Commit Graph

13451 Commits (1b24f4d357fd922a5c3202fce2904da29a04ed12)
 

Author SHA1 Message Date
Juliana Fajardini 5f4bcfe313 detect/engine: fix typos in assorted files 2 years ago
Juliana Fajardini 58928b249d commandline: add alert-queue expand failure option
For testing purposes. Meant to simulate a reallocation failure when
dynamically growing the alert queue in DetectEngineThreadCtx, so we can
check that Suri's behavior doesn't break under such circumstances.

Task #5319
2 years ago
Victor Julien ebc2714e07 nflog: fix missing util-time include; cleanups 2 years ago
Victor Julien 09c0128138 nflog: update copyright years 2 years ago
Jeff Lucovsky e566563875 classification/config: Propagate validation errors
Issue: #4554

This commit modifies the workflow to propagate classification parsing
errors when in test mode.

When not in test mode, errors continue to be displayed but they do not
halt Suricata execution.
2 years ago
Jeff Lucovsky 2621c90ea1 classification/config: Raise error on validation errors
This commit adds logic which raises an error if parse errors occur while
loading classification.config

Issue: 4554
2 years ago
Jufajardini Reichow 61f9f0df55 userguide/rules/meta: minor formatting adjustments 2 years ago
Jufajardini Reichow 45f14bb97c userguide/rules: explain sid uniqueness within gid
While Suri will throw an error if two signatures have the same `sid`
and no `gid`, or same `sid` and same `gid`, it will just accept same
`sid` for different `gid`s.

Related to

Task #5441
2 years ago
Philippe Antoine 83a8cd80b2 detect: remove wrappers around DetectEngineInspectGenericList 2 years ago
Scott Jordan 7eaf1688b5 stream: fix StreamTcpSegmentForSession missing segments
Bugfix, segment traversal was being initialized at root node, but
should have been started at the min node. Bug resulted in captures
missing segments left of root node.
2 years ago
jason taylor 87990b138c doc: update priority wording userguide meta
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor a7d739a05b doc: update to 80 char formatting userguide meta
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor 9bd55ff81b doc: metadata information update userguide meta
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor 563dc66837 doc: update priority information userguide meta
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor f73a60eb89 doc: update reference section in userguide meta
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor e611ef5ccb doc: update userguide meta classtype information
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor 39bc56ec97 doc: update rev and gid userguide meta wording
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor b9cb66c58f doc: add clarity around userguide meta information
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor 790ef9a53f doc: add sid reserved range reference
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor 38a179d89d doc: add clarity to rule msg tips
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor 299a931e49 doc: update example rule list
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor 98c29da6ec doc: add clarity to role wording
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor c0bdb6cc10 doc: meta keyword doc example rule update
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor ca9e9009ba doc: add bsize keyword examples
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
Victor Julien ad3e68f378 detect/file: minor cleanups 2 years ago
Victor Julien af145ad125 detect/file: reduce scope of keyword data structures 2 years ago
Victor Julien 73eb7744d8 detect/file: update copyright years 2 years ago
Victor Julien 6f8ca41eb3 detect/cip: cleanup includes 2 years ago
Philippe Antoine 11e0eb9c89 quic: do not log empty cyu array
Ticket: #5167
2 years ago
Philippe Antoine 16fc78645d dnp3: do not log empty objects array
Ticket: #5167
2 years ago
Philippe Antoine 632581ac95 ike: do not log empty notify array
Ticket: #5167
2 years ago
Philippe Antoine 262a93ce18 mqtt: do not log reason_codes if there is none
Ticket: #5167
2 years ago
Philippe Antoine da0be16d36 output: do not log empty arrays for sid
Ticket: #5167
2 years ago
Jufajardini Reichow f9c9091bb5 userguide: fix typo in inline mode illustration
The image describing Suricata's sliding window had two of the "packets"
with the same text. Now they actually give the sense of a sliding
window.

This was found by Zhiyuan-liao.
2 years ago
dependabot[bot] 8090cba7c4 github-actions: bump actions/cache from 3.0.4 to 3.0.5
Bumps [actions/cache](https://github.com/actions/cache) from 3.0.4 to 3.0.5.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](c3f1317a9e...0865c47f36)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2 years ago
Philippe Antoine adeb1fdfc3 threads: cleaner code with one instruction per line
As reported by Shchelk
2 years ago
Victor Julien 9fa0033966 detect: reduce datatype scope for various keywords 2 years ago
Victor Julien ad76502df0 detect/cip: remove dead code 2 years ago
Victor Julien 08e349a8bb detect: update copyright years 2 years ago
Victor Julien 0ec9379db9 includes: minor cleanups 2 years ago
Victor Julien 21f76773c7 profiling: minor code cleanups 2 years ago
Philippe Antoine e69e99f820 ci: checks include are necessary in github 2 years ago
Philippe Antoine 36b1344680 util: fix integer warnings in profiling 2 years ago
Philippe Antoine 4411ef785d src: remove unused header files 2 years ago
Philippe Antoine 02f2602dde src: rework includes as per cppclean 2 years ago
Jufajardini Reichow 93c2c9743d detect/engine: init alert queue counters on reload
alert_queue_overflow and alerts_suppressed were not being
reinitialized when there was a reload of Suricata rules, leading to
non-valid stats counters if that happened.

Bug #5457
2 years ago
Philippe Antoine f8bf581775 output: skip files logging for ICMP packets
Ticket: #5408
2 years ago
Philippe Antoine 5781631f85 output: use flow's proto for file loggers
As there can be an ICMP packet which gets related to a TCP flow.

Ticket: #5408
2 years ago
Philippe Antoine 7f9d25fa86 fuzz: use forced file store
to find bugs such as 5408
2 years ago
Philippe Antoine a2f857ed90 threshold: fix regex to accept by_both and by_rule
As is done in detect-threshold.c or in DETECT_RATE_REGEX
and is expected by switch (rule_type) which makes the same
for THRESHOLD_TYPE_THRESHOLD and THRESHOLD_TYPE_RATE

Ticket: #5327
2 years ago