19179 Commits (aea9fd73b7e28b83d86c7f049a4c0ccfdaf98711)

 

All Branches   

Search

Author	SHA1	Message	Date
Jason Ish	865b7243a0	http-log: remove support for http-log ... http-log was deprecated in Suricata 8, and marked for removal in Suricata 9.0. Ticket: #7232	2 months ago
Jason Ish	6368f6401b	qa: remove socket_to_gzip_file.py ... I'm not really what the purpose of this script is.	2 months ago
Giuseppe Longo	143774220e	doc: add llmnr ... Ticket #8366	2 months ago
Giuseppe Longo	0b20011a9f	llmnr: implement sticky buffers ... Add detection keywords for LLMNR protocol inspection: - llmnr.queries.rrname - llmnr.answers.rrname - llmnr.authorities.rrname - llmnr.additionals.rrname - llmnr.response.rrname LLMNR reuses the existing DNS functions since it follows the same protocol structure. The implementation registers LLMNR-specific keywords that leverage the DNS data extraction functions. Both to_server and to_client directions are supported. Ticket #8366	2 months ago
Giuseppe Longo	8f205bb34f	llmnr: implement logger ... This adds an LLMNR protocol logger that reuses existing DNS functions, following the same approach as the mDNS logger: - No grouped logging - Rdata is logged in a field that is named after the rdata type - Types are logged in lower case - Flags are logged as an array Ticket #8366	2 months ago
Giuseppe Longo	13df0f7a06	llmnr: implement parser ... This adds a parser for LLMNR protocol over both UDP and TCP. The parser reuses the existing DNS functions since LLMNR shares the same wire format as DNS, but implements its own protocol-specific validation: - LLMNR-specific flag checks (C, TC, T bits) - Opcode validation (only standard query opcode 0 is valid) - An Event is set if Z-flag is set, since it's must be zero per RFC4795 LLMNR transactions inherit DNS behavior where each packet creates a new state with one transaction. Ticket #8366	2 months ago
Victor Julien	9e82ff82e2	fuzz: use heap threadvars allocations ... Use new allocator to properly set up thread storage.	2 months ago
Victor Julien	cefee1390e	detect/threshold: don't double init per thread cache ... Can get called multiple times in the multi-tenancy case.	2 months ago
Victor Julien	f67dadc3d8	detect/threshold: fix unittests for storage based cache	2 months ago
Victor Julien	c27868a8c5	threshold: use seed consistently in hashing ... Use for IPv6 in the main hash. Update IPv4 thread cache to also use a seed. For this the thread initialization is done at thread init instead on the first packet. The thread ctx is no longer stored in a thread_local, but instead uses the thread storage API to store in the ThreadVars. This way it will stay active during rule reloads as well. Ticket: #8617.	2 months ago
Victor Julien	b742d58544	hash: allow registing with a seed value ... Seed value will have to be used by the caller's hash function.	2 months ago
Victor Julien	730ff5075d	threads: use threadvars memory helpers	2 months ago
Victor Julien	ad1459df72	threads: add threadvars allocator and free func ... Mostly meant to help unittests and fuzz targets alloc the storage correctly.	2 months ago
Victor Julien	b11aa94d42	decode/vlan: implement max layers for IEEE8021ah ... Ticket: #8615.	2 months ago
Victor Julien	377462ea63	defrag: decrement memuse on alloc failure ... Ticket: #8613.	2 months ago
Jason Ish	3dc8b154f3	rust/ffi: add safe thread storage wrapper ... Add a typed ThreadStorage<T> wrapper around the thread storage bindings. Ticket: #8445	2 months ago
Jason Ish	9f40968bba	rust/ffi: bindgen thread storage ... Ticket: #8445	2 months ago
Jason Ish	5e0abf1572	rust/ffi: use ThreadVars wrapper in flow callbacks ... Update the flow init, update and finish callback registrations to pass the safe ThreadVars wrapper instead of a raw pointer. Ticket: #8598	2 months ago
Jason Ish	1cac242948	rust/ffi: use ThreadVars wrapper in eve callback ... Update the EVE callback registration to pass the safe ThreadVars wrapper instead of a raw pointer. Ticket: #8598	2 months ago
Jason Ish	45762aa644	rust/ffi: use ThreadVars wrapper in thread init callback ... Update the thread init callback registration to pass the safe ThreadVars wrapper instead of a raw pointer. Ticket: #8598	2 months ago
Jason Ish	5fe88212c3	rust/ffi: add wrapper around ThreadVars ... A Rust wrapper around ThreadVars to enforce Rust lifetimes to ThreadVars when used in a callback. Ticket: #8598	2 months ago
Victor Julien	736f50600f	mpm/hs: fix compile warnings ... CC util-mpm-hs-cache.o util-mpm-hs-cache.c:301:59: error: implicit conversion loses integer precision: '__size_t' (aka 'unsigned long') to 'uint32_t' (aka 'unsigned int') [-Werror,-Wshorten-64-to-32] 301 | SCSha256Update(hasher, (const uint8_t *)ref_info, strlen(ref_info)); | ~~~~~~~~~~~~~~ ^~~~~~~~~~~~~~~~ util-mpm-hs-cache.c:310:46: error: implicit conversion loses integer precision: 'size_t' (aka 'unsigned long') to 'uint32_t' (aka 'unsigned int') [-Werror,-Wshorten-64-to-32] 310 | if (!SCSha256FinalizeToHex(hasher, hash, hash_len)) { | ~~~~~~~~~~~~~~~~~~~~~ ^~~~~~~~ 2 errors generated.	2 months ago
Victor Julien	781bd5184e	clang-format: support clang 17 ... Update Github CI runner to use it. Bump to Ubuntu 24.04 as well.	2 months ago
Victor Julien	e0b501a4b7	detect: cleanup last tx logic ... Move into DetectTransaction.	2 months ago
Victor Julien	3d00e73d91	detect: make progress values uint8_t ... Also reflect that it can be >= 48, like in prefilter.	2 months ago
Victor Julien	a9b3ad49ea	detect/firewall: minor code cleanup	2 months ago
Victor Julien	4db84cfa28	detect/firewall: clean up apply accept logic ... Use end state from tx. Handle flow control from inside the function consistently.	2 months ago
Victor Julien	68885e75e1	detect/firewall: refactor per tx rule result handling ... Break out the 3 options: match, partial match, no match for firewall into separate functions. Additionally, handle the re-match case for matches on a hook where the progress value didn't yet progress further. In this case the continue inspection logic revisits the rule and the accept needs to be re-applied.	2 months ago
Philippe Antoine	73193c7e6a	rust: format pgsql files ... Ticket: 3836	2 months ago
Philippe Antoine	3bfe6cf4b9	rust: format nfs files ... Ticket: 3836	2 months ago
Juliana Fajardini	a783007408	detect/bypass: ban bypass keyword for firewall mode ... Related to Ticket #8551	2 months ago
Juliana Fajardini	edaa912ed9	detect: ban `replace` keyword for firewall mode ... Ticket #8551	2 months ago
Juliana Fajardini	372cb8c692	rust/sys: update bindgen SIGMATCH_ constants ... Part of Ticket #8551	2 months ago
Juliana Fajardini	6e71ff3013	detect/parse: allow banning keywords with fw mode ... Related to Ticket #8551	2 months ago
Juliana Fajardini	04a7674512	detect/parse: allow banning keywords from fw rules ... Related to Ticket #8551	2 months ago
Philippe Antoine	e089ac9775	util/mpm-ac: preallocate on the heap rather than stack ... Ticket: 8001 As the the size of the allocation can get large	2 months ago
Philippe Antoine	dc5185e355	util/mpm-ac-ks: preallocate on the heap rather than stack ... Ticket: 8001 As the the size of the allocation can get large	2 months ago
Philippe Antoine	94a3e03903	util/mpm: add MpmCtx argument to MpmInitThreadCtx ... Ticket: 8001 Will allow algorithms such as ac to use the MpmCtx, especially the number of patterns, to preallocate some structures. For detect engine PatternMatchThreadPrepare, create a dummy MpmCtx out of all the MpmCtx in the DetectEngineCtx, and get the max value for the number of patterns	2 months ago
Philippe Antoine	25bf59f238	util/spm: explicit needle_len is u16 ... So, stack allocation is bounded Ticket: 8001	2 months ago
Victor Julien	9c76480ac3	detect/firewall: further simplify flow control ... For the last for progress case we can just break on a firewall drop. For the accept:flow and accept:tx cases the next sig (if any) will check the flow/tx flag and manage flow control from there.	2 months ago
Victor Julien	0a84015214	doc/userguide: add new constructs to firewall examples	2 months ago
Victor Julien	8728f9ffc0	doc/userguide: document firewall lte rule support	2 months ago
Victor Julien	ac59883c26	doc/userguide: fix default policies for pre_* hooks ... Minor other cleanups.	2 months ago
Victor Julien	da6af0879e	doc: update firewall design ... Bring in line with recent changes.	2 months ago
Victor Julien	bb6dc93789	detect/firewall: clean up per rule run check	2 months ago
Victor Julien	035e8bc851	detect/firewall: minor flow control cleanup	2 months ago
Victor Julien	bb7aff36a8	detect/firewall: simplify pre-check flow ... Simplify pre-check logic. Pre-check takes care of enforcing FLOW_ACTION_ACCEPT, APP_LAYER_TX_ACCEPT and default policy enforcement before the current rule's hook. This should be done in firewall mode for each rule regardless whether it is a firewall or TD rule. No need to track verdict state anymore.	2 months ago
Victor Julien	68f73302ce	detect/firewall: clean up tx inspection loop	2 months ago
Victor Julien	a86fe01cc3	detect/firewall: consolidate action handling ... Step towards consolidating all action handling into a central location.	2 months ago
Victor Julien	1ad9c3ec29	detect/firewall: clean up pre-check policy logic	2 months ago