13754 Commits (df45fc9e97f49398d4dd0994c436bd38254689ee)

 

All Branches   

Search

Author	SHA1	Message	Date
Haleema Khan	df45fc9e97	detect-l3proto: Convert unittests to new FAIL/PASS API ... Ticket: #4050	2 years ago
Alice Akaki	d46ce170ba	detect-icmp-seq: clean-up unittests ... Task: #5597	2 years ago
Eric Leblond	4e1ff9a7ff	flow: fix FlowSwapFileFlags function ... Ticket: #5625	2 years ago
Haleema Khan	160c778a1f	detect-filesize: Convert unittests to new FAIL/PASS API ... Ticket: 4039	2 years ago
Haleema Khan	f25d4cc546	detect-distance: Convert unittests to new FAIL/PASS API ... Ticket : #4020	2 years ago
Juliana Fajardini	a654ef50de	pgsql: add test for parameter status parser ... Since we've done some changes to how the parameters are parsed, add one more test case to check that. Bug #5579	2 years ago
Juliana Fajardini	c4fbd78770	pgsql: move database into opt parameters list ... For StartupMessages, the database parameter is optional. This moves the parameter into the optional_parameters list. Bug #5579	2 years ago
Juliana Fajardini	84f9ea7254	eve/schema: pgsql - allow flexible parameters list ... Pgsql's parameters - for message types like StartupMessage and ParameterStatus, for instance, don't have a finite, definitive set, as per their documentation. Our json schema was allow expecting a fixed set of parameters, though, resulting in SV tests failing if different, valid parameters appeared. Bug #5579	2 years ago
Philippe Antoine	cc68898532	pgsql: support empty parameter values ... Bug #5579	2 years ago
Philippe Antoine	1e0190bc6b	pgsql: support out of order parameters for startup message ... As user can be not the first parameter Bug #5579	2 years ago
Alice Akaki	f251b6af65	detect-icmp-id: convert unittests to FAIL/PASS APIs ... Task: #4042	2 years ago
Haleema Khan	1fdd56a61d	detect-itype: Convert unittests to new FAIL/PASS API ... Bug: #5589	2 years ago
dependabot[bot]	6a9b7cf977	github-actions: bump actions/cache from 3.0.10 to 3.0.11 ... Bumps [actions/cache](https://github.com/actions/cache) from 3.0.10 to 3.0.11. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/v3.0.10...9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7) --- updated-dependencies: - dependency-name: actions/cache dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2 years ago
Simeon Miteff	6673846481	profiling: Make rule_perf.log JSON output newline-delimited ... Adding a newline makes the output valid JSON when multiple sortings of the rules profile object are written to the log.	2 years ago
Jeff Lucovsky	5a6e68285b	doc/netmap: Describe Netmap IPS usage ... Issue: 5512 This commit summarizes Netmap usage with Suricata's IPS mode.	2 years ago
Jason Ish	9d653512f9	doc/userguide: update bittorrent-dht eve examples ... Update the bittorrent-dht examples using real log records with peers and nodes broken down into objects.	2 years ago
Jason Ish	e3e7d007b2	eve/schema: bittorrent-dht updates ... Some values that were previously strings are now parsed down into objects.	2 years ago
Jason Ish	1f056f9974	bittorrent-dht: parse and log node6 lists ... Node6 lists are just like node lists, but for IPv6 addresses.	2 years ago
Jason Ish	86d5ab8644	bittorrent-dht: remove tests that are no longer valid	2 years ago
Jason Ish	2f9eb5d1dd	bittorrent-dht: fix values decoding, as a list of peers ... The "values" field is not a string, but instead peer information in compact format. Decode this properly and then properly format in the log.	2 years ago
Jason Ish	4a0859beeb	jsonbuilder: add append_hex - add hex to array ... New method, append_hex to add a byte array to a JSON array in hex encoding.	2 years ago
Jason Ish	4bc9cf3986	bittorrent-dht: parse token and target as byte values	2 years ago
Jason Ish	5a30ee77a1	bittorrent-dht: only attempt to parse dht messages ... The bittorrent flow is shared with transport messages as well as dht messages. Only attempt to parse dht message as dht, ignore the rest.	2 years ago
Jason Ish	98a9391210	bittorrent-dht: decode node data structures ... Instead of decoding the nodes field into a blog of bytes, decode it into an array of node info objects, each with a node id, IP address and port.	2 years ago
Jason Ish	3cb50592ed	bittorrent-dht: convert some fields to byte arrays ... Some fields that were previously strings are not always value UTF-8 data, instead the protocol specification refers to them as strings of bytes, so in other words byte arrays. Currently fields converted are: - client_version - info_hash - response.id - request.id - nodes - token	2 years ago
Jason Ish	065f3ab9f1	doc: rename bittorrent-dht to bittorrent_dht in eve output	2 years ago
Jason Ish	0d3cfbbe3f	bittorrent-dht/eve: log as bittorrent_dht	2 years ago
Jason Ish	66fc92276a	eve-schema: add bittorrent-dht	2 years ago
Jason Ish	78ba17caa8	bittorrent-dht: register a pattern for protocol detection ... Removes the port based probing which takes a long time to register for ports 1024-65535 and instead use pattern based protocol detection.	2 years ago
Jason Ish	350c0723d7	bittorrent-dht: set parser to unidirectional ... This parser does not match up responses with requests so flag it as unidirectional.	2 years ago
Jason Ish	0ea9ba66d1	userguide/eve-log: remove mentions of requiring Rust ... Rust is required to build now.	2 years ago
Jason Ish	06eaec67ac	bittorrent: updates for new event handling ... Fixes anomaly events.	2 years ago
Aaron Bungay	d166c48d28	docs: update for bittorrent-dht app-layer	2 years ago
Aaron Bungay	86037885a9	bittorrent-dht: add bittorrent-dht app layer ... Parses and logs the bittorrent-dht protocol. Note: Includes some compilation fixups after rebase by Jason Ish. Feature: #3086	2 years ago
Jason Ish	27672c950c	dnp3: fixups to work with unified json tx logger ... Update DNP3 to work with a single TX logger, and just register one logger instead of 2. This primarily creates a TX per message instead of correlating replies to requests, which fits the DNP3 model better, but we didn't really have this concept nailed down when DNP3 was written.	2 years ago
Victor Julien	2f9ca8bb34	dpdk: set new running flag at thread startup	2 years ago
Victor Julien	91b7b63ed2	threads: count thread types after all initialized ... To avoid double counting in case a thread took longer than expected to start up.	2 years ago
Alice Akaki	6621b0ec93	detect-icmp-seq: convert unittests to FAIL/PASS APIs ... Task: #4043	2 years ago
Haleema Khan	8d5c5f24a1	dns/eve: add 'HTTPS' type logging ... Add a new DNS record type to represent HTTPS Ticket: #4751	2 years ago
Haleema Khan	b1972a5c61	detect-itype: remove unittests ... Ticket: #5590	2 years ago
Gabriel Lima Luz	4b009eb907	detect-replace: Convert unittests to FAIL/PASS API ... Ticket: 4054	2 years ago
Philippe Antoine	a003640ecf	security: prevents process creation ... with setrlimit NPROC. So that, if Suricata wants to execve or such to create a new process the OS will forbid it so that RCE exploits are more painful to write. Ticket: #5373	2 years ago
Jason Ish	2ab3646fad	profiling: sort LoggerId's in same order as defined ... Sort the LoggerId's in the order they are define in suricata-common.h.	2 years ago
Jason Ish	99cb8c666a	loggers: all json tx loggers can share the same loggerid ... This is to avoid the tx logging code that doesn't support LoggerId values over 31 at this time. The simplest fix for now is to just have all JSON (eve) loggers use the same ID. DNP3 is left as-is for now as it needs some extra support in the parser.	2 years ago
Richard McConnell	9c2939fb33	workflow: add systemd integration and check ... Intergration of systemd is a feature that enables notification of a running service to the service manager. The workflow now ensures compilation with systemd and checks the binary has been built against libsystemd.	2 years ago
Richard McConnell	7f4c1d5e2f	doc/systemd: add documentation for sd_notify	2 years ago
Richard McConnell	88b98a54df	suricata: add sd_notify support ... Upon all threads reaching a running state the system generates a notification for systems running and configured for systemd Implements feature 5384 (https://redmine.openinfosecfoundation.org/issues/5384)	2 years ago
Richard McConnell	13beba141c	source: add THV_RUNNING flag to notify of running state ... Each module (thread) updates its status to indicate running. Main thread awaits for all threads to be in a running state before continuing the initialisation process Implements feature 5384 (https://redmine.openinfosecfoundation.org/issues/5384)	2 years ago
Eric Leblond	9fb0137d9d	doc: add reference to ipaddr in IP matching	2 years ago
Eric Leblond	94664ef565	datasets: don't exit on invalid data	2 years ago