Fix parsing of content like "|aa b cc|" which was parsed as "|aa bc|"
without error or warning. This will now fail out, requiring all hex
values to be 2 chars.
Ticket #5201
(cherry picked from commit 8d1e4a1d0b)
If there is a space following a keyword that does not expect a value,
the rule fails to load due to improper value evaluation.
e.g. Space after "set" command
alert http any any -> any any (http.user_agent; dataset:set ,ua-seen,type string,save datasets.csv; sid:1;)
gives error
[ERRCODE: SC_ERR_UNKNOWN_VALUE(129)] - dataset action "" is not supported.
Fix this by handling values correctly for such cases.
(cherry picked from commit 6d2a2a0731)
Since:
9551cd0535 ("threading: don't pass locked flow between threads")
`MoveToWorkQueue()` unconditionally unlocks the flow. This allows simpler
locking handling, including of tcp reuse flows.
The simpler logic also fixes a scenario where TCP reuse flows got "unlocked"
twice, once in `FlowGetFlowFromHash()` and once in `MoveToWorkQueue()`.
Bug: #5248.
Coverity: 1494354.
(cherry picked from commit 57533d3e47)
Issue: 4550
This commit modifies the "stack trace on signal" to propagate the
original signal received instead of always raising SIGABRT.
(cherry picked from commit a3443845fb)
Issue: 4973
This commit makes stack-trace on fault configurable by
adding "--enable-libunwind" as a configure option.
By default, or if "--enable-libunwind=no" is specified, the libunwind
library will not be configured.
When "--enable-libunwind=yes" is specified, libunwind will be used iff
it can be found in one of the standard library locations.
This commit adds a signal handler for SIGSEGV when configured. The
signal handler emits a one line stack trace using SCLogError. The intent
is to provide diagnostic information in deployments where core files are
not possible.
The diagnostic message is from the offending thread and includes the
stack trace; each frame includes the symbol + offset.
(cherry picked from commit 7f0f463b64)
This commit adds a configuration setting to enable a stack trace message
if Suricata receives a signal that terminates execution, such as
SIGSEGV, SIGABRT.
(cherry picked from commit 163f70be9d)
This commit adds an error code for the diagnostic code used for
diagnostic messages following unexpected termination due to signals..
(cherry picked from commit 501c870a2c)
This commit adds support for enabling libunwind -- a library that can be
used to display stack information.
Libunwind is enabled and used by Suricata if present during
configuration. A diagnostic message is displayed if libunwind
cannot be found.
(cherry picked from commit 303dd29b50)
The current code doesn't cover all rows when more than one flow manager is
used. It leaves a single row between ftd->max and ftd->min of the next
manager orphaned. As an example:
hash_size=1000
flowmgr_number=3
range=333
instance ftd->min ftd->max
0 0 333
1 334 666
2 667 1000
Rows not covered: 333, 666
(cherry picked from commit 8ef066318d)
With this check, on the first packet of a certificate presenting
a length of 16Mbytes, we only allocate up to 65Kb
When we get to the point where need more than 65Kb, we realloc
to the true size.
With this check, it makes it more expensive for an attacket to use
this allocation as a way to trigger ressource exhaustion...
(cherry picked from commit 862e84877f)
As is done for other targets,
so that all app-layer protocols are enabled,
even the ones disabled by default such as enip
And resets protocol detection every time we try
so that probing_parser_toserver_alproto_masks are fresh.
(cherry picked from commit 09c84d0c26)
Ticket: 4948
This is not the perfect solution, but it prevents to trigger
the assert, and keep the assert.
A better solution would need to create transaction from
the reponse parsing, in case a later command was buffered and
not answered. But this would not be enough as NoNewTx prevents
the creation of a new transaction for RSET...
(cherry picked from commit 4247605d87)
Instead of closing files in both direction when receiving a close request,
close only toserver files for the request and close toclient on receiving
a response.
(cherry picked from commit b336882008)
This commit eliminates the dependency on /etc/protocols and equivalent
on other platforms by using a static table of IANA assigned protocol
values (names, description).
(cherry picked from commit e77e8dbe18)
Issue: 4550
This commit adjusts the per-thread stack size if a size has been
configured. If the setting has not been configured, the default
per-thread stack size provided by the runtime mechanisms are used.
(cherry picked from commit 6232c94235)
Issue: 4550
This commit checks if there's a config setting for threading.stack-size
and assigns the value to a global variable for use during thread
creation.
(cherry picked from commit e4d60f451b)
This commit adds a probe for a non-portable function to be used in
diagnostic debug display of a thread's stack size.
(cherry picked from commit deb49862cd)
Issue: 4550
This commit documents the new per-thread stack-size setting. Some
systems have a small default value that is not suitable for Suricata's
multi-threaded architecture and adjustment may be required.
(cherry picked from commit 117e11b0ae)
This commit raises an error in configuration test mode if there was an
error parsing reference.config.
Issue: 4659
(cherry picked from commit be2155b4ed)
When running with privilege dropping, the application log file
is opened before privileges are dropped resulting in Suricata
failing to re-open the file for file rotation.
If needed, chown the application to the run-as user/group after
opening.
Ticker #4523
(cherry picked from commit 59ac1fe277)
Initialize the run-as user info after loading the config, but
before setting up logging (previously it was done while initializing
signal handlers). This will allow the log file to be given the
correct permissions if Suricata is configured to run as a non-root
user.
(cherry picked from commit 08518df373)
Separate the code paths between reusing a Packet stored host reference
and fetching a new reference from the host hash.
This addresses the issue where in some conditions use_cnt could get
desync'd.
Bug: #2802.
(cherry picked from commit 49a36bb323)
Introduce a new util function to free a Hosts iprep code. It also
handles the Host use_cnt decrement.
This change makes sure we also decrement the use_cnt when cleaning
up when shutting down the host table.
Move the BUG_ON check for use_cnt into the HostClearMemory() func
to check it in more cases.
(cherry picked from commit 172d2b28a5)
Only accept netmask in dotted quad notation if they can be turned
into a CIDR.
According to rfc 4632, CIDR (compat) netmasks are all that should be
used.
Bug: #5168.
(cherry picked from commit 79b7b7a0dd)
Only accept netmask in dotted quad notation if they can be turned
into a CIDR.
According to rfc 4632, CIDR (compat) netmasks are all that should be
used.
Bug: #5168.
(cherry picked from commit 259bd8aa92)
Philippe Antoine
Jason Ish
Shivani Bhardwaj
Victor Julien
Jeff Lucovsky
Arne Welzel
Steven Ottenhoff