146 Commits (56f49bfe8e657b8fcc4d2a8f358e69190f90f8d9)

Author	SHA1	Message	Date
Victor Julien	d8edea904c	stream/rules: add example rule for pkt_spurious_retransmission	2 years ago
Victor Julien	dc57460427	smb: fix event types for limit exceeded rules	3 years ago
Victor Julien	b0354437d5	smb/rules: add rules for new events	3 years ago
Sascha Steinbiss	1ba62993d5	mqtt: raise event on parse error	3 years ago
Philippe Antoine	acbe6a33a2	ssh: install app-layer events rules	3 years ago
Jason Ish	1e65324940	smb: rules for messages in the wrong direction	3 years ago
Philippe Antoine	8adf172ab8	nfs: limits the number of active transactions per flow ... Ticket: 4530	3 years ago
Philippe Antoine	a8079dc978	mqtt: limits the number of active transactions per flow ... Ticket: 4530 So, that we do not get DOS by quadratic complexity, while looking for a new pkt_id over the ever growing list of active transactions	3 years ago
Philippe Antoine	5475212f21	http2: limits the number of active transactions per flow ... Ticket: 4530 So, that we do not get DOS by quadratic complexity, while looking for a new stream id over the ever growing list of active streams	3 years ago
Philippe Antoine	df2cbd6517	http2: event for variable-length integer overflow ... http2_parse_var_uint can overflow the variable-length integer it is decoding. In this case, it now returns an error of kind LengthValue. The new function http2_parse_headers_blocks, which factorizes the code loop for headers, push promise, and continuation, will check for this specific error, and instead of erroring itself, will return the list of so far parsed headers, plus another one with HTTP2HeaderDecodeStatus::HTTP2HeaderDecodeIntegerOverflow This status is then checked by process_headers to create an app-layer event.	3 years ago
Philippe Antoine	334b1382e0	http: : fix int warnings ... Explicitly truncate file names to UINT16_MAX Before, they got implicitly truncated, meaning a UINT16_MAX + 1 file name, went to 0 file name (because of modulo 65536)	3 years ago
Philippe Antoine	e1c0725e05	doc: fix typo lenght/length	3 years ago
Philippe Antoine	6cb6225b28	tcp: rejects FIN+SYN packets as invalid ... Ticket: #4569 If a FIN+SYN packet is sent, the destination may keep the connection alive instead of starting to close it. In this case, a later SYN packet will be ignored by the destination. Previously, Suricata considered this a session reuse, and thus used the sequence number of the last SYN packet, instead of using the one of the live connection, leading to evasion. This commit errors on FIN+SYN so that they do not get processed as regular FIN packets.	3 years ago
Philippe Antoine	98f84d5a9b	http2: follow range requests ... Move the content-range parsing code to rust	3 years ago
Philippe Antoine	e82416a415	http/range: reassemble files from different flows with range ... adds a container, ie a thread safe hash table whose key is the filename keep a tree of unordered ranges, up to a memcap limit adds HTPFileOpenWithRange to handle like HTPFileOpen if there is a range : open 2 files, one for the whole reassembled, and one only for the current range	3 years ago
Philippe Antoine	ca760e305c	ipv6: decoder event on invalid length ... From RFC 2460, section 4.5, each fragment, except the last one, must have a length which is a multiple of 8	3 years ago
frank honza	f83d51d0cb	ike: set event for multiple server proposals	4 years ago
Jeff Lucovsky	1ddad0a0d6	decode/events: VNTAG decoder events	4 years ago
Andreas Herz	c93073c246	rules: add newer rule files to makefile for release tarball	4 years ago
frank honza	ecdf9f6b0b	ikev1: rename ikev2 to common ike ... Renaming was done with shell commands, git mv for moving the files and content like find -iname '*.c' | xargs sed -i 's/ikev1/ike/g' respecting the different mixes of upper/lower case.	4 years ago
Philippe Antoine	7500c29300	decode: limits the number of decoded layers ... so as to avoid overrecursion leading to stack exhaustion	4 years ago
Philippe Antoine	d861228214	http2: decompression for files ... gzip and brotli decompression for files	4 years ago
Jason Ish	8bd68478a4	rules/mqtt: renumber mqtt events to avoid conflict with ssh ... Both SSH and MQTT events were in the 2228000 range. As SSH was added first, renumber MQTT events into the 2229000 range which is free.	4 years ago
Philippe Antoine	caa7946888	smb: adds file overlap event against evasions ... Evasion scenario is - a first dummy write of one byte at offset 0 is done - the second full write of EICAR at offset 0 is then done and does not trigger detection The last write had the final value, and as we cannot "cancel" the previous write, we set an event which is then transformed into an app-layer decoder alert	4 years ago
Jason Ish	2b1bbd08a3	rules/tls: sync with changes to the TLS events ... Sync rules with event changes in commit 01aef49cbd.	4 years ago
Philippe Antoine	6694737fcf	http2: settings from http1 upgrade	4 years ago
Philippe Antoine	1422b18a99	http2: initial support	4 years ago
Sascha Steinbiss	c31360070b	rust/mqtt: add MQTT parser	4 years ago
Philippe Antoine	5a98035bac	rules: add SSH decoder events rules	4 years ago
Philippe Antoine	053c728871	http: adds debug check against too many warnings	5 years ago
Victor Julien	328a94206e	decode/hdlc: initial support	5 years ago
Jason Ish	ca5a3f0f04	dns: cleanup: remove unused events ... Removed events that are no longer used since the Rust implementation of DNS: - UnsolicitedResponse - StateMemCapReached - Flooded	5 years ago
Jeff Lucovsky	130b8d26e7	smtp/mime: Set event when name exceeds limit	5 years ago
William Stearns	7e47fc58af	rules: fix files.rules typo	5 years ago
Philippe Antoine	af4f816204	http: sets compression bomb limit	5 years ago
Philippe Antoine	9cbf9ef7a4	HTTP new parser warning for Ambiguous C-L	5 years ago
Victor Julien	c9c23d5cda	htp: set lzma memlimit from config	5 years ago
Jason Ish	e3cfc9fc4b	rules: install dhcp-events.rules; order alphabetically ... Add dhcp-events.rules to Makefile.am so it gets installed. Also order the rule files alphabetically for easier review.	5 years ago
Philippe Antoine	b5f3e03209	New app layer event for invalid http request line ... Handles logs from libhtp even if case of error	5 years ago
Philippe Antoine	8a339e73d3	http: adds an event for double encoded uri	5 years ago
Philippe Antoine	3e12066819	http: adds events for each libhtp log ... Fixes #997	5 years ago
Philippe Antoine	b6b7778e2d	http: adds event for header repetition	6 years ago
Jason Ish	275e8f280d	rules: add mpls packet too small decoder rule	6 years ago
Philippe Antoine	a1c6e091ac	http: new event for auth unrecognized ... activates libhtp auth parsing Fixes #984	6 years ago
Pierre Chifflier	27b0775d27	rules: fix event names for ikev2 (weak authentication and DH parameters)	6 years ago
Victor Julien	fa2ce043cf	ipv6: disable zero len padN rule by default	6 years ago
Victor Julien	631ee383bb	flow/stream: 'wrong thread' as stream event & counter ... Set event at most once per flow, for the first 'wrong' packet. Add 'tcp.pkt_on_wrong_thread' counter. This is incremented for each 'wrong' packet. Note that the first packet for a flow determines what thread is 'correct'.	6 years ago
Victor Julien	17ced4fb7f	smb: add smb-events.rules to dist	6 years ago
Victor Julien	843d0b7a10	stream: support RST getting lost/ignored ... In case of a valid RST on a SYN, the state is switched to 'TCP_CLOSED'. However, the target of the RST may not have received it, or may not have accepted it. Also, the RST may have been injected, so the supposed sender may not actually be aware of the RST that was sent in it's name. In this case the previous behavior was to switch the state to CLOSED and accept no further TCP updates or stream reassembly. This patch changes this. It still switches the state to CLOSED, as this is by far the most likely to be correct. However, it will reconsider the state if the receiver continues to talk. To do this on each state change the previous state will be recorded in TcpSession::pstate. If a non-RST packet is received after a RST, this TcpSession::pstate is used to try to continue the conversation. If the (supposed) sender of the RST is also continueing the conversation as normal, it's highly likely it didn't send the RST. In this case a stream event is generated. Ticket: #2501 Reported-By: Kirill Shipulin	6 years ago
Victor Julien	d0cded2523	http: set events for too many layers of compression ... libhtp would already issue warnings, but these were not mapped to events yet.	6 years ago