14994 Commits (suricata-7.0.1)

 

All Branches   

Search

Author	SHA1	Message	Date
Victor Julien	f41646a012	streaming: remove dead code ... As reported by Coverity Scan.	3 years ago
Victor Julien	7b18b9c01c	flow: make next_ts unsigned ... To silence a coverity warning.	3 years ago
Victor Julien	420351eda2	time: fix various time issues ... Found by Coverity Scan.	3 years ago
Shivani Bhardwaj	06caef988c	detect/ftp: use AppLayerResult API	3 years ago
Juliana Fajardini	d9cd05e828	stream: remove unused retval from fn description	3 years ago
Juliana Fajardini	918bd7435c	userguide/config: update log format symbols list ... There were some possible format options missing after the recent changes in the log format.	3 years ago
Philippe Antoine	e8db6255cb	tls: accept validity before 1970 ... modify TLS certificate decoding of validity timestamps to support times between 1950 and 2049, as per RFC 5280 Ticket: #3253	3 years ago
Philippe Antoine	0c0fcc9411	detect: config keyword transaction logic fix ... When the keyword config:logging disable,type tx is used, OutputTxLog checks a flag to skip the transaction without logging it, but AppLayerParserTransactionsCleanup waits for the transaction to be marked as logged to clean it. So, OutputTxLog now marks the tx as logged, so that it can get cleaned away. Ticket: #5456	3 years ago
Victor Julien	37f13a4fc7	smb: set defaults for file transfer limits ... Ticket: #5782.	3 years ago
Juliana Fajardini	416f7522e7	stream/tcp: fix typos, update copyright year ... Bug #5765	3 years ago
Juliana Fajardini	8e9905e0d8	exceptions: ignore policy if stream.midstream=true ... Set the engine to ignore the stream.midstream-policy if stream.midstream is enabled. If we had both stream.midstream AND stream.midstream_policy enabled, this could lead to midstream flows being dropped (or bypassed, or...) instead of being accepted by the engine, as it was probably meant when the user enabled midstream flows. Bug #5765	3 years ago
Juliana Fajardini	0d9289014b	exceptions: add master switch config option ... This allows all traffic Exception Policies to be set from one configuration point. All exception policy options are available in IPS mode. Bypass, pass and auto (disabled) are also available in iDS mode Exception Policies set up individually will overwrite this setup for the given traffic exception. Task #5219	3 years ago
Jason Ish	fab3f36b8c	dns: never return error on UDP DNS ... UDP parsers should never return error as it should indicate to Suricata that an unrecoverable error has occurred. UDP being record based for the most part is almost always recoverable, at least for protocols like DNS.	3 years ago
Jason Ish	d720ead470	dns: split header and body parsing ... As part of extra header validation, split out DNS body parsing to avoid the overhead of parsing the header twice.	3 years ago
Jason Ish	595700ab7e	dns: validate header on every incoming message ... As UDP streams getting probed, a stream that does not appear to be DNS at first, may have a single packet that does look close enough to DNS to be picked up as DNS causing every subsequent packet to result in a parser error. To mitigate this, probe every incoming DNS message header for validity before continuing onto the body. If the header doesn't validate as DNS, just ignore the packet so no parse error is registered.	3 years ago
Jason Ish	c98c49d4ba	dns: parse and alert on invalid opcodes ... Accept DNS messages with an invalid opcode that are otherwise valid. Such DNS message will create a parser event. This is a change of behavior, previously an invalid opcode would cause the DNS message to not be detected or parsed as DNS. Issue: #5444	3 years ago
Jason Ish	49e9f51a03	github-ci: fedora non-root: suricata-verify -q ... Run Suricata-Verify in quiet mode for the non-root build to more easily find the error when fails.	3 years ago
Jason Ish	7afc2e3aed	dns: rustfmt	3 years ago
Jason Ish	39d2524bf6	dns: mark test buffers with rustfmt::skip	3 years ago
Jason Ish	30a2cfa693	log-pcap: remove early output initializing if offline ... Remove early opening of output files if running in an offline mode, as we don't yet know the timestamp to use. Prevents the first pcap files being opened with a timestamp of 0, bringing us back to the same behvaviour of pcap logging in 6.0. Issue: 5374	3 years ago
Jason Ish	64c069f162	log-pcap: fix typo in multi-mode error message	3 years ago
Jason Ish	e4f85ecc2a	log-pcap: display mininum limit on error ... On fatal error due to limit being less than the allowed minimum, display the minimum value in bytes.	3 years ago
Lukas Sismis	30d9d8c7f4	util-debug: clang-format required change	3 years ago
Lukas Sismis	03c21bfaa8	runmodes: Determine engine's copy-mode as early as possible ... Configuration and behavior of HTP app layer depends on the copy mode of Suricata engine. Copy mode was set after the app layer setup. Decision of engine's copy mode operation is now made earlier. Ticket: #5706	3 years ago
Lukas Sismis	958f94276a	runmodes: remove misleading commment	3 years ago
Lukas Sismis	e2a5bc7961	dpdk: add support for enabling IPS support in DPDK mode	3 years ago
Lukas Sismis	449943e1a9	util-device: remove unused functions	3 years ago
Lukas Sismis	bed16ba44c	runmodes: change function prototype of runmode init functions ... Commit contains prototype changes of RunModeSetLiveCaptureAutoFp and RunModeSetLiveCaptureWorkers functions to move the IPS enable logic out of suricata.c file.	3 years ago
Lukas Sismis	ee4f75e4b4	dpdk: port deprecated DPDK macros to the newer forms	3 years ago
Lukas Sismis	1c8205e6b1	dpdk: add Github action to build Suricata with all available (LTS) DPDK versions	3 years ago
Lukas Sismis	79130103c2	dpdk: print debug xstats counters of all DPDK ports on shutdown	3 years ago
Lukas Sismis	cb6fa894ef	dpdk: add a check for HW checksum validation offload ... Ticket: #5553	3 years ago
Victor Julien	da1ad843b4	time: -Wstrict-prototypes fix	3 years ago
Jeff Lucovsky	9fbe683642	time: Rework SCTime_t into a struct ... Issue: 5718 This commit changes SCTime_t to a struct with members setup as bitfields.	3 years ago
Jeff Lucovsky	31793aface	time: Replace struct timeval with scalar value ... Issue: 5718 This commit switches the majority of time handling to a new type -- SCTime_t -- which is a 64 bit container for time: - 44 bits -- seconds - 20 bits -- useconds	3 years ago
Jeff Lucovsky	7702ad410e	format/clang: Apply clang-format ... Issue: 5718	3 years ago
Victor Julien	c15d511064	frames: enable only used frames ... Enable only frames that are actually used. Ticket: #4979.	3 years ago
Victor Julien	6cc9811edd	files: move FileContainer into FileTransferTracker ... Update SMB, NFS, HTTP2.	3 years ago
Victor Julien	aa376a3b21	detect/frame: improve frame detection ... Add a per frame progress tracker.	3 years ago
Victor Julien	169ee11ead	output/frame: log frame type stream	3 years ago
Victor Julien	d72bc364de	output/frame: improve 'complete' logging	3 years ago
Victor Julien	6cbb5306c6	frame: add debug validation check	3 years ago
Victor Julien	b43dc5a64a	app-layer/frames: use absolute frame offset ... Frame offset was already a 64 bit integer, so simplify things by making it an absolute offset from the start of the stream.	3 years ago
Victor Julien	39d9b3adbe	frames: implement generic <alproto>.stream frames ... Add a hard coded <alproto>.stream option for all stream data for a protocol. Starts at stream offset 0 or at the point of a protocol upgrade in case of STARTTLS or CONNECT.	3 years ago
Victor Julien	f773b714e9	detect/frames: minor cleanup in buffer handling ... Don't lookup a buffer twice, even if the lookup should be fast.	3 years ago
Victor Julien	d0f1507c83	htp: simplify streaming buffer config ... Use a single static config instead of the per profile config.	3 years ago
Victor Julien	c79c0ca347	streaming: remove config pointer from struct	3 years ago
Victor Julien	53d9a1f39f	streaming: internal switch to sbcfg by argument	3 years ago
Victor Julien	ff882cd73f	streaming: add sbcfg to StreamingBufferClear	3 years ago
Victor Julien	6e5f35e0a0	streaming: add sbcfg to StreamingBufferFree	3 years ago