18811 Commits (898446aee88bcba4dcf2aa1cba2da7ce2cae7018)

 

All Branches   

Search

Author	SHA1	Message	Date
Philippe Antoine	898446aee8	detect/doh2: prefilter does not use dns engine progress ... to update HTTP2 tx progress Ticket: 8454	3 months ago
Philippe Antoine	5f9e436c3f	detect/dcerpc: support generic integer for opnum keyword ... Ticket: 8179	3 months ago
Philippe Antoine	67379b009a	detect/dcerpc: move opnum keyword to rust ... Ticket: 8391	3 months ago
Philippe Antoine	a36af353bc	rust: bindgen SCFlowGetAppProtocol	3 months ago
Jason Ish	fd31e50954	ntp: enable keywords for firewall mode ... Ticket: #8394	3 months ago
Jason Ish	713e4eb900	ntp: convert reference_id to buffer and add keyword ... Store the NTP reference ID as raw network-order bytes so it can be exposed as a sticky buffer and matched with payload keywords. The reference ID is often a 4 character string, or an IP address and not just an integer identifier. Updates the log reference ID to be a string of colon separated hex digits as this matches what tshark does. Ticket: #8488	3 months ago
Jason Ish	991e7f3b1d	ntp: add ntp.mode keyword ... This keyword also accepts strings for known mode names. Ticket: #8429	3 months ago
Jason Ish	c10c482290	ntp: add ntp.stratum keyword ... Ticket: #8431	3 months ago
Jason Ish	ec344fe68d	ntp: add ntp.version keyword ... SNMP was used as a template. Ticket: #8430	3 months ago
Jason Ish	74bb525401	ntp: create tx for all modes; log version, mode and stratum ... Add logging for version, mode and stratum as these will be the first keywords we will add. Ticket: #8425	3 months ago
Jason Ish	879846e153	ntp: remove unused event types ... NotRequest and NotResponse event type have never been used. Unsolicited is also unused, however there is a rule for it so removing support would be a breaking change at this time.	3 months ago
Jason Ish	31b967b089	ntp: add transaction logging ... Adds basic NTP transaction logging for the current supported message types. Includes small cleanups around reference ID. Ticket: #8425	3 months ago
Lukas Sismis	214e47bea1	dpdk: move to native queue-sized mempools ... As a legacy from Suricata 7, mempool size was kept even internally as a global size. Since in Suricata 8, mempool allocation moved to per queue model, it makes sense to calculate the correct size right when loading the configuration. The previous implementation misscalculated in some scenarios the size of the mempool which prevented Suricata starting successfully. This happened, e.g. when there were 32k RX descriptors and 64 TX descs. The resulting mempool was incorrectly deduced as 32767 (2^n-1), which didn't even hold all RX descriptors. Instead, it should result to 65535. Ticket: 8370	3 months ago
Victor Julien	c7cd3b17c3	snmp: minor snmp.pdu_type type cleanup	3 months ago
Victor Julien	9c450d18e7	eve/drop: minor code cleanup	3 months ago
Victor Julien	f9b25dc6ec	eve/drop: always enable verdict in firewall mode	3 months ago
Victor Julien	ff6fb068c7	detect/firewall: fix 'last_for_progress' logic ... If the last signature in the candidates list is also the last for the current progress value, it needs to be considered as the last for that progress, so that if it doesn't match the default policy is applied.	3 months ago
Victor Julien	2cef1404bc	detect/snmp: let generic keyword share the same list	3 months ago
Victor Julien	670fdabd32	detect/snmp: add snmp.trap_type keyword ... Implemented as a U8 integer keyword. Ticket: #8482.	3 months ago
Victor Julien	c94cb8e098	eve/schema: add snmp trap fields	3 months ago
Philippe Antoine	8ac9a62ec4	detect: enable snmp keywords for firewall mode ... Ticket: #8395	3 months ago
Philippe Antoine	63603fe14a	detect/snmp: sticky buffers at progress 1 ... Since snmp txs are created at progress 1 which is the completion, this does not change detection, except allowing firewall mode to use these keywords with generic hook like snmp:request_complete Ticket: 8395	3 months ago
Philippe Antoine	8f824458c2	detect: helper for buffer register requires progress ... Ticket: 8395 For protocols where tx are complete at start, that is the `tx_get_progress` function returns 1 inconditionnally, we can use the progress 1, not losing time on detection in ips mode, and getting ready for firewall mode For the other protocols (where a tx needs both a request and response for instance), keep progress 0 as was the case before	3 months ago
Jason Ish	f5bf76c0ee	examples/plugins/rust: add a rust example plugin ... Only demonstrates EVE callbacks for now, but I plan to turn this into a show case of a variety of callbacks a Rust plugin can do as we add Rust bindings to the ffi crate.	3 months ago
Jason Ish	6512be19aa	output-eve: rust.h include is no longer needed ... output-eve.h pulls it in.	3 months ago
Jason Ish	eb46d0129e	rust/ffi: add eve callback handler ... Wrap the EVE callback handler with a Rust friendly variant that allows the user to register a callback as a closure which is provided an already wrapped JsonBuilder object. Ticket: #8477	3 months ago
Jason Ish	199e844a07	rust/ffi: add mark support to ffi::jsonbuilder ... To support Rust friendly EVE callback registration (ticket 8477).	3 months ago
Adam Kiripolsky	0a8e3132c2	bypass: fix BypassManager BypassedCheckFunc check ... Switch check whether BypassedCheckFuncInit was registered to check whether BypassedCheckFunc was registered. Ticket: 8473	3 months ago
Philippe Antoine	bcbec8d615	doc: fix eol content in http rules	3 months ago
Philippe Antoine	e65643909a	doc: move more examples to container:: example-rule ... Ticket: 8372 And fix another bad rule	3 months ago
Philippe Antoine	72e13c9774	doc: do not highlight bad transactional rule ... As stated, it will refuse to load. Ticket: 8372	3 months ago
Philippe Antoine	15f45be672	doc: fix rules ... Ticket: 8372 Somes rules in the doc had typos, fix them so suricata can load them when you copy/paste the doc	3 months ago
Philippe Antoine	42a85c37f1	scripts: add script to check rules in doc ... Ticket: 8372 and run it in github CI	3 months ago
Jason Ish	be36e67f52	rust: suppress cargo audit for RUSTSEC-2026-0097 ... Per https://rustsec.org/advisories/RUSTSEC-2026-0097, this issue it not applicable unless the "log" and "thread_rng" features of rand are enabled. "log" is not enabled in our dependency chain. Updating to the fixed version of rand requires an MSRV of 1.85. Ticket: #8467	3 months ago
Philippe Antoine	58a71d94b0	rust/ffi: move conf_get helper to ffi crate ... Ticket: 7666	3 months ago
Jason Ish	6a67811a0c	conf: make dirname pointer const ... Fixes warning: conf-yaml-loader.c: In function ‘ConfYamlSetConfDirname’: conf-yaml-loader.c:87:8: warning: assignment discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers] 87 | ep = strrchr(filename, '\\'); | ^	3 months ago
Jason Ish	73bee2f4fd	conf: avoid use-after-free when processing include sequences ... Ticket: #8465	3 months ago
Jason Ish	a11aaadd86	plugins: add --plugin command line option to load plugins ... Add --plugin <PATH> to load an additional plugin from the command line. This is more convenient than "--set plugins.X" especially when you may already have a plugins loaded and you want to load an additional one. Ticket: 8463	3 months ago
Philippe Antoine	512bbe4de8	detect/template: merge template and template2 ... Ticket: 7278 Do a single packet match template merging best of both current templates	3 months ago
Philippe Antoine	8d254f5630	dhcp/output: log app-layer metadata in alerts ... Ticket: 6091 log as extended	3 months ago
Philippe Antoine	db980daf5f	dhcp: standardize output code ... To prepare to add metadata in alerts Ticket: 6091	3 months ago
Philippe Antoine	d14af54b3b	detect/transforms: constify some callbacks arguments ... Ticket: 8298	3 months ago
Philippe Antoine	cae749bc58	detect: remove unneeded null check ... CID 1645613 Ticket: 7664 We assign and dereference next_s like next_s = *match_array++; next_sflags = next_s->flags; So, there is no need to check if next_s is NULL, as it can never be (otherwise, we could crash before)	3 months ago
Philippe Antoine	0a24f0afe2	smb: parse smb1 session setup with word count 13 ... Ticket: 5845	3 months ago
Jason Ish	98469b0f56	rust/ffi: fix clippy warnings ... Remove the unneeded return. The other option would be to allow it, but so far in the ffi crate we don't have any non-default allows.	3 months ago
Jason Ish	ecffd6cd54	github-ci: deny warnings in clippy check ... We currently have some clippy warnings in the ffi crate. They output to to the terminal but clippy exits with a success code. Typically we want to fix this, so deny warnings which will cause clippy to exit with an error code, failing ci.	3 months ago
Jason Ish	70994426d3	github-ci: add --workspace to cargo clippy --fix ... --fix doesn't appear to apply to all sub-crates unless --workspace is provided.	3 months ago
Jason Ish	336b50ae9e	storage: prefix core API with SC	3 months ago
Jason Ish	3722477319	device/storage: prefix API with SC	3 months ago
Jason Ish	41fd80aa46	ippair/storage: prefix API with SC	3 months ago