11b2860f23
rust/cargo: ignore RUSTSEC-2026-0009 for time crate
...
cargo audit reports this security issue with the time crate but Suricata
remains unaffected as no influenced fn is used by Suricata.
Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0009
The MSRV for newer time crate versions are higher than the MSRV for
Suricata right now: 1.75.0
Hence, the best course of action is to suppress this warning.
Ticket: 8269
6 months ago
c1d6958940
github-ci: relax block check
6 months ago
0a86b0f79d
github-ci: remove too verbose namespace test output
6 months ago
f3e3795f48
github-ci: relax namespace shutdown error checks
...
Caddy would sometimes return an error during shutdown. Add a warning if
this happens, but don't fail the job.
6 months ago
3a9682fd48
github-actions: bump actions/checkout from 6.0.1 to 6.0.2
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 6.0.1 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases )
- [Commits](https://github.com/actions/checkout/compare/v6.0.1...v6.0.2 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
6 months ago
c533ec0a1d
github-actions: bump github/codeql-action from 4.31.6 to 4.32.0
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.31.6 to 4.32.0.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Commits](https://github.com/github/codeql-action/compare/v4.31.6...v4.32.0 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.32.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
6 months ago
49783fa9f7
github-ci: add namespace based IPS tests
...
Implementing a bridge test with af-packet IPS and a routing test
with iptables + nfqueue.
Very helpful explanation and guidance on network namespaces can be
found here: https://www.redhat.com/en/blog/net-namespaces
Sets up 3 network namespaces:
1. client - for running client tools like ping, curl, wget
2. server - for running a server, currently only Caddy
3. dut - for running Suricata, this namespace connects the client and
server namespaces
Validate IPS operations in 3 ways:
1. check return codes of the client tools
2. check Suricata's IPS stats
3. use tshark to validate expected drops
Run Suricata in AF_PACKET IPS mode for both autofp and workers mode. Do
the same for NFQUEUE.
Tshark's JSON output is used with JQ to validate that pings are dropped.
All tests are codecov enabled.
6 months ago
b944e3b1ed
ci: update rust version to 1.93
7 months ago
a0c91aa9f0
github-actions: bump actions/upload-artifact from 5.0.0 to 6.0.0
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 5.0.0 to 6.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/v5...v6 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: 6.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
7 months ago
2deb1d25c4
github-actions: bump actions/cache from 4 to 5
...
Bumps [actions/cache](https://github.com/actions/cache ) from 4 to 5.
- [Release notes](https://github.com/actions/cache/releases )
- [Commits](https://github.com/actions/cache/compare/v4...v5 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: '5'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
7 months ago
03ee55c99f
github-actions: bump actions/checkout from 6.0.0 to 6.0.1
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 6.0.0 to 6.0.1.
- [Release notes](https://github.com/actions/checkout/releases )
- [Commits](https://github.com/actions/checkout/compare/v6...v6.0.1 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
7 months ago
1f28880ba1
github-actions: bump codecov/codecov-action from 5.5.1 to 5.5.2
...
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action ) from 5.5.1 to 5.5.2.
- [Release notes](https://github.com/codecov/codecov-action/releases )
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md )
- [Commits](5a1091511a...671740ac38
7 months ago
b4ed2da8ff
github-actions: bump actions/download-artifact from 6.0.0 to 7.0.0
...
Bumps [actions/download-artifact](https://github.com/actions/download-artifact ) from 6.0.0 to 7.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](018cc2cf5b...37930b1c2a
7 months ago
984fc260c5
github-ci: update Fedora to 43
8 months ago
3bcad5f364
windivert: upgrade to 2.0.0
...
WinDivert 2 was released in 2019. This introduced some minimal
changes to some functions arguments.
Bug: #8138 .
8 months ago
973ab60a34
github-actions: bump github/codeql-action from 4.31.2 to 4.31.6
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.31.2 to 4.31.6.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Commits](https://github.com/github/codeql-action/compare/v4.31.2...v4.31.6 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.31.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
8 months ago
9095eb9b22
github-actions: bump actions/checkout from 5.0.0 to 6.0.0
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 5.0.0 to 6.0.0.
- [Release notes](https://github.com/actions/checkout/releases )
- [Commits](https://github.com/actions/checkout/compare/v5...v6 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
8 months ago
1329786f84
detect: new command line option : list-rule-protos
...
To list the protocols we can use a in a rule header
Ticket: 635
8 months ago
3cb873e3bc
ci: check script eve-parity is working
9 months ago
7417cf07f6
github-ci: add schema tests to docs workflow
...
This will run the schema tests when no code has been modified.
9 months ago
745e972348
github-ci: update Rust 1.91 for clippy and "known" stable
9 months ago
70a2524d95
ci: update ndpi to 4.14
9 months ago
5f138891b2
github-actions: bump github/codeql-action from 3.30.5 to 4.31.2
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.30.5 to 4.31.2.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Commits](https://github.com/github/codeql-action/compare/v3.30.5...v4.31.2 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.31.2
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
9 months ago
2609860884
github-actions: bump actions/download-artifact from 5.0.0 to 6.0.0
...
Bumps [actions/download-artifact](https://github.com/actions/download-artifact ) from 5.0.0 to 6.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](634f93cb29...018cc2cf5b
9 months ago
a6505395c6
github-actions: bump actions/upload-artifact from 4 to 5
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 4 to 5.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/v4...v5 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: '5'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
9 months ago
fcbccb0292
github-actions: check for leaks in unittests
10 months ago
7ca95eeec0
github-ci: build-test DPDK v23.11.x and v24.11.x
...
Ticket: 6382
10 months ago
ee0b08692c
github-ci: stop testing obsolete DPDK versions, bump up the rest
10 months ago
3efab2bb7e
github-actions: bump github/codeql-action from 3.30.3 to 3.30.5
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.30.3 to 3.30.5.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Commits](https://github.com/github/codeql-action/compare/v3.30.3...v3.30.5 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.30.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
10 months ago
a714ba8522
github-actions: bump ossf/scorecard-action from 2.4.2 to 2.4.3
...
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action ) from 2.4.2 to 2.4.3.
- [Release notes](https://github.com/ossf/scorecard-action/releases )
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md )
- [Commits](05b42c6244...4eaacf0543
10 months ago
5c921507af
ci/codeql: rename codeql python test
...
To differentiate from other CodeQL workflows.
10 months ago
14448ecb0f
ci/codeql: enable for rust, enable unittests
...
Unit tests need to be enabled for the src/tests files to be scanned.
Also rename, to differentiate from the Python CodeQL workflow.
10 months ago
846eb44a9d
ci/mt: Include MT tests in CI workflows
...
Add the MT live tests to the CI workflow.
10 months ago
51c9609c7c
mt/ci: Add MT live test
...
Add MT live test capability:
- multi-tenant.sh: harness that sets up and steps through MT steps
- suricata-mt.yaml: Adds MT capability to Suricata
- tenant-1.yaml: Per-tenant configuration file
10 months ago
746823f3df
github-actions: update rust checks to 1.90
10 months ago
ec418248d6
rust: update highest known rustc version to 1.90
10 months ago
dae9264120
doc: really enforce more the completeness of json schema
...
Completes commit f1f32a39ee
11 months ago
cf4a86185d
github-actions: bump codecov/codecov-action from 5.5.0 to 5.5.1
...
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action ) from 5.5.0 to 5.5.1.
- [Release notes](https://github.com/codecov/codecov-action/releases )
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md )
- [Commits](fdcc847654...5a1091511a
11 months ago
5aa30fccc8
github-actions: bump actions/github-script from 7.0.1 to 8.0.0
...
Bumps [actions/github-script](https://github.com/actions/github-script ) from 7.0.1 to 8.0.0.
- [Release notes](https://github.com/actions/github-script/releases )
- [Commits](60a0d83039...ed597411d8
11 months ago
f18c8883cf
github-actions: bump github/codeql-action from 3.30.0 to 3.30.3
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.30.0 to 3.30.3.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Commits](https://github.com/github/codeql-action/compare/v3.30.0...v3.30.3 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.30.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
11 months ago
46203de0e9
doc: adjust for master to main rename
11 months ago
63767252be
github-action: adjust for master to main rename
11 months ago
266809a0f2
ci: check json schema sets always additionalProperties
...
Even if it is set to true.
Avoids forgetting adding fields and thinking it is tested
11 months ago
6d52bcbcb1
ci: do not run undefined for clusterfuzzlite
...
as it takes too long to build
11 months ago
0662736167
github-ci: pass CARGO and RUSTC to S-V
...
S-V needs cargo to build the EVE validator.
11 months ago
6d74656bef
rust: respect RUSTC and CARGO env vars like CC
...
To support alternative cargo and rustc programs (such as cargo-1.82),
respect CARGO and RUSTC environment variables during ./configure much
like CC.
RUSTFMT is also respected as that is required for the tests, and Cargo
can't figure this out like it can for rustc (perhaps a bug in the
packaging).
For cbindgen, we have also have to make sure the cargo environment
variable is set for each invocation.
To build with Ubuntu's Rust 1.82 packaging:
CARGO=cargo-1.82 RUSTC=rustc-1.82 RUSTDOC=rustdoc-1.82 \
./configure
Note that setting RUSTDOC is only required for commands like "make
check" to pass.
Ticket: #7877
11 months ago
88009793cc
github-actions: bump actions/download-artifact from 4.3.0 to 5.0.0
...
Bumps [actions/download-artifact](https://github.com/actions/download-artifact ) from 4.3.0 to 5.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](d3f86a106a...634f93cb29
11 months ago
2c5c8c6dff
github-actions: bump codecov/codecov-action from 5.4.3 to 5.5.0
...
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action ) from 5.4.3 to 5.5.0.
- [Release notes](https://github.com/codecov/codecov-action/releases )
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md )
- [Commits](18283e04ce...fdcc847654
11 months ago
362394ac8e
github-actions: bump actions/checkout from 4 to 5
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 4 to 5.
- [Release notes](https://github.com/actions/checkout/releases )
- [Commits](https://github.com/actions/checkout/compare/v4...v5 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '5'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
11 months ago
55249b7df2
github-actions: bump github/codeql-action from 3.29.5 to 3.30.0
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.29.5 to 3.30.0.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Commits](https://github.com/github/codeql-action/compare/v3.29.5...v3.30.0 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.30.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
11 months ago
f910e3045f
github-ci: add Debian 13 job with xdp and vectorscan
12 months ago
a024ede9ba
github-actions: bump github/codeql-action from 3.29.2 to 3.29.5
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.29.2 to 3.29.5.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Commits](https://github.com/github/codeql-action/compare/v3.29.2...v3.29.5 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.29.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
1 year ago
ffa1766742
github-ci: finish removing cppclean
...
Completes commit 2d308c000d
1 year ago
3c98ea85d6
github-ci: add almalinux 10 build
...
Based on the current AlmaLinux 9 build, with plugin tests, etc.
Remove cppclean as its not installed and was previously disabled with
commit 2d308c000d
1 year ago
bb846de074
github-ci: add flto build
...
Ubuntu and Fedora packing system build with -flto=auto by default, so
update one test to use -flto=auto. Also build with -O2 as that
combination can cause issues such as
https://redmine.openinfosecfoundation.org/issues/7824 .
Also adds vectorscan to the build.
1 year ago
6bbba953df
ci: use debian 12 for xdp
...
As bullseye is EOL so it is being removed from the mirrors
https://lists.debian.org/debian-backports/2024/07/msg00003.html
[Edit by JI: Add xdp to distcheck build as well.]
1 year ago
2e69e0d5c1
github-ci: remove debian:10 build, it is EOL
1 year ago
ed4cf9a803
github-actions: bump github/codeql-action from 3.28.18 to 3.29.2
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.28.18 to 3.29.2.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Commits](https://github.com/github/codeql-action/compare/v3.28.18...v3.29.2 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.29.2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
1 year ago
055d270b98
ci: test with latest rust stable version 1.88
1 year ago
8ba16e2813
ci: do not run workflows for etc/schema.json
...
As it is rather a documentation file than code
1 year ago
17ed6f7b8e
windows: use _tzname instead of tzname
...
tzname is a POSIX variable, WIN32 has prefixed many POSIX variables
with "_". While Mingw64 supports both, UCRT64 emits a compiler warning
on the usage of "tzname".
This triggered a rather large clang-format update.
1 year ago
106e09ed57
github-ci: add windows ucrt build
...
MSYS2 now recommends the UCRT environment as the default, so we should
probably add a CI job for it.
1 year ago
4cadeb17e1
github: upload scan-build artifacts
1 year ago
35c86ce800
actions: test hwloc build
1 year ago
49cd1206e8
github-ci: install hwloc as a mandatory dependency
1 year ago
f0eaebe3a6
rust: set MSRV to 1.75.0
...
This is the Rust version found on Ubuntu LTS releases as of today, and
is the oldest we need to support.
Ticket: #6573
1 year ago
7c88d37570
ci: check cargo fmt for htp
1 year ago
3bc88d8330
github-actions: bump github/codeql-action from 3.28.16 to 3.28.18
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.28.16 to 3.28.18.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Commits](https://github.com/github/codeql-action/compare/v3.28.16...v3.28.18 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.28.18
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
1 year ago
c8ef5fe192
github-actions: bump ossf/scorecard-action from 2.4.1 to 2.4.2
...
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action ) from 2.4.1 to 2.4.2.
- [Release notes](https://github.com/ossf/scorecard-action/releases )
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md )
- [Commits](f49aabe0b5...05b42c6244
1 year ago
e75c121a63
github-actions: bump codecov/codecov-action from 5.4.2 to 5.4.3
...
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action ) from 5.4.2 to 5.4.3.
- [Release notes](https://github.com/codecov/codecov-action/releases )
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md )
- [Commits](ad3126e916...18283e04ce
1 year ago
5a5b48179a
github-ci: enable asan for suricata-lua-sys in fuzz build
1 year ago
0c1ded33da
github-ci/macos: don't pass CFLAGS to make
...
With autoconf, CFLAGS should only need to be passed to
./configure. They're then memorized in the generated Makefiles.
1 year ago
ab87089686
github-ci: cache npcap binary download
1 year ago
dbc2f9d1db
github-ci: add check for schema property ordering
1 year ago
061ed2d6a4
github-ci: use rust 1.85.0 for clippy check on templates
...
Currently our CI clippy test is based on 1.85.0, but the clippy test for
the templates was using latest stable. Unify the clippy checks to
1.85.0.
1 year ago
3b5a99d239
github-ci: use all profraw files in coverage test
1 year ago
7b46ec8c24
github-ci: add --list-app-layer-hooks checks
1 year ago
019c746d79
github-ci: add -h option to coverage test
1 year ago
11cef2980b
github-ci: use current directory for unit test logging
...
/tmp appears to exist when you make it, but doesn't appear to actually
exist after msys translation, so just use "."
1 year ago
159bacb268
github-ci: bump scan-build to 20 on Ubuntu 25.04
1 year ago
649a032ba9
github-ci: add a nix build
...
This will test that shell.nix is working properly and also
test compile-commands Makefile target.
Ticket: #7669
1 year ago
4b89dafb44
github-actions: bump actions/download-artifact from 4.2.1 to 4.3.0
...
Bumps [actions/download-artifact](https://github.com/actions/download-artifact ) from 4.2.1 to 4.3.0.
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](95815c38cf...d3f86a106a
1 year ago
af2b56e9fb
github-actions: bump github/codeql-action from 3.28.13 to 3.28.16
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.28.13 to 3.28.16.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Commits](https://github.com/github/codeql-action/compare/v3.28.13...v3.28.16 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.28.16
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
1 year ago
1f846bc131
github-actions: bump codecov/codecov-action from 5.4.0 to 5.4.2
...
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action ) from 5.4.0 to 5.4.2.
- [Release notes](https://github.com/codecov/codecov-action/releases )
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md )
- [Commits](0565863a31...ad3126e916
1 year ago
810a47cd60
github-ci: pin bindgen test to bindgen v0.66.0
1 year ago
bed96505aa
github-ci: update to Fedora 42
1 year ago
7af8ef07b3
github-ci: codecov llvm updates
...
Use LLVM 15 with Rust 1.67.1
1 year ago
fe07781bfc
github-ci: update codecov unittest job
...
LLVM 19, rust 1.85.1 and Ubuntu 24.04.
1 year ago
7d806dc7b7
ci: rustc wrapper to disable coverage for external crates
...
To keep the disk usage good even when we use new crates
1 year ago
cff611a284
workflows: use aggressive-cleanup option w s-v
...
on the Fedora 41 + codecov job to avoid running out of disk space.
1 year ago
95b079ae0d
github-actions: f41 codecov improvements
...
Add missing gpg package.
Reduce disk space usage.
1 year ago
5e87b6bd51
plugin: add in-tree app-layer template plugin for testing
...
Ticket: 7151
Ticket: 7152
Ticket: 7154
1 year ago
0bf0f90e97
ci: make a build with ja disabled
...
Ticket: 7461
In order to run all SV tests in CI, including the ones that
require the abse,ce of the JA3 or JA4 feature
1 year ago
9c324b796e
http: Use libhtp-rs.
...
Ticket: #2696
There are a lot of changes here, which are described below.
In general these changes are renaming constants to conform to the
libhtp-rs versions (which are generated by cbindgen); making all htp
types opaque and changing struct->member references to
htp_struct_member() function calls; and a handful of changes to offload
functionality onto libhtp-rs from suricata, such as URI normalization
and transaction cleanup.
Functions introduced to handle opaque htp_tx_t:
- tx->parsed_uri => htp_tx_parsed_uri(tx)
- tx->parsed_uri->path => htp_uri_path(htp_tx_parsed_uri(tx)
- tx->parsed_uri->hostname => htp_uri_hostname(htp_tx_parsed_uri(tx))
- htp_tx_get_user_data() => htp_tx_user_data(tx)
- htp_tx_is_http_2_upgrade(tx) convenience function introduced to detect response status 101
and “Upgrade: h2c" header.
Functions introduced to handle opaque htp_tx_data_t:
- d->len => htp_tx_data_len()
- d->data => htp_tx_data_data()
- htp_tx_data_tx(data) function to get the htp_tx_t from the htp_tx_data_t
- htp_tx_data_is_empty(data) convenience function introduced to test if the data is empty.
Other changes:
Build libhtp-rs as a crate inside rust. Update autoconf to no longer
use libhtp as an external dependency. Remove HAVE_HTP feature defines
since they are no longer needed.
Make function arguments and return values const where possible
htp_tx_destroy(tx) will now free an incomplete transaction
htp_time_t replaced with standard struct timeval
Callbacks from libhtp now provide the htp_connp_t and the htp_tx_data_t
as separate arguments. This means the connection parser is no longer
fetched from the transaction inside callbacks.
SCHTPGenerateNormalizedUri() functionality moved inside libhtp-rs, which
now provides normalized URI values.
The normalized URI is available with accessor function: htp_tx_normalized_uri()
Configuration settings added to control the behaviour of the URI normalization:
- htp_config_set_normalized_uri_include_all()
- htp_config_set_plusspace_decode()
- htp_config_set_convert_lowercase()
- htp_config_set_double_decode_normalized_query()
- htp_config_set_double_decode_normalized_path()
- htp_config_set_backslash_convert_slashes()
- htp_config_set_bestfit_replacement_byte()
- htp_config_set_convert_lowercase()
- htp_config_set_nul_encoded_terminates()
- htp_config_set_nul_raw_terminates()
- htp_config_set_path_separators_compress()
- htp_config_set_path_separators_decode()
- htp_config_set_u_encoding_decode()
- htp_config_set_url_encoding_invalid_handling()
- htp_config_set_utf8_convert_bestfit()
- htp_config_set_normalized_uri_include_all()
- htp_config_set_plusspace_decode()
Constants related to configuring uri normalization:
- HTP_URL_DECODE_PRESERVE_PERCENT => HTP_URL_ENCODING_HANDLING_PRESERVE_PERCENT
- HTP_URL_DECODE_REMOVE_PERCENT => HTP_URL_ENCODING_HANDLING_REMOVE_PERCENT
- HTP_URL_DECODE_PROCESS_INVALID => HTP_URL_ENCODING_HANDLING_PROCESS_INVALID
htp_config_set_field_limits(soft_limit, hard_limit) changed to
htp_config_set_field_limit(limit) because libhtp didn't implement soft
limits.
libhtp logging API updated to provide HTP_LOG_CODE constants along with
the message. This eliminates the need to perform string matching on
message text to map log messages to HTTP_DECODER_EVENT values, and the
HTP_LOG_CODE values can be used directly. In support of this,
HTP_DECODER_EVENT values are mapped to their corresponding HTP_LOG_CODE
values.
New log events to describe additional anomalies:
HTP_LOG_CODE_REQUEST_TOO_MANY_LZMA_LAYERS
HTP_LOG_CODE_RESPONSE_TOO_MANY_LZMA_LAYERS
HTP_LOG_CODE_PROTOCOL_CONTAINS_EXTRA_DATA
HTP_LOG_CODE_CONTENT_LENGTH_EXTRA_DATA_START
HTP_LOG_CODE_CONTENT_LENGTH_EXTRA_DATA_END
HTP_LOG_CODE_SWITCHING_PROTO_WITH_CONTENT_LENGTH
HTP_LOG_CODE_DEFORMED_EOL
HTP_LOG_CODE_PARSER_STATE_ERROR
HTP_LOG_CODE_MISSING_OUTBOUND_TRANSACTION_DATA
HTP_LOG_CODE_MISSING_INBOUND_TRANSACTION_DATA
HTP_LOG_CODE_ZERO_LENGTH_DATA_CHUNKS
HTP_LOG_CODE_REQUEST_LINE_UNKNOWN_METHOD
HTP_LOG_CODE_REQUEST_LINE_UNKNOWN_METHOD_NO_PROTOCOL
HTP_LOG_CODE_REQUEST_LINE_UNKNOWN_METHOD_INVALID_PROTOCOL
HTP_LOG_CODE_REQUEST_LINE_NO_PROTOCOL
HTP_LOG_CODE_RESPONSE_LINE_INVALID_PROTOCOL
HTP_LOG_CODE_RESPONSE_LINE_INVALID_RESPONSE_STATUS
HTP_LOG_CODE_RESPONSE_BODY_INTERNAL_ERROR
HTP_LOG_CODE_REQUEST_BODY_DATA_CALLBACK_ERROR
HTP_LOG_CODE_RESPONSE_INVALID_EMPTY_NAME
HTP_LOG_CODE_REQUEST_INVALID_EMPTY_NAME
HTP_LOG_CODE_RESPONSE_INVALID_LWS_AFTER_NAME
HTP_LOG_CODE_RESPONSE_HEADER_NAME_NOT_TOKEN
HTP_LOG_CODE_REQUEST_INVALID_LWS_AFTER_NAME
HTP_LOG_CODE_LZMA_DECOMPRESSION_DISABLED
HTP_LOG_CODE_CONNECTION_ALREADY_OPEN
HTP_LOG_CODE_COMPRESSION_BOMB_DOUBLE_LZMA
HTP_LOG_CODE_INVALID_CONTENT_ENCODING
HTP_LOG_CODE_INVALID_GAP
HTP_LOG_CODE_ERROR
The new htp_log API supports consuming log messages more easily than
walking a list and tracking the current offset. Internally, libhtp-rs
now provides log messages as a queue of htp_log_t, which means the
application can simply call htp_conn_next_log() to fetch the next log
message until the queue is empty. Once the application is done with a
log message, they can call htp_log_free() to dispose of it.
Functions supporting htp_log_t:
htp_conn_next_log(conn) - Get the next log message
htp_log_message(log) - To get the text of the message
htp_log_code(log) - To get the HTP_LOG_CODE value
htp_log_free(log) - To free the htp_log_t
1 year ago
b536dee9cd
github-actions: bump actions/upload-artifact from 4.6.1 to 4.6.2
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 4.6.1 to 4.6.2.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](4cec3d8aa0...ea165f8d65
1 year ago
f2a9203558
github-actions: bump actions/download-artifact from 4.1.9 to 4.2.1
...
Bumps [actions/download-artifact](https://github.com/actions/download-artifact ) from 4.1.9 to 4.2.1.
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](cc20338598...95815c38cf
1 year ago
d2705aa052
github-actions: bump github/codeql-action from 3.28.10 to 3.28.13
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.28.10 to 3.28.13.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Commits](https://github.com/github/codeql-action/compare/v3.28.10...v3.28.13 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.28.13
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
1 year ago
455aef7a22
github-ci: add test for custom lib example
...
Ticket: #7240
1 year ago
6c57d85ecb
github-ci: use git cli command for netmap instead of action
...
This action hits API limits often, however our other uses of git clone
do not seem to, so try use git clone here instead of the github
action.
1 year ago
078b7a4251
github-ci: add ndpi build to the centos-stream9 build
...
- Download and build nDPI
- Enable nDPI during Suricata ./configure
- Test that the plugin was built and installed
1 year ago
Shivani Bhardwaj
Victor Julien
dependabot[bot]
Philippe Antoine
Ambre Iooss
Jason Ish
Lukas Sismis
Jeff Lucovsky
Eric Leblond
Todd Mortimer