Next/20201003/v9 #5464
Merged
Next/20201003/v9 #5464
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
It a protocol is found in a first direction, we should run the probing parser, even if it is not in the known ports. That can happen for HTTP2, where client magic is detected, then server probe can be run
If a pattern matches in the other direction, after probing parser finished without finding a protocol, we will rerun the probing parser, which will include the newly protocol found by its pattern
Also handles better the state so as not to revert from HTTP2StateHalfClosedClient to HTTP2StateDataServer and not go to final HTTP2StateClosed
And evict entries accordingly to maximum size
Fix Rust app-layer generation. Main parser file was being named gopher.rs instead of the name of the protocol.
This commit changes the size of reporting variables to be dynamic based on the buffer ids in use instead of a fixed value to address a SEGV when the fixed value was less than the max buffer/type id in use.
This commit corrects a copy/paste error handling the `include-mpm-stats` configuration setting.
This commit returns the basename of a file, if it exists in the same way that `basename(1)` works.
This commit changes the name of the file used with threaded eve logging to better support log rotation Instead of using "eve.json.N" and creating potential issues with log rotation (which also uses a ".N" suffix), the eve logs will be named "eve.N.json" when threaded.
This avoids a potential casting to uint64_t of -1, leading to a very high upper bound of the tx loop.
This was referenced Oct 5, 2020
Closed
jufajardini
added a commit
to jufajardini/suricata
that referenced
this pull request
Dec 22, 2022
The eve logs have a field alert.action that may say something like 'allowed' even if a packet gets blocked by some other rules. To make this more clear, add a field with the final verdict of what the engine did to a given packet in the packet event_type with the action applied to the packet, no based on a single alert/rule. Bug OISF#5464
jufajardini
added a commit
to jufajardini/suricata
that referenced
this pull request
Dec 22, 2022
The eve logs have a field alert.action that may say something like 'allowed' even if a packet gets blocked by some other rules. To make this more clear, add a field with the final verdict of what the engine did to a given packet in the packet event_type with the action applied to the packet, no based on a single alert/rule. Bug OISF#5464
jufajardini
added a commit
to jufajardini/suricata
that referenced
this pull request
Dec 23, 2022
The eve logs have a field alert.action that may say something like 'allowed' even if a packet gets blocked by some other rules. To make this more clear, add a field with the final verdict of what the engine did to a given packet in the packet event_type with the action applied to the packet, no based on a single alert/rule. Bug OISF#5464
jufajardini
added a commit
to jufajardini/suricata
that referenced
this pull request
Dec 23, 2022
The eve logs have a field alert.action that will say something like 'allowed' even if a packet gets blocked by some other rule. To make this less ambiguous, added a field to the alert and drop events indicating the final verdict by the engine for a given packet. Bug OISF#5464
jufajardini
added a commit
to jufajardini/suricata
that referenced
this pull request
Jan 5, 2023
The eve logs have a field alert.action that will say something like 'allowed' even if a packet gets blocked by some other rule. To make this less ambiguous, added a field to the alert and drop events indicating the final verdict by the engine for a given packet. Bug OISF#5464
jufajardini
added a commit
to jufajardini/suricata
that referenced
this pull request
Jun 29, 2023
Add ability to output final verdict for packet, based on matched rules. Related to Task OISF#5464
jufajardini
added a commit
to jufajardini/suricata
that referenced
this pull request
Jul 6, 2023
Besides having the alert's verdict as a part of the alert event, also offer the ability to have it as an independent event type. Related to Task OISF#5464
jufajardini
added a commit
to jufajardini/suricata
that referenced
this pull request
Jul 6, 2023
Related to Bug OISF#5464
jufajardini
added a commit
to jufajardini/suricata
that referenced
this pull request
Jul 6, 2023
Related to Bug OISF#5464
jufajardini
added a commit
to jufajardini/suricata
that referenced
this pull request
Jul 11, 2023
Related to Bug OISF#5464
jufajardini
added a commit
to jufajardini/suricata
that referenced
this pull request
Jul 11, 2023
Related to Bug OISF#5464
jufajardini
added a commit
to jufajardini/suricata
that referenced
this pull request
Jul 11, 2023
If packet->action is never set to 'pass', we won't know if a packet had a 'pass' verdict. Related to Bug OISF#5464
jufajardini
added a commit
to jufajardini/suricata
that referenced
this pull request
Jul 12, 2023
Related to Bug OISF#5464
jufajardini
added a commit
to jufajardini/suricata
that referenced
this pull request
Jul 12, 2023
Related to Bug OISF#5464
jufajardini
added a commit
to jufajardini/suricata
that referenced
this pull request
Jul 12, 2023
If packet->action is never set to 'pass', we won't know if a packet had a 'pass' verdict. Related to Bug OISF#5464
jufajardini
added a commit
to jufajardini/suricata
that referenced
this pull request
Jul 12, 2023
Related to Bug OISF#5464
jufajardini
added a commit
to jufajardini/suricata
that referenced
this pull request
Jul 12, 2023
If packet->action is never set to 'pass', we won't know if a packet had a 'pass' verdict. Related to Bug OISF#5464
jufajardini
added a commit
to jufajardini/suricata
that referenced
this pull request
Jul 12, 2023
Related to Bug OISF#5464
jufajardini
added a commit
to jufajardini/suricata
that referenced
this pull request
Jul 12, 2023
Related to Bug OISF#5464
jufajardini
added a commit
to jufajardini/suricata
that referenced
this pull request
Jul 13, 2023
Related to Bug OISF#5464
jufajardini
added a commit
to jufajardini/suricata
that referenced
this pull request
Jul 13, 2023
Related to Bug OISF#5464
jufajardini
added a commit
to jufajardini/suricata
that referenced
this pull request
Jul 13, 2023
Related to Bug OISF#5464
jufajardini
added a commit
to jufajardini/suricata
that referenced
this pull request
Jul 13, 2023
Related to Bug OISF#5464
jufajardini
added a commit
to jufajardini/suricata
that referenced
this pull request
Jul 13, 2023
Related to Bug OISF#5464
victorjulien
pushed a commit
to victorjulien/suricata
that referenced
this pull request
Jul 13, 2023
Related to Bug OISF#5464
victorjulien
pushed a commit
to victorjulien/suricata
that referenced
this pull request
Jul 13, 2023
Related to Bug OISF#5464
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
#5463 with commits squashed
#5460
#5457
#5435
PRScript output (if applicable):
Passed
#suricata-verify-pr:
#suricata-verify-repo:
#suricata-verify-branch:
#suricata-update-pr:
#suricata-update-repo:
#suricata-update-branch:
#libhtp-pr:
#libhtp-repo:
#libhtp-branch: