5386 Commits (5cdb21ec34b20b72d457055470cae485201a002e)

 

All Branches   

Search

Author	SHA1	Message	Date
Ken Steele	5cdb21ec34	Remove an unused define COUNTER_DETECT_ALERTS ... The only place this exists in the code is when it is defined.	10 years ago
Ken Steele	18e2de320b	Coding style cleanup in detect-modbus files.	10 years ago
Ken Steele	ff41c1c452	Correct size increase in SigGroupHeadStore() ... The code was increasing the size of the allocated memory by 16, but only increasing the stored size by 10. Now uses one variable for both places.	10 years ago
DIALLO David	55c5081240	Detect-engine: Add Modbus detection engine ... Management of Modbus Tx Based on DNS source code. Signed-off-by: David DIALLO <diallo@et.esia.fr>	10 years ago
DIALLO David	b3bf2f9939	Detect: Add Modbus keyword management ... Add the modbus.function and subfunction) keywords for public function match in rules (Modbus layer). Matching based on code function, and if necessary, sub-function code or based on category (assigned, unassigned, public, user or reserved) and negation is permitted. Add the modbus.access keyword for read/write Modbus function match in rules (Modbus layer). Matching based on access type (read or write), and/or function type (discretes, coils, input or holding) and, if necessary, read or write address access, and, if necessary, value to write. For address and value matching, "<", ">" and "<>" is permitted. Based on TLS source code and file size source code (address and value matching). Signed-off-by: David DIALLO <diallo@et.esia.fr>	10 years ago
DIALLO David	5a0409959f	App-layer: Add Modbus protocol parser ... Decode Modbus request and response messages, and extracts MODBUS Application Protocol header and the code function. In case of read/write function, extracts message contents (read/write address, quantity, count, data to write). Links request and response messages in a transaction according to Transaction Identifier (transaction management based on DNS source code). MODBUS Messaging on TCP/IP Implementation Guide V1.0b (http://www.modbus.org/docs/Modbus_Messaging_Implementation_Guide_V1_0b.pdf) MODBUS Application Protocol Specification V1.1b3 (http://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b3.pdf) Based on DNS source code. Signed-off-by: David DIALLO <diallo@et.esia.fr>	10 years ago
Victor Julien	0b28943487	Update Changelog for 2.1beta2 release	10 years ago
Christophe M	6c2ae469be	Fix to output a JSON buffer to an Unix domain socket. ... Create the JSON buffer and write to it like regular file. Upper function SCConfLogOpenGeneric already handle it properly. Closes issue #1246.	10 years ago
Victor Julien	27007cc7d5	Fix Coverity issue in SMTP output ... ** CID 1250327: Uninitialized pointer read (UNINIT) /src/output-json-email-common.c: 117 in JsonEmailLogJson() /src/output-json-email-common.c: 139 in JsonEmailLogJson()	10 years ago
Victor Julien	7c3b22da22	smtp: don't create a new tx for rset/quit ... A tx is considered complete after the data command completed. However, this would lead to RSET and QUIT commands setting up a new tx. This patch simply adds a check that refuses to setup a new tx when these commands are encountered after the data portion is complete.	10 years ago
Victor Julien	f7c2c219cd	filestore: fix crash if keyword setup fails ... SigMatch would be added to list, then the alproto check failed, leading to freeing of sm. But as it was still in the list, the list now contained a dangling pointer.	10 years ago
Victor Julien	9d2a0c39e5	mime: fix output issues ... When multiple email addresses were in the 'to' field, sometimes they would be logged as "\r\n \"Name\" <email>". The \r\n was added by GetFullValue in the mime decoder, for unknown reasons. Disabling this seems to have no drawbacks.	10 years ago
Victor Julien	ebd6737b65	mime: fix compiler warning	10 years ago
Victor Julien	20a175f315	mime: improve error checking	10 years ago
Victor Julien	5461294a52	smtp: fix SMTPParserTest14 on 32bit	10 years ago
Victor Julien	9d33131d37	smtp: improve ProcessDataChunk error checking	10 years ago
Victor Julien	d209699a41	smtp: expand tx use ... Instead of just using TX for mime decoding, it is now also used for tracking decoder events.	10 years ago
Victor Julien	d67289b60e	output-filedata: close files even w/o data ... If there is no data chunk but the file is closed/truncated anyway, logging is still required.	10 years ago
Victor Julien	08b06bac3f	smtp: register file truncate callback ... Tag files as truncated from this callback so storing/logging displays the correct info.	10 years ago
Victor Julien	2b9ef87527	smtp: convert logger to tx logger ... Move from packet logger to tx logger.	10 years ago
Victor Julien	d0357c6169	smtp: add file inspection engine ... Fix file inspection engine. TODO: test	10 years ago
Victor Julien	56b74c8b5b	smtp: make TX aware ... Store mime decoding context per transaction. For this the parser creates a TX when the mime body decoding starts.	10 years ago
Victor Julien	cb4440324e	mime: redo PrintChars using PrintRawDataFp	10 years ago
Victor Julien	f979e92f68	decode mime: refactor & cleanup ... Partly to work around cppchecks: [src/util-decode-mime.c:1085]: (error) Memory leak: url	10 years ago
Victor Julien	54df86658c	mime: rename mime-decode.[ch] to util-decode-mime.[ch]	10 years ago
Victor Julien	6035470ffb	mime: style updates	10 years ago
Victor Julien	595acf2dfc	mime decode: reshuffle data structures to reduce structure sizes	10 years ago
Victor Julien	9a573c5704	output smtp: fix call	10 years ago
Victor Julien	de44a5af94	decode mime: clean up includes	10 years ago
Victor Julien	cd55b657c2	mime decode: improve MimeDecParseLineTest01 and MimeDecParseLineTest02 tests	10 years ago
Victor Julien	dd4b506cc2	decode mime: fix scan-build issues	10 years ago
Victor Julien	f91d52a0d2	mime decode: fix memory leak	10 years ago
Victor Julien	bffceb7115	mime decode: remove unused url counter	10 years ago
Victor Julien	d72f8c7de5	output smtp: clean up memory at shutdown	10 years ago
Victor Julien	c712ab2299	Fix compiler warning	10 years ago
Victor Julien	106bbc78e1	mime: refactor buffer use ... Turn all buffers into uint8_t (from char) and no longer use the string functions like strncpy/strncasecmp on them. Store url and field names as lowercase, and also search/compare them as lowercase. This allows us to use SCMemcmp.	10 years ago
Tom DeCanio	f55c94cb54	smtp-mime: preinitialize base64 decoder space ... Preinit with zeros.	10 years ago
Tom DeCanio	c279f07d2a	mime-decode: clean up after MimeDecParseFullMsgTest01.	10 years ago
Tom DeCanio	4503ffeee9	mime-decode: fix minor memory leak if Mime parser initialization were to fail.	10 years ago
Tom DeCanio	1ab5f72fdd	mime-decode: remove "comparison between signed and unsigned integer expressions" ... warnings	10 years ago
Tom DeCanio	e5c36952d6	app-layer-smtp: move old smtp-mime section in suricata.yaml into ... app-layer-protocols.smtp.mine section and update code to accomodate.	10 years ago
Tom DeCanio	3e10ee4608	PR review comment. Use protocol to discern log type.	10 years ago
Tom DeCanio	f1c160ed22	smtp: turn on smtp mime decoding and enable smtp eve logging.	10 years ago
Tom DeCanio	746da75615	eve-log: catch and log URLs in basic text emails without mime encapsulation. ... expand pointer walk protection.	10 years ago
Tom DeCanio	471967aafd	mime-decode: don't scan attachment's data for URLs. ... move event pointer lookup inside extract_urls and protect pointer walk.	10 years ago
Tom DeCanio	6467a5d563	app-layer-smtp: fix Test14. ... Was running one byte past end of buffer. Declare Unit Test 14's data as static.	10 years ago
Eric Leblond	260872ccd9	smtp layer: fix unittests ... Synchronize test 14 with the new application layer API and improve debug messages.	10 years ago
Tom DeCanio	31f8f5cf20	eve-log: SMTP JSON logger	10 years ago
Tom DeCanio	7850d896a8	smtp-mime: add server reply codes returned from outlook server	10 years ago
David Abarbanel	c2dc686742	SMTP MIME Email Message decoder	10 years ago