14574 Commits (0903536fd66a98087bff3b9a1f235d7295710298)

 

All Branches   

Search

Author	SHA1	Message	Date
Lancer Cheng	9207012e4b	smb: fix parser of ntlmssp negotiateflags ... Fix endian-conversion bug in function parse_ntlm_auth_nego_flags Bug OISF#5783	2 years ago
Jeff Lucovsky	cb174e4fd9	log/thread: Consolidate threaded file tracking ... Issue: 5836 This commit removes the duplicate threaded file tracking from the log file mechanisms. Tracking is now consolidated with the threaded hash table.	2 years ago
Jeff Lucovsky	99b7257ef6	log: Stop if log initialization fails at startup ... Issue: 5836 This commit modifies Suricata to fail if log initialization errors occur during startup.	2 years ago
Victor Julien	8746fbe07e	stream: add seq min and max; use in segment compare	2 years ago
Victor Julien	cbcd70537a	stream: fix overlap detection ... If a in-tree segment was partly before base_seq the overlap detection miscalculated the data offset. This lead to memcmp comparing the wrong data. Bug: #5881.	2 years ago
Victor Julien	ceebd6e904	stream: reuse TCP session after TFO SYN+data reject	2 years ago
Victor Julien	ee76b27535	eve/stream: log tcp reuse flag in packets	2 years ago
Victor Julien	2bb1e5a38a	flow: remove unused tcp reuse flow flag	2 years ago
Victor Julien	7ef57cc7cb	stream: support SYN/ACK with TFO only ack'ing ISN ... Not ack'ing the data.	2 years ago
Victor Julien	7e6154a26f	stream: add counter for acks for unseen data ... This is another indicator for packet loss or strange captures.	2 years ago
Victor Julien	37e694b5b8	eve/stream: ack unseen data	2 years ago
Victor Julien	b7739bfdba	stream: flag ACKs that ack segments after next_seq ... Avoid this for async streams.	2 years ago
Victor Julien	a0f0a3b48b	stream: fix spurious retransmission handling ... Fix spurious retransmissions getting dropped, stalling connections in IPS mode. There are several reasons why benign spurious retransmissions can happen, with the most obvious one that an ACK is lost so the sender retransmits while the receiver has ACK'd it. If Suricata sees the ACK but afterwards it gets lost, we can get in this condition. Packet loss can have a wide range of causes here, including packets reaching a host but getting dropped in the NIC queue or kernel queues due to resource constraints. So these packets are no longer an "error" in this patch. Next to this, the accuracy of the spurious retransmission has been improved. Use SEQ macros to compare sequence numbers. Only use base_seq if reassembly is still enabled for a stream. A special case is added for cases where a segment is before last_ack but after base_seq, which can happen when protocol detection isn't finished yet. In this case the segment is tagged as spurious, but still processed. This way we can check for overlaps. Bug: #5875.	2 years ago
Victor Julien	01b7ccc224	stream: add liberal timetamps option ... Linux is slightly more permissive wrt timestamps than many other OS'. To avoid many events/issues with linux hosts, add an option to allow for this slightly more permissive behavior. Ideally the host-os config would be used, but in practice this setting is rarely set up correctly, if at all. This option is enabled by default.	2 years ago
Victor Julien	d79a926085	stream: D-SACK detection and logging ... RFC 2883 specifies a special use of SACKs to indicate a host has received a segment it considers a spurious retransmission.	2 years ago
Victor Julien	6a2fdc456b	stream: Dup-ACK detection ... Modeled after Wiresharks Dup-ACK detection.	2 years ago
Victor Julien	76225bf9ac	stream: fix next_seq updates after temporary gap ... On every accepted packet in established state, update next_seq if packet seq+len is larger than existing next_seq. This allows it to catch up after large gaps that are filled again a bit later. Bug: #5877.	2 years ago
Victor Julien	83a16a7a89	eve/stream: per packet stream engine logging ... Debug facility to get a per packet view into the stream engine's state. Logs after a packet has been processed in the stream engine, so the view into the state includes the updates based on the current packet. Marked as experimental so it can be changed w/o notice. Bug: #5876.	2 years ago
Victor Julien	3948b160c7	stream: implement config option for SYN queue ... Default to allowing 10 SYNs to not trigger an event on a connection attempt that times out.	2 years ago
Victor Julien	d03773840b	stream: track packet flags in packet ... These flags can then later be used by stream logging.	2 years ago
Victor Julien	551fb80150	stream: improve first FIN next_seq update ... For accepted FIN packets, always update next_seq. This helps track the FIN sequence. Bug: #5877.	2 years ago
Victor Julien	80a012a787	stream: improve FIN next_seq handling ... Update next_seq to SEQ + payload_len + 1, so retransmission checks work better. Bug: #5877.	2 years ago
Victor Julien	20df715e64	stream: set next_seq before last_ack ... next_seq sometimes depends on last_ack in cases of packet loss catch up, so first update it. Bug: #5877.	2 years ago
Victor Julien	67af94f2e0	stream/tcp: fix wrong ACK trigger FIN1 to FIN2 ... An ACK that ACK'd older data while still being in-window could lead to FIN_WAIT1 to FIN_WAIT2 state transition. Detect this case and generally harden the check. Bug: #5877.	2 years ago
Victor Julien	7bfee147ef	stream: SYN queue support ... Support case where there are multiple SYN retransmits, where each has a new timestamp. Before this patch, Suricata would only accept a SYN/ACK that matches the last timestamp. However, observed behavior is that the server may choose to only respond to the first. In IPS mode this could lead to a connection timing out as Suricata drops the SYN/ACK it considers wrong, and the server continues to retransmit it. This patch reuses the SYN/ACK queuing logic to keep a list of SYN packets and their window, timestamp, wscale and sackok settings. Then when the SYN/ACK arrives, it is first evaluated against the normal session state. But if it fails due to a timestamp mismatch, it will look for queued SYN's and see if any of them match the timestamp. If one does, the ssn is updated to use that SYN and the SYN/ACK is accepted. Bug: #5856.	2 years ago
Victor Julien	449ed75547	stream: fix direction macro to be used in conditions	2 years ago
Victor Julien	3bbed8c1d4	stream: minor code cleanup	2 years ago
Victor Julien	9a34997d71	flow: fix comment typo	2 years ago
Victor Julien	65f28b075f	stream: turn session bool into flag	2 years ago
Victor Julien	aa7d58b0c7	stream: turn session flags into u32 ... Due to gaps/padding the size of the struct won't change.	2 years ago
Victor Julien	dd8e8fd7c3	stream/config: optimize stream config structure layout	2 years ago
Victor Julien	23dd34dd8a	stream/config: turn async_oneside into bool	2 years ago
Victor Julien	0a831b5ea2	stream: minor code cleanups in ACK validation	2 years ago
Victor Julien	15637ecce4	stream: remove unused macros	2 years ago
Victor Julien	58c1f14f17	stream: remove usused thread pseudo packet queue	2 years ago
Victor Julien	435ca5bbf0	stream: remove unused packetqueue argument	2 years ago
Haleema Khan	6b55e53ff5	rfb: add unittests to rfb.rs ... Task: #5741	2 years ago
Philippe Antoine	3365ef72c3	tcp: pick up a midstream session even with FIN flag ... Ticket: #5437	2 years ago
Haleema Khan	609df1776e	userguide: update tls keywords information ... Ticket #5544	2 years ago
Philippe Antoine	233ab11148	smb: handles records with trailing nbss data ... If a file (read/write) SMB record has padding/trailing data after the buffer being read or written, and that Suricata falls in one case where it skips the data, it should skip until the very end of the NBSS record, meaning it should also skip the padding/trailing data. Otherwise, an attacker may smuggle some NBSS/SMB record in this trailing data, that will be interpreted by Suricata, but not by the SMB client/server, leading to evasions. Ticket: #5786	2 years ago
Philippe Antoine	c1b7befb18	smb: checks against nbss records length ... When Suricata handles files over SMB, it does not wait for the NBSS record to be complete, and can stream the payload to the file... But it did not check the consistency of the SMB record length being read or written against the NBSS record length. This could lead to an evasion where an attacker crafts a SMB write with a too big Length field, and then sends its evil payload, even if the server returned an error for the write request. Ticket: #5770	2 years ago
jason taylor	8e5b1fe8e6	userguide: add DHCP EVE log information ... Signed-off-by: jason taylor <jtfas90@gmail.com>	2 years ago
Victor Julien	4ad5e040af	stream: minor cleanups	2 years ago
Victor Julien	b31617c060	stream: reduce scope of inline drop check	2 years ago
Victor Julien	288086af3f	stream: move state queue code into util func	2 years ago
Victor Julien	fc376f8145	stream: set event on bad timestamp on syn_sent state	2 years ago
Victor Julien	c3ecf63b1e	stream: remove unnecessary ssn checks ... Add debug validation to catch any change.	2 years ago
Victor Julien	89f3346c3c	eve/flow: optimize tcp gap checks	2 years ago
Victor Julien	67634c561c	time: don't log debug messages from debug logging ... Bug: #5835. Fixes: 31793aface ("time: Replace struct timeval with scalar value")	2 years ago
Philippe Antoine	96b48d7104	github: avoid bash escaping ... so as to allow ' in github discussion and get CI green	2 years ago