11275 Commits (d720ead470bcb5dd5a0c0ae7db302ab170205ee6)

Author	SHA1	Message	Date
Daniel Young	aeb0c0e71a	detect/parse-port: fix whitespaces bug ... Updated by Victor Julien to: - accept but strip leading whitespaces - update tests - cleanup tests	4 years ago
Eric Leblond	ea85e2ccf2	detect/filename: fix buffer description	4 years ago
Shivani Bhardwaj	82dba07579	src: remove unneeded header and refs	4 years ago
Haleema Khan	df45fc9e97	detect-l3proto: Convert unittests to new FAIL/PASS API ... Ticket: #4050	4 years ago
Alice Akaki	d46ce170ba	detect-icmp-seq: clean-up unittests ... Task: #5597	4 years ago
Eric Leblond	4e1ff9a7ff	flow: fix FlowSwapFileFlags function ... Ticket: #5625	4 years ago
Haleema Khan	160c778a1f	detect-filesize: Convert unittests to new FAIL/PASS API ... Ticket: 4039	4 years ago
Haleema Khan	f25d4cc546	detect-distance: Convert unittests to new FAIL/PASS API ... Ticket : #4020	4 years ago
Alice Akaki	f251b6af65	detect-icmp-id: convert unittests to FAIL/PASS APIs ... Task: #4042	4 years ago
Haleema Khan	1fdd56a61d	detect-itype: Convert unittests to new FAIL/PASS API ... Bug: #5589	4 years ago
Simeon Miteff	6673846481	profiling: Make rule_perf.log JSON output newline-delimited ... Adding a newline makes the output valid JSON when multiple sortings of the rules profile object are written to the log.	4 years ago
Jason Ish	0d3cfbbe3f	bittorrent-dht/eve: log as bittorrent_dht	4 years ago
Aaron Bungay	86037885a9	bittorrent-dht: add bittorrent-dht app layer ... Parses and logs the bittorrent-dht protocol. Note: Includes some compilation fixups after rebase by Jason Ish. Feature: #3086	4 years ago
Jason Ish	27672c950c	dnp3: fixups to work with unified json tx logger ... Update DNP3 to work with a single TX logger, and just register one logger instead of 2. This primarily creates a TX per message instead of correlating replies to requests, which fits the DNP3 model better, but we didn't really have this concept nailed down when DNP3 was written.	4 years ago
Victor Julien	2f9ca8bb34	dpdk: set new running flag at thread startup	4 years ago
Victor Julien	91b7b63ed2	threads: count thread types after all initialized ... To avoid double counting in case a thread took longer than expected to start up.	4 years ago
Alice Akaki	6621b0ec93	detect-icmp-seq: convert unittests to FAIL/PASS APIs ... Task: #4043	4 years ago
Haleema Khan	8d5c5f24a1	dns/eve: add 'HTTPS' type logging ... Add a new DNS record type to represent HTTPS Ticket: #4751	4 years ago
Haleema Khan	b1972a5c61	detect-itype: remove unittests ... Ticket: #5590	4 years ago
Gabriel Lima Luz	4b009eb907	detect-replace: Convert unittests to FAIL/PASS API ... Ticket: 4054	4 years ago
Philippe Antoine	a003640ecf	security: prevents process creation ... with setrlimit NPROC. So that, if Suricata wants to execve or such to create a new process the OS will forbid it so that RCE exploits are more painful to write. Ticket: #5373	4 years ago
Jason Ish	2ab3646fad	profiling: sort LoggerId's in same order as defined ... Sort the LoggerId's in the order they are define in suricata-common.h.	4 years ago
Jason Ish	99cb8c666a	loggers: all json tx loggers can share the same loggerid ... This is to avoid the tx logging code that doesn't support LoggerId values over 31 at this time. The simplest fix for now is to just have all JSON (eve) loggers use the same ID. DNP3 is left as-is for now as it needs some extra support in the parser.	4 years ago
Richard McConnell	13beba141c	source: add THV_RUNNING flag to notify of running state ... Each module (thread) updates its status to indicate running. Main thread awaits for all threads to be in a running state before continuing the initialisation process Implements feature 5384 (https://redmine.openinfosecfoundation.org/issues/5384)	4 years ago
Eric Leblond	94664ef565	datasets: don't exit on invalid data	4 years ago
Eric Leblond	3bd48d9336	detect: doc link for ip.src and ip.dst	4 years ago
Eric Leblond	7518204ad4	datasets: introduce new IPv6 type ... This patch also simplifies IPv6 parsing. Feature: #5383	4 years ago
Eric Leblond	6fe9d510cf	detect: add ip.dst keyword as sticky buffer ... Feature: #5383	4 years ago
Eric Leblond	7e516aad94	detect: add ip.src keyword ... It is a sticky buffer matching on src_ip. Feature: #5383	4 years ago
Eric Leblond	b2cdc6c899	datasets: introduce ipv4 type ... This patch introduce the IPv4 type for dataset so Suricata commandmatch on a set of IPv4 addresses. This is meant to complement iprep feature for people that needs more flexibility such as settings the IP on the packet path. Feature: #5383	4 years ago
Eric Leblond	a9c05c7d96	datasets: factorize serialised operations ... Ticket: #5184	4 years ago
Eric Leblond	843dba0a28	datasets: add dataset-lookup command ... Ticket: #5184	4 years ago
Eric Leblond	2f25e48897	datasets: add dataset-clear command ... Ticket: #5184	4 years ago
Eric Leblond	a480abcdd0	datasets: add dump via unix socket ... This patch adds a dataset-dump command to the list of unix socket commands. Implementation is not optimal as we are locking the datasets when doing the dump. But if we consider that the current alternative from an implementation point of view is to stop Suricata then this is far better than current state. Ticket: #5184	4 years ago
Victor Julien	1fafb83fed	packet: turn tunnel lock into spinlock ... Lock is only held to update/check ints, so spin lock will be more efficient. Place the member of Packet in a new "persistent" area to make it clear this is not touched by the PacketReinit logic. Ticket: #5592.	4 years ago
Victor Julien	57e70841c4	stream/tcp: remove obsolete and commented out tests	4 years ago
Victor Julien	e72770c1b2	decode/vxlan/tests: don't memset new packet	4 years ago
Victor Julien	edf93ae5b6	decode/mpls/tests: improve pkt handling; cleanups	4 years ago
Victor Julien	0f7fe2a4c3	app-layer/tests: don't memset new packet	4 years ago
Victor Julien	6dc53447f1	decode/geneve/tests: don't memset packet ... Packet is already initialized.	4 years ago
Victor Julien	b07c7ad14c	threading: improve/add thread queues explanations	4 years ago
Victor Julien	951bcde0b2	eve/alert: remove tunnel locking ... Tunnel lock is only used to sync verdict logic.	4 years ago
Victor Julien	0e7adc21a6	decode: alloc packets using calloc	4 years ago
Victor Julien	68a9da52ad	packetpool: remove PKT_ALLOC flag ... Use Packet::pool instead. If Packet::pool is non-NULL the packet is owned by a pool. Otherwise it is allocated and should be freed after use.	4 years ago
Victor Julien	3ed7b4473e	runmodes: remove dead error check	4 years ago
Victor Julien	9d3c60bde3	smtp/mime: no error logging in packet path	4 years ago
Victor Julien	256f0f2c5c	defrag: no error logging in packet path	4 years ago
Victor Julien	8f02a3e415	applayer: make sure to use correct ipproto	4 years ago
Victor Julien	dba7103a96	eve/alert: use flow proto to avoid crash on ICMP	4 years ago
Alice Akaki	51c0714d71	detect-filemd5: convert unittests to FAIL/PASS APIs ... Task: #4035	4 years ago
Alice Akaki	fe31d51c30	detect-filesha256: convert unittests to FAIL/PASS APIs ... Task: #4038	4 years ago
Haleema Khan	6988168114	src: Use WARN_UNUSED for ByteExtract* functions ... Add WARN_UNUSED macro for ByteExtract* functions Fix warning raised in code related to WARN_UNUSED for ByteExtract* Ticket: #3658	4 years ago
Alice Akaki	76024f7571	detect-filename: convert unittests to FAIL/PASS APIs ... Task: #4036	4 years ago
Alice Akaki	8614bff017	detect-filemagic: convert unittests to FAIL/PASS APIs ... Task: #4034	4 years ago
Victor Julien	55cf11fdc2	flow/storage: use const for getter	4 years ago
Victor Julien	99fd69ee8c	eve: mac logging code cleanup	4 years ago
Victor Julien	2d79a5206b	eve/drop: log direction if we have a flow	4 years ago
Victor Julien	90f3823cad	eve: log mac addresses in packet direction	4 years ago
Victor Julien	f1068bbb08	dpdk: fix timestamp issues ... Each thread had its own version of the `machine_start_time`, which lead to slight time differences. This became apparent mostly in IPS, where 2 threads each process a side of the flow. This patch makes the `machine_start_time` global.	4 years ago
Victor Julien	cd2a5ec84f	packet: move action functions to packet files	4 years ago
Victor Julien	0977f40d1c	detect/tag: improve time handling on windows ... Bug: #5584.	4 years ago
Victor Julien	410acf226f	detect: unittest guards for ut only function	4 years ago
Victor Julien	60285a629f	detect: remove unused function	4 years ago
Victor Julien	5d6212183b	eve/alert: minor cleanups	4 years ago
Victor Julien	6c200c7793	detect: issue drop to root packet in all cases ... Update DROP action handling in tunnel packets. DROP/REJECT action is set to outer (root) and inner packet. Check action flags both against outer (root) and inner packet. Remove PACKET_SET_ACTION macro. Replace with RESET for the one reset usecase. The reason to remove is to make the logic easier to understand. Reduce scope of RESET macros. Rename PacketTestAction to PacketCheckAction except in unittests. Keep PacketTestAction as a wrapper around PacketCheckAction. This makes it easier to trace the action handling in the real code. Fix rate_filter setting actions directly. General code cleanups. Bug: #5571.	4 years ago
Victor Julien	79fc8e74cb	packetpool: debug message to assist drop checks	4 years ago
Victor Julien	d1009e295c	packetpool: remove debug validation check ... Current packet might be the root or a child. Root would have set drop action set, but Packet::pkt_src might be set in either.	4 years ago
Victor Julien	fe5a8beb50	decode: minor code cleanup	4 years ago
Victor Julien	ba3e0b3155	nfq: set drop reason on verdict error	4 years ago
Victor Julien	a7333a3ea5	napatech: reduce size of Packet structure ... Put napatech packet vars in the union that is meant for this type of data.	4 years ago
Haleema Khan	b31a286952	detect-fileext: convert unittests to FAIL/PASS APIs ... Fixes Bug: #4033	4 years ago
Lukas Sismis	5365fdccf7	dpdk: fix mempool cache error message	4 years ago
Shivani Bhardwaj	7005443b8b	base64: add and clean tests	4 years ago
Shivani Bhardwaj	dad52f133d	base64: add new mode as per RFC 4648 ... As per RFC 4648, Implementations MUST reject the encoded data if it contains characters outside the base alphabet when interpreting base-encoded data, unless the specification referring to this document explicitly states otherwise. Add a new mode BASE64_MODE_RFC4648, and handle input strictly as per the specification. Bug 5223	4 years ago
Lukas Sismis	e101384e7b	transversal: remove suricata-ids.org references	4 years ago
Lukas Sismis	aeb690317a	dpdk: allow specifying RSS hash function flags in the config ... Ticket: #5400	4 years ago
Eric Leblond	e46a0bd46a	eve: explicit default when setting port	4 years ago
Eric Leblond	00c419a6f8	eve: micro simplification	4 years ago
Eric Leblond	a0065f4368	eve/alert: add direction field to log data way ... Add a key in the event to specify if the data that did trigger the alert are in to_client or to_server direction.	4 years ago
Eric Leblond	f1300e68c9	eve/alert: add src and dest info to flow in alert ... When looking at an alert event, it was impossible to determine which side from src or dest IP in the alert was the client and wich side was the server with regards to the underlying flow. This was a problem when you try to known who belongs a metadata property such as a HTTP hostname or a TLS JA3. This patch updates the code to add src and dest IP in the flow subobject as well as src and dst port. This way, we can now which side is the client and which side is the server. The result is looking like: { "event_type": "alert", "src_ip": "22.47.184.196", "src_port": 81, "dest_ip": "192.168.1.47", "dest_port": 1063, "proto": "TCP", "tx_id": 0, "alert": { "signature_id": 2018959, "rev": 3, }, "app_proto": "http", "flow": { "pkts_toserver": 22, "pkts_toclient": 35, "bytes_toserver": 1370, "bytes_toclient": 48852, "start": "2009-10-28T10:01:46.755232+0100", "src_ip": "192.168.1.47", "dest_ip": "22.47.184.196", "src_port": 1063, "dest_port": 81 } }	4 years ago
Eric Leblond	bb93d67ddd	unix-socket: add command to get flow stats ... Add a command to extract the accounting data from a live flow using the unix socket. It takes the flow_id as param and return the volume of data seen on the flow as well as its age.	4 years ago
Eric Leblond	19400a7d69	flow: add function to get flow using flow_id	4 years ago
Eric Leblond	06756314d6	flow: change flow id computation method ... Previous method was truncating the flow hash value when building the flow_id. It is interesting not to loose the flow hash value as it can be used in other tools or to interact with a flow that is still active.	4 years ago
Eric Leblond	06b6f85c1f	json/flow: log if flow had gap in TCP	4 years ago
Eric Leblond	f9faff5c4c	flow: add function to say if there is gap	4 years ago
Eric Leblond	e6768118da	stream: flag TCP streams with gap	4 years ago
Eric Leblond	9cb06d4376	detect/smb: add smb.ntlmssp_domain keyword ... Feature #5411.	4 years ago
Eric Leblond	69ef1bc194	detect/smb: add smb.ntlmssp_user keyword ... Feature #5411.	4 years ago
Victor Julien	a6e86fef04	detect: remove unused data struct	4 years ago
Victor Julien	f837146321	flow/worker: process injected flows more gradually ... Worker threads are responsible for final processing of timed out flows. These are selected by the Flow Manager and inserted into a per thread queue. The Flow Worker then checks this queue after each packet. Due to the burstiness of this process, the packet threads would sometimes process a lot of these flows in the context of a single packet, leading to spike in latency which might cause packet loss. This patch changes the behavior to only process at max 2 flows per packet. This way added processing cost is amortized over many packets.	4 years ago
Victor Julien	ce1bdcb474	flow: count max number of injected flows in workers	4 years ago
Victor Julien	235f369ab9	stream: reduce pool locking overhead ... Add thread local cache to avoid locking overhead for ssns and segments. A thread will return segments/ssns to a local cache first, and if that is full, to a return queue where the actual return to the pool returns a batch, to amortize locking overhead. Adds segment and session pool/cache counters to see where how effective the cache is.	4 years ago
Victor Julien	536d66e344	stream: minor test cleanup	4 years ago
Victor Julien	839a4f5ab4	files: only call loggers is there is work to do	4 years ago
Victor Julien	fa6d41ca66	filestore: remove obsolete checks	4 years ago
Victor Julien	0b3053a376	filestore: fix empty file not opening, but trying to close	4 years ago
Victor Julien	23323a961f	app-layer: reduce app cleanup and output-tx calls ... Track packets that updated the app-layer, and for those run the transaction housekeeping and output-tx logging loops. Do the same of end of flow packets. This skips needless iterations over the transaction stores.	4 years ago
Victor Julien	4bb7f827e0	output/tx: minor cleanups/optimizations	4 years ago
Victor Julien	39cf5b151a	src: includes cleanup ... Work towards making `suricata-common.h` only introduce system headers and other things that are independent of complex internal Suricata data structures. Update files to compile after this. Remove special DPDK handling for strlcpy and strlcat, as this caused many compilation failures w/o including DPDK headers for all files. Remove packet macros from decode.h and move them into their own file, turn them into functions and rename them to match our function naming policy.	4 years ago
Victor Julien	3e2295a963	detect: clean up detect-engine-state.h ... Remove prototypes that are not about purely the data structures.	4 years ago
Victor Julien	ad0a29cabc	detect: remove wrapper func	4 years ago
Victor Julien	1dd0a2fed6	detect: move DetectTransaction to header its used in	4 years ago
Victor Julien	41265a859e	detect/files: optimize file.data by skipping non-file txs ... As well as 'file' txs not in our direction. Implement the same logic for file.name and file.magic prefilter engines.	4 years ago
Victor Julien	db0f9ddc69	files/tx: inspection, logging and loop optimizations ... Introduce AppLayerTxData::file_tx as direction(s) indicator for transactions. When set to 0, its not a file tx and it will not be considered for file inspection, logging and housekeeping tasks. Various tx loop optimizations in housekeeping and output. Update the "file capable" app-layers to set the fields based on their directional file support as well as on the traffic.	4 years ago
Victor Julien	3263202094	detect/tx: add AppLayerTxData to PrefilterTx ... In preparation of some file inspection optimizations, for which we need the tx data. Update all users.	4 years ago
Victor Julien	602c39ed01	files: remove unused code	4 years ago
Victor Julien	b1c22169f8	files: don't set NOSTORE in 'store all' case	4 years ago
Victor Julien	d39a79b6f2	smtp: remove bad tests	4 years ago
Victor Julien	79499e4769	app-layer: move files into transactions ... Update APIs to store files in transactions instead of the per flow state. Goal is to avoid the overhead of matching up files and transactions in cases where there are many of both. Update all protocol implementations to support this. Update file logging logic to account for having files in transactions. Instead of it acting separately on file containers, it is now tied into the transaction logging. Update the filestore keyword to consider a match if filestore output not enabled.	4 years ago
Victor Julien	01e64d80da	app-layer: trunc parser per direction	4 years ago
Victor Julien	ff9d1807f9	app-layer: parser flags to u16	4 years ago
Victor Julien	a1d728bb65	app-layer: specify direction in tx cleanup ... In preparation of per tx files storage.	4 years ago
Victor Julien	c27df6304d	app-layer: introduce common AppLayerStateData API ... Add per state structure for storing flags and other variables.	4 years ago
Victor Julien	96b642c32d	file: minor debug updates	4 years ago
Victor Julien	2218a3716e	file: clean up file flags handling	4 years ago
Victor Julien	408b64558f	files: debug log flags	4 years ago
Victor Julien	bdbaaa3b24	lua: store id with tx ptr	4 years ago
Sascha Steinbiss	8438ee48aa	decode-ipv4: adjust validation to RFC ... RFC1108 only specifies a minimum field length of 3, not a fixed length of 11.	4 years ago
Sascha Steinbiss	fb790121bb	decode-ipv4: implement extended security option ... IP option 0x85 (extended security) is mentioned in the documentation for the ipopts keyword but was not implemented.	4 years ago
Philippe Antoine	ae6abd8ca3	ssl: fix compiler warning ... implicit conversion loses integer precision: 'int' to 'uint16_t' because C shifts << translates automatically to signed integers	4 years ago
Victor Julien	b06c0579f5	stream: fix reachable assertion ... Fix `Flow::thread_id` not always getting properly set up, leading to a reachable assertion. Bug #4582.	4 years ago
Juliana Fajardini	9d9bc04886	stream/tcp: typo fix	4 years ago
jason taylor	489af24132	detect: update ttl debug log messages ... Signed-off-by: jason taylor <jtfas90@gmail.com>	4 years ago
Jeff Lucovsky	ccd1063e43	detect/bytemath: convert parser to Rust ... Issue: 5077 This commit - Converts the PCRE based parser to Rust. - Adds unit tests to the new Rust modules - Removes the PCRE parser from detect-bytemath.c - Adjusts the C source modules to refer to the Rust definitions - Includes the multiply operator (missing from the C parser)	4 years ago
Philippe Antoine	c6d8daecd3	log: fix coverity warning ... CID 1515529 Checks ftell return value for negative/error	4 years ago
Victor Julien	1701a6b14c	tls: handle incomplete header sooner ... Make sure to exit the parser early on incomplete header data. Additionally, make sure to not create duplicated tls frames in this case. Add a debug validation check for the header parser parsing too much data, which should never happen.	4 years ago
Victor Julien	9053c49178	ssl: add debug validation check for incomplete api	4 years ago
Victor Julien	0ec136621d	debug: add bool string print helper macro	4 years ago
Victor Julien	69be41b241	tls: improve record checks ... Improve unknown record handling. Inspired by Wireshark 'unknown record' handling, we take a best effort approach for records with unknown content types in TLS versions 1.0, 1.1 and 1.2. Improve record length check and set 'invalid_record_length' event instead of 'invalid_tls_header'.	4 years ago
Victor Julien	c028800ae1	tls: improve versions extension logic ... Skip over unusable versions like GREASE.	4 years ago
Victor Julien	599791fa33	tls: make version and size checks stricter ... This way bad records won't buffer lots of stream data.	4 years ago
Victor Julien	c73d812026	tls: store cert data in heap buffer ... Cert chain is a list of pointers into this buffer, so can't use a stream slice approach.	4 years ago
Victor Julien	4a283d480d	eve/tls: implement client cert logging ... Enable client logging in extended mode. Add "client", "client_certificate" and "client_chain", where the latter two depend on "client".	4 years ago
Victor Julien	e817a8f968	tls: parse client certificates ... Parse client cerificates and store them in the state similar to how this is done for server certificates. Update "progress" handling to not consider the TLS handshake complete if the server indicated a client cert was needed.	4 years ago
Victor Julien	10f5e6cb66	tls: prepare for client cert parsing	4 years ago
Victor Julien	6d4cc39c02	eve/tls: prepare for client cert logging ... Code cleanups that work on per direction "connp" instead of hard coding to the server side.	4 years ago
Victor Julien	14b2e04b58	tls: make cert handling more generic ... In preparation for client cert handling.	4 years ago
Victor Julien	cf4c201acb	tls: avoid tls.invalid_handshake_message FP ... Don't set TLS_DECODER_EVENT_INVALID_HANDSHAKE_MESSAGE event on encrypted handshake messages.	4 years ago
Victor Julien	e9d63f3355	tls: don't set 2 events for a single exception ... Keep the more specific ones.	4 years ago
Victor Julien	214e466b29	tls: remove incomplete tests ... These tests are incompatible with the incomplete API usage and should have been pcap based tests in the first place.	4 years ago
Victor Julien	82e03bd8fc	tls: set event if record size exceeds limit	4 years ago
Victor Julien	e857c864ca	tls: support server hello done message	4 years ago
Victor Julien	4bab6e24e5	tls: support handshake fragmentation ... Implement TLS record defrag for handshake messages. Ticket: #5183.	4 years ago
Victor Julien	bcaf0f6f7d	tls: remove certificate buffering code ... TCP Buffering is now done in the app-layer using the incomplete API, on the SSL/TLS record level. TLS level fragmentation will be implemented separately.	4 years ago
Victor Julien	0839317ea7	tls: parse handshake protocol records in single pass	4 years ago
Victor Julien	9f0ea5e70c	sslv2: use version from client hello ... Remove streaming code that is now unused. Incomplete handling makes this record parsing work on full data.	4 years ago
Victor Julien	c8d79fb81f	ssl: implement 'incomplete' handling for SSLv2	4 years ago
Victor Julien	6076a51511	tls: streaming mode for application records ... To avoid overhead of stream buffering for records we don't do much with anyway, pass through application records instead of buffering the entire record in the stream engine.	4 years ago
Victor Julien	129fcb5c72	tls: use incomplete API to get full TLS records ... The TLS record header is parsed in streaming mode still, but once the record size is known we tell the app-layer API to give us the full record. Ticket: #5481	4 years ago
Gleb Smirnoff	7110ea75c4	ipfw: remove setting of SO_BROADCAST on the divert(4) socket ... My review of the FreeBSD kernel code reveals that this setting a) is ignored by the kernel b) is not required. The sending side of divert(4) never checks so->so_options, but always gives IP_ALLOWBROADCAST to ip_output().	4 years ago
Andrei Shchapaniak	ee5573c4ee	dpdk/i40e: fix warning with number of queues for RSS configuration	4 years ago
Philippe Antoine	390cf9248f	detect: adds flow.age keyword ... Ticket: #5536	4 years ago
Philippe Antoine	ce2775d331	flow/icmpv4: fix vlan.use-for-tracking ... For ICMPv4 error messages the vlan ids were always considered, even if the 'vlan.use-for-tracking' option was disabled. Ticket: #5330	4 years ago
Sascha Steinbiss	148b53125b	ebpf: update deprecated API calls ... This fixes build errors when libbpf 1.0 is used. It removes previously deprecated API functions that were still in use in Suricata's eBPF code.	4 years ago
Jeff Lucovsky	63745a7879	detect/tls: Improve tls.fingerprint rule handling ... Issue: 4581 This commit improves the runtime performance of rules with tls.fingerprint by using the inspection logic from tls.cert_fingerprint.	4 years ago
Jeff Lucovsky	6bccd5aa30	detect/uri: Remove unnecessary include ... This commit removes an unnecessary #include for detect-uricontent.h	4 years ago
Victor Julien	d941703cd8	detect/build: minor code cleanup	4 years ago
Victor Julien	040404b093	detect/profiling: track bytes scanned by prefilter engines	4 years ago
Victor Julien	682e2a07fe	detect/tls: add tls.cert_chain_len keyword	4 years ago
Victor Julien	224ba82569	eve/tls: warn on unsupported 'custom' options	4 years ago
Victor Julien	dbf3d1e977	tls: make SSLSetEvent a macro to help debugging	4 years ago
Victor Julien	0e39c92fcf	flow-manager: reduce locks at startup ... Effectively busy looping on a mutex to wait for time to be ready.	4 years ago
Victor Julien	19e94e93fa	common: move u8_tolower to common header	4 years ago
Victor Julien	18e63d4ede	htp: remove user setup from request line callback ... This used to be the first callback that was called, but its not anymore. Codecov confirmed that this is no longer used and therefore not useful.	4 years ago
Victor Julien	faca974f32	ipfw: remove unused func prototype	4 years ago
Victor Julien	b9ad1d1260	app-layer: fix compiler warning	4 years ago
Victor Julien	e250ef6402	debug: remove empty header	4 years ago
Victor Julien	c3c5829f96	reputation: add ipv6 cidr test	4 years ago
Victor Julien	e9c4b3719e	reputation: fix multiline test	4 years ago
Eric Leblond	a9a17c8185	landlock: handle filestore case ... If landlock ABI is inferior to 2 (before Linux 5.19) then the renaming of files is impossible if the protection is enabled. This patch disables landlock if ABI < 2 and file-store is enabled. As file store is initialized in output the call to landlock had to done after the output initialization.	4 years ago
Eric Leblond	485d5a4ea4	landlock: basic implementation ... This patch is adding support for Landlock, a Linux Security Module available since Linux 5.13. The concept is to prevent any file operation on directories where Suricata is not supposed to access. Landlock support is built by default if the header is present. The feature is disabled by default and need to be activated in the YAML to be active. Landlock documentation: https://docs.kernel.org/userspace-api/landlock.html Feature: #5479	4 years ago
Juliana Fajardini	bbd968c738	exceptions: add reject support to exception policy ... This enables the usage of 'reject' as an exception policy. As for both IPS and IDS modes the intended result of sending a reject packet is to reject the related flow, this will effectively mean setting the reject action to the packet that triggered the exception condition, and then dropping the associated flow. Task #5503	4 years ago
Victor Julien	f5bd55dac8	decode/tcp: allow 4 byte TFO with 2 byte cookie	4 years ago
Philippe Antoine	5ef259722b	dhcp: adds renewal-time keyword ... Ticket: #5507	4 years ago
Philippe Antoine	dc59389087	dhcp: fix license in detect-dhcp-leasetime.c ... from search and replace overkill	4 years ago
Philippe Antoine	6faf6299e0	dhcp: adds rebinding-time keyword ... Ticket: #5506	4 years ago
Josh Soref	c23560ec41	detect: function header return value clarification ... Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>	4 years ago
Gleb Smirnoff	5dbbc52b06	ipfw: use PF_DIVERT on modern FreeBSD	4 years ago
Victor Julien	bb2e11108b	packetpool: fix uaf in debug validation check ... Location of the check meant access to freed packet was possible. Move check and simplify it to just look at the packet at hand.	4 years ago
Philippe Antoine	b0ce55c9df	flow: finish to remove obsolete counters ... As was begun in b3599507f4 Ticket: #5317	4 years ago
Juliana Fajardini	aa5bb2c329	stream: add exception policy for midstream flows ... This allows to set a midstream-policy that can: - fail closed (stream.midstream-policy=drop-flow) - fail open (stream.midstream-policy=pass-flow) - bypass stream (stream.midstream-policy=bypass) - do nothing (default behavior) Usage and behavior: If stream.midstream-policy is set then if Suricata identifies a midstream flow it will apply the corresponding action associated with the policy. No setting means Suricata will not apply such policies, either inspecting the flow (if stream.midstream=true) or ignoring it stream.midstream=false. Task #5468	4 years ago
Juliana Fajardini	242b8f7d65	exceptions: add callbacks for drop-flow policy ... Make sure that when the policy is to drop the flow, we set no inspection for payload and packet and disable applayer inspection as well. Task #5468	4 years ago
Victor Julien	1bff888947	detect: fix duplicate detect state issue ... For protocols with multi buffer inspection there could be multiple times the same sid would be queued into the candidates queue. This triggered a debug validation check. W/o debug validation this would lead to duplicate work and possibly multiple alerts where a single one would be appropriate. Bug: 5419.	4 years ago
Victor Julien	d31beba8d4	detect/frames: fix too strict debug check ... Frame::len is -1 if it is still unknown. Handle that in the debug check.	4 years ago
Victor Julien	f04b7a1827	stream/ids: make sure we don't slide past last_ack ... Bug: #5401.	4 years ago
Victor Julien	55b2077fcd	stream: minor code cleanup	4 years ago
Shivani Bhardwaj	78045d3bbf	tls/sni: remove unused fn declaration	4 years ago
Shivani Bhardwaj	42c3f418c6	tls: add tls.random* keywords ... Add tls.random keyword that matches on the 32 bytes of the TLS random field for client as well as server. Add tls.random_time keyword that matches on the first 4 bytes of the TLS random field for client as well as server. Add tls.random_bytes keyword that matches on the last 28 bytes of the TLS random field for client as well as server. All these are sticky buffers. Feature 5190	4 years ago
Philippe Antoine	e587f6792a	detect: support file.data for HTTP1 to server ... That is file sent with POST or PUT Ticket: #4144	4 years ago
Victor Julien	50f8779128	flow-manager: reduce burstiness in adaptive timing ... Previous adaptive model would have a large time range when scanning the hash when not so busy. In the default case it would take up to 4 minutes for a full hash scan. In case of sudden increase in business, where the hash would fill up rapidily during a few seconds, the flow manager would be forced to suddenly consider a much larger slice of the hash leading to a burst of work. This burst would increase pressure on the rest of the system leading to packet loss as the worker threads would be overloaded with flow housekeeping tasks. This patch reduces the max scan time to 10 seconds, and ramps up quickly to increase the slice of the hash scanned.	4 years ago
Juliana Fajardini	58ef3cde7a	exceptions: error out when invalid policy is used ... Before, if an invalid value was passed as exception policy, Suricata would log a warning and set the exception policy to "ignore". This is a very different result, than, say, dropping or bypassing a midstream flow. Task #5504	4 years ago
Philippe Antoine	61b73416e2	detect: transforms check for 0-sized buffer ... So as to avoid undefined behavior with a 0-sized variable length array Ticket: #5521	4 years ago
Philippe Antoine	d1ebf320f7	fuzz: disable enip detection based on source port ... So as to avoid fuzzing detecting protocol polyglots with enip	4 years ago
Philippe Antoine	617c9fb7e5	fuzz: remove check about max transactions ... Suricata can indeed pipeline many HTTP1 transactions	4 years ago
Victor Julien	b01c311c1d	profiling: fix implicit-int-float-conversion warnings	4 years ago
Victor Julien	aa09d5f556	packetpool: ifdef debug check	4 years ago
Juliana Fajardini	e7727c3744	decode: remove unused macros, replace w/ functions ... With the recent changes, these macros weren't being used anymore. Related to Bug #5458	4 years ago
Juliana Fajardini	d07a6c6174	stream/tcp: remove repeated header declaration ... StreamTcpRegisterTests was being declared twice.	4 years ago
Juliana Fajardini	f897761ecb	detect/alert: add unittests to check packet action ... Add unittests to check that packet flags are correctly updated after detection finds drop or reject rules that match. Related to Bug #5458	4 years ago
Juliana Fajardini	abd595d695	decode: validate if dropped packet has drop reason ... Related to Bug #5458	4 years ago
Juliana Fajardini	1f54e8611a	detect/alert: ensure reject action is applied ... Bug 5458 states that the reject action is no longer working. While SV tests that use the reject action still pass, it indeed seems that a regression has happened with commit aa93984, because while the function that applies rule actions to the flow (RuleActionToFlow) does check for the reject action, the newly added function PacketApply SignatureActions only checks for ACTION_DROP or ACTION_PASS when deciding to call RuleActionToFlow. Bug #5458	4 years ago
Juliana Fajardini	1774ff18a6	decode: make PacketDrop use action as parameter ... A Packet may be dropped due to several different reasons. This change adds action as a parameter, so we can update the packet action when we drop it, instead of setting it to drop. Related to Bug #5458	4 years ago
Eric Leblond	01bf0ad43d	luajit: fix unittests build ... When building with the following options: ./configure CC=clang --enable-luajit --enable-geoip --enable-unittests There is a build failure: runmode-unittests.c:234:9: error: implicit declaration of function 'LuajitSetupStatesPool' is invalid in C99 [-Werror,-Wimplicit-function-declaration] if (LuajitSetupStatesPool() != 0) {	4 years ago
Philippe Antoine	11f849c3ee	protocol-change: sets event in case of failure ... Protocol change can fail if one protocol change is already occuring. Ticket: #5509	4 years ago
Philippe Antoine	461725a9bf	dhcp: adds leasetime keyword ... As it is logged Ticket: #5435	4 years ago
Jason Ish	f1f43cba5e	app-layer: don't wrap around on port 65535 ... A port value of 65535 caused the port value to wrap-around to 0 resulting in an infinite loop. Fixes: 53fc70a9a7 ("protodetect: fix int warnings")	4 years ago
Juliana Fajardini	c81b78fd1c	detect/parse: test sig parsing for more actions ... Our unittests were only covering sig parsing for alert actions. As in environments without LibNet the reject action will not work, we must ensure that our parser properly fails in such cases, instead of silently accepting an unsupported action. Added tests for the reject and drop action. Task #5496	4 years ago
Eric Leblond	954e3e1f3f	smtp/mime: fix url extraction when no config is set	4 years ago
Eric Leblond	ad6c2f1411	eve/email: log existing url type ... MIME parsing was setting flag on URL to indicate their estimated type. This patch attach the information to the email object so the user can extract interesting email directly: ``` "email": { "status": "PARSE_DONE", "from": "Eric Leblond <regit@regit.org>", "to": [ "eric@regit.org" ], "has_ipv6_url": false, "has_ipv4_url": false, "has_exe_url": true, "url": [ "http://www.toto.com", "http://perdu.com.", "https://hacke.me/pown.exe" ] } ```	4 years ago
Eric Leblond	767d2cc9ba	util/mime: add some extensions to exe list	4 years ago
Benjamin Wilkins	57ef80f5ec	lua: Expose byte extract to lua match scripts ... Allow lua match scripts to access variables defined in rule by byte_extract or byte_math Issue: 2871	4 years ago
Eric Leblond	debdff0375	detect/tls: fix descriptions ... Most keywords were presented as content modifiers when they were in fact sticky buffers.	4 years ago
Victor Julien	5fbec8ca67	netmap: fix includes	4 years ago
Philippe Antoine	489ac003b2	detect/krb: no more wrapper around DetectEngineInspectGenericList	4 years ago
Philippe Antoine	5c7b5c5fb5	krb: detection for ticket encryption ... As is done for logging. Ticket: #5442	4 years ago
Victor Julien	5fec07b87d	flow: minor compiler warnings ... flow-util.c: In function 'FlowEndCountersRegister': flow-util.c:294:34: warning: 'name' may be used uninitialized in this function [-Wmaybe-uninitialized] 294 | fec->flow_tcp_state[i] = StatsRegisterCounter(name, t); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~	4 years ago
Jeff Lucovsky	e133ab029e	stream/event: Trigger stream reassembly event ... Issue: 3512 This commit triggers the stream reassembly depth reached event.	4 years ago
Jeff Lucovsky	1d8cc7791d	general: Typo fixup	4 years ago
Jeff Lucovsky	6a039ab316	stream/event: New reassembly depth event ... Issue: 3512 This commit adds a stream event triggered when the stream assembly depth is reached.	4 years ago
Philippe Antoine	e1e03c25c9	ci: update to macos latest	4 years ago
Philippe Antoine	018fef5ef8	quic: ja3 computation and logging and detection ... Logging as is done in TLS. Detection using the generic generic ja3.string keyword Ticket: #5143	4 years ago
Juliana Fajardini	5f4bcfe313	detect/engine: fix typos in assorted files	4 years ago
Juliana Fajardini	58928b249d	commandline: add alert-queue expand failure option ... For testing purposes. Meant to simulate a reallocation failure when dynamically growing the alert queue in DetectEngineThreadCtx, so we can check that Suri's behavior doesn't break under such circumstances. Task #5319	4 years ago
Victor Julien	ebc2714e07	nflog: fix missing util-time include; cleanups	4 years ago
Victor Julien	09c0128138	nflog: update copyright years	4 years ago
Jeff Lucovsky	e566563875	classification/config: Propagate validation errors ... Issue: #4554 This commit modifies the workflow to propagate classification parsing errors when in test mode. When not in test mode, errors continue to be displayed but they do not halt Suricata execution.	4 years ago
Jeff Lucovsky	2621c90ea1	classification/config: Raise error on validation errors ... This commit adds logic which raises an error if parse errors occur while loading classification.config Issue: 4554	4 years ago
Philippe Antoine	83a8cd80b2	detect: remove wrappers around DetectEngineInspectGenericList	4 years ago
Scott Jordan	7eaf1688b5	stream: fix StreamTcpSegmentForSession missing segments ... Bugfix, segment traversal was being initialized at root node, but should have been started at the min node. Bug resulted in captures missing segments left of root node.	4 years ago
Victor Julien	ad3e68f378	detect/file: minor cleanups	4 years ago
Victor Julien	af145ad125	detect/file: reduce scope of keyword data structures	4 years ago
Victor Julien	73eb7744d8	detect/file: update copyright years	4 years ago
Victor Julien	6f8ca41eb3	detect/cip: cleanup includes	4 years ago
Philippe Antoine	16fc78645d	dnp3: do not log empty objects array ... Ticket: #5167	4 years ago
Philippe Antoine	da0be16d36	output: do not log empty arrays for sid ... Ticket: #5167	4 years ago
Philippe Antoine	adeb1fdfc3	threads: cleaner code with one instruction per line ... As reported by Shchelk	4 years ago
Victor Julien	9fa0033966	detect: reduce datatype scope for various keywords	4 years ago
Victor Julien	ad76502df0	detect/cip: remove dead code	4 years ago
Victor Julien	08e349a8bb	detect: update copyright years	4 years ago
Victor Julien	0ec9379db9	includes: minor cleanups	4 years ago
Victor Julien	21f76773c7	profiling: minor code cleanups	4 years ago
Philippe Antoine	36b1344680	util: fix integer warnings in profiling	4 years ago
Philippe Antoine	4411ef785d	src: remove unused header files	4 years ago
Philippe Antoine	02f2602dde	src: rework includes as per cppclean	4 years ago
Jufajardini Reichow	93c2c9743d	detect/engine: init alert queue counters on reload ... alert_queue_overflow and alerts_suppressed were not being reinitialized when there was a reload of Suricata rules, leading to non-valid stats counters if that happened. Bug #5457	4 years ago
Philippe Antoine	f8bf581775	output: skip files logging for ICMP packets ... Ticket: #5408	4 years ago
Philippe Antoine	5781631f85	output: use flow's proto for file loggers ... As there can be an ICMP packet which gets related to a TCP flow. Ticket: #5408	4 years ago
Philippe Antoine	7f9d25fa86	fuzz: use forced file store ... to find bugs such as 5408	4 years ago
Philippe Antoine	a2f857ed90	threshold: fix regex to accept by_both and by_rule ... As is done in detect-threshold.c or in DETECT_RATE_REGEX and is expected by switch (rule_type) which makes the same for THRESHOLD_TYPE_THRESHOLD and THRESHOLD_TYPE_RATE Ticket: #5327	4 years ago
Philippe Antoine	1621f5e453	detect/nfs: use inclusive ranges	4 years ago