aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
11,652 Commits
10 Branches
154 Tags
165 MiB
dependabot/github_actions/actions/checkout-4.2.1
dependabot/github_actions/github/codeql-action-3.26.12
dependabot/github_actions/actions/upload-artifact-4.4.3
master
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '2f81f3fbe9'
${ noResults }
Commit Graph

551 Commits (2f81f3fbe90ae164a39e4d2e737584957030d1b8)

Author SHA1 Message Date
Jason Ish 7f32822843 doc/filestore(v1) - document force-filestore field 5 years ago
Jeff Lucovsky 44a59b78c7 doc/anomaly Remove event_no 5 years ago
Victor Julien be6cdd37f8 stream: remove fix stream.depth references 5 years ago
Peter Manev 10819ed892 doc: Update tuning considerations doc 5 years ago
Peter Manev 6df1001957 doc: Update high performance config doc 5 years ago
Victor Julien bd2f1e15fd doc/stats: minor clarrifications on 5.0 defaults 5 years ago
Victor Julien 42438ec08e doc/userguide: add quickstart to dist 5 years ago
Giuseppe Longo dd5d0afd79 doc: add SIP keywords 5 years ago
Jason Ish d3e2cc9926 doc: document dns.opcode keyword 5 years ago
Jason Ish daed788d49 doc: Replace dns_query with dns.query. 5 years ago
Giuseppe Longo 972be0a560 doc: update file-extraction section 5 years ago
Travis Green 798d874662 doc: fix whitespace 5 years ago
Victor Julien 6aa2d550a1 doc/dotprefix: fix example rules 5 years ago
Jeff Lucovsky ab3d6328ba detect/transform: add dotprefix keyword to doc 5 years ago
Victor Julien df325d63ea doc/eve.anomaly: fix indent and general formatting 5 years ago
Jeff Lucovsky 075592b66f doc: Simplified anomaly configuration settings 5 years ago
Jeff Lucovsky aaacbf28c2 logging/anomaly: Support configuration filter types 5 years ago
Eric Leblond 35bc73e4e2 doc: change eBPF directory path 5 years ago
Zach Kelly caef8b5b38 protocol parser: rdp 
Initial implementation of feature 2314:
1. Add protocol parser for RDP
2. Add transactions for RDP negotiation
3. Add eve logging of transactions
 5 years ago
Andreas Herz d657fd9bf0 doc: add quickstart guide 5 years ago
Victor Julien d5009c5d8c doc/stream: briefly explain bypass 5 years ago
Jason Ish 0bb07b550c userguide: remove section on using Oinkmaster 
Users should be using Suricata-Update now.
 5 years ago
Travis Green 3f146cdd7e doc: add endswith keyword docs 5 years ago
Travis Green 9f8dcad287 doc: update of ssh-kewords documentation 
Modifies ssh-keywords.rst to fix syntax error in example rule as well as
update descriptions to indicate older keywords have been deprecated.
 5 years ago
Jason Ish 9488002a0d doc: use describe instead of option for old Sphinx 
Older versions of Sphinx will generate duplicate IDs when you have
options like:

.. option:: some-option

.. option:: some-other-option

The version of Sphinx provided on CentOS 7 has this issue, newer
versions of Sphinx do not.  As CentOS 7 is still a popular
distribution, change ".. option" to ".. describe" which has the
same visual output, but does not generate links.
 5 years ago
Victor Julien e36a963196 datasets/doc: minor fixes and clarifications 5 years ago
Victor Julien 0107b9a057 doc/dataset: initial documentation 5 years ago
Victor Julien 1bc738fbe4 doc: typo fixes 
By @espritlibre and @Zeal0us
 5 years ago
Nick Price d0a85b7550 ja3: Mention LibNSS dependency for JA3 5 years ago
Eric Leblond cc28d24e9a doc: install eBPF files in share directory 
Following proposal by Sascha Steinbiss, let's use /usr/share/suricata
to store the eBPF files.
 5 years ago
Eric Leblond 3cf49ae868 doc: fix English and some typos 5 years ago
Eric Leblond 4be6701836 doc: pointer to bpfctrl 
As bpfctrl is currently the easiest way to manage pinned maps,
let's point to it. We will switch doc to suricatacl once support
has been added.
 5 years ago
Eric Leblond 8f1a7de791 doc: improve doc on compiling with eBPF support 5 years ago
Eric Leblond f1ab27b7cb doc: improve XDP cpu redirect documentation 5 years ago
Eric Leblond 6d9ac64f7b doc: only balance by ip pair 
As there is some issue with defrag, let's recommend to only do
IP pair load-balacing for RSS
 5 years ago
Eric Leblond a1d3835b86 doc: document filter.bpf changes 
Also adds some info to explain maps.
 5 years ago
Eric Leblond 08397e07f1 doc: fix typos in geoip doc 5 years ago
Eric Leblond 0d5608bab2 doc: fix display of icmp code and type array 5 years ago
Eric Leblond 0c84591afe doc: use a table to list direction filter in geoip 5 years ago
Eric Leblond c01cadbade doc: fix geoip syntax 
Spaces are not allowed before country code.
 5 years ago
Vinjar Hillestad 4c18fee3c6 Documenting base64_decode and base64_content 
base64 doc changes based on #4027 pull feedback
 5 years ago
Hilko Bengen 36998ab4cd Add documentation for --with-clang parameter 5 years ago
Andreas Herz c0bddff078 userguide: remove old reference to rule-reload option 5 years ago
Jeff Lucovsky a66383569c userguide: formatting: remove tabs 5 years ago
Jeff Lucovsky c68510437f userguide: ftp formatting updates 5 years ago
Jeff Lucovsky 2149807bd6 eve/ftp: Transaction support for unmatched requests 
Modified transaction logic to create a new transaction with each
request; replies location transactions by using the oldest "open"
(unmatched) transaction or the last transaction if none are open.
 5 years ago
Jeff Lucovsky 1930b1f504 eve/ftp: Log FTP transactions 
This changeset includes changes that
1. Add transaction support to the FTP parser
2. Support eve json logging of FTP transactions
 5 years ago
Bill Meeks a291209e47 detect/geoip: migrate to GeoIP2 database format 
Issue #2765
 5 years ago
Victor Julien 034555644b doc: add tcp.hdr and udp.hdr 5 years ago
Victor Julien a01df4b86b doc: document tcp.mss keyword 5 years ago
Jeff Lucovsky 6cd39c5cfb userguide: Document app-layer anomaly items 
This changeset expands the anomaly section to include newly added
app-layer items.
 5 years ago
Eric Leblond 1f151dd8a6 doc: address norg comments on eBPF doc 5 years ago
Eloïse Brocas 8692aac97f doc: specify config file in ebpf doc 
This patch updates the ebpf-xdp.rst file to specify which
configuration file has to be modified.
 5 years ago
Eric Leblond eea3c6b610 doc: info for new bypass counters 5 years ago
Eric Leblond e3dccb2400 doc: update bypass stats doc 5 years ago
Eric Leblond dbf3606169 doc: document flow event_type 5 years ago
Eric Leblond 8a11581ac8 doc: update ebpf doc following bypass_filter change 5 years ago
Eric Leblond 253c011c70 doc: update for latest xdp_filter.c change 5 years ago
Eric Leblond 567b5ee1bc af-packet: rename option 'no-percpu-hash' 5 years ago
Eric Leblond ca50f8852e doc: improve ebpf doc 
Add example of bypass rules and explain clang dependency.
 5 years ago
Eric Leblond c11eb78141 doc: document netronome hardware bypass usage 5 years ago
Eric Leblond 82c4f5135b doc: use github mirror to setup libbpf 5 years ago
Eric Leblond 1c4d214cdb doc: typo fixes on ebpf doc 5 years ago
Eric Leblond b7560d7547 doc: document externally managed global switch 
This is currently implemented as an exposed map and it seems
a good way to do it.
 5 years ago
Eric Leblond b1769d5f8f util-ebpf: implement pinned maps loading 
Load flow tables at start if asked to.
 5 years ago
Eric Leblond 19c0a5edf5 doc: white space and typo fix 5 years ago
Eric Leblond 6d41a0ced0 doc: more eBPF and XDP capabilities 5 years ago
Eric Leblond 315c29a8e6 ebpf: change the logic to avoid ktime usage 
Kernel time is not available (and/or costly) on NIC such as
Netronome so we update the logic to detect dead flows based on a
lack of update of packets counters. This way, the XDP filter will
be usable by network card.

This patch also updates the ebpf code to support per CPU and
regular mapping. Netronome is not supporting it and the structure
is using atomic for counter so the cost of simultaneous update
is really low.

This patch also updates the xdp_filter to be able to select if the
flow table is per CPU on shared. Second option will be used for
hardward offload. To deactivate the per cpu hash, you need to set
USE_PERCPU_HASH to 0.

This patch also adds an new option to af-packet named no-percpu-hash
If this option is set to yes then the Flow bypassed manager thread
will use one CPU instead of the number of cores. By doing that
we are able to handle the case where USE_PERCPU_HASH is unset (so
hardware offload for Netronome).

This patch also remove aligment indications in the eBPF filter. This
was not really needed and it seems it is causing problem with
some recent version of LLVM toolchain.
 5 years ago
Andreas Herz 30fd80b0ef doc: convert fancy quotes to straight quotes 5 years ago
Pierre Chifflier 9dfec7e734 SNMP: add the "snmp.pdu_type" detection keyword 5 years ago
Pierre Chifflier e1dd19a0eb SNMP: add the "snmp.community" detection keyword 5 years ago
Pierre Chifflier aa608e0ca2 SNMP: add the "snmp.version" detection keyword 5 years ago
Jeff Lucovsky ab1d95446a doc: http keyword update 
This changeset updates the keyword type for http.location and http.server
 5 years ago
Jeff Lucovsky 0960ca0d00 detect/analyzer Add missing HTTP values 
This changeset adds recognition of missing HTTP values
- Raw host
- Header names
- Server body
- User agent
 5 years ago
Mats Klepsland b59e82a642 userguide: add documentation for ja3s.string keyword 5 years ago
Mats Klepsland 76b94c7073 userguide: add documentation for ja3s.hash keyword 5 years ago
Mats Klepsland d15903a2ef userguide: add documentation for Ja3SGetString Lua function 5 years ago
Mats Klepsland 37a0594417 userguide: add documentation for JA3SGetHash Lua function 5 years ago
Mats Klepsland 800608ab65 userguide: add JA3S fields to the TLS logger documentation 5 years ago
Jeff Lucovsky 8a94b93b7b doc: Anomaly logging documentation 
This changeset adds discussion of anomaly log records and
the anomaly log record format.
 5 years ago
Mats Klepsland 7020cffaa8 userguide: 'sticky' instead of 'Sticky' for all tls keywords 5 years ago
Mats Klepsland 03d986dd55 userguide: add documentation for tls.certs keyword 5 years ago
Jeff Lucovsky 7d6875fb68 documentation: Correct rst for ssh-keywords 
This changeset corrects an error in the ssh-keywords
where 3 "`" characters were used instead of 2 "`" characters.
 6 years ago
Jeff Lucovsky 97fc7c1e1a documentation: sticky buffer updates 
This changeset updates the userguide for the TLS and JA3
keywords that have been renamed from <id>_<name> to <id.name>
 6 years ago
Giuseppe Longo 76357350fd doc: update http.protocol description 6 years ago
Shivani Bhardwaj 4705314fd2 doc: Add manpages for suricatasc and suricatactl 
Add the missing manpages and the corresponding Sphinx configuration
for the command line tools `suricatasc` and `suricatactl`.

Closes redmine ticket #884.
 6 years ago
Eric Leblond 360a6ace43 doc: add info about buffer usage in lua 6 years ago
Jason Ish 355d125c4f userguide: remove dns-log 6 years ago
Jason Ish 75a018ead2 doc: remove autoconf replacement var for Rust 
Set to yes as Rust is always enabled now.
 6 years ago
Phil Young 6cfc39d7c9 napatech: auto-config documentation update 
Added documentation describing how to configure suricata to automaticly
configure sreams and host buffers without using NTPL.  I.e. from
suricata.yaml.
 6 years ago
Jeff Lucovsky 9856c5533a doc: ssh.{proto,software} documentation update 6 years ago
Jeff Lucovsky 74cd6a9ee8 doc: add http.location and http.server 6 years ago
Pascal Delalande bde65467a9 doc: add ssh protocol in eve log section 6 years ago
Victor Julien 96c6cf98d5 doc/userguide: add 3rd-party-integration to dist 6 years ago
Victor Julien f1c83c3308 doc/userguide: new 3rd party section, add bluecoat 
Add Symantec SSLV (bluecoat) doc to new 3rd party section for
documenting integrating Suricata with 3rd party tools.
 6 years ago
Bryant Smith 398133b6ce doc: add byte_* documentation to the userguide 
Added byte_test, byte_jump and byte_extract description and example rules
 6 years ago
Victor Julien d6903e70c1 file-log: remove and add warning 
Feature was deprecated and scheduled for removal.

Ticket #2376
 6 years ago
Eric Leblond 83a8df90f3 doc: improvement of xbits documentation page 6 years ago
Eric Leblond 43ede4db7f doc: xbits:noalert is not a valid syntax 6 years ago
Shivani Bhardwaj 2483331a5d doc/unix-socket: Add missing commands and detail 
Add missing commands and their corresponding details in unix-socket
userguide.

Closes redmine ticket #2800
 6 years ago
Victor Julien c47164ebc8 doc: add table for custom values of eve/http 6 years ago
Victor Julien 6fcd2db043 tile: remove files 6 years ago
Victor Julien 517b45ea2d netmap: switch to nm_* API 
Process multiple packets at nm_dispatch. Use zero copy for workers
recv mode.

Add configure check netmap check for API 11+ and find netmap api version.

Add netmap guide to the userguide.
 6 years ago
Maurizio Abba 6c0ec0b2f3 eve/http: add request/response http headers 
Add a keyword configuration dump-all-headers, with allowed values
{both, request, response}, dumping all HTTP headers in the eve-log http
object. Each header is a single object in the list request_headers
(response_headers) with the following notation:

{
    "name": <header name>,
    "value": <header value>
}

To avoid forged malicious headers, the header name size is capped at 256
bytes, the header value size at 2048.

By default, dump-all-headers is disabled.
 6 years ago
Maurizio Abba 4697351188 smtp: create raw-extraction feature 
Add a raw-extraction option for smtp. When enabled, this feature will
store the raw e-mail inside a file, including headers, e-mail content,
attachments (base64 encoded). This content is stored in a normal File *,
allowing for normal file detection.
It'd also allow for all-emails extraction if a rule has
detect-filename:"rawmsg" matcher (and filestore).
Note that this feature is in contrast with decode-mime.

This feature is disabled by default, and will be disabled automatically
if decode-mime is enabled.
 6 years ago
Victor Julien eb73008ccf detect/transform: add to_sha1 keyword 6 years ago
Victor Julien 75f9c1ae9f detect/transform: add to_md5 keyword 6 years ago
Victor Julien b3c021f8d0 userguide: improve stats logging documentation 6 years ago
Pascal Delalande f2dca46382 doc: fix minor typo 6 years ago
Eric Leblond 7a121d9b4c doc: add _static dir to make dist 6 years ago
Travis Green c2adb9e669 doc: added tos keyword 
Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2583
 6 years ago
Victor Julien 9dd925a46a userguide/install: add rust, python-yaml to ubuntu 6 years ago
jason taylor fc395eb2c5 userguide: updated hyperscan version reference 
Signed-off-by: jason taylor <jtfas90@gmail.com>
 6 years ago
jason taylor 131112de13 doc: Remove gulp references 
Signed-off-by: jason taylor <jtfas90@gmail.com>
 6 years ago
jason taylor fc54d750dd doc: add bypass keyword documentation 
Signed-off-by: jason taylor <jtfas90@gmail.com>
 6 years ago
Mats Klepsland be8c06adfd userguide: add documentation for ssl_version keyword 6 years ago
Victor Julien 85f2486e0b multi-tenant: document per tenant settings 6 years ago
Victor Julien 5afeebf884 doc/flow: updates and cleanups to flow section 6 years ago
Victor Julien 72dd4a5f92 doc/rules: initial transforms documentation 6 years ago
Victor Julien 226fe5cab3 doc/performance: redo runmodes explanation 6 years ago
Victor Julien 17e2d39531 doc/install: update Rust info in generic install overview 6 years ago
Victor Julien 473688746b doc/eve: add community id 6 years ago
Mats Klepsland e92fda37c9 doc: add documentation for SSH keywords 6 years ago
Pascal Delalande 64922a476e doc: remove deprecated force-md5 flag from userguide 6 years ago
jason taylor 7f4e5e6eac userguide: update hyperscan documentation 
Signed-off-by: jason taylor <jtfas90@gmail.com>
 6 years ago
Mats Klepsland 4d38d0844b doc: add documentation for Lua function 'TlsGetVersion' 6 years ago
Mats Klepsland 10fcc8d2ca doc: update tls.version documentation 6 years ago
Maurizio Abba bce7c2dd87 eve/http: add tx->request_port_number as http_port 
Add the port specified in the hostname (if any) to the http object in
eve. The port may be different from the dest_port used by the TCP flow.
 6 years ago
Eric Leblond 173e5a1c58 doc: iprep supports CIDR networks 6 years ago
Victor Julien 7c884e0850 doc: update multi-tentant for device feature 6 years ago
Danny Browning 2dc6b6ee14 source-pcap-file: delete when done (2417) 
https://redmine.openinfosecfoundation.org/issues/2417

Add option to have pcap files deleted after they have been processed.
This option combines well with pcap file continuous and streaming
files to a directory being processed.
 6 years ago
Jason Ish ede94e1f66 doc: alphabetize EXTRA_DIST 6 years ago
Jason Ish ff73d908aa doc: add window ips inline doc to extra_dist 6 years ago
Jason Ish d2142cf433 doc: make warnings errors when building man page 6 years ago
Jason Ish 01f477786e doc: link in windows ips setup page 6 years ago
Jacob Masen-Smith ec77632e84 Adds WinDivert support to Windows builds 
Enables IPS functionality on Windows using the open-source
(LGPLv3/GPLv2) WinDivert driver and API.

From https://www.reqrypt.org/windivert-doc.html : "WinDivert is a
user-mode capture/sniffing/modification/blocking/re-injection package
for Windows Vista, Windows Server 2008, Windows 7, and Windows 8.
WinDivert can be used to implement user-mode packet filters, packet
sniffers, firewalls, NAT, VPNs, tunneling applications, etc., without
the need to write kernel-mode code."

- adds `--windivert [filter string]` and `--windivert-forward [filter
    string]` command-line options to enable WinDivert IPS mode.
    `--windivert[-forward] true` will open a filter for all traffic. See
    https://www.reqrypt.org/windivert-doc.html#filter_language for more
    information.

Limitation: currently limited to `autofp` runmode.

Additionally:
- `tmm_modules` now zeroed during `RegisterAllModules`
- fixed Windows Vista+ `inet_ntop` call in `PrintInet`
- fixed `GetRandom` bug (nonexistent keys) on fresh Windows installs
- fixed `RandomGetClock` building on Windows builds
- Added WMI queries for MTU
 6 years ago
Chris Speidel 1e8959b465 doc: fix minor typo 6 years ago
Victor Julien 693a3df031 tls: document encrypt-handling option 
Document in sample yaml and user guide.
 6 years ago
Victor Julien c677e07d3e kerberos: minor doc updates, add author 6 years ago
Jason Ish fb85822730 dhcp: update user guide 6 years ago
Pierre Chifflier c51ff32adb Document Kerberos 5 parsing events 6 years ago
Pierre Chifflier 1076c7cd47 Add krb5_err_code detection keyword 6 years ago
Pierre Chifflier d6b9c0294a Add krb5_cname and krb5_sname detection keywords 6 years ago
Pierre Chifflier 0bd81ff838 Add krb5_msg_type detection keyword 6 years ago
Pierre Chifflier 1e5f5d405f Kerberos 5: add support for TCP as well 6 years ago
Pascal Delalande 4f48927c44 doc: spelling mistakes in various sections of the user guide 7 years ago
Max Fillinger ce270a8f6a Add info about pcap log compression to user guide 7 years ago
Eric Leblond e249ce29bb doc: add lua directory to Makefile 7 years ago
Victor Julien 4a90dced8e doc/lua: small update to the usage intro 7 years ago
Eric Leblond 2546e86a16 doc: document lua function about flow var 7 years ago