10821 Commits (1aaf9a80c570569f61daf4b5581155e177e85593)

 

All Branches   

Search

Author	SHA1	Message	Date
Victor Julien	1aaf9a80c5	decode/vxlan: minor yaml example clarrification	6 years ago
Victor Julien	e97cdb48f3	decode/teredo: implement port support ... Implement support for limiting Teredo detection and decoding to specific UDP ports, with 3544 as the default. If no ports are specified, the old behaviour of detecting/decoding on any port is still in place. This can also be forced by specifying 'any' as the port setting.	6 years ago
Shivani Bhardwaj	0e4f261224	Use StringParse* for all parsers and configurations	6 years ago
Shivani Bhardwaj	c4c734541a	Use appropriate ByteExtractString* functions	6 years ago
Shivani Bhardwaj	6b2c7d5be8	util: Add StringParse* functions ... StringParse* functions would perform a stricter check compared to ByteExtractString* functions. These new functions shall also check if any extra characters follow the extracted numeric value in addition to the checks performed by ByteExtractString* and return -1 in that case. This is particularly important in parser, configuration and setup functions.	6 years ago
Philippe Antoine	293eebd999	fuzz: remove obsolete AFL code	6 years ago
Victor Julien	19fe8d9894	ci: add fuzztargets and afl build test	6 years ago
Philippe Antoine	bf60959d84	fuzz: simpler way to force usage of CXX linker	6 years ago
Philippe Antoine	440bb4d600	fuzz: remove decodeder fuzz target ... As we removed decodeder function	6 years ago
Philippe Antoine	e15f3db474	configure: right test for AFLFUZZ_PERSISTANT_MODE	6 years ago
Philippe Antoine	66181ed2e4	ci: enables fuzz targets in one build ... github workflow wih debian	6 years ago
Victor Julien	e500c59b99	stream/tcp: fix STREAM_HAS_SEEN_DATA macro ... The macro would not return true for smaller TCP streams, leading to cases where the app-layer was not notified of EOF.	6 years ago
Victor Julien	1618fb1b97	stream/tcp: clean up stream flags	6 years ago
Pierre Chifflier	01aef49cbd	rust/x509: map decoding errors to decoder events	6 years ago
Pierre Chifflier	333fcc43e7	ssl/tls: call rs_cstring_free for strings allocated in Rust	6 years ago
Pierre Chifflier	36d2e257c6	rust/x509: use the raw serial number so leading zeros are not removed	6 years ago
Pierre Chifflier	1d9f37a60e	DER: remove the C parser for DER	6 years ago
Pierre Chifflier	d92321d8b1	ssl/tls: use the rust decoder to decode X.509 certificates	6 years ago
Pierre Chifflier	10d9deec9f	rust: add common function to exchange CString objects from/to C	6 years ago
Jeff Lucovsky	e0bd79670c	detect: byte-test convert neg_op flag to a bool ... Only 8 flags are permitted so convert one of them to a struct member. I choose neg_op	6 years ago
Jeff Lucovsky	313c23a26b	detect: Add unittests to exercise bitmask	6 years ago
Jeff Lucovsky	d12950c9e4	detect: fixup incorrect comments, indentation	6 years ago
Jeff Lucovsky	31ed9786f6	detect: byte_test impl for bitmask ... This commit implements byte_test's bitmask feature.	6 years ago
Jeff Lucovsky	4ad6c5421a	doc: fix documentation typos	6 years ago
Jeff Lucovsky	bc01392e93	doc: Update byte_test documentation	6 years ago
Sascha Steinbiss	26123e05f2	rfb: use more idiomatic Rust code ... Using 'if let Some()...' makes the code in these many checks more concise and readable.	6 years ago
Victor Julien	b85539b2ab	stream/tcp: fix fast open off by one ... With data on SYN the sequence number used for the first data was off by one, leading to the next segments to appear to come after a one byte gap.	6 years ago
Philippe Antoine	f51d7d8947	fuzz: check tcp splitting evasions in protocol detection	6 years ago
Philippe Antoine	9eddaa038e	fuzz: enable AFLFUZZ_PERSISTANT_MODE for libfuzzer targets	6 years ago
Philippe Antoine	ac35118ebe	fuzz: use env variable to restrict app layer	6 years ago
Philippe Antoine	600b0d7c55	fuzz: adds eight fuzz targets ... And ways to compile them with enable-fuzztargets at configure time Adds utility function in util-unittest-helper	6 years ago
Frank Honza	1c8943dedd	add RFB parser ... This commit adds support for the Remote Framebuffer Protocol (RFB) as used, for example, by various VNC implementations. It targets the official versions 3.3, 3.7 and 3.8 of the protocol and provides logging for the RFB handshake communication for now. Logged events include endpoint versions, details of the security (i.e. authentication) exchange as well as metadata about the image transfer parameters. Detection is enabled using keywords for: - rfb.name: Session name as sticky buffer - rfb.sectype: Security type, e.g. VNC-style challenge-response - rfb.secresult: Result of the security exchange, e.g. OK, FAIL, ... The latter could be used, for example, to detect brute-force attempts on open VNC servers, while the name could be used to map unwanted VNC sessions to the desktop owners or machines. We also ship example EVE-JSON output and keyword docs as part of the Sphinx source for Suricata's RTD documentation.	6 years ago
Victor Julien	b4d75b7448	output/anomaly: minor code cleanups	6 years ago
Victor Julien	4d21b03575	detect/app-layer-event: code cleanups	6 years ago
Jeff Lucovsky	f0bd69e7e3	detect/pcre: Correct spelling typos	6 years ago
Jeff Lucovsky	7f6af10fed	general: copyright bump	6 years ago
Jeff Lucovsky	4b0085b03c	detect: Update to take advantage of PCRE refactor ... This commit changes the keyword detectors to use the refactored PCRE modifications from detect-parse.[ch]	6 years ago
Jeff Lucovsky	abe0cdc4ad	detect/pcre: Changes to support pcre_jit_exec ... This command causes `pcre_jit_exec` to be used when available. If it's available and there are allocation errors preparing for it, things fallback to `pcre_exec`.	6 years ago
Jeff Lucovsky	aa67a0a236	detect/pcre: Add warning for failed registrations ... This commit adds a warning used by the PCRE detect logic when it fails to register initialization and free functions for per-thread JIT stack handling. This error code is only used when the platform has PCRE JIT exec functionality.	6 years ago
Jeff Lucovsky	d19429f7e5	detect/parse: Refactor interfaces/definitions ... This commit refactors existing code patterns to reduce code duplication and to be a base for supporting additional PCRE jit-related actions.	6 years ago
Jeff Lucovsky	94df0b08d4	configure: Determine whether pcre_jit_exec exists ... This commit adds logic to determine whether pcre_jit_exec is present in the system's pcre library using AC_RUN_ELSEIF	6 years ago
Victor Julien	ccfdcb55fb	devguide: document new app-layer retvals	6 years ago
Philippe Antoine	6251deae21	doc: adds doc for ipv4.hdr signature keyword	6 years ago
Philippe Antoine	1cd314c500	detect: adds icmpv6.mtu keyword	6 years ago
Philippe Antoine	75ec528384	detect: adds utility file for uint keywords	6 years ago
Philippe Antoine	0355b70f5a	detect: define generic PrefilterIsPrefilterableById	6 years ago
Philippe Antoine	bb7abbd6ec	detect: extend PrefilterPacketHeaderValue to 16 bytes	6 years ago
Philippe Antoine	d04d69acbb	decode: fix endianness for ICMPv6 MTU	6 years ago
Philippe Antoine	9d2fabcd99	doc: fix typo in DetectTcpmssSetup description ... And use lowercase true for boolean	6 years ago
Victor Julien	efee458af8	stream: fix direction flags in corner case ... When a TCP DNS flow would start with a GAP on the TS side, the successful protocol detection on the TC side would trigger 'opposing side' reassembly and app-layer processing. In this case the stream flags would indicate the wrong direction and the wrong parser would be called.	6 years ago