14158 Commits (0303bb1f9c0f5fce06d388e053a6176f1ebfe0bb)

 

All Branches   

Search

Author	SHA1	Message	Date
Victor Julien	0303bb1f9c	decoder: mention removal of udp.hlen_invalid sig	2 years ago
Shivani Bhardwaj	487f59df4c	rules/decoder: fix sid for udp.len_invalid rule	2 years ago
Victor Julien	a6723bca7c	flow: enforce flow assumption ... Enforce assumption that packets in ThreadVars::decode_pq have no flow attached to it because this is only true for packets while they are in the FlowWorker.	2 years ago
Victor Julien	66ed3ae6e4	flow/mgr: remove flows_timeout_inuse counter	2 years ago
Victor Julien	0592e57df5	flow: rearrange Flow struct to be more compact	2 years ago
Victor Julien	7951d8a14f	flow: remove use_cnt ... Packets only ever reference the flow while holding its lock. This means than any code possibly evicting the flow will have to wait for the existing users to complete their work. Therefore the use_cnt serves no function anymore and can be removed.	2 years ago
Victor Julien	a2dc9a40e7	flowworker: don't keep unnecessary flow reference ... Flow stream/detect/log flush packets, don't hold on to the flow beyond the flow worker module.	2 years ago
Victor Julien	3ca37008d7	stream: remove unused pseudo packet function	2 years ago
Jason Ish	2dc157ed9e	github-ci: dump github context and pr body ... For debugging the parsing of suricata-verify-pr.	2 years ago
Jason Ish	102a022898	github-ci: annotate job with s-v info	2 years ago
Jason Ish	f15f092a69	rfb: remove duplicate logging of depth ... The "depth" field in the "pixel_format" object was being logged twice. Issue: 5813	2 years ago
Jason Ish	717e2b0248	smb: fix duplicate interface logging ... An array of interfaces was being logged without creating an array, resulting in duplicate "interface" objects being logged. Instead put these interfaces into an array like already done elsewhere. Issue: 5814	2 years ago
Jason Ish	59d9a51bad	eve: remove dcerpc.interface from schema ... Looks like this was due to an error in the dcerpc logging where the interfaces should have been logged to the "interfaces" array that was already defined. Issue: 5814	2 years ago
Jason Ish	67baab573b	smb: remove duplicate tree_id logging ... Remove the second occurrence of tree_id logging which appears to always be a duplicate of the first tree_id logged, even though they come from different data structures. Issue: 5811	2 years ago
Jason Ish	3d8130614e	github-ci/rust: display clippy diff	2 years ago
Jason Ish	e21ae88e05	rust: utility function to copy Rust strings to C strings ... As there are a few places where a Rust string is copied into a provided C string buffer, create a utility function to take care of these details.	2 years ago
Jason Ish	6344501dba	tls: fix date logging for dates before 1970 ... The Rust time crate used by the x509-parser crate represents dates before 1970 as negative numbers which do not survive the conversion to SCTime_t and formatting with the current time formatting functions. Instead of fixing our formatting functions to handle such dates, create a Rust function for logging TLS dates directly to JSON using the time crate that handles such dates properly. Also add a FFI function for formatting to a provided C buffer for the legacy tls-log. Issue: 5817	2 years ago
Jason Ish	ef48c5064f	schema: add regular expression for tls date format	2 years ago
Victor Julien	9e41075d5d	detect/frames: improve IPS and GAP handling ... Inspect individual chunks in lossy traffic. Don't use the frame idx as the inspection buffer idx. Engines are running per frame, so multi inspection can be used for stream chunks instead. Ticket: #4977.	2 years ago
Victor Julien	6fcf48d09a	detect/frames: handle duplicate sigs in candidates ... Prefilter engines run on each stream chunk in a lossy stream, so we can get the same sid in the list multiple times.	2 years ago
Victor Julien	8ff2543343	stream: add util to get absolute right edge of data	2 years ago
Victor Julien	a95934b5ee	detect/frames: reduce scope of private function	2 years ago
Victor Julien	652de0cc99	output: move function name in non-release output	2 years ago
Victor Julien	f834377c5f	detect/tls.certs: improve buffer init logic	2 years ago
Victor Julien	aa4a128fb0	detect/quic: update buffer initialization logic	2 years ago
Victor Julien	6f1574276f	detect/mqtt: update buffer initialization logic	2 years ago
Victor Julien	83e97a9283	detect/krb5.sname: update buffer initialization logic	2 years ago
Victor Julien	d3675d5197	detect/krb5.cname: update buffer initialization logic	2 years ago
Victor Julien	849f1cf1b8	detect/ike.vendor: update buffer initialization logic	2 years ago
Victor Julien	158e648d87	detect/http2: update buffer initialization logic	2 years ago
Victor Julien	5e783a01fe	detect/file.name: update buffer initialization logic	2 years ago
Victor Julien	576bfc6bf0	detect/file.magic: update buffer initialization logic	2 years ago
Victor Julien	50fd691efb	detect/file.data: update buffer initialization logic	2 years ago
Victor Julien	9c34e82471	detect/http.uri: update buffer initialization logic	2 years ago
Victor Julien	f6fd1b017f	detect/dce.stub_data: update buffer initialization logic	2 years ago
Victor Julien	e31ead9bc2	detect/dns: update buffer initialization logic	2 years ago
Victor Julien	70125a29f6	detect/buffer: add initialized flag to simplify buffer logic	2 years ago
Jeff Lucovsky	c1c67536b6	decode/stat: Add decode counters for unknown/arp ... Issue: 5761 This commit adds statistics for ARP and unknown ethertype packets for diagnostic purposes.	2 years ago
Philippe Antoine	e3105a6614	ftp: adds a config option ftp-hash for autofp-scheduler ... This allows ftp-data and ftp flows to be processed by the same thread. Otherwise, there may be a concurrency issue where the would-be ftp-data flow is first processed, and thus not recognized as such. And the ftp flow gets processed later and the expectation coming from it is never found. To do so, the flow hash gets used as usual, except for flows that may be either ftp or ftp-data, that is either one port is 21, or both ports are high ones. Ticket: #5205	2 years ago
Philippe Antoine	c1f615b8d2	src: fix coverity warning about sizeof ... CID: 1520601 CID: 1520602 > In this particular case sizeof (char **) happens to be equal to sizeof (char *), but this is not a portable assumption.	2 years ago
Jason Ish	84d1ed58bb	config: check return value of dotted override ... Fixes commit fbb0d2b0f4.	2 years ago
Jason Ish	64cb687a65	rust: suppress specific manual_flatten list ... In this case of debug code, the explicit iterator seems to make more sense.	2 years ago
Jason Ish	7080ecbb76	rust: remove explicit lifetimes where not needed	2 years ago
Jason Ish	e7f5bd047d	rust: fix needless borrows of references ... Fixed automatically by cargo clippy --fix.	2 years ago
Jason Ish	29f345af1a	rust: allow uninlined_format_args ... Newer versions of Rust/clippy are getting picky about format strings. We should allow and use the new style, but also not prevent the old style.	2 years ago
Jason Ish	0490279a75	rules/readme: document sid ranges in source tree	2 years ago
Jason Ish	3f4dad8676	ftp: add events for command too long ... Issue: 5235	2 years ago
Jason Ish	48920bd784	rust/derive: allow event name to be set as attribute ... When deriving AppLayerEvent, allow the event name to be set with the "name" attribute in cases where the transformed name is not suitable. This allows us to use enum variant names like "FtpEventRequestCommandTooLong" for direct use in C, but is also a name that doesn't transform well to an event name in rules, where we want to see "request_command_too_long".	2 years ago
Jason Ish	1b844cd7f7	doc/userguide: document --include command line option	2 years ago
Jason Ish	dcfa6a6002	suricata: allow additional include files on command line ... Add a new command line option, --include. This will merge additional configuration files into the configuration specified in the main suricata.yaml. It can be provided multiple times and the files will be included in the order they appear on the command line. Ticket: 3912	2 years ago