11720 Commits (2320d62872d81a6ab423b8adc92d2a9a35243b61)

 

All Branches   

Search

Author	SHA1	Message	Date
Jeff Lucovsky	7ab986250a	detect/file-data: Apply transforms on file_data ... This commit cause transforms to be applied on the sticky buffer.	4 years ago
Victor Julien	e07a4393a9	http: error check htp_list_size ... This avoids a potential casting to uint64_t of -1, leading to a very high upper bound of the tx loop.	4 years ago
Jeff Lucovsky	6f9b7e052a	doc/eve: Update threaded filename examples	4 years ago
Jeff Lucovsky	8f009cf9b5	output/json: Update threaded filename example	4 years ago
Jeff Lucovsky	a75e9667ce	log/eve: Threaded filename change: eve.N.json ... This commit changes the name of the file used with threaded eve logging to better support log rotation Instead of using "eve.json.N" and creating potential issues with log rotation (which also uses a ".N" suffix), the eve logs will be named "eve.N.json" when threaded.	4 years ago
Jeff Lucovsky	73567272cd	path: SCBasename - function to return basename ... This commit returns the basename of a file, if it exists in the same way that `basename(1)` works.	4 years ago
Jeff Lucovsky	db9776af64	detect/rules: Fix copy/paste error ... This commit corrects a copy/paste error handling the `include-mpm-stats` configuration setting.	4 years ago
Jeff Lucovsky	41967a53ec	detect: Apply clang-format updates	4 years ago
Jeff Lucovsky	d911fb87b8	detect/rules: Increase array size to remove SEGV ... This commit changes the size of reporting variables to be dynamic based on the buffer ids in use instead of a fixed value to address a SEGV when the fixed value was less than the max buffer/type id in use.	4 years ago
Jason Ish	13049ae09d	scripts/setup-app-layer: fix rust generation ... Fix Rust app-layer generation. Main parser file was being named gopher.rs instead of the name of the protocol.	4 years ago
Philippe Antoine	64fcba228b	http2: complete parsing of priority frames	4 years ago
Philippe Antoine	c300a859a0	http2: keep track of dynamic headers table size ... And evict entries accordingly to maximum size	4 years ago
Philippe Antoine	1a21eea0e9	http2: variable size integers decoded everywhere	4 years ago
Philippe Antoine	b21acfbf21	http2: StreamIdReuse frame types exceptions ... Also handles better the state so as not to revert from HTTP2StateHalfClosedClient to HTTP2StateDataServer and not go to final HTTP2StateClosed	4 years ago
Philippe Antoine	89573060d9	http2: use variable integer for headers lengths	4 years ago
Philippe Antoine	d57275fa64	protodetect: rerun probing parser if pattern matched ... If a pattern matches in the other direction, after probing parser finished without finding a protocol, we will rerun the probing parser, which will include the newly protocol found by its pattern	4 years ago
Philippe Antoine	5f348e9907	protodetect: runs probing parser on protocol found ... It a protocol is found in a first direction, we should run the probing parser, even if it is not in the known ports. That can happen for HTTP2, where client magic is detected, then server probe can be run	4 years ago
Philippe Antoine	518e0e66cb	applayer: fix a leak in protocol change ... TCPProtoDetect can either set f->alproto, change f->alstate and return error. When the original alstate gets freed, we shall set the pointer to NULL, as it can get reused.	4 years ago
Shivani Bhardwaj	97c67cd5ce	dcerpc: fix gap handling ... This patch addresses issues discovered by redmine ticket 3896. With the approach of finding latest record, there was a chance that no record was found at all and consumed + needed became input length. e.g. input_len = 1000 input = 01 05 00 02 00 03 a5 56 00 00 ..... There exists no |05 00| identifier in the rest of the record. After having parsed |05 00|, there was a search for another record with the leftover data. Current data length at this point would be 997. Since the identifier was not found in the data, we calculate the consumed bytes at this point i.e. consumed = current_data.len() - 1 which would be 996. Needed bytes still stay at a constant of 2. So, consumed + needed = 996 + 2 = 998 which is lesser than initial input length of 1000 and hence the assertion fails. There could be two fixes to this problem. 1. Finding the latest record but making use of the last found record in case no new record was found. 2. Always use the earliest record. This patch takes the approach (2). It also makes sure that the gap and current direction are the same.	4 years ago
Philippe Antoine	4f963717f8	fuzz: better configure checks for MSAN building ... More compatible check for rust nightly Checks for CARGO_BUILD_TARGET Builds release or debug mode independently	4 years ago
Jeff Lucovsky	bb71eac9f9	log/anomaly: Move metadata out of anomaly section ... This commit moves the metadata from the anomaly object where it was incorrectly located.	4 years ago
Jason Ish	f70e1f571e	doc/userguide: add info about --set and lists	4 years ago
Victor Julien	daffcc6e53	app-layer: improve depth handling ... Consider txs inspected and done for a direction after depth is reached for that direction.	4 years ago
Victor Julien	a5a46795bd	stream: make sure to call app-layer in case of depth reached	4 years ago
Victor Julien	5d985c4271	dcerpc: implement tx free function	4 years ago
Victor Julien	8b2886635f	dcerpc/tcp: implement trunc logic ... When one side of the connection reaches the STREAM_DEPTH condition the parser should be aware of this. Otherwise transactions will forever be waiting for data in that direction.	4 years ago
Victor Julien	4da0d9bdea	applayer/rust: expose truncate callback	4 years ago
Victor Julien	2cfa35ccc9	app-layer: don't check tx detect flags if detect is disabled	4 years ago
Victor Julien	34e83b8acf	stream: remove GAP flag from stream ... This flag was checked in many places, but never set expect in 2 unittests.	4 years ago
Jeff Lucovsky	c5ace81a27	log/eve: Rename fileinfo alert object to files ... This commit changes the name of the "fileinfo" array in the alert object to "files" to better support legacy use of "fileinfo" in reporting and elsewhere. The "fileinfo" event type is not an array while the alert "fileinfo" member was.	4 years ago
Jason Ish	69fffb2dc4	doc/userguide: include man page even when not including pdf ... Fix a mistake in Makefile.am where the man page was only being added to the distribution if the PDF was also created. It should be included even if the PDF cannot be included.	4 years ago
Shivani Bhardwaj	301454e9e4	dcerpc: fix datatypes while handling stub data	4 years ago
Shivani Bhardwaj	3fd9a3d420	dcerpc: fix datatype for stub data len	4 years ago
Philippe Antoine	222b386102	rust: rebuilds std when building fuzzers ... so as to have MSAN working	4 years ago
Victor Julien	2bef41a630	version: continue 6 development	4 years ago
Victor Julien	914391697a	version: update to 6.0.0-rc1	4 years ago
Victor Julien	990dfdac6b	changelog: update for 6.0.0-rc1	4 years ago
Philippe Antoine	15447cc672	dceprc: signature rust check with is_char_boundary ... before calling split_at which would panic	4 years ago
Shivani Bhardwaj	98285177ba	datasets: use default memcap	4 years ago
Philippe Antoine	872de829ea	detect: initialize pointer before calling pcre_study ... So as not to check an uninitialized value Found by MSAN	4 years ago
Victor Julien	f21a4bc40e	datasets: remove experimental warning	4 years ago
Shivani Bhardwaj	87617b200c	doc/datasets: add info about memcap and hashsize	4 years ago
Shivani Bhardwaj	1286b0a8f1	datasets: parse defaults section from yaml ... Datasets can now have a global defaults setting in suricata.yaml. In case the settings for memcap and hashsize are not find in the yaml or rule, this shall be the fallback. Example: datasets: defaults: memcap: 100mb hashsize: 2048 ua-seen: type: string load: datasets.csv	4 years ago
Shivani Bhardwaj	5ac94fc407	datasets: allow memcap, hashsize be set via yaml or rule ... It is now possible to set the memcap and hashsize via suricata.yaml and rules. Rule example: alert http any any -> any any (http.user_agent; dataset:isset,ua-seen,type string,load datasets.csv,memcap 100mb,hashsize 2048; sid:1;) suricata.yaml example: datasets: ua-seen: type: string load: datasets.csv memcap: 20mb hashsize: 2048	4 years ago
Shivani Bhardwaj	b2482d6c60	datasets: allow max possible memcap while loading ... While using the "load" option of datasets, it should be possible to load any file from the disk, so set the limit to highest possible.	4 years ago
Jason Ish	2b1bbd08a3	rules/tls: sync with changes to the TLS events ... Sync rules with event changes in commit 01aef49cbd.	4 years ago
Jeff Lucovsky	ce603d662f	log/eve: Ensure eve logs have sequential suffixes ... This commit ensures that the eve logs have sequential suffixes without gaps.	4 years ago
Jeff Lucovsky	ad2e18be3e	atomics: Add "decl and init with value" function ... This commit adds an interface to declare and initialize an atomic with a specific value. This can help with situations where there's no defined initialization path to set things up.	4 years ago
Jeff Lucovsky	8395a9201e	log: Ensure threaded eve honors SIGHUP ... This commit ensures that all logging contexts register for the file rotation mechanism (SIGHUP and configured).	4 years ago
Jason Ish	7d44e80a50	doc: document removal of unified2 ... And suggest an alternate tool, Meer if compatibility with Barnyard2 style databases is required. Redmine ticket: https://redmine.openinfosecfoundation.org/issues/3497	4 years ago