aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
8,968 Commits
8 Branches
165 Tags
223 MiB
main-8.0.x
main
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '5b954212f7'
${ noResults }
Commit Graph

7852 Commits (5b954212f73dc4e9f838370667d087f91455ae6a)

Author SHA1 Message Date
Mats Klepsland 5b954212f7 detect-tls-ja3-hash: add warning if nocase is used 8 years ago
Mats Klepsland 2501d48ac8 detect-tls-cert-serial: add warning if nocase is used 8 years ago
Mats Klepsland 2c5d5bbdaa detect-tls-cert-fingerprint: add warning if nocase is used 8 years ago
Mats Klepsland 4c9d448fa1 detect-tls-ja3-hash: add content validation callback 
Validate that the content that follows the 'ja3_hash' keyword has
the correct length.
 8 years ago
Mats Klepsland 52d9d45747 detect-tls-cert-fingerprint: add setup callback to lowercase content 
Add setup callback that lowercase the content that follows
'tls_cert_fingerprint'.
 8 years ago
Mats Klepsland f788719348 detect-tls-cert-fingerprint: add content validation callback 
Validate that the content that follows the 'tls_cert_fingerprint'
keyword is on the correct form and has the correct length.
 8 years ago
Mats Klepsland 6cf4c3c26e detect-tls-cert-serial: add setup callback to uppercase content 
Add setup callback that uppercase the content that follows
'tls_cert_serial'.
 8 years ago
Mats Klepsland 321603de37 detect-engine: add DetectEngineCtx to setup callback function 
Add detect engine context as variable to setup callback function
in 'DetectBufferTypeRegisterSetupCallback'.
 8 years ago
Mats Klepsland 48a5ea9df0 detect-tls-cert-serial: add content validation callback 
Validate that the content that follows the 'tls_cert_serial' keyword
is on the correct form. If it's longer than two bytes it should be
separated by colons.
 8 years ago
Max Fillinger b85a0b188b Add an option for compressing pcap-log files 
Introduces the option 'outputs.pcap-log.compression' which can be set
to 'none' or 'lz4', plus options to set the compression level and to
enable checksums. SCFmemopen is used to make pcap_dump() write to a
buffer which is then compressed using liblz4.
 8 years ago
Eric Leblond 6062c27eb7 af-packet: kill some white spaces 8 years ago
Eric Leblond 75b6972cfd util-ioctl: fix a typo in setter message 8 years ago
Eric Leblond f53e687bb8 af-packet: dump counters when timeout occurs 
When traffic is becoming null (mainly seen in tests) we reach the
situation where there is timeouts in the poll on the socket and
only that. Existing code is then just looping on the poll and
the result is that the packet iface counters are not updated.

This patch calls the dump counter function to be sure to get
the counter right faster (and not only right at exit).
 8 years ago
Victor Julien 8a5710307d hyperscan: don't abort on payloads > 64k 
SPM API was recently updated to accept 32 bit length fields instead of
16 bits. This could trigger a BUG_ON in the hyperscan implementation.
 8 years ago
Victor Julien a5de9968dd gcc8: fix format truncation warnings 8 years ago
Victor Julien 5faaa5dceb file_data/http: inspect cleanup 8 years ago
Eric Leblond 1d0727d85f stream-tcp: fix stream depth computation 
The stream depth computation was partly done with the stream_config
depth instead of using the value in the TCP session. As a result,
some configuration were resulting in abnormal behavior.

In particular, when stream depth was 0 and the file store depth was
not 0, Suricata was stopping the streaming on the flow as soon as
the filestore was started.

Reported-by: Pascal Delalande <pdl35@free.fr>
 8 years ago
Eric Leblond 1012fc4466 file: update logger API to log direction 
By adding the flow direction to the logger we can have an accurate
logging of fileinfo events that has source and destination IP
correctly set.
 8 years ago
Eric Leblond 2515c8927b app-layer-ftp: fill direction of transfer 
This is required to return the file when asked with one direction.
 8 years ago
Maurizio Abba d2bf7a3ba9 detect: fix buffer length to uint32 
There is a difference in the size of the buffer length as passed from
the content buffers (cfr HttpReassembledBody.buffer_len) and the buflen
variable passed to mpm primitives. This can cause a misdetection
whenever the bufferlen is multiple of 65536 (as uint16(X*65536) == 0).
Increasing the buflen variable type to uint32 solves the issue (this
does not cause any issue with primitives, they all accept uint32).
 8 years ago
Victor Julien 2e8fd612a6 files: properly close files on flow timeout 
If a file transfer stops on flow timeout, it won't be closed or
truncated. This patch makes sure that in such cases the files
are indeed truncated. This fixes the filestore-v2 output module,
as that requires a sha256 for storing the partial file correctly.
 8 years ago
Victor Julien 81c0b53d3f flow: track flow for ip proto 41 8 years ago
Victor Julien 8c75a022ea eve/netflow: only log response record if we've seen response pkts 8 years ago
Victor Julien c662383b53 flow: track flow for ICMP 
Change packet layout to allow for expected counterpart type.
 8 years ago
Victor Julien 708aad3f4a unified2: address strict aliasing issue 8 years ago
Victor Julien 7ce77f9351 decode/ipv6: expose addr as 'struct in6_addr' as well 8 years ago
Victor Julien 49b02f8f1b mingw: minor compile warning fixes 8 years ago
Giuseppe Longo 28849509b2 tests/detect-engine-hsbd: deinit det_ctx threads 8 years ago
Giuseppe Longo c620fc3dc4 detect-engine: free events 
Events are stored in a detection engine but actually
they are not freed.
 8 years ago
Victor Julien f461be75c5 smb: use inspect API v2 for smb keywords 
Simplies code and supports transforms.
 8 years ago
Victor Julien 3854c304d8 mpm/hs: fix minor coverity warning 
CID 1428797 (#1 of 1): Unchecked return value (CHECKED_RETURN)
    check_return: Calling HashTableAdd without checking return value
    (as is done elsewhere 5 out of 6 times).
 8 years ago
Victor Julien e834d94fd2 detect/pktvar: clean up keyword parsing 8 years ago
Alexander Gozman 10a360280f Print syslog format with SCLogDebug() instead of printf() 8 years ago
Mats Klepsland 21078521f8 app-layer-ssl: remove possibility to overflow HAS_SPACE macro 8 years ago
Mats Klepsland 598ef96b7b app-layer-ssl: really fix CID 1433623 8 years ago
Mats Klepsland 900c27e235 app-layer-ssl: fix use-after-free (CID 1433623) 
Ja3BufferAddValue frees the buffer on error, so there is no point
in doing it twice (use-after-free).
 8 years ago
Mats Klepsland fc0e339467 app-layer-ssl: fix use-after-free (CID 14336229) 
Nullify JA3 buffer on free to avoid use-after-free vulnerability.
 8 years ago
Victor Julien 3b474ac599 tls: work around coverity warnings 8 years ago
Alexander Gozman 5c1a2b53f9 Bug #2466: map SC_LOG_CONFIG level to syslogs LOG_DEBUG 8 years ago
Mats Klepsland 7f0cfc0717 app-layer-ssl: use BIT_U32 for flags 8 years ago
Mats Klepsland 3e597512ea app-layer-tls-handshake: remove since it is no longer needed 
Remove this file and all its content, since the functionality
was reimplemented in app-layer-ssl.
 8 years ago
Mats Klepsland e93fef5c44 app-layer-ssl: reimplement function for decoding certificates 
Do a complete rewrite of the function for decoding the SSL/TLS
certificate from the handshake.
 8 years ago
Mats Klepsland d9ddae4592 tls: replace variable in header file with TAILQ_EMPTY() 
Use TAILQ_EMPTY to check if a certificate exists instead of
setting two variables in the app-layer-ssl header file for
that purpose only.
 8 years ago
Victor Julien f201a3761f rust: remove multi level 'experimental' 
Don't treat 'external' parsers as more experimental. All parsers
depend on crates to some extend, and all have C glue code. So the
distinction doesn't really make sense.
 8 years ago
Pierre Chifflier bf66948ad7 IKEv2: suppress some debug output 8 years ago
Pierre Chifflier 4e4cf00c07 Remove the 'experimental' mark for IKEv2 8 years ago
Pierre Chifflier d94346282c Add logger for IKEv2 8 years ago
Pierre Chifflier c99b9462d7 Add new parser: IKEv2 
Add a new parser for Internet Key Exchange version (IKEv2), defined in
RFC 7296.
The IKEv2 parser itself is external. The embedded code includes the
parser state and associated variables, the state machine, and the
detection code.

The parser looks the first two messages of a connection, and analyzes
the client and server proposals to check the cryptographic parameters.
 8 years ago
Victor Julien 1e56cfe08e threshold: don't touch globals after init 
Don't free/reinit pcre globals per tenant. Others may be using them
at the same time, or try to free/reinit them at the same time.
 8 years ago
Mats Klepsland efdc592172 detect-tls-sni: use *_Register2 API functions 
Use *_Register2 API functions when registering 'tls_sni' detection
keyword.
 8 years ago