15587 Commits (suricata-7.0.11)

 

All Branches   

Search

Author	SHA1	Message	Date
Victor Julien	82e03bd8fc	tls: set event if record size exceeds limit	3 years ago
Victor Julien	e857c864ca	tls: support server hello done message	3 years ago
Victor Julien	4bab6e24e5	tls: support handshake fragmentation ... Implement TLS record defrag for handshake messages. Ticket: #5183.	3 years ago
Victor Julien	bcaf0f6f7d	tls: remove certificate buffering code ... TCP Buffering is now done in the app-layer using the incomplete API, on the SSL/TLS record level. TLS level fragmentation will be implemented separately.	3 years ago
Victor Julien	0839317ea7	tls: parse handshake protocol records in single pass	3 years ago
Victor Julien	9f0ea5e70c	sslv2: use version from client hello ... Remove streaming code that is now unused. Incomplete handling makes this record parsing work on full data.	3 years ago
Victor Julien	c8d79fb81f	ssl: implement 'incomplete' handling for SSLv2	3 years ago
Victor Julien	6076a51511	tls: streaming mode for application records ... To avoid overhead of stream buffering for records we don't do much with anyway, pass through application records instead of buffering the entire record in the stream engine.	3 years ago
Victor Julien	129fcb5c72	tls: use incomplete API to get full TLS records ... The TLS record header is parsed in streaming mode still, but once the record size is known we tell the app-layer API to give us the full record. Ticket: #5481	3 years ago
Victor Julien	2d308c000d	github-ci: disable cppclean as it is too noisy ... We can reenable it after the larger cleanup efforts are complete.	3 years ago
Gleb Smirnoff	7110ea75c4	ipfw: remove setting of SO_BROADCAST on the divert(4) socket ... My review of the FreeBSD kernel code reveals that this setting a) is ignored by the kernel b) is not required. The sending side of divert(4) never checks so->so_options, but always gives IP_ALLOWBROADCAST to ip_output().	3 years ago
dependabot[bot]	30ce63c50f	github-actions: bump ossf/scorecard-action from 1.1.2 to 2.0.3 ... Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 1.1.2 to 2.0.3. - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ce330fde6b...865b409285) --- updated-dependencies: - dependency-name: ossf/scorecard-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	3 years ago
Andrei Shchapaniak	ee5573c4ee	dpdk/i40e: fix warning with number of queues for RSS configuration	3 years ago
Philippe Antoine	390cf9248f	detect: adds flow.age keyword ... Ticket: #5536	3 years ago
Philippe Antoine	ce2775d331	flow/icmpv4: fix vlan.use-for-tracking ... For ICMPv4 error messages the vlan ids were always considered, even if the 'vlan.use-for-tracking' option was disabled. Ticket: #5330	3 years ago
Sascha Steinbiss	148b53125b	ebpf: update deprecated API calls ... This fixes build errors when libbpf 1.0 is used. It removes previously deprecated API functions that were still in use in Suricata's eBPF code.	3 years ago
Philippe Antoine	af40873127	pgsql: config limit maximum number of live transactions ... As is done for other protocols Ticket: #5527	3 years ago
Philippe Antoine	e160917bcf	mqtt: remove quadratic time complexity ... When having many transactions in a single parsing call... Fix has overhead of having one more field in the mqtt state. Completes commit a8079dc978 Ticket: #5399	3 years ago
Jeff Lucovsky	63745a7879	detect/tls: Improve tls.fingerprint rule handling ... Issue: 4581 This commit improves the runtime performance of rules with tls.fingerprint by using the inspection logic from tls.cert_fingerprint.	3 years ago
Jeff Lucovsky	6bccd5aa30	detect/uri: Remove unnecessary include ... This commit removes an unnecessary #include for detect-uricontent.h	3 years ago
Victor Julien	d941703cd8	detect/build: minor code cleanup	3 years ago
Victor Julien	040404b093	detect/profiling: track bytes scanned by prefilter engines	3 years ago
Victor Julien	682e2a07fe	detect/tls: add tls.cert_chain_len keyword	3 years ago
Victor Julien	224ba82569	eve/tls: warn on unsupported 'custom' options	3 years ago
Victor Julien	dbf3d1e977	tls: make SSLSetEvent a macro to help debugging	3 years ago
Victor Julien	036686e21c	etc/schema: clang (re)format	3 years ago
Victor Julien	6e1220700d	github-ci: bump cbindgen to 0.24.3 ... This addresses issues around the AppLayerTxData type.	3 years ago
Victor Julien	0e39c92fcf	flow-manager: reduce locks at startup ... Effectively busy looping on a mutex to wait for time to be ready.	3 years ago
Victor Julien	19e94e93fa	common: move u8_tolower to common header	3 years ago
Victor Julien	18e63d4ede	htp: remove user setup from request line callback ... This used to be the first callback that was called, but its not anymore. Codecov confirmed that this is no longer used and therefore not useful.	3 years ago
Victor Julien	faca974f32	ipfw: remove unused func prototype	3 years ago
Victor Julien	b9ad1d1260	app-layer: fix compiler warning	3 years ago
Victor Julien	e250ef6402	debug: remove empty header	3 years ago
Victor Julien	c3c5829f96	reputation: add ipv6 cidr test	3 years ago
Victor Julien	e9c4b3719e	reputation: fix multiline test	3 years ago
Eric Leblond	a9a17c8185	landlock: handle filestore case ... If landlock ABI is inferior to 2 (before Linux 5.19) then the renaming of files is impossible if the protection is enabled. This patch disables landlock if ABI < 2 and file-store is enabled. As file store is initialized in output the call to landlock had to done after the output initialization.	3 years ago
Eric Leblond	1b24f4d357	doc: document landlock feature	3 years ago
Eric Leblond	485d5a4ea4	landlock: basic implementation ... This patch is adding support for Landlock, a Linux Security Module available since Linux 5.13. The concept is to prevent any file operation on directories where Suricata is not supposed to access. Landlock support is built by default if the header is present. The feature is disabled by default and need to be activated in the YAML to be active. Landlock documentation: https://docs.kernel.org/userspace-api/landlock.html Feature: #5479	3 years ago
Philippe Antoine	fe91506320	doc/http2: suricata.yaml max-streams parameter ... Ticket: #4949	3 years ago
Juliana Fajardini	bbd968c738	exceptions: add reject support to exception policy ... This enables the usage of 'reject' as an exception policy. As for both IPS and IDS modes the intended result of sending a reject packet is to reject the related flow, this will effectively mean setting the reject action to the packet that triggered the exception condition, and then dropping the associated flow. Task #5503	3 years ago
Victor Julien	f5bd55dac8	decode/tcp: allow 4 byte TFO with 2 byte cookie	3 years ago
Philippe Antoine	5ef259722b	dhcp: adds renewal-time keyword ... Ticket: #5507	3 years ago
Philippe Antoine	dc59389087	dhcp: fix license in detect-dhcp-leasetime.c ... from search and replace overkill	3 years ago
Philippe Antoine	6faf6299e0	dhcp: adds rebinding-time keyword ... Ticket: #5506	3 years ago
Philippe Antoine	95f0424423	nfs4: fix write record handling ... Ticket: #5280	3 years ago
Josh Soref	c23560ec41	detect: function header return value clarification ... Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>	3 years ago
Philippe Antoine	bf43011a43	dcerpc: convert transaction list to vecdeque for UDP ... As was done for TCP in dfe76bb90 and d745d28d4 Ticket: #5518	3 years ago
Gleb Smirnoff	5dbbc52b06	ipfw: use PF_DIVERT on modern FreeBSD	3 years ago
Victor Julien	bb2e11108b	packetpool: fix uaf in debug validation check ... Location of the check meant access to freed packet was possible. Move check and simplify it to just look at the packet at hand.	3 years ago
Philippe Antoine	b0ce55c9df	flow: finish to remove obsolete counters ... As was begun in b3599507f4 Ticket: #5317	3 years ago