aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
9,574 Commits
8 Branches
173 Tags
180 MiB
main
main-7.0.x
main-8.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '08fb4d790e'
${ noResults }
Commit Graph

8299 Commits (08fb4d790e469a71e2c4e154443ad387194973d7)

Author SHA1 Message Date
Victor Julien 998f32f88c detect/tls: consolidate validity code 8 years ago
Victor Julien ccdafe6697 detect/http-server-body: move tests to tests/ 8 years ago
Victor Julien 2221dd9403 detect: add http.request_body sticky buffer 
Sticky buffer version of the http_client_body content modifier.
 8 years ago
Victor Julien 64987f36fb detect/file-data: move tests into tests/ 8 years ago
Victor Julien 2fa8066f3a detect/file-data: consolidate matching code 8 years ago
Victor Julien 9a8092249e detect/http-client-body: move tests into tests/ 8 years ago
Victor Julien 477e46da78 detect/http-client-body: convert to inspect api v2 8 years ago
Victor Julien ce677abdf0 detect/file-data: minor cleanups 8 years ago
Victor Julien c0767ece9b detect/file-data: minor cleanups and clarifications 8 years ago
Victor Julien 58aa9dca65 detect/http-server-body: code cleanup and test cleanups 8 years ago
Victor Julien 3413757027 detect/http-client-body: code cleanups and test cleanups 8 years ago
Victor Julien 645acb1089 detect: add http.header.raw sticky buffer keyword 
Add parsing tests as well.
 8 years ago
Victor Julien 76fd666cad detect/http_raw_header: move tests into tests/ 8 years ago
Victor Julien 25f974eb29 detect/http_raw_header: use inspect v2 api 8 years ago
Victor Julien c298412947 detect/http_raw_header: minor code cleanups 8 years ago
Victor Julien 85697671b8 detect: add http.header sticky buffer keyword 8 years ago
Victor Julien 31444cd088 detect/http_header: convert parsing tests to use helper 8 years ago
Victor Julien b9bcd4e115 detect/http_header: move tests into tests/ 8 years ago
Victor Julien 5e951a8b06 detect/http_header: inspect v2 api 8 years ago
Victor Julien 74b06b56f2 detect/http_header: test cleanups 8 years ago
Victor Julien 2a61ee13e1 detect/http_header: remove unused func args 8 years ago
Victor Julien dac182741b detect: add http.cookie sticky buffer keyword 8 years ago
Victor Julien ab027cb481 detect/http_cookie: move tests into tests/ 8 years ago
Victor Julien 988cc8468e detect/http_cookie: switch to inspect v2 api 8 years ago
Victor Julien 0aab3ac336 detect/http_cookie: minor cleanups 8 years ago
Victor Julien e222017a29 detect/http_user_agent: set alternative and info flags 8 years ago
Victor Julien b8a0a0d6ea detect: add http.stat_code sticky buffer keyword 8 years ago
Victor Julien 2f342da048 detect/http_stat_code: move tests into tests/ 8 years ago
Victor Julien 382fa2e81d detect/http_stat_code: use inspect v2 api 8 years ago
Victor Julien db7d7b2401 detect/http_stat_code: minor code cleanups 8 years ago
Victor Julien 59c3c748c9 detect: add http.stat_msg sticky buffer keyword 8 years ago
Victor Julien 5dfba01b2e detect/http_stat_msg: move tests to tests/ 8 years ago
Victor Julien 9b9cf2cc5f detect/http_stat_msg: switch to inspect v2 8 years ago
Victor Julien 880724d2ee detect/http_stat_msg: minor code cleanups 8 years ago
Victor Julien e9d43254c8 detect: add http.host.raw sticky buffer 8 years ago
Victor Julien b469938998 detect/http_raw_host: move raw into regular host logic 8 years ago
Victor Julien dc43f35427 detect/http_host: move tests into tests/ 8 years ago
Victor Julien 2c57037611 detect/http_raw_host: use inspect v2 api 8 years ago
Victor Julien 8c8a3473c9 detect/http_raw_host: minor cleanups 8 years ago
Victor Julien e9fcb9d5ef detect/http_method: add http.method sticky buffer 8 years ago
Victor Julien cb332b4cda detect/http_method: move all tests into tests/ 8 years ago
Victor Julien d00732175a detect/http_method: use inspect v2 api 8 years ago
Victor Julien 5fbee04306 detect/http_method: minor cleanups 8 years ago
Victor Julien 4e50df0f55 detect/http: add http.uri.raw sticky buffer keyword 8 years ago
Victor Julien 0a405e27a0 detect/http_raw_uri: code reorganization 
Move registration into http_uri logic, move tests into the other uri
tests. Switch to v2 mpm/inspect APIs.
 8 years ago
Victor Julien e29f13502b detect/http_raw_uri: small cleanups 8 years ago
Victor Julien 10e2731f18 detect/http-uri: move tests into tests/ 8 years ago
Victor Julien 0c879d5041 detect: add http.uri sticky buffer keyword 8 years ago
Victor Julien 789f302d1a detect: add http.host sticky buffer 8 years ago
Victor Julien a0e4c5e79b detect/http-hh: code cleanups 8 years ago
Victor Julien 3111910fc6 detect/http_user_agent: move tests into tests/ 8 years ago
Victor Julien 123ebb2c41 detect: add http.user_agent sticky buffer 8 years ago
Victor Julien fe738014e4 detect/http-ua: remove dead code 8 years ago
Victor Julien e62c75335e detect/http-ua: test cleanups 8 years ago
Victor Julien 33b81f7439 detect: add verbosity of --list-keywords 
Add indicators of content modifier or sticky buffer, and also
allow registering an alternative to a keyword.
 8 years ago
Victor Julien d3e953e5f2 detect: switch keyword flags u16 8 years ago
Victor Julien eb73008ccf detect/transform: add to_sha1 keyword 8 years ago
Victor Julien 75f9c1ae9f detect/transform: add to_md5 keyword 8 years ago
Victor Julien 42d22ddb2a unittests: add signature parse test helper 8 years ago
Victor Julien 705d3b6130 Open 5.0.0-dev branch 8 years ago
Victor Julien 7f38ffc8bc log/stats: fix formatting of long decoder events 8 years ago
Jingyu Yang bb26e6216e source-pcap:set PktAcqBreakLoop as pcap_breakloop 8 years ago
Victor Julien d8634daf74 stream: fix false negative on bad RST 
If a bad RST was received the stream inspection would not happen
for that packet, but it would still move the 'raw progress' tracker
forward. Following good packets would then fail to detect anything
before the 'raw progress' position.

Bug #2770

Reported-by: Alexey Vishnyakov
 8 years ago
Victor Julien fb18a1655c eve.stats: warn that output might miss decoder-events 8 years ago
Victor Julien 0d86263efd eve.stats: make decoder event prefix configurable 8 years ago
Victor Julien 932c2a7ec5 eve: fix missing decoder-events in stats 
In the eve log the decoder events are added as optional counters. This
behaviour is enabled by default. However, lots of the counters are
missing, as the names colide with other counters.

E.g.

decoder.ipv6 counts ipv6 packets
decoder.ipv6.unknown_next_header counts how often an unknown next
    header is encountered.

In this example 'ipv6' would be both a json integer and a json object.
It appears that jansson favours the first that is generated, so the
event counters are mostly missing.

This patch registers them as 'decoder.events.<event>' instead. As
these names are generated on the fly, a hash table to contain the
allocated strings was added as well.
 8 years ago
Victor Julien 0f1fc1f0c8 hash: move string hash funcs into util files 8 years ago
Victor Julien c140505bec decoder: add gre over ipv6 support 8 years ago
Victor Julien 8709a20d94 af-packet: minor code cleanups 8 years ago
Victor Julien c99dc5a7bf af-packet: re-enable sync for tpacket v2 
Synchronize start was disabled for v2 when v3 was introduced, without
a reason being given.

Re-enable as v2 will otherwise also start reading packets before the
other threads are set up. This will lead to hashing issues.

Part of bug #2788.
 8 years ago
Victor Julien cebbe06f70 af-packet: fix sync start for tpacket v3 
The tpacket-v3 implementation of the synchonize start logic would
not correctly consider the timestamp parameter, leading to threads
starting before synchronization between threads was complete.

Bug #2788
 8 years ago
Alexander Gozman 03af3e1ed8 nfqueue: inject fake packet on timeout 
Fixes nfqueue and delayed-detect.

On systems with small amount of traffic (or with no traffic at all)
nfqueue with 'delayed-detect' enabled hanged in 'workers' mode.

Bug #2362.
 8 years ago
Eric Leblond 0e3b1eba86 util-binsearch: remove the files 8 years ago
Travis Green 6f5eb487a1 doc: add missing and fix 404 for --list-keywords 8 years ago
Travis Green c2adb9e669 doc: added tos keyword 
Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2583
 8 years ago
Philippe Antoine 7fca771ef4 Fixes other affected tests for smtp pipelining 
Either checking state has pipelining
Or removing pipelining from input
 8 years ago
Philippe Antoine 447c1042f4 smtp: improve pipelining support 
Fixes #1863
 8 years ago
Victor Julien 8357ef3f8f proto/detect: workaround dns misdetected as dcerpc 
The DCERPC UDP detection would misfire on DNS with transaction
ID 0x0400. This would happen as the protocol detection engine
gives preference to pattern based detection over probing parsers for
performance reasons.

This hack/workaround fixes this specific case by still running the
probing parser if DCERPC has been detected on UDP. The probing
parser result will take precedence.

Bug #2736.
 8 years ago
Victor Julien 11f3659f64 teredo: be stricter on what to consider valid teredo 
Invalid Teredo can lead to valid DNS traffic (or other UDP traffic)
being misdetected as Teredo. This leads to false negatives in the
UDP payload inspection.

Make the teredo code only consider a packet teredo if the encapsulated
data was decoded without any 'invalid' events being set.

Bug #2736.
 8 years ago
Victor Julien e30212c5d8 detect: fix crash during startup with malformed yaml 
detect-engine:
  custom-values:
    toclient-groups: 200
    toserver-groups: 200

Bug #2745
 8 years ago
Victor Julien 4c8f6b2246 offloading: on bsd, disable rxcsum and v6 variants 8 years ago
Victor Julien fa6b73d1c9 offloading: don't set multiple times per interface 
This could happen with netmap igb0->igb0^ IPS mode.
 8 years ago
Victor Julien ad1945aae4 detect: fix content inspection flags 
Fix generic inspect function content inspection flags so that
streaming buffers work correctly.
 8 years ago
Victor Julien 394e115036 detect/rawbytes: improve error message plus do minor cleanups 8 years ago
Victor Julien f336ba3217 detect/file-data: fix enabling http body tracking 8 years ago
Victor Julien 3eec088d31 detect/parse: error out on unused sticky buffers 8 years ago
Victor Julien b36e921cf9 detect/prefilter: add closing debug return statement 8 years ago
Victor Julien 3a057c5f54 capture: fix mtu plus sign names for non-netmap 
Bug #2502.
 8 years ago
Victor Julien 31f81429c2 stats: more accurate interval handling 
In the stats loop sleep for a time period more closely matching
the stats.interval setting. Fix an off by one that would make
the loop wake up ~1 second early.

Bug #2716
 8 years ago
Jason Ish d03a5be118 dns json v2 (C) - log rrtype in response 
Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2723
 8 years ago
Jason Ish 87250da0fc rust/dns: add v1 dns logging 
Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2704
 8 years ago
Victor Julien 9d36182b74 unix: fix deadlock in unix runmode on many cores 
Same issue as in 7f8795c756, with the
solution now also applied to the unix socket runmode.

Bug #2734
 8 years ago
Victor Julien 8d2883f3fa output/tx: fix multi-instance logger output 
Fix transactions not being logged after the first tx logger had
logged.
 8 years ago
Victor Julien 0e40231189 app-layer: improve transaction cleanup handling 
The app layers with a custom iterator would skip a tx if during
the ..Cleanup() pass a transaction was removed.

Address this by storing the current index instead of the next
index. Also pass in the next "min_tx_id" to be incremented from
the last TX. Update loops to do this increment.

Also make sure that the min_id is properly updated if the last
TX is removed when out of order.

Finally add a SMB unittest to test this.

Reported by: Ilya Bakhtin
 8 years ago
Victor Julien d34e41068f app-layer: fix tx tracking updates in tx cleanup 
Fix min_id not getting updated in all cases.

Reported by: Ilya Bakhtin
 8 years ago
Victor Julien e62e4bdc49 app-layer: add debug statements to tx cleanup logic 8 years ago
Victor Julien 37203c98a1 unittests/app-layer: add helper to get app tx trackers 8 years ago
Eric Leblond f3be8eaaf4 detect-depth: remove semi coma from desc 
It was breaking the CSV export.
 8 years ago
Eric Leblond 8c1b16e22d doc: fix some links in list-keywords command 8 years ago
Eric Leblond 64df672cf7 util-bpf: workaround OpenBSD old libpcap 
OpenBSD is not using a pcap_compile_* function so we can just
comment the code for OpenBSD users.
 8 years ago