18240 Commits (ca16b4ebf7ecb58c5d2bfcf034f209f98e99f4df)

 

All Branches   

Search

Author	SHA1	Message	Date
Philippe Antoine	ca16b4ebf7	detect/parse: debug validation about stack allocation ... Ticket: 8001	12 months ago
Philippe Antoine	3337617a5e	output: debug validation about stack allocations ... Ticket: 8001 For flow variables names	12 months ago
Philippe Antoine	42d6c85757	util/debug: debug validation about stack allocation ... Ticket: 8001	12 months ago
Philippe Antoine	6b7c78393c	util/classification: check stack allocation size ... Ticket: 8001	12 months ago
Philippe Antoine	753ab723b0	datasets: debug validation for stack allocation size ... We iterate C substrings of a string whose max size is SIG_JSON_CONTENT_KEY_LEN Ticket: 8001	12 months ago
Jason Ish	a9eee5dfd9	rust/htp: convert to nom 8 ... Ticket: #8090	12 months ago
Jason Ish	ef9cd7beff	rust/smb: convert to nom 8 ... Ticket: #8089	12 months ago
Jason Ish	02045e1d62	rust/dcerpc: convert to nom 8 ... Ticket: #8093	12 months ago
Jason Ish	25c98af0e8	rust/detect: convert remaining detection rule parsers to nom 8 ... Ticket: #8051	12 months ago
Jason Ish	dea3f9e260	rust/detect: convert error.rs and dependent parsers to nom 8 ... Ticket: #8051	12 months ago
Jason Ish	efc32dea41	rust/detect: convert uint nom 8 ... And users of uint directly impacted by this change. Ticket: #8051	12 months ago
Jason Ish	cf604751de	rust/util: convert to nom 8 ... Ticket: #8088	12 months ago
Jason Ish	1e01d5adca	rust/conf: convert to nom 8 ... Ticket: #8087	12 months ago
Jason Ish	c6e8932740	rust/asn1: convert to nom 8 ... Ticket: #8086	12 months ago
Jason Ish	59f8fb30a8	rust/ftp: fix clippy warning ... error: implicitly casting the result of `from_raw_parts_mut` to `*mut [u8]` --> src/ftp/response.rs:107:31	12 months ago
Jason Ish	745e972348	github-ci: update Rust 1.91 for clippy and "known" stable	12 months ago
Philippe Antoine	9d164d8794	fuzz/conf: bail out on long sequence of scalars ... Ticket: 8105	12 months ago
Olusegun Fajobi	785389aa00	detect/analyzer: add more details for flowint keyword ... Ticket: 6311	12 months ago
Cheryl Owala	8120d9dc6c	detect-pcre: convert unittests to FAIL/PASS API ... Convert unittests to new FAIL/PASS API. Ticket: #6344	12 months ago
Philippe Antoine	cba13ed9b1	rust: bindgen functions needed for datasets ... Ticket: 7762	12 months ago
Philippe Antoine	12892ba010	rust: bindgen functions neede for features ... Ticket: 7762	12 months ago
Philippe Antoine	b21c93d789	util/time: fix TimeDifferenceMicros microseconds computation ... Ticket: 8073 Currently only used in pcap logging for flushing	12 months ago
Victor Julien	874a0e8d3d	unix-socket/hostbits: fix ipv6 address parsing ... In `add-hostbit`, `remove-hostbit` and `list-hostbit` commands, the IPv6 address parsing was not using the correct variable: from /usr/include/dirent.h:25, from suricata-common.h:73, from runmode-unix-socket.c:18: In function ‘inet_pton’, inlined from ‘UnixSocketHostbitAdd’ at runmode-unix-socket.c:1316:13: /usr/include/x86_64-linux-gnu/bits/inet-fortified.h:56:10: warning: call to ‘__inet_pton_chk_warn’ declared with attribute warning: inet_pton called with a destination buffer size too small [-Wattribute-warning] 56 | return __glibc_fortify (inet_pton, __sz, sizeof (char), | ^~~~~~~~~~~~~~~ In function ‘inet_pton’, inlined from ‘UnixSocketHostbitRemove’ at runmode-unix-socket.c:1403:13: /usr/include/x86_64-linux-gnu/bits/inet-fortified.h:56:10: warning: call to ‘__inet_pton_chk_warn’ declared with attribute warning: inet_pton called with a destination buffer size too small [-Wattribute-warning] 56 | return __glibc_fortify (inet_pton, __sz, sizeof (char), | ^~~~~~~~~~~~~~~ In function ‘inet_pton’, inlined from ‘UnixSocketHostbitList’ at runmode-unix-socket.c:1476:13: /usr/include/x86_64-linux-gnu/bits/inet-fortified.h:56:10: warning: call to ‘__inet_pton_chk_warn’ declared with attribute warning: inet_pton called with a destination buffer size too small [-Wattribute-warning] 56 | return __glibc_fortify (inet_pton, __sz, sizeof (char), | ^~~~~~~~~~~~~~~ Bug: #8102.	12 months ago
Victor Julien	3a0f4dde07	thresholds: fix unittest compile warning ... In file included from decode.h:33, from host.h:27, from util-threshold-config.c:34: util-threshold-config.c: In function 'SCThresholdConfInitContext': util-debug.h:260:5: warning: '%s' directive argument is null [-Wformat-overflow=] 260 | SCLogErr(SC_LOG_WARNING, __FILE__, __FUNCTION__, __LINE__, _sc_module, __VA_ARGS__) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ util-threshold-config.c:190:9: note: in expansion of macro 'SCLogWarning' 190 | SCLogWarning("Error loading threshold configuration from %s", filename); | ^~~~~~~~~~~~ util-threshold-config.c:190:66: note: format string is defined here 190 | SCLogWarning("Error loading threshold configuration from %s", filename); | ^~	12 months ago
Jason Ish	6bd360570a	dnp3: fix dnp3 generation script to match code	12 months ago
Jeff Lucovsky	e1bf5cb1f3	nfs: Support EXCLUSIVE4_1 flag ... Issue: 8006 Support the EXCLUSIVE4_1 create mode added to NFS 4.1	12 months ago
Philippe Antoine	deb5926609	fuzz: increase some config values ... To get better coverage and bug findings Ticket: 8068	12 months ago
Philippe Antoine	a07390573f	fuzz: default conf with verdict enabled in alerts	12 months ago
Philippe Antoine	af8390f2ca	doc: upgrade note for engine-analysis breaking change ... For keywords that now use the generic integer framework Ticket: 7889	12 months ago
Philippe Antoine	d94aea8331	detect: tcp.window is now a generic integer ... Ticket: 7889	12 months ago
Philippe Antoine	68bb783e97	detect: tcp.seq is now a generic integer ... Ticket: 7889	12 months ago
Philippe Antoine	ed907bbd78	detect: tcp.ack is now a generic integer ... Ticket: 7889	12 months ago
Philippe Antoine	7a8eb28cae	detect: id is now a generic integer ... Ticket: 7889	12 months ago
Philippe Antoine	bff7413488	detect: icmp_seq is now a generic integer ... Ticket: 7889	12 months ago
Philippe Antoine	79e66f76e6	detect: icmp_id is now a generic integer ... Ticket: 7889	12 months ago
Philippe Antoine	09531447d1	detect: fragoffset is now a generic integer ... Ticket: 7889	12 months ago
Philippe Antoine	85fa894425	detect: dnp3.func is now a generic integer ... Ticket: 7889	12 months ago
Jason Ish	70a2524d95	ci: update ndpi to 4.14	12 months ago
Jeff Lucovsky	b02d9bb4f1	doc/luaxform: Remove init function from example ... Issue: 8035 The `luaxform` transform doesn't support the `init` function. This commit removes that from the example and clarifies how functions in the Lua script are used.	12 months ago
Victor Julien	558ab73a7f	doc/devguide: explain alert logging changes	12 months ago
Victor Julien	d45bdb85d5	eve/verdict: more explicit pass handling ... Instead of indexing `Packet::alerts` to find out if the action should be `ACTION_PASS`, add an arguement to make this explicit from the alert logging logic. Bug: #7630.	12 months ago
Victor Julien	5b19508661	detect/alert: fully add pass-only rules to alert queue ... Pass-only rules were previously stored in Packet::alerts, but not correctly. The `cnt` wasn't incremented leaving it in a weird state. This patch changes the logic to have a `pass` entry be added to the queue as well as incrementing the `cnt`. As a consequence of this the alert logging needs to explicitly check for `PacketAlert::action` having `ACTION_ALERT` set now. Update the alert loggers. Bug: #8021.	12 months ago
Victor Julien	2a7eb5d062	detect/threshold: set missing alert flag in rate_filter ... ACTION_ALERT is supposed to be set now, but wasn't for rate_filter. This becomes important in a follow up patch where only PacketAlert entries with `action` `ACTION_ALERT` are logged in alert logging.	12 months ago
Victor Julien	bccdb445ff	eve/verdict: clean up packet action checking ... Get action from packet just once.	12 months ago
Philippe Antoine	b8411fcc8d	output/http: log content-type like other headers ... Ticket: 8056 Avoid stack allocation. Do not handle null and ; especially	12 months ago
Philippe Antoine	acc051ac94	unix-socket: return after closing on too long ... Avoids later use after free Ticket: 8063	12 months ago
Philippe Antoine	a84addb771	util/swf: move allocation from stack to heap ... As it can overflow the stack Ticket: 8055	12 months ago
Philippe Antoine	f2b6540c52	htp: bound decompression ... Ticket: 7980 Usage of Vec<u8> instead of Box<u8> gave the ability to callers to grow the buffer (indefinitely) This was regressed in 16fee33368 Additionnaly, use rust WriteZero instead of WouldBlock as a more fitting error when cursor is full, as that error kind is the one tested by callers.	12 months ago
Philippe Antoine	c61f1cb6d0	detect/integers: rename index all1 to all ... And all to all_or_absent Ticket: 7929	12 months ago
Philippe Antoine	eb5a2d646b	detect/vlan: move vlan.id keyword to generic integer ... Ticket: 7929	12 months ago