aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
17,728 Commits
7 Branches
161 Tags
203 MiB
main-7.0.x
master
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'master'
${ noResults }
Commit Graph

17728 Commits (master)
 

Author SHA1 Message Date
Victor Julien b0b3808a55 detect/config: supported for firewall rules 1 month ago
Victor Julien 1ee9b15a6a help: group and reorder help/usage output 1 month ago
Victor Julien fa3311a253 commandline: add --help option 
Acts same as -h.
 1 month ago
Victor Julien 08925eac18 firewall: add --firewall and firewall.enabled 
Allows for enabling firewall mode
 1 month ago
Victor Julien 0e18048ef0 firewall: move config into yaml object 
To make it easier to group settings or include them.
 1 month ago
Pierre Chifflier adcee8d7b5 ldap: avoid unneeded renaming of variables 1 month ago
Pierre Chifflier ebc1678c5c ldap: fix clippy warnings (unneded conversions) 1 month ago
Pierre Chifflier bda22c1f4a ldap: factorize code and remove duplicated structs, use ldap_parser where relevant 1 month ago
Pierre Chifflier c152c5c7e0 ldap: update ldap-parser to 0.5.0 1 month ago
Alice Akaki 3065374314 json/schema: link file.name to email.attachment 
As a Suricata keyword.

Ticket: #7683
 1 month ago
Jason Ish 8e8c3040e7 doc/upgrade: note about dns address swap on responses 
Document the change in DNS addresses for ticket 6400.

Ticket: https://redmine.openinfosecfoundation.org/issues/6400
 1 month ago
Philippe Antoine f6856eac9c fuzz: fix -Wshorten-64-to-32 warnings 
Ticket: #6186
 1 month ago
Philippe Antoine 9e64555c5e util: fix -Wshorten-64-to-32 warnings for afpacket 
Ticket: #6186
 1 month ago
Philippe Antoine e0e91c9302 configure: add -Wshorten-64-to-32 to the flags 
when configure is run with --enable-warnings

Ticket: 6186

Also add -Wimplicit-int-conversion to the flags

Both are not compatible with unit tests
 1 month ago
Philippe Antoine 7b492bc83b detect/engine: fix -Wshorten-64-to-32 warnings 
Ticket: #6186

Especially take care of the case where byte_extract extracts a u64
value that does not fit in a u32
 1 month ago
Victor Julien c3f054b625 time: replace usleep by SleepUsec/SleepMsec 
Helps cross platform support, esp Windows
 1 month ago
Victor Julien 35e711d00a threads: clean up module flags 
Remove unused TM_FLAG_STREAM_TM.

Rename TM_FLAG_DETECT_TM to TM_FLAG_FLOWWORKER_TM as it was mostly used
to check if a thread is a flow worker. TM_FLAG_DETECT_TM was always set
for a flow worker, even when there was no detection in use.
 1 month ago
Victor Julien bdac028fc7 threading: fix shutdown of IPS autofp modes 
For IPS modes with a verdict thread in autofp there was an issue with
the verdict thread not shutting down, leading to a long shutdown time
until an error condition was reached.

The problem was that when the packet threads, of which the verdict
thread is one, were told to enter their flow timeout loop the verdict
thread got stuck as it immediately progressed to THV_RUNNING_DONE
instead of the expected THV_FLOW_LOOP.

This patch updates the shutdown logic to only apply the flow timeout
logic to the relevant threads, and skip the verdict thread(s).

Add TM_FLAG_VERDICT_TM to indicate a thread has a verdict module to more
explicitly shut it down.

Fixes: 12f8f03532 ("threads: fix autofp shutdown race condition")

Bug: #7681.
 1 month ago
Philippe Antoine 6dbc421825 rust: bindgen AppLayerParserConfParserEnabled 
Ticket: 7667
 1 month ago
Philippe Antoine 49b2a2be5d rust: bindgen SCAppLayerParserRegisterLogger 
Ticket: 7667
 1 month ago
Philippe Antoine 7bfef2e1e8 rust: bindgen AppLayerParserRegisterParserAcceptableDataDirection 
Ticket: 7667
 1 month ago
Philippe Antoine 1ff4dbfc24 rust: bindgen AppLayerParserSetStreamDepth 
Ticket: 7667
 1 month ago
Philippe Antoine b29d46d81f rust: bindgen SCAppLayerParserStateIssetFlag 
Ticket: 7667
 1 month ago
Philippe Antoine 6d56beffef rust: bindgen AppLayerParserStateSetFlag 
Ticket: 7667
 1 month ago
Philippe Antoine 249131e9de src: clean includes for app-layer-parser.h 
To prepare bindgening
 1 month ago
Victor Julien f2faba5a23 detect/config: add flow tracking doc 1 month ago
Victor Julien 00336c45f4 detect/config: remove unused include 1 month ago
Victor Julien 67902c791d detect/config: add func docs 1 month ago
Victor Julien ec6081363c detect/config: remove filestore reference from comments 1 month ago
Victor Julien 6e0a6abb0b detect/config: add support for skipping flow tracking 
Allow rules in the `pre_flow` hook to disable flow tracking for a
packet:

    config:packet tcp:pre_flow any any <> any 12345 (           \
        config: tracking disable, type flow, scope packet;      \
        sid:1;)

This rule will be evaluated before a packet is handled by the flow
engine, and a match will ensure that the flow engine is skipped.

Ticket: #7715.
 1 month ago
Victor Julien f1fdc1801e detect: set detect table for non-firewall mode as well 
This also exposed a difference between the handling of TD alerts in
firewall vs non-firewall mode. In firewall mode the table/hook is also
part of the alert ordering to make sure actions from packet:td are
applied before app:td. Handle that explicitly for now.
 1 month ago
Victor Julien 7896148798 detect/config: allow setting a scope for action config 1 month ago
Victor Julien b554c43ab9 util/config: comment out unused types 1 month ago
Victor Julien 4836c3c46b detect/config: clean up keyword value parsing 1 month ago
Victor Julien 0de19d61aa detect: clean up signature validate logic 
`SigValidate` was doing more than just validation. Break out the
function into validation steps and consolidation steps.
 1 month ago
Victor Julien 12f2f3f9f1 detect: tables support per keyword 
Allow keywords to specify in which detect table they can function.

E.g. the pre_flow table will not support flow keywords, as no flow is
availble at this time.
 1 month ago
Victor Julien a88d58e531 detect: use accept:hook policy for pre_* hooks 
Set firewall policy in scratch pad. Default to drop:packet for filter tables,
use accept:hook for pre_stream and pre_hook.
 1 month ago
Victor Julien df7fe5b0ce detect: add pre_flow hook 
Allows dropping of packets before a flow is created/updated.
Directionless as direction is inferred from the flow.

Ticket: #7714.
 1 month ago
Victor Julien 8f2b925e09 detect: add pre_stream hook 
Meant to be used from the detection engine, to allow rules to drop
traffic before it modifies the stream state.

Ticket: #7712.
 1 month ago
Victor Julien ecbcccf355 detect: add tcp.wscale keyword 
Allows matching on wscale option value in TCP header options.

Ticket: #7713.
 1 month ago
Victor Julien 0246668de7 flow-worker: use explicit type for DetectEngineThreadCtx 1 month ago
Victor Julien 860bb11692 detect: only reset packet alert things in unittest mode 1 month ago
Victor Julien afa88757fe detect: pass de_ctx around as const 1 month ago
Victor Julien a90938c55a detect/bsize: constify signature pointer in callback 1 month ago
Victor Julien 325f0cc02a detect/absent: constify signature pointer in callback 1 month ago
Victor Julien 17ed70dcb5 eve/schema: reformat with clang-format 1 month ago
Jason Ish 1aaf5cb7d2 rust: allow some lints in suricatactl and suricatasc 
These are lints we allow in the Suricata Rust source code for style
reasons.
 1 month ago
Jason Ish 89ba53272c suricatasc: reconnect on loss of connection 
If the connection is lost (for example, Suricata is restarted), try to
re-open the connect and re-execute the command.

This was the behavior of the Python implementation.

Ticket: #7746
 1 month ago
Lukas Sismis da03461f71 affinity: avoid zero-division in the CPU selector 
Ticket: 7747
 1 month ago
Lukas Sismis b71bb41bc5 runmodes: remove redundant NULL check 
Ticket: 7747
 1 month ago