17722 Commits (suricata-8.0.0)

 

All Branches   

Search

Author	SHA1	Message	Date
Jason Ish	a5e662cb8a	doc/lua/dns: fix typo	4 months ago
Philippe Antoine	a6392ac5d4	rust: use pure rust helper for registering sticky buffers ... Mark sdp and sip keywords with flags SIGMATCH_INFO_STICKY_BUFFER as a side effect.	4 months ago
Philippe Antoine	9c8ec0d3a9	plugin: applayer: do not use suricata JsonError ... We do not need a specific error type	4 months ago
Philippe Antoine	833a738dd1	http: fail tx creation if we cannot allocate user data ... So, we always have a libhtp.rs htp_tx_t and a Suricata tx with its AppLayerTxData Thus AppLayerParserGetTxData cannot return NULL Ticket: 5739	4 months ago
Philippe Antoine	0167001ce8	rust/htp: remove unused code	4 months ago
Philippe Antoine	e728aae1e0	websocket: fixes substraction ... Fixes: 16f74c68aa ("websocket: use max window bits of 15")	4 months ago
Victor Julien	7af8ef07b3	github-ci: codecov llvm updates ... Use LLVM 15 with Rust 1.67.1	4 months ago
Victor Julien	fe07781bfc	github-ci: update codecov unittest job ... LLVM 19, rust 1.85.1 and Ubuntu 24.04.	4 months ago
Philippe Antoine	e41c28f7c9	dnp3: mark tx as updated when creating it ... Ticket: 7668 We should set updated_tx when allocating a dnp3 tx	4 months ago
Philippe Antoine	f24d3ffb74	ftp: mark tx as updated when creating it ... Ticket: 7668 We should set updated_tx when allocating a ftp tx Was already done right for updated_tc	4 months ago
Philippe Antoine	a5b987266b	http1: always mark tx as updated on request/response start ... Ticket: 7668 We should set updated_tx when allocating HtpTxUserData	4 months ago
Philippe Antoine	aa7f926ff4	detect: rust helper to register sticky buffer	4 months ago
Philippe Antoine	96afdce283	detect: rename SCSigTableElmt to SCSigTableAppLiteElmt	4 months ago
Philippe Antoine	a7f4fd12d5	detect: remove never set SIGMATCH_NOT_BUILT	4 months ago
Philippe Antoine	794f991ad6	unittests: more realistic packet from UTHBuildPacketReal ... So that its contents can be reused when translating unit tests to SV tests	4 months ago
Philippe Antoine	8757ad5fd3	detect/dns: support string for dns.rrtype ... Ticket: 6723	4 months ago
Philippe Antoine	44a6f7f8ca	detect/dns: support string for dns.rcode ... Ticket: 6723	4 months ago
Philippe Antoine	9814b698c8	detect/dns: move keywords to rust ... Ticket: 7529 Ticket: 3725 Adds url for dns.opcode on the way	4 months ago
Philippe Antoine	bb9b8d2460	detect: new helper to register multi-buffer with progress ... This allows to use these engines for hook rules needing exact progress (checked in SigValidate)	4 months ago
Philippe Antoine	7d806dc7b7	ci: rustc wrapper to disable coverage for external crates ... To keep the disk usage good even when we use new crates	4 months ago
Philippe Antoine	a1ff7424e4	http1: brotli decompression ... Ticket: 5692 http2 already used brotli crate for decompression	4 months ago
Philippe Antoine	128ee9ba46	output: fix leak in case of alloc error ... CID: 1638290	4 months ago
Philippe Antoine	85f2f597f1	defrag: remove unnecessary NULL check ... CID: 727861	4 months ago
Philippe Antoine	9dac5ec23c	util/mpm: prevents double free ... CID: 1645545 PatternDatabaseGetCached frees cd on success So, we should NULL it, so that in case PatternDatabaseGetSize fails and we goto error, we do not free cd again.	4 months ago
Philippe Antoine	e301e038ef	detect: explicitly skip check on SCConfGet ... CID: 1644571	4 months ago
Eric Leblond	adfa46ab1c	dox/userguide: add tx_cnt documentation	4 months ago
Eric Leblond	0044b5f682	eve/schema: remove duplicate fields	4 months ago
Eric Leblond	5cf6459f3f	eve/flow: log tx_cnt ... This patch adds a `tx_cnt` field to `netflow` events to give some context about the underlying protocol activity. Ticket: #7635	4 months ago
Eric Leblond	668c6d646e	eve/netflow: add tx_cnt ... This patch adds a `tx_cnt` field to `netflow` events to give some context about the underlying protocol activity. Ticket: #7635	4 months ago
Eric Leblond	db11078315	eve/smb: add tx_id to event ... As SMB protocol is using heavily transactions, getting the transaction ID in SMB events can be really useful for automated analysis.	4 months ago
Philippe Antoine	16f74c68aa	websocket: use max window bits of 15 ... Ticket: 7285 As this is the default for websocket, which is bigger than the defaut for zlib usage Also limit the decompressed content to the max-payload-size configuration parameter also used for non-compressed content. And also use a stateful decoder to store/remember the compression state to be able to decompress later messages.	4 months ago
Philippe Antoine	44c8632284	rust: use flate2 with C zlib ... move flate2.rs to a backend supporting the setting of window_bits, which is not the case for miniz-oxide. This will allow WebSocket to use Sec-WebSocket-Extensions which can set a non-default window_bits	4 months ago
Philippe Antoine	ff57a162d7	websocket: decompress single pdu message ... Ticket: 7285 Previously, only messages over multiple PDUs could get decompressed	4 months ago
Jeff Lucovsky	d59f5d6db6	output/rotate: Remove extra rotation flag register ... Issue: 3436 Remove duplicate register of the rotation flag. Eventually, this will cause corruption when the file context has been freed and the rotation flag is deregistered.	4 months ago
Jeff Lucovsky	33445d01b3	output/rotate: Serialize rotation flag handling ... Issue: 3436 Serialize rotation flag handling to avoid corruption.	4 months ago
Alice Akaki	bda0890834	detect: add email.received keyword ... email.received matches on MIME EMAIL Received This keyword maps to the EVE field email.received[] It is a sticky buffer Supports multiple buffer matching Supports prefiltering Ticket: #7599	4 months ago
James	deb761367d	doc: Update bypass docs to use new keyword format ... Ticket: #7143 Update documentation to reflect new sticky buffer keyword format	4 months ago
Victor Julien	e3c6554ee6	detect/app-layer-protocol: allow matching on 'unknown'	4 months ago
Victor Julien	8f9c05243c	firewall: detect: set firewall support flag on select keywords	4 months ago
Victor Julien	f96e97205c	firewall: detect: add feature flag for keywords supporting firewall	4 months ago
Victor Julien	e6bd69b419	firewall: detect: set per rule table ... For firewall mode, set the pseudo table in the rule and use this in alert queue ordering, so that rule actions are applied in the expected order: packet:filter -> packet:td -> app:filter -> app:td This makes sure that a packet:td drop is applied before a app:filter accept.	4 months ago
Victor Julien	1643b017b6	detect: don't set conflicting packet/flow actions ... If for the same a packet a drop rule and a pass rule would match, the applying of actions could be contradictionary: - the drop would be applied to the packet - the pass rule would also be considered, not overriding the drop, but still setting the flow pass flag. This would lead to the packet being dropped, but the rest of the flow getting passed, including retransmissions of the dropped packet. This patch only sets drop/pass actions if no conflicting action has been set on the packet before. It respects the action-order. Bug: #7653.	4 months ago
Victor Julien	d6e61b6690	firewall: detect: add explanation	4 months ago
Victor Julien	49979587ce	detect/alert: minor cleanup	4 months ago
Alice Akaki	ca429ef5e3	detect: add email.url keyword ... email.url matches on URLs extracted from an email This keyword maps to the EVE field email.url[] Supports multiple buffer matching Supports prefiltering Ticket: #7597	4 months ago
Jason Ish	bea685bfcd	rust/htp: remove authors; fix homepage ... Remove the authors field as it is deprecated. Update the repository page to the Suricata repository. Remove the homepage, it can be found via the reposistory page.	4 months ago
Jason Ish	e3a400a581	htp: rename to suricata-htp; allow publishing to crates.io ... As the "suricata" crate depends on htp, we need to publish htp to crates.io first, however "htp" name is already taken. So rename "htp" to "suricata-htp".	4 months ago
Jason Ish	b98b44a576	suricatactl: add description to Cargo.toml ... For publishing to crates.io.	4 months ago
Jason Ish	0e65cccc09	rust: always update Cargo.lock.in ... On a normal project where the Cargo.lock is checked in, it would be normal to see an updated Cargo.lock in git status and the like. As we use autoconf to generate this file, we should just copy it back to the input file so we get the same convenience of seeing when it is updated, which usually means it needs to be checked in. However, to satisfy "make distcheck", only copy it if the input template exists, if the input template does not exist we are in an out of tree build.	4 months ago
Shivani Bhardwaj	cff611a284	workflows: use aggressive-cleanup option w s-v ... on the Fedora 41 + codecov job to avoid running out of disk space.	4 months ago