12109 Commits (7d0a39412bb451443a4e19e6571ab86a0583214c)

 

All Branches   

Search

Author	SHA1	Message	Date
Philippe Antoine	7d0a39412b	detect: use u32 for InspectionBufferMultipleForList ... So that we do not have an endless loop casting index to u16 and having more than 65536 buffers in one transaction Changes for all protocols, even ones where it is impossible to have such a pattern, so as to avoid bad pattern copy/paste in the future	4 years ago
Victor Julien	e611adf3dc	detect: set event if max inspect buffers exceeded ... If a parser exceeds 1024 buffers we stop processing them and set a detect event instead. This is to avoid parser bugs as well as crafted bad traffic leading to resources starvation due to excessive loops.	4 years ago
Victor Julien	3dc50322db	detect: fix multi inspect buffer issue; clean up ... Fix multi inspect buffer API causing cleanup logic in the single inspect buffer paths. This could lead to a buffer overrun in the "to clear" logic. Multi buffers now use InspectionBufferSetupMulti instead of InspectionBuffer. This is enforced by a check in debug validation. Simplify the multi inspect buffer setup code and update the callers.	4 years ago
Victor Julien	23d7beb458	detect: reformat events table	4 years ago
Philippe Antoine	b3c1f2ab48	nfs: improve probing parser ... Checks credentials flavor is known	4 years ago
Philippe Antoine	0c948142b9	enip: improve probing parser ... Strict length for register sessions NOP command must have options=0	4 years ago
Philippe Antoine	8bf6530540	config: fix null dereference in MacSetRegisterFlowStorage ... Crash happens with --set outputs.eve-json.types.files.force-magic=yes	4 years ago
Philippe Antoine	39575e2cc9	modbus: use ascii character classes while parsin rule ... As the rust regex crate is unicode aware, which was not the case of the C version	4 years ago
Philippe Antoine	ef5755338f	rust: SCLogDebug is real nop when built as release ... Before, even if there were no outputs, all the arguments were evaluated, which could turn expensive All variables which are used only in certain build configurations are now prefixed by underscore to avoid warnings	4 years ago
Victor Julien	20e8f90981	http2: set Debug on structs	4 years ago
Victor Julien	86e600dab8	unittests: optimize RunmodeIsUnittests()	4 years ago
Victor Julien	4ecde6efb0	stream: packet to stream flags macro	4 years ago
Victor Julien	beb6b1e0d1	packets: more detailed entry debug for detect/stream	4 years ago
Victor Julien	3587033d9e	files: construct with default, free on drop ... Update protocols.	4 years ago
Victor Julien	d757545f03	files: implement default support	4 years ago
Philippe Antoine	fdab22d924	rust: fix app-layer parser flags ... This especially allows for SSH bypass to work	4 years ago
Jeff Lucovsky	61fa748e9d	decode/vxlan: Delay var init until needed ... This commit modifies the var initialization slightly until after integrity checks have been performed.	4 years ago
Jeff Lucovsky	415db83d2d	general/typo: Correct typo	4 years ago
Jeff Lucovsky	83067e5a55	decode: Eliminate NULL pkt checks ... This commit removes the NULL pkt check that each decoder performs as this is a "can't happen" case.	4 years ago
Mats Klepsland	2a326421aa	thresholds: Fix buffer overflow in threshold context ... th_entry is resized using ThresholdHashRealloc() every time a rule with a threshold using by_rule tracking is added. The problem is that this is done before the rules are reordered, so occasionally a rule with by_rule tracking gets a higher signature number (after reordering) than the number of th_entries allocated, causing Suricata to crash. This commit fixes this by allocating th_entries after all the rules are loaded and reordered. Backtrace from core dump: Program terminated with signal SIGSEGV, Segmentation fault. #0 0x000000000051b381 in ThresholdHandlePacket (p=p@entry=0x7fb0080f3960, lookup_tsh=0x51, new_tsh=new_tsh@entry=0x7fb016c316e0, td=td@entry=0x14adedf0, sid=9800979, gid=1, pa=0x7fb0080f3b18) at detect-engine-threshold.c:415 415>---- if (TIMEVAL_DIFF_SEC(p->ts, lookup_tsh->tv1) < td->seconds) { Bug #4503.	4 years ago
Mats Klepsland	f47e4375b3	thresholds: syntax fixes ... Fix syntax of if statement in SigGetThresholdTypeIter()	4 years ago
Mats Klepsland	b0b4fab794	thresholds: remove unneeded function argument ... Remove packet pointer from SigGetThresholdTypeIter() as it is unused.	4 years ago
Juliana Fajardini	6b8b58f98a	doc/eve: common fields and alert updates ... - update examples for both - change app_proto from alert field to common field, as per JsonBuilder's changes.	4 years ago
Juliana Fajardini	eacf933edf	doc/eve: fix typos	4 years ago
Jeff Lucovsky	02fe026046	output: Fix possible null deref ... This commit corrects an issue uncovered by Coverity. See the redmine issue for details: https://redmine.openinfosecfoundation.org/issues/4495	4 years ago
Philippe Antoine	d00b755b64	http2: only mimic http1 request if there is one ... That may not be the case in midstream/async configurations	4 years ago
Jason Ish	70b21df756	makefile: don't include the whole test/ directory ... Including the whole directory results in .deps files ending up in the distribution archive which shouldn't be there. Instead we have to list all the test sources individually.	4 years ago
Jeff Lucovsky	aa8871a5be	rust/default: Enable Default usage	4 years ago
Jeff Lucovsky	6028ca7827	nfs: Rework constructs to use Self/Default	4 years ago
Jeff Lucovsky	aafb0a60b7	dhcp: Rework constructs to use Self/Default	4 years ago
Jeff Lucovsky	1ef0bd580b	dcerpc: Rework constructs to use Self/Default	4 years ago
Jeff Lucovsky	00167121dc	dns: Rework constructs to use Self/Default	4 years ago
Jeff Lucovsky	02dccb1529	smb: Rework constructs to use Self/Default ... This commit modifies the constructors to use Self and/or Default::default() when feasible	4 years ago
Jeff Lucovsky	f502f21f9e	rust/default: Enable Default usage in SMB	4 years ago
Philippe Antoine	95f225e8fb	doc: update sphinx api to use add_css_file ... instead of deprecated add_stylesheet	4 years ago
Shivani Bhardwaj	581cb6223d	dcerpc/udp: Add rust registration function ... Get rid of the C glue code and move registration completely to Rust.	4 years ago
Shivani Bhardwaj	d7007424bd	dcerpc/udp: Change fn sign as per rust registration requirement ... Registering parsers in Rust requires signatures to be a certain way and compatible with C. Change signatures of all the functions.	4 years ago
Shivani Bhardwaj	bac69af7e4	dcerpc: Add rust registration function ... Get rid of the C glue code and move registration completely to Rust.	4 years ago
Shivani Bhardwaj	a0a09a102b	dcerpc: Change fn sign as per rust registration requirement ... Registering parsers in Rust requires signatures to be a certain way and compatible with C. Change signatures of all the functions.	4 years ago
Shivani Bhardwaj	dee972b863	rust/core: Make AppProto type u16	4 years ago
Shivani Bhardwaj	d66ad96f0d	applayer/rust: add extern AppLayerProtoDetectPMRegisterPatternCSwPP	4 years ago
Victor Julien	533c6ff274	github: work around rustc mingw issue ... https://github.com/msys2/MINGW-packages/issues/8732#issuecomment-845079799	5 years ago
Jason Ish	65809be8ec	suricata-plugin.h: don't include autoconf.h ... It is not required here and just creates double inclusion in some scenarios.	5 years ago
Victor Julien	d7c3ecb6f9	http2: remove dead code	5 years ago
Philippe Antoine	b3c502d572	http2: remove assertion which can be wrong ... Brotli decoder stops consuming input it it reaches the end of its input	5 years ago
Simon Dugas	c2720fc2fb	modbus: fix quantity and count calculation ... The [Modbus Spec S6.11](https://modbus.org/docs/Modbus_Application_Protocol_V1_1b.pdf) clearly states that the `count = quantity / 8` and not the other way around. This is fixed in sawp-0.5.0.	5 years ago
Philippe Antoine	999327ba1f	http2: http.cookie keyword now works for HTTP2	5 years ago
Philippe Antoine	df039555bc	http2: http.host.raw keyword now works for HTTP2	5 years ago
Philippe Antoine	1e82d0b3c8	http2: http.method keyword now works for HTTP2	5 years ago
Philippe Antoine	017e39d8fd	http2: makes all HTTP1 header keywords work	5 years ago