16177 Commits (1e82e20c65a5772e84a671fe00be38bb59d83f13)

 

All Branches   

Search

Author	SHA1	Message	Date
Philippe Antoine	1e82e20c65	doh: implement dns over http2 app-proto ... Ticket: 5773	2 years ago
Philippe Antoine	46d98ae81c	http2: log dns if DoH is recognized ... Ticket: 5773	2 years ago
Philippe Antoine	29d9dc2729	http2: rustfmt	2 years ago
Philippe Antoine	b5f55b5b1f	dns: prepare for dns over http2 support ... by making tx parsing and creation more easily available, without needing a dns state. Dns event NotResponse is now set on the right tx, and not the one before. Also debug log for Z-flag on request says "request" instead of "response" Also rustfmt dns.rs	2 years ago
Philippe Antoine	eff7b52327	build: Wimplicit-int-float-conversion checked with --enable-warnings ... When configure is used with --enable-warnings, we try to add most warning flags that should pass. This commits adds the warning Wimplicit-int-float-conversion	2 years ago
Philippe Antoine	10ef4e832f	runmodes: fix -Wshorten-64-to-32 warnings ... Ticket: #6186	2 years ago
Philippe Antoine	ce2c087e92	defrag: fix -Wshorten-64-to-32 warnings ... Ticket: #6186	2 years ago
Philippe Antoine	bb9a45cfd0	datasets: fix -Wshorten-64-to-32 warnings ... Ticket: #6186	2 years ago
Victor Julien	6598a6953e	rust/ldap: add ldap-parser to Cargo.lock.in	2 years ago
Giuseppe Longo	70ed9f91d8	doc: add ldap protocol	2 years ago
Giuseppe Longo	910a5b226c	rust/ldap: implement logger	2 years ago
Giuseppe Longo	93da339975	rust/ldap: implement app-layer	2 years ago
Giuseppe Longo	ce7e190501	rust/ldap: implement types and filters ... This implementation adds types and filters specified in the LDAP RFC to work with the ldap_parser. Although using the parser directly would be best, strange behavior has been observed during transaction logging. It appears that C pointers are being overwritten, leading to incorrect output when LDAP fields are logged.	2 years ago
Philippe Antoine	b8c12090f7	smtp: add port 465 for probing	2 years ago
Philippe Antoine	eac9cd959f	smtp: do not return error on NULL buffer for end of stream	2 years ago
Philippe Antoine	e2d1d05878	smtp: recognize more reply codes ... Ticket: 6821	2 years ago
Philippe Antoine	694b2797cd	ftp: adds server side detection	2 years ago
Philippe Antoine	cc3dde8ada	smtp: adds server side detection ... Ticket: #1125	2 years ago
mmaatuq	64d18e3cc2	imap: extend detection patterns ... Ticket: #2886 Signed-off-by: mmaatuq <mahmoudmatook.mm@gmail.com>	2 years ago
Philippe Antoine	bce8f4b853	detect/ssh: remove deprecated keywords ... Ticket: 2377	2 years ago
Philippe Antoine	0a1062fad2	detect/mqtt: move keywords to rust ... Ticket: 4863 On the way, convert some keywords to use the first-class integer support. And helpers for pure rust the support for multi-buffer. Move the C unit tests about keyword mqtt.protocol_version to unit tests for generic integer parsing, and test version 5 instead of testing twice version 3. Also iterate all tx's messages for reason code as is done for other keywords. And allow detection on empty topics.	2 years ago
Philippe Antoine	f4e7d1e217	detect: helper function for multibuffer registration ... So that rust does not need to know about SIG_FLAG_TOCLIENT value	2 years ago
Philippe Antoine	4e074b8f38	output/alert: remove now unused include ... Including the mqtt one, now that it is almost rust only	2 years ago
Philippe Antoine	ad08309c75	mqtt: parse and store raw connect flags ... for easier later matching	2 years ago
Philippe Antoine	9adf4224e4	rust/derive: string enumeration become case insensitive ... As needed for MQTTTypeCode which accepts both CONNECT uppercase and unassigned lowercase	2 years ago
Philippe Antoine	3c5ad7a23d	rust/derive: transform all uppercase names the right way ... So that MQTTTypeCode::CONNECT does not become c_o_n_n_e_c_t	2 years ago
Philippe Antoine	daad7f2d41	detect/integers: harmonize parser return handling ... Ticket: 7172 When parsing an integer for a rule keyword fails, we return error straight away, without bothering to try to free the NULL pointer. On the way, remove some one-line wrapper around DetectUxParse	2 years ago
Jason Ish	fcc1b1067b	eve/dns: make version required ... The "eve.version" field is not always logged. Update the schema to enforce that it is, and fix it for records that don't log it. Ticket: #7167	2 years ago
Jason Ish	6d5022cd1e	github-ci: pf-ring build	2 years ago
Jason Ish	5f516c5896	doc: add pf-ring plugin upgrade notes ... Ticket: #7162	2 years ago
Jason Ish	4d0e09c6b2	configure: fail on --enable-pfring and --disable-shared ... Plugins can't be build using the standard autoconf/automake methods. We can get around this by creating our own Makefiles, but they're often less portable. For now, fail during ./configure instead of during compile.	2 years ago
Jason Ish	b318e78b3a	pf-ring: bring back command line arguments ... Bring back the pf-ring command line arguments, but instead of initializing the pfring runmode, initialize the capture plugin runmode with a plugin named "pfring". Ticket: #7162	2 years ago
Jason Ish	1173bb788e	.gitignore: globally ignore .la files ... With automake and libraries, these files are creeping in.	2 years ago
Jason Ish	155501f250	pf-ring: load plugin by default ... Ticket: #7162	2 years ago
Jason Ish	79df4b4c89	pf-ring: add as plugin ... Ticket: #7162	2 years ago
Jason Ish	c3092b6e5a	pf-ring: remove, to make room for plugin ... Ticket: #7162	2 years ago
Victor Julien	223a4194ea	config: switch default config to IEEE 1541 notation	2 years ago
Victor Julien	342aec8f1c	parse/size: support IEEE 1541 size units ... Introduce KiB, MiB and GiB. They are case sensitive as a lower case 'b' means bits in the IEEE 1541 scheme. KiB = 1024 MiB = 1048576 GiB = 1073741824 Ticket: #1457.	2 years ago
Victor Julien	0e03691fdb	parse/size: fix unit test checks	2 years ago
Jason Ish	ca6e73830c	suricata.yaml: set dns log version to 3; link to docs ... Missed in the original PR, but update the commented out version to reflect the default, and a link to the upgrade notes.	2 years ago
Victor Julien	855cc89636	profiling: allow absolute paths ... Ticket #6490.	2 years ago
Victor Julien	a404fd26af	tcp: fix 'broken ack' on flow timeout ... Don't set an ACK value if ACK flag is no longer set. This avoids a bogus `pkt_broken_ack` event set. Fixes: ebf465a11b ("tcp: do not assign TCP flags to pseudopackets") Ticket: #7158.	2 years ago
Shivani Bhardwaj	f2de3e01cb	src: remove truncate fn and glue code ... truncate fn is only active and used by dcerpc and smb parsers. In case stream depth is reached for any side, truncate fn is supposed to set the tx entity (request/response) in the same direction as complete so the other side is not forever waiting for data. However, whether the stream depth is reached is already checked by AppLayerParserGetStateProgress fn which is called by: - DetectTx - DetectEngineInspectBufferGeneric - AppLayerParserSetTransactionInspectId - OutputTxLog - AppLayerParserTransactionsCleanup and, in such a case, StateGetProgressCompletionStatus is returned for the respective direction. This fn following efc9a7a, always returns 1 as long as the direction is valid meaning that the progress for the current direction is marked complete. So, there is no need for the additional callback to mark the entities as done in case of depth or a gap. Remove all such glue code and callbacks for truncate fns. Bug 7044	2 years ago
Shivani Bhardwaj	80159eb519	applayer: remove truncation logic ... as its functionality is already covered by the generic code. This removes APP_LAYER_PARSER_TRUNC_TC and APP_LAYER_PARSER_TRUNC_TS flags as well as FlowGetDisruptionFlags sets STREAM_DEPTH flag in case the respective stream depth was reached. This flag tells that whether all the open files should be truncated or not. Bug 7044	2 years ago
Philippe Antoine	090079cdd8	decode: fix -Wshorten-64-to-32 warnings ... Ticket: #6186	2 years ago
Philippe Antoine	eeb290384a	flow: fix -Wshorten-64-to-32 warnings ... Ticket: #6186	2 years ago
Philippe Antoine	9c0875b2a4	features: fix -Wshorten-64-to-32 warnings ... Ticket: #6186	2 years ago
Philippe Antoine	b5140c43ca	counters: fix -Wshorten-64-to-32 warnings ... Ticket: #6186	2 years ago
Philippe Antoine	e0fd59a20d	doc: state that payload-length includes the gaps	2 years ago
Philippe Antoine	d28c646662	output/dcerpc: call jb_get_mark just before jb_open_object	2 years ago