13715 Commits (b1972a5c61aa22bc0f275ede4af169c792a7df6e)

 

All Branches   

Search

Author	SHA1	Message	Date
Juliana Fajardini	9d9bc04886	stream/tcp: typo fix	2 years ago
jason taylor	489af24132	detect: update ttl debug log messages ... Signed-off-by: jason taylor <jtfas90@gmail.com>	2 years ago
Jeff Lucovsky	ab4d0f7f4a	detect/stream_size: Rename detect.rs to stream_size.rs ... This commit renames detect.rs to stream_size.rs to reflect its content.	2 years ago
Jeff Lucovsky	2386f2614f	detect/iprep: Move iprep logic into a separate module	2 years ago
Jeff Lucovsky	c957882d1c	detect/uri: Move uri logic into a separate module	2 years ago
Jeff Lucovsky	484c34bc60	detect/uint: Move uint logic into a separate module ... This commit moves the uint logic into its own module.	2 years ago
Jeff Lucovsky	33c424f9ed	doc/byte_math: Add byte_math differences with snort ... Issue: 5077	2 years ago
Jeff Lucovsky	192a31c74e	doc: Fixup byte* entries to display tables properly	2 years ago
Jeff Lucovsky	8bfe427a74	rust/detect: Create detect module for rule parsing ... This commit creates a module named "detect" for rule parsing logic. As part of this commit, detect.rs is moved from its toplevel position into the new module. Thus, use crate::detect::detect to refer to items within detect.rs (instead of create::detect). Ticket: 5077	2 years ago
Jeff Lucovsky	ccd1063e43	detect/bytemath: convert parser to Rust ... Issue: 5077 This commit - Converts the PCRE based parser to Rust. - Adds unit tests to the new Rust modules - Removes the PCRE parser from detect-bytemath.c - Adjusts the C source modules to refer to the Rust definitions - Includes the multiply operator (missing from the C parser)	2 years ago
Philippe Antoine	c6d8daecd3	log: fix coverity warning ... CID 1515529 Checks ftell return value for negative/error	2 years ago
Victor Julien	ad6bea5108	github-ci/codecov: add rust coverage support ... Based on Rust 1.63 and LLVM 14. Update the jobs to meet those requirements. Includes the bundled libhtp coverage now, including libhtp tests. Ticket: #4278.	2 years ago
Victor Julien	1701a6b14c	tls: handle incomplete header sooner ... Make sure to exit the parser early on incomplete header data. Additionally, make sure to not create duplicated tls frames in this case. Add a debug validation check for the header parser parsing too much data, which should never happen.	2 years ago
Victor Julien	9053c49178	ssl: add debug validation check for incomplete api	2 years ago
Victor Julien	0ec136621d	debug: add bool string print helper macro	2 years ago
Victor Julien	69be41b241	tls: improve record checks ... Improve unknown record handling. Inspired by Wireshark 'unknown record' handling, we take a best effort approach for records with unknown content types in TLS versions 1.0, 1.1 and 1.2. Improve record length check and set 'invalid_record_length' event instead of 'invalid_tls_header'.	2 years ago
Victor Julien	c028800ae1	tls: improve versions extension logic ... Skip over unusable versions like GREASE.	2 years ago
Victor Julien	599791fa33	tls: make version and size checks stricter ... This way bad records won't buffer lots of stream data.	2 years ago
Victor Julien	308fe31cb5	eve/schema: add tls client logging	2 years ago
Victor Julien	c73d812026	tls: store cert data in heap buffer ... Cert chain is a list of pointers into this buffer, so can't use a stream slice approach.	2 years ago
Victor Julien	4a283d480d	eve/tls: implement client cert logging ... Enable client logging in extended mode. Add "client", "client_certificate" and "client_chain", where the latter two depend on "client".	2 years ago
Victor Julien	e817a8f968	tls: parse client certificates ... Parse client cerificates and store them in the state similar to how this is done for server certificates. Update "progress" handling to not consider the TLS handshake complete if the server indicated a client cert was needed.	2 years ago
Victor Julien	10f5e6cb66	tls: prepare for client cert parsing	2 years ago
Victor Julien	6d4cc39c02	eve/tls: prepare for client cert logging ... Code cleanups that work on per direction "connp" instead of hard coding to the server side.	2 years ago
Victor Julien	14b2e04b58	tls: make cert handling more generic ... In preparation for client cert handling.	2 years ago
Victor Julien	cf4c201acb	tls: avoid tls.invalid_handshake_message FP ... Don't set TLS_DECODER_EVENT_INVALID_HANDSHAKE_MESSAGE event on encrypted handshake messages.	2 years ago
Victor Julien	e9d63f3355	tls: don't set 2 events for a single exception ... Keep the more specific ones.	2 years ago
Victor Julien	214e466b29	tls: remove incomplete tests ... These tests are incompatible with the incomplete API usage and should have been pcap based tests in the first place.	2 years ago
Victor Julien	82e03bd8fc	tls: set event if record size exceeds limit	2 years ago
Victor Julien	e857c864ca	tls: support server hello done message	2 years ago
Victor Julien	4bab6e24e5	tls: support handshake fragmentation ... Implement TLS record defrag for handshake messages. Ticket: #5183.	2 years ago
Victor Julien	bcaf0f6f7d	tls: remove certificate buffering code ... TCP Buffering is now done in the app-layer using the incomplete API, on the SSL/TLS record level. TLS level fragmentation will be implemented separately.	2 years ago
Victor Julien	0839317ea7	tls: parse handshake protocol records in single pass	2 years ago
Victor Julien	9f0ea5e70c	sslv2: use version from client hello ... Remove streaming code that is now unused. Incomplete handling makes this record parsing work on full data.	2 years ago
Victor Julien	c8d79fb81f	ssl: implement 'incomplete' handling for SSLv2	2 years ago
Victor Julien	6076a51511	tls: streaming mode for application records ... To avoid overhead of stream buffering for records we don't do much with anyway, pass through application records instead of buffering the entire record in the stream engine.	2 years ago
Victor Julien	129fcb5c72	tls: use incomplete API to get full TLS records ... The TLS record header is parsed in streaming mode still, but once the record size is known we tell the app-layer API to give us the full record. Ticket: #5481	2 years ago
Victor Julien	2d308c000d	github-ci: disable cppclean as it is too noisy ... We can reenable it after the larger cleanup efforts are complete.	2 years ago
Gleb Smirnoff	7110ea75c4	ipfw: remove setting of SO_BROADCAST on the divert(4) socket ... My review of the FreeBSD kernel code reveals that this setting a) is ignored by the kernel b) is not required. The sending side of divert(4) never checks so->so_options, but always gives IP_ALLOWBROADCAST to ip_output().	2 years ago
dependabot[bot]	30ce63c50f	github-actions: bump ossf/scorecard-action from 1.1.2 to 2.0.3 ... Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 1.1.2 to 2.0.3. - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ce330fde6b...865b409285) --- updated-dependencies: - dependency-name: ossf/scorecard-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2 years ago
Andrei Shchapaniak	ee5573c4ee	dpdk/i40e: fix warning with number of queues for RSS configuration	2 years ago
Philippe Antoine	390cf9248f	detect: adds flow.age keyword ... Ticket: #5536	2 years ago
Philippe Antoine	ce2775d331	flow/icmpv4: fix vlan.use-for-tracking ... For ICMPv4 error messages the vlan ids were always considered, even if the 'vlan.use-for-tracking' option was disabled. Ticket: #5330	2 years ago
Sascha Steinbiss	148b53125b	ebpf: update deprecated API calls ... This fixes build errors when libbpf 1.0 is used. It removes previously deprecated API functions that were still in use in Suricata's eBPF code.	2 years ago
Philippe Antoine	af40873127	pgsql: config limit maximum number of live transactions ... As is done for other protocols Ticket: #5527	2 years ago
Philippe Antoine	e160917bcf	mqtt: remove quadratic time complexity ... When having many transactions in a single parsing call... Fix has overhead of having one more field in the mqtt state. Completes commit a8079dc978 Ticket: #5399	2 years ago
Jeff Lucovsky	63745a7879	detect/tls: Improve tls.fingerprint rule handling ... Issue: 4581 This commit improves the runtime performance of rules with tls.fingerprint by using the inspection logic from tls.cert_fingerprint.	2 years ago
Jeff Lucovsky	6bccd5aa30	detect/uri: Remove unnecessary include ... This commit removes an unnecessary #include for detect-uricontent.h	2 years ago
Victor Julien	d941703cd8	detect/build: minor code cleanup	2 years ago
Victor Julien	040404b093	detect/profiling: track bytes scanned by prefilter engines	2 years ago