18278 Commits (fd9ce24fa300d20afa8144f1b7fd42180742b51a)

 

All Branches   

Search

Author	SHA1	Message	Date
Jason Ish	1e01d5adca	rust/conf: convert to nom 8 ... Ticket: #8087	12 months ago
Jason Ish	c6e8932740	rust/asn1: convert to nom 8 ... Ticket: #8086	12 months ago
Jason Ish	59f8fb30a8	rust/ftp: fix clippy warning ... error: implicitly casting the result of `from_raw_parts_mut` to `*mut [u8]` --> src/ftp/response.rs:107:31	12 months ago
Jason Ish	745e972348	github-ci: update Rust 1.91 for clippy and "known" stable	12 months ago
Philippe Antoine	9d164d8794	fuzz/conf: bail out on long sequence of scalars ... Ticket: 8105	12 months ago
Olusegun Fajobi	785389aa00	detect/analyzer: add more details for flowint keyword ... Ticket: 6311	12 months ago
Cheryl Owala	8120d9dc6c	detect-pcre: convert unittests to FAIL/PASS API ... Convert unittests to new FAIL/PASS API. Ticket: #6344	12 months ago
Philippe Antoine	cba13ed9b1	rust: bindgen functions needed for datasets ... Ticket: 7762	12 months ago
Philippe Antoine	12892ba010	rust: bindgen functions neede for features ... Ticket: 7762	12 months ago
Philippe Antoine	b21c93d789	util/time: fix TimeDifferenceMicros microseconds computation ... Ticket: 8073 Currently only used in pcap logging for flushing	12 months ago
Victor Julien	874a0e8d3d	unix-socket/hostbits: fix ipv6 address parsing ... In `add-hostbit`, `remove-hostbit` and `list-hostbit` commands, the IPv6 address parsing was not using the correct variable: from /usr/include/dirent.h:25, from suricata-common.h:73, from runmode-unix-socket.c:18: In function ‘inet_pton’, inlined from ‘UnixSocketHostbitAdd’ at runmode-unix-socket.c:1316:13: /usr/include/x86_64-linux-gnu/bits/inet-fortified.h:56:10: warning: call to ‘__inet_pton_chk_warn’ declared with attribute warning: inet_pton called with a destination buffer size too small [-Wattribute-warning] 56 | return __glibc_fortify (inet_pton, __sz, sizeof (char), | ^~~~~~~~~~~~~~~ In function ‘inet_pton’, inlined from ‘UnixSocketHostbitRemove’ at runmode-unix-socket.c:1403:13: /usr/include/x86_64-linux-gnu/bits/inet-fortified.h:56:10: warning: call to ‘__inet_pton_chk_warn’ declared with attribute warning: inet_pton called with a destination buffer size too small [-Wattribute-warning] 56 | return __glibc_fortify (inet_pton, __sz, sizeof (char), | ^~~~~~~~~~~~~~~ In function ‘inet_pton’, inlined from ‘UnixSocketHostbitList’ at runmode-unix-socket.c:1476:13: /usr/include/x86_64-linux-gnu/bits/inet-fortified.h:56:10: warning: call to ‘__inet_pton_chk_warn’ declared with attribute warning: inet_pton called with a destination buffer size too small [-Wattribute-warning] 56 | return __glibc_fortify (inet_pton, __sz, sizeof (char), | ^~~~~~~~~~~~~~~ Bug: #8102.	12 months ago
Victor Julien	3a0f4dde07	thresholds: fix unittest compile warning ... In file included from decode.h:33, from host.h:27, from util-threshold-config.c:34: util-threshold-config.c: In function 'SCThresholdConfInitContext': util-debug.h:260:5: warning: '%s' directive argument is null [-Wformat-overflow=] 260 | SCLogErr(SC_LOG_WARNING, __FILE__, __FUNCTION__, __LINE__, _sc_module, __VA_ARGS__) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ util-threshold-config.c:190:9: note: in expansion of macro 'SCLogWarning' 190 | SCLogWarning("Error loading threshold configuration from %s", filename); | ^~~~~~~~~~~~ util-threshold-config.c:190:66: note: format string is defined here 190 | SCLogWarning("Error loading threshold configuration from %s", filename); | ^~	12 months ago
Jason Ish	6bd360570a	dnp3: fix dnp3 generation script to match code	12 months ago
Jeff Lucovsky	e1bf5cb1f3	nfs: Support EXCLUSIVE4_1 flag ... Issue: 8006 Support the EXCLUSIVE4_1 create mode added to NFS 4.1	12 months ago
Philippe Antoine	deb5926609	fuzz: increase some config values ... To get better coverage and bug findings Ticket: 8068	12 months ago
Philippe Antoine	a07390573f	fuzz: default conf with verdict enabled in alerts	12 months ago
Philippe Antoine	af8390f2ca	doc: upgrade note for engine-analysis breaking change ... For keywords that now use the generic integer framework Ticket: 7889	12 months ago
Philippe Antoine	d94aea8331	detect: tcp.window is now a generic integer ... Ticket: 7889	12 months ago
Philippe Antoine	68bb783e97	detect: tcp.seq is now a generic integer ... Ticket: 7889	12 months ago
Philippe Antoine	ed907bbd78	detect: tcp.ack is now a generic integer ... Ticket: 7889	12 months ago
Philippe Antoine	7a8eb28cae	detect: id is now a generic integer ... Ticket: 7889	12 months ago
Philippe Antoine	bff7413488	detect: icmp_seq is now a generic integer ... Ticket: 7889	12 months ago
Philippe Antoine	79e66f76e6	detect: icmp_id is now a generic integer ... Ticket: 7889	12 months ago
Philippe Antoine	09531447d1	detect: fragoffset is now a generic integer ... Ticket: 7889	12 months ago
Philippe Antoine	85fa894425	detect: dnp3.func is now a generic integer ... Ticket: 7889	12 months ago
Jason Ish	70a2524d95	ci: update ndpi to 4.14	12 months ago
Jeff Lucovsky	b02d9bb4f1	doc/luaxform: Remove init function from example ... Issue: 8035 The `luaxform` transform doesn't support the `init` function. This commit removes that from the example and clarifies how functions in the Lua script are used.	12 months ago
Victor Julien	558ab73a7f	doc/devguide: explain alert logging changes	12 months ago
Victor Julien	d45bdb85d5	eve/verdict: more explicit pass handling ... Instead of indexing `Packet::alerts` to find out if the action should be `ACTION_PASS`, add an arguement to make this explicit from the alert logging logic. Bug: #7630.	12 months ago
Victor Julien	5b19508661	detect/alert: fully add pass-only rules to alert queue ... Pass-only rules were previously stored in Packet::alerts, but not correctly. The `cnt` wasn't incremented leaving it in a weird state. This patch changes the logic to have a `pass` entry be added to the queue as well as incrementing the `cnt`. As a consequence of this the alert logging needs to explicitly check for `PacketAlert::action` having `ACTION_ALERT` set now. Update the alert loggers. Bug: #8021.	12 months ago
Victor Julien	2a7eb5d062	detect/threshold: set missing alert flag in rate_filter ... ACTION_ALERT is supposed to be set now, but wasn't for rate_filter. This becomes important in a follow up patch where only PacketAlert entries with `action` `ACTION_ALERT` are logged in alert logging.	12 months ago
Victor Julien	bccdb445ff	eve/verdict: clean up packet action checking ... Get action from packet just once.	12 months ago
Philippe Antoine	b8411fcc8d	output/http: log content-type like other headers ... Ticket: 8056 Avoid stack allocation. Do not handle null and ; especially	12 months ago
Philippe Antoine	acc051ac94	unix-socket: return after closing on too long ... Avoids later use after free Ticket: 8063	12 months ago
Philippe Antoine	a84addb771	util/swf: move allocation from stack to heap ... As it can overflow the stack Ticket: 8055	12 months ago
Philippe Antoine	f2b6540c52	htp: bound decompression ... Ticket: 7980 Usage of Vec<u8> instead of Box<u8> gave the ability to callers to grow the buffer (indefinitely) This was regressed in 16fee33368 Additionnaly, use rust WriteZero instead of WouldBlock as a more fitting error when cursor is full, as that error kind is the one tested by callers.	12 months ago
Philippe Antoine	c61f1cb6d0	detect/integers: rename index all1 to all ... And all to all_or_absent Ticket: 7929	12 months ago
Philippe Antoine	eb5a2d646b	detect/vlan: move vlan.id keyword to generic integer ... Ticket: 7929	12 months ago
Li Heng	c141c55bc6	snmp: can be set to detection-only ... Realloc alp_ctx.ctxs when a dynamic alproto is registered and g_alproto_max increases. So dynamic alproto can be treated as real/normal ones. And app-layer switch can be set to any value of no/deteciton-only/yes. Ticket: 8000	12 months ago
Philippe Antoine	439f96dea7	rust: bindgen frames functions ... Ticket: 7667	12 months ago
Philippe Antoine	92c7be1cb6	rust: bindgen SCSRepCatGetByShortname ... Ticket: 7667	12 months ago
Ezra Adeyinka	368ef839de	detect/address: switch tests to FAIL/PASS API ... Ticket: #4023	12 months ago
Shivani Bhardwaj	bb1ed16408	src: check retval of VarNameStoreRegister ... VarNameStoreRegister can return 0 in case of any error conditions. Handle this case in all the users of this function. It is an unlikely event so add branch assistance accordingly. Bug 8054	12 months ago
Shivani Bhardwaj	6b3c21a4e6	detect/xbits: use correct Free fn ... Most call sites use a casula SCFree fn to get rid of the DetectXbitsData in case of an error. However, if a varname is also registered, that must be unregistered too. Fix all the free calls by replacing them with the appropriate DetectXbitFree fn.	12 months ago
Shivani Bhardwaj	13c8724ae0	detect/xbits: remove unneeded cast to check ptr validity	12 months ago
Shivani Bhardwaj	dad883406d	detect/xbits: use calloc to avoid undefined behavior	12 months ago
Shivani Bhardwaj	a23add0194	detect/lua: remove extra NULL check ... The fn DetectLuaFree checks if the pointer (DetectLuaData) passed to it is valid. So, the checks for NULL in the call sites can safely be removed.	12 months ago
Shivani Bhardwaj	71339c459e	detect/flowvar: remove extra NULL check ... The fn DetectFlowvarDataFree checks if the pointer (DetectFlowvarData) passed to it is valid. So, the checks for NULL in the call sites can safely be removed.	12 months ago
Shivani Bhardwaj	7c9fad27fc	detect/flowint: clean up free fn	12 months ago
Shivani Bhardwaj	bc8bf865ae	detect/flowint: remove extra NULL check ... The fn DetectFlowintFree checks if the pointer (DetectFlowintData) passed to it is valid. So, the checks for NULL in the call sites can safely be removed.	12 months ago