8913 Commits (5de77e3102acb991b20e2e24313d689135b4d237)

 

All Branches   

Search

Author	SHA1	Message	Date
Richard Sailer	5de77e3102	lua output: Update example script to match style of user doc examples	7 years ago
Richard Sailer	dc07c1fe13	lua output doc: Use more descriptive variable names in the examples ... This also removes the "args" parameter of the hooking functions in the examples, since this parameter is unused in all functions. It would not be very helpful anyways since 3 of the 4 functions don't get passed any parameters. The only exception is init() which gets a table containing: script_api_ver = 1	7 years ago
Richard Sailer	3307f7a94e	lua output doc: Add explaining introduction text	7 years ago
Victor Julien	e09027915a	doc: fix json formatting in smb doc	7 years ago
Alexander Gozman	10a360280f	Print syslog format with SCLogDebug() instead of printf()	7 years ago
Mats Klepsland	21078521f8	app-layer-ssl: remove possibility to overflow HAS_SPACE macro	7 years ago
Mats Klepsland	598ef96b7b	app-layer-ssl: really fix CID 1433623	7 years ago
Victor Julien	67e81a9555	doc: initial smb eve documentation	7 years ago
Victor Julien	78437375c4	doc: add by_either to suppress explanation	7 years ago
Victor Julien	2c259f2239	doc: add smb section to yaml	7 years ago
Victor Julien	13bdcd5249	doc: minor fix	7 years ago
Mats Klepsland	900c27e235	app-layer-ssl: fix use-after-free (CID 1433623) ... Ja3BufferAddValue frees the buffer on error, so there is no point in doing it twice (use-after-free).	7 years ago
Mats Klepsland	fc0e339467	app-layer-ssl: fix use-after-free (CID 14336229) ... Nullify JA3 buffer on free to avoid use-after-free vulnerability.	7 years ago
Victor Julien	3b474ac599	tls: work around coverity warnings	7 years ago
Victor Julien	1edd9d19fc	doc: add SMB to file extraction. Minor improvements.	7 years ago
Victor Julien	b4771150b8	doc: update suricata-update screenshot	7 years ago
Victor Julien	b531e7725d	doc: improve suricata-update docs now that its bundled	7 years ago
Victor Julien	ac1ed24cb4	doc: improve making sense of alerts	7 years ago
Victor Julien	ccde621ceb	doc: add suricata-update to intro for rules	7 years ago
Alexander Gozman	5c1a2b53f9	Bug #2466: map SC_LOG_CONFIG level to syslogs LOG_DEBUG	7 years ago
Jason Ish	43617dc11f	suricatasc: move lib to suricata.sc ... Pull the sc python package under the suricata top level package. A suricatasc package still exists for compatibility that pulls in suricata.sc.	7 years ago
Jason Ish	4a115f4d56	suricatasc: allow to run from non-standard python locations ... When we install to a non-standard prefix, the Python modules are not in the standard location requiring the PYTHONPATH to be fixed up. This wa a pre-existing issue with suricatasc, and not due to the move into the python directory.	7 years ago
Jason Ish	a7d90162d1	suricatasc: move into python/ ... Will be built and installed as part of the Python code used for suricatactl, which is intended to be the generic place for all Python utility code that gets installed with Suricata. No change to suricatasc code.	7 years ago
Mats Klepsland	7f0cfc0717	app-layer-ssl: use BIT_U32 for flags	7 years ago
Mats Klepsland	3e597512ea	app-layer-tls-handshake: remove since it is no longer needed ... Remove this file and all its content, since the functionality was reimplemented in app-layer-ssl.	7 years ago
Mats Klepsland	e93fef5c44	app-layer-ssl: reimplement function for decoding certificates ... Do a complete rewrite of the function for decoding the SSL/TLS certificate from the handshake.	7 years ago
Mats Klepsland	d9ddae4592	tls: replace variable in header file with TAILQ_EMPTY() ... Use TAILQ_EMPTY to check if a certificate exists instead of setting two variables in the app-layer-ssl header file for that purpose only.	7 years ago
Victor Julien	f40fc0293b	smb: minor optimizations	7 years ago
Victor Julien	f201a3761f	rust: remove multi level 'experimental' ... Don't treat 'external' parsers as more experimental. All parsers depend on crates to some extend, and all have C glue code. So the distinction doesn't really make sense.	7 years ago
Pierre Chifflier	d222b9ae6c	IKEv2: Use JSON arrays instead of comma-separated values	7 years ago
Pierre Chifflier	bf66948ad7	IKEv2: suppress some debug output	7 years ago
Pierre Chifflier	3fbfb22204	IKEv2: remove events counter	7 years ago
Pierre Chifflier	6eb48e1e93	Add ikev2 to userguide	7 years ago
Pierre Chifflier	4e4cf00c07	Remove the 'experimental' mark for IKEv2	7 years ago
Pierre Chifflier	f65fafa34b	IKEv2 logger: use Debug trait for IkePayloadType	7 years ago
Pierre Chifflier	d94346282c	Add logger for IKEv2	7 years ago
Pierre Chifflier	d16397ce61	Add rules for IKEv2 events	7 years ago
Pierre Chifflier	c99b9462d7	Add new parser: IKEv2 ... Add a new parser for Internet Key Exchange version (IKEv2), defined in RFC 7296. The IKEv2 parser itself is external. The embedded code includes the parser state and associated variables, the state machine, and the detection code. The parser looks the first two messages of a connection, and analyzes the client and server proposals to check the cryptographic parameters.	7 years ago
Pierre Chifflier	b810275b16	Rust: fix prototype of parsing function (make pstate mutable)	7 years ago
Pierre Chifflier	8e8f0db192	Rust: expose function AppLayerParserStateSetFlag	7 years ago
Renato Botelho	8f926fb75a	configure: allow to disable libnss and libnspr ... Let user chose to disable libnss and libnspr support even if these libraries are installed in the system. Default remains to enable when libraries are found and disable parameter were not used	7 years ago
Victor Julien	91307dafd9	nfs/rpc: fix reponse parsing	7 years ago
Victor Julien	b1e2783788	auth/krb5: move kerberos5 wrapper to rust root ... Make it available outside of just the SMB parser.	7 years ago
Victor Julien	4d58aaae90	smb: clean up partial read/write record handling	7 years ago
Victor Julien	aa8d64c2b8	smb: improve skip handling ... When skipping records the skip tracker could underflow if the record parsing had more data than expected. Enforce the calculation by moving it into a method and make the actual fields private.	7 years ago
Victor Julien	eac7a92200	smb2: improve read/write record parsing ... parse_smb2_response_read()/parse_smb2_response_write() can be called on incomplete data, so they didn't use the read/write length field to grab the data field. Instead it just used rest(). However in some cases SMB2 records have trailing data, which would be included in the READ/WRITE data. This patch addresses this by using the length field if enough data is available.	7 years ago
Victor Julien	97c224d193	changelog: update for 4.1.0-beta1	7 years ago
Victor Julien	26e807ca34	doc: fix http_header_names example	7 years ago
Victor Julien	1e56cfe08e	threshold: don't touch globals after init ... Don't free/reinit pcre globals per tenant. Others may be using them at the same time, or try to free/reinit them at the same time.	7 years ago
Mats Klepsland	efdc592172	detect-tls-sni: use *_Register2 API functions ... Use *_Register2 API functions when registering 'tls_sni' detection keyword.	7 years ago