Victor Julien
6f8ca41eb3
detect/cip: cleanup includes
3 years ago
Philippe Antoine
11e0eb9c89
quic: do not log empty cyu array
...
Ticket: #5167
3 years ago
Philippe Antoine
16fc78645d
dnp3: do not log empty objects array
...
Ticket: #5167
3 years ago
Philippe Antoine
632581ac95
ike: do not log empty notify array
...
Ticket: #5167
3 years ago
Philippe Antoine
262a93ce18
mqtt: do not log reason_codes if there is none
...
Ticket: #5167
3 years ago
Philippe Antoine
da0be16d36
output: do not log empty arrays for sid
...
Ticket: #5167
3 years ago
Jufajardini Reichow
f9c9091bb5
userguide: fix typo in inline mode illustration
...
The image describing Suricata's sliding window had two of the "packets"
with the same text. Now they actually give the sense of a sliding
window.
This was found by Zhiyuan-liao.
3 years ago
dependabot[bot]
8090cba7c4
github-actions: bump actions/cache from 3.0.4 to 3.0.5
...
Bumps [actions/cache](https://github.com/actions/cache ) from 3.0.4 to 3.0.5.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](c3f1317a9e...0865c47f36
)
---
updated-dependencies:
- dependency-name: actions/cache
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
3 years ago
Philippe Antoine
adeb1fdfc3
threads: cleaner code with one instruction per line
...
As reported by Shchelk
3 years ago
Victor Julien
9fa0033966
detect: reduce datatype scope for various keywords
3 years ago
Victor Julien
ad76502df0
detect/cip: remove dead code
3 years ago
Victor Julien
08e349a8bb
detect: update copyright years
3 years ago
Victor Julien
0ec9379db9
includes: minor cleanups
3 years ago
Victor Julien
21f76773c7
profiling: minor code cleanups
3 years ago
Philippe Antoine
e69e99f820
ci: checks include are necessary in github
3 years ago
Philippe Antoine
36b1344680
util: fix integer warnings in profiling
3 years ago
Philippe Antoine
4411ef785d
src: remove unused header files
3 years ago
Philippe Antoine
02f2602dde
src: rework includes as per cppclean
3 years ago
Jufajardini Reichow
93c2c9743d
detect/engine: init alert queue counters on reload
...
alert_queue_overflow and alerts_suppressed were not being
reinitialized when there was a reload of Suricata rules, leading to
non-valid stats counters if that happened.
Bug #5457
3 years ago
Philippe Antoine
f8bf581775
output: skip files logging for ICMP packets
...
Ticket: #5408
3 years ago
Philippe Antoine
5781631f85
output: use flow's proto for file loggers
...
As there can be an ICMP packet which gets related to a TCP flow.
Ticket: #5408
3 years ago
Philippe Antoine
7f9d25fa86
fuzz: use forced file store
...
to find bugs such as 5408
3 years ago
Philippe Antoine
a2f857ed90
threshold: fix regex to accept by_both and by_rule
...
As is done in detect-threshold.c or in DETECT_RATE_REGEX
and is expected by switch (rule_type) which makes the same
for THRESHOLD_TYPE_THRESHOLD and THRESHOLD_TYPE_RATE
Ticket: #5327
3 years ago
Philippe Antoine
1621f5e453
detect/nfs: use inclusive ranges
3 years ago
Philippe Antoine
8dbb07e4fe
detect: use generic integer functions for itype
...
Ticket: #4112
3 years ago
Philippe Antoine
2817f1a6ed
detect: use generic integer functions for snmp.version
...
Ticket: #4112
3 years ago
Philippe Antoine
c72571ea28
detect: use generic integer functions for rfb.sectype
...
Ticket: #4112
3 years ago
Philippe Antoine
6c9091c86f
detect: use generic integer functions for nfs.version
...
Ticket: #4112
3 years ago
Philippe Antoine
ddac6165c9
detect: use generic integer functions for nfs.procedure
...
Ticket: #4112
3 years ago
Philippe Antoine
ed6955ee98
detect: use generic integer functions for iprep
...
Ticket: #4112
3 years ago
Philippe Antoine
bdc359bed3
detect: use generic integer functions for bsize
...
Ticket: #4112
3 years ago
Philippe Antoine
cfb60d0fce
detect: use generic integer functions for urilen
...
Ticket: #4112
3 years ago
Philippe Antoine
e87c53bb55
defrag: use util function for timeout
...
To fix timestamp overflow as found by oss-fuzz
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44608
fixu
3 years ago
jason taylor
d600a1603c
detect: update text for nocase used with http.host
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor
34e0a384ad
doc: update to include additional rule references
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor
4405704372
doc: update intro direction content
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor
3eeacf8a3d
doc: fixed HOME_NET/EXTERNAL example formatting
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor
f2c7998903
doc: add clarity around HOME_NET/EXTERNAL_NET
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor
76cca8b08a
doc: minor example rule description update
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor
4f61a35fe7
doc: minor wording restructure
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor
845ba154a6
doc: add tcp-pkt/tcp-stream to intro
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor
56f49bfe8e
doc: minor punctuation update
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor
ab300ab0ae
doc: intro example rule update to simpler example
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor
2f240230f0
doc: minor intro wording update
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
Philippe Antoine
c57052181c
snmp: rustfmt detect.rs
3 years ago
Philippe Antoine
c7214be99b
snmp: adds usm keyword
...
as is logged
Ticker: #5416
3 years ago
Victor Julien
4adab8f271
github/codeowners: update
3 years ago
Philippe Antoine
5a31b3508d
ftp: optimized tx iterator
...
To be more efficient with larger number of transactions.
Ticket: #5314
3 years ago
Victor Julien
6d3140bc01
mime: remove unused length fields
3 years ago
Victor Julien
816bbeb7dc
fuzz/mime: fix call conditions and args
...
The SMTP parser should not supply lines w/o EOL chars to the mime
parser unless its in the BODY parsing stage. Mimic this in the fuzz
target by testing the state for inputs that have no EOL.
Additionally, make sure the delim cnt reflects the missing EOL.
3 years ago