8988 Commits (7e06e765f39088c51a700cf232f2c3cc953929f7)

 

All Branches   

Search

Author	SHA1	Message	Date
Mats Klepsland	e93fef5c44	app-layer-ssl: reimplement function for decoding certificates ... Do a complete rewrite of the function for decoding the SSL/TLS certificate from the handshake.	7 years ago
Mats Klepsland	d9ddae4592	tls: replace variable in header file with TAILQ_EMPTY() ... Use TAILQ_EMPTY to check if a certificate exists instead of setting two variables in the app-layer-ssl header file for that purpose only.	7 years ago
Victor Julien	f40fc0293b	smb: minor optimizations	7 years ago
Victor Julien	f201a3761f	rust: remove multi level 'experimental' ... Don't treat 'external' parsers as more experimental. All parsers depend on crates to some extend, and all have C glue code. So the distinction doesn't really make sense.	7 years ago
Pierre Chifflier	d222b9ae6c	IKEv2: Use JSON arrays instead of comma-separated values	7 years ago
Pierre Chifflier	bf66948ad7	IKEv2: suppress some debug output	7 years ago
Pierre Chifflier	3fbfb22204	IKEv2: remove events counter	7 years ago
Pierre Chifflier	6eb48e1e93	Add ikev2 to userguide	7 years ago
Pierre Chifflier	4e4cf00c07	Remove the 'experimental' mark for IKEv2	7 years ago
Pierre Chifflier	f65fafa34b	IKEv2 logger: use Debug trait for IkePayloadType	7 years ago
Pierre Chifflier	d94346282c	Add logger for IKEv2	7 years ago
Pierre Chifflier	d16397ce61	Add rules for IKEv2 events	7 years ago
Pierre Chifflier	c99b9462d7	Add new parser: IKEv2 ... Add a new parser for Internet Key Exchange version (IKEv2), defined in RFC 7296. The IKEv2 parser itself is external. The embedded code includes the parser state and associated variables, the state machine, and the detection code. The parser looks the first two messages of a connection, and analyzes the client and server proposals to check the cryptographic parameters.	7 years ago
Pierre Chifflier	b810275b16	Rust: fix prototype of parsing function (make pstate mutable)	7 years ago
Pierre Chifflier	8e8f0db192	Rust: expose function AppLayerParserStateSetFlag	7 years ago
Renato Botelho	8f926fb75a	configure: allow to disable libnss and libnspr ... Let user chose to disable libnss and libnspr support even if these libraries are installed in the system. Default remains to enable when libraries are found and disable parameter were not used	7 years ago
Victor Julien	91307dafd9	nfs/rpc: fix reponse parsing	7 years ago
Victor Julien	b1e2783788	auth/krb5: move kerberos5 wrapper to rust root ... Make it available outside of just the SMB parser.	7 years ago
Victor Julien	4d58aaae90	smb: clean up partial read/write record handling	7 years ago
Victor Julien	aa8d64c2b8	smb: improve skip handling ... When skipping records the skip tracker could underflow if the record parsing had more data than expected. Enforce the calculation by moving it into a method and make the actual fields private.	7 years ago
Victor Julien	eac7a92200	smb2: improve read/write record parsing ... parse_smb2_response_read()/parse_smb2_response_write() can be called on incomplete data, so they didn't use the read/write length field to grab the data field. Instead it just used rest(). However in some cases SMB2 records have trailing data, which would be included in the READ/WRITE data. This patch addresses this by using the length field if enough data is available.	7 years ago
Victor Julien	97c224d193	changelog: update for 4.1.0-beta1	7 years ago
Victor Julien	26e807ca34	doc: fix http_header_names example	7 years ago
Victor Julien	1e56cfe08e	threshold: don't touch globals after init ... Don't free/reinit pcre globals per tenant. Others may be using them at the same time, or try to free/reinit them at the same time.	7 years ago
Mats Klepsland	efdc592172	detect-tls-sni: use *_Register2 API functions ... Use *_Register2 API functions when registering 'tls_sni' detection keyword.	7 years ago
Mats Klepsland	b479d1d47c	detect-tls-cert-serial: use *_Register2 API functions ... Use *_Register2 API functions when registering 'tls_cert_serial' detection keyword.	7 years ago
Mats Klepsland	5c96e1df95	detect-tls-cert-subject: use *_Register2 API functions ... Use *_Register2 API functions when registering 'tls_cert_subject' detection keyword.	7 years ago
Mats Klepsland	b1dd41c9cd	detect-tls-cert-issuer: use *_Register2 API functions ... Use *_Register2 API functions when registering 'tls_cert_issuer' detection keyword.	7 years ago
Mats Klepsland	c3a329d6e9	detect-tls-cert-fingerprint: use *_Register2 API functions ... Use *_Register2 API functions when registering 'tls_cert_fingerprint' detection keyword.	7 years ago
Victor Julien	53f63f7498	nfs/rpc: improve RPCv2 parser, add GssApi ... Improve RPCv2 credentials parsing. Add GssApi and turn creds into an enum. Minor cleanups and optimizations.	7 years ago
Victor Julien	47ebef3af8	nfs: minor cleanup	7 years ago
Antoine LUONG	56e7afc4f7	prelude: swap msg and class_msg in Prelude alert	7 years ago
Antoine LUONG	caa2903f1f	prelude: fix duplicated analyzer in Prelude alert	7 years ago
Danny Browning	697a5a1978	pcap/file: fix missing files stopping engine #2451 ... https://redmine.openinfosecfoundation.org/issues/2451 When a missing (or empty named) file is passed to source-pcap-file while using unix socket, the pcap processing thread will incorrectly be stopped, and no longer available for subsequent files.	7 years ago
Alexander Gozman	2cf2387e31	rules: optimize bidir rules with same src/dst ... As an optimization, reset bidirectional flag for rules with same src and dst. If one created bidirectional rule like 'alert tcp any any <> any any ...', the rule was checked twice (for each packet in every direction). This is suboptimal and may give duplicated alerts. To avoid this, bidirectional rules are now checked for the same src and dst (addresses and ports) and if it's the case, the rule is treated as unidirectional and a corresponding message is logged.	7 years ago
Eric Leblond	0a72d5be96	doc: fix typo in unix socket doc ... Also fixes a dead link to code.	7 years ago
Eric Leblond	975f413308	doc: more info on unix socket rule reload	7 years ago
Eric Leblond	e2aab10d29	doc: fix typo in ebpf xdp doc	7 years ago
Eric Leblond	66b37d8689	suricata.yaml: fix some spelling mistakes	7 years ago
Victor Julien	ba24bb82fa	der: don't overwrite errcode ... If the code has already been set it is more detailed than the more generic 'invalid object'.	7 years ago
Jason Ish	cbcbc0f6b0	suricata-update: bundle suricata update ... Add autoconf/automake support for installing suricata-update if found in the top level suricata-update.	7 years ago
Mats Klepsland	c130820bff	conf: user-configurable umask setting ... Make umask user-configurable by setting 'umask' in suricata.yaml.	7 years ago
Pierre Chifflier	3140e4598a	DER parser: ensure errcode is set for every return path	7 years ago
Pierre Chifflier	2d34e402c0	DER parser: fix undefined behaviors and add missing length tests ... Fix several undefined behaviors, caused by possible use or read of uninitialized memory.	7 years ago
Antti Tönkyrä	d6a98aa1c3	stream-tcp: add counters for midstream pickups ... If midstream pickups are enabled this will help in discovering how many midstream pickups are being done by Suricata.	7 years ago
Mats Klepsland	47a7ebbbc2	doc: add JA3 fields to the TLS logger documentation	7 years ago
Mats Klepsland	d55e455504	eve: add JA3 fields to TLS JSON logger ... Add JA3 object to TLS JSON logger (extended log).	7 years ago
Mats Klepsland	fb0bfb614f	doc: add documentation for Ja3GetString Lua function	7 years ago
Mats Klepsland	8339ed338f	lua: add Ja3GetString function ... Add Ja3GetString() to return the content of the JA3 string buffer from the TLS session. Example: function init (args) local needs = {} needs["protocol"] = "tls" return needs end function setup (args) filename = SCLogPath() .. "/ja3_string.log" file = assert(io.open(filename, "a")) end function log (args) ja3_string = Ja3GetString() if ja3_string == nil then return end file:write(ja3_string .. "\n") file:flush() end function deinit (args) file:close() end	7 years ago
Mats Klepsland	2514553098	doc: add documentation for Ja3GetHash Lua function	7 years ago