Commit Graph

13313 Commits (08e349a8bb0dbd16c0cc549eccb9f16030d6eb0c)
 

Author SHA1 Message Date
Victor Julien 08e349a8bb detect: update copyright years 3 years ago
Victor Julien 0ec9379db9 includes: minor cleanups 3 years ago
Victor Julien 21f76773c7 profiling: minor code cleanups 3 years ago
Philippe Antoine e69e99f820 ci: checks include are necessary in github 3 years ago
Philippe Antoine 36b1344680 util: fix integer warnings in profiling 3 years ago
Philippe Antoine 4411ef785d src: remove unused header files 3 years ago
Philippe Antoine 02f2602dde src: rework includes as per cppclean 3 years ago
Jufajardini Reichow 93c2c9743d detect/engine: init alert queue counters on reload
alert_queue_overflow and alerts_suppressed were not being
reinitialized when there was a reload of Suricata rules, leading to
non-valid stats counters if that happened.

Bug #5457
3 years ago
Philippe Antoine f8bf581775 output: skip files logging for ICMP packets
Ticket: #5408
3 years ago
Philippe Antoine 5781631f85 output: use flow's proto for file loggers
As there can be an ICMP packet which gets related to a TCP flow.

Ticket: #5408
3 years ago
Philippe Antoine 7f9d25fa86 fuzz: use forced file store
to find bugs such as 5408
3 years ago
Philippe Antoine a2f857ed90 threshold: fix regex to accept by_both and by_rule
As is done in detect-threshold.c or in DETECT_RATE_REGEX
and is expected by switch (rule_type) which makes the same
for THRESHOLD_TYPE_THRESHOLD and THRESHOLD_TYPE_RATE

Ticket: #5327
3 years ago
Philippe Antoine 1621f5e453 detect/nfs: use inclusive ranges 3 years ago
Philippe Antoine 8dbb07e4fe detect: use generic integer functions for itype
Ticket: #4112
3 years ago
Philippe Antoine 2817f1a6ed detect: use generic integer functions for snmp.version
Ticket: #4112
3 years ago
Philippe Antoine c72571ea28 detect: use generic integer functions for rfb.sectype
Ticket: #4112
3 years ago
Philippe Antoine 6c9091c86f detect: use generic integer functions for nfs.version
Ticket: #4112
3 years ago
Philippe Antoine ddac6165c9 detect: use generic integer functions for nfs.procedure
Ticket: #4112
3 years ago
Philippe Antoine ed6955ee98 detect: use generic integer functions for iprep
Ticket: #4112
3 years ago
Philippe Antoine bdc359bed3 detect: use generic integer functions for bsize
Ticket: #4112
3 years ago
Philippe Antoine cfb60d0fce detect: use generic integer functions for urilen
Ticket: #4112
3 years ago
Philippe Antoine e87c53bb55 defrag: use util function for timeout
To fix timestamp overflow as found by oss-fuzz
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44608

fixu
3 years ago
jason taylor d600a1603c detect: update text for nocase used with http.host
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 34e0a384ad doc: update to include additional rule references
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 4405704372 doc: update intro direction content
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 3eeacf8a3d doc: fixed HOME_NET/EXTERNAL example formatting
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor f2c7998903 doc: add clarity around HOME_NET/EXTERNAL_NET
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 76cca8b08a doc: minor example rule description update
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 4f61a35fe7 doc: minor wording restructure
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 845ba154a6 doc: add tcp-pkt/tcp-stream to intro
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 56f49bfe8e doc: minor punctuation update
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor ab300ab0ae doc: intro example rule update to simpler example
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 2f240230f0 doc: minor intro wording update
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
Philippe Antoine c57052181c snmp: rustfmt detect.rs 3 years ago
Philippe Antoine c7214be99b snmp: adds usm keyword
as is logged

Ticker: #5416
3 years ago
Victor Julien 4adab8f271 github/codeowners: update 3 years ago
Philippe Antoine 5a31b3508d ftp: optimized tx iterator
To be more efficient with larger number of transactions.

Ticket: #5314
3 years ago
Victor Julien 6d3140bc01 mime: remove unused length fields 3 years ago
Victor Julien 816bbeb7dc fuzz/mime: fix call conditions and args
The SMTP parser should not supply lines w/o EOL chars to the mime
parser unless its in the BODY parsing stage. Mimic this in the fuzz
target by testing the state for inputs that have no EOL.

Additionally, make sure the delim cnt reflects the missing EOL.
3 years ago
Victor Julien d81582c4a2 mime: fix corner case
Fix a corner case where a base64 sequence including a space was followed
by a newline in the input data.
3 years ago
Victor Julien 5805ed47f5 mime: add base64 related debug messages 3 years ago
Victor Julien 41c2c1ed5a mime: improved empty line handling
Make sure a new body is not set up on empty lines unless it is
a body that is not encoded as base64/quoted printable.
3 years ago
Victor Julien 074cfb5c68 mime: fix and cleanup tests
Line count check was failing after recent delim handling updates.
3 years ago
Victor Julien 6e2c066ce1 smtp: fix passing a wrong delim len around 3 years ago
Victor Julien b82b8825e7 mime: properly pass full lines to non-decoded body
Use actual delim count and make sure we also pass on empty lines
(so delim(s) only).
3 years ago
Victor Julien 0d6ab727c5 mime/base64: fix final data not getting processed
If the last data of the body was not a multple of 4 and not padded
to be a multiple of 4, it would not be processed.
3 years ago
Victor Julien 100d821a9f stream: fix GAP check
Gap check would consider a GAP when the current data was in fact
exactly not a gap, but next segment(s) were already available.
3 years ago
Victor Julien 29ec1b1e7b mime: minor code cleanup 3 years ago
Victor Julien 0871029d17 mime: remove unused 'linerem' logic 3 years ago
Victor Julien 5953a7d2eb smtp/mime: fix parsing edge case
Correctly track "remaining" bytes after partial base64 decoding.

Add comment clarifications and debug validation checks.
3 years ago