9061 Commits (64b6ff7392341f1f5abe81f7942351df4900ec57)

 

All Branches   

Search

Author	SHA1	Message	Date
Mats Klepsland	b1dd41c9cd	detect-tls-cert-issuer: use *_Register2 API functions ... Use *_Register2 API functions when registering 'tls_cert_issuer' detection keyword.	7 years ago
Mats Klepsland	c3a329d6e9	detect-tls-cert-fingerprint: use *_Register2 API functions ... Use *_Register2 API functions when registering 'tls_cert_fingerprint' detection keyword.	7 years ago
Victor Julien	53f63f7498	nfs/rpc: improve RPCv2 parser, add GssApi ... Improve RPCv2 credentials parsing. Add GssApi and turn creds into an enum. Minor cleanups and optimizations.	7 years ago
Victor Julien	47ebef3af8	nfs: minor cleanup	7 years ago
Antoine LUONG	56e7afc4f7	prelude: swap msg and class_msg in Prelude alert	7 years ago
Antoine LUONG	caa2903f1f	prelude: fix duplicated analyzer in Prelude alert	7 years ago
Danny Browning	697a5a1978	pcap/file: fix missing files stopping engine #2451 ... https://redmine.openinfosecfoundation.org/issues/2451 When a missing (or empty named) file is passed to source-pcap-file while using unix socket, the pcap processing thread will incorrectly be stopped, and no longer available for subsequent files.	7 years ago
Alexander Gozman	2cf2387e31	rules: optimize bidir rules with same src/dst ... As an optimization, reset bidirectional flag for rules with same src and dst. If one created bidirectional rule like 'alert tcp any any <> any any ...', the rule was checked twice (for each packet in every direction). This is suboptimal and may give duplicated alerts. To avoid this, bidirectional rules are now checked for the same src and dst (addresses and ports) and if it's the case, the rule is treated as unidirectional and a corresponding message is logged.	7 years ago
Eric Leblond	0a72d5be96	doc: fix typo in unix socket doc ... Also fixes a dead link to code.	7 years ago
Eric Leblond	975f413308	doc: more info on unix socket rule reload	7 years ago
Eric Leblond	e2aab10d29	doc: fix typo in ebpf xdp doc	7 years ago
Eric Leblond	66b37d8689	suricata.yaml: fix some spelling mistakes	7 years ago
Victor Julien	ba24bb82fa	der: don't overwrite errcode ... If the code has already been set it is more detailed than the more generic 'invalid object'.	7 years ago
Jason Ish	cbcbc0f6b0	suricata-update: bundle suricata update ... Add autoconf/automake support for installing suricata-update if found in the top level suricata-update.	7 years ago
Mats Klepsland	c130820bff	conf: user-configurable umask setting ... Make umask user-configurable by setting 'umask' in suricata.yaml.	7 years ago
Pierre Chifflier	3140e4598a	DER parser: ensure errcode is set for every return path	7 years ago
Pierre Chifflier	2d34e402c0	DER parser: fix undefined behaviors and add missing length tests ... Fix several undefined behaviors, caused by possible use or read of uninitialized memory.	7 years ago
Antti Tönkyrä	d6a98aa1c3	stream-tcp: add counters for midstream pickups ... If midstream pickups are enabled this will help in discovering how many midstream pickups are being done by Suricata.	7 years ago
Mats Klepsland	47a7ebbbc2	doc: add JA3 fields to the TLS logger documentation	7 years ago
Mats Klepsland	d55e455504	eve: add JA3 fields to TLS JSON logger ... Add JA3 object to TLS JSON logger (extended log).	7 years ago
Mats Klepsland	fb0bfb614f	doc: add documentation for Ja3GetString Lua function	7 years ago
Mats Klepsland	8339ed338f	lua: add Ja3GetString function ... Add Ja3GetString() to return the content of the JA3 string buffer from the TLS session. Example: function init (args) local needs = {} needs["protocol"] = "tls" return needs end function setup (args) filename = SCLogPath() .. "/ja3_string.log" file = assert(io.open(filename, "a")) end function log (args) ja3_string = Ja3GetString() if ja3_string == nil then return end file:write(ja3_string .. "\n") file:flush() end function deinit (args) file:close() end	7 years ago
Mats Klepsland	2514553098	doc: add documentation for Ja3GetHash Lua function	7 years ago
Mats Klepsland	195fa9d272	lua: add Ja3GetHash function ... Add Ja3GetHash() to return the content of the JA3 hash buffer from the TLS session. Example: function init (args) local needs = {} needs["protocol"] = "tls" return needs end function setup (args) filename = SCLogPath() .. "/ja3_hash.log" file = assert(io.open(filename, "a")) end function log (args) ja3_hash = Ja3GetHash() if ja3_hash == nil then return end file:write(ja3_hash .. "\n") file:flush() end function deinit (args) file:close() end In the (useless) example above, each JA3 hash is logged to a log file.	7 years ago
Mats Klepsland	a357f52fa5	doc: add documentation for ja3_string keyword	7 years ago
Mats Klepsland	6e23ae230b	detect: add (mpm) keyword ja3_string ... Match on JA3 string using ja3_string keyword, e.g: alert tls any any -> any any (msg:"JA3 string test"; ja3_string; content:"65-68-69-102"; sid:1;)	7 years ago
Mats Klepsland	38cc6f595f	doc: add documentation for ja3_hash keyword	7 years ago
Mats Klepsland	6c7aacce9e	detect: add (mpm) keyword ja3_hash ... Match on JA3 hash using ja3_hash keyword, e.g: alert tls any any -> any any (msg:"JA3 hash test"; ja3_hash; content:"e7eca2baf4458d095b7f45da28c16c34"; sid:1;)	7 years ago
Mats Klepsland	d4af90032e	util-ja3: add function to check if JA3 is disabled	7 years ago
Mats Klepsland	0c16cd0120	app-layer-ssl: generate JA3 fingerprints ... Decode additional fields from the client hello packet and generate JA3 fingerprints.	7 years ago
Mats Klepsland	3f0dea582d	app-layer-ssl: split function into multiple smaller functions ... Split 'TLSDecodeHandshakeHello' into smaller functions to make it easier to read the code when the function grows in size.	7 years ago
Victor Julien	ea1e13cb00	smb: suppress notice messages	7 years ago
Pierre Chifflier	576b8ef722	SMB: simplify code	7 years ago
Pierre Chifflier	cf5de0c58e	SMB: use String::from_utf8_lossy in logging functions	7 years ago
Pierre Chifflier	b5529e4ffb	SMB: use kerberos-parser to extract Real and PrincipalName	7 years ago
Victor Julien	0dfb3f0e7f	smb1: extract rename info from TRANS2 ... Exclude TRANS2 from generic TX lookup bypass.	7 years ago
Victor Julien	8eeda113c8	smb1: add parsing for RENAME command	7 years ago
Victor Julien	7b61f2c589	smb2: log renames	7 years ago
Victor Julien	15978d4e85	smb: if filename is missing, use '<unknown>'	7 years ago
Victor Julien	c60decd678	rust/dns: default to eve log version 2 for rust	7 years ago
Jason Ish	27fd521420	eve/dns/v2: support eve/dns v2 in rust	7 years ago
Jason Ish	57d9574839	rust/json: expose more of jansson to rust	7 years ago
Jason Ish	dfdfc478ab	eve/dns-v2: only log responses for enabled types ... This changes the logic a bit for v2, checking the rrtype of the query to see if the response should be logged.	7 years ago
Jason Ish	769f972185	eve/dns-v2: log authorities as a list ... Log the authorities just like the answers, as a list under the authorities key.	7 years ago
Giuseppe Longo	fb66d45754	doc: introduce dns compact logging	7 years ago
Giuseppe Longo	92db7be502	output-json-alert: add dns info ... This changes LogQuery and LogAnswer functions returning a json object instead of writing it in a log file. In this way it's possible to reuse them to add dns info into an alert. The following is an alert record with dns: { "timestamp": "2017-07-31T15:01:17.885281+0200", "event_type": "alert", "src_ip": "8.8.8.8", ... "dns": { "query": [ { "type": "query", "id": 25394, "rrname": "notifications.google.com", "rrtype": "A", "tx_id": 0 } ], "answer": { "type": "answer", "id": 25394, "rcode": "NOERROR", "answers": [ { "rrname": "notifications.google.com", "rrtype": "CNAME", "ttl": 3599, "rdata": "plus.l.google.com" }, { "rrname": "plus.l.google.com", "rrtype": "A", "ttl": 299, "rdata": "216.58.205.174" } ] } } }	7 years ago
Giuseppe Longo	6231ffc110	output-json-dns: add json logging functions ... This adds some public functions needed to add dns information when an alert is logged.	7 years ago
Giuseppe Longo	756bed06a8	output-json-dns: add new output formats for v2 ... This adds two new output formats that permits to reduce the number of line logged for a dns answer because actually an event is logged for each answer. With this patch, only an event that contains all the answers is logged. The formats are named 'detailed' and 'grouped'. The first format provides a list of answers with the following fields: - rrname - rrdata - ttl - rdata The second format provides a list of record data grouped by their type. The output below is an example of the formats: { "timestamp": "2017-11-29T10:27:18.148282+0100", "flow_id": 268864910185905, "in_iface": "wlp2s0", "event_type": "dns", "src_ip": "192.168.1.254", "src_port": 53, "dest_ip": "192.168.1.176", "dest_port": 52609, "proto": "UDP", "dns": { "type": "answer", "id": 3654, "rcode": "NOERROR", "answers": [ { "rrname": "wordpress.org", "rrtype": "A", "ttl": 544, "rdata": "66.155.40.249" }, { "rrname": "wordpress.org", "rrtype": "A", "ttl": 544, "rdata": "66.155.40.250" } ], "grouped": { "A": [ "66.155.40.249", "66.155.40.250" ] } } }	7 years ago
Giuseppe Longo	869b7c0e0c	output-json-dns: add new configuration ... This patch adds a new configuration for dns, introducing a "version" that permits to switch between the new and old format to provide backward compatibility. The new configuration is made up of these new fields: - version - requests (query) - response (answer) - types (custom)	7 years ago
David DIALLO	c2236ea2b3	modbus: Support Unit Identifier ... When destination IP address does not suffice to uniquely identify the Modbus/TCP device. Some Modbus/TCP devices act as gateways to other Modbus/TCP devices that are behind this gateways.	7 years ago