16224 Commits (629873c2bcad0f95162740bea83252f9d95a5209)

 

All Branches   

Search

Author	SHA1	Message	Date
Victor Julien	114fc37294	detect/address: constify ipv6 cmp funcs	2 years ago
Victor Julien	3a7247b1ed	detect/threshold: minor rate filter cleanup	2 years ago
Victor Julien	ab5e04525f	detect/threshold: minor code cleanup ... Packet pointer is not used during allocation.	2 years ago
Victor Julien	6622dc7444	detect/threshold: minor cleanup	2 years ago
Victor Julien	c08c81cacf	detect/threshold: implement per thread cache ... Thresholding often has 2 stages: 1. recording matches 2. appling an action, like suppress E.g. with something like: threshold:type limit, count 10, seconds 3600, track by_src; the recording state is about counting 10 first hits for an IP, then followed by the "suppress" state that might last an hour. By_src/by_dst are expensive, as they do a host table lookup and lock the host. If many threads require this access, lock contention becomes a serious problem. This patch adds a thread local cache to avoid the synchronization overhead. When the threshold for a host enters the "apply" stage, a thread local hash entry is added. This entry knows the expiry time and the action to apply. This way the action can be applied w/o the synchronization overhead. A rbtree is used to handle expiration. Implemented for IPv4.	2 years ago
Victor Julien	c963158443	detect: add ticket id to var related todos	2 years ago
Victor Julien	405491c3fc	detect/detection_filter: add support for track by_flow	2 years ago
Victor Julien	3f04af7c7f	doc: add thresholding by_flow	2 years ago
Victor Julien	f028648750	detect/content: fix wrong value for depth check ... Limits propegation checked for DETECT_DEPTH as a content flag, which appears to have worked by chance. After reshuffling the keyword id's it no longer worked. This patch uses the proper flag DETECT_CONTENT_DEPTH.	2 years ago
Victor Julien	d0f3f2d462	detect: group content inspect keyword id's	2 years ago
Victor Julien	022173d7ab	detect: group types used in traffic variables ... Traffic variables (flowvars, flowbits, xbits, etc) use a smaller int for their type than detection types. As a workaround make sure the values fit in a uint8_t.	2 years ago
Victor Julien	cfd55ead74	threshold: add by_flow support for global thresholds ... Allow rate_filter and thresholds from the global config to specify tracking "by_flow".	2 years ago
Victor Julien	1552f0953a	detect/threshold: implement tracking 'by_flow' ... Add support for 'by_flow' track option. This allows using the various threshold options in the context of a single flow. Example: alert tcp ... stream-event:pkt_broken_ack; \ threshold:type limit, track by_flow, count 1, seconds 3600; The example would limit the number of alerts to once per hour for packets triggering the 'pkt_broken_ack' stream event. Implemented as a special "flowvar" holding the threshold entries. This means no synchronization is required, making this a cheaper option compared to the other trackers. Ticket: #6822.	2 years ago
Victor Julien	a81b23254c	util/var: add comments explaining types	2 years ago
Victor Julien	1fa13e4b81	util/var: remove printf; add assert	2 years ago
Philippe Antoine	5bd17934df	http2: do not expand duplicate headers ... Ticket: 7104 As this can cause a big mamory allocation due to the quadratic nature of the HPACK compression.	2 years ago
Philippe Antoine	37509e8e0e	modbus: abort flow parsing on flood ... Ticket: 6987 Let's not spend more resources for a flow which is trying to make us do it...	2 years ago
Victor Julien	ce727cf4b1	detect: remove unnecessary detect thread flags stores	2 years ago
Philippe Antoine	b34d4b1314	detect/nfs: do not free a null pointer ... https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=69840	2 years ago
Jeff Lucovsky	5b97f4040c	detect/base64: Use Rust defined modes everywhere ... Issue: 6487 To avoid ambiguity, a single definition for base 64 decoding modes will be used. The Rust base64 transform contains the definitions for the existing mode types: Strict, RFC2045, RFC4648	2 years ago
Jeff Lucovsky	01e20c91fb	doc/transform: Correct typo	2 years ago
Jeff Lucovsky	d205ff82d0	doc/transform: Describe the from_base64 transform ... Issue: 6487 Document the new transform and indicate that it's the preferred way to perform base64 decoding (preferred over base64_decode)	2 years ago
Jeff Lucovsky	f042e9034b	detect/transform: Add from_base64 transform ... Issue: 6487 Implement the from_base64 transform: [bytes value] [offset value] [mode strict|rfc4648|rfc2045] The value for bytes and offset may be a byte_ variable or an unsigned integer.	2 years ago
Jeff Lucovsky	1823681709	detect/transform: from_base64 option parsing ... Issue: 6487 Implement from_base64 option parsing in Rust. The Rust module also contains unit tests.	2 years ago
Jeff Lucovsky	ab0cb960a1	detect/parser: Refactor utility routines ... Refactor utility functions/definitions from the byte_math module into the parser module. This includes parse_var and ResultValue Issue: 6487	2 years ago
Shivani Bhardwaj	903283d76e	flow: declare and use constansts where possible	2 years ago
Shivani Bhardwaj	00a644c5c2	flow/manager: make fn calls only when necessary	2 years ago
Shivani Bhardwaj	eb95d2bf66	flow/timeout: cleanup fn names and comments	2 years ago
Shivani Bhardwaj	8818b9cbe0	flow: remove unneeded args to fn	2 years ago
Shivani Bhardwaj	f97b4ec1e8	flow/manager: add fn docs	2 years ago
Shivani Bhardwaj	14cd594d3c	flow: add defensive check	2 years ago
Shivani Bhardwaj	a87c8eb46f	packetpool: use DEBUG_VALIDATE statement	2 years ago
Shivani Bhardwaj	87fa7f10ef	flow: use bool wherever possible	2 years ago
Philippe Antoine	8b831e6751	detect/icmp: require real packet in signature ... Fixes: 956c8bebd1 ("detect/prefilter: use sig mask to exclude pkt engines")	2 years ago
Philippe Antoine	0a953fe1ce	detect: add to signature mask for decode events ... Ticket: 6291	2 years ago
Philippe Antoine	4e584ed201	detect: fix check for app_layer events ... Ticket: 7106	2 years ago
Jeff Lucovsky	834cd6fbdb	af-packet: Remove unused preprocessor define ... Remove unused preprocessor value; exposed by compilation warning	2 years ago
Philippe Antoine	c9ce43b31e	output: configurable payload_length field for alerts ... Ticket: 7098	2 years ago
Philippe Antoine	a21232828e	dcerpc: add app-layer metadata in alerts ... Ticket: 6090	2 years ago
Philippe Antoine	5f35035928	filestore: do not try to store a file set to nostore ... Ticket: 6390 This can happen with keyword filestore:both,flow If one direction does not have a signature group with a filestore, the file is set to nostore on opening, until a signature in the other direction tries to set it to store. Subsequent files will be stored in both directions as flow flags are now set.	2 years ago
Philippe Antoine	0d4efe0c0f	app-layer: fix -Wshorten-64-to-32 warnings ... Ticket: #6186 Warnings about downcast from 64 to 32 bits	2 years ago
Philippe Antoine	1790aa49a4	util: fix -Wshorten-64-to-32 warnings ... Ticket: 6186 Warnings about downcast from 64 to 32 bits Generic fixes required to get app-layer clean	2 years ago
Philippe Antoine	dc043d0297	detect: remove unused field ... content_inspect_window is used in app-layer-smtp, but not directly in detect-file-data	2 years ago
Victor Julien	3d059611c3	detect: add tls.alpn keyword ... Ticket: #7108.	2 years ago
Victor Julien	869d5492dc	eve/schema: update for alpn	2 years ago
Victor Julien	c79a382e42	eve/tls: log ALPN for client and server ... Part of the extended logging. Logs `client_alpns` and `server_alpns` arrays in the tls object. Ticket: #7055.	2 years ago
Victor Julien	0b37654578	tls: store all ALPN records in the state ... For later logging and detection.	2 years ago
Victor Julien	7f474af1d0	eve/schema: minor enip reformat	2 years ago
Jason Ish	6256391408	github-ci: run cargo update test on pull requests ... Previously it was run once a week, hiding some issues until Monday's. Instead run on pull requests, but still not every push.	2 years ago
Victor Julien	e3e917d967	detect/icmp-id: remove prefilter pseudo check ... This is now handled at registration with SIG_MASK_REQUIRE_REAL_PKT.	2 years ago