19043 Commits (dc5185e3555f9c78179df41f0e89c9032f5b302f)

 

All Branches   

Search

Author	SHA1	Message	Date
Philippe Antoine	dc5185e355	util/mpm-ac-ks: preallocate on the heap rather than stack ... Ticket: 8001 As the the size of the allocation can get large	2 months ago
Philippe Antoine	94a3e03903	util/mpm: add MpmCtx argument to MpmInitThreadCtx ... Ticket: 8001 Will allow algorithms such as ac to use the MpmCtx, especially the number of patterns, to preallocate some structures. For detect engine PatternMatchThreadPrepare, create a dummy MpmCtx out of all the MpmCtx in the DetectEngineCtx, and get the max value for the number of patterns	2 months ago
Philippe Antoine	25bf59f238	util/spm: explicit needle_len is u16 ... So, stack allocation is bounded Ticket: 8001	2 months ago
Victor Julien	9c76480ac3	detect/firewall: further simplify flow control ... For the last for progress case we can just break on a firewall drop. For the accept:flow and accept:tx cases the next sig (if any) will check the flow/tx flag and manage flow control from there.	2 months ago
Victor Julien	0a84015214	doc/userguide: add new constructs to firewall examples	2 months ago
Victor Julien	8728f9ffc0	doc/userguide: document firewall lte rule support	2 months ago
Victor Julien	ac59883c26	doc/userguide: fix default policies for pre_* hooks ... Minor other cleanups.	2 months ago
Victor Julien	da6af0879e	doc: update firewall design ... Bring in line with recent changes.	2 months ago
Victor Julien	bb6dc93789	detect/firewall: clean up per rule run check	2 months ago
Victor Julien	035e8bc851	detect/firewall: minor flow control cleanup	2 months ago
Victor Julien	bb7aff36a8	detect/firewall: simplify pre-check flow ... Simplify pre-check logic. Pre-check takes care of enforcing FLOW_ACTION_ACCEPT, APP_LAYER_TX_ACCEPT and default policy enforcement before the current rule's hook. This should be done in firewall mode for each rule regardless whether it is a firewall or TD rule. No need to track verdict state anymore.	2 months ago
Victor Julien	68f73302ce	detect/firewall: clean up tx inspection loop	2 months ago
Victor Julien	a86fe01cc3	detect/firewall: consolidate action handling ... Step towards consolidating all action handling into a central location.	2 months ago
Victor Julien	1ad9c3ec29	detect/firewall: clean up pre-check policy logic	2 months ago
Victor Julien	52967c69ec	detect/firewall: fix accept:tx,alert in default policy	2 months ago
Victor Julien	247c6a2333	detect/firewall: inject alert before default policy ... If default policy is invoked because of missing rules for next hooks, make sure to inject an alert before the next hook policies might do so.	2 months ago
Victor Julien	90a837cef3	detect/firewall: update discarded logic ... Only count alert queue overflow here, not alerts in the queue after a drop.	2 months ago
Victor Julien	57b16c964e	detect/firewall: drop in fw mode does not include alert ... In TD mode the drop action also includes alert. In firewall mode it should not to stay in line with accept. Ticket: #8601.	2 months ago
Victor Julien	f1090da254	detect/firewall: log alert for app default with alert ... Fix missing alert on drop:flow,alert	2 months ago
Victor Julien	485f5243d5	detect/firewall: improve handle fw alert handling ... More clearly define the relationship between PacketAlerts for firewall and threat detection events. Also no longer count firewall_discarded if drop rule came before a another rule, causing the later rule to not be evaluated/alerted. When packet:filter and app:filter alert appear in a single alert queue, handle accept:hook by keeping track of the detect_table.	2 months ago
Victor Julien	7e9402a2e0	detect/alert: fix suppressed drop handling ... If drop was issued for suppressed rule, still consider it for the next alert.	2 months ago
Victor Julien	508bb71d78	detect: minor action handling cleanup ... Don't run exact same check twice.	2 months ago
Victor Julien	9bcf0f332b	detect/firewall: fix TD drop:flow after FW accept:flow ... Threat detection can drop a flow that is but in accept:flow by the firewall.	2 months ago
Victor Julien	ecf2161f3b	detect/firewall: fixup debug message	2 months ago
Victor Julien	fb9747df8e	detect/firewall: minor code cleanup	2 months ago
Victor Julien	8572088b0f	eve/alert: firewall default policy logging improvements ... Add firewall.hook to indicate the hook that the policy was set on. Ticket: #8566.	2 months ago
Victor Julien	dc4c22e906	detect/firewall: support alert in packet default policy ... Support `alert` as a secondary action in packet firewall policies. To implement this a Signature object is created per policy that uses alert, and this is stored in a array table. When the policy is applied the signature is looked up and used in the PacketAlert. Ticket: #8566.	2 months ago
Victor Julien	2d4f1968b8	detect/firewall: support alert in default app policy ... Support `alert` as a secondary action in app-layer firewall policies. To implement this a Signature object is created per policy that uses alert, and this is stored in a hash table. When the policy is applied the signature is looked up and used in the PacketAlert. Ticket: #8566.	2 months ago
Victor Julien	6e037d9783	detect/analyzer: log firewall lte rule for prior states as well	2 months ago
Victor Julien	71a6a9a746	detect/firewall: limit auto accept notation ... Limit to accept:flow, accept:tx and accept:hook.	2 months ago
Victor Julien	651afba883	detect/firewall: implement initial state range support ... Allow a single rule to accept a hook and the hooks prior to it. Example: accept:flow tls:<client_hello_done ... \ tls.sni; content:"suricata.io"; endswith; This will evaluate the SNI at the client_hello_done hook, but will act as if there is a `accept:hook tls:client_in_progress ...` as well. Implementation is currently specific to this `<` operator. During parsing the sig gets flagged for this case. During setup this has 3 main effects: 1. prefilter is disabled as we need to eval this right at the first state (0) 2. for state 0 a non-PF "prefilter" engine is setup to make sure the rule is flagged for evaluation 3. In the Signature::app_inspect list a dummy inspect engine is registered per state before Signature::app_progress_hook The matching logic is building on the stateful rule handling. The stateful rule handling can now tell the inspection loop that a partial match occured. For this rule type the partial match will act as a match with action accept:hook. Next app updates will then use the continue detection logic to continue the stateful match. When that fully matches, the final actions are applied, like accept:flow or accept:tx. Ticket: #8472.	2 months ago
Victor Julien	f6dc772677	detect/firewall: fix last for progress handling ... In last_for_progress handling set accept only on packet if it was also triggered on the last tx. If there are more transactions, the accept can be set later (if policy allows).	2 months ago
Juliana Fajardini	6933602050	detect/parse: convert Notice Log into Debug	2 months ago
Juliana Fajardini	040369ed1a	qa/live: update tests for fw stats counters ... Part of Ticket #7699	2 months ago
Juliana Fajardini	8a8574b149	exceptions: add dedicated flow drop reason ... To better control stats counters.	2 months ago
Juliana Fajardini	312967f291	detect: add flow drop by firewall as drop reason ... To track flow drops triggered by the firewall. Add flow drop by firewall as drop reason. As part of Ticket #7699	2 months ago
Juliana Fajardini	0acb136b40	schema: expand stats.ips.replaced explanation ... As this is a less obvious counter.	2 months ago
Juliana Fajardini	234172a93c	docs: add firewall stats doc ... Related to Ticket #7699	2 months ago
Juliana Fajardini	5b488feef5	detect/firewall: add dedicated stats counters ... Add a `firewall` stats counter aggregator for all firewall-related stats. De-overload "detect.alert_queue_overflow", by adding "firewall.discarded_alerts" to account for discarded drops in Firewall mode. Add Debug statements for tracking corner cases where it can be difficult to know where a drop is coming from. Added counters: - stats.firewall.blocked - stats.firewall.accepted - stats.firewall.rejected - stats.firewall.drop_reason.default_app_policy - stats.firewall.drop_reason.default_packet_policy - stats.firewall.drop_reason.flow_drop - stats.firewall.drop_reason.pre_flow_hook - stats.firewall.drop_reason.pre_stream_hook - stats.firewall.drop_reason.rules - stats.firewall.discarded_alerts Ticket #7699	2 months ago
Juliana Fajardini	32d89072d2	docs/configuration: add firewall mode settings ... Partly related to Ticket #7699	2 months ago
Jason Ish	b366665ad8	doc: document rust thread life cycle api ... Ticket: #8605	2 months ago
Jason Ish	144f824f17	rust/ffi: add thread init callback wrapper ... Ticket: #8605	2 months ago
Jason Ish	c689af0bbb	rust/ffi: bindgen thread lifecycle callbacks ... Ticket: #8605	2 months ago
Jason Ish	f269e22b67	github-ci: add coverage reporting for the rust example plugin ... Should help reporting coverage on the ffi wrappers only used by plugins.	2 months ago
Jason Ish	e1a2a36ee7	examples/plugins/rust: misc cleanups ... - Remove registration helper - Limit function visibility	2 months ago
Philippe Antoine	07112bc7ae	rust: format mqtt files ... Ticket: 3836	2 months ago
Philippe Antoine	844f2effa3	rust: format modbus files ... Ticket: 3836	2 months ago
Philippe Antoine	db019ebefe	rust: format ike files ... Ticket: 3836	2 months ago
jason taylor	da827322ba	doc: minor ebpf doc update for fedora/rhel ... Signed-off-by: jason taylor <jtfas90@proton.me>	2 months ago
Victor Julien	54322f38f8	common: fix cppcheck syntax error	2 months ago