Jeff Lucovsky [Tue, 4 Nov 2025 14:37:57 +0000 (09:37 -0500)]
doc/luaxform: Remove init function from example
Issue: 8035
The `luaxform` transform doesn't support the `init` function. This
commit removes that from the example and clarifies how functions in the
Lua script are used.
Victor Julien [Sat, 1 Nov 2025 16:58:50 +0000 (17:58 +0100)]
eve/verdict: more explicit pass handling
Instead of indexing `Packet::alerts` to find out if the action should
be `ACTION_PASS`, add an arguement to make this explicit from the alert
logging logic.
Victor Julien [Sat, 1 Nov 2025 14:06:54 +0000 (15:06 +0100)]
detect/alert: fully add pass-only rules to alert queue
Pass-only rules were previously stored in Packet::alerts, but not
correctly. The `cnt` wasn't incremented leaving it in a weird state.
This patch changes the logic to have a `pass` entry be added to the
queue as well as incrementing the `cnt`. As a consequence of this the
alert logging needs to explicitly check for `PacketAlert::action` having
`ACTION_ALERT` set now.
Victor Julien [Sat, 1 Nov 2025 13:27:56 +0000 (14:27 +0100)]
detect/threshold: set missing alert flag in rate_filter
ACTION_ALERT is supposed to be set now, but wasn't for rate_filter.
This becomes important in a follow up patch where only PacketAlert
entries with `action` `ACTION_ALERT` are logged in alert logging.
Usage of Vec<u8> instead of Box<u8> gave the ability to callers
to grow the buffer (indefinitely)
This was regressed in 16fee333687d9fac72a1cf5d37ff08bfb780b3ed
Additionnaly, use rust WriteZero instead of WouldBlock as a more
fitting error when cursor is full, as that error kind is the
one tested by callers.
Li Heng [Fri, 31 Oct 2025 02:01:17 +0000 (10:01 +0800)]
snmp: can be set to detection-only
Realloc alp_ctx.ctxs when a dynamic alproto is registered and
g_alproto_max increases. So dynamic alproto can be treated as
real/normal ones. And app-layer switch can be set to any value
of no/deteciton-only/yes.
Shivani Bhardwaj [Fri, 31 Oct 2025 10:52:38 +0000 (16:22 +0530)]
src: check retval of VarNameStoreRegister
VarNameStoreRegister can return 0 in case of any error conditions.
Handle this case in all the users of this function. It is an unlikely
event so add branch assistance accordingly.
Most call sites use a casula SCFree fn to get rid of the DetectXbitsData
in case of an error. However, if a varname is also registered, that must
be unregistered too. Fix all the free calls by replacing them with the
appropriate DetectXbitFree fn.
The fn DetectFlowvarDataFree checks if the pointer (DetectFlowvarData)
passed to it is valid. So, the checks for NULL in the call sites can
safely be removed.
The fn DetectFlowintFree checks if the pointer (DetectFlowintData)
passed to it is valid. So, the checks for NULL in the call sites can
safely be removed.
In case of an error a varname id is set to 0. Ideally, it shouldn't be
found in the hash table lookup but add a check anyway to avoid obtaining
the mutex lock and performing the lookup.
Andreas Dolp [Wed, 29 Oct 2025 20:43:04 +0000 (21:43 +0100)]
python/Makefile.am: fix file permissions of python/suricata/config/defaults.py
The install command, by default, sets 0755 if -m is not specified, so the
file python/suricata/config/defaults.py will be marked as an executable,
though it isn't.
Victor Julien [Fri, 31 Oct 2025 08:38:55 +0000 (09:38 +0100)]
lua: remove luajit pushlstring workaround
81ee6f5aadeb ("lua: push correct length back through ScFlowvarGet, work around valgrind warning")
added a workaround for valgrind warnings in pushing a string buffer
into the lua state. This is no longer needed as tested with both
address sanitizer and valgrind.
Jason Ish [Mon, 20 Oct 2025 00:36:27 +0000 (18:36 -0600)]
detect/http2: call correct free function on errors
Fix cases where the wrong free function was being called in error
handlers.
DetectHTTP2sizeUpdateSetup was calling DetectHTTP2settingsFree instead
of DetectHTTP2sizeUpdateFree in error case.
Moving http2.priority and http2.window to multi-integers, instead
of basic integers only modified the Free callback, but the
Setup function was still using the direct call to old obsolete free
function.
Using the callback Free abstration in Setup, allows to be
consistent and have less code to change.
Jeff Lucovsky [Thu, 21 Aug 2025 13:57:27 +0000 (09:57 -0400)]
engine/mt: Ensure master lock held for reload
Issue: 7819
DetectEngineReload must hold the `master->lock`; recent changes changed
the locking usages to avoid deadlock when registering/handling tenants.
These changes added the presumption that the master lock is held at a
higher level. Coverity highlighted that the lock is not held
consistently.
detect/tcp: make tcp.flags a generic integer with bitflags
Ticket: 6724
Allows to use numerical values for example
Also fixes some unit tests that were returning 1 after goto error
FlagsTestParse05 especially took this path as
de->ignored_flags != (TH_SYN|TH_RST) was false
we had de->ignored_flags == 0xff ^ (TH_SYN|TH_RST)
And then, we had a match, instead of what the not-run code
was supposing.
detect/integers: generalize support for bitflags modifier
Ticket: 6724
Allows sugar syntax for bitflags keywords.
While the expressivity does not increase, because we could already
use numerial values with all generic integer modes, this modifier
prefix is used with the strings, and follows the syntax
that is already used for fragbits and tcp.flags keyword.
Shivani Bhardwaj [Sat, 11 Oct 2025 08:45:37 +0000 (14:15 +0530)]
applayer/tls: do not free SAN for decoding error
SSL connp maintains all the state and certificate data that was
parsed/decoded successfully and it must retain that for later usage.
There should be just one place to free this object which is SSLStateFree
for both the directions. By freeing the connp data during parsing error,
there is room for memory errors.
This works so far because the field parsed after this cannot error out so
if there's an error parsing this, it anyway does not exist. However, this
is incorrect and leaves scope for mistakes.
Remove this extra free and treat SAN like all other TLS keywords.
projects / thirdparty / suricata.git / log
