12779 Commits (251b52ab07800207ab2882040754dc878eefd433)

 

All Branches   

Search

Author	SHA1	Message	Date
Lukas Sismis	a7faed1245	dpdk: initial support with workers runmode ... Register a new runmode - DPDK. This enables a new flag on Suricata start (--dpdk). With the flag given, DPDK runmode is enabled. Runmode loads the configuration and then initializes EAL. If successful, it configures the physical NICs according to the configuration file. After that, worker threads are initialized and then are in continuous receive loop.	3 years ago
Lukas Sismis	fcfee6994e	dpdk: edit configure.ac to include DPDK compilation option ... Add a build flag --enable-dpdk to support DPDK parts in the source code.	3 years ago
Jeff Lucovsky	142a579971	netmap: allow specifying a library directory ... Ticket: #4482	3 years ago
Jason Ish	92eb14c5ad	datasets: initialize after dropping privileges ... Move initialization of datasets to a point after privileges have been dropped. Ticket 4239	3 years ago
Pierre Chifflier	d67f8f9196	rust/smb: convert parser to nom7 functions (SMB1)	3 years ago
Pierre Chifflier	895a54cea4	rust/smb: convert parser to nom7 functions (DCERPC records)	3 years ago
Pierre Chifflier	8d77ce1ffc	rust/smb: convert parser to nom7 functions (SMB2)	3 years ago
Pierre Chifflier	5cadb878ff	rust/smb: convert parser to nom7 functions (SMB3)	3 years ago
Pierre Chifflier	4c97dfa851	rust/smb: convert parser to nom7 functions (NTLM/SSP records)	3 years ago
Pierre Chifflier	3da816eb23	rust/smb: convert parser to nom7 functions (NBSS records)	3 years ago
Pierre Chifflier	90f9450971	rust: add nom7 combinator take_until_and_consume	3 years ago
Lukas Sismis	e4b5239202	doc: fix typo in "Stream engine" documentation	3 years ago
Philippe Antoine	dd32238667	ftp: do not set alproto if one was already found ... Ticket: 4857 If a pattern such as GET is seen ine the beginning of the file transferred over ftp-data, this flow will get recognized as HTTP, and a HTTP state will be created during parsing. Thus, we cannot override directly alproto's values This solves the segfault, but not the logical bug that the flow should be classified as FTP-DATA instead of HTTP	3 years ago
Victor Julien	a02f263e56	app-layer/htp: cleanup test	3 years ago
Victor Julien	0a1c3267e6	htp: rename callbacks to make purpose clearer	3 years ago
Victor Julien	258415b23f	stream: unify ack'd right edge handling ... Use util function in all code needing the ack'd data.	3 years ago
Victor Julien	ac11502629	detect/engine: store buffer name in local array ... Instead of storing a name and description as a pointer in DetectBufferType store them in fixed size arrays. This is in preparation of runtime registration of buffer types, where a constant name/desc is not available.	3 years ago
Victor Julien	e93dc24383	mingw: add bcrypt to LDADD for rust compilation	3 years ago
Victor Julien	6ee818cb3e	stream/reassembly: ignore min_inspect_depth on TCP state CLOSED	3 years ago
Victor Julien	55202f826a	detect/http: don't set min-inspect-depth higher than setting	3 years ago
Philippe Antoine	27dd0c6b3d	eve/ftp-data: log alert metadata in ftp-data object ... Ticket: 4860 instead of directly in root	3 years ago
Philippe Antoine	87d9c44ec5	rust: export constants via cbindgen ... so that constants are not defined twice in Rust anc C So that we are sure they have the same value	3 years ago
Philippe Antoine	784558df2e	mime: handles multiple sections for a parameter ... Ticket: 4386 as per RFC2231. For instance filename can be split between filename*0, filename*1, etc...	3 years ago
Philippe Antoine	8feb9c35ae	mime: move FindMimeHeaderTokenRestrict to rust ... Also fixes the case where the token name is present in a value	3 years ago
Modupe Falodun	76131c8cff	detect-ipopts: convert unittests to FAIL/PASS APIs ... Bug: 4047	3 years ago
Philippe Antoine	1b10848d84	mqtt: fix transaction completion ... Ticket: 4862 A transaction to client is always considered complete in the direction to server and vice versa. Otherwise, transactions are never complete for AppLayerParserTransactionsCleanup	3 years ago
Victor Julien	ecce116117	detect/fast_pattern: allow for rule time registration ... In preparation of more dynamic logic in rule loading also doing some registration, allow for buffers to be registered as fast_patterns during rule parsing. Leaves the register time registrations mostly as-is, but copies the resulting list into the DetectEngineCtx and works with that onwards. This list can then be extended.	3 years ago
Victor Julien	db27244379	detect: add buffer helper functions	3 years ago
Victor Julien	707b75ccda	detect: split register time and detect load time buffer funcs	3 years ago
Victor Julien	5bcaae0a01	detect: use hashes for all buffer to id ... Instead of a map that is constantly realloc'd, use 2 hash tables for DetectBufferType entries: one by name (+transforms), the other by id. Use these everywhere.	3 years ago
Victor Julien	51dcf3d76a	detect: increase SigMatch type from u8 to u16	3 years ago
Victor Julien	bb3d49d5bf	detect: use bool for uint16_t used as bool	3 years ago
Victor Julien	6d7c1519ed	common: fix missing ; in header	3 years ago
Philippe Antoine	c9d222a483	detect: allows <> syntax for uint ranges	3 years ago
Philippe Antoine	5af4ef4532	detect: use prefilter values for modes	3 years ago
Philippe Antoine	3f15b2492c	detect: errors for rule with impossible conditions ... Such as >255 for an uint8 field	3 years ago
Juliana Fajardini	7c636d25c7	userguide: (nit) fix typo in lua-output page	3 years ago
Juliana Fajardini	4256c1ccd5	userguide: rename pg Lua Scripting->Lua Detection ... Since we can have scripts for output _or_ detection, it seems more clear to rename this page to add more meaning	3 years ago
Juliana Fajardini	59e5a21fca	userguide: update buffers list for lua-scripting	3 years ago
Juliana Fajardini	e7f1736f3a	userguide/lua: add explanation about `need` diffs ... The differences on how the `need` key works, depending on script usage (output or detection) confuses users, sometimes (cf doc#4725). While we don't fix that, just explain this behavior.	3 years ago
Philippe Antoine	f4449d3fb3	fuzz: restrict flags passed to AppLayerProtoDetectGetProto ... Completes commit 05f9b3ffc6	3 years ago
Jason Ish	7732efbec2	app-layer: include decoder events in app-layer tx data ... As most parsers use an events structure we can include it in the tx_data structure to reduce some boilerplate/housekeeping code in app-layer parsers.	3 years ago
Philippe Antoine	0caaf6bd23	range: prevents memory leak of file from HTTP2 ... Ticket: 4811 Completes commit c023116857 state.free should also close files with ranges as state.free_tx did already And file_range field should be reset so that there is no use after free.	3 years ago
Philippe Antoine	86f5d33f75	enip: fix int warnings ... There seems to fix a real bug when an ENIP connection has more than 65k transactions	3 years ago
Philippe Antoine	86b5c81ea2	dnp3: fix int warnings ... There is a hack to know the type of an integer and do an explicit cast in the python script generating the C file Also extends some bounds check against negative values	3 years ago
Philippe Antoine	53fc70a9a7	protodetect: fix int warnings ... There is actually a real evasion with AppLayerProtoDetectPMGetProto using u16 instead of u32 for buflen	3 years ago
Philippe Antoine	743fb12aa8	ci: adds default warning flag about float conversions	3 years ago
Philippe Antoine	46981ccd98	warning: explicit casts to double	3 years ago
Philippe Antoine	b88f015bfb	source/pcap: remove unused code	3 years ago
Philippe Antoine	05f9b3ffc6	fuzz: restrict flags passed to AppLayerProtoDetectGetProto ... So that rust does not panic with an unhandled value	3 years ago