aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
7,736 Commits
7 Branches
155 Tags
192 MiB
master
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '723e23dd67'
${ noResults }
Commit Graph

7736 Commits (723e23dd6781356d20e3f6e4c0b7ed593c126afd)
 

Author SHA1 Message Date
Victor Julien c89ce17017 afl: with -Wshadow issues 8 years ago
Eric Leblond ecf59be413 af-packet: add VLAN header when needed in IPS mode 
When packet is coming from a real ethernet card, the kernel is
stripping the vlan header and delivering a modified packet so
we need to insert the VLAN header back before sending the packet
on the wire.

To do so, we pass an option to the raw socket to add a reserve
before the packet data. It will get Suricata some head room to
to move the ethernet addresses before there actual place and
and insert the VLAN header in the correct place.

We get VLAN info from the ring buffer as the call of AFPWrite is
always done in the release function so we still have access to the
memory.
 8 years ago
Eric Leblond f407d77016 detect-tls-sni: add link to documentation 8 years ago
Eric Leblond c357dafed9 doc: document the tls_sni keyword 8 years ago
Eric Leblond 1af713d67d detect-tls: add url field pointing to doc 8 years ago
Eric Leblond 0695ad4bf0 detect-xbits: set documentation URL 8 years ago
Jason Ish 21bbac5648 dns-log: log requests even when there is no response 
The JSON logger had already been updated to handle
transactions without a response. Apply the same logic
to the older dns-log where a logger is registered
for each direction.

Fixes issue 2012.
 8 years ago
Andreas Herz d8b5bf9bc6 app-layer-parsing: detect malformed input 
If the app-layer-parsing has a very long content it exceeds the maximum
defined in "alproto_name". This adds a check for the too long content
before it will be passed to "strlcpy" and logs an error.
 8 years ago
Victor Julien f91d490d25 detect: remove unused flow_locked hint 8 years ago
Victor Julien 31a96d5a79 detect: make tenant loading less verbose 8 years ago
Victor Julien addf64f1f7 profiling: fix memory leaks 8 years ago
Victor Julien 6e876182d7 detect: use TLS_STATE_CERT_READY in cert inspect 8 years ago
Victor Julien 473dae75b5 tls: introduce 'cert ready' state 8 years ago
Victor Julien 15accc86c9 common: add BIT_U8 macro 8 years ago
Sascha Steinbiss e6044aaf1c mpm/spm: check for SSSE3 and enable/disable HS 
The new Hyperscan 4.4 API provides a function to check for SSSE3
presence at runtime. This allows us to fall back to non-Hyperscan
matchers on systems without SSSE3 even when the suricata executable
is built with Hyperscan support. Addresses Redmine issue #2010.

Signed-off-by: Sascha Steinbiss <sascha@steinbiss.name>
Tested-by: Arturo Borrero Gonzalez <arturo@debian.org>
 8 years ago
Victor Julien a0580d8805 stream: initialize stream segment pool from mtu 
If segments section in the yaml is ommitted (default) or when the
pool size is set to 'from_mtu', the size of the pool will be MTU
minus 40. If the MTU couldn't be determined, it's assumed to be
1500, so the segment size for the bool will be 1460.
 8 years ago
Victor Julien 1ba15d3721 mtu: track max mtu for capture devices 8 years ago
Victor Julien 7ca466c598 shutdown: remove pid file last 8 years ago
Victor Julien 816dd7b301 startup: clean up main loop 8 years ago
Victor Julien 2eec07cc3a unittests: clean up registration and startup 8 years ago
Victor Julien f452df761a shutdown: move global shutdown steps into func 8 years ago
Victor Julien babe8a299e startup/shutdown: cleanup and unify with unix mode 8 years ago
Victor Julien 3c64cfb384 threads: fix missed logging at shutdown 
At shutdown, all flows that still need work are handled by the flow
force reassembly logic. This means one or more flow end pseudo packets
are generated and pushed through the engine for final detection and
logging.

In some cases this would not work correctly. This was caused by the
flow timeout logic kicking in before all the 'live' packets were
processed. Before the flow timeout handling runs the receive threads
are disabled, however the engine did not wait for the in-flight
packets to be fully processed. In autofp mode, packets could still
be in the queue between receive thread(s) and flow worker(s).

This patch adds a new function that 'drains' all the packet threads
of any in-progress packets before moving on the flow timeout logic.

Bug #1946.
 8 years ago
Jason Ish f73806211a template script: use bash and require ed 
For now these scripts only work in bash, and the "ed" program
is required.
 8 years ago
Jason Ish 1abaf1c96d templates: require the protocol name to start with a capital 
When running ./setup-app-layer.sh require the protocol name to
start with a capital letter so it looks somewhat like a proper
name. This will help give better function names.

For example:

   ./setup-app-layer.sh IRC
   ./setup-app-layer.sh Irc

will create function names starting with IRC or Irc. But we do
not want function names to start with "irc".
 8 years ago
Andreas Herz a18af7325f configure: prevent combination of unittests and debug-validation 8 years ago
Mats Klepsland edbb035160 doc: add documentation for Lua SCFlowHasAlerts 8 years ago
Mats Klepsland a2659ed7ec output-json-flow: add has_alerts field 
Add has_alerts field to flow eve-log to indicate if a flow has
any alerts or not.
 8 years ago
Mats Klepsland c531e8f77c lua: add SCFlowHasAlerts function 
Add SCFlowHasAlerts() to check if a flow has alerts. Returns true
on alerts, false otherwise.

Example:

  has_alerts = SCFlowHasAlerts()
  if has_alerts then
    -- do something
  end
 8 years ago
Mats Klepsland d9b87e502d flow: set flag to indicate that a flow has alerts 
Set FLOW_HAS_ALERTS flag on the flow on alerts. Add FlowHasAlerts(..)
and FlowSetHasAlertsFlag(..) to check and set this flag.
 8 years ago
Eric Leblond 569cc5d238 util-file: introduce new functions for file size 
This patch introduces the FileDataSize and FileTrackedSize functions.
The first one is just a renaming of the initial FilSize function
whereas the other one is using the newly introduced size field as
value.
 8 years ago
Eric Leblond a098896b28 output-json-file: use size instead of FileSize 
FileSize is not returning the actual value when file store is not
used.
 8 years ago
Eric Leblond fbc2dbac28 util-file: change file size computation 
The file size returned by FileSize is invalid if file store is not
used so we introduce a new size field in File structure that is used
to store the size.
 8 years ago
Alexander Gozman 187a6f392c Bug #2009: added CAP_NET_ADMIN for PCAP and af-packet modes. 
Without this capability suricata is unable to get network
interface's settings.
 8 years ago
Jason Ish 19e578a740 pcap-log: fix pcre_study error check 
Code was failing on a NULL return value which can be returned
when there was nothing todo instead of an error. Instead
check the errbuf for a non-NULL value to determine error.
 8 years ago
Victor Julien a2d31b5e04 doc: napatech formatting fixes 8 years ago
Victor Julien b7b9b5b682 doc: add napatech to userguide 8 years ago
Peter Sanders 28c1516be7 doc: initial Napatech documentation 8 years ago
Jason Ish 5c55373679 app-layer-detect-proto.c: fix indent 
A recent commit was outdented by 1 column.
 8 years ago
Jason Ish ec44585dca app-layer - fix secondary probing parser logic 
Apply the same logic to pe2 as pe1 for determining which
probe to call. Missed in previous commit.
 8 years ago
Victor Julien cb36dee477 hyperscan: fix minor coverity issue in error path 
*** CID 1398951:  API usage errors  (LOCK)
/src/util-mpm-hs.c: 722 in SCHSPreparePatterns()
716         SCMutexUnlock(&g_db_table_mutex);
717
718         SCHSFreeCompileData(cd);
719         return 0;
720
721     error:
>>>     CID 1398951:  API usage errors  (LOCK)
>>>     "pthread_mutex_unlock" unlocks "g_db_table_mutex" while it is unlocked.
722         SCMutexUnlock(&g_db_table_mutex);
723         if (pd) {
724             PatternDatabaseFree(pd);
725         }
726         if (cd) {
 8 years ago
Victor Julien 15f4144eda smb: add tcp/445 to proto detect fallback 8 years ago
Victor Julien fa8cbd8741 smb: detect protocol in both directions 8 years ago
Jason Ish e9fccfa67c tx logging: only update logged tx id if all loggers logged 
Prevents the case where the logged id is incremented if a newer
transaction is complete and an older one is still outstanding.

For example, dns request0, unsolicited dns response, dns response0

would result in the valid response0 never being logged.

Similarily this could happen for:
  request0, request1, response1, response0

which would end up having request0, request1 and response1 logged,
but response0 would not be logged.
 8 years ago
Eric Leblond 0d5fd0f658 util-file: fix error logic in hash computation 
This patch fixes an issue with hash computation resulting in the
invalidity of at least one hash when at least two different hashes
functions were used.

Impact was setting as `force-hash: [md5, sha256]` not to be valid.
Also it could lead to false negative if too different hash functions
had to be used on a single file due to signatures.
 8 years ago
Jason Ish 20111cab23 unix-socket: fix shadowed variable 
ret does not need to be redefined here, the existing
declaration of ret can be used.
 8 years ago
Jason Ish 3e70d7befc travis: export CFLAGS on linux 8 years ago
Jason Ish f180ed8715 travis: add a build with -DNDEBUG 8 years ago
Victor Julien f964cdbc93 address parsing: fix memory leak in error path 8 years ago
Victor Julien a6fccd952e ssl: suppress scan-build warnings 8 years ago