9450 Commits (d5bb41011c0afd0219f9e450e982e49bdd670ee8)

Author	SHA1	Message	Date
Jeff Lucovsky	d5bb41011c	output/ikev2: Convert to JsonBuilder ... Convert the IKEV2 Json logging to use JsonBuilder.	5 years ago
Philippe Antoine	1e8ac7dadb	dnp3: adds unit test against previous bug	5 years ago
Philippe Antoine	d465bb8686	dnp3: fix buffer over read in responses parsing	5 years ago
Philippe Antoine	629a16e373	dnp3: probing parser fixes direction based on dnp3 header	5 years ago
Philippe Antoine	a90b1c1bcb	fuzz: disable DNP3 checksums while fuzzing	5 years ago
Philippe Antoine	00509da286	fuzz: improves fuzz target applayerparserparse ... Does not proceed final chunk if we got an error previously Flips the direction for last chunk as usual	5 years ago
Victor Julien	b440d0b13e	flow: use stream state to string util func	5 years ago
Victor Julien	1b0319ea98	stream: add state to string funcs	5 years ago
Victor Julien	6608b9a5f3	app-layer: set EOF flag in case of unsupported GAP ... If GAP is not supported set EOF flags in the parser.	5 years ago
Victor Julien	54d2f2c300	flow: improve 'under stress' behavior ... When under stress, the packet threads ultimately fall back to walking the hash table until they find a flow they can safely evict and reuse. This could lead to all threads fighting over the FlowBucket locks. Fix by adding a limit to the number of hash rows that are checked for a new flow. If the limit is reached, simply fail to get a flow.	5 years ago
Victor Julien	c50ef8cc21	flow: fix TCP closed default initialization ... TCP closed state was initialized to 0 by default. Clean up 'closed' value setting for other protocols and the common default.	5 years ago
Victor Julien	3bba671273	flow: remove unused function declaration	5 years ago
Victor Julien	cba8efff2a	flow: remove unused sctp enum member ... This caused some arrays to be larger than needed.	5 years ago
Victor Julien	c2561b2655	flow: cleanup validation check	5 years ago
Jeff Lucovsky	8c5c949cfa	output/tftp: Convert to JsonBuilder ... This commit converts the TFTP logging mechanisms to JsonBuilder.	5 years ago
Philippe Antoine	5ac8e41a13	signature: fix linked list for bidirectional signatures ... Bidirectional signatures are really two signatures with one id This needs to be handled with care when changing a linked list	5 years ago
Philippe Antoine	ac76ff9e47	detect: fail properly on invalid transform pcrexform	5 years ago
Antti Tönkyrä	57d0f4bb6f	detect/flowbits: fix stack overflow in analyzer ... Fix stack overflow in DetectFlowbitsAnalyze. Use dynamically allocated array instead of stack and free it after it is no longer needed.	5 years ago
Jason Ish	c09235e327	netflow/eve: convert to JsonBuilder	5 years ago
Jeff Lucovsky	9c47b8c1bf	general: Fix spelling error	5 years ago
Jeff Lucovsky	64912104b3	detect/content: Validate content byte array ... This commit checks whether the content byte array is compatible with the transforms, if any, for the rule.	5 years ago
Jeff Lucovsky	197a593078	detect: Add transform validation api ... This commit extends the API with a function that validates arguments against the transforms for the SM list (if any).	5 years ago
Jeff Lucovsky	0189ff998f	detect/transform: Add validation function ... This commit adds a function to pre-validate buffers. If a content buffer contains whitespace, the validation fails.	5 years ago
Jeff Lucovsky	a4132d8e0f	detect/transform: Add transform "validate" function ... This commit adds an (optional) entry for a validation function. The validation function, if present, will be used during rule processing. Its role is to determine if the arguments are compatible with the transform. E.g., a content string of "this string has whitespace" is not compatible with the `strip_whitespace` transform.	5 years ago
Jason Ish	114b7e5cd9	dhcp/eve: remove erroneous jsonbuilder close ... The JsonBuilder was being closed to early.	5 years ago
Jeff Lucovsky	4127c5fcc8	output/fileinfo: Optimize filename output ... This commit optimizes the JSON preparation of the file name by eliminating the temporary copy before adding to the Json builder buffer.	5 years ago
Jeff Lucovsky	0d298d47a1	output/rdp: Include common output options ... This commit will cause common metadata values and the community id to be included in log output when configured.	5 years ago
Jeff Lucovsky	ef3840e256	output/dhcp: Include common output options ... This commit will cause common metadata values and the community id to be included in log output when configured.	5 years ago
Jeff Lucovsky	c6c4936a20	output/smb: Include common output options ... This commit will cause common metadata values and the community id to be included in log output when configured.	5 years ago
Jeff Lucovsky	414bb25c93	output/tftp: Include common options ... This commit will cause common metadata values and the community id to be included in log output when configured.	5 years ago
Angelo Mirabella	0cdc009da1	detect/http_raw_header: Correct type mismatch ... This changeset fixes a bug on the computation of the buffer lenght for raw http headers. The bug is due to a mismatch on the data type of the length (uint8_t vs uint32_t) and it was causing signature misses.	5 years ago
Victor Julien	37d228dae0	rule/parse: minor action parsing cleanup	5 years ago
Victor Julien	14e1a342ac	reject: support single vlan layer ... Support sending RST/ICMP errors for packet with a single VLAN header.	5 years ago
Victor Julien	9f3f07dd97	reject: get MTU for reject-dev and use it	5 years ago
Victor Julien	498ae0180b	reject: minor optimization of reset entry code	5 years ago
Victor Julien	279865b145	reject: remove L3 from function names	5 years ago
Victor Julien	c594d0c1ad	reject: allow configuration of the reject interface ... Using the '--reject-dev <dev>' commandline option. This is a global option that applies to all 'reject' actions. If the interface specified is using ethernet, libnet will use the faster L2 (link) layer. Suricata sets up the ethernet header based on the packet. When the interface is specified, cache libnet_t ctx for (much) better performance.	5 years ago
Victor Julien	604aa65c80	reject: don't respond to tunnel packets	5 years ago
Victor Julien	a6ed9b11d5	reject: check tcp header sooner to avoid potential leak	5 years ago
Victor Julien	1b042cf108	reject: optimize and simplify run test	5 years ago
Victor Julien	66257f37eb	reject: never return error ... Errors by thread modules are not handled.	5 years ago
Jason Ish	b8d1677b9c	file-hash-common: fix rule_file truncation ... Loading file hash lists uses dirname(3) on the de_ctx->rule_file which modifies the contents, removing the last part of the path. So on subsequent calls the rule_file no longer contains the rule_file, but instead just the directory name. Mostly noticed when using "-S" with rule files outside of the default-rule-path which requires more hunting for the rule file.	5 years ago
Jeff Lucovsky	648bd5afff	output/ftp: Use "Eve" prefix with FTP helpers ... This commit changes the prefix of the FTP helper routines from Json to Eve.	5 years ago
Jeff Lucovsky	1f19ab1013	output/eve: Remove unused helper function ... This commit removes an unused helper function no longer required/used after conversion to JsonBuilder.	5 years ago
Jeff Lucovsky	03de315bc2	ftp/eve: Convert FTP logging to use JsonBuilder ... This commit converts the FTP logging mechanisms to use JsonBuilder.	5 years ago
Shivani Bhardwaj	a7535099b4	smb/eve: convert to jsonbuilder ... Closes redmine ticket 3712.	5 years ago
Jeff Lucovsky	d14a14fa13	output/anomaly: Use helpers for string output	5 years ago
Jeff Lucovsky	9097df3a3b	output/flow: Use helpers for string output	5 years ago
Jeff Lucovsky	ff92745851	output/json: Include fileinfo in alerts ... This commit adds fileinfo to alerts when `metadata` is configured.	5 years ago
Jeff Lucovsky	cc99f95ecd	json: macro for setting formatted false value	5 years ago