10973 Commits (beb45c564ec3ed8891189c15ec93195b3e3d87d8)

 

All Branches   

Search

Author	SHA1	Message	Date
Victor Julien	34b7035a0d	detect/iponly: debug output improvements	5 years ago
Victor Julien	618ad0d92f	app-layer: optimize inspection id tracking ... Increase the inspect id for a completely inspected tx in any case. This avoids re-evaluating transactions. Reported-by: Ilya Bakhtin	5 years ago
Victor Julien	f5b33a070a	smb1: allow empty trans records	5 years ago
Victor Julien	40fe29de96	smb1: fix 'event' txs not getting closed ... If the only reason we created a request side TX was to set an event, we would not close it. This patch always looks up the TX from the response side.	5 years ago
Victor Julien	129cd28058	smb/dcerpc: close request tx sooner	5 years ago
Victor Julien	44ac3e30dd	smb: post-GAP handling update ... Close all prior transactions in the direction of the GAP, except the file xfers. Those use their own logic.	5 years ago
Victor Julien	a7ee2ffbde	smb: winreg is a DCERPC facility	5 years ago
Victor Julien	f302f3543f	files: add call for setting inspect sizes ... The inspect sizes are currently only used during file prune house keeping for SMTP.	5 years ago
Victor Julien	f9f958d66e	smtp: fix and clean up new file handling ... Set tx id on files that were just opened. Move logic to a small util func.	5 years ago
Victor Julien	683b22d114	smtp: use FILE_USE_DETECT for raw-extract	5 years ago
Victor Julien	21760bfc76	files: change pruning behavior ... If file prune is called inspect has already run. So if file is closed we can just prune. No need to consider a window anymore. When still in progress, fix the left_edge calculation.	5 years ago
Victor Julien	682014619f	files: fix FILE_USE_DETECT with --disable-detection ... Don't set FILE_USE_DETECT flag if detect is disabled.	5 years ago
Victor Julien	4ac9cd2c70	files: move smtp prune logic to main ... Now that we call the file prune loop very regularly, we can move the SMTP specific inspection pruning logic into this loop. Helps with cases there we don't (often) update a files inspection trackers.	5 years ago
Victor Julien	4b7599af90	http/file: modernize unittests ... Part of ticket #2975.	5 years ago
Victor Julien	1cdb2182e4	fastlog: apply icmp type logic to icmpv6 too	5 years ago
Victor Julien	5ef05ffad1	http/multipart: small cleanup	5 years ago
Victor Julien	aae00df4df	http/multipart: use wider type for boundary lengths ... Use uint32_t for a local type instead of uint8_t to avoid casts. Length should always stay under this regardless.	5 years ago
Victor Julien	4d0db9cb4a	http/multipart: optimize form end search ... If we already know that the boundary exists, we can start looking there. Otherwise, we can skip trying as the boundary is a subset of the form end marker.	5 years ago
Victor Julien	54d93e1eb9	http/multipart: process incomplete file data ... Start processing multipart data as soon as it is available to allow inspection sooner.	5 years ago
Jeff Lucovsky	fcfb679893	detect/analyzer: Suppress direction warnings ... This commit ensures direction warnings for ICMP v4 and v6 are suppressed and corrects check so that both protocols are checked (instead of the same protocol being checked twice).	5 years ago
Eric Leblond	1b9009ea0e	suricata: fix computing of default packet size ... Update the default packet size computation to use LiveDeviceName instead of LiveDevice as the LiveDevice list is not built when the default packet size is built.	5 years ago
Jason Ish	222a81f85d	travis: remove cocci and macos builds ... These tests are covered by Github actions and removing them may speed up the Travis builds to get results sooner. Its still worth keeping some of these builds as they test more compile time options than the Github Actions currently do.	5 years ago
Fabrice Fontaine	c08ec8d8b2	configure.ac: remove AC_CHECK_FILE ... The use of AC_CHECK_FILE and AC_CHECK_FILES cause the following error when cross-compiling: configure: error: cannot check for file existence when cross compiling The solution is to check for the file directly instead of using a macro. Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>	5 years ago
Ciprian	c9cd7559fd	configure: fixing rust/cargo cross compile command ... adding --target argument to cargo command line when cross compiling	5 years ago
Victor Julien	c010f092e0	detect/replace: fix debug print issue ... Don't print field that will likely not be 0 terminated.	5 years ago
Victor Julien	c3ea5e71e5	detect/file.data: fix buffer reusing id 0	5 years ago
Victor Julien	cd66c37711	http/multipart: use proper progress value to test eof	5 years ago
jason taylor	95237f9894	docs: update datasets examples ... Signed-off-by: jason taylor <jtfas90@gmail.com>	5 years ago
Philippe Antoine	08b84e060b	fastlog: use icmp type and code instead of port ... Fixes #3266	5 years ago
Philippe Antoine	75a7d9641c	fastlog: move code to reduce variable scope	5 years ago
Philippe Antoine	c2fdd7c969	transform: fixes comment about compress_whitespace	5 years ago
Philippe Antoine	9126fc25c1	transform: updates doc about compress_whitespace ... And removes duplicate test from strip_whitespace	5 years ago
Victor Julien	2b581fa836	qa/banned-functions: remove strndup now we have a fall back	5 years ago
Eric Leblond	18a1d93c58	qa/coccinelle: fix make distcheck ... We need to use top_srcdir to know where the sources are. Relative directory is not enough.	5 years ago
Eric Leblond	7a8ddf06de	qa/coccinelle: flag check for setter and getter ... WHen adding something like /* coccinelle: AppLayerParserStateIssetFlag():4,2:APP_LAYER_PARSER_ */ the coccinelle check will consider that AppLayerParserStateIssetFlag is taking 4 parameters and that the second one is a flag that needs to be checked against APP_LAYER_PARSER_.	5 years ago
Eric Leblond	3ded7f1170	qa/coccinelle: fix false positive in setter getter ... Coccinelle test was doing a false positive on the function AppLayerParserStateSetFlag and AppLayerParserStateIssetFlag. To address that, this patch adds a new coccinelle markup: /* coccinelle: AppLayerParserStateSetFlag():2,2:APP_LAYER_PARSER_ */ It indicates that AppLayerParserStateSetFlag is a setter and getter and that the checks should be disabled inside the function. Currently this markup is only used for that but following patch will add some checks on option value.	5 years ago
Eric Leblond	f745f0655b	qa/coccinelle: port struct-flags.py to Python3	5 years ago
Eric Leblond	b58d508bff	qa/coccinelle: reformat struct-flags.py	5 years ago
Eric Leblond	ba6b58a0da	qa: generate struct-flags.cocci at each run	5 years ago
EmilienCourt	50bb8d4cb2	doc: fix typo on example ... Quotes have been forgotten in the dnp3.data example, which throws an SC_ERR_INVALID_SIGNATURE(39) if used like in the example.	5 years ago
Jeff Lucovsky	8f4f1cb633	detect/analyzer: Improved fast pattern display ... When transforms are part of a rule, improve information displayed with fast patterns to include the original buffer name and whether any transform(s) are applied.	5 years ago
Jeff Lucovsky	c88c1f1e14	detect/analyzer: Suppress direction warnings ... This commit suppresses direction warnings by the rules analyzer for ICMP and ICMPV6 since it's not actionable.	5 years ago
Victor Julien	83bbe287e7	stats: fix stats not always syncing in flow timeout	5 years ago
Jason Ish	ba3a2c31bf	app-layer: validate TX detect flag callbacks ... Check that both are set or unset.	5 years ago
Jason Ish	706558d4d5	enip: add tx detect flags	5 years ago
Jason Ish	cb62c8dacf	dcerpc: add tx detect flags	5 years ago
Jason Ish	e2c846d01f	snmp: add tx detect flags	5 years ago
Jason Ish	21f014f5c3	modbus: add tx detect flags	5 years ago
Jason Ish	fa4b9d37c2	krb5: register tx detect flags ... Related ticker #3345: https://redmine.openinfosecfoundation.org/issues/3345	5 years ago
Jason Ish	8a232be77e	rust: define TxDetectFlag struct and binding macros ... Define a TxDetectFlag type and macros to generating C bindings for getting and settings the tx detect flags.	5 years ago