suricata

Commit Graph

Author	SHA1	Message	Date
Victor Julien	3eb2f6a584	radix: remove old radix tree implementation No longer used.	3 months ago
Victor Julien	0ea6fe668e	detect/iponly: reimplement with radix4 for ipv6 Use a more compact ipv6 specific structure.	3 months ago
Victor Julien	4b6296c848	detect/iponly: reimplement with radix4 for ipv4 Use a more compact ipv4 specific structure.	3 months ago
Victor Julien	8536dd51b5	host-os-policy: switch to radix4/6 Splits the unified tree into a ipv4 specific and ipv6 specific tree.	3 months ago
Victor Julien	82cd053fc8	htp: switch config tree to radix4/6 Splits the unified tree into a ipv4 specific and ipv6 specific tree.	3 months ago
Victor Julien	46fb7bb162	defrag/config: switch to radix4/6 Splits the unified tree into a ipv4 specific and ipv6 specific tree.	3 months ago
Victor Julien	c75b29c74f	reputation: switch cidr handling to radix4/6 Splits the unified tree into a ipv4 specific and ipv6 specific tree.	3 months ago
Victor Julien	8f03a2eb9b	radix: implement more compact trees Implement a more compact set of trees specifically for IPv4 and IPv6 addresses. This allows for more compact data structures and fewer memory allocations. Based on the existing radix tree implementation.	3 months ago
Victor Julien	e9a2352b99	host-os-info: test cleanup	3 months ago
Pierre Chifflier	bd7d38e91e	ldap: add support for STARTTLS to make certificate information available Ticket: #7394.	3 months ago
Pierre Chifflier	3341907125	ldap: add port 3268 (used by Active Directory)	3 months ago
Philippe Antoine	c26cb9abd3	detect/transform: fix leak in xor transform parse Fixes: `8984bc6801` ("transforms: move xor to rust")	3 months ago
Jason Ish	13841c0b9e	rust: put all rust/cargo env vars in CARGO_ENV To ensure that all calls to cargo use the same environment variables, put the environment variables in CARGO_ENV so every call to cargo can easily use the same vars. The Cargo build system is smarter than make, it can detect a change in an environment variable that affects the build, and the setting of SURICATA_LUA_SYS_HEADER_DST changing could cause a rebuild. Also update suricata-lua-sys, which is smarter about copying headers. It will only copy if the destination does not exist, or the source header is newer than the target, which can also prevent unnecessary rebuilds. This is mainly to fix an issue where subsequent builds may fail, especially when running an editor with a LSP enabled: Update lua crate to 0.1.0-alpha.5. This update will force a rewrite of the headers if the env var SURICATA_LUA_SYS_HEADER_DST changes. This fixes the issue where the headers may not be written. The cause is that Rust dependencies are cached, and if your editor is using rust-analyzer, it might cache the build without this var being set, so these headers are not available to Suricata. This crate update forces the re-run of the Lua build.rs if this env var changes, fixing this issue.	3 months ago
Eric Leblond	138898f5c2	github-actions: add list keywords and app layers Add the 2 command line options to coverage build.	3 months ago
Eric Leblond	be7cea4d32	suricata: fix list-keywords option The list keywords option was crashing due to improper init. Ticket: 7397	3 months ago
Shivani Bhardwaj	d0427a2833	detect/smb: fix the sigmatch table for url sigmatch_table for url entry was incorrectly set to DETECT_FLOW_AGE.	4 months ago
Jason Ish	5d766df12b	make: install-headers: rust-bindings.h rust-bindings.h was not being installed with "make install-headers", and its now pulled in by a header used for plugin support, so make sure its installed. We first attempt to install the "dist" version if exists, otherwise install the "gen" one. Also install the "gen" even if the "dist" one exists, as its going to be newer.	4 months ago
Jason Ish	2ac16ee1a6	detect: break apart sigtable setup and initialization Allows initialization to be done early, so the table is ready for dynamic registration by plugins which are loaded before signature setup.	4 months ago
Jason Ish	83b1e40028	examples/plugin: update to find generated rust header Needed for changes to output-eve.h.	4 months ago
Jason Ish	b660ff8aff	eve: user callbacks for adding additional data Provide a way for library/plugin users to register a callback that will be called prior to an EVE record being closed. The callback will be passed ThreadVars, Packet, and Flow pointers if available, as well as private user data.	4 months ago
Jason Ish	30bd2a27ff	threads: add initialization callbacks For library users and plugins that need to hook into the thread life cycle, perhaps to initialize some thread storage.	4 months ago
Jason Ish	fa230efccb	threads: add storage api, based on flow storage	4 months ago
Jason Ish	a6fc37c90a	flow: add callbacks for flow init and flow updates Adds user registerable callbacks for flow initialization, flow update and flow finish. Some plugins, such as other DPI libraries like nDPI need a way to hook into these flow lifecycle events. Ticket: #7319 Ticket: #7320	4 months ago
Jeff Lucovsky	b30df19f1a	app-layer/stats: Expand memuse/memcap handling This commit adds memcap/memuse handling to the unix-socket interface: - ftp - http-byterange - host New stats: - ippair: memuse, memcap - host: memuse, memcap - http-byterange: memuse, memcap	4 months ago
Jeff Lucovsky	83bdcda932	thash/memcap: Use atomics for memcap Issue: 845 Maintain the memcap as an atomic counter so changes through the unix-socket interface can be supported.	4 months ago
Jeff Lucovsky	f23fec0c64	memcap/socket: Improve memcap array support Remove hard-coded value for the memcap array and substitute compile-time value for array sizing. Issue: 845	4 months ago
Victor Julien	278dc24cd0	doc/userguide: document smb cache size limit options Ticket: #5672.	4 months ago
Victor Julien	543429f176	smb: use lru for ssn2vec_map Generic ssn2vec_map was a HashMap used for mapping session key to different types of vector data: - GUID - filename - share name Turn this into a bounded LruCache. Rename to ssn2vec_cache. Size of the cache is 512 by default, and can be configured using: `app-layer.protocols.smb.max-session-cache-size` Ticket: #5672.	4 months ago
Victor Julien	ba7a4ece76	smb: use lru for ssnguid2vec_map; rename Reimplement the ssnguid2vec_map HashMap as a LruCache. Since this is a DCERPC record cache, name it as such. Default size is 128. Can be controlled by `app-layer.protocols.smb.max-dcerpc-frag-cache-size`. Ticket: #5672.	4 months ago
Victor Julien	0f23557ef7	smb: use lru for ssn2tree; rename Turn the map mapping the smb session key to smb tree into a lru cache, limited to 1024 by default. Add `app-layer.protocols.smb.max-tree-cache-size` option to control the limit. Ticket: #5672.	4 months ago
Victor Julien	ce44d38ca8	smb: use lru for ssn2vecoffset_map; rename Rename to read_offset_cache. Add `app-layer.protocols.smb.max-read-offset-cache-size` option to control the limit. Ticket: #5672.	4 months ago
Victor Julien	91828ec00b	smb: use lru for guid2name map; rename Use `lru` crate. Rename to reflect this. Add `app-layer.protocols.smb.max-guid-cache-size` to control the max size of the LRU cache. Ticket: #5672.	4 months ago
Victor Julien	23f2317c6a	smb1: remove name on close Ticket: #5672.	4 months ago
Victor Julien	85987aaad6	smb2: remove filename on close Ticket: #5672.	4 months ago
Victor Julien	c2124f0b9e	smb: update to GAP handling Don't tag the session as gap'd when the GAP is in a precise location: 1. in "skip" data, where the GAP just fits the skip data 2. in file data, where we pass the GAP on to the file This reduces load of GAP post-processing that is unnecessary in these case.	4 months ago
Victor Julien	d535d7f768	smb2: use if let for read/write parsing	4 months ago
Victor Julien	5bd2289008	rust: update crates	4 months ago
Philippe Antoine	63324b7368	transforms: move urldecode to rust Ticket: 7229	4 months ago
Philippe Antoine	8984bc6801	transforms: move xor to rust Ticket: 7229	4 months ago
Philippe Antoine	45e0acf772	transforms: move http headers transforms to rust Ticket: 7229	4 months ago
Philippe Antoine	f0414570d2	transforms: move casechange to rust Ticket: 7229	4 months ago
Philippe Antoine	0e5b49d20f	transforms: move hash transforms to rust md5, sha1 and sha256 Ticket: 7229	4 months ago
Philippe Antoine	71da38e702	transforms: move dotprefix to rust Ticket: 7229	4 months ago
Philippe Antoine	966f659201	transforms: move compress_whitespace to rust Ticket: 7229	4 months ago
Philippe Antoine	4985ebc0e0	transforms: move strip_whitespace to rust Ticket: 7229	4 months ago
Philippe Antoine	dd71ef0af2	suricata/bpf: fix -Wshorten-64-to-32 warning Ticket: 7366 Ticket: 6186	4 months ago
Jason Ish	b1c26dccf3	http2: rename event variant to match rule Rename InvalidHTTP1Settings to InvalidHttp1Settings so it gets the expected name transformation of "invalid_http1_settings". Ticket: #7361	4 months ago
Jason Ish	a55960e6ba	rules/modbus: remove rule for event that not longer exists The event "modbus.invalid_unit_identifier" no longer exists. Ticket: #7361	4 months ago
Jason Ish	b44ba3224f	rules/ike: fix ike event names that have changed - weak_crypto_nodh -> weak_crypto_no_dh - weak_crypto_noauth -> weak_crypto_no_auth Ticket: #7361	4 months ago
Jason Ish	833c7c64be	rules/dns: fix dns event names that have changed - not_a_request to not_request - not_a_response to not_reponse Ticket: #7361	4 months ago

1 2 3 4 5 ...

16575 Commits (abe8dfc56b505fdb706f154856d5b1eccc0c3da1) All Branches Search

16575 Commits (abe8dfc56b505fdb706f154856d5b1eccc0c3da1)

All Branches