14255 Commits (c945eff66e3dbf664b1e87cd93e0e8a9cee56c8a)

 

All Branches   

Search

Author	SHA1	Message	Date
Victor Julien	c945eff66e	detect/within: minor code cleanups	2 years ago
Victor Julien	8de2948df8	detect/analyzer: fix lists names ... Simpler names that lead to cleaner json.	2 years ago
Victor Julien	325000ca2b	detect/analyzer: add byte_test/byte_jump detail	2 years ago
Victor Julien	105dd636cb	detect/analyzer: add content relative_next flag	2 years ago
Victor Julien	2b85ab0ba1	detect/analyzer: add more pcre detail	2 years ago
Victor Julien	e624328deb	detect: split mpm per alproto for file.data & others ... Instead of a shared mpm context for just "file.data" or "file.magic" use per alproto mpms. This way http file.data rules won't affect smb file.data performance. Ticket: #4378.	2 years ago
Victor Julien	a806445abf	mpm factory: include alproto ... In preparation of spliting out mpm's for keywords shared by multiple protocols, like file.data.	2 years ago
Philippe Antoine	416a780f69	jsonschema: do not enforce keys for alert metadata ... As this is a free field and can have any key based on a rule	2 years ago
Philippe Antoine	8f9cd8ff1a	doc: security.limit-noproc upgrade note ... Ticket: #5621	2 years ago
Lukas Sismis	4f3e1279f5	github-ci: Add Netmap build to GH actions ... Issue: #5803	2 years ago
Jason Ish	0533737726	smtp: apply suricata.yaml defaults to in-code defaults ... Currently the default suricata.yaml sets some values that do not reflect the default values in the code. As most users are probably using a default suricata.yaml, make the code have the same defaults as in suricata.yaml: - mime.decode-mime: false -> true - mime.decode-base64: false -> true - mime.decode-quoted-printable: false -> true - mime.extract-urls: false -> true Issue: #5823	2 years ago
Jason Ish	3a44197183	schema: add "message_id" to email	2 years ago
Jason Ish	3d92990c6f	conf: document ConfGetChildValueBool	2 years ago
Gabriel Lima Luz	b43357eb26	detect-lua: Convert unittests to FAIL/PASS API ... Ticket: 4051	2 years ago
Jason Ish	bdd889899f	source-xdp: only allow busy poll if headers support it ... Wrap the enabling of busy poll in a compile time conditional checking for the required defines to be set. While we have runtime support for kernels less than 5.11, we also need a compile time check as the headers may be old as well. Issue: 5855	2 years ago
Jason Ish	b734676617	github-ci: add Debian 11 builder with XDP	2 years ago
Jason Ish	bf079c9214	schema: fix optional ... "optional" is not part of jsonschema. Instead an array named "required" is used to list all field names that are required.	2 years ago
Jason Ish	49ba378d38	schema: fix engines section ... The definition of items is an object, not an array.	2 years ago
Jeff Lucovsky	2dbcbb2a2a	nflog/time: Fixup timestamp handling ... Issue: 5818 This commit corrects the timestamp handling for the packet to work with the SCTime_t struct.	2 years ago
Jason Ish	159b72c101	rust/clippy: allow derivable impls ... The latest Rust will automatically "fix" derivable default implementation, which is nice, but makes changes that don't meet our current MSRV, so allow derivable impls for now.	2 years ago
Victor Julien	1726bd643c	detect/app-layer-event: simplify parsing code ... Simpler and fully local parsing code. Remove unittests that relied on previous implementation. Code is tested by SV tests.	2 years ago
Victor Julien	0c8646959e	detect/analyzer: add transform names	2 years ago
Shivani Bhardwaj	c089bbb7d7	util/mime: use uint32_t for consumed bytes ... In a case of the line buffer being over 255 bytes, the consumed bytes would reset to 0 as it was uint8_t. Fix this integer overflow by setting the type to uint32_t. Redmine ticket: 5883	2 years ago
Shivani Bhardwaj	0f3e7761da	doc: add dataset examples	2 years ago
Shivani Bhardwaj	901e99fa95	detect: add comments for DETECT_SM_LIST_* types	2 years ago
Jason Ish	c6c781ef67	config: put version in configuration as a proper value ... Adds a new field, "suricata-version" to the configuration file with the major and minor version of the Suricata that generated the configuration file. This may be useful in the future for presenting warnings about important changes, or even providing different defaults based on what the user might expect. Ticket: 5822	2 years ago
Jeff Lucovsky	2d28c09ea1	pfring: Packet structure for ts fix ... Issue: 5818 This commit addresses the issue with using the address of a packed member of a structure. The pfring timeval is within a packed structure.	2 years ago
Jeff Lucovsky	056c13c417	pfring/time: Track stat output with SCTime_t ... Issue: 5818 This commit changes the datatype of the tracking value for the last time stats were dumped. Changing the type also eliminates a comparison between values with different signs.	2 years ago
Jeff Lucovsky	59ab1c20ec	time: SCTime additions -- neq, initializer ... Issue: 5818 This commit adds an initializer for the SCTime_t type and a comparison macro for "not equal". Use them as follows: SCTime_t my_var = SCTIME_INITIALIZER; if (SCTIME_CMP_NEQ(sctime1_val, sctime2_val)) { }	2 years ago
Lancer Cheng	08b17e9778	eve: add version and warning in ntlmssp ... Bug OISF#5783	2 years ago
Lancer Cheng	6142593a69	doc: add version filed in NTLMSSP documentation ... Bug OISF#5783	2 years ago
Lancer Cheng	9207012e4b	smb: fix parser of ntlmssp negotiateflags ... Fix endian-conversion bug in function parse_ntlm_auth_nego_flags Bug OISF#5783	2 years ago
Jeff Lucovsky	cb174e4fd9	log/thread: Consolidate threaded file tracking ... Issue: 5836 This commit removes the duplicate threaded file tracking from the log file mechanisms. Tracking is now consolidated with the threaded hash table.	2 years ago
Jeff Lucovsky	99b7257ef6	log: Stop if log initialization fails at startup ... Issue: 5836 This commit modifies Suricata to fail if log initialization errors occur during startup.	2 years ago
Victor Julien	8746fbe07e	stream: add seq min and max; use in segment compare	2 years ago
Victor Julien	cbcd70537a	stream: fix overlap detection ... If a in-tree segment was partly before base_seq the overlap detection miscalculated the data offset. This lead to memcmp comparing the wrong data. Bug: #5881.	2 years ago
Victor Julien	ceebd6e904	stream: reuse TCP session after TFO SYN+data reject	2 years ago
Victor Julien	ee76b27535	eve/stream: log tcp reuse flag in packets	2 years ago
Victor Julien	2bb1e5a38a	flow: remove unused tcp reuse flow flag	2 years ago
Victor Julien	7ef57cc7cb	stream: support SYN/ACK with TFO only ack'ing ISN ... Not ack'ing the data.	2 years ago
Victor Julien	7e6154a26f	stream: add counter for acks for unseen data ... This is another indicator for packet loss or strange captures.	2 years ago
Victor Julien	37e694b5b8	eve/stream: ack unseen data	2 years ago
Victor Julien	b7739bfdba	stream: flag ACKs that ack segments after next_seq ... Avoid this for async streams.	2 years ago
Victor Julien	a0f0a3b48b	stream: fix spurious retransmission handling ... Fix spurious retransmissions getting dropped, stalling connections in IPS mode. There are several reasons why benign spurious retransmissions can happen, with the most obvious one that an ACK is lost so the sender retransmits while the receiver has ACK'd it. If Suricata sees the ACK but afterwards it gets lost, we can get in this condition. Packet loss can have a wide range of causes here, including packets reaching a host but getting dropped in the NIC queue or kernel queues due to resource constraints. So these packets are no longer an "error" in this patch. Next to this, the accuracy of the spurious retransmission has been improved. Use SEQ macros to compare sequence numbers. Only use base_seq if reassembly is still enabled for a stream. A special case is added for cases where a segment is before last_ack but after base_seq, which can happen when protocol detection isn't finished yet. In this case the segment is tagged as spurious, but still processed. This way we can check for overlaps. Bug: #5875.	2 years ago
Victor Julien	01b7ccc224	stream: add liberal timetamps option ... Linux is slightly more permissive wrt timestamps than many other OS'. To avoid many events/issues with linux hosts, add an option to allow for this slightly more permissive behavior. Ideally the host-os config would be used, but in practice this setting is rarely set up correctly, if at all. This option is enabled by default.	2 years ago
Victor Julien	d79a926085	stream: D-SACK detection and logging ... RFC 2883 specifies a special use of SACKs to indicate a host has received a segment it considers a spurious retransmission.	2 years ago
Victor Julien	6a2fdc456b	stream: Dup-ACK detection ... Modeled after Wiresharks Dup-ACK detection.	2 years ago
Victor Julien	76225bf9ac	stream: fix next_seq updates after temporary gap ... On every accepted packet in established state, update next_seq if packet seq+len is larger than existing next_seq. This allows it to catch up after large gaps that are filled again a bit later. Bug: #5877.	2 years ago
Victor Julien	83a16a7a89	eve/stream: per packet stream engine logging ... Debug facility to get a per packet view into the stream engine's state. Logs after a packet has been processed in the stream engine, so the view into the state includes the updates based on the current packet. Marked as experimental so it can be changed w/o notice. Bug: #5876.	2 years ago
Victor Julien	3948b160c7	stream: implement config option for SYN queue ... Default to allowing 10 SYNs to not trigger an event on a connection attempt that times out.	2 years ago