Commit Graph

14174 Commits (977c5ea71901db3b0108f00d9c865af71fb803df)
 

Author SHA1 Message Date
Victor Julien 6f8ca41eb3 detect/cip: cleanup includes 3 years ago
Philippe Antoine 11e0eb9c89 quic: do not log empty cyu array
Ticket: #5167
3 years ago
Philippe Antoine 16fc78645d dnp3: do not log empty objects array
Ticket: #5167
3 years ago
Philippe Antoine 632581ac95 ike: do not log empty notify array
Ticket: #5167
3 years ago
Philippe Antoine 262a93ce18 mqtt: do not log reason_codes if there is none
Ticket: #5167
3 years ago
Philippe Antoine da0be16d36 output: do not log empty arrays for sid
Ticket: #5167
3 years ago
Jufajardini Reichow f9c9091bb5 userguide: fix typo in inline mode illustration
The image describing Suricata's sliding window had two of the "packets"
with the same text. Now they actually give the sense of a sliding
window.

This was found by Zhiyuan-liao.
3 years ago
dependabot[bot] 8090cba7c4 github-actions: bump actions/cache from 3.0.4 to 3.0.5
Bumps [actions/cache](https://github.com/actions/cache) from 3.0.4 to 3.0.5.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](c3f1317a9e...0865c47f36)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
3 years ago
Philippe Antoine adeb1fdfc3 threads: cleaner code with one instruction per line
As reported by Shchelk
3 years ago
Victor Julien 9fa0033966 detect: reduce datatype scope for various keywords 3 years ago
Victor Julien ad76502df0 detect/cip: remove dead code 3 years ago
Victor Julien 08e349a8bb detect: update copyright years 3 years ago
Victor Julien 0ec9379db9 includes: minor cleanups 3 years ago
Victor Julien 21f76773c7 profiling: minor code cleanups 3 years ago
Philippe Antoine e69e99f820 ci: checks include are necessary in github 3 years ago
Philippe Antoine 36b1344680 util: fix integer warnings in profiling 3 years ago
Philippe Antoine 4411ef785d src: remove unused header files 3 years ago
Philippe Antoine 02f2602dde src: rework includes as per cppclean 3 years ago
Jufajardini Reichow 93c2c9743d detect/engine: init alert queue counters on reload
alert_queue_overflow and alerts_suppressed were not being
reinitialized when there was a reload of Suricata rules, leading to
non-valid stats counters if that happened.

Bug #5457
3 years ago
Philippe Antoine f8bf581775 output: skip files logging for ICMP packets
Ticket: #5408
3 years ago
Philippe Antoine 5781631f85 output: use flow's proto for file loggers
As there can be an ICMP packet which gets related to a TCP flow.

Ticket: #5408
3 years ago
Philippe Antoine 7f9d25fa86 fuzz: use forced file store
to find bugs such as 5408
3 years ago
Philippe Antoine a2f857ed90 threshold: fix regex to accept by_both and by_rule
As is done in detect-threshold.c or in DETECT_RATE_REGEX
and is expected by switch (rule_type) which makes the same
for THRESHOLD_TYPE_THRESHOLD and THRESHOLD_TYPE_RATE

Ticket: #5327
3 years ago
Philippe Antoine 1621f5e453 detect/nfs: use inclusive ranges 3 years ago
Philippe Antoine 8dbb07e4fe detect: use generic integer functions for itype
Ticket: #4112
3 years ago
Philippe Antoine 2817f1a6ed detect: use generic integer functions for snmp.version
Ticket: #4112
3 years ago
Philippe Antoine c72571ea28 detect: use generic integer functions for rfb.sectype
Ticket: #4112
3 years ago
Philippe Antoine 6c9091c86f detect: use generic integer functions for nfs.version
Ticket: #4112
3 years ago
Philippe Antoine ddac6165c9 detect: use generic integer functions for nfs.procedure
Ticket: #4112
3 years ago
Philippe Antoine ed6955ee98 detect: use generic integer functions for iprep
Ticket: #4112
3 years ago
Philippe Antoine bdc359bed3 detect: use generic integer functions for bsize
Ticket: #4112
3 years ago
Philippe Antoine cfb60d0fce detect: use generic integer functions for urilen
Ticket: #4112
3 years ago
Philippe Antoine e87c53bb55 defrag: use util function for timeout
To fix timestamp overflow as found by oss-fuzz
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44608

fixu
3 years ago
jason taylor d600a1603c detect: update text for nocase used with http.host
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 34e0a384ad doc: update to include additional rule references
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 4405704372 doc: update intro direction content
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 3eeacf8a3d doc: fixed HOME_NET/EXTERNAL example formatting
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor f2c7998903 doc: add clarity around HOME_NET/EXTERNAL_NET
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 76cca8b08a doc: minor example rule description update
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 4f61a35fe7 doc: minor wording restructure
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 845ba154a6 doc: add tcp-pkt/tcp-stream to intro
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 56f49bfe8e doc: minor punctuation update
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor ab300ab0ae doc: intro example rule update to simpler example
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 2f240230f0 doc: minor intro wording update
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
Philippe Antoine c57052181c snmp: rustfmt detect.rs 3 years ago
Philippe Antoine c7214be99b snmp: adds usm keyword
as is logged

Ticker: #5416
3 years ago
Victor Julien 4adab8f271 github/codeowners: update 3 years ago
Philippe Antoine 5a31b3508d ftp: optimized tx iterator
To be more efficient with larger number of transactions.

Ticket: #5314
3 years ago
Victor Julien 6d3140bc01 mime: remove unused length fields 3 years ago
Victor Julien 816bbeb7dc fuzz/mime: fix call conditions and args
The SMTP parser should not supply lines w/o EOL chars to the mime
parser unless its in the BODY parsing stage. Mimic this in the fuzz
target by testing the state for inputs that have no EOL.

Additionally, make sure the delim cnt reflects the missing EOL.
3 years ago