16897 Commits (9f96975d556bbff999482d83c331b96566461cd1)

 

All Branches   

Search

Author	SHA1	Message	Date
Jason Ish	9f96975d55	af-packet: warn if v3 block size is not large enough for defrag ... If using tpacket-v3 and defrag, warn if the block size is not large enough for a fully defragmented packet. Ticket: #7458	1 year ago
Jason Ish	320ef7b617	af-packet: warn if v2 block size not large enough for defrag ... If using tpacket-v2, defrag and a user provided v2-block-size, warn if the block size is not large enough to hold one fully defragmented packet. Ticket: #7458	1 year ago
Jason Ish	5871c6458c	af-packet: make tpacket-v2 block size configurable ... With the change of the default tpacket-v2 block size from 32k to 128k, allow it to be configurable for users who may want to make it larger, or revert it back to the pre 7.0.9 default of 32k. Ticket: #7458	1 year ago
Jason Ish	c342b054f4	af-packet: increase default block size ... Increase the default block size from 32k to 128k. This allows for a fully defragmented packet to fit in the buffer. Ticket: #7458	1 year ago
Jason Ish	808502d5ca	af-packet: warn if defrag not suitable for mode ... AF_PACKET defrag should not be used for inline modes. Its possible that a packet received could be larger than can be set when defrag is enabled, so warn if disabled for inline use. Likewise, warn if defrag is disabled for IDS use, or non-inline mode. Ticket: #7458	1 year ago
Jason Ish	25d0fba912	af-packet: check defrag value even if cluster-type not set ... If cluster-type was not set we default to "cluster_flow" with defrag always on. Instead check for defrag value and disable defrag if disabled by the user. Ticket: #7458	1 year ago
Philippe Antoine	32d0bd2bbb	detect: limit base64_decode `bytes` to 64KiB ... Ticket: 7613 Avoids potential large per-thread memory allocation. A buffer with the size of the largest decode_base64 buffer size setting would be allocated per thread. As this was a u32, it could mean a per-thread 4GiB memory allocation. 64KiB was already the built-in default for cases where bytes size wasn't specified.	1 year ago
Philippe Antoine	b9b797f1f4	detect: non infinite default value for inspection-recursion-limit ... So that empty config are protected by this setting as was intended. Set to unlimited for fuzz testing.	1 year ago
Philippe Antoine	b14c67cbdf	detect/pcre: avoid infinite loop after negated pcre ... Ticket: 7526 The usage of negated pcre, followed by other relative payload content keywords could lead to an infinite loop. This is because regular (not negated) pcre can test multiple occurences, but negated pcre should be tried only once.	1 year ago
Jason Ish	66e47a1983	rust: pin once_cell to work with Rust 1.67.1 ... Clap uses once_cell which recently released v1.20 which updated its MSRV to 1.70. Locally pin once_cell to 1.20.3 to maintain our MSRV.	1 year ago
Victor Julien	559e4ce062	pcap: skip pcap-config if pkgconfig in use	1 year ago
Victor Julien	2aceb9b76f	detect/action: minor action parsing cleanup ... Preparation for explicit action scope parsing.	1 year ago
Victor Julien	fa9dbe3970	detect/loader: minor code cleanup	1 year ago
Victor Julien	ce26159a03	detect: constify rule file and lines in parsing and analyzer	1 year ago
Victor Julien	c65756a38c	tls: fix handshake handling being too strict ... e.g. server hello done has no data	1 year ago
Victor Julien	f5e4c52f44	app-layer: constify AppLayerGetProtoByName	1 year ago
Victor Julien	b5cd1e578b	detect/tls: don't double register tls_validity generic list	1 year ago
Victor Julien	c1155e473d	detect/nfs: don't double register nfs_request generic list	1 year ago
Victor Julien	7cafdfac11	detect: don't register duplicate app inspect engines	1 year ago
Victor Julien	b649252059	detect/analyzer: add policy ... Example output: "match_policy": { "actions": [ "alert", "drop" ], "scope": "flow" },	1 year ago
Victor Julien	609a59a529	smtp/events: set direction on rules ... Several rules matched on both directions even if events are set in a single direction.	1 year ago
Jason Ish	3658d502ff	github-ci: don't run builds on PR if only docs changed	1 year ago
Jason Ish	ed30e95a09	github-ci: stop caching system packages	1 year ago
Victor Julien	fbfeea752a	lua: remove script_api_ver ... Not documented and never set to new values despite updates. Ticket: #7492.	1 year ago
Victor Julien	0f13908b72	contrib: remove suri-graphite ... Built for py2. Remove now empty contrib dir. Ticket: #6888.	1 year ago
Victor Julien	1c386e64ce	contrib: remove file_processor ... Has been developed for a now obsolete file log format. Ticket: #6888.	1 year ago
Victor Julien	99f151c907	detect/dcerpc.iface: remove commented out unittest	1 year ago
Victor Julien	b8ed01e23e	eve/schema: map tls fields to keywords	1 year ago
Shivani Bhardwaj	fc1dbf6eb4	schema: add rule keyword mapping for dcerpc	1 year ago
Juliana Fajardini	d8523d9d97	userguide/header-keywords: fix typos, adjust format	1 year ago
Juliana Fajardini	28407b2fb8	doc/rule-types: remove trailing underscore ... And other minor fixes that were overseen.	1 year ago
Juliana Fajardini	4a8da8c448	userguide/suricatactl: use suricata community page ... We were mentioning "Suricata Support" page, which could be a bit misleading -- and also used a link that is actually redirected to the Suricata Community page, anyways.	1 year ago
Jason Ish	5718d5c0fa	github-ci: pin rust version for clippy tests ... Prevents CI breakage after a new Rust release until we're ready to make the changes.	1 year ago
Jason Ish	cbc296f313	github-ci: update rpm builder to fedora 41	1 year ago
Jason Ish	65b863b087	github-ci: update Fedora non-root build to Fedora 41	1 year ago
Jason Ish	70d5bae160	github-ci: remove fedora 40 builds where 41 exists ... Remove Fedora 40 builds where there is a Fedora 41 equivalent.	1 year ago
Jason Ish	facd525692	eve-parity: merge $ref props into current object ... Allows for a "suricata" entry along with a "$ref".	1 year ago
Jason Ish	744f301df4	eve-parity: handle arrays of scalars ... And add an example with "client_alpns".	1 year ago
Bryan Benson	15da9d783e	rust: Update sawp dependencies to 0.13.1 due to SPDX license compatibility.	1 year ago
Jeff Lucovsky	e9717f3ad2	detect/lua: Fix max value displayed in error msg ... This commit corrects an error message displayed when the key length is out of range.	1 year ago
Jeff Lucovsky	3d26f917ee	var: Use 16-bit container for type ... Issue: 6855: Match sigmatch type field in var and bit structs Align the size and datatype of type, idx, and next members across: - FlowVarThreshold - FlowBit - FlowVar - GenericVar - XBit - DetectVarList Note that the FlowVar structure has been intentionally constrained to match the structure size prior to this commit. To achieve this, the keylen member was restricted to 8 bits after it was confirmed its value is checked against a max of 0xff.	1 year ago
Philippe Antoine	d8ddef4c14	detect: delay tx cleanup in some edge case ... Ticket: 7552 f->sgh_toserver may be NULL but because FLOW_SGH_TOSERVER is unset and thus, we want to delay cleanup until detection has really been run with the right signature group head. This may happen for a rule using `alert tcp any any -> any any` and a app-layer keyword to client with a app-layer supporting both udp and tcp with stream.midstream=true and with the first packet of a flow being a server response In this case, we swap the flow and reset its signature group heads	1 year ago
Philippe Antoine	d74bc774b7	detect: reset signature groups when reversing flow ... Ticket: 7552 When we use midstream, and the first packet we see of a flow is a response from server, and we want to match on some signature to client : - we had first set sgh_toserver/FLOW_SGH_TOSERVER as we first thought this was a packet to server - we then swap/reverse the flow, so sgh_toclient becomes sgh_toserver but it contains signatures to server and cannot match our to_client signature The detect engine with DetectRunSetup will set again the signatures group heads properly	1 year ago
Jason Ish	6477b31199	eve-parity: skip transform keywords	1 year ago
Jason Ish	771d9d9d8b	schema: mark dns.version and dns.grouped as having no keywords	1 year ago
Jason Ish	00a571a25c	schema: mark "stats" and "drop" as having no keywords	1 year ago
Jason Ish	33c29be139	detect-dns-response: remove unit tests ... Should have coverage by S-V now.	1 year ago
Jason Ish	861896ed39	script/eve-parity: add script for checking eve/keyword parity ... Currently this script has two commands: "missing" and "having". "missing" will show eve fields that do not map to any keywords. "having" will sohw eve fields along with their keyword mappsings, while also validating that those keywords really exist. Related to tickets: #6463, #4772	1 year ago
Jason Ish	115d7d3c6d	schema: add an object for mapping fields to keywords ... To some EVE fields and a "suricata" object that contains an array of keywords. These are the keywords that map directly to this field, or somehow cover this field. This is an attempt at tooling to help with EVE and keyword parity. Related to tickets: #5642, #6463, #4772	1 year ago
Jason Ish	814e9ffb7a	dns: add keywords for additionals and authorities rrnames ... Add keywords dns.additionals.rrname and dns.authorities.rrname. Along the way, consolidate dns.query.name and dns.answer.name into a single file and register them altogether since there is a lot of common code.	1 year ago