12861 Commits (1e653249400ec6217af6d3f153f774ec133d5357)

 

All Branches   

Search

Author	SHA1	Message	Date
Victor Julien	b36683e04f	output/stats: use unique thread data name	3 years ago
Victor Julien	008f4aee69	output/packet: use unique thread data name	3 years ago
Victor Julien	dd1dc88c65	output/filedata: use unique thread data name	3 years ago
Victor Julien	c7db9aa50d	output/file: use unique thread data name	3 years ago
Victor Julien	45f13b3d01	output/tx: use unique thread data name	3 years ago
Victor Julien	0be99f3e35	output: minor header cleanups	3 years ago
Victor Julien	645a04c233	output: declare OutputLoggerThreadStore once	3 years ago
Victor Julien	0ccf5b9147	app-layer: fix error counter logic	3 years ago
Victor Julien	b0cad24705	github: enable dependabot for Rust/cargo	3 years ago
Modupe Falodun	cf5c58c075	detect-uricontent: convert unittests to FAIL/PASS APIs	3 years ago
Modupe Falodun	dc8908b282	detect-uricontent: remove unittests ... These tests are reimplemented as Suricata-verify Task: 4911	3 years ago
Modupe Falodun	26c9e66586	detect-engine-enip: remove unittests ... These test is reimplemented in Suricata-Verify Task: 4911	3 years ago
Victor Julien	609a7eaab2	app-layer: error counters ... Per app-layer error counters for: gap, parser, internal (AppLayerResult issues), alloc	3 years ago
Victor Julien	ae0b8d92da	flow/manager: remove dead code	3 years ago
Victor Julien	5618886aa9	stream: remove unused defines	3 years ago
Victor Julien	811b2cd334	doc: refresh main README; more accurate CI description	3 years ago
Modupe Falodun	d2dad66a2b	detect-dce-opnum: remove unittests ... These tests are reimplemented in Suricata-Verify Task: 4911	3 years ago
Jason Ish	b9a429e6ce	devguide: move image generation into sphinx setup ... While ReadTheDocs can't execute arbitrary scripts, we can install mscgen in the container that builds the docs (see .readthedocs.yaml). Then instead of calling generate-images.sh from the Makefile, move this into the setup function defined on conf.yaml, which will generate the scripts as part of a normal Sphinx workflow. This should give us an image generation solution that works on ReadTheDocs, and locally within anyones build system provided they have mscgen installed.	3 years ago
Philippe Antoine	4247605d87	smtp: check if we have a current transaction ... Ticket: 4948 This is not the perfect solution, but it prevents to trigger the assert, and keep the assert. A better solution would need to create transaction from the reponse parsing, in case a later command was buffered and not answered. But this would not be enough as NoNewTx prevents the creation of a new transaction for RSET...	3 years ago
Philippe Antoine	11d3af551b	doc: suricata.yaml fields about maximum transactions ... For HTTP2, MQTT and FTP.	3 years ago
Philippe Antoine	2ef4172437	ftp: limits the number of active transactions per flow ... Ticket: 4530 As for HTTP2 and MQTT. In FTP case, transactions are pipelined, not identified by an id. So, there are less chances of DOS by quadratic complexity.	3 years ago
Philippe Antoine	e42094f238	mqtt: make max transactions configurable ... Allows users to find balance between completeness of decoding and increases resource consumption, which can DOS suricata.	3 years ago
Philippe Antoine	4f90d4254e	http2: makes some settings configurable ... max-streams and max-table-size Allows users to find balance between completeness of decoding and increases resource consumption, which can DOS suricata.	3 years ago
Philippe Antoine	a8079dc978	mqtt: limits the number of active transactions per flow ... Ticket: 4530 So, that we do not get DOS by quadratic complexity, while looking for a new pkt_id over the ever growing list of active transactions	3 years ago
Philippe Antoine	5475212f21	http2: limits the number of active transactions per flow ... Ticket: 4530 So, that we do not get DOS by quadratic complexity, while looking for a new stream id over the ever growing list of active streams	3 years ago
Philippe Antoine	b39554b11f	fuzz: target for applayer cleans transactions ... Ticket: 4530 Otherwise, we timeout because we kept too many of them as Suricata would not	3 years ago
Aaron Bungay	a5d3a1f92c	src: use bool instead of int	3 years ago
Aaron Bungay	272786908c	smtp/mime: configurable url scheme extraction ... Parse extract-url-schemes from the mime config. e.g. 'extract-urls-schemes: [http, https, ftp, mailto]' Update MimeDecConfig struct to new url extraction fields. Change app-layer-smtp.c & util-decode-mime.c to initialize new struct fields for MimeDecConfig. Sets the default value for extract-url-schemes if not found in the config to 'extract-urls-schemes: [http]' for backwards compatibility. Uses the schemes defined in the mime config value for extract-urls-schemes to search for URLS starting with those scheme names followed by "://". Logs the URLS with the scheme + '://' at the start if the log-url-scheme is set in the mime config, otherwise the old behaviour is reverted to and the urls are logged with the schemes stripped. Removed unused constant URL_STR now that URLS are being searched for using extract-urls-schemes mime config values instead of just URL's starting with 'http://'. Added commented out new options for extract-urls-schemes and log-url-scheme to suricata.yaml.in. Update FindUrlStrings comments. Remove old outdated comments/commented code from FindUrlStrings. Update test case for mime which now needs schemes list to be set. Add Test Cases for FindUrlStrings() method. Feature: #2054	3 years ago
Victor Julien	6c240938b5	github-ci: replace failing CentOS 8 by AlmaLinux 8.4	3 years ago
Modupe Falodun	b77d1d7d2e	detect-flowbits: remove unittests ... These tests are reimplemented in Suricata-Verify Task: 4911	3 years ago
Philippe Antoine	f0e869b26b	mqtt: parse properties with the right buffer's length	3 years ago
Philippe Antoine	df2cbd6517	http2: event for variable-length integer overflow ... http2_parse_var_uint can overflow the variable-length integer it is decoding. In this case, it now returns an error of kind LengthValue. The new function http2_parse_headers_blocks, which factorizes the code loop for headers, push promise, and continuation, will check for this specific error, and instead of erroring itself, will return the list of so far parsed headers, plus another one with HTTP2HeaderDecodeStatus::HTTP2HeaderDecodeIntegerOverflow This status is then checked by process_headers to create an app-layer event.	3 years ago
Philippe Antoine	b86beb9b68	http2: check overflow before it happens ... instead of checking afterwards if value got smaller	3 years ago
Jason Ish	f8e143030c	github-ci: update commit and formatting containers ... Update the Ubuntu containers for the commit and formatting checks to Ubuntu 20.04. The latest version of the checkout action requires git v2.18 in order to checkout the code as a git repo, which is required for these workflows. With older versions of git the action will download the code as a tarball and lack the .git directory.	3 years ago
Jason Ish	234a44bf85	github-ci: pin actions to specific versions ... Resolve the GitHub scanning pinned-dependencies for most of our GitHub actions. The oss-fuzz actions have not been updated.	3 years ago
Philippe Antoine	1e1a4ab1c4	detect: logs an error if a protocol is disabled ... So that the user knows that the rule cannot match	3 years ago
Philippe Antoine	bf30eb344a	detect: checking validity of rules with http protocol ... We want to check that a rule beginning with alert http can be valid, that is if either HTTP1 or HTTP2 is enabled. So, AppLayerProtoDetectGetProtoName will do a more complex check for this ALPROTO_HTTP (any).	3 years ago
Jeff Lucovsky	b53fced452	general: Fix typo	3 years ago
Jeff Lucovsky	be2155b4ed	config/ref: Raise errors for ref.config parsing ... This commit raises an error in configuration test mode if there was an error parsing reference.config. Issue: 4659	3 years ago
Modupe Falodun	8d615842f9	detect/bypass: remove unittest ... This test is reimplemented in Suricata-Verify Task: 4911	3 years ago
Victor Julien	7b152d0021	github-ci: update codecov ... Update to v2 API. Pin the version as suggested by Scorecard. No longer fail on error. This was not found to be very actionable.	3 years ago
Jason Ish	ee933794aa	github-ci: set workflow permissions to read-all	3 years ago
Victor Julien	738e756eaf	eve/pgsql: log txs in flow direction	3 years ago
Angelo Mirabella	41a139b590	stream-tcp-reassemble: fix reassembly direction for FIN packets ... Suricata invokes the stream reassembly logic only for the current packet direction if the packet contains a FIN flag. However, this does not handle the case in which the packet ACKs data from the opposing direction. This patch forces the invocation of the stream reassembly logic on both direction when Suricata sees a FIN packet.	3 years ago
Jason Ish	9e096dda4e	windows: exit early if live capture requested without npcap	3 years ago
Jason Ish	5037c86b49	github-ci: add windows build for libpcap	3 years ago
Jason Ish	31ba4fd152	configure: fallback to libpcap on Windows ... If npcap/wpcap is not found on Windows, try libpcap. This allows Suricata to build without NPCap on Windows, however live capture won't be available.	3 years ago
Modupe Falodun	154e4eb395	http-response-line: remove unittest ... This test is reimplemented in Suricata-Verify Task: 4911	3 years ago
Modupe Falodun	926c02a141	detect/modbus: remove unittests ... These tests are reimplemented in Suricata-Verify Task: 4911	3 years ago
Modupe Falodun	0984528ddb	detect-http-request-line: remove unittests ... These tests are reimplemented as Suricata-Verify Task: 4911	3 years ago