suricata

Commit Graph

Author	SHA1	Message	Date
Alice Akaki	90aab0d62f	detect: add email.from email.from matches on MIME EMAIL FROM This keyword maps to the EVE field email.from It is a sticky buffer Supports prefiltering Ticket: #7592	2 years ago
Alice Akaki	90cf59ac71	rustfmt: rust/src/mime/smtp.rs	2 years ago
Joyce Yu	1c50de4ad0	Eve: use mac addresses from flow for flow timeout Ethernet metadata is missing for events triggered on flow timeout pseudopackets. Use the first set of mac addresses stored with the flow to fill in the ether field. Ticket: #5486	2 years ago
Joyce Yu	dac0d6371e	Doc: update eve-json-output ethernet description Document getting mac addresses from flow when flow timeout.	2 years ago
Victor Julien	749ffbd06a	af-packet: use actual snaplen in bpf Avoids setting a 0 snaplen in BPF, leading to an error. Fixes: `b8b6ed550a` ("af-packet: delay setting default-packet-size for af-packet") Ticket: #7618.	2 years ago
Victor Julien	c6fdf99cec	datasets: work around scan-build warning datasets.c:493:27: warning: Dereference of null pointer [core.NullDereference] 493 \| DEBUG_VALIDATE_BUG_ON(set->hash->config.hash_size != hashsize); \| ^~~~~~~~~~~~~~~~~~~~~~~~~~~ ./util-validate.h:95:44: note: expanded from macro 'DEBUG_VALIDATE_BUG_ON' 95 \| #define DEBUG_VALIDATE_BUG_ON(exp) BUG_ON((exp)) \| ^~~ ./suricata-common.h:307:36: note: expanded from macro 'BUG_ON' 307 \| #define BUG_ON(x) assert(!(x)) \| ^ /usr/include/assert.h:109:7: note: expanded from macro 'assert' 109 \| ((expr) \ \| ^~~~ 1 warning generated.	2 years ago
Shivani Bhardwaj	be372ce39d	doc: explain priority port setting Ticket 7329	2 years ago
Shivani Bhardwaj	040c694256	doc: format and align suricata.yaml section	2 years ago
Juliana Fajardini	3985b24e1b	upgrade: list inspection recursion default limit As the yaml indicated before that if no value was specified there were no limits, and now there will be one.	2 years ago
Juliana Fajardini	e1f9e66af0	doc/upgrade: add datasets hash size limit note	2 years ago
Philippe Antoine	a7713db709	detect: add configurable limits for datasets Ticket: 7615 Avoids signatures setting extreme hash sizes, which would lead to very high memory use. Default to allowing: - 65536 per dataset - 16777216 total To override these built-in defaults: ```yaml datasets: # Limits for per rule dataset instances to avoid rules using too many # resources. limits: # Max value for per dataset `hashsize` setting #single-hashsize: 65536 # Max combined hashsize values for all datasets. #total-hashsizes: 16777216 ```	2 years ago
Victor Julien	d32a39ca4b	datasets: improve default hashsize handling Make hashsize default local to dataset code, instead of relying on the thash code. Use the same default value as before.	2 years ago
Jason Ish	c6d18fc871	doc/userguide: af-packet upgrade notes Add note about increased block size and how to change it back to old defaults if needed. Ticket: #7458	2 years ago
Jason Ish	b8b6ed550a	af-packet: delay setting default-packet-size for af-packet AF_PACKET needs more information about its configuration before we can set the default packet size, so on startup, leave unset in suricata.c if in AF_PACKET mode. If defrag is enabled, use a default packet size of 9k for tpacket-v2. This can still lead to truncation events, then the user can increase their 'default-packet-size'. Tpacket-v3 does not need an increased packet size as it will handle any size of packet that is smaller than the configured block size which now has a default of 128k. 9k for the snap is somewhat arbitrary but is large enough for the common 9000 jumbo frame plus some extra headers including tpacket headers. Ticket: #7458	2 years ago
Jason Ish	8c7ac89791	af-packet: warn that tpacket-v3 is better for non-inline usage Ticket: #7458	2 years ago
Jason Ish	d78f2c9a4e	af-packet: add event for packets truncated by af-packet Ticket: #7458	2 years ago
Jason Ish	9f96975d55	af-packet: warn if v3 block size is not large enough for defrag If using tpacket-v3 and defrag, warn if the block size is not large enough for a fully defragmented packet. Ticket: #7458	2 years ago
Jason Ish	320ef7b617	af-packet: warn if v2 block size not large enough for defrag If using tpacket-v2, defrag and a user provided v2-block-size, warn if the block size is not large enough to hold one fully defragmented packet. Ticket: #7458	2 years ago
Jason Ish	5871c6458c	af-packet: make tpacket-v2 block size configurable With the change of the default tpacket-v2 block size from 32k to 128k, allow it to be configurable for users who may want to make it larger, or revert it back to the pre 7.0.9 default of 32k. Ticket: #7458	2 years ago
Jason Ish	c342b054f4	af-packet: increase default block size Increase the default block size from 32k to 128k. This allows for a fully defragmented packet to fit in the buffer. Ticket: #7458	2 years ago
Jason Ish	808502d5ca	af-packet: warn if defrag not suitable for mode AF_PACKET defrag should not be used for inline modes. Its possible that a packet received could be larger than can be set when defrag is enabled, so warn if disabled for inline use. Likewise, warn if defrag is disabled for IDS use, or non-inline mode. Ticket: #7458	2 years ago
Jason Ish	25d0fba912	af-packet: check defrag value even if cluster-type not set If cluster-type was not set we default to "cluster_flow" with defrag always on. Instead check for defrag value and disable defrag if disabled by the user. Ticket: #7458	2 years ago
Philippe Antoine	32d0bd2bbb	detect: limit base64_decode `bytes` to 64KiB Ticket: 7613 Avoids potential large per-thread memory allocation. A buffer with the size of the largest decode_base64 buffer size setting would be allocated per thread. As this was a u32, it could mean a per-thread 4GiB memory allocation. 64KiB was already the built-in default for cases where bytes size wasn't specified.	2 years ago
Philippe Antoine	b9b797f1f4	detect: non infinite default value for inspection-recursion-limit So that empty config are protected by this setting as was intended. Set to unlimited for fuzz testing.	2 years ago
Philippe Antoine	b14c67cbdf	detect/pcre: avoid infinite loop after negated pcre Ticket: 7526 The usage of negated pcre, followed by other relative payload content keywords could lead to an infinite loop. This is because regular (not negated) pcre can test multiple occurences, but negated pcre should be tried only once.	2 years ago
Jason Ish	66e47a1983	rust: pin once_cell to work with Rust 1.67.1 Clap uses once_cell which recently released v1.20 which updated its MSRV to 1.70. Locally pin once_cell to 1.20.3 to maintain our MSRV.	2 years ago
Victor Julien	559e4ce062	pcap: skip pcap-config if pkgconfig in use	2 years ago
Victor Julien	2aceb9b76f	detect/action: minor action parsing cleanup Preparation for explicit action scope parsing.	2 years ago
Victor Julien	fa9dbe3970	detect/loader: minor code cleanup	2 years ago
Victor Julien	ce26159a03	detect: constify rule file and lines in parsing and analyzer	2 years ago
Victor Julien	c65756a38c	tls: fix handshake handling being too strict e.g. server hello done has no data	2 years ago
Victor Julien	f5e4c52f44	app-layer: constify AppLayerGetProtoByName	2 years ago
Victor Julien	b5cd1e578b	detect/tls: don't double register tls_validity generic list	2 years ago
Victor Julien	c1155e473d	detect/nfs: don't double register nfs_request generic list	2 years ago
Victor Julien	7cafdfac11	detect: don't register duplicate app inspect engines	2 years ago
Victor Julien	b649252059	detect/analyzer: add policy Example output: "match_policy": { "actions": [ "alert", "drop" ], "scope": "flow" },	2 years ago
Victor Julien	609a59a529	smtp/events: set direction on rules Several rules matched on both directions even if events are set in a single direction.	2 years ago
Jason Ish	3658d502ff	github-ci: don't run builds on PR if only docs changed	2 years ago
Jason Ish	ed30e95a09	github-ci: stop caching system packages	2 years ago
Victor Julien	fbfeea752a	lua: remove script_api_ver Not documented and never set to new values despite updates. Ticket: #7492.	2 years ago
Victor Julien	0f13908b72	contrib: remove suri-graphite Built for py2. Remove now empty contrib dir. Ticket: #6888.	2 years ago
Victor Julien	1c386e64ce	contrib: remove file_processor Has been developed for a now obsolete file log format. Ticket: #6888.	2 years ago
Victor Julien	99f151c907	detect/dcerpc.iface: remove commented out unittest	2 years ago
Victor Julien	b8ed01e23e	eve/schema: map tls fields to keywords	2 years ago
Shivani Bhardwaj	fc1dbf6eb4	schema: add rule keyword mapping for dcerpc	2 years ago
Juliana Fajardini	d8523d9d97	userguide/header-keywords: fix typos, adjust format	2 years ago
Juliana Fajardini	28407b2fb8	doc/rule-types: remove trailing underscore And other minor fixes that were overseen.	2 years ago
Juliana Fajardini	4a8da8c448	userguide/suricatactl: use suricata community page We were mentioning "Suricata Support" page, which could be a bit misleading -- and also used a link that is actually redirected to the Suricata Community page, anyways.	2 years ago
Jason Ish	5718d5c0fa	github-ci: pin rust version for clippy tests Prevents CI breakage after a new Rust release until we're ready to make the changes.	2 years ago
Jason Ish	cbc296f313	github-ci: update rpm builder to fedora 41	2 years ago

1 2 3 4 5 ...

16913 Commits (90aab0d62fe74cd299af6d0182941798e863bb4e) All Branches Search

16913 Commits (90aab0d62fe74cd299af6d0182941798e863bb4e)

All Branches