19464 Commits (928ac012156fb8d393ce5ac4a496fde3c2e87b00)

 

All Branches   

Search

Author	SHA1	Message	Date
dependabot[bot]	8002b59993	github-actions: bump actions/checkout from 6.0.2 to 7.0.0 ... Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Commits](https://github.com/actions/checkout/compare/v6.0.2...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2 months ago
dependabot[bot]	0a2b024317	github-actions: bump vmactions/freebsd-vm from 1.4.6 to 1.5.0 ... Bumps [vmactions/freebsd-vm](https://github.com/vmactions/freebsd-vm) from 1.4.6 to 1.5.0. - [Release notes](https://github.com/vmactions/freebsd-vm/releases) - [Commits](a6de9343ef...5a72679103) --- updated-dependencies: - dependency-name: vmactions/freebsd-vm dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2 months ago
dependabot[bot]	7a419071c8	github-actions: bump actions/cache from 5 to 6 ... Bumps [actions/cache](https://github.com/actions/cache) from 5 to 6. - [Release notes](https://github.com/actions/cache/releases) - [Commits](https://github.com/actions/cache/compare/v5...v6) --- updated-dependencies: - dependency-name: actions/cache dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2 months ago
Philippe Antoine	aa59bb040b	detect: allocate array on the heap, with a dedicated struct ... buffer_type_id is a u32 We have a list per buffer of a list of AppProto But the list of AppProto can grow maximum for the case of file.data to all the alprotos supporting files. Ticket: 8001	2 months ago
Lukas Sismis	376db8fc6b	ci: upgrade FreeBSD Python package to 3.12 ... FreeBSD upgraded the default Python package to 3.12. With that the pip packages also updated to the new version.	2 months ago
Philippe Antoine	2205761bf6	doc: add missing "value" to entropy examples ... Commit from Hydraze	2 months ago
Jason Ish	e7e837c6af	psl: update to latest version ... Ticket: #8147	2 months ago
Victor Julien	c1392d99a3	http/xff: harden code against http in detection-only	2 months ago
Victor Julien	c01aa71b56	app-layer: treat pstate as non-NULL ... In almost every case, if there is a alstate there is also a pstate. So remove the conditional pstate handling, and replace it by unconditionally using the pointer. Add debug validation to make sure the assumption is and stays correct. Explicitly handle the one exception in AppLayerParserParse, which follows an error before the pstate is allocated, or when pstate allocation itself fails.	2 months ago
Victor Julien	7cc25599de	app-layer: enforce pstate as non-NULL	2 months ago
Victor Julien	f4f521272a	app-layer: cleanup inspect id getter ... Since pstate can't be NULL, remove the conditional logic.	2 months ago
Victor Julien	5a770adc27	app-layer/parser: remove misleading comment ... Fixes: 833a738dd1 ("http: fail tx creation if we cannot allocate user data")	2 months ago
Victor Julien	280a1e5a59	app-layer: minor code cleanup for GetStateProgress ... It used the alstate name where it meant tx.	2 months ago
Victor Julien	7fe8f63a89	detect/parse: tighten hook parsing ... Don't allow trailing :	2 months ago
Victor Julien	f8daaac096	detect/file: rename file registration type	2 months ago
Victor Julien	0123cfd9ca	detect/file.data: reduce scope for MPM datatype	2 months ago
Victor Julien	5ae427b146	detect/file: minor cleanup ... Rename progress vars.	2 months ago
Victor Julien	0e3c946836	detect/file: remove unused registration fields	2 months ago
Victor Julien	d81be73ba3	htp: remove duplicate entries in the event table	2 months ago
Philippe Antoine	17dc065326	ci: check uint keywords with their size ... So, that if a keyword advertises uint16, it can indeed parse a uint16 and is not just a uint8	3 months ago
Philippe Antoine	399ee1e360	ci: check multi uint keywords ... Ticket: 7929	3 months ago
Philippe Antoine	3b994e807d	detect/mqtt: bitflags do not support multi integer ... Ticket: 7929 As both syntaxes share comma as delimiter	3 months ago
Philippe Antoine	9bf9d53c42	detect/sctp: sctp.chunk_type does not support multi integer ... Ticket: 7929 As it supports prefilter	3 months ago
Philippe Antoine	06855cd832	detect/nfs: nfs_procedure does not support multi integer ... Ticket: 7929	3 months ago
Philippe Antoine	4649bb3838	detect/file: filesize does not support multi integer ... Ticket: 7929	3 months ago
Philippe Antoine	cb0ecb1722	detect/krb5: msg_type is not a multi integer ... Ticket: 7929 There is only one msg_type by tx	3 months ago
Philippe Antoine	be4c036071	detect/enip: status are not multi integers ... Ticket: 7929	3 months ago
Philippe Antoine	e08a19a88a	detect/enip: cip_class and cip_instance are now a multi-integer ... Ticket: 7929 One commit as they share the same code	3 months ago
Philippe Antoine	0bdfe3f571	detect/enip: cip_attribute keyword is now a multi-integer ... Ticket: 7929	3 months ago
Jeff Lucovsky	5af13e3eb0	rdp: mark transactions single-directional ... Mark the direction into RDP transactions at creation time, so the tx carries SKIP_INSPECT for the direction it is never seen in, matching DHCP and the other single-direction parsers. This lets cleanup free completed transactions and stops a tx from being inspected (and alerting) twice, once per direction. RDP bounds its transactions to connection setup and stops parsing once bypass_parsing is set. Issue: 8621	3 months ago
Jeff Lucovsky	3f86c56c80	dhcp: mark transactions single-directional to fix tx leak ... DHCP is a stateless parser where each datagram is its own standalone, single-direction transaction. It was creating transactions with AppLayerTxData::new(), which leaves both SKIP_INSPECT bits clear, so the engine treats every tx as still needing inspection in both directions. For a flow that only ever carries one direction (broadcast DHCP, or a relay seeing one side), the never-observed direction's inspect bit can never be set, so AppLayerParserTransactionsCleanup() never frees the tx. The per-flow transaction Vec then grows without bound and every packet re-scans the whole list, giving O(n^2) CPU and unbounded memory on a busy DHCP aggregation point. Use AppLayerTxData::for_direction() like every other stateless parser (DNS, SNMP, NTP, IKE, KRB5, MQTT, QUIC, SIP, WebSocket, bittorrent-dht) so the tx carries SKIP_INSPECT for the direction it will never be seen in. This lets cleanup free completed transactions and also stops the tx from being inspected (and alerting) twice, once per direction. Issue: 8621	3 months ago
Philippe Antoine	a6fcbb1ab7	flow: factorize duplicated code for hashing	3 months ago
Philippe Antoine	fe728d97d8	flow: use livedev for ftp-hash ... Completes commit 7e725c650d autofp-scheduler with value ftp-hash ends up using FlowGetIpPairProtoHash which ignores the ports for ftp-looking flows so that the ftp and ftp-data flow get processed by the same thread. As for the other cases, we want to use every other parameter to compute the flow hash, inclusing the live device	3 months ago
Philippe Antoine	f4388d45c6	ebpf: remove unused macro	3 months ago
Philippe Antoine	2ee4ef0ec5	features: add EBPF as a feature ... for SV to run tests based on the presence of this feature	3 months ago
Philippe Antoine	ee9b48493b	ebpf: factorize duplicated code for key setting	3 months ago
Philippe Antoine	09f0851043	detect/krb5: fix doc about cname and sname keywords ... These keywords match only in to_client direction, even if the fields are logged in both directions	3 months ago
Philippe Antoine	a81031591e	detect/krb5: move krb5.ticket_encryption to rust ... Ticket: 8648	3 months ago
Philippe Antoine	8f0dbc0b63	detect/krb5: move krb5.cname and krb5.sname to rust ... Ticket: 8648	3 months ago
Philippe Antoine	3327cf42f0	detect/krb5: move krb5_err_code to rust ... Ticket: 8648 Make it a generic integer on the way	3 months ago
Jason Ish	e560db9d1f	ftp: don't match unset ftp.dynamic_port ... Treat dyn_port 0 as an absent value so numeric comparisons do not match FTP transactions without a negotiated data port. Ticket: #8392	3 months ago
Jason Ish	dd600d0860	ftp: mark ftp.reply as firewall supported ... Ticket: #8392	3 months ago
Jason Ish	c6ec50ab6f	ftp: mark ftp.command_data as firewall supported ... Ticket: #8392	3 months ago
Jason Ish	1f30641a83	ftp: mark ftpbounce as firewall supported ... Ticket: 8392	3 months ago
Jason Ish	974241aa50	ftp: mark ftp.reply_received as firewall supported ... Ticket: #8392	3 months ago
Jason Ish	f59960d42b	ftp: support STOU data transfers ... Support STOU on the FTP data channel. With STOU a filename is optional. If no filname is provided, use "<stou>". The server does respond with the filename to use, but there can be a race condition in getting this filename and setting up file storage before data starts flowing. Ticket: #8664	3 months ago
Jason Ish	e65bf4c905	ftp: support APPE data transfers ... Support the APPE (append) command on the ftp data channel. Like STOR, APPE uploads file content on the data channel. Ticket: #8664	3 months ago
Jason Ish	5856ced29c	ftp: support LIST and MLSD data channels ... Support LIST and MLSD on the ftp data channel. Ticket: #8664	3 months ago
Jason Ish	be94ab952a	ftp: register ftp.mode at response_complete ... Also mark as supported by the firewall. Ticket: #8392	3 months ago
Jason Ish	fc1546e25e	ftp: register ftp.completion_code at response_complete ... Ticket: #8392	3 months ago