a1c6328156
output/json: check 5-tuple values prior to logging
...
This commit enhances the JSON output by introducing a feature for conditional port logging.
Now, port logging is dependent on the underlying protocol
(such as TCP, UDP, or SCTP), where port information is pertinent, while it
avoids unnecessary logging for protocols where a port is not utilized (e.g. ARP).
Furthermore, this update ensures that IP addresses and the protocol have
meaningful values set, rather than being logged as empty strings.
These changes will make each log entry more precise, eliminating cases where
5-tuple fields are empty or set to zero, indicating the absence of a field.
2 years ago
987a27923d
output/json: make JSONFormatAndAddMACAddr public
...
This change exposes 'JSONFormatAndAddMACAddr' as a public function,
allowing it to be reused across modules, such as the ARP logger, for logging
MAC addresses extracted from ARP packets.
2 years ago
5219a5da5f
decode/arp: implement decoder
...
This adds a decoder for ARP.
Ticket #6827
2 years ago
12d027f6a2
base64: re-add the check for destination space
...
Cover all the calls to DecodeBase64Block with the check for enough
space. Found by the recently introduced fuzz target.
Bug 7028
Fixes: c0bc43c393
2 years ago
d401082bba
github-actions: set bpf to icmp for af-packet
2 years ago
1240bdd914
github-actions: add pcap live test script and jobs
...
Asan and coverage jobs.
2 years ago
27b6a31a0c
github-actions: unix pcap coverage run
...
To increase code coverage.
2 years ago
ea95aac022
github-actions: add unix socket runmode script and job
...
Runs with ASAN.
2 years ago
40b87bfd04
github-actions: add ASAN enabled Ubuntu 24.04 build of live tests
2 years ago
fcdd7f000a
detect: add options to app-layer-protocol keyword
...
Ticket: 4921
app-layer-protocol keyword accept an optional mode to precise
which protocol we want to match: toclient, toserver, final,
or original
2 years ago
3b5f1173ab
Revert "rust: temporary: disable debug assertions"
...
This reverts commit 14ab9aa763
2 years ago
37a9003736
rust/probing: safety check for null input
...
Ticket: 7013
Done consistently for all protocols
This may change some protocols behaviors which failed early
if they found there was not enough data...
2 years ago
5dc8dea869
rust: return empty slice without using from_raw_parts
...
As this triggers rustc 1.78
unsafe precondition(s) violated: slice::from_raw_parts requires
the pointer to be aligned and non-null,
and the total size of the slice not to exceed `isize::MAX`
Ticket: 7013
2 years ago
edd5507ea4
tests: do not bother to free a null pointer
...
Ticket: #7013
2 years ago
4c33e64d56
github-actions: make sure unix socket is created in dpdk tests
2 years ago
8e320449f6
github-actions: expand af-packet live test with more unix commands
2 years ago
d02c57bd1f
hostbits: release use_cnt for unix (add|remove)-hostbit
...
Commands would leave use_cnt incremented, never decrementing them. This
would lead to a asserting triggering at shutdown.
Bug: #7020 .
2 years ago
bc2dfe4c17
device: don't crash on unix command 'iface-bypassed-stat'
...
In the default config iface bypass support is not enabled,
and storage API not initialized for it. Using it will lead to a crash.
This commit first checks if the device storage API is initialized.
Bug: #7022 .
2 years ago
806052d762
websocket: fix opcodes values for ping/pong
...
And also set close
Ticket: 7025
2 years ago
8b103ae755
dns: set tx id for frames
2 years ago
715bf048ee
frames: rust API makes tx_id explicit
...
And set it right for SIP and websocket,
so that relevant tx app-layer metadata gets logged.
Ticket: 6973
2 years ago
9e01956e77
detect: log relevant frames app-layer metadata
...
Ticket: 6973
Completes commit 2b4e10224e
2 years ago
2e6777c8e3
fuzz: add target for DecodeBase64
...
Task 6050
2 years ago
6d92596548
doc: add note about fast_pattern w base64_data
...
Bug 5220
2 years ago
363050616a
base64_data: reject fast_pattern use
...
If a rule has fast_pattern on base64_data, it is anyway not applied, so,
consider any such rules invalid.
Bug 5220
2 years ago
cb56752bf7
config/ja3: Eliminate warnings when JA3 is disabled
...
This commit eliminates warnings when either ja3, ja4 or both are
disabled.
2 years ago
14ab9aa763
rust: temporary: disable debug assertions
2 years ago
f7eb94a6c0
github: update pull request template
...
Update the pull request template to suggest providing a link to the
SV/LIBHTP pull request as this aides in cross linking.
Also change the way to provide the link to the Redmine ticket, as it
often results in linking to our Redmine, and add a checkbox for the
creation of a ticket.
2 years ago
cec1c9d853
bundle.sh: accept more forms of a branch name
...
For GitHub, add the following branch name formats:
- https://github.com/OISF/libhtp/pull/123
- OISF/libhtp#123
2 years ago
abb74245cc
doc: update normalization notes
...
Ticket: #6781
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
5dacf4d92b
doc: add http.connection ref and fix location
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
329ac61961
eve/stats: add description for ips
...
Ticket 6434
2 years ago
861ffff972
eve/stats: add description for transactions
...
Ticket 6434
2 years ago
ce4119ae3d
snmp: remove community keyword unit test
...
Ticket: 3725
This test was moved to suricata-verify snmp-community
2 years ago
1297d96592
github-actions: bump actions/upload-artifact from 4.3.1 to 4.3.3
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 4.3.1 to 4.3.3.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](5d5d22a312...65462800fd
2 years ago
f14a4a1bf8
github-actions: bump github/codeql-action from 3.24.9 to 3.25.3
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.24.9 to 3.25.3.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Commits](https://github.com/github/codeql-action/compare/v3.24.9...v3.25.3 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2 years ago
b9fbc5749d
github-actions: bump actions/download-artifact from 4.1.4 to 4.1.7
...
Bumps [actions/download-artifact](https://github.com/actions/download-artifact ) from 4.1.4 to 4.1.7.
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](c850b930e6...65a9edc588
2 years ago
76314cc00e
github-actions: bump codecov/codecov-action from 4.1.1 to 4.3.1
...
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action ) from 4.1.1 to 4.3.1.
- [Release notes](https://github.com/codecov/codecov-action/releases )
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md )
- [Commits](c16abc29c9...5ecb98a3c6
2 years ago
2b80689ee4
github-actions: convert dpdk tests to use script
2 years ago
6edf05cdaa
github-actions: add dpdk ids live test script
2 years ago
ed9ad0048d
github-ci: add af-packet and dpdk codecov builds
...
Adds live tests for DPDK and AF_PACKET, with support for code coverage.
2 years ago
99eaf3943a
util/base64: remove coverity reported dead code
...
New defect(s) Reported-by: Coverity Scan
Showing 1 of 1 defect(s)
** CID 1596621: Control flow issues (DEADCODE)
/src/util-base64.c: 238 in DecodeBase64RFC4648()
________________________________________________________________________________________________________
*** CID 1596621: Control flow issues (DEADCODE)
/src/util-base64.c: 238 in DecodeBase64RFC4648()
232 DEBUG_VALIDATE_BUG_ON(bbidx == B64_BLOCK);
233
234 /* Handle any leftover bytes by adding padding to them as long as they do not
235 * violate the destination buffer size */
236 if (bbidx > 0) {
237 padding = bbidx > 1 ? B64_BLOCK - bbidx : 2;
>>> CID 1596621: Control flow issues (DEADCODE)
>>> Execution cannot reach the expression "3U" inside this statement: "numDecoded_blk = 3U - ((pad...".
238 uint32_t numDecoded_blk = ASCII_BLOCK - (padding < B64_BLOCK ? padding : ASCII_BLOCK);
239 if (dest_size < *decoded_bytes + numDecoded_blk) {
240 SCLogDebug("Destination buffer full");
241 return BASE64_ECODE_BUF;
242 }
243 /* Decode base-64 block into ascii block and move pointer */
Also, add a comment explaining the padding logic for leftover data.
Bug 6985
2 years ago
fcca5c7514
detect/iprep: update doc about 0 value
...
A value of 0 was already allowed by the rule parser, but didn't
actually work.
Bug: #6834 .
2 years ago
64dc217f9f
detect/iprep: allow 0 as a reputation value
...
Rules would allow checking against value 0, but internally the value
was used to indicate "no value". To address this, the internals now
return negative values for not found. This way value 0 can be fully
supported.
Bug: #6834 .
2 years ago
673d27c861
detect/iprep: minor code cleanups
2 years ago
c53e9ac0dd
sdp: fix logging medias
...
As introduced by bff790b6ac
2 years ago
df8568ee30
rust/dns: visibility cleanups
...
Remove pub from functions that don't require it.
2 years ago
556cfe56bf
rust/dns: ffi naming and visibility cleanups
...
- Remove no_mangle and pub from FFI functions that are only accessed
with a function pointer.
- Rename all no_mangle FFI functions to our C naming scheme.
2 years ago
4fedba1140
github-ci: remove cocci from fedora 39 build
...
Cocci on Fedora 39+ gets stuck for some reason. Cocci has been moved
to a new Ubuntu 24.04 build.
2 years ago
1c2402f5e7
github-ci: add ubuntu 24.04 build with cocci
...
Rather basic 24.04 build for now, but use Cocci as Cocci is working
properly here, but not working in the latest Fedora releases.
2 years ago
Giuseppe Longo
Shivani Bhardwaj
Victor Julien
Philippe Antoine
Jeff Lucovsky
Jason Ish
jason taylor
dependabot[bot]