Commit Graph

9515 Commits (57285b54d5cf611cee78cef6f428320555cbe90d)
 

Author SHA1 Message Date
Shivani Bhardwaj 57285b54d5 suricatasc: Get rid of issues detected by Pylint
Pylint is a tool to make sure we do not regress the support for Python
3. The following conventions, warnings, errors, refactors have been
fixed.

C0326: Exactly one space required around assignment
C0326: No space allowed around keyword argument assignment
C0325: Unnecessary parens after 'if' keyword
W0301: Unnecessary semicolon
W0702: No exception type(s) specified
W0231: __init__ method from base class 'Exception' is not called
W0107: Unnecessary pass statement
C0121: Comparison to None should be 'expr is not None'
E0602: Undefined variable 'raw_input'
W0201: Attribute 'socket' defined outside __init__
W0611: Unused import
6 years ago
Victor Julien 87019ff22b dcerpc/udp: fix int mishandling in opnum parsing
For Big Endian support in the protocol, the opnum would not be set
correctly.

Found using undefined sanitizer.
6 years ago
Victor Julien 9aa4e53434 file/swf: fix undefined int behaviour
Fix warnings by the undefined sanitizer.
6 years ago
Victor Julien 94191ea960 detect/bytetest: don't print errors at runtime 6 years ago
Victor Julien 25112ee7e3 rust/smb: fix and optimize record search
Get rid of struct with just a slice reference as well.
6 years ago
Pierre Chifflier 9e7f261a88 rust: fix cargo tests 6 years ago
Pierre Chifflier f22695130b rust: nom4 requires to add complete!() when using many! combinators 6 years ago
Pierre Chifflier 8c0cde36c6 rust: fix warnings for unused variables (add _) 6 years ago
Pierre Chifflier 13b7399790 rust: upgrade all parsers to nom4 6 years ago
Pierre Chifflier 2f08b3eabd rust/nom4: error_code is superseded by error_position 6 years ago
Pierre Chifflier d3011e3ee8 rust: update dependencies for nom4 transition 6 years ago
Maurizio Abba 6c0ec0b2f3 eve/http: add request/response http headers
Add a keyword configuration dump-all-headers, with allowed values
{both, request, response}, dumping all HTTP headers in the eve-log http
object. Each header is a single object in the list request_headers
(response_headers) with the following notation:

{
    "name": <header name>,
    "value": <header value>
}

To avoid forged malicious headers, the header name size is capped at 256
bytes, the header value size at 2048.

By default, dump-all-headers is disabled.
6 years ago
Maurizio Abba 4697351188 smtp: create raw-extraction feature
Add a raw-extraction option for smtp. When enabled, this feature will
store the raw e-mail inside a file, including headers, e-mail content,
attachments (base64 encoded). This content is stored in a normal File *,
allowing for normal file detection.
It'd also allow for all-emails extraction if a rule has
detect-filename:"rawmsg" matcher (and filestore).
Note that this feature is in contrast with decode-mime.

This feature is disabled by default, and will be disabled automatically
if decode-mime is enabled.
6 years ago
Alexander Gozman b2a6c60dee source-nfq: increase maximum queues number to 65535
Previously this was limited to 16, however Netfilter allows
up to 65535 queues. Suricata now is able to create as many
queues as possible, but at the same time warns user if one
specifies more queues than available CPU cores.

This change involves dynamic (de)allocation of NFQ contexts
instead of on-stack arrays to use less memory.
6 years ago
Alexander Gozman bdd69d13e0 source-nfq: support queue range
If one needs to use multiple sequential Netfilter queues,
it can be done with a new '-q' option's syntax: "start:end"
(just like it's done with iptables '--queue-balance' option).
6 years ago
Jason Ish 93c956ebdf issue 2795: python 3 fix in Rust C header gen
The C header generation script was failing with a unicode error
in Python 3 on FreeBSD.  Fix the reading of files to properly
handle unicode in all Python 3 environments.

Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2794
6 years ago
Jason Ish 9bf6f7d5a9 rust/dns: add dns to dns alerts 6 years ago
Fabrice Fontaine d01ce2e58e configure.ac: fix --{disable,enable}-xxx options
Currently, if the user provides --enable-libmagic or
--disable-libmagic, libmagic will be disabled because $enableval is not
used to know if the user provided --enable or --disable

Most of the options have this issue so fix them all by using $enableval

Fixes:
 - https://redmine.openinfosecfoundation.org/issues/2797

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
6 years ago
Victor Julien e710b06669 detect: add file.name sticky buffer 6 years ago
Victor Julien ca8471387a detect: add http.response_body sticky buffer
As a mirror of the http_server_body content modifier.
6 years ago
Victor Julien 998f32f88c detect/tls: consolidate validity code 6 years ago
Victor Julien ccdafe6697 detect/http-server-body: move tests to tests/ 6 years ago
Victor Julien 2221dd9403 detect: add http.request_body sticky buffer
Sticky buffer version of the http_client_body content modifier.
6 years ago
Victor Julien 64987f36fb detect/file-data: move tests into tests/ 6 years ago
Victor Julien 2fa8066f3a detect/file-data: consolidate matching code 6 years ago
Victor Julien 9a8092249e detect/http-client-body: move tests into tests/ 6 years ago
Victor Julien 477e46da78 detect/http-client-body: convert to inspect api v2 6 years ago
Victor Julien ce677abdf0 detect/file-data: minor cleanups 6 years ago
Victor Julien c0767ece9b detect/file-data: minor cleanups and clarifications 6 years ago
Victor Julien 58aa9dca65 detect/http-server-body: code cleanup and test cleanups 6 years ago
Victor Julien 3413757027 detect/http-client-body: code cleanups and test cleanups 6 years ago
Victor Julien 645acb1089 detect: add http.header.raw sticky buffer keyword
Add parsing tests as well.
6 years ago
Victor Julien 76fd666cad detect/http_raw_header: move tests into tests/ 6 years ago
Victor Julien 25f974eb29 detect/http_raw_header: use inspect v2 api 6 years ago
Victor Julien c298412947 detect/http_raw_header: minor code cleanups 6 years ago
Victor Julien 85697671b8 detect: add http.header sticky buffer keyword 6 years ago
Victor Julien 31444cd088 detect/http_header: convert parsing tests to use helper 6 years ago
Victor Julien b9bcd4e115 detect/http_header: move tests into tests/ 6 years ago
Victor Julien 5e951a8b06 detect/http_header: inspect v2 api 6 years ago
Victor Julien 74b06b56f2 detect/http_header: test cleanups 6 years ago
Victor Julien 2a61ee13e1 detect/http_header: remove unused func args 6 years ago
Victor Julien dac182741b detect: add http.cookie sticky buffer keyword 6 years ago
Victor Julien ab027cb481 detect/http_cookie: move tests into tests/ 6 years ago
Victor Julien 988cc8468e detect/http_cookie: switch to inspect v2 api 6 years ago
Victor Julien 0aab3ac336 detect/http_cookie: minor cleanups 6 years ago
Victor Julien e222017a29 detect/http_user_agent: set alternative and info flags 6 years ago
Victor Julien b8a0a0d6ea detect: add http.stat_code sticky buffer keyword 6 years ago
Victor Julien 2f342da048 detect/http_stat_code: move tests into tests/ 6 years ago
Victor Julien 382fa2e81d detect/http_stat_code: use inspect v2 api 6 years ago
Victor Julien db7d7b2401 detect/http_stat_code: minor code cleanups 6 years ago