Issue: 7814
Support unique flow variable names for entropy-related values.
Since this is a breaking change from Suricata 8, unique names
are configurable (default value off) with this setting
logging:
entropy:
make-unique: on
When `make-unique` is on, entropy-related flow variable names are
structured as:
sid:<sid>;buffer:<buffer>;instance:<instance>
Instance is a small integer value corresponding to the number of
entropy values in the rule. The first entropy usage will create a flow
variable with an instance value of 1; the second will use 2, and so
on. This is necessary to disambiguate the flow variable names.
When `make-unique` is off (default = off), this format is used:
<sticky_buffer>
Issue: 8035
The `luaxform` transform doesn't support the `init` function. This
commit removes that from the example and clarifies how functions in the
Lua script are used.
Instead of indexing `Packet::alerts` to find out if the action should
be `ACTION_PASS`, add an arguement to make this explicit from the alert
logging logic.
Bug: #7630.
Pass-only rules were previously stored in Packet::alerts, but not
correctly. The `cnt` wasn't incremented leaving it in a weird state.
This patch changes the logic to have a `pass` entry be added to the
queue as well as incrementing the `cnt`. As a consequence of this the
alert logging needs to explicitly check for `PacketAlert::action` having
`ACTION_ALERT` set now.
Update the alert loggers.
Bug: #8021.
ACTION_ALERT is supposed to be set now, but wasn't for rate_filter.
This becomes important in a follow up patch where only PacketAlert
entries with `action` `ACTION_ALERT` are logged in alert logging.
Ticket: 7980
Usage of Vec<u8> instead of Box<u8> gave the ability to callers
to grow the buffer (indefinitely)
This was regressed in 16fee33368
Additionnaly, use rust WriteZero instead of WouldBlock as a more
fitting error when cursor is full, as that error kind is the
one tested by callers.
Realloc alp_ctx.ctxs when a dynamic alproto is registered and
g_alproto_max increases. So dynamic alproto can be treated as
real/normal ones. And app-layer switch can be set to any value
of no/deteciton-only/yes.
Ticket: 8000
VarNameStoreRegister can return 0 in case of any error conditions.
Handle this case in all the users of this function. It is an unlikely
event so add branch assistance accordingly.
Bug 8054
Most call sites use a casula SCFree fn to get rid of the DetectXbitsData
in case of an error. However, if a varname is also registered, that must
be unregistered too. Fix all the free calls by replacing them with the
appropriate DetectXbitFree fn.
The fn DetectFlowvarDataFree checks if the pointer (DetectFlowvarData)
passed to it is valid. So, the checks for NULL in the call sites can
safely be removed.
The fn DetectFlowintFree checks if the pointer (DetectFlowintData)
passed to it is valid. So, the checks for NULL in the call sites can
safely be removed.
In case of an error a varname id is set to 0. Ideally, it shouldn't be
found in the hash table lookup but add a check anyway to avoid obtaining
the mutex lock and performing the lookup.
The install command, by default, sets 0755 if -m is not specified, so the
file python/suricata/config/defaults.py will be marked as an executable,
though it isn't.
Jeff Lucovsky
Jason Ish
Philippe Antoine
Victor Julien
Li Heng
Ezra Adeyinka
Shivani Bhardwaj
Andreas Dolp
dependabot[bot]