-
Notifications
You must be signed in to change notification settings - Fork 1.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Backports 5.0.x V2 Batched backports of several issues #4723
Commits on Jan 29, 2020
-
flow: expose last time as a function
This function returns the individual components of the timeval in output pointers making it suitable for use over Rust FFI.
Configuration menu - View commit details
-
Copy full SHA for 95a408f - Browse repository at this point
Copy the full SHA 95a408fView commit details -
smb: handle file transactions post-GAP
After a GAP all normal transactions are closed. File transactions are left open as they can handle GAPs in principle. However, the GAP might have contained the closing of a file and therefore it may remain active until the end of the flow. This patch introduces a time based heuristic for these transactions. After the GAP all file transactions are stamped with the current timestamp. If 60 seconds later a file has seen no update, its marked as closed. This is meant to fix resource starvation issues observed in long running SMB sessions where packet loss was causing GAPs.
Configuration menu - View commit details
-
Copy full SHA for 060781c - Browse repository at this point
Copy the full SHA 060781cView commit details
Commits on Feb 6, 2020
-
Configuration menu - View commit details
-
Copy full SHA for 36902ba - Browse repository at this point
Copy the full SHA 36902baView commit details
Commits on Feb 10, 2020
-
Configuration menu - View commit details
-
Copy full SHA for 8a6d4ba - Browse repository at this point
Copy the full SHA 8a6d4baView commit details
Commits on Feb 11, 2020
-
Configuration menu - View commit details
-
Copy full SHA for 43ee9d8 - Browse repository at this point
Copy the full SHA 43ee9d8View commit details -
init: Fix dropping privileges in nflog runmode
Using the run-as configuration option with the nflog capture method results in the following error during the startup of suricata: [ERRCODE: SC_ERR_NFLOG_BIND(248)] - nflog_bind_pf() for AF_INET failed This is because SCDropMainThreadCaps does not have any capabilities defined for the nflog runmode (unlike other runmodes). Therefore, apply the same capabilities to the nflog runmode that are already defined for the nfqueue runmode. This has been confirmed to allow suricata start and drop its privileges in the nflog runmode. Fixes redmine issue OISF#3265. Signed-off-by: Timo Sigurdsson <public_timo.s@silentcreek.de> (cherry picked from commit 1262ecb)
Configuration menu - View commit details
-
Copy full SHA for e1b363b - Browse repository at this point
Copy the full SHA e1b363bView commit details
Commits on Feb 12, 2020
-
Configuration menu - View commit details
-
Copy full SHA for 72858ac - Browse repository at this point
Copy the full SHA 72858acView commit details -
Configuration menu - View commit details
-
Copy full SHA for 6865043 - Browse repository at this point
Copy the full SHA 6865043View commit details -
Configuration menu - View commit details
-
Copy full SHA for bd3fac7 - Browse repository at this point
Copy the full SHA bd3fac7View commit details -
Configuration menu - View commit details
-
Copy full SHA for 04d546d - Browse repository at this point
Copy the full SHA 04d546dView commit details -
Configuration menu - View commit details
-
Copy full SHA for 5067357 - Browse repository at this point
Copy the full SHA 5067357View commit details -
Configuration menu - View commit details
-
Copy full SHA for ff1076e - Browse repository at this point
Copy the full SHA ff1076eView commit details -
Configuration menu - View commit details
-
Copy full SHA for 966df16 - Browse repository at this point
Copy the full SHA 966df16View commit details -
Configuration menu - View commit details
-
Copy full SHA for 0fce017 - Browse repository at this point
Copy the full SHA 0fce017View commit details -
Configuration menu - View commit details
-
Copy full SHA for 3ee1f57 - Browse repository at this point
Copy the full SHA 3ee1f57View commit details -
Configuration menu - View commit details
-
Copy full SHA for d635eab - Browse repository at this point
Copy the full SHA d635eabView commit details -
Configuration menu - View commit details
-
Copy full SHA for 67d53f9 - Browse repository at this point
Copy the full SHA 67d53f9View commit details -
Configuration menu - View commit details
-
Copy full SHA for e8573f4 - Browse repository at this point
Copy the full SHA e8573f4View commit details -
Configuration menu - View commit details
-
Copy full SHA for 11a97da - Browse repository at this point
Copy the full SHA 11a97daView commit details -
Configuration menu - View commit details
-
Copy full SHA for 89757fe - Browse repository at this point
Copy the full SHA 89757feView commit details -
Configuration menu - View commit details
-
Copy full SHA for 15ad0d5 - Browse repository at this point
Copy the full SHA 15ad0d5View commit details -
Configuration menu - View commit details
-
Copy full SHA for 471bb2d - Browse repository at this point
Copy the full SHA 471bb2dView commit details -
Configuration menu - View commit details
-
Copy full SHA for 9985cc2 - Browse repository at this point
Copy the full SHA 9985cc2View commit details -
Configuration menu - View commit details
-
Copy full SHA for ac800d0 - Browse repository at this point
Copy the full SHA ac800d0View commit details -
nfs: implement post-GAP transaction cleanup
Close all prior transactions in the direction of the GAP, except the file xfers. Those use their own logic described below. After a GAP all normal transactions are closed. File transactions are left open as they can handle GAPs in principle. However, the GAP might have contained the closing of a file and therefore it may remain active until the end of the flow. This patch introduces a time based heuristic for these transactions. After the GAP all file transactions are stamped with the current timestamp. If 60 seconds later a file has seen no update, its marked as closed. This is meant to fix resource starvation issues observed in long running SMB sessions where packet loss was causing GAPs. Due to the similarity of the NFS and SMB parsers, this issue is fixed for NFS as well in this patch. Bug OISF#3424. Bug OISF#3425. (cherry picked from commit f68c255)
Configuration menu - View commit details
-
Copy full SHA for 908ba0f - Browse repository at this point
Copy the full SHA 908ba0fView commit details
Commits on Feb 13, 2020
-
stream/reassembly: fix data overlap check
Fix function CheckOverlap bug. (cherry picked from commit 2456f27)
Configuration menu - View commit details
-
Copy full SHA for 61e938f - Browse repository at this point
Copy the full SHA 61e938fView commit details -
Configuration menu - View commit details
-
Copy full SHA for 8ad874e - Browse repository at this point
Copy the full SHA 8ad874eView commit details -
Configuration menu - View commit details
-
Copy full SHA for fd3c7d5 - Browse repository at this point
Copy the full SHA fd3c7d5View commit details -
Configuration menu - View commit details
-
Copy full SHA for 988e74d - Browse repository at this point
Copy the full SHA 988e74dView commit details
Commits on Mar 22, 2020
-
stream: fix direction flags in corner case
When a TCP DNS flow would start with a GAP on the TS side, the successful protocol detection on the TC side would trigger 'opposing side' reassembly and app-layer processing. In this case the stream flags would indicate the wrong direction and the wrong parser would be called. (cherry picked from commit efee458)
Configuration menu - View commit details
-
Copy full SHA for 306adf2 - Browse repository at this point
Copy the full SHA 306adf2View commit details -
dag: Skip over ERF_TYPE_META records
Suricata generates an error on unrecognised ERF types. Suricata should ignore ERF 'Provenance' records with ERF_TYPE_META. (cherry picked from commit 47082dd)
Configuration menu - View commit details
-
Copy full SHA for 1661248 - Browse repository at this point
Copy the full SHA 1661248View commit details -
smtp/mime: Restrict file name lengths
This commit places restrictions on the length of the file name specified in attachments (`name=` or `filename=`) to `NAME_MAX`. Names exceeding these limits will be truncated and processing will continue with the truncated name. (cherry picked from commit d0d20bd)
Configuration menu - View commit details
-
Copy full SHA for 6e69781 - Browse repository at this point
Copy the full SHA 6e69781View commit details -
smtp/mime: Set event when name exceeds limit
(cherry picked from commit 130b8d2)
Configuration menu - View commit details
-
Copy full SHA for f02ee89 - Browse repository at this point
Copy the full SHA f02ee89View commit details -
Configuration menu - View commit details
-
Copy full SHA for 96c1a3e - Browse repository at this point
Copy the full SHA 96c1a3eView commit details -
mime: Test cases for filename length limit
(cherry picked from commit c92975e)
Configuration menu - View commit details
-
Copy full SHA for 821e43c - Browse repository at this point
Copy the full SHA 821e43cView commit details -
util-error: define SC_ERR_PCRE_COPY_SUBSTRING
(cherry picked from commit bcea730)
Configuration menu - View commit details
-
Copy full SHA for 174e3f3 - Browse repository at this point
Copy the full SHA 174e3f3View commit details -
Configuration menu - View commit details
-
Copy full SHA for 7a6e616 - Browse repository at this point
Copy the full SHA 7a6e616View commit details -
detect/ssl_state: Fix memory leaks from pcre_get_substring
This commit replaces usages of pcre_get_substring with pcre_copy_substring to avoid leaking memory on error conditions. (cherry picked from commit 6c35039)
Configuration menu - View commit details
-
Copy full SHA for 6597959 - Browse repository at this point
Copy the full SHA 6597959View commit details -
detect/flowvar: Fix memory leaks from pcre_get_substring
This commit replaces usages of pcre_get_substring with pcre_copy_substring to avoid leaking memory on error conditions. (cherry picked from commit 9fe51a8)
Configuration menu - View commit details
-
Copy full SHA for cd89363 - Browse repository at this point
Copy the full SHA cd89363View commit details -
detect/filestore: Fix memory leaks from pcre_get_substring
This commit replaces usages of pcre_get_substring with pcre_copy_substring to avoid leaking memory on error conditions. (cherry picked from commit c2071e1)
Configuration menu - View commit details
-
Copy full SHA for e57637e - Browse repository at this point
Copy the full SHA e57637eView commit details -
Corrects misplaced backticks preventing proper formatting of `mpm-algo` section. (cherry picked from commit 8c132c0)
Configuration menu - View commit details
-
Copy full SHA for 14a789f - Browse repository at this point
Copy the full SHA 14a789fView commit details -
Configuration menu - View commit details
-
Copy full SHA for 8d946d7 - Browse repository at this point
Copy the full SHA 8d946d7View commit details -
Configuration menu - View commit details
-
Copy full SHA for 237964a - Browse repository at this point
Copy the full SHA 237964aView commit details -
decode/erspan: ERSPAN TypeI configurable
For the backport, ERSPAN TypeI decode is 1. Disabled by default 2. Configurable: `decoder.erspan_typeI.enabled` (cherry picked from commit ae6beed)
Configuration menu - View commit details
-
Copy full SHA for 33b56b3 - Browse repository at this point
Copy the full SHA 33b56b3View commit details -
detect/parse: move spaces skip up the stack
Switch to isspace() as well. (cherry picked from commit 52970d8)
Configuration menu - View commit details
-
Copy full SHA for a3a2ea0 - Browse repository at this point
Copy the full SHA a3a2ea0View commit details
Commits on Mar 23, 2020
-
doc: adds doc for ipv4.hdr signature keyword
(cherry picked from commit 0715e13)
Configuration menu - View commit details
-
Copy full SHA for 52a7358 - Browse repository at this point
Copy the full SHA 52a7358View commit details -
doc: Remove bitmask documentation
This commit removes documentation for the never-implemented bitmask option for the `byte_jump` and `byte_test` keywords.
Configuration menu - View commit details
-
Copy full SHA for 3d7f654 - Browse repository at this point
Copy the full SHA 3d7f654View commit details -
Configuration menu - View commit details
-
Copy full SHA for db6edbc - Browse repository at this point
Copy the full SHA db6edbcView commit details