133 Commits (23768c71814aa267672de772d43394727b3428a4)

Author	SHA1	Message	Date
Philippe Antoine	98f84d5a9b	http2: follow range requests ... Move the content-range parsing code to rust	3 years ago
Philippe Antoine	e82416a415	http/range: reassemble files from different flows with range ... adds a container, ie a thread safe hash table whose key is the filename keep a tree of unordered ranges, up to a memcap limit adds HTPFileOpenWithRange to handle like HTPFileOpen if there is a range : open 2 files, one for the whole reassembled, and one only for the current range	3 years ago
Philippe Antoine	ca760e305c	ipv6: decoder event on invalid length ... From RFC 2460, section 4.5, each fragment, except the last one, must have a length which is a multiple of 8	4 years ago
frank honza	f83d51d0cb	ike: set event for multiple server proposals	4 years ago
Jeff Lucovsky	1ddad0a0d6	decode/events: VNTAG decoder events	4 years ago
Andreas Herz	c93073c246	rules: add newer rule files to makefile for release tarball	4 years ago
frank honza	ecdf9f6b0b	ikev1: rename ikev2 to common ike ... Renaming was done with shell commands, git mv for moving the files and content like find -iname '*.c' | xargs sed -i 's/ikev1/ike/g' respecting the different mixes of upper/lower case.	4 years ago
Philippe Antoine	7500c29300	decode: limits the number of decoded layers ... so as to avoid overrecursion leading to stack exhaustion	4 years ago
Philippe Antoine	d861228214	http2: decompression for files ... gzip and brotli decompression for files	4 years ago
Jason Ish	8bd68478a4	rules/mqtt: renumber mqtt events to avoid conflict with ssh ... Both SSH and MQTT events were in the 2228000 range. As SSH was added first, renumber MQTT events into the 2229000 range which is free.	4 years ago
Philippe Antoine	caa7946888	smb: adds file overlap event against evasions ... Evasion scenario is - a first dummy write of one byte at offset 0 is done - the second full write of EICAR at offset 0 is then done and does not trigger detection The last write had the final value, and as we cannot "cancel" the previous write, we set an event which is then transformed into an app-layer decoder alert	4 years ago
Jason Ish	2b1bbd08a3	rules/tls: sync with changes to the TLS events ... Sync rules with event changes in commit 01aef49cbd.	5 years ago
Philippe Antoine	6694737fcf	http2: settings from http1 upgrade	5 years ago
Philippe Antoine	1422b18a99	http2: initial support	5 years ago
Sascha Steinbiss	c31360070b	rust/mqtt: add MQTT parser	5 years ago
Philippe Antoine	5a98035bac	rules: add SSH decoder events rules	5 years ago
Philippe Antoine	053c728871	http: adds debug check against too many warnings	5 years ago
Victor Julien	328a94206e	decode/hdlc: initial support	5 years ago
Jason Ish	ca5a3f0f04	dns: cleanup: remove unused events ... Removed events that are no longer used since the Rust implementation of DNS: - UnsolicitedResponse - StateMemCapReached - Flooded	5 years ago
Jeff Lucovsky	130b8d26e7	smtp/mime: Set event when name exceeds limit	5 years ago
William Stearns	7e47fc58af	rules: fix files.rules typo	5 years ago
Philippe Antoine	af4f816204	http: sets compression bomb limit	6 years ago
Philippe Antoine	9cbf9ef7a4	HTTP new parser warning for Ambiguous C-L	6 years ago
Victor Julien	c9c23d5cda	htp: set lzma memlimit from config	6 years ago
Jason Ish	e3cfc9fc4b	rules: install dhcp-events.rules; order alphabetically ... Add dhcp-events.rules to Makefile.am so it gets installed. Also order the rule files alphabetically for easier review.	6 years ago
Philippe Antoine	b5f3e03209	New app layer event for invalid http request line ... Handles logs from libhtp even if case of error	6 years ago
Philippe Antoine	8a339e73d3	http: adds an event for double encoded uri	6 years ago
Philippe Antoine	3e12066819	http: adds events for each libhtp log ... Fixes #997	6 years ago
Philippe Antoine	b6b7778e2d	http: adds event for header repetition	6 years ago
Jason Ish	275e8f280d	rules: add mpls packet too small decoder rule	6 years ago
Philippe Antoine	a1c6e091ac	http: new event for auth unrecognized ... activates libhtp auth parsing Fixes #984	6 years ago
Pierre Chifflier	27b0775d27	rules: fix event names for ikev2 (weak authentication and DH parameters)	6 years ago
Victor Julien	fa2ce043cf	ipv6: disable zero len padN rule by default	6 years ago
Victor Julien	631ee383bb	flow/stream: 'wrong thread' as stream event & counter ... Set event at most once per flow, for the first 'wrong' packet. Add 'tcp.pkt_on_wrong_thread' counter. This is incremented for each 'wrong' packet. Note that the first packet for a flow determines what thread is 'correct'.	6 years ago
Victor Julien	17ced4fb7f	smb: add smb-events.rules to dist	7 years ago
Victor Julien	843d0b7a10	stream: support RST getting lost/ignored ... In case of a valid RST on a SYN, the state is switched to 'TCP_CLOSED'. However, the target of the RST may not have received it, or may not have accepted it. Also, the RST may have been injected, so the supposed sender may not actually be aware of the RST that was sent in it's name. In this case the previous behavior was to switch the state to CLOSED and accept no further TCP updates or stream reassembly. This patch changes this. It still switches the state to CLOSED, as this is by far the most likely to be correct. However, it will reconsider the state if the receiver continues to talk. To do this on each state change the previous state will be recorded in TcpSession::pstate. If a non-RST packet is received after a RST, this TcpSession::pstate is used to try to continue the conversation. If the (supposed) sender of the RST is also continueing the conversation as normal, it's highly likely it didn't send the RST. In this case a stream event is generated. Ticket: #2501 Reported-By: Kirill Shipulin	7 years ago
Victor Julien	d0cded2523	http: set events for too many layers of compression ... libhtp would already issue warnings, but these were not mapped to events yet.	7 years ago
Jason Ish	c052e23348	dhcp: add dhcp app-layer rules file	7 years ago
Pierre Chifflier	5037051161	Kerberos 5: rename weak crypto to weak encryption, and log it	7 years ago
Pierre Chifflier	6ae53a1869	Add event rules for Kerberos 5	7 years ago
Jason Ish	7bf490062c	rules: install to $datadir/suricata/rules ... Common /usr/share/suricata/rules or /usr/local/share/suricata/rules. The rules provided by the distribution are installed here as part of the Suricata install process so will always be installed, even without the use of install-rules.	7 years ago
Pascal Delalande	e3c5784dd5	doc: minor updates (tls custom, TODO removal, ftp/smb file rules)	7 years ago
Pierre Chifflier	d16397ce61	Add rules for IKEv2 events	7 years ago
Victor Julien	1d4aac1d4d	smb1: set event on empty/malformed dialect	7 years ago
Victor Julien	75d7c9d64a	rust/smb: initial support ... Implement SMB app-layer parser for SMB1/2/3. Features: - file extraction - eve logging - existing dce keyword support - smb_share/smb_named_pipe keyword support (stickybuffers) - auth meta data extraction (ntlmssp, kerberos5)	7 years ago
Victor Julien	ca67408e79	stream: set event for suspected data injection during 3whs ... This rule will match on the STREAM_3WHS_ACK_DATA_INJECT, that is set if we're: - in IPS mode - get a data packet from the server - that matches the exact SEQ/ACK expectations for the 3whs The action of the rule is set to drop as the stream engine will drop. So the rule action is actually not needed, but for consistency it is drop.	7 years ago
Pascal Delalande	0ff60f65ec	doc: update filestore for file hash extraction ... Update for extraction based on md5, sha1 and sha256	7 years ago
Victor Julien	d5f7acd860	decoder: implement IEEE802.1AH	7 years ago
Victor Julien	a306ccfd34	rust/nfs: implement events ... Remove lots of panic statements in favor of setting non-fatal events. Bug #2175.	8 years ago
Pierre Chifflier	79ed8c2dd3	Add event rules for NTP events	8 years ago