18312 Commits (9095eb9b228192d5a67419fd69cf51716217108c)

 

All Branches   

Search

Author	SHA1	Message	Date
Philippe Antoine	af8390f2ca	doc: upgrade note for engine-analysis breaking change ... For keywords that now use the generic integer framework Ticket: 7889	9 months ago
Philippe Antoine	d94aea8331	detect: tcp.window is now a generic integer ... Ticket: 7889	9 months ago
Philippe Antoine	68bb783e97	detect: tcp.seq is now a generic integer ... Ticket: 7889	9 months ago
Philippe Antoine	ed907bbd78	detect: tcp.ack is now a generic integer ... Ticket: 7889	9 months ago
Philippe Antoine	7a8eb28cae	detect: id is now a generic integer ... Ticket: 7889	9 months ago
Philippe Antoine	bff7413488	detect: icmp_seq is now a generic integer ... Ticket: 7889	9 months ago
Philippe Antoine	79e66f76e6	detect: icmp_id is now a generic integer ... Ticket: 7889	9 months ago
Philippe Antoine	09531447d1	detect: fragoffset is now a generic integer ... Ticket: 7889	9 months ago
Philippe Antoine	85fa894425	detect: dnp3.func is now a generic integer ... Ticket: 7889	9 months ago
Jason Ish	70a2524d95	ci: update ndpi to 4.14	9 months ago
Jeff Lucovsky	b02d9bb4f1	doc/luaxform: Remove init function from example ... Issue: 8035 The `luaxform` transform doesn't support the `init` function. This commit removes that from the example and clarifies how functions in the Lua script are used.	9 months ago
Victor Julien	558ab73a7f	doc/devguide: explain alert logging changes	9 months ago
Victor Julien	d45bdb85d5	eve/verdict: more explicit pass handling ... Instead of indexing `Packet::alerts` to find out if the action should be `ACTION_PASS`, add an arguement to make this explicit from the alert logging logic. Bug: #7630.	9 months ago
Victor Julien	5b19508661	detect/alert: fully add pass-only rules to alert queue ... Pass-only rules were previously stored in Packet::alerts, but not correctly. The `cnt` wasn't incremented leaving it in a weird state. This patch changes the logic to have a `pass` entry be added to the queue as well as incrementing the `cnt`. As a consequence of this the alert logging needs to explicitly check for `PacketAlert::action` having `ACTION_ALERT` set now. Update the alert loggers. Bug: #8021.	9 months ago
Victor Julien	2a7eb5d062	detect/threshold: set missing alert flag in rate_filter ... ACTION_ALERT is supposed to be set now, but wasn't for rate_filter. This becomes important in a follow up patch where only PacketAlert entries with `action` `ACTION_ALERT` are logged in alert logging.	9 months ago
Victor Julien	bccdb445ff	eve/verdict: clean up packet action checking ... Get action from packet just once.	9 months ago
Philippe Antoine	b8411fcc8d	output/http: log content-type like other headers ... Ticket: 8056 Avoid stack allocation. Do not handle null and ; especially	9 months ago
Philippe Antoine	acc051ac94	unix-socket: return after closing on too long ... Avoids later use after free Ticket: 8063	9 months ago
Philippe Antoine	a84addb771	util/swf: move allocation from stack to heap ... As it can overflow the stack Ticket: 8055	9 months ago
Philippe Antoine	f2b6540c52	htp: bound decompression ... Ticket: 7980 Usage of Vec<u8> instead of Box<u8> gave the ability to callers to grow the buffer (indefinitely) This was regressed in 16fee33368 Additionnaly, use rust WriteZero instead of WouldBlock as a more fitting error when cursor is full, as that error kind is the one tested by callers.	9 months ago
Philippe Antoine	c61f1cb6d0	detect/integers: rename index all1 to all ... And all to all_or_absent Ticket: 7929	9 months ago
Philippe Antoine	eb5a2d646b	detect/vlan: move vlan.id keyword to generic integer ... Ticket: 7929	9 months ago
Li Heng	c141c55bc6	snmp: can be set to detection-only ... Realloc alp_ctx.ctxs when a dynamic alproto is registered and g_alproto_max increases. So dynamic alproto can be treated as real/normal ones. And app-layer switch can be set to any value of no/deteciton-only/yes. Ticket: 8000	9 months ago
Philippe Antoine	439f96dea7	rust: bindgen frames functions ... Ticket: 7667	9 months ago
Philippe Antoine	92c7be1cb6	rust: bindgen SCSRepCatGetByShortname ... Ticket: 7667	9 months ago
Ezra Adeyinka	368ef839de	detect/address: switch tests to FAIL/PASS API ... Ticket: #4023	9 months ago
Shivani Bhardwaj	bb1ed16408	src: check retval of VarNameStoreRegister ... VarNameStoreRegister can return 0 in case of any error conditions. Handle this case in all the users of this function. It is an unlikely event so add branch assistance accordingly. Bug 8054	9 months ago
Shivani Bhardwaj	6b3c21a4e6	detect/xbits: use correct Free fn ... Most call sites use a casula SCFree fn to get rid of the DetectXbitsData in case of an error. However, if a varname is also registered, that must be unregistered too. Fix all the free calls by replacing them with the appropriate DetectXbitFree fn.	9 months ago
Shivani Bhardwaj	13c8724ae0	detect/xbits: remove unneeded cast to check ptr validity	9 months ago
Shivani Bhardwaj	dad883406d	detect/xbits: use calloc to avoid undefined behavior	9 months ago
Shivani Bhardwaj	a23add0194	detect/lua: remove extra NULL check ... The fn DetectLuaFree checks if the pointer (DetectLuaData) passed to it is valid. So, the checks for NULL in the call sites can safely be removed.	9 months ago
Shivani Bhardwaj	71339c459e	detect/flowvar: remove extra NULL check ... The fn DetectFlowvarDataFree checks if the pointer (DetectFlowvarData) passed to it is valid. So, the checks for NULL in the call sites can safely be removed.	9 months ago
Shivani Bhardwaj	7c9fad27fc	detect/flowint: clean up free fn	9 months ago
Shivani Bhardwaj	bc8bf865ae	detect/flowint: remove extra NULL check ... The fn DetectFlowintFree checks if the pointer (DetectFlowintData) passed to it is valid. So, the checks for NULL in the call sites can safely be removed.	9 months ago
Shivani Bhardwaj	59944c7787	detect/flowint: use calloc to avoid undefined behavior	9 months ago
Shivani Bhardwaj	e5994deb23	util/varname: check id before unregister ... In case of an error a varname id is set to 0. Ideally, it shouldn't be found in the hash table lookup but add a check anyway to avoid obtaining the mutex lock and performing the lookup.	9 months ago
Victor Julien	ec65fd430e	exception-policy: rename 'reject-both' to 'rejectboth' ... To align it with the rule action.	9 months ago
Andreas Dolp	fcbae97a1f	python/Makefile.am: fix file permissions of python/suricata/config/defaults.py ... The install command, by default, sets 0755 if -m is not specified, so the file python/suricata/config/defaults.py will be marked as an executable, though it isn't.	9 months ago
dependabot[bot]	5f138891b2	github-actions: bump github/codeql-action from 3.30.5 to 4.31.2 ... Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.30.5 to 4.31.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Commits](https://github.com/github/codeql-action/compare/v3.30.5...v4.31.2) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.31.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	9 months ago
dependabot[bot]	2609860884	github-actions: bump actions/download-artifact from 5.0.0 to 6.0.0 ... Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 5.0.0 to 6.0.0. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](634f93cb29...018cc2cf5b) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	9 months ago
dependabot[bot]	a6505395c6	github-actions: bump actions/upload-artifact from 4 to 5 ... Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 5. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v4...v5) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	9 months ago
Jason Ish	cdd4ea0f11	doc/devguide: document eve callback ... Document the callback for adding additional data to EVE. Ticket: #4708	9 months ago
Jason Ish	9fffc09ad7	doc/devguide: document eve file types ... Ticket: #4708	9 months ago
Philippe Antoine	7447651fa0	output/jsonbuilder: helper function SCJbSetPrintAsciiString ... To replace C PrintStringsToBuffer and avoid a stack alloc + copy Ticket: 8004	9 months ago
Jason Ish	7e705269e0	requirements.txt: use suricata-update master ... Master makes sense for Suricata main branch as we are on a ways out on a release.	9 months ago
Victor Julien	52fd61dffd	lua: remove luajit pushlstring workaround ... 81ee6f5aad ("lua: push correct length back through ScFlowvarGet, work around valgrind warning") added a workaround for valgrind warnings in pushing a string buffer into the lua state. This is no longer needed as tested with both address sanitizer and valgrind.	9 months ago
Li Heng	1106323ae1	rust/sip: delete redundant computing codes ... Delete call of is_alphanumeric where is_alphanumeric and is_token_char are called together. Four places are modified. Ticket: 8003	9 months ago
Victor Julien	0c4a8fd183	doc/userguide: document reject-both expection policy ... Ticket: #5974.	9 months ago
Victor Julien	acb769291a	exception-policy: add 'reject-both' option ... Allow rejecting both sides of a connection. Has the same support as regular reject (which is essentially rejectsrc). Ticket: #5974.	9 months ago
Juliana Fajardini	6b75b937ff	output/eve: fix typos ... To accompany documentation work done in Task #4708	9 months ago