8948 Commits (8a5710307d3b2dd144ea7d1ba884441695721cf9)

 

All Branches   

Search

Author	SHA1	Message	Date
Victor Julien	b4771150b8	doc: update suricata-update screenshot	7 years ago
Victor Julien	b531e7725d	doc: improve suricata-update docs now that its bundled	7 years ago
Victor Julien	ac1ed24cb4	doc: improve making sense of alerts	7 years ago
Victor Julien	ccde621ceb	doc: add suricata-update to intro for rules	7 years ago
Alexander Gozman	5c1a2b53f9	Bug #2466: map SC_LOG_CONFIG level to syslogs LOG_DEBUG	7 years ago
Jason Ish	43617dc11f	suricatasc: move lib to suricata.sc ... Pull the sc python package under the suricata top level package. A suricatasc package still exists for compatibility that pulls in suricata.sc.	7 years ago
Jason Ish	4a115f4d56	suricatasc: allow to run from non-standard python locations ... When we install to a non-standard prefix, the Python modules are not in the standard location requiring the PYTHONPATH to be fixed up. This wa a pre-existing issue with suricatasc, and not due to the move into the python directory.	7 years ago
Jason Ish	a7d90162d1	suricatasc: move into python/ ... Will be built and installed as part of the Python code used for suricatactl, which is intended to be the generic place for all Python utility code that gets installed with Suricata. No change to suricatasc code.	7 years ago
Mats Klepsland	7f0cfc0717	app-layer-ssl: use BIT_U32 for flags	7 years ago
Mats Klepsland	3e597512ea	app-layer-tls-handshake: remove since it is no longer needed ... Remove this file and all its content, since the functionality was reimplemented in app-layer-ssl.	7 years ago
Mats Klepsland	e93fef5c44	app-layer-ssl: reimplement function for decoding certificates ... Do a complete rewrite of the function for decoding the SSL/TLS certificate from the handshake.	7 years ago
Mats Klepsland	d9ddae4592	tls: replace variable in header file with TAILQ_EMPTY() ... Use TAILQ_EMPTY to check if a certificate exists instead of setting two variables in the app-layer-ssl header file for that purpose only.	7 years ago
Victor Julien	f40fc0293b	smb: minor optimizations	7 years ago
Victor Julien	f201a3761f	rust: remove multi level 'experimental' ... Don't treat 'external' parsers as more experimental. All parsers depend on crates to some extend, and all have C glue code. So the distinction doesn't really make sense.	7 years ago
Pierre Chifflier	d222b9ae6c	IKEv2: Use JSON arrays instead of comma-separated values	7 years ago
Pierre Chifflier	bf66948ad7	IKEv2: suppress some debug output	7 years ago
Pierre Chifflier	3fbfb22204	IKEv2: remove events counter	7 years ago
Pierre Chifflier	6eb48e1e93	Add ikev2 to userguide	7 years ago
Pierre Chifflier	4e4cf00c07	Remove the 'experimental' mark for IKEv2	7 years ago
Pierre Chifflier	f65fafa34b	IKEv2 logger: use Debug trait for IkePayloadType	7 years ago
Pierre Chifflier	d94346282c	Add logger for IKEv2	7 years ago
Pierre Chifflier	d16397ce61	Add rules for IKEv2 events	7 years ago
Pierre Chifflier	c99b9462d7	Add new parser: IKEv2 ... Add a new parser for Internet Key Exchange version (IKEv2), defined in RFC 7296. The IKEv2 parser itself is external. The embedded code includes the parser state and associated variables, the state machine, and the detection code. The parser looks the first two messages of a connection, and analyzes the client and server proposals to check the cryptographic parameters.	7 years ago
Pierre Chifflier	b810275b16	Rust: fix prototype of parsing function (make pstate mutable)	7 years ago
Pierre Chifflier	8e8f0db192	Rust: expose function AppLayerParserStateSetFlag	7 years ago
Renato Botelho	8f926fb75a	configure: allow to disable libnss and libnspr ... Let user chose to disable libnss and libnspr support even if these libraries are installed in the system. Default remains to enable when libraries are found and disable parameter were not used	7 years ago
Victor Julien	91307dafd9	nfs/rpc: fix reponse parsing	7 years ago
Victor Julien	b1e2783788	auth/krb5: move kerberos5 wrapper to rust root ... Make it available outside of just the SMB parser.	7 years ago
Victor Julien	4d58aaae90	smb: clean up partial read/write record handling	7 years ago
Victor Julien	aa8d64c2b8	smb: improve skip handling ... When skipping records the skip tracker could underflow if the record parsing had more data than expected. Enforce the calculation by moving it into a method and make the actual fields private.	7 years ago
Victor Julien	eac7a92200	smb2: improve read/write record parsing ... parse_smb2_response_read()/parse_smb2_response_write() can be called on incomplete data, so they didn't use the read/write length field to grab the data field. Instead it just used rest(). However in some cases SMB2 records have trailing data, which would be included in the READ/WRITE data. This patch addresses this by using the length field if enough data is available.	7 years ago
Victor Julien	97c224d193	changelog: update for 4.1.0-beta1	7 years ago
Victor Julien	26e807ca34	doc: fix http_header_names example	7 years ago
Victor Julien	1e56cfe08e	threshold: don't touch globals after init ... Don't free/reinit pcre globals per tenant. Others may be using them at the same time, or try to free/reinit them at the same time.	7 years ago
Mats Klepsland	efdc592172	detect-tls-sni: use *_Register2 API functions ... Use *_Register2 API functions when registering 'tls_sni' detection keyword.	7 years ago
Mats Klepsland	b479d1d47c	detect-tls-cert-serial: use *_Register2 API functions ... Use *_Register2 API functions when registering 'tls_cert_serial' detection keyword.	7 years ago
Mats Klepsland	5c96e1df95	detect-tls-cert-subject: use *_Register2 API functions ... Use *_Register2 API functions when registering 'tls_cert_subject' detection keyword.	7 years ago
Mats Klepsland	b1dd41c9cd	detect-tls-cert-issuer: use *_Register2 API functions ... Use *_Register2 API functions when registering 'tls_cert_issuer' detection keyword.	7 years ago
Mats Klepsland	c3a329d6e9	detect-tls-cert-fingerprint: use *_Register2 API functions ... Use *_Register2 API functions when registering 'tls_cert_fingerprint' detection keyword.	7 years ago
Victor Julien	53f63f7498	nfs/rpc: improve RPCv2 parser, add GssApi ... Improve RPCv2 credentials parsing. Add GssApi and turn creds into an enum. Minor cleanups and optimizations.	7 years ago
Victor Julien	47ebef3af8	nfs: minor cleanup	7 years ago
Antoine LUONG	56e7afc4f7	prelude: swap msg and class_msg in Prelude alert	7 years ago
Antoine LUONG	caa2903f1f	prelude: fix duplicated analyzer in Prelude alert	7 years ago
Danny Browning	697a5a1978	pcap/file: fix missing files stopping engine #2451 ... https://redmine.openinfosecfoundation.org/issues/2451 When a missing (or empty named) file is passed to source-pcap-file while using unix socket, the pcap processing thread will incorrectly be stopped, and no longer available for subsequent files.	7 years ago
Alexander Gozman	2cf2387e31	rules: optimize bidir rules with same src/dst ... As an optimization, reset bidirectional flag for rules with same src and dst. If one created bidirectional rule like 'alert tcp any any <> any any ...', the rule was checked twice (for each packet in every direction). This is suboptimal and may give duplicated alerts. To avoid this, bidirectional rules are now checked for the same src and dst (addresses and ports) and if it's the case, the rule is treated as unidirectional and a corresponding message is logged.	7 years ago
Eric Leblond	0a72d5be96	doc: fix typo in unix socket doc ... Also fixes a dead link to code.	7 years ago
Eric Leblond	975f413308	doc: more info on unix socket rule reload	7 years ago
Eric Leblond	e2aab10d29	doc: fix typo in ebpf xdp doc	7 years ago
Eric Leblond	66b37d8689	suricata.yaml: fix some spelling mistakes	7 years ago
Victor Julien	ba24bb82fa	der: don't overwrite errcode ... If the code has already been set it is more detailed than the more generic 'invalid object'.	7 years ago