56514f3be8
openbsd: pledge before allowing threads to continue
...
Avoids a race condition with pcap file directory mode.
Ticket: #8300 .
5 months ago
1e0f344ab7
doc: be more precise for decompress transforms
...
Ticket: 7846
5 months ago
9cecd29fd4
detect/parse: convert test to fail/pass
5 months ago
3068089762
github-ci: disable libmagic on macos
...
5.47 is currently breaking CI, so disable during investigation.
Related to ticket #8342 .
5 months ago
7e97dfd521
detect: replace stack alloc by member of DetectEngineThreadCtx
...
To avoid running a big (when many signatures) stack allocation
on each detection loop with postmatches
Ticket: 8001
5 months ago
b7a3a6b167
detect/pcre: add debug validations
...
Before stack allocation
Ticket: 8001
5 months ago
4849d34325
detect/parse: debug validation before stack allocation
...
A rule size has a global bound
Ticket: 8001
5 months ago
db64462b1d
detect/metadata: add debug validation
...
Before stack allocation
Ticket: 8001
5 months ago
03f767a094
github-ci: re-enable rpm jobs
5 months ago
a4aa056884
detect/parse: convert test to fail/pass
5 months ago
33ddbc3244
github-ci: use --skip-branches in coverage consistently
...
Completes 02f6340972
5 months ago
d241237c0f
Revert "dcerpc: fix consumed bytes post gap handling"
...
This reverts commit fc9da1c7a1
5 months ago
5a3a2d5fd1
doc/output: Document the IPv6 display behavior
...
Issue: 7399
Document the IPv6 display behavior and how to display IPv6 addresses in
their compressed form (per RFC-5952).
5 months ago
809fb56612
output/log: IPv6 addr display per cfg
...
When configured, display the compressed form of the IPv6 address.
Issue: 7399
5 months ago
4af77975e3
output/log: ipv6-compress member to file context
...
Issue: 7399
Add compress ipv6 setting to file context.
5 months ago
20b8829867
output/eve: EVE output to use IPv6 compress cfg
...
Issue: 7399
Determine the EVE IPv6 address display and use that when generating
external display representation.
5 months ago
ed882ede68
output/ipv6: Utility function to compress IPv6 addrs
...
Issue: 7399
Utility function to compress IPv6 addresses per RFC-5952
5 months ago
0e345c93ca
app-layer: check ipproto enabled setting first
...
If the key `app-layer.protocols.PROTO.enabled` is present, the protocol
is enabled for all carrier protocols. This is not ideal.
Only if the key `app-layer.protocols.PROTO.enabled` is missing, an
attempt is made to look for a setting specific to the ipproto passed
at the time of registration e.g.
`app-layer.protocols.PROTO.udp.enabled`.
By default, check for carrier proto specific setting. If it is not
found, then fall back to the generic setting.
Issue a warning in case an inconsistent combination of global and
ipproto specific setting is found.
Bug 8205
5 months ago
8df4e10018
github-actions: bump actions/download-artifact from 7.0.0 to 8.0.0
...
Bumps [actions/download-artifact](https://github.com/actions/download-artifact ) from 7.0.0 to 8.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](37930b1c2a...70fc10c6e5
5 months ago
202d1e26c3
github-actions: bump github/codeql-action from 4.32.3 to 4.32.4
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.32.3 to 4.32.4.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Commits](https://github.com/github/codeql-action/compare/v4.32.3...v4.32.4 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.32.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
5 months ago
cfde322f06
github-actions: bump actions/upload-artifact from 6.0.0 to 7.0.0
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 6.0.0 to 7.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/v6...v7 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
5 months ago
de46f4ba9d
ldap: set invalid_data event
...
Currently in parse_request function LdapEvent::InvalidData is not set when a
request is not parsed correctly.
Ticket #8258
5 months ago
2480f8c038
doc: fix dcerpc.opnum documentation
...
Docs were claiming greater than, less than, etc. support even though this was never supported.
Fixes: 51be8f0238#8330 .
5 months ago
b55be5a44f
detect/transforms: update gunzip / zlib_deflate syntax
...
Use standard space separated syntax.
5 months ago
fe3cce895c
doc/userguide: add igmp keyword docs
5 months ago
7e6fd09e90
doc/userguide: add missing ipopts values
5 months ago
086c27a07f
decoder/igmp: add decoder events
5 months ago
94c16d8915
eve/igmp: add schema support for alert records
5 months ago
791e7c1924
detect/tcp.flags: minor code cleanup
5 months ago
e916fc3ba4
detect: add igmp.type keyword
5 months ago
6a1389acff
detect: add igmp.hdr keyword
5 months ago
d652b7ef62
decoder/igmp: detect RGMP (RFC 3488)
...
RGMP is a dialect of IGMP that uses the same protocol structure,
but with some different values for the fields.
Detect this and log it differently.
5 months ago
18f699cb97
detect/ipopts: add qs and rtralt options
...
Reordering of table and switch to match switch in parser.
5 months ago
190ed2e8ed
detect/csum: add igmp-csum keyword to match checksum
...
Add rule to decoder-events.rules to match on bad checksums.
5 months ago
c54bc8bc8b
detect/proto: add igmp support
...
So 'alert igmp ...' can work.
5 months ago
1b7cc2b323
decoder/igmp: initial decoder support for IGMP
...
Basic v1, v2 and v3 header validation.
Ticket: #8262 .
5 months ago
90823fa90e
devguide: add policy on patches w unasigned ticket
5 months ago
d4434ef4e8
dpdk: add live run test suite
...
Add live tests to verify that mempool, mempool cache sizes, and
potentially other DPDK features are initialized correctly during the
startup.
Follows up on bugs found in mempool settings on real/bonded devices.
The tests are placed in the new folder qa/live/ after a comment
in https://github.com/OISF/suricata/pull/14896 which indicated other
live tests are going to be moved there as well.
Ticket: 8320
5 months ago
ecd15a6c7e
dpdk: scale mempool size to the number of bond members
...
DPDK interface which were added to bond and had auto-calculated
mempool size didn't have enough space as the configured
descriptors and the derived mempool only considered one interface
per YAML node entry.
DPDK Bonding PMD allows for multiple interface to cooperate and
therefore, needs more space.
Ticket: 8125
5 months ago
ea853e92a3
dpdk: fix mempool sizing to always yield 2^n -1
...
Following DPDK's recommendation to size mempool to 2^n - 1,
the current implementation was flawed for certain combos,
e.g. mp_size 1023 and 1 queue, which resulted to 1022.
5 months ago
109742932a
dpdk: honor cache size setting
...
Previously, the interface initialization always recalculated
cache size according to the per-queue computed mempool size.
Ticket: 8123
5 months ago
d640719413
hs: include HS platform info in cache file hash
...
Hash Hyperscan installation info (version, CPU features, mode)
into the cache filename. A Hyperscan upgrade or platform change
would now produce a different filename, so stale caches from an
older installation are never opened.
Ticket: 8325
5 months ago
2e7b12dda4
hs: validate cached database against current HS installation
...
After deserializing a cached Hyperscan database, verify that its
version, CPU features, and mode match the current Hyperscan
installation by comparing hs_database_info output against a
reference database. Reject loading incompatible caches.
Ticket: 8325
5 months ago
0cdc77b707
hs: use binary mode for cache file I/O
...
HSSaveCache wrote serialized Hyperscan databases using text mode ("w")
while HSReadStream already read them with binary mode ("rb").
Matched file reading modes to the binary format and simplified
write-size check.
Ticket: 8325
5 months ago
d754b28717
hs: remove redundant file handle in HSLoadCache
...
HSLoadCache opened the cache file but never used the resulting handle
for reading. The actual read was done by HSReadStream which opened
the same file independently.
Removed the unused fopen/fclose pair and flattened the control flow.
Ticket: 8325
5 months ago
569ba3d26f
hs/cache: cleaner and more detailed output
...
Reduce logging level of a minor informational message.
Split tracking of pruning by age and by version and log those
separately, where the logging only appears if something has been
removed.
Ticket: 8322
5 months ago
66473f6ad7
doc: add more public datasets
...
Add:
- UNSW-NB15
- CIC-IDS2017
- CSE-CIC-IDS2018
- CIC-DDoS2019
Update formatting for better display.
5 months ago
e69b732d1c
af-xdp: address compile warnings
...
runmode-af-xdp.c:119:52: error: implicit conversion loses integer precision: 'const int' to 'uint16_t' (aka 'unsigned short') [-Werror,-Wimplicit-int-conversion]
119 | aconf->threads = (nr_cores <= nr_queues) ? nr_cores : nr_queues;
| ~ ^~~~~~~~
runmode-af-xdp.c:119:63: error: implicit conversion loses integer precision: 'const int' to 'uint16_t' (aka 'unsigned short') [-Werror,-Wimplicit-int-conversion]
119 | aconf->threads = (nr_cores <= nr_queues) ? nr_cores : nr_queues;
| ~ ^~~~~~~~~
runmode-af-xdp.c:135:26: error: implicit conversion loses integer precision: 'const int' to 'uint16_t' (aka 'unsigned short') [-Werror,-Wimplicit-int-conversion]
135 | aconf->threads = nr_queues;
| ~ ^~~~~~~~~
runmode-af-xdp.c:268:41: error: implicit conversion loses integer precision: 'intmax_t' (aka 'long') to 'uint32_t' (aka 'unsigned int') [-Werror,-Wshorten-64-to-32]
268 | aconf->busy_poll_time = conf_val_int;
| ~ ^~~~~~~~~~~~
runmode-af-xdp.c:275:43: error: implicit conversion loses integer precision: 'intmax_t' (aka 'long') to 'uint32_t' (aka 'unsigned int') [-Werror,-Wshorten-64-to-32]
275 | aconf->busy_poll_budget = conf_val_int;
| ~ ^~~~~~~~~~~~
runmode-af-xdp.c:282:40: error: implicit conversion loses integer precision: 'intmax_t' (aka 'long') to 'uint32_t' (aka 'unsigned int') [-Werror,-Wshorten-64-to-32]
282 | aconf->gro_flush_timeout = conf_val_int;
| ~ ^~~~~~~~~~~~
runmode-af-xdp.c:287:43: error: implicit conversion loses integer precision: 'intmax_t' (aka 'long') to 'uint32_t' (aka 'unsigned int') [-Werror,-Wshorten-64-to-32]
287 | aconf->napi_defer_hard_irqs = conf_val_int;
| ~ ^~~~~~~~~~~~
7 errors generated.
source-af-xdp.c:426:24: error: implicit conversion loses integer precision: 'int' to 'uint8_t' (aka 'unsigned char') [-Werror,-Wimplicit-int-conversion]
426 | ptv->afxdp_state = state;
| ~ ^~~~~
source-af-xdp.c:642:44: error: implicit conversion loses integer precision: 'uint32_t' (aka 'unsigned int') to '__u16' (aka 'unsigned short') [-Werror,-Wimplicit-int-conversion]
642 | ptv->xsk.cfg.bind_flags = afxdpconfig->bind_flags;
| ~ ~~~~~~~~~~~~~^~~~~~~~~~
2 errors generated.
5 months ago
edc19a15ad
detect/parse: convert unittest to fail/pass API
5 months ago
02f6340972
github-ci: update cov builds
...
Use --skip-branches to avoid countless partial coverage in unittests.
Update from 22.04 to 24.04 and llvm 15 to 19 to support --skip-branches.
5 months ago
Victor Julien
Philippe Antoine
Jason Ish
Shivani Bhardwaj
Jeff Lucovsky
dependabot[bot]
Giuseppe Longo
Juliana Fajardini
Lukas Sismis