c226626a7f
counters: use strcmp instead of memcmp
7 months ago
7a794945c6
proto: use strcmp instead of memcmp
7 months ago
8f655c7d8d
reference: use strcmp instead of memcmp
7 months ago
3fbce40def
classification: use strcmp instead of memcmp
7 months ago
5a12096dd9
spm: minor unittest cleanup
7 months ago
a16c6ff6a5
memcpy: rename memcpy_tolower
...
Rename to match coding style. Update callers.
Minor loop cleanup.
7 months ago
c4360cd515
util: add timing assembly for arm64
7 months ago
b3d45e5507
profiling: log rule profiling as json by default
...
We've been forcing JSON logging in our default configuration for some
time now, just make it the actual default.
7 months ago
d89b35db56
conf: add SCConfNodeChildValueIsFalse to check for false value
...
New function to check is a value is actually set to a false value.
7 months ago
6eda4b9f59
configure: remove @e_enable_evelog@
...
Jansson/JSON has been mandatory for a long time now, so this value has
evaluated to yes for many years now.
7 months ago
e895cbbf58
profiling: don't enable rule profiling by default
...
Update the suricata.yaml rule profiling section to not turn on rule
profiling by default, as its not on by default when commented out.
Also update the comments.
7 months ago
aa7091f927
ebpf: ignore *.bpf
...
Add the compiled .bpf programs to .gitignore.
7 months ago
af246ae7ab
http: do not use a loop to find the tx count
...
As we want the last tx
Ticket: 8156
The generic function AppLayerParserGetTxCnt calls for HTTP1
Transactions.size()
This function has some specific code, as we may have pre-created
a tx that we do not want to count.
This used to get the last tx by iterating over all the transactions
waiting to find the one with max index.
So, instead of using the Transactions.get function, we get the last
tx out of the VecDeque and check its index.
7 months ago
5c0f95faec
gen: Fix typos
7 months ago
9c81f817e8
rust: bindgen update
...
Issue: 7389
Update bindgen with `make update-bindgen`
7 months ago
e80e881335
main/options: display level name, not numeric
...
Issue: 7389
Follow-up change for verbose handling. Instead of displaying the numeric
verbose level, display the level name.
I.e., instead of 4, display Debug
7 months ago
a53ba4af94
detect: use PrefilterIsPrefilterableById where possible
...
cocci script used:
@@
identifier s, sm, DETECT_TYPE;
@@
- for (sm = s->init_data->smlists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) {
- switch (sm->type) {
- case DETECT_TYPE:
- return true;
- }
- }
- return false;
+ return PrefilterIsPrefilterableById(s, DETECT_TYPE);
followed by some basic cmdline manipulations to get rid of extras left.
7 months ago
726139a539
fuzz: really restrict path for nalloc
...
Ticket: 4125
7 months ago
e305c6c9df
conf: do not exit on alloc failure
...
Ticket: 6188
Just return an error
7 months ago
6882159692
fuzz: set engine stage for conf yaml target
...
Ticket: 6188
Allows allocations failures not to be fatal as in init
7 months ago
50224f2ee5
rust: fix clippy warning for unused import
...
While debug_validate_bug_on is still used, it does not need to be
imported directly, as that macro is marked with `macro_export`, making
it globally available to the crate.
7 months ago
24405a7b76
doc: http fields in json schema
...
Ticket: 6075
7 months ago
2f39c8c099
jsonschema: remove obsolete http fields
...
These were moved to array request_headers/response_headers
Ticket: 6075
7 months ago
0ca874b678
userguide: highlight exceptions interactions
...
In corner cases, we assume that a midstream exception policy could be
triggered by a prior exception policy in effect. Explain this in the
docs.
Task #5830
7 months ago
b7bd7f7d4c
fuzz: allocation failures with nalloc
...
Ticket: 4125
7 months ago
984fc260c5
github-ci: update Fedora to 43
7 months ago
455b7d1b3b
rust: use snake case for applayer_register_protocol_detection
7 months ago
b4d8aea0ae
rust: bindgen SCAppLayerRegisterProtocolDetection
...
Ticket: 7662
Changing the struct passed to it to have the minimal number
of useful fields.
7 months ago
91c9e34419
doc/userguide: update windivert instructions
...
The IPS documentation for Windows had a dead link
to a PDF. Update the Windows build page to include
WinDivert instructions.
Documentation: #8137 .
7 months ago
3bcad5f364
windivert: upgrade to 2.0.0
...
WinDivert 2 was released in 2019. This introduced some minimal
changes to some functions arguments.
Bug: #8138 .
7 months ago
cf88ed518c
jsonschema: check for duplicate keys
...
Ticket: 6691
And fix the one duplicate found
7 months ago
365ed2a2ff
af-packet: disable hwtimestamp by default
...
Add enable-hwtimestamp option to replace disable-hwtimestamp.
Ticket: #7585 .
7 months ago
845544aad3
doc/luaxform: Clarify luaxform calling convention
...
Issue: 8135
Clarify the calling convention for the Lua transform's `transform`
function.
7 months ago
78d8fd7b9d
output/file: validate force-hash YAML values
...
Previously, the force-hash configuration for file logging silently accepted
unknown or invalid hash types (e.g., 'shanani')
Now, invalid values trigger FatalError.
Bug OISF#4330
7 months ago
354e9987e4
detect/analyzer: add details for the xbits keyword
...
Add xbits keyword details. Exposes cmd, name, track, and expire
properties, following the same pattern as byte_jump and flowbits.
Task #6351
7 months ago
6c06ab6144
devguide: update backports policy for Suricata 7.0
...
Also remove mentions to `master` and `6.0x`.
Task #7937
7 months ago
e3878042c9
stream/reassemble: use more legible FAIL macros
...
Use `FAIL_IF_NOT` instead of `FAIL_IF(!` or `FAIL_IF(.... !=`
7 months ago
1b18081dfb
stream/tcp/reassemble: convert unittests to FAIL/PASS API
...
Updated the stream TCP reassembly unit tests to use the new
FAIL/PASS API instead of the deprecated legacy assertion macros.
Task OISF#6324
7 months ago
907f4faff8
doc/thresholding: minor fix for backoff subsection
7 months ago
c93e69830a
detect/ssl: properly handle negation in ssl_version keyword
...
Ticket: 3220
DetectSslVersionMatch did not handle properly negation.
It could never match on a signatrue with ssl_version: !tls1.3
That is because, if we had such a signature and network traffic
with tls1.1, we were looking into DetectSslVersionData field
for tls1.1, which was not set, instead of looking at field
for tls1.3 which was set with negated flag.
Previous DetectSslVersionData was holding redundant information.
It did not need to have it for each ssl version, but just globally.
Also, it did not need to hold the version as a value in the array,
as it was redundant with the index of the array.
7 months ago
3d80c7fb19
main/options: Limit verbose option count
...
Issue: 7389
Continue to recognize multiple 'v' specifications up to the maximum
recognized. The maximum recognized is the number of slots between the
NOTICE and DEBUG levels.
When debug is configured, `-vvvv` is required to set the log level to
debug. Specifying 4 or more `v` will maintain debug level.
When debug is not configured, `-vvvv` and more `v`'s will cause
config messages to be printed.
7 months ago
09e50ac3f4
stream/tcp: check new last_ack stays within base_seq bounds
...
If we have
- stream->last_ack 0x40021
Then, we call StreamTcpUpdateLastAck with 0x8000fc21
Then we satisfy SEQ_GT((ack), (stream)->last_ack)
But we do not satisfy SEQ_GT(ack, (stream)->base_seq))
and the new last_ack will be compared to base_seq
So, refuse to make such a big update
Ticket: 6865
7 months ago
973ab60a34
github-actions: bump github/codeql-action from 4.31.2 to 4.31.6
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.31.2 to 4.31.6.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Commits](https://github.com/github/codeql-action/compare/v4.31.2...v4.31.6 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.31.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
7 months ago
9095eb9b22
github-actions: bump actions/checkout from 5.0.0 to 6.0.0
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 5.0.0 to 6.0.0.
- [Release notes](https://github.com/actions/checkout/releases )
- [Commits](https://github.com/actions/checkout/compare/v5...v6 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
7 months ago
1329786f84
detect: new command line option : list-rule-protos
...
To list the protocols we can use a in a rule header
Ticket: 635
7 months ago
69c95f2b7c
detect: rewrite DetectProtoParse
...
To use an array, instead of hard-coded values.
Opens the path to list the rule protocols
Ticket: 635
7 months ago
08d625bb10
mpm: remove remaining ac-bs references
7 months ago
be2c40bde7
doc/af-packet: document disable-hwtimestamp option
...
Ticket: #1954 .
7 months ago
18a6a079da
af-packet: add disable-hwtimestamp option
...
HW timestamping is not always reliable, so add an option to disable it.
Bug: #1954 .
7 months ago
7c0776abeb
counters: remove ThreadVars from counter registration
...
Just pass the StatsThreadContext pointer directly.
7 months ago
Victor Julien
Ali Saidi
Jason Ish
Philippe Antoine
Jeff Lucovsky
Shivani Bhardwaj
Juliana Fajardini
Ambre Iooss
James Kaddu
dependabot[bot]