10773 Commits (b0298dd0468f150229f9021ebe9c438bc2b7cecf)

Author	SHA1	Message	Date
Philippe Antoine	b0298dd046	events: reset logged event ... Otherwise, if we log a first app_layer_event, then reset with AppLayerDecoderEventsResetEvents for a new packet, then get another event, it does not get logged Ticket: #5391	3 years ago
Philippe Antoine	eb1c2a6083	smb: use default stream-depth 0 by default ... As broken by commit e5c948df87 Ticket: #5390	3 years ago
Philippe Antoine	7acdece7d0	util: fix integer warnings in mime decoding ... Ticket: #4516	3 years ago
Philippe Antoine	9d6e5558f1	defrag: do not cast pkt len to u16 ... as it can overflow	3 years ago
Philippe Antoine	b8524e70d9	detect: change InspectEngineFuncPtr2 to return uint8_t	3 years ago
Philippe Antoine	c5cf2967b3	detect: fix integer warnings ... Ticket: #4516	3 years ago
Philippe Antoine	ac8fb553a1	detect: fix integer warnings for content ... Ticket: #4516	3 years ago
Philippe Antoine	57fb183d32	detect: fix integer warnings for app-layer-event ... Ticket: #4516	3 years ago
Philippe Antoine	79d7edb3e0	ftp: fix integer warning ... Ticket: #4516	3 years ago
Victor Julien	df2e408d96	detect/threshold: fix offline time handling issue ... Due to the TIMEVAL_DIFF_SEC calculating the delta into an unsigned integer, it would underflow to a high positive value leading to and incorrect result if the packet timestamp was below the timestamp for the threshold entry. In normal conditions this shouldn't happen, but in offline mode each thread has its own concept of time which might differ significantly based on the pcap. In this case the overflow would be very common. Changing it to a signed value calculation triggered fuzz undefined behavior if the packet timeval was very high, so this patch takes a new approach where it no longer calculates a diff but sets up the "seconds" value we compare against as a timeval itself, and uses that to compare. Fixes: 9fafc1031c ("time: Add TIMEVAL_EARLIER and TIMEVAL_DIFF_SEC macros.") Fixes: 82dc61f4c3 ("detect/threshold: Refactor threshold calculation to handle by_rule and by_both.") Uses add `timeradd` specific version where available. Bug: #5386.	3 years ago
Victor Julien	fea374626a	stream/midstream: fix double flow reverse case ... In the case of midstream SYN/ACK pickup, we reverse the flow based on the SYN/ACK. If we then later get traffic that appears to be in the reverse direction based on the app-layer, we would reverse it again. This isn't correct. When we have the SYN/ACK we know the flow's real direction.	3 years ago
Lukas Sismis	8845c07a90	bypass: af-packet: fix memory leak - reassign of EBPFBypassData ... AF-Packet bypass function in some situations allocates EBPF bypass data for an already bypassed flow and assigns it to the flow without any checks Issue: #5368	3 years ago
Lukas Sismis	05797c45bb	bypass: fix memory leak - reassign of FlowBypassInfo ... In some situations bypass callback is called on already bypassed flow. This allocates FlowBypassInfo structure for the flow but does not check if the flow already has one. Issue: #5368	3 years ago
Victor Julien	2486d29adb	napatech: fix conf API call	3 years ago
Victor Julien	8580499ded	exceptions: initial exception-policy implementation ... Adds a framework for setting exception policies. These would be called when the engine reaches some kind of exception condition, like hitting a memcap or some traffic processing error. The policy gives control over what should happen next: drop the packet, drop the packet and flow, bypass, etc. Implements the policy for: stream: If stream session or reassembly memcaps are hit call the memcap policy on the packet and flow. flow: Apply policy when memcap is reached and no flow could be freed up. defrag: Apply policy when no tracker could be picked up. app-layer: Apply ppolicy if a parser reaches an error state. All options default to 'ignore', which means the default behavior is unchanged. Adds commandline options: add simulation options for exceptions. These are only exposed if compiled with `--enable-debug`. Ticket: #5214. Ticket: #5215. Ticket: #5216. Ticket: #5218. Ticket: #5194.	3 years ago
Victor Julien	4567995678	decode: add pass action wrapper	3 years ago
Victor Julien	d81ad78444	decode: turn no payload/packet inspect macros into funcs ... Remove unused unset macros.	3 years ago
Victor Julien	0035673208	eve/drop: log drop reason ... Ticket: #5202.	3 years ago
Victor Julien	55fb2d5d2d	stream/tests: remove bad test; update failing test to new behavior	3 years ago
Victor Julien	2d64ec6585	stream: clarify error handling comment	3 years ago
Victor Julien	b6cf79901a	stream/reassemble: clarify error handling	3 years ago
Victor Julien	f34845858c	stream: remove now unused tcp.insert_list_fail counter	3 years ago
Victor Julien	13554f7e44	stream/segtree: simplify error handling ... Now that spurious retransmissions don't propegate into the reassembly code, error handling can be simplified.	3 years ago
Victor Julien	cc4e8f0936	stream: detect spurious retransmissions early	3 years ago
Victor Julien	84448d3bae	tests: remove unnecessary flow locks ... Added once to satisfy debug validation, but we don't mix unittests and debug validation anymore. sed -i -E '/.*FLOWLOCK_.*LOCK/d' *.c	3 years ago
Victor Julien	579547c849	smtp: minor line loop cleanup	3 years ago
Victor Julien	96bb67f474	smtp: remove defunct check for line with single LF ... Don't fix it as DATA processing needs all the bytes.	3 years ago
Victor Julien	a2924b7141	smtp: constify line arguments where possible	3 years ago
Victor Julien	e0d5878e49	smtp: move current line out of state	3 years ago
Victor Julien	1451bd62a6	smtp: move input out of state	3 years ago
Victor Julien	77fae275ef	smtp: turn assertions in to debug asserts	3 years ago
Victor Julien	3a631085bb	smtp: simplify preprocess loop	3 years ago
Victor Julien	30e47b2171	mime/base64: decode cleanups and simplification ... Addresses edge case: > 4 bytes at the end of the input with 2 or more spaces. Changes length type for remainder processing to allow for much longer lines, which can happen in practice. Adds a series of debug validation checks with real error handling as well, to assist the fuzzer to find more edge cases.	3 years ago
Victor Julien	92cd95b416	base64: no special case for nul char ... Let it be handled like other invalid input.	3 years ago
Shivani Bhardwaj	5b27619778	base64: make decoder handle decoded data space constraints ... So far, it was the job of caller to send the bae64 decoder a perfect block of data and take care of the destination buffer (decoded data) size. Now, make it the decoder's job to take care of any space constraints that the destination buffer may have and return accordingly. Also, handle space characters in base64 encoded data as per RFC 2045. Update MIME parser accordingly to handle the base64 data. Ticket: 5315	3 years ago
Shivani Bhardwaj	cb01cc6929	base64: add Base64Ecode enum	3 years ago
Shivani Bhardwaj	9131d1d857	base64: add Base64Mode enum	3 years ago
Shivani Bhardwaj	1e3282f363	smtp: treat CR as a line terminator ... The ideal line terminator for an SMTP line is <CRLF>. But, given that bare LF is still allowed by many systems despite the prohibition by standards, we have to consider that. In order to simplify things, we consider bare CR as line terminators as well while updating the delimiter parameter correctly if they were to be followed by a LF immediately or as a part of next fragment. This takes care of some edge cases that made base64 decoder error out because unexpected data was sent to it at times. Ticket: 5316	3 years ago
Philippe Antoine	d1a4dae36b	detect: use generic integer functions for streamsize ... By the way, adds the prefilter feature Ticket: #2697 Ticket: #4112	3 years ago
Philippe Antoine	35b6dcec7e	detect: use generic integer functions for filesize ... Ticket: #4112	3 years ago
Philippe Antoine	bfdf5b1952	detect: use generic integer functions for tcp mss ... Ticket: #4112	3 years ago
Philippe Antoine	025b510cac	detect: use generic integer functions for template2	3 years ago
Philippe Antoine	261eebba12	detect: use generic integer functions for ttl ... Ticket: #4112	3 years ago
Philippe Antoine	2b0be91f28	detect: use generic integer functions for dsize ... Ticket: #4112	3 years ago
Philippe Antoine	f29b43defd	detect: rust generic functions for integers ... Move it away from http2 to generic core crate. And use it for DCERPC (and SMB) And remove the C version. Main change in API is the free function is not free itself, but a rust wrapper around unbox. Ticket: #4112	3 years ago
Philippe Antoine	c4d9cb02ec	util: better hex print function ... Without dangerous snprintf pattern identified by CodeQL even if this pattern is not a problem in those precise cases, it may easily get copy pasted in a dangerous place, so better get rid of it and make CodeQL happy	3 years ago
Philippe Antoine	6058792bee	rust: make suricata context const ... So that it is read only and its pointers do not get modified	3 years ago
Philippe Antoine	5a00acece2	ftp: remove temporary fields from state ... As input, input_len and direction only last for the scope of one call of AppLayerParserParse, it is not necessary to keep them in FtpState which lives longer, so we consume less memory.	3 years ago
Jason Ish	c8a5207083	detect: introduce "like" ip-only signature type ... Rules that look like they should be IP-only but contain a negated rule address are now marked with an LIKE_IPONLY flag. This is so they are treated like IPONLY rules with respect to flow action, but don't interfere with other IPONLY processing like using the radix tree. Ticket: #5361	3 years ago
Philippe Antoine	d5abaf0b38	decode: fix integer warning ... Newly introduced warning. Regular cast as value is checked just before. Ticket: #4516	3 years ago