aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
18,228 Commits
8 Branches
173 Tags
254 MiB
main
main-7.0.x
main-8.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '078ab2ff70'
${ noResults }
Commit Graph

151 Commits (078ab2ff7028ebb8243ef8f5467acd7e84c26387)

Author SHA1 Message Date
Victor Julien 4b0e3d79bb detect/analyzer: support frames in pattern dump 4 years ago
Victor Julien 3cbe33de57 detect/analyzer: add frame support 5 years ago
Victor Julien 707b75ccda detect: split register time and detect load time buffer funcs 5 years ago
Victor Julien 5bcaae0a01 detect: use hashes for all buffer to id 
Instead of a map that is constantly realloc'd, use 2 hash tables for
DetectBufferType entries: one by name (+transforms), the other by
id. Use these everywhere.
 5 years ago
Philippe Antoine cb30772372 style: remove latest warnings 
about unused variables
 5 years ago
Philippe Antoine f6ba3699bb flowint: same analysis warnings as flowbits 5 years ago
Philippe Antoine bce3c46874 pcre2: remove PCRE1 as dependency 5 years ago
Philippe Antoine 2a1690e110 pcre2: move header include to suricata-common only 5 years ago
Philippe Antoine 3633c48e6e pcre2: migrate utility uses of pcre 5 years ago
Victor Julien 22dfcc928c detect/analyzer: use rule style pretty print for patterns 5 years ago
Victor Julien 5703aec44e detect/content: generalize pattern pretty printing 5 years ago
Victor Julien a2e37522bb detect/analyze: dump patterns facility 
Dump all patterns to `patterns.json`, with the pattern, a total count (`cnt`),
count of how many times this pattern is the mpm (`mpm`) and some of the flags.

Patterns are listed per buffer. So payload, http_uri, etc.
 5 years ago
Victor Julien f49c181ceb detect/analyzer: display per rule prefilter details 5 years ago
Victor Julien 1c5842df12 detect/analyzer: add per rule mpm block to rules.json 5 years ago
Victor Julien b55b327db1 detect/analyzer: suggest modern keywords 5 years ago
Victor Julien 57f7612ffd detect/analyzer: fix json output for warnings/notes 5 years ago
Philippe Antoine 707f027231 protos: renaming ALPROTO_HTTP* constants 
Having now ALPROTO_HTTP1, ALPROTO_HTTP2 and ALPROTO_HTTP

Run with 3 sed commands
git grep ALPROTO_HTTP | cut -d: -f1 | uniq |
 xargs sed -i -e 's/ALPROTO_HTTP/ALPROTO_HTTP1/g'
git grep ALPROTO_HTTP12 | cut -d: -f1 | uniq |
 xargs sed -i -e 's/ALPROTO_HTTP12/ALPROTO_HTTP2/g'
git grep ALPROTO_HTTP1_ANY | cut -d: -f1 | uniq |
 xargs sed -i -e 's/ALPROTO_HTTP1_ANY/ALPROTO_HTTP/g'

and then running clang-format
 5 years ago
Victor Julien 0eb692e500 mingw: fix format string warnings 6 years ago
Victor Julien 7facf5785f detect/analyzer: convert to jsonbuilder 6 years ago
Shivani Bhardwaj 6f7d8e50c8 src: use FatalError whenever possible 
Replaces all patterns of SCLogError() followed by exit() with
FatalError(). Cocci script to do this:

@@
constant C;
constant char[] msg;
@@

- SCLogError(C,
+ FatalError(SC_ERR_FATAL,
  msg);
- exit(EXIT_FAILURE);

Closes redmine ticket 3188.
 6 years ago
Jeff Lucovsky 9c47b8c1bf general: Fix spelling error 6 years ago
Jeff Lucovsky 31e2cff9cb detect/analysis: Warn if required feature missing 7 years ago
Jeff Lucovsky 6c2cdbb5f0 analysis: exit if table entries are stale 
This commit causes Suricata to exit when a buffer from the analyzer
table is not recognized.

Since the table must match what's registered, exiting will bring noticed
to the condition.
 7 years ago
Jeff Lucovsky fcfb679893 detect/analyzer: Suppress direction warnings 
This commit ensures direction warnings for ICMP v4 and v6
are suppressed and corrects check so that both protocols
are checked (instead of the same protocol being checked twice).
 7 years ago
Jeff Lucovsky 8f4f1cb633 detect/analyzer: Improved fast pattern display 
When transforms are part of a rule, improve information displayed with
fast patterns to include the original buffer name and whether any
transform(s) are applied.
 7 years ago
Jeff Lucovsky c88c1f1e14 detect/analyzer: Suppress direction warnings 
This commit suppresses direction warnings by the rules analyzer for ICMP
and ICMPV6 since it's not actionable.
 7 years ago
Jeff Lucovsky ae198add6d detect/analyzer: Refactor engine analysis code 
This commit changes the analysis code to be table driven to better
identify the rule elements covered by the analysis.
 7 years ago
Jeff Lucovsky 79d308db73 detect/analyzer: Add missing http_accept_enc handling 7 years ago
Jeff Lucovsky 140bfd7b0c detect/analyzer: remove HAVE_LIBJANSSON cpp guards 7 years ago
Jeff Lucovsky 87bfce025d spelling: correct spelling typo 7 years ago
Jeff Lucovsky dcf5e247ca detect/analyzer: add support for http_content_type 7 years ago
Victor Julien 4dff903b35 detect: introduce pkt mpm engines 
Instead of the hardcode L4 matching in MPM that was recently introduced,
add an API similar to the AppLayer MPM and inspect engines.

Share part of the registration code with the AppLayer.

Implement for the tcp.hdr and udp.hdr keywords.
 7 years ago
Victor Julien bdf53f449c detect/tcp: rename tcp keyword files 7 years ago
Jeff Lucovsky 0960ca0d00 detect/analyzer Add missing HTTP values 
This changeset adds recognition of missing HTTP values
- Raw host
- Header names
- Server body
- User agent
 7 years ago
Jeff Lucovsky 462a4e2b5b detect/analyzer: Improve warning message 
This changeset modifies the warning printed when a rule
is determined to detect in both directions.
 7 years ago
Jeff Lucovsky 1b1fc9fee2 rule-analyzer: Ensure content counts are accurate 
Fix for issue 2605.  Make sure that content is counted,
even if none of the specific content types are matched.
 7 years ago
Travis Green 1743cf5dcd engine-analysis: add support for http_host buffer 
Add support for http_host buffer for more accurate reporting.
Bug: #2798
 8 years ago
Victor Julien 014056f686 detect/analyzer: add detection for sigs that could use http keywords 8 years ago
Victor Julien 127937b2dd detect/analyzer: add debug statements 8 years ago
Victor Julien 64d75496b8 detect/analyzer: add notes (and warnings) 8 years ago
Victor Julien 38b698c50f detect/analyzer: show pattern that is used by mpm 
Set a new DETECT_CONTENT_MPM flag on the pattern that is selected
during setup.
 8 years ago
Victor Julien 35c5ae3458 detect: limit flush logic to sigs that need it 
Limit the early 'flush' logic to sigs that actually need to match
on both stream and http bodies.
 8 years ago
Victor Julien f35a3bbae0 detect/analyzer: add built-in lists 8 years ago
Victor Julien 6694593cc0 detect/analyzer: add Signature::flags 8 years ago
Victor Julien c0adff3770 detect: remove STATE_MATCH flag use at runtime 
Instead, use it only at init time and use Signature::app_inspect
directly at runtime.
 8 years ago
Victor Julien 3c72d67635 detect/analyzer: log mask flags and more engine details 8 years ago
Victor Julien 709b3bc1e4 rule analyzer: simple rules to json dumper 9 years ago
Victor Julien 0de86211c6 detect: register dynamic buffers into de_ctx 
Register buffers that are created during rule parsing. Currently
this means an existing buffer with one or more transformations.
 9 years ago
Victor Julien a499a44f7a detect: move buffer type map into detect ctx 
Move previously global table into detect engine ctx. Now that we
can register buffers at rule loading time we need to take concurrency
into account.

Move DetectBufferType to detect.h and update DetectBufferCtx API calls
to include a detect engine ctx reference.
 9 years ago
Victor Julien ddd3c0b1df detect/analyzer: formatting fixup 9 years ago
Victor Julien ab1200fbd7 compiler: more strict compiler warnings 
Set flags by default:

    -Wmissing-prototypes
    -Wmissing-declarations
    -Wstrict-prototypes
    -Wwrite-strings
    -Wcast-align
    -Wbad-function-cast
    -Wformat-security
    -Wno-format-nonliteral
    -Wmissing-format-attribute
    -funsigned-char

Fix minor compiler warnings for these new flags on gcc and clang.
 9 years ago
Victor Julien cfdd934aba dnp3: dynamic buffers/lists 10 years ago
Victor Julien 9ba386a141 tls: dynamic buffers 10 years ago
Victor Julien d9b3ae6cd6 dns: use dynamic buffers 10 years ago
Victor Julien 6f867c3c73 http_raw_uri: dynamic buffer 10 years ago
Victor Julien ee55aefa1c http_client_body: dynamic buffer 10 years ago
Victor Julien e7d5e845c7 http_header / http_raw_header: dynamic buffers 10 years ago
Victor Julien b694d96e22 http_stat_msg: dynamic buffer 10 years ago
Victor Julien 7e3ab4f5ea http_stat_code: dynamic buffer 10 years ago
Victor Julien 67b7d9734e http_cookie: dynamic buffer 10 years ago
Victor Julien 54604c7bf2 http_user_agent: dynamic buffer 10 years ago
Victor Julien 6346a074a7 http_uri: dynamic buffer 
Clean up tests
 10 years ago
Victor Julien e34102d67a http_method: make list dynamic 10 years ago
Victor Julien 6bd37611ee file_data: dynamic buffer 10 years ago
Victor Julien 779d40cedf detect: remove hardcoded sm_list logic from setup 
Introduce utility functions to aid this.
 10 years ago
Victor Julien 04592efb76 detect: buffer type API 
To replace the hardcoded SigMatch list id's, use this API to register
and query lists by name.

Also allow for registering descriptions and whether mpm is supported.

Registration is only allowed at startup.
 10 years ago
Victor Julien f370e88135 detect: move init only Signature members to init_data 10 years ago
Victor Julien 8edc954e82 detect: get rid of Signature::sm_lists 
Instead use the lists in init_data during setup and the SigMatchData
arrays during runtime.
 10 years ago
Jason Ish 1a31bded4a DNP3: dnp3_data, dnp3_func, dnp3_ind, dnp3_obj rule keywords 10 years ago
Victor Julien 0ed119068d detect-app-layer-protocol: implement prefilter 
Introduce 'Protocol detection'-only rules. These rules will only be
fully evaluated when the protocol detection completed. To allow
mixing of the app-layer-protocol keyword with other types of matches
the keyword can also inspect the flow's app-protos per packet.

Implement prefilter for the 'PD-only' rules.
 10 years ago
Victor Julien 9195708d58 detect analyzer: give minimal prefilter info 10 years ago
Mats Klepsland 4172c4c8ac tls: add (mpm) keyword tls_cert_subject 
This keyword is a replacement for tls.subject.
 10 years ago
Mats Klepsland 9b2717799c tls: add (mpm) keyword tls_cert_issuer 
This keyword is a replacement for tls.issuerdn.
 10 years ago
Mats Klepsland a13df67864 detect: add (mpm) keyword for tls_sni 
Match on server name indication (SNI) extension in TLS using tls_sni
keyword, e.g:

alert tls any any -> any any (msg:"SNI test"; tls_sni;
        content:"example.com"; sid:12345;)
 10 years ago
Victor Julien bfe49b60f7 rule analyzer: add no/both direction warning 10 years ago
Victor Julien 0d3f671b55 detect: constify mpm/detect funcs 10 years ago
Victor Julien 2c8e8c2516 dns: rename type so it's purpose is more clear 11 years ago
Victor Julien 1ed8d7b538 detect analizer: fix minor coverity warning 
** CID 1298889:  Integer handling issues  (NEGATIVE_RETURNS)
/src/detect-engine-analyzer.c: 102 in EngineAnalysisFP()
 11 years ago
Victor Julien 8d0b090150 engine-analysis: print fast_pattern summary 
When using engine analysis for print fast_pattern stats, print a
short summary at the end containing per buffer:
- smallest fp
- biggest fp
- number of patterns
- avg fp len
 11 years ago
Giuseppe Longo 41a1a9f4af find and replace HSBDMATCH by FILEDATA 
This commit do a find and replace of the following:

- DETECT_SM_LIST_HSBDMATCH by DETECT_SM_LIST_FILEDATA
  sed -i 's/DETECT_SM_LIST_HSBDMATCH/DETECT_SM_LIST_FILEDATA/g' src/*

- HSBD by FILEDATA:
  sed -i 's/HSBDMATCH/FILEDATA/g' src/*
 11 years ago
Victor Julien d834173bb8 detect-flow: use dedicated flags 
The flow keyword used flag names that were shared with the
Packet::flowflags field. Some of the flags were'nt used by the packet
though. This lead to waste of some 'flag space'.

This patch defines dedicated flags for the flow keyword and removes
the otherwise unused flags from the FLOW_PKT_* space.
 12 years ago
Ken Steele 8f1d75039a Enforce function coding standard 
Functions should be defined as:

int foo(void)
{
}

Rather than:
int food(void) {
}

All functions where changed by a script to match this standard.
 12 years ago
Anoop Saldanha 127ef8f903 Use a typdef AppProto <-> uint16_t for representing app layer protocol. 
Some minor refactoring/cleanup, including renaming functions.
 13 years ago
Ken Steele d4dd18eb85 Clean up SCLocalTime() usage 
Remove cast of return type from SCLocalTime() as it is not needed.
Replace last use of localtime_r() with SCLocalTime().
 13 years ago
Eric Leblond 34abd818dd Prefix util-conf function with Config 13 years ago
Eric Leblond 54006de40c Use new function GetLogDirectory() 13 years ago
Victor Julien 43ba5a677e DNS: enable mpm/fast_pattern support for dns_query 13 years ago
Anoop Saldanha f58c6589b4 We now print content flags in engine fp analyzer. 14 years ago
Last G 8ae11f73b2 Added parentheses to fix Eclipse static code analysis 
Fixed bug in action priority (REJECT_DST had lowest prio)
 14 years ago
Eric Leblond 86709f5e9d rule analyser: display message for invalid signatures 14 years ago
Eric Leblond c7cfbb71c9 engine-analyzer: fix typo in message 14 years ago
Eric Leblond b0471fb8e4 rule analyser: add msg if rule is ipv4 or ipv6 only 14 years ago
Anoop Saldanha 7a7cd6999e feature #558. 
Print FP info in rule analysis + other cleanup.
 14 years ago
Victor Julien f1b6f7a9e6 rule analyzer: make analyzer aware of http_user_agent pcre flag /V. 14 years ago
Victor Julien bd6b865473 rule analyzer: fix fast pattern analyzer reporting wrong filename (same as rule analyzer). 14 years ago
Anoop Saldanha bf6cd48259 if a sig's set as stream sig only, don't updated it as both stream and pkt sig if offset/depth's present 
bug #495 - update rule analyzer to not warn on offset_depth-tcp_pkt update if sig is stream only

bug #497 - rule_warnings fixed
 14 years ago
Anoop Saldanha 7833883a8f bug #496 - don't warn about offset/depth for packet sigs 14 years ago
Victor Julien c2e484ae88 rule analyzer: fix detecting stream match 14 years ago
Anoop Saldanha 946a9ece32 rule analyzer updated for sigs with offset/depth set + alproto set 14 years ago
Victor Julien 850379552a rule analyzer: minor cleanups. Fix warning-only setting, allow true/yes/enabled for yaml option. 14 years ago