18854 Commits (cff3d6417a601b310f56687dac88141b0507bfdd)

 

All Branches   

Search

Author	SHA1	Message	Date
Philippe Antoine	c0d6747e82	app-layer: GetTxIteratorFn uses a AppLayerGetTxIterState ... Even if every current rust parser uses the u64 variant of the C union	6 months ago
Philippe Antoine	4b541b39f2	rust: move AppLayerEventType definition to C ... and bindgen it to rust. Will make easier the bindgen of RustParser structure which uses a callback which uses AppLayerEventType	6 months ago
Philippe Antoine	c960b7d7c1	app-layer: AppLayerParserFPtr uses a mut pointer to local storage ... So, fix the fn prototype in rust ParseFn	6 months ago
Philippe Antoine	f470ee448b	quic: use standard tx iterator code ... Will make bindgen life easier As the fn prototype should not have istate: &mut u64 but a *mut AppLayerGetTxIterState which is an union with a u64	6 months ago
Philippe Antoine	076fcd61cd	bittorrent: use standard tx iterator code ... Will make bindgen life easier As the fn prototype should not have istate: &mut u64 but a *mut AppLayerGetTxIterState which is an union with a u64	6 months ago
Philippe Antoine	1a546936c7	rust: AppLayerTxConfig uses Default impl	6 months ago
Philippe Antoine	4e64de3b3b	rust: remove wrapper LoggerFlags struct definition ... just use an u32 out of the box. Will make bindgen like easier	6 months ago
Philippe Antoine	f663be5983	rust: define every RustParser fn pointer unsafe ... That is what bindgen will do	6 months ago
Philippe Antoine	327f45ceb3	app-layer: ApplyTxConfigFn does not return bool ... It does not return anything. The only known implementation is in dns where it does not return. And the C code does not bother to check a return value anyways.	6 months ago
Victor Julien	cf7a56dd78	counters: compact public stats context	6 months ago
Victor Julien	711c1193d0	counters: misc cleanups	6 months ago
Victor Julien	6524a3fb5c	stats: add derive support; add DERIVE_DIV type ... Add basic derive counter support, where a counters value is derived from 2 other counters. Add DERIVE_DIV that divides the first counter value by the second counters value. Convert `decoder.avg_pkt_size` to be derived from `decoder.bytes` and `decoder.pkts`. Ticket: #5615.	6 months ago
Abhijeet Singh	b145e389ab	util/log: fix log file rotation ... Fix double log file rotation in presence of both rotation flag and rotate interval Ticket: https://redmine.openinfosecfoundation.org/issues/8153	6 months ago
Victor Julien	5f92a6cac3	detect/base64_data: reset buffer offset ... When in a `base64_decode`-`base64_data` pair the decode was depending on another match through the relative option, the `buffer_offset` would be updated to the relative position of the previous match. During the `base64_data` phase, a relative match would use that offset even though the match happened in a new buffer. Example:: http.request_body; content:"|27|"; \ base64_decode:relative; \ base64_data; content:"|ff ff ff ff|"; within:16; This use of the `buffer_offset` is incorrect as that value is relative to a buffer and the `base64_data` points to a new buffer. This patch addresses this by resetting DetectEngineThreadCtx::buffer_offset before inspecting `base64_data`. Bug: #7842.	6 months ago
Philippe Antoine	f8ad6904bc	features: add UNIX_SOCKET feature ... for SV tests to tun conditionnaly on it Ticket: 3464	6 months ago
Juliana Fajardini	48b15ac152	devguide: add chapter about exception policies ... Adds a chapter indicating what are the main steps when adding exception policies, how is it possible to extend them, as well as main aspects and files to consider when doing so. Task #5612	6 months ago
Lukas Sismis	56c1552c3e	hs: warn about the same cache directory ... This is especially relevant for multi-instance simultaneous setups as we might risk read/write races.	6 months ago
Lukas Sismis	15c83be61a	hs: prune stale MPM cache files ... Hyperscan MPM can cache the compiled contexts to files. This however grows as rulesets change and leads to bloating the system. This addition prunes the stale cache files based on their modified file timestamp. Part of this work incorporates new model for MPM cache stats to split it out from the cache save function and aggregate cache-related stats in one place (newly added pruning). Ticket: 7830	6 months ago
Lukas Sismis	08f5abe5e9	detect-engine: make mpm & spm part of MT stub ctx ... As a intermediary step for Hyperscan (MPM) caching, the MPM config initialization should be part of the default detect engine context for later dynamic retrieval. Ticket: 7830	6 months ago
Lukas Sismis	7031c26865	hs: touch cache files on use to signal activity ... Ticket: 7830	6 months ago
Lukas Sismis	fd3847db72	path: signal last use of the file (touch) ... To have a system-level overview of when was the last time the file was used, update the file modification timestamp to to the current time. This is needed to remove stale cache files of the system. Access time is not used as it may be, on the system level, disabled. Ticket: 7830	6 months ago
Lukas Sismis	85f0382072	conf: add time parsing conf function	6 months ago
Lukas Sismis	3e4fdb2118	misc: time unit parsing function	6 months ago
Lukas Sismis	c282880174	hs: change hash in the cache name to SHA256	6 months ago
Lukas Sismis	2a313ff429	hs: reduce cache filename size to max file limit	6 months ago
Lukas Sismis	47fc78eeae	hs: update the file description	6 months ago
Philippe Antoine	251d10fa42	util-spm-hs: add missing deallocator ... Add missing deallocator when hs_alloc_scratch fails. Bug: #8146	6 months ago
Sergey Zhidkih	799f01f78f	util-spm-hs: add missing deallocator ... Add missing deallocator for expr when hs_compile fails. Bug: #8146	6 months ago
Sergey Zhidkih	11073a0190	hyperscan: move error logging for hs_compile ... Move error logging from util-mpm-hs to reuse it in util-spm-hs as it has proper hs_compile error handling. Bug: #8146.	6 months ago
Philippe Antoine	5bb9a0c3af	dcerpc/tcp: fix fragmentation handling ... Really count the fragments, and set it done when last was received	6 months ago
Philippe Antoine	f64aec9d11	dcerpc: use different header for different directions ... Header handling is wrong in the case packet A to server is fragmented (return AppLayerResult::incomplete) packet B is to client, but uses the header of the to_server packet Bug 7547	6 months ago
Philippe Antoine	1832b50506	nfs: log read/write/rename whatever the nfs version ... These were previously logged correctly only for nfs v3 Now, the correct opcodes are used for v2 and v4 as well Ticket: 8222	6 months ago
Victor Julien	c20c7c1dfa	detect/content: pretty print pattern directly	6 months ago
Philippe Antoine	374c191268	detect/port: fix use-after-free in case of alloc failure ... If recursive call to DetectPortInsert (in case DetectPortCut returned a c != NULL) failed, we had successfullt inserted `new` but we return error, leading to freeing DetectPort `new` in DetectPortParseInsertString but it will be freed again by DetectPortCleanupList from DetectPortParse Ticket: 6187	6 months ago
Philippe Antoine	fcec08a178	detect/port: remove unused variable	6 months ago
Philippe Antoine	83acf3ca53	detect: remove unset flag PORT_FLAG_ANY	6 months ago
Victor Julien	d1c16a0cc8	spm/bs: use memmem when available ... Memmem is generally much more optimized.	6 months ago
Victor Julien	ddfeef2897	spm: add mm, a memmem based spm ... Wrapper around `memmem`. The case sensitive search is implemented by directly calling `memmem`. As there is no case insensitieve variant available, a wrapper around memmem is created, that takes a sliding window approach: 1. take a slice of the haystack 2. convert it to lowercase 3. search it using memmem 4. move window forward	6 months ago
Victor Julien	73a873ecfe	doc/userguide: endswith can be mixed with offset/distance/within ... Bug: #5030.	6 months ago
Victor Julien	2a2b98650b	firewall: fix rules not loading w/o commandline opts ... Firewall rules were supposed to also load when using a config like ## ## Suricata as a Firewall options (experimental) ## firewall: # toggle to enable firewall mode enabled: yes # Firewall rule file are in their own path and are not managed # by Suricata-Update. rule-path: /etc/suricata/firewall/ # List of files with firewall rules. Order matters, files are loaded # in order and rules are applied in that order (per state, see docs) rule-files: - firewall.rules But they were not because of a missing check. Bug: #8206.	6 months ago
Philippe Antoine	dd6baccabd	src: doc: remove more double-space typos ... Found with git grep -E '[a-z] [a-z]'	6 months ago
Juliana Fajardini	a1f088cc65	docs: use correct suricata version mentions ... Found with 'git grep suricata-7' Task #8113	6 months ago
Philippe Antoine	feea984872	app-layer: test bypass set for udp ... Ticket: 8116 quic parsing on udp can request bypass. But such a bypass was only handled for TCP protocols in AppLayerParserParse	6 months ago
Philippe Antoine	b0850efd67	rust: from_str implementation for EncryptionHandling ... To move non-specific quic code to the right place	6 months ago
Philippe Antoine	89b6ab6730	rust: rename EncryptionHandling ... as it is no longer specific to SSH	6 months ago
Philippe Antoine	7acfea57a9	rust: move EncryptionHandling definition to its own file ... as it is not specific to ssh anymore	6 months ago
Philippe Antoine	7422c97bf2	quic: encryption-handling config parameters ... Ticket: 8116	6 months ago
Victor Julien	844f6011b1	datasets: fix compile warnings ... datasets-string.c:53:20: error: implicit conversion loses integer precision: 'unsigned long' to 'int' [-Werror,-Wshorten-64-to-32] return len + 2; ~~~~~~ ~~~~^~~ 1 error generated.	6 months ago
Victor Julien	ff3def130c	rust/htp: formatting fixup	6 months ago
Victor Julien	b1fe6a4ceb	rust: update lru to 0.16.3; update lock ... RUSTSEC-2026-0002 Ticket: #8210.	6 months ago