18854 Commits (cff3d6417a601b310f56687dac88141b0507bfdd)

 

All Branches   

Search

Author	SHA1	Message	Date
Jason Ish	ccd1df99fd	github-ci: add coveralls coverage uploads	5 months ago
Jason Ish	accaf68615	github-ci: fix cov-ut profile file collision	5 months ago
Jason Ish	65e87949c8	github-ci: ignore /github from coverage output	5 months ago
Jason Ish	8c99759dfe	github-ci: ignore /usr and /rustc in coverage	5 months ago
Jason Ish	d3b6bae140	github-ci: upload lcov coverage artifacts	5 months ago
Victor Julien	e991375b04	github-ci: for codecov netns check, account for cargo build dir ... It's not in /root/ like with container based builds.	5 months ago
Jason Ish	e6513b5117	codecov: upload lcov reports to codecov ... Seems to fix our issues with codecov.io.	5 months ago
Philippe Antoine	71b59f6dbe	rust/ffi: move IPPROTO_TCP to ffi ... and reexport in suricata Allows to reduce dependencies to full suricata crate Ticket: 7666	5 months ago
Philippe Antoine	2a90cef318	plugin: reduce dependency on suricata crate ... Ticket: 7666 The end goal is to remove all dependencies on suricata and just use suricata_sys or suricata_ffi For now, make usage of what is already available	5 months ago
Juliana Fajardini	926fde859e	userguide: fix Deprecations, warn about syslog ... The Deprecation note on Syslog was partly conveying the opposite message, and we were missing a deprecation notice on the Syslog output section.	5 months ago
Philippe Antoine	d5ea973791	detect/ike: move ike.ike.chosen_sa_attribute keyword to rust ... Ticket: 8310 And increases expressivity on the way by supporting other modes than equality	5 months ago
Philippe Antoine	55333a6ca0	detect/ike: move ike.vendor keyword to rust ... Ticket: 8310	5 months ago
Philippe Antoine	14edd66494	detect/ike: move ike.nonce_payload keyword to rust ... Ticket: 8310	5 months ago
Philippe Antoine	d1213e4440	detect/ike: move ike.key_exchange_payload keyword to rust ... Ticket: 8310	5 months ago
Philippe Antoine	f23169c924	detect/ike: move ike.nonce_payload_length keyword to rust ... Ticket: 8310	5 months ago
Philippe Antoine	e85bf5be4d	detect/ike: move ike.key_exchange_payload_length keyword to rust ... Ticket: 8310	5 months ago
Philippe Antoine	841fe44f34	detect/ike: move ike.exchtype keyword to rust ... Ticket: 8310	5 months ago
Philippe Antoine	23032ebc65	detect/ike: move ike spi keywords to rust ... Ticket: 8310	5 months ago
Victor Julien	28ba93e60c	ndpi: minor optimization ... Check protocol before doing more expensive work.	5 months ago
Victor Julien	278da4bc6a	npdi: fix null pointer deref in detect keywords ... Check for the existence of a flow before calling FlowGetStorageById() on it. Ticket: #8308.	5 months ago
Juliana Fajardini	723aa21e6f	misc: update copyright years ... For files edited during Task #7885	5 months ago
Juliana Fajardini	dc4d805908	exceptions: s/DEBUG/QA_SIMULATION build flag ... Task #7885	5 months ago
Juliana Fajardini	5edb5a5d1a	build-scopes: add QA_SIMULATION mode ... For qa-simulation scenarios, especially for testing purposes. Task #7885	5 months ago
Victor Julien	e7c9be07e6	af-xdp: add missing unlock in error path ... CID 1638288: (#1 of 1): Missing unlock (LOCK) 4. missing_unlock: Returning without unlocking xsk_protect.queue_protect.	5 months ago
Victor Julien	b84ae80146	affinity: address coverity warning ... CID 1667318: (#1 of 1): Structurally dead code (UNREACHABLE) unreachable: This code cannot be reached: hwloc_obj_t non_io_ancestor....	5 months ago
Sven Cuyt	1246f1cf8c	doc/userguide: add link to differences-from-snort ... Ticket: #8031.	5 months ago
Sven Cuyt	a0cc534471	doc/userguide: fix table showing example payload ... Ticket: #8031.	5 months ago
Sven Cuyt	2d662538e5	doc/userguide: add example with non-zero offset for relative isdataat ... Ticket: #8031.	5 months ago
Victor Julien	7c5285e5e6	doc/userguide: explain isdataat absolute vs relative difference ... Ticket: #8031.	5 months ago
dependabot[bot]	fe5c2250e1	github-actions: bump github/codeql-action from 4.32.0 to 4.32.3 ... Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.32.0 to 4.32.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Commits](https://github.com/github/codeql-action/compare/v4.32.0...v4.32.3) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.32.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	5 months ago
Philippe Antoine	b37b2b6bd6	decode: use compact uint8_t instead of enum in struct ... to save memory also move it to the first cacheline, as there is a 2 byte gap there and this field should also not change after it has been set.	5 months ago
Philippe Antoine	9807fe4326	decode/xvlan: treat as its own tunnel ... Ticket: 7717 Allows for instance to process/log ARP packets over VXLAN. That means we need to decode the ethernet layer above vxlan instead of skipping it as part of the vxlan, even if the vxlan decoder still checks the ethernet layer to avoid FPs.	5 months ago
Philippe Antoine	efb6daa1ae	decode: use PacketIsTunnelChild ... Instead of directly accessing the field Will allow PacketTunnelType to hold the precise tunnel type like DECODE_TUNNEL_ERSPANII with a modification of PacketIsTunnelChild	5 months ago
Philippe Antoine	dc29ab46ed	ebpf: check maps compatibility ... ebpf program does not handle 3 layers of vlan	5 months ago
Philippe Antoine	d378610e93	stream: non infinite default value for reassembly.depth ... So that empty config have a safer default. Ticket: 8290	5 months ago
Victor Julien	db2e97ab5f	detect/iprep: mark as supported for firewall mode ... Ticket: #8285.	5 months ago
Ofer Dagan	e1f9d8a067	pcap: refactor delete-when-done to support non-alerts ... Refactor pcap file deletion to use a single delete-when-done option with three values instead of separate boolean options: - false (default): No deletion - true: Always delete files - "non-alerts": Delete only files with no alerts Also account for alerts produced by pseudo packets (flow timeout / shutdown flush): - Introduce small capture hooks and invoke on pseudo-packet creation so the capture layer can retain references and observe alerts emitted after the last live packet - Call the hook from both TmThreadDisableReceiveThreads and TmThreadDrainPacketThreads Key changes: - Replace should_delete/delete_non_alerts_only bools with enum - Move alert counter from global to per-file PcapFileFileVars - Relocate alert counting from PacketAlertFinalize to pcap module - Ensure thread safety for both single and continuous pcap modes - Add unit tests for configuration parsing and pseudo-packet alert path The --pcap-file-delete command line option overrides YAML config and forces "always delete" mode for backward compatibility. Documentation updated to reflect the new three-value configuration. Fixes OISF#7786	5 months ago
Philippe Antoine	539e4ee665	detect/transforms: add zlib_deflate transform ... Ticket: 7846	5 months ago
Philippe Antoine	dbea660729	detect/transforms: add gunzip transform ... Ticket: 7846	5 months ago
Philippe Antoine	751ef1fe9b	detect: add debug validation about nlists ... To avoid stack overflow A single signature should not have more than 65k buffers Ticket: 8001	5 months ago
Philippe Antoine	f4d83f29a9	detect: allocate sids_array on the heap ... To be able to load 1M signatures and not have a stack overflow Ticket: 8001	5 months ago
Philippe Antoine	256c6a99b8	datasets: adds safety check before stack allocation ... Even if current caller does not provide too big data. Ticket: 8001	5 months ago
Victor Julien	336a9d05ca	krb5: fix TCP record parsing ... A logic error in multi-record parsing meant only the first record was parsed. Bug: #8278.	5 months ago
Jason Ish	eab5931074	github-ci: merge rust.yml into existing builds.yml build ... The Rust build in rust.yml was just an AlmaLinux 9 build with some extra checks. Instead, use an existing AlmaLinux 9 build in builds.yml, make it use Rustup (there are other AlmaLinux 9 builds that use the RPM), and add the checks. Saves us one build in CI.	5 months ago
Jason Ish	77d96851f5	pfring: use static functions; add void arg to SCPluginRegister ... Minor cleanups.	5 months ago
Jason Ish	a60e93c2cd	pfring: fix typo in StringParseUint16 ... StringParseUnt16 -> StringParseUint16 Ticket: #8271	5 months ago
Jason Ish	828d105cea	pfring: copy cflags over from src/ ... This should cause the following warning to error out: runmode-pfring.c: In function 'OldParsePfringConfig': runmode-pfring.c:118:17: error: implicit declaration of function 'StringParseUnt16'; did you mean 'StringParseInt16'? [-Wimplicit-function-declaration] 118 | if (StringParseUnt16(&pfconf->threads, 10, 0, threadsstr) < 0) { | ^~~~~~~~~~~~~~~~ | StringParseInt16 Ticket: #8271	5 months ago
Jason Ish	d230a760e6	examples/altemplate: update to use jsonbuilder from ffi crate	5 months ago
Jason Ish	6b850dddb8	rust/ffi: JsonBuilder wrapper around C JsonBuilder API ... For use by plugins that need to work with JsonBuilder.	5 months ago
Jason Ish	f6b11ac855	output-eve: finish exposing to bindgen ... As all out output-eve.h is now exposed, merge output-eve.h and output-eve-bindgen.h back into one file, output-eve.h.	5 months ago