c578015edf
lua: remove unused code
...
Since hooks, we do not need a specific SMTP buffer list id.
1 year ago
06ad72e83e
quic: ja3 getter function uses direction
...
so that future lua code can specify a direction
1 year ago
d1bca4a9b9
util/lua: fix new -Wshorten-64-to-32 warning
...
Ticket: 6186
1 year ago
4463fbac15
output/ftp: fix new -Wshorten-64-to-32 warning
...
Ticket: 6186
Fixes d674ce2510
1 year ago
41fcf3b356
detect: fix some -Wshorten-64-to-32 warnings
...
Ticket: #6186
1 year ago
527b05b6b8
datasets: fix new -Wshorten-64-to-32 warning
...
Ticket: #6186
1 year ago
8545ef2e56
detect: factorize code for DetectSetupDirection
...
Ticket: 7665
Instead of each keyword calling DetectSetupDirection, use a
new flag SIGMATCH_SUPPORT_DIR so that DetectSetupDirection gets
called, before parsing the rest of the keyword.
Allows to support filesize keyword in transactional signatures
1 year ago
14864d49ac
examples/altemplate: remove rs_ naming
1 year ago
e8d7d3d83d
scripts/setup-app-layer: fixes for name changes
1 year ago
bf427c69cd
rust: remaining rs_ to SC conversions
1 year ago
d16c014641
rust/x509: replace rs_ naming with SC
1 year ago
afce53c8b7
rust/websocket: replace rs_ naming with SC
1 year ago
7321d7c7db
rust/applayertemplate: replace rs_ naming with SC
1 year ago
2c98ee73ce
rust/rfb: replace rs_ naming with SC
1 year ago
e74b4177ac
rust/nfs: rust format
1 year ago
8c1bd60ab1
rust/nfs: replace rs_ naming with SC
1 year ago
01ce0f92e8
rust/modbus: replace rs_ naming to SC
...
This was missed in the previous round.
1 year ago
2cbec43b98
mpm/ac-ks: allow cppcheck to inspect included file directly
1 year ago
a8b342a07b
debug: suppress cppcheck warning
...
src/util-debug.c:1562:5: warning: Either the condition 'sc_lid!=NULL' is redundant or there is possible null pointer dereference: sc_lid. [nullPointerRedundantCheck]
sc_lid->global_log_level = MAX(sc_lid->global_log_level, max_level);
^
src/util-debug.c:1569:16: note: Assuming that condition 'sc_lid!=NULL' is not redundant
if (sc_lid != NULL)
^
src/util-debug.c:1562:5: note: Null pointer dereference
sc_lid->global_log_level = MAX(sc_lid->global_log_level, max_level);
^
1 year ago
223c568701
lua/flowvarlib: check malloc result
...
src/util-lua-flowvarlib.c:110:12: warning: If memory allocation fails, then there is a possible null pointer dereference: buf [nullPointerOutOfMemory]
memcpy(buf, value, len);
^
src/util-lua-flowvarlib.c:109:28: note: Assuming allocation function fails
uint8_t *buf = SCMalloc(len + 1);
^
src/util-lua-flowvarlib.c:109:28: note: Assignment 'buf=malloc(len+1)', assigned value is 0
uint8_t *buf = SCMalloc(len + 1);
^
src/util-lua-flowvarlib.c:110:12: note: Null pointer dereference
memcpy(buf, value, len);
^
src/util-lua-flowvarlib.c:111:5: warning: If memory allocation fails, then there is a possible null pointer dereference: buf [nullPointerOutOfMemory]
buf[len] = '\0';
^
src/util-lua-flowvarlib.c:109:28: note: Assuming allocation function fails
uint8_t *buf = SCMalloc(len + 1);
^
src/util-lua-flowvarlib.c:109:28: note: Assignment 'buf=malloc(len+1)', assigned value is 0
uint8_t *buf = SCMalloc(len + 1);
^
src/util-lua-flowvarlib.c:111:5: note: Null pointer dereference
buf[len] = '\0';
1 year ago
4e2f1de308
rust/quic: replace rs_ naming with SC
1 year ago
bfa0acf278
rust/ike: replace rs_ naming with SC
1 year ago
717e06e351
rust/http2: replace rs_ naming with SC
1 year ago
af15986d41
rust/modbus: replace rs_ naming with SC
1 year ago
c994cfb615
rust/sip: replace rs_ naming with SC
1 year ago
9b830c92dc
rust/tftp: replace rs_ naming with SC
1 year ago
aa24276999
rust/telnet: replace rs_ naming with SC
1 year ago
1c580f9001
rust/detect: replace rs_ naming with SC
1 year ago
713034d0dd
rust/asn1: replace rs_ naming with SC naming
1 year ago
90116827fe
rust/krb: rust format
1 year ago
8ba0a5c8ec
rust/krb: remove rs_ prefix; visibility fixes
...
- remove pub/no_mangle where not needed
- replace rs_ naming with SC naming
1 year ago
1f30746e07
rust/dns: rs_ prefix name cleanup
1 year ago
3fe9bd7cbb
detect/flow: don't overwrite hook direction
1 year ago
6ee32cba3b
firewall: apply action again for stateful matches
...
For "stateful rules", don't drop packets after the initial match as long
as the tx state doesn't change.
An example of how this could happen was:
accept:hook ssh:request_started any any -> any any (alert; sid:2000;)
accept:hook ssh:request_banner_wait_eol any any -> any any (alert; sid:2001;)
accept:hook ssh:request_banner_done any any -> any any ( \
ssh.software; content:"OpenSSH_8.2p1"; alert; sid:2002;)
As the ssh session reached the request_banner_done state, it would
remain in this state. So additional packets would again review the rules
for this state. The rule 2002 is stored in the tx state as fully
matched, and would be skipped for the additional packets. This meant
that the `accept:hook` action was not applied and the default drop
policy was triggered.
This is addressed by updating the stateful logic:
If an accept rule has the DE_STATE_FLAG_FULL_INSPECT flag set, and the
tx progress is not progressed beyond the rule, apply the rule accept
acction.
1 year ago
b1f955ef5a
firewall: move app action setting into helper func
...
In preparation of adding another callsite.
1 year ago
4b89dafb44
github-actions: bump actions/download-artifact from 4.2.1 to 4.3.0
...
Bumps [actions/download-artifact](https://github.com/actions/download-artifact ) from 4.2.1 to 4.3.0.
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](95815c38cf...d3f86a106a
1 year ago
af2b56e9fb
github-actions: bump github/codeql-action from 3.28.13 to 3.28.16
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.28.13 to 3.28.16.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Commits](https://github.com/github/codeql-action/compare/v3.28.13...v3.28.16 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.28.16
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
1 year ago
1f846bc131
github-actions: bump codecov/codecov-action from 5.4.0 to 5.4.2
...
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action ) from 5.4.0 to 5.4.2.
- [Release notes](https://github.com/codecov/codecov-action/releases )
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md )
- [Commits](0565863a31...ad3126e916
1 year ago
4c695b1075
doc/devguide: document the rate filter callback
...
Ticket: #7673
1 year ago
f968a7bfb0
doc: add rst header order recommendation
...
Ticket: #7396
1 year ago
60c429e04d
detect: add callback for when rate filter changes action
...
This callback will be called when alert action has been changed due to a
rate filter. The user can then reset or customize the action in their
callback per their own logic.
As the callback is added to the current detection engine, make sure its
copied to the new detection engine on reload.
Ticket: #7673
1 year ago
23c5fafe5c
decode: documentation group for packet alert flags
...
As #define's like this can't be logically grouped into an enum, try
Doxygen documentation groups, which create a group just of these flag
values and documents them together on a page.
1 year ago
1b7496bf5b
decode: use BIT macros for flags; consistent naming
...
Use the BIT_U8 macros for packet alert flags and rename
PACKET_ALERT_RATE_FILTER_MODIFIED to
PACKET_ALERT_FLAG_RATE_FILTER_MODIFIED for consistency.
1 year ago
e3ae4b005e
detect/ftpbounce: reuse generic hook
1 year ago
3c5ce91cbb
ftp: per direction tx progress
...
For request side, having a tx means the request is done.
For response, wait for tx to be marked complete.
Remove unused states.
1 year ago
810a47cd60
github-ci: pin bindgen test to bindgen v0.66.0
1 year ago
8102fbfd0c
doc/userguide: fix typo in lua flowvar lib
...
Was importing suricata.flow, not suricata.flowvar.
1 year ago
8a5bc12156
lua: convert lua flowint functions to lib: suricata.flowintlib
...
Ticket: #7487
1 year ago
12e149b99b
build: separate private headers from installed headers
...
Create a new list of headers for headers that should never be
installed, such as private headers that should only be available
within the Suricata project.
For now, just the util-device-private.h belongs to this set.
1 year ago
8540627b4e
examples: add simple c++ example
...
For now just used to make sure a C++ variation of our custom example
can build.
1 year ago
Philippe Antoine
Jason Ish
Victor Julien
dependabot[bot]