aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
19,073 Commits
8 Branches
173 Tags
254 MiB
main
main-7.0.x
main-8.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '9e82ff82e2'
${ noResults }
Commit Graph

19073 Commits (9e82ff82e278644efd55cc7fa88e7ae895e04f90)
 

Author SHA1 Message Date
Victor Julien 9e82ff82e2 fuzz: use heap threadvars allocations 
Use new allocator to properly set up thread storage.
 2 months ago
Victor Julien cefee1390e detect/threshold: don't double init per thread cache 
Can get called multiple times in the multi-tenancy case.
 2 months ago
Victor Julien f67dadc3d8 detect/threshold: fix unittests for storage based cache 2 months ago
Victor Julien c27868a8c5 threshold: use seed consistently in hashing 
Use for IPv6 in the main hash.

Update IPv4 thread cache to also use a seed. For this the thread
initialization is done at thread init instead on the first packet. The
thread ctx is no longer stored in a thread_local, but instead uses the
thread storage API to store in the ThreadVars. This way it will stay
active during rule reloads as well.

Ticket: #8617.
 2 months ago
Victor Julien b742d58544 hash: allow registing with a seed value 
Seed value will have to be used by the caller's hash function.
 2 months ago
Victor Julien 730ff5075d threads: use threadvars memory helpers 2 months ago
Victor Julien ad1459df72 threads: add threadvars allocator and free func 
Mostly meant to help unittests and fuzz targets alloc the storage
correctly.
 2 months ago
Victor Julien b11aa94d42 decode/vlan: implement max layers for IEEE8021ah 
Ticket: #8615.
 2 months ago
Victor Julien 377462ea63 defrag: decrement memuse on alloc failure 
Ticket: #8613.
 2 months ago
Jason Ish 3dc8b154f3 rust/ffi: add safe thread storage wrapper 
Add a typed ThreadStorage<T> wrapper around the thread storage bindings.

Ticket: #8445
 2 months ago
Jason Ish 9f40968bba rust/ffi: bindgen thread storage 
Ticket: #8445
 2 months ago
Jason Ish 5e0abf1572 rust/ffi: use ThreadVars wrapper in flow callbacks 
Update the flow init, update and finish callback registrations to pass the
safe ThreadVars wrapper instead of a raw pointer.

Ticket: #8598
 2 months ago
Jason Ish 1cac242948 rust/ffi: use ThreadVars wrapper in eve callback 
Update the EVE callback registration to pass the safe ThreadVars wrapper
instead of a raw pointer.

Ticket: #8598
 2 months ago
Jason Ish 45762aa644 rust/ffi: use ThreadVars wrapper in thread init callback 
Update the thread init callback registration to pass the safe ThreadVars
wrapper instead of a raw pointer.

Ticket: #8598
 2 months ago
Jason Ish 5fe88212c3 rust/ffi: add wrapper around ThreadVars 
A Rust wrapper around ThreadVars to enforce Rust lifetimes to ThreadVars when
used in a callback.

Ticket: #8598
 2 months ago
Victor Julien 736f50600f mpm/hs: fix compile warnings 
CC       util-mpm-hs-cache.o
util-mpm-hs-cache.c:301:59: error: implicit conversion loses integer precision: '__size_t' (aka 'unsigned long') to 'uint32_t'
      (aka 'unsigned int') [-Werror,-Wshorten-64-to-32]
  301 |         SCSha256Update(hasher, (const uint8_t *)ref_info, strlen(ref_info));
      |         ~~~~~~~~~~~~~~                                    ^~~~~~~~~~~~~~~~
util-mpm-hs-cache.c:310:46: error: implicit conversion loses integer precision: 'size_t' (aka 'unsigned long') to 'uint32_t'
      (aka 'unsigned int') [-Werror,-Wshorten-64-to-32]
  310 |     if (!SCSha256FinalizeToHex(hasher, hash, hash_len)) {
      |          ~~~~~~~~~~~~~~~~~~~~~               ^~~~~~~~
2 errors generated.
 2 months ago
Victor Julien 781bd5184e clang-format: support clang 17 
Update Github CI runner to use it.

Bump to Ubuntu 24.04 as well.
 2 months ago
Victor Julien e0b501a4b7 detect: cleanup last tx logic 
Move into DetectTransaction.
 2 months ago
Victor Julien 3d00e73d91 detect: make progress values uint8_t 
Also reflect that it can be >= 48, like in prefilter.
 2 months ago
Victor Julien a9b3ad49ea detect/firewall: minor code cleanup 2 months ago
Victor Julien 4db84cfa28 detect/firewall: clean up apply accept logic 
Use end state from tx.

Handle flow control from inside the function consistently.
 2 months ago
Victor Julien 68885e75e1 detect/firewall: refactor per tx rule result handling 
Break out the 3 options: match, partial match, no match for firewall
into separate functions.

Additionally, handle the re-match case for matches on a hook where the
progress value didn't yet progress further. In this case the continue
inspection logic revisits the rule and the accept needs to be
re-applied.
 2 months ago
Philippe Antoine 73193c7e6a rust: format pgsql files 
Ticket: 3836
 2 months ago
Philippe Antoine 3bfe6cf4b9 rust: format nfs files 
Ticket: 3836
 2 months ago
Juliana Fajardini a783007408 detect/bypass: ban bypass keyword for firewall mode 
Related to
Ticket #8551
 2 months ago
Juliana Fajardini edaa912ed9 detect: ban `replace` keyword for firewall mode 
Ticket #8551
 2 months ago
Juliana Fajardini 372cb8c692 rust/sys: update bindgen SIGMATCH_ constants 
Part of
Ticket #8551
 2 months ago
Juliana Fajardini 6e71ff3013 detect/parse: allow banning keywords with fw mode 
Related to
Ticket #8551
 2 months ago
Juliana Fajardini 04a7674512 detect/parse: allow banning keywords from fw rules 
Related to
Ticket #8551
 2 months ago
Philippe Antoine e089ac9775 util/mpm-ac: preallocate on the heap rather than stack 
Ticket: 8001

As the the size of the allocation can get large
 2 months ago
Philippe Antoine dc5185e355 util/mpm-ac-ks: preallocate on the heap rather than stack 
Ticket: 8001

As the the size of the allocation can get large
 2 months ago
Philippe Antoine 94a3e03903 util/mpm: add MpmCtx argument to MpmInitThreadCtx 
Ticket: 8001

Will allow algorithms such as ac to use the MpmCtx, especially
the number of patterns, to preallocate some structures.

For detect engine PatternMatchThreadPrepare, create a dummy
MpmCtx out of all the MpmCtx in the DetectEngineCtx,
and get the max value for the number of patterns
 2 months ago
Philippe Antoine 25bf59f238 util/spm: explicit needle_len is u16 
So, stack allocation is bounded

Ticket: 8001
 2 months ago
Victor Julien 9c76480ac3 detect/firewall: further simplify flow control 
For the last for progress case we can just break on a firewall drop.

For the accept:flow and accept:tx cases the next sig (if any) will check
the flow/tx flag and manage flow control from there.
 2 months ago
Victor Julien 0a84015214 doc/userguide: add new constructs to firewall examples 2 months ago
Victor Julien 8728f9ffc0 doc/userguide: document firewall lte rule support 2 months ago
Victor Julien ac59883c26 doc/userguide: fix default policies for pre_* hooks 
Minor other cleanups.
 2 months ago
Victor Julien da6af0879e doc: update firewall design 
Bring in line with recent changes.
 2 months ago
Victor Julien bb6dc93789 detect/firewall: clean up per rule run check 2 months ago
Victor Julien 035e8bc851 detect/firewall: minor flow control cleanup 2 months ago
Victor Julien bb7aff36a8 detect/firewall: simplify pre-check flow 
Simplify pre-check logic. Pre-check takes care of enforcing
FLOW_ACTION_ACCEPT, APP_LAYER_TX_ACCEPT and default policy enforcement
before the current rule's hook. This should be done in firewall mode for
each rule regardless whether it is a firewall or TD rule.

No need to track verdict state anymore.
 2 months ago
Victor Julien 68f73302ce detect/firewall: clean up tx inspection loop 2 months ago
Victor Julien a86fe01cc3 detect/firewall: consolidate action handling 
Step towards consolidating all action handling into a central location.
 2 months ago
Victor Julien 1ad9c3ec29 detect/firewall: clean up pre-check policy logic 2 months ago
Victor Julien 52967c69ec detect/firewall: fix accept:tx,alert in default policy 2 months ago
Victor Julien 247c6a2333 detect/firewall: inject alert before default policy 
If default policy is invoked because of missing rules for next hooks,
make sure to inject an alert before the next hook policies might do so.
 2 months ago
Victor Julien 90a837cef3 detect/firewall: update discarded logic 
Only count alert queue overflow here, not alerts in the queue after a drop.
 2 months ago
Victor Julien 57b16c964e detect/firewall: drop in fw mode does not include alert 
In TD mode the drop action also includes alert.

In firewall mode it should not to stay in line with accept.

Ticket: #8601.
 2 months ago
Victor Julien f1090da254 detect/firewall: log alert for app default with alert 
Fix missing alert on drop:flow,alert
 2 months ago
Victor Julien 485f5243d5 detect/firewall: improve handle fw alert handling 
More clearly define the relationship between PacketAlerts for firewall
and threat detection events.

Also no longer count firewall_discarded if drop rule came before a
another rule, causing the later rule to not be evaluated/alerted.

When packet:filter and app:filter alert appear in a single alert queue,
handle accept:hook by keeping track of the detect_table.
 2 months ago