parity hard fail on unknown keyword 9 months ago
Philippe Antoine f581b8f1ae scripts: complete eve-parity type check 9 months ago
Pierre Chifflier 459e2599c7 configure: fix binary crate name in hint message if bindgen is not found 9 months ago
Philippe Antoine 62fcdf9bff detect: add debug validation check about flags consistency
If a flag is not a uint with a size, it should not have a specific
flag like multi_uint, nor enum nor bitflags
9 months ago
Philippe Antoine 32ce3d29be detect/krb: use flag u32 for krb5_msg_type 9 months ago
Philippe Antoine 8b9a779a16 file: fix hash computation for small multipart files
Ticket: 8119

Fixes: f68e2f5537 ("files: append data on closing even with
FILE_NOSTORE")
9 months ago
Jason Ish 7417cf07f6 github-ci: add schema tests to docs workflow
This will run the schema tests when no code has been modified.
9 months ago
Juliana Fajardini 331bc8aeac schema: add descriptions to global memcaps/memuses
For FTP, Host, IP Pair and HTTP.

Related to
Task #6434
9 months ago
Juliana Fajardini 2855574a2c schema: add additional properties to stats.capture
The `stats.capture` object may have different properties based on the
capture method used.

This adds the ones pertaining to AF_PACKET capture.

Related to
Task #6434
9 months ago
Juliana Fajardini 12e0e51864 schema: add desc for each main stats module
Part of the schema documentation effort.

Related to
Task #6434
9 months ago
Juliana Fajardini 025ffa6135 schema: allow stats.stream event counters
While the counters exist, they're not present in the schema, causing
validation to fail if stats.stream-events is enabled.

Task #7858
9 months ago
Juliana Fajardini 173fec81f8 schema/stats: flow_mgr is actually flow.mgr
The schema accounts for a stats counters group that is a subgroup of the
flows stats counters. Remove `flow_mgr`, thus.
9 months ago
Juliana Fajardini 1647081b29 doc: remove remaining references to pruned flows
These were removed with a5587fec2e but these mentions went under the
radar.
9 months ago
Jhonny Sousa 05a4aaf2c0 util/misc: Change shortening format and add unittests
Ticket: #5583
9 months ago
Jhonny Sousa 626027a456 util/pool: Convert unittests to new FAIL/PASS api
Ticket: #6322
9 months ago
Philippe Antoine 8ca589b5fb detect/tls: get rid of stack allocation
By making the pcre trim the trailing spaces

Ticket: 8001
9 months ago
Philippe Antoine ddb228e839 detect/msg: avoid temporary stack buffer
Just allocate the heap buffer asap and work on it.

Ticket: 8001
9 months ago
Philippe Antoine e3b79c4077 detect/content: avoid temporary stack buffer
Just allocate the heap buffer asap and work on it.

Ticket: 8001
9 months ago
Philippe Antoine 190ae4c6f9 detect/mpm: use fixed constant for stack allocation
instead of smaller run-time value.
Allows easier reading of the code for unbounded stack allocations

Ticket: 8001
9 months ago
Philippe Antoine 71c95fe670 output/frame: remove ifdefed out code
With bad pattern : stack allocation instead of using built-in
jsonbuilder hex printer

Ticket: 8001
9 months ago
Philippe Antoine ca16b4ebf7 detect/parse: debug validation about stack allocation
Ticket: 8001
9 months ago
Philippe Antoine 3337617a5e output: debug validation about stack allocations
Ticket: 8001

For flow variables names
9 months ago
Philippe Antoine 42d6c85757 util/debug: debug validation about stack allocation
Ticket: 8001
9 months ago
Philippe Antoine 6b7c78393c util/classification: check stack allocation size
Ticket: 8001
9 months ago
Philippe Antoine 753ab723b0 datasets: debug validation for stack allocation size
We iterate C substrings of a string whose max size is
SIG_JSON_CONTENT_KEY_LEN

Ticket: 8001
9 months ago
Jason Ish a9eee5dfd9 rust/htp: convert to nom 8
Ticket: #8090
9 months ago
Jason Ish ef9cd7beff rust/smb: convert to nom 8
Ticket: #8089
9 months ago
Jason Ish 02045e1d62 rust/dcerpc: convert to nom 8
Ticket: #8093
9 months ago
Jason Ish 25c98af0e8 rust/detect: convert remaining detection rule parsers to nom 8
Ticket: #8051
9 months ago
Jason Ish dea3f9e260 rust/detect: convert error.rs and dependent parsers to nom 8
Ticket: #8051
9 months ago
Jason Ish efc32dea41 rust/detect: convert uint nom 8
And users of uint directly impacted by this change.

Ticket: #8051
9 months ago
Jason Ish cf604751de rust/util: convert to nom 8
Ticket: #8088
9 months ago
Jason Ish 1e01d5adca rust/conf: convert to nom 8
Ticket: #8087
9 months ago
Jason Ish c6e8932740 rust/asn1: convert to nom 8
Ticket: #8086
9 months ago
Jason Ish 59f8fb30a8 rust/ftp: fix clippy warning
error: implicitly casting the result of `from_raw_parts_mut` to `*mut [u8]`
        --> src/ftp/response.rs:107:31
9 months ago
Jason Ish 745e972348 github-ci: update Rust 1.91 for clippy and "known" stable 9 months ago
Philippe Antoine 9d164d8794 fuzz/conf: bail out on long sequence of scalars
Ticket: 8105
9 months ago
Olusegun Fajobi 785389aa00 detect/analyzer: add more details for flowint keyword
Ticket: 6311
9 months ago
Cheryl Owala 8120d9dc6c detect-pcre: convert unittests to FAIL/PASS API
Convert unittests to new FAIL/PASS API.

Ticket: #6344
9 months ago
Philippe Antoine cba13ed9b1 rust: bindgen functions needed for datasets
Ticket: 7762
9 months ago
Philippe Antoine 12892ba010 rust: bindgen functions neede for features
Ticket: 7762
9 months ago
Philippe Antoine b21c93d789 util/time: fix TimeDifferenceMicros microseconds computation
Ticket: 8073

Currently only used in pcap logging for flushing
9 months ago
Victor Julien 874a0e8d3d unix-socket/hostbits: fix ipv6 address parsing
In `add-hostbit`, `remove-hostbit` and `list-hostbit` commands, the IPv6
address parsing was not using the correct variable:

                 from /usr/include/dirent.h:25,
                 from suricata-common.h:73,
                 from runmode-unix-socket.c:18:
In function ‘inet_pton’,
    inlined from ‘UnixSocketHostbitAdd’ at runmode-unix-socket.c:1316:13:
/usr/include/x86_64-linux-gnu/bits/inet-fortified.h:56:10: warning: call to ‘__inet_pton_chk_warn’ declared with attribute warning: inet_pton called with a destination buffer size too small [-Wattribute-warning]
   56 |   return __glibc_fortify (inet_pton, __sz, sizeof (char),
      |          ^~~~~~~~~~~~~~~
In function ‘inet_pton’,
    inlined from ‘UnixSocketHostbitRemove’ at runmode-unix-socket.c:1403:13:
/usr/include/x86_64-linux-gnu/bits/inet-fortified.h:56:10: warning: call to ‘__inet_pton_chk_warn’ declared with attribute warning: inet_pton called with a destination buffer size too small [-Wattribute-warning]
   56 |   return __glibc_fortify (inet_pton, __sz, sizeof (char),
      |          ^~~~~~~~~~~~~~~
In function ‘inet_pton’,
    inlined from ‘UnixSocketHostbitList’ at runmode-unix-socket.c:1476:13:
/usr/include/x86_64-linux-gnu/bits/inet-fortified.h:56:10: warning: call to ‘__inet_pton_chk_warn’ declared with attribute warning: inet_pton called with a destination buffer size too small [-Wattribute-warning]
   56 |   return __glibc_fortify (inet_pton, __sz, sizeof (char),
      |          ^~~~~~~~~~~~~~~

Bug: #8102.
9 months ago
Victor Julien 3a0f4dde07 thresholds: fix unittest compile warning
In file included from decode.h:33,
                 from host.h:27,
                 from util-threshold-config.c:34:
util-threshold-config.c: In function 'SCThresholdConfInitContext':
util-debug.h:260:5: warning: '%s' directive argument is null [-Wformat-overflow=]
  260 |     SCLogErr(SC_LOG_WARNING, __FILE__, __FUNCTION__, __LINE__, _sc_module, __VA_ARGS__)
      |     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
util-threshold-config.c:190:9: note: in expansion of macro 'SCLogWarning'
  190 |         SCLogWarning("Error loading threshold configuration from %s", filename);
      |         ^~~~~~~~~~~~
util-threshold-config.c:190:66: note: format string is defined here
  190 |         SCLogWarning("Error loading threshold configuration from %s", filename);
      |                                                                  ^~
9 months ago
Jason Ish 6bd360570a dnp3: fix dnp3 generation script to match code 9 months ago
Jeff Lucovsky e1bf5cb1f3 nfs: Support EXCLUSIVE4_1 flag
Issue: 8006

Support the EXCLUSIVE4_1 create mode added to NFS 4.1
9 months ago
Philippe Antoine deb5926609 fuzz: increase some config values
To get better coverage and bug findings

Ticket: 8068
9 months ago
Philippe Antoine a07390573f fuzz: default conf with verdict enabled in alerts 9 months ago