Andreas Dolp
324f5ec10c
doc: Add missing ")" in example
2 years ago
Andreas Dolp
32b39d054f
suricata.yaml.in: Remove duplicate "with" in comment.
2 years ago
Andreas Dolp
e4163c4e02
doc: Fix typos
2 years ago
Andreas Dolp
49bd6cfa5d
doc: Fix broken link
2 years ago
Philippe Antoine
284ad462fc
output: adds schema.json
...
Ticket: #1369
2 years ago
Victor Julien
ebf0629615
log-pcap: remove tunnel locks
...
The tunnel lock mutex only "protects" the tunnel synchronization,
not the packet data, length or datalink fields.
2 years ago
Victor Julien
e7ab96c389
nflog: fix datalink compile issue
2 years ago
Juliana Fajardini
43d28f251f
util/action: convert unittests to FAIL/PASS API
...
Task #5371
2 years ago
Juliana Fajardini
9b9b6aa2ce
util/action: unittests clean-up (to sv tests)
...
Removing all unittests that work better as suricata-verify tests.
Task #5371
2 years ago
Victor Julien
4ed6c928aa
unittest: minor helper cleanup
2 years ago
Victor Julien
41b5364511
detect/parse: cleanup test
2 years ago
Victor Julien
a437dde739
detect: parsing test cleanups/improvements
2 years ago
Victor Julien
e738b10e23
host-os-info: add test to show mixed ipv4/ipv6
2 years ago
Victor Julien
f3d887310c
rule/vars: clean up tests
2 years ago
Victor Julien
1b65af2867
detect/iponly: minor code cleanup
2 years ago
Victor Julien
beecc1890f
detect/iponly: include postmatch in determination
2 years ago
Victor Julien
4b097460c2
detect/iponly: simplify handling of 'any' parsing
2 years ago
Victor Julien
ffef10c5d7
detect: address parsing variable rename to match code style
2 years ago
Victor Julien
51ef6f4e3a
detect/iponly: remove unused code
2 years ago
Juliana Fajardini
6ccc01a79c
rust: fix doc comments that trigger rust warnings
...
Rust generates warnings that are treated as errors for documentation
blocks before `extern` blocks.
2 years ago
dependabot[bot]
fbbf23b930
github-actions: bump ossf/scorecard-action from 1.0.4 to 1.1.0
...
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action ) from 1.0.4 to 1.1.0.
- [Release notes](https://github.com/ossf/scorecard-action/releases )
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md )
- [Commits](c1aec4ac82...5c8bc69dc8
)
---
updated-dependencies:
- dependency-name: ossf/scorecard-action
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2 years ago
Victor Julien
f4f63ebff8
stream: add packet header outside of lock
2 years ago
Victor Julien
419920288c
log/pcap: open handles outside of lock
2 years ago
Scott Jordan
c751c45850
log/pcap: add buffer timeout
...
Set timeout for pcap log so that packets do not sit
in buffer. Set default to one second.
2 years ago
Scott Jordan
2bf3172dd1
stream: memcap tracking for TcpSegment alloc
2 years ago
Eric Leblond
47a5e6356d
log/pcap: handle case of multiple link types
2 years ago
Eric Leblond
2c2fc6cd91
flow: set datalink for pseudo packet
...
Set pseudo packet datalink to the global one. This fixes the case
where the pcap handle is open with information coming from a
pseudo packet. Without this, we did end up in most cases with
an Ethernet packet being written in a Raw pcap.
2 years ago
Eric Leblond
1c2fba57f8
suricata: introduce global linktype
...
As Suricata is not supporting pcap-ng we have to stick with one single
datalink type for the capture if ever we want to do pcap logging.
Assuming this, this patch introduces a function to set the link
type globally. This will be used with pcap conditional logging
to get the logging of TCP segments with the correct link type.
2 years ago
Eric Leblond
584136ecb7
log/pcap: log segments for pseudo packets
2 years ago
Eric Leblond
8f0ef48e82
log/pcap: fix conditional pcap in tag mode
...
We were missing the first packet when using condition pcap logging
in tag mode as it was not tagged. As a result we were not getting
the stream data triggering the alert in the pcap file.
2 years ago
Eric Leblond
9f4d59b3f7
detect/tag: add a tag for first packet
...
We may need to know that a packet has been tagged but is the
first one (and thus is not tagged).
2 years ago
Scott Jordan
6cfc3343e7
log/pcap: dump segments of both sides of tcp session.
...
This patch updates tcp segment dumping to dump segments
from both sides of the session in order when capturing
alerts and tags.
2 years ago
Eric Leblond
6f06f7c22c
doc: add info about capture_file key
2 years ago
Eric Leblond
faab853685
log/pcap and eve/alert: get pcap filename to support multi mode
...
This patch adds a function to get the current pcap file name that
will be used to current packet. This patch also updates EVE
alerts to add pcap output filename when pcap capture is done in
multi or normal mode.
2 years ago
Eric Leblond
2317fd83ef
log/pcap: fix typo in error message
2 years ago
Eric Leblond
3908166f91
stream: count realloc in memcap
...
TCP memory cap was not taking into account the memory that can
be used by realloc of Packet headers in TCP segments.
2 years ago
Eric Leblond
0f14c55e52
log/pcap: update copyright date
2 years ago
Eric Leblond
0c7e4c13a1
doc: add conditional pcap logging info
2 years ago
Eric Leblond
58ef7bcdee
log/pcap: introduce tag as logging condition
...
This patch adds the tag as logging condition. If this option is
used all tagged packets are written to the pcap.
2 years ago
Eric Leblond
626fce0712
log/pcap: fix some indentation and white spaces
2 years ago
Eric Leblond
cc04eef007
log/pcap: add support for tunnel logging
...
In alert mode, we need to write the root packet to the pcap
file instead of the packet that did trigger the alert.
2 years ago
Eric Leblond
e7b1c52c1c
log/pcap: add existing stream logging
...
This patch update the alert mode of pcap logging.
It uses the packet header data added to the TCP segments
to build packets corresponding to the acked data that did trigger
the alert. It then write it to the pcap file before starting to
dump all packet for the flow that did alert.
2 years ago
Eric Leblond
b416a4455c
stream: conditionally add packet header to segment
...
This patch optionally adds packet header to the TCP segment
and update the for each segment function by changing the
callback.
This patch is based on the work by Scott Jordan <scottfgjordan@gmail.com>
2 years ago
Eric Leblond
435557ee7f
detect: add flag when packet is first with alert
...
We add a flag to packet to be able to know if this packet was the
first one to get alerts on the flow.
2 years ago
Eric Leblond
412ca5d64c
log/pcap: add PcapWrite function
...
It will be used later when multiple writing operations will be
necessary.
2 years ago
Eric Leblond
4cab5e5262
log/pcap: conditional logging
...
Add an option to only write to pcap packets with alerts and flow
that have alerted.
2 years ago
Jason Ish
0b51022337
github-ci: remove fedora 34 build
...
Fedora 34 goes EOL in early June. The checks in this build are already
covered by the 35 and 36 builds.
2 years ago
Jason Ish
49647ad120
github-ci: bump fedora versions
...
35 -> 36
34 -> 35
33 -> 34
2 years ago
Jason Ish
3ea6572e22
rules: use primary default-rule-path if set on command line
...
When reloading rules, respect `--set default-rule-path=...` from the
command line if set.
Previously the rule reload would always take the default-rule-path from
the configuration file, even if overrided on the command line.
Issue: #1911
2 years ago
Juliana Fajardini
28ac75b505
detect/alert: directly increment alerts.discarded
...
In the unlikely case of AlertQueueExpand failure, we were incrementing
the discarded alerts stats in AlertQueueAppend via the Packet member in the
DetectEngineThreadCtx, which may not be initialized yet.
Bug #5353
2 years ago