aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
8,085 Commits
8 Branches
173 Tags
202 MiB
main
main-8.0.x
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '8ea9a5a7d6'
${ noResults }
Commit Graph

7280 Commits (8ea9a5a7d6619057ea7c51676743b02692dad7b5)

Author SHA1 Message Date
Jason Ish f56428d996 tcp/udp: fix checksum validation when 0xffff 
Issue:
https://redmine.openinfosecfoundation.org/issues/2041

One approach to fixing this issue to just validate the
checksum instead of regenerating it and comparing it. This
method is used in some kernels and other network tools.

When validating, the current checksum is passed in as an
initial argument which will cause the final checksum to be 0
if OK. If generating a checksum, 0 is passed and the result
is the generated checksum.
 10 years ago
Victor Julien b58127edcb print: constify input 10 years ago
Victor Julien 44bab885d6 detect: fix ssl_state test 10 years ago
Victor Julien 4f8eacdc69 disable-detect: fix needless file hashing 
When detection is running flags are set on flows to indicate if file
hashing is needed. This is based on global output settings and rules.

In the case of --disable-detection this was not happening, so all
files where hashed with all methods. This has a significant
performance impact.

This patch adds logic to set the flow flags in --disable-detect mode.
 10 years ago
Victor Julien e24eb0f2b1 app-layer: remove version logic 10 years ago
Victor Julien a56b4817ef flow: remove unused alversion fields 10 years ago
Victor Julien c066f043a5 detect: remove unused alversion logic 10 years ago
Victor Julien 6c6802b957 detect: simplify state detect code: remove unused params 10 years ago
Victor Julien c961da2dce detect: clean up test 10 years ago
Victor Julien 3626ecb474 bytejump: don't print errors when matching 
When bytejump was told to convert some payload data to int from a
string it would print an error to the screen if the conversion
failed. This is unwanted as the payload is controlled by an attacker
and printing is expensive.
 10 years ago
Victor Julien 15d26f14e1 file-store: fix force store 10 years ago
Victor Julien dbbf185173 app-layer: fix gap handling in protocol detection 
A GAP during protocol detection would lead to all reassembly
getting disabled, so also the raw reassembly. In addition, it
could prevent the opposing side from doing protocol detection.

This patch remove the 'disable reassembly' logic. Stream engine
will take the stream with GAP and app-layer will make the proto
detection as complete.
 10 years ago
Victor Julien f1e19b5dd4 file store: store multiple files if available 10 years ago
Victor Julien 7c0a3b5582 app-layer: fix memleak on bad traffic 
If state was alloc'd after protocol detection, but then the direction
turned out to be wrong, the state would not be freed.
 10 years ago
Victor Julien 132e0e21f0 ippair: fix xbits unset memleak 10 years ago
Victor Julien 4c597bb9e1 ippair: use both addresses in hash 10 years ago
Victor Julien 1de1413863 stream: validate SACK right edge to be in window 10 years ago
Victor Julien daf39b422b stream: remove unused stream config member 10 years ago
Victor Julien 7512949670 stream: make data pointer in StreamSegmentCallback const 10 years ago
Victor Julien 2a5b9eb5fa stream: remove unused variable 10 years ago
Victor Julien a86b7b7042 app-layer: minor debug improvement 10 years ago
Jason Ish 6585ac4a9f logging: remove unused print stats callbacks 
Remove the ThreadExitPrintStats callback from logging modules
that weren't doing anything with it.
 10 years ago
Jason Ish 0c3f1e2974 logging: move lock into write function 
All loggers were wrapping just the write in a lock with some
updating a counter.  This moves the lock into the write function.

The log_ctx alerts counter was also removed as many modules have
stopped using this and the alert count is available elsewhere.

Should satisfy Coverity CID 1400798:

CID 1400798 (#1 of 1): Data race condition (MISSING_LOCK) 2.
missing_lock: Accessing log_ctx->rotation_flag without holding lock
LogFileCtx_.fp_mutex. Elsewhere, "LogFileCtx_.rotation_flag" is accessed
with LogFileCtx_.fp_mutex held 4 out of 5 times.

Which appears to be a false positive as all calls to SCLogFileWrite
were done under lock, but this will make it more explicit.
 10 years ago
Jason Ish ddf1bf6518 unified2: unlock using same dereference as lock 
Addresses Coverity CIDs:
    1400797
    1400796

Note that the mutex was actually being unlocked, but
from a different variable pointing to the same mutex.
 10 years ago
Mats Klepsland d6508e640a detect: add (mpm) keyword tls_cert_serial 
Match on TLS certificate serial number using tls_cert_serial
keyword, e.g.:

alert tls any any -> any any (msg:"TLS cert serial test";
        tls_cert_serial; content:"5C:19:B7:B1:32:3B:1C:A1";
        sid:12345;)
 10 years ago
Mats Klepsland 95864375f2 lua: add function to print certificate serial number 
Add function LuaGetCertSerial to print serial number from TLS
certificate.

Example:

function log (args)
    serial = TlsGetCertSerial()

    if serial then
        file:write(serial .. "\n");
        file:flush()
    end
end
 10 years ago
Mats Klepsland 2e339aa791 tls-log: log certificate serial number 10 years ago
Mats Klepsland 2b460b8d06 output-json-lua: log certificate serial number 10 years ago
Mats Klepsland 2c1a36dd6e app-layer-tls: decode certificate serial number 10 years ago
Alexander Gozman 310b27a196 af-packet: fix parsing packet in TPACKET_V3 mode 
AFPParsePacketV3() saved tpacket_block_desc structure
instead of tpacket3_hdr. As a result, reconstructed
packets were wrong.

Bug #2044.
 10 years ago
Alexander Gozman e41a9d637b af-packet: get VLAN info for packets in TPACKET_V3 mode 10 years ago
Alexander Gozman ee7e689b54 af-packet: write VLAN info for both TPACKET_V2 and V3 10 years ago
Jason Ish 92db12c349 pidfile: fail if the pid file exists 
Changes the pidfile check function to fail just on the
existence of the file to address issue
https://redmine.openinfosecfoundation.org/issues/1335
but log a message if the pid file appears to be stale.
 10 years ago
Mats Klepsland bbd32c1419 output-json-tls: code cleanup 10 years ago
Mats Klepsland 115b3138cc output-json-tls: log certificate and chain 
Log entire certificate and certificate chain Base64 encoded.
 10 years ago
Mats Klepsland 0716199acb output-json-tls: custom tls logging 10 years ago
Jason Ish 82f6103149 unified2: nostamp and file rotation 
Give unified2 a nostamp option which will create the file
without the timestamp suffix (like Snort's nostamp option).

Also register for rotation notification on SIGHUP so the file
will be recreated if it is removed by an external rotation
program (only when nostamp is used).
 10 years ago
Jason Ish 2c01985e73 autoconf - look for stdbool.h 10 years ago
Jason Ish d8e9e1fd77 unified2: minor cleanups 
- remove unused arguments and make static
 10 years ago
Mats Klepsland 234a3a890b output-json-alert: print 'tunnel' JSON object if tunnel 
Log src_ip, dst_ip and proto for root packet (p->root) if the
packet that triggered is inside a tunnel, as JSON object
'tunnel'. Also log recursion depth to indicate the depth of
the tunnel.
 10 years ago
Mats Klepsland 7293286f2f output-json: move code to get 5-tuple to own function 
Move code to get 5-tuple in JSON object to own function 'JsonFiveTuple'.
This enables this code to be reused when printing 'parent' JSON object in
output-json-alert.
 10 years ago
Mats Klepsland 8c8db1cf0f output-json-alert: fix wrongful comments 10 years ago
Mats Klepsland 65317ba865 output-json: make JSON flags in eve-log user configurable 10 years ago
Victor Julien d445b4b5fa dce: remove commented out code 10 years ago
Victor Julien 9da7be81f0 flow-worker: clean up thread init 10 years ago
Victor Julien c859d39f4f coverity: suppress CID 1400648 10 years ago
Victor Julien 955c227127 detect-ssh: cleanup duplicate code 10 years ago
Victor Julien 2f30adb08a detect-lua: setup cleanup, fixing a potential int issue 10 years ago
Victor Julien 511e804915 detect: fix missing unlock in error path 10 years ago
Victor Julien f74eff9eac threads: address sleep under lock issue 10 years ago
Victor Julien f380871057 threads: don't sleep under lock 10 years ago
Victor Julien cc4010343d detect: add and use util func for alproto sets 10 years ago
Victor Julien 4a49260897 flowvar: shrink flowvar type by using padded space 10 years ago
Victor Julien 99517cbd53 lua: support key/value flowvars in lua 10 years ago
Victor Julien f0af133c5f flowvar: remove unused DETECT_VAR_TYPE_ALWAYS 10 years ago
Victor Julien 88888c3d8b unix-socket: add/list/remove hostbit commands 
add-hostbit adds a named hostbit with an expire time in seconds.
remove-hostbit removes hostbit by name.

add-hostbit, remove-hostbit return success or failure.

list-hostbit returns a json array of hostbits with their name and
expire time:

    {
        "message": {
            "count": 1,
            "hostbits":
                [{
                    "expire": 3222,
                    "name": "firefox-users"
                }]
        },
        "return": "OK"
    }
 10 years ago
Victor Julien b6e4276792 hostbits: add list API 10 years ago
Victor Julien 996112edf5 pktvars: same name pktvars, key-value vars 10 years ago
Victor Julien 5ca4a2e6fe outputs: vars log 
EVE addition called 'vars' that logs pkt/flow vars for each packet/flow.
 10 years ago
Victor Julien 1a2ad059a1 eve: log pktvars/flowvars/bits/ints 
Optionally logs 'vars' into alerts
 10 years ago
Victor Julien 1ba8c2fe3a pcre: new way of specifying var names 
Until now the way to specify a var name in pcre substring capture
into pkt and flow vars was to use the pcre named substring support:
e.g. /(?P<pkt_somename>.*)/

This had 2 drawbacks:

1. limitations of the name. The name could be max 32 chars, only have
   alphanumeric and the underscore characters. This imposed limitations
   that are not present in flowbits/ints.

2. we didn't actually use the named substrings in pcre through the
   API. We parsed the names separately. So putting the names in pcre
   would actually be wasteful.

This patch introduces a new way of mapping captures with names:

  pcre:"/(.*)/, pkt:somename";
  pcre:"/([A-z]+) ([0-9]+)/, pkt:somename,flow:anothername";

The order of the captures and the order of the names are mapped 1 on 1.
This method is no longer limited by the pcre API's naming limits. The
'flow:' and 'pkt:' prefixes indicate what the type of variable is. It's
mandatory to specify one.

The old method is still supported as well.
 10 years ago
Victor Julien 0f708d427b pkt-var: abuse flowvar postmatch logic for pktvars 
Flowvars were already using a temporary store in the detect thread
ctx.

Use the same facility for pktvars. The reasons are:

1. packet is not always available, e.g. when running pcre on http
   buffers.

2. setting of vars should be done post match. Until now it was also
   possible that it is done on a partial match.
 10 years ago
Victor Julien 5e39486399 pkt-var: use id instead of name pointer 10 years ago
Victor Julien a0bd15a1c4 pcre: support multiple captures 
Support up to 8 substring captures into pkt or flow vars.
 10 years ago
Victor Julien 017b16d421 detect-pcre: small cleanups 10 years ago
Victor Julien ac42a44280 alert-debug: print flowvar/int names 10 years ago
Victor Julien e95a0c1344 alert-debug: print flowbit names from VarNameStore 10 years ago
Victor Julien 22f3205664 var-names: expose outside of detect engine 
Until now variable names, such as flowbit names, were local to a detect
engine. This made sense as they were only ever used in that context.

For the purpose of logging these names, this needs a different approach.
The loggers live outside of the detect engine. Also, in the case of
reloads and multi-tenancy, there are even multiple detect engines, so
it would be even more tricky to access them from the outside.

This patch brings a new approach. A any time, there is a single active
hash table mapping the variable names and their id's. For multiple
tenants the table is shared between tenants.

The table is set up in a 'staging' area, where locking makes sure that
multiple loading threads don't mess things up. Then when the preparing
of a detection engine is ready, but before the detect threads are made
aware of the new detect engine, the active varname hash is swapped with
the staging instance.

For this to work, all the mappings from the 'current' or active mapping
are added to the staging table.

After the threads have reloaded and the new detection engine is active,
the old table can be freed.

For multi tenancy things are similar. The staging area is used for
setting up until the new detection engines / tenants are applied to
the system.

This patch also changes the variable 'id'/'idx' field to uint32_t. Due
to data structure padding and alignment, this should have no practical
drawback while allowing for a lot more vars.
 10 years ago
Victor Julien 43cc06eabe detect: use engine version instead of id 
Use engine version based on global detect engine master. This is
incremented between reloads.
 10 years ago
Victor Julien 920709fe6f detect: ssh_software sticky buffer 10 years ago
Victor Julien f1ab6a6153 detect: ssh_proto stickybuffer 10 years ago
Victor Julien dfac5276b8 detect: remove unused SIGMATCH_PAYLOAD flag 10 years ago
Victor Julien 14ced15e36 detect: remove unused state file flag 10 years ago
Victor Julien fa1ef158b2 detect: small API cleanup 10 years ago
Victor Julien 073fcbeb7f detect: move file hash common code 10 years ago
Victor Julien 5bafc64c08 detect: unify FileMatch API with other calls 10 years ago
Victor Julien fe415ae518 detect: remove DMATCH list 10 years ago
Victor Julien 1c02cf4542 flow: remove unused Flow::de_state 10 years ago
Victor Julien ad238121e3 detect: remove the AMATCH list 10 years ago
Victor Julien 775e182531 detect: remove AppLayerMatch API call 10 years ago
Victor Julien f018ae94b0 dce: dynamic lists 10 years ago
Victor Julien 84ba9cf9df smb/dcerpc: use tx api 10 years ago
Victor Julien d318bfc934 dcerpc: simplify common detect code 10 years ago
Victor Julien 402eb645a0 ftp: parser and ftpbounce update 
Convert parser to TX API.

Convert ftpbounce keyword to use that.
 10 years ago
Victor Julien d9a300cd8c detect: move lua smtp support to dynamic list 10 years ago
Victor Julien 96b8100a51 lua: convert lua output to be tx aware 10 years ago
Victor Julien a10b2fdecf detect: make ssh detection use dynamic list 10 years ago
Victor Julien c412352474 ssh: remove single logger limit 10 years ago
Victor Julien 3ee4989ba7 ssh: convert app-layer parser to be tx aware 
Like with SSL, there is only a single 'tx'.
 10 years ago
Victor Julien 4ae4fd0802 lua: use tls_generic list for ssl/tls 10 years ago
Victor Julien a8975c68e0 detect ssl/tls: use dynamic lists 10 years ago
Victor Julien 1cacba435b ssl/tls: clean up keywords 10 years ago
Victor Julien 6ef4712cd6 detect: convert old tls keywords to dynamic list 10 years ago
Victor Julien ef149bed7b tls.store: convert to postmatch 10 years ago
Victor Julien 8b3a71a285 tls.store: cleanup 10 years ago
Victor Julien 8eac1156c6 app-layer-events: remove unused API options 10 years ago
Victor Julien 1087495d6d detect: http_start sticky buffer 
Matches on the start of a HTTP request or response.

Uses a buffer constructed from the request line and normalized request
headers, including the Cookie header.

Or for the response side, it uses the response line plus the
normalized response headers, including the Set-Cookie header.

Both buffers are terminated by an extra \r\n.
 10 years ago
Victor Julien 36535efa04 detect: add http_protocol sticky buffer 
Matches on protocol field in HTTP.
 10 years ago
Victor Julien f2fc5a255f http_header: convert to use common code 10 years ago
Victor Julien 6279ec399e http_header: common detection code 10 years ago
Victor Julien 5ee68ca2b2 http_header: remove old files 10 years ago
Victor Julien 2bb0cae05a http_header: move all code into keyword files 10 years ago
Victor Julien aaeeae0722 detect: http_header_names sticky buffer keyword 
A sticky buffer that allows content inspection on a contructed buffer
of HTTP header names. The buffer starts with \r\n, the names are
separated by \r\n and the end of the buffer contains an extra \r\n.

E.g. \r\nHost\r\nUser-Agent\r\n\r\n

The leading \r\n is to make sure one can match on a full name in all
cases.
 10 years ago
Victor Julien cf9678d926 detect: global registery for keyword thread data 
Some keywords need a scratch space where they can do store the results
of expensive operations that remain valid for the time of a packets
journey through the detection engine.

An example is the reconstructed 'http_header' field, that is needed
in MPM, and then for each rule that manually inspects it. Storing this
data in the flow is a waste, and reconstructing multiple times on
demand as well.

This API allows for registering a keyword with an init and free function.

It it mean to be used an initialization time, when the keyword is
registered.
 10 years ago
Victor Julien 75907fce06 profiling: output all sort options for rules 
Limit the default number of sids to 10.
 10 years ago
Victor Julien 7d8a5a75ef profiling: honor limit in json rule output 10 years ago
Victor Julien a9a228a289 profiling: fix keyword profiling 10 years ago
Victor Julien a1465bc4fa detect-engine-mpm: api cleanup 10 years ago
Victor Julien 8bd1422948 detect: detect engine registration cleanup 10 years ago
Victor Julien 49fbd28ceb detect: cleanup built-in list id's 10 years ago
Victor Julien 40851eecf0 template: dynamic buffer 10 years ago
Victor Julien 815120896b app-layer-events: dynamic list 10 years ago
Victor Julien b68343e372 files: use dynamic list 10 years ago
Victor Julien e4bfdd53c2 cip/enip: dynamic buffer 10 years ago
Victor Julien f2393c1ae0 modbus: dynamic buffer 10 years ago
Victor Julien cfdd934aba dnp3: dynamic buffers/lists 10 years ago
Victor Julien 9ba386a141 tls: dynamic buffers 10 years ago
Victor Julien d9b3ae6cd6 dns: use dynamic buffers 10 years ago
Victor Julien d2f77978ec detect-parse: content modifier cleanup 10 years ago
Victor Julien 6f867c3c73 http_raw_uri: dynamic buffer 10 years ago
Victor Julien ee55aefa1c http_client_body: dynamic buffer 10 years ago
Victor Julien e7d5e845c7 http_header / http_raw_header: dynamic buffers 10 years ago
Victor Julien b694d96e22 http_stat_msg: dynamic buffer 10 years ago
Victor Julien 7e3ab4f5ea http_stat_code: dynamic buffer 10 years ago
Victor Julien 128b59d4f6 http_raw_host: dynamic buffer 10 years ago
Victor Julien 296c275e23 http_host: dynamic buffer 10 years ago
Victor Julien 67b7d9734e http_cookie: dynamic buffer 10 years ago
Victor Julien 54604c7bf2 http_user_agent: dynamic buffer 10 years ago
Victor Julien 9262fa3dcf http_response_line: dynamic buffer 10 years ago
Victor Julien 6346a074a7 http_uri: dynamic buffer 
Clean up tests
 10 years ago
Victor Julien e34102d67a http_method: make list dynamic 10 years ago
Victor Julien 6bd37611ee file_data: dynamic buffer 10 years ago
Victor Julien 7052f9b933 http_request_line: dynamic buffer 10 years ago
Victor Julien 779d40cedf detect: remove hardcoded sm_list logic from setup 
Introduce utility functions to aid this.
 10 years ago
Victor Julien 04592efb76 detect: buffer type API 
To replace the hardcoded SigMatch list id's, use this API to register
and query lists by name.

Also allow for registering descriptions and whether mpm is supported.

Registration is only allowed at startup.
 10 years ago
Victor Julien 58e1180efe detect: inspect engine setup cleanup 10 years ago
Victor Julien debc1a6334 detect: dce test fixes and improvements 10 years ago
Victor Julien a2b521b7fa detect-csum: redo tests 10 years ago
Victor Julien f370e88135 detect: move init only Signature members to init_data 10 years ago
Victor Julien 0a5ae415b8 detect: shrink Signature::sm_arrays 
Signature::sm_arrays now only contains 'built-in' lists, and so is
sized appropriately.
 10 years ago
Victor Julien 4978a7a133 detect: reorganize id's in prep of dynamic lists 10 years ago
Victor Julien 59303d1fbb threshold: fix and redo tests 10 years ago
Victor Julien 6f7e4adbe8 detect: improve memory handling & comments 10 years ago
Victor Julien 8edc954e82 detect: get rid of Signature::sm_lists 
Instead use the lists in init_data during setup and the SigMatchData
arrays during runtime.
 10 years ago
Victor Julien f281481b67 detect: use detect list passed to generic funcs 
Until now the GenericList users used hardcoded list id's.
 10 years ago
Victor Julien bd456076a8 detect: pass SigMatchData to inspect functions 10 years ago
Victor Julien a0fe67a3c0 detect: template list in engine 10 years ago
Victor Julien da7c816c7c detect: enip/cip list in engine 10 years ago
Victor Julien e94a7bddb3 detect: modbus list in engine 10 years ago
Victor Julien 7f7d4296da detect: file list in engine 10 years ago
Victor Julien f5adccba1d detect: app-event list in engine 10 years ago
Victor Julien 747dbf92ce detect: dns & tls lists in engine 10 years ago
Victor Julien 5a2e568385 detect: http lists in engine 10 years ago
Victor Julien 1ee32da2ca detect-engine: memory handling of sm_lists 
For lists that are registered multiple times, like http_header and
http_cookie, making the engines owner of the lists is complicated.
Multiple engines in a sig may be pointing to the same list. To
address this the 'free' code needs to be extra careful about not
double freeing, so it takes an approach to first fill an array
of the to-free pointers before freeing them.
 10 years ago
Victor Julien f81b90dacd detect: when freeing sig also see sm in inspect engine 10 years ago
Victor Julien 2f87c975d4 detect: add SigMatch arg to inspect functions 10 years ago
Victor Julien cf42fbf51f detect: use InspectEngineFuncPtr in inspect engines 
Replace explicit function pointer use by InspectEngineFuncPtr typedef
 10 years ago
Victor Julien 5f7e096be4 detect: shrink inspect engine by using 'id' as state flag 10 years ago
Victor Julien 715ff60087 detect: remove unused SIG_FLAG_INIT_PAYLOAD init_flag 10 years ago
Victor Julien 859cb89c7e detect alert/threshold/tag: sm_list -> sm_array 10 years ago
Victor Julien 99580487e5 detect: fix file_data / http_server_body tests 10 years ago
Victor Julien faadec0d7f detect file_data: improve error messages 10 years ago
Victor Julien e2c6e1be33 detect-parse: set ipprotos earlier 
A high level proto like HTTP implies TCP. However this wasn't set
until after all the parsing was complete which means that keywords
couldn't test if the ipproto matched.

This patch populates the ipprotos right when the higher level proto
is parsed.
 10 years ago
Victor Julien 5e0b0eea4b detect: remove unused flags 10 years ago
Victor Julien 39613778cd detect: make setup/free/match funcs static where possible 10 years ago
Victor Julien bfd4bc8233 detect: constify Signature/SigMatch use at runtime 10 years ago
Victor Julien a44da9f5cb detect: simplify SIG_FLAG_STATE_MATCH set logic 10 years ago
Victor Julien be3ee5330f detect: remove alproto from keyword registration 
It was already marked as depricated and no longer in use anywhere.
 10 years ago
Victor Julien 113a238e90 Open 4.0 development branch 10 years ago
Victor Julien 71710f088e dns: fix outputs with 0-len A/AAAA records 10 years ago
Victor Julien 20990f7a7e dns: fix out of bounds read 
On a zero size A or AAAA record, 4 or 16 bytes would still be
read.

Found with AFL+ASAN.
 10 years ago
Jason Ish 4a04f814b1 defrag - take protocol into account during re-assembly 
The IP protocol was not being used to match fragments with
their packets allowing a carefully constructed packet
with a different protocol to be matched, allowing re-assembly
to complete, creating a packet that would not be re-assembled
by the destination host.
 10 years ago
Victor Julien 292baf0872 afl: add ethernet and erspan entry points 10 years ago
Victor Julien 49c41fc79e afl: clean up commandline parsing 10 years ago
Victor Julien b56b04f84c afl: pass a packet queue to decoder calls 10 years ago
Jason Ish 35488eefda afl: set the packet data so pktlen gets set 10 years ago
Victor Julien fbd69729aa afl: improve packet fuzz testing 
Due to the use of AFL_LOOP and initialization/deinit outside of it,
part of the fuzzing relied on the global 'state' in flow and defrag.
Because of this crashes that were found could not be reproduced. The
saved crash input was only the last in the series.

This patch addresses that. It requires a new output directory 'dump'
where the packet fuzzers will store all their input. If the AFL_LOOP
fails the files will not be removed and this 'serie' can be read
again for reproducing the issue.

e.g.: AFL would work with:
--afl-decoder-ppp=@@

and after a crash is found the produced serie can be read with:
--afl-decoder-ppp-serie=1486656919-514163

The series have a timestamp as name and a suffix that controls the
order in which the files will be 'replayed' in Suricata.
 10 years ago
Victor Julien 923d93f314 afl: add decoder ipv4 option 10 years ago
Sascha Steinbiss 5e96977983 mpm-ac: fix integer overflow on allocation 
The size of a memory buffer to be allocated was kept in a signed int
instead of a size_t, leading to an overflow when large lists of long
and diverse patterns cause the amount of AC states to blow up (>2GB).
Fixes Redmine issues #1827 and #1843.

Signed-off-by: Sascha Steinbiss <sascha@steinbiss.name>
 10 years ago
Sascha Steinbiss b25b067d93 alert: silence compiler type warning 
The `ts_ecr' and `ts_val' struct fields are integer types, not
pointers. This leads GCC 6.3.0 to complain about comparisons to
NULL.

Signed-off-by: Sascha Steinbiss <sascha@steinbiss.name>
 10 years ago
Victor Julien 86222428dd detect: don't run IP inspection on non-IP packets 
The code to get the rule group (sgh) would return the group for
IP proto 0 instead of nothing. This lead to certain types of rules
unintentionally matching (False Positive).

Since the packets weren't actually IP, the logged alert records
were missing the IP header.

Bug #2017.
 10 years ago
Victor Julien 4683b0e662 afl: fix ENIP, switch DNS to UDP and add --afl-dnstcp* 10 years ago
Victor Julien c89ce17017 afl: with -Wshadow issues 10 years ago
Eric Leblond ecf59be413 af-packet: add VLAN header when needed in IPS mode 
When packet is coming from a real ethernet card, the kernel is
stripping the vlan header and delivering a modified packet so
we need to insert the VLAN header back before sending the packet
on the wire.

To do so, we pass an option to the raw socket to add a reserve
before the packet data. It will get Suricata some head room to
to move the ethernet addresses before there actual place and
and insert the VLAN header in the correct place.

We get VLAN info from the ring buffer as the call of AFPWrite is
always done in the release function so we still have access to the
memory.
 10 years ago
Eric Leblond f407d77016 detect-tls-sni: add link to documentation 10 years ago
Eric Leblond 1af713d67d detect-tls: add url field pointing to doc 10 years ago
Eric Leblond 0695ad4bf0 detect-xbits: set documentation URL 10 years ago
Jason Ish 21bbac5648 dns-log: log requests even when there is no response 
The JSON logger had already been updated to handle
transactions without a response. Apply the same logic
to the older dns-log where a logger is registered
for each direction.

Fixes issue 2012.
 10 years ago
Andreas Herz d8b5bf9bc6 app-layer-parsing: detect malformed input 
If the app-layer-parsing has a very long content it exceeds the maximum
defined in "alproto_name". This adds a check for the too long content
before it will be passed to "strlcpy" and logs an error.
 10 years ago
Victor Julien f91d490d25 detect: remove unused flow_locked hint 10 years ago
Victor Julien 31a96d5a79 detect: make tenant loading less verbose 10 years ago
Victor Julien addf64f1f7 profiling: fix memory leaks 10 years ago
Victor Julien 6e876182d7 detect: use TLS_STATE_CERT_READY in cert inspect 10 years ago
Victor Julien 473dae75b5 tls: introduce 'cert ready' state 10 years ago
Victor Julien 15accc86c9 common: add BIT_U8 macro 10 years ago
Sascha Steinbiss e6044aaf1c mpm/spm: check for SSSE3 and enable/disable HS 
The new Hyperscan 4.4 API provides a function to check for SSSE3
presence at runtime. This allows us to fall back to non-Hyperscan
matchers on systems without SSSE3 even when the suricata executable
is built with Hyperscan support. Addresses Redmine issue #2010.

Signed-off-by: Sascha Steinbiss <sascha@steinbiss.name>
Tested-by: Arturo Borrero Gonzalez <arturo@debian.org>
 10 years ago
Victor Julien a0580d8805 stream: initialize stream segment pool from mtu 
If segments section in the yaml is ommitted (default) or when the
pool size is set to 'from_mtu', the size of the pool will be MTU
minus 40. If the MTU couldn't be determined, it's assumed to be
1500, so the segment size for the bool will be 1460.
 10 years ago
Victor Julien 1ba15d3721 mtu: track max mtu for capture devices 10 years ago
Victor Julien 7ca466c598 shutdown: remove pid file last 10 years ago
Victor Julien 816dd7b301 startup: clean up main loop 10 years ago
Victor Julien 2eec07cc3a unittests: clean up registration and startup 10 years ago
Victor Julien f452df761a shutdown: move global shutdown steps into func 10 years ago
Victor Julien babe8a299e startup/shutdown: cleanup and unify with unix mode 10 years ago
Victor Julien 3c64cfb384 threads: fix missed logging at shutdown 
At shutdown, all flows that still need work are handled by the flow
force reassembly logic. This means one or more flow end pseudo packets
are generated and pushed through the engine for final detection and
logging.

In some cases this would not work correctly. This was caused by the
flow timeout logic kicking in before all the 'live' packets were
processed. Before the flow timeout handling runs the receive threads
are disabled, however the engine did not wait for the in-flight
packets to be fully processed. In autofp mode, packets could still
be in the queue between receive thread(s) and flow worker(s).

This patch adds a new function that 'drains' all the packet threads
of any in-progress packets before moving on the flow timeout logic.

Bug #1946.
 10 years ago
Mats Klepsland a2659ed7ec output-json-flow: add has_alerts field 
Add has_alerts field to flow eve-log to indicate if a flow has
any alerts or not.
 10 years ago
Mats Klepsland c531e8f77c lua: add SCFlowHasAlerts function 
Add SCFlowHasAlerts() to check if a flow has alerts. Returns true
on alerts, false otherwise.

Example:

  has_alerts = SCFlowHasAlerts()
  if has_alerts then
    -- do something
  end
 10 years ago
Mats Klepsland d9b87e502d flow: set flag to indicate that a flow has alerts 
Set FLOW_HAS_ALERTS flag on the flow on alerts. Add FlowHasAlerts(..)
and FlowSetHasAlertsFlag(..) to check and set this flag.
 10 years ago
Eric Leblond 569cc5d238 util-file: introduce new functions for file size 
This patch introduces the FileDataSize and FileTrackedSize functions.
The first one is just a renaming of the initial FilSize function
whereas the other one is using the newly introduced size field as
value.
 10 years ago
Eric Leblond a098896b28 output-json-file: use size instead of FileSize 
FileSize is not returning the actual value when file store is not
used.
 10 years ago
Eric Leblond fbc2dbac28 util-file: change file size computation 
The file size returned by FileSize is invalid if file store is not
used so we introduce a new size field in File structure that is used
to store the size.
 10 years ago
Alexander Gozman 187a6f392c Bug #2009: added CAP_NET_ADMIN for PCAP and af-packet modes. 
Without this capability suricata is unable to get network
interface's settings.
 10 years ago
Jason Ish 19e578a740 pcap-log: fix pcre_study error check 
Code was failing on a NULL return value which can be returned
when there was nothing todo instead of an error. Instead
check the errbuf for a non-NULL value to determine error.
 10 years ago
Jason Ish 5c55373679 app-layer-detect-proto.c: fix indent 
A recent commit was outdented by 1 column.
 10 years ago
Jason Ish ec44585dca app-layer - fix secondary probing parser logic 
Apply the same logic to pe2 as pe1 for determining which
probe to call. Missed in previous commit.
 10 years ago
Victor Julien cb36dee477 hyperscan: fix minor coverity issue in error path 
*** CID 1398951:  API usage errors  (LOCK)
/src/util-mpm-hs.c: 722 in SCHSPreparePatterns()
716         SCMutexUnlock(&g_db_table_mutex);
717
718         SCHSFreeCompileData(cd);
719         return 0;
720
721     error:
>>>     CID 1398951:  API usage errors  (LOCK)
>>>     "pthread_mutex_unlock" unlocks "g_db_table_mutex" while it is unlocked.
722         SCMutexUnlock(&g_db_table_mutex);
723         if (pd) {
724             PatternDatabaseFree(pd);
725         }
726         if (cd) {
 10 years ago
Victor Julien fa8cbd8741 smb: detect protocol in both directions 10 years ago
Jason Ish e9fccfa67c tx logging: only update logged tx id if all loggers logged 
Prevents the case where the logged id is incremented if a newer
transaction is complete and an older one is still outstanding.

For example, dns request0, unsolicited dns response, dns response0

would result in the valid response0 never being logged.

Similarily this could happen for:
  request0, request1, response1, response0

which would end up having request0, request1 and response1 logged,
but response0 would not be logged.
 10 years ago
Eric Leblond 0d5fd0f658 util-file: fix error logic in hash computation 
This patch fixes an issue with hash computation resulting in the
invalidity of at least one hash when at least two different hashes
functions were used.

Impact was setting as `force-hash: [md5, sha256]` not to be valid.
Also it could lead to false negative if too different hash functions
had to be used on a single file due to signatures.
 10 years ago
Jason Ish 20111cab23 unix-socket: fix shadowed variable 
ret does not need to be redefined here, the existing
declaration of ret can be used.
 10 years ago
Victor Julien f964cdbc93 address parsing: fix memory leak in error path 10 years ago
Victor Julien a6fccd952e ssl: suppress scan-build warnings 10 years ago
Victor Julien 61b72c6981 output: clean up output function 
Don't allocate memory per call.
 10 years ago
Victor Julien 709d20f8c6 smb/dcerpc: suppress scan-build warnings 10 years ago
Victor Julien 618ab4e177 ac-bs: fix scan-build warnings 10 years ago
Victor Julien bbc02205fb queue: add debug assertions to TAILQ 
To avoid scan-build fp's add assertions that are only active if
built with scan-build.
 10 years ago
Mats Klepsland 03ad9d4ec0 tls-store: fix bug that causes Suricata to crash 
Fix bug that causes Suricata to crash when the tls.store keyword is used.

*** Error in `/usr/bin/suricata': free(): invalid next size (fast):
0x00007fd4b4373180 ***
 10 years ago
Jason Ish 87b5bf9541 proto detect - fix coverity CID 1204325 
CID 1204325 (#1 of 1): Logically dead code (DEADCODE)
dead_error_line: Execution cannot reach this statement: mask = 0U;.
433        mask = 0;

additionally, mask is initialized to 0
 10 years ago
Jason Ish d09cd16c8c template logger - fix coverity CID 1324964 
null: At condition templatejs != NULL, the value of templatejs must be
NULL.
dead_error_condition: The condition templatejs != NULL cannot be true.
113    if (templatejs != NULL) {
CID 1324964 (#1 of 1): Logically dead code (DEADCODE)
dead_error_line: Execution cannot reach this statement:
json_decref(templatejs);.
114        json_decref(templatejs);
115    }
 10 years ago
Jason Ish a10a9220cf dns (tcp) - fix coverity CIDs 1374306, 1374305 
CID 1374306 (#1 of 1): Dereference before null check (REVERSE_INULL)
check_after_deref: Null-checking dns_state suggests that it may be null,
but it has already been dereferenced on all paths leading to the check.
585    if (dns_state != NULL && f != NULL) {
586        dns_state->last_req = f->lastts;
587    }

CID 1374305 (#1 of 1): Dereference before null check (REVERSE_INULL)
check_after_deref: Null-checking dns_state suggests that it may be null,
but it has already been dereferenced on all paths leading to the check.
366    if (dns_state != NULL && f != NULL) {
367        dns_state->last_req = f->lastts;
368    }
 10 years ago
Jason Ish dfbfb50f64 dns (tcp) - fix coverity cid 1374307 
CID 1374307 (#1 of 1): Dereference before null check (REVERSE_INULL)
check_after_deref: Null-checking dns_state suggests that it may be null,
but it has already been dereferenced on all paths leading to the check.
317    if (dns_state != NULL && f != NULL) {
318        dns_state->last_resp = f->lastts;
319    }
 10 years ago
Eric Leblond 5b1de57d73 detect-parse: simplify port prefiltering 
Regular expression was not matching some authorized setting like
"![1234, 1235]". This patch simplify the regexp to match on
possible character and let the port parsing code handle the
complete verification.
 10 years ago
Jason Ish b0de5ad1a8 dns: increment tx id when allocated during response 10 years ago
Victor Julien fe4e119278 common: improve BUG_ON 
When BUG_ON is a wrapper for assert(), we risk getting rid of certain
code lines. Assert is a no-op when NDEBUG is defined.

This patch defines an alternate path for BUG_ON that exits after
printing an error.

Bug #2003.
 10 years ago
Andreas Herz 98e8b13bf0 decode-icmpv6: add missing types 
There have been some ICMPv6 types missing within the DecodeICMPV6 that
are added by this commit and the code check is adjusted to always use
the DEFINE.
 10 years ago
Jason Ish bcdbd12839 dns (tcp): register a to_client (response) probing parser 
Just a minimal parser to make sure the data contains at
least a header.
 10 years ago
Jason Ish c35c18a797 app-layer: support to server and to client probing parsers 
When registering a probing parser allow to_server and
to_client parsers to be registered. Previously the
probing parser may be called for both directions which
in some cases works OK, but in others can cause
the to_client side to be detected as failed.
 10 years ago
Victor Julien 586774203f redis: support for all output types 10 years ago
Victor Julien 2820ed332e redis: use 'binary' notation for output 10 years ago
Victor Julien df28c1ac6e common: add WARN_UNUSED macro 10 years ago
Victor Julien 8c65d45d55 detect: remove dead code 10 years ago
Eric Leblond 63a3b84127 util-magic: fix build when magic is not available 
If HAVE_MAGIC is not defined then we don't have the test functions
so we can't register them.
 10 years ago
Victor Julien cb08f02140 xbits: clean up parsing and tests 10 years ago
Jason Ish 27ec811187 pcap-log: fix memory leak during initialization of ring buffer 
A free was missing when files are removed during initialization
of the ring buffer.

Redmine issue:
https://redmine.openinfosecfoundation.org/issues/1985
 10 years ago
Eric Leblond 9f6b58747b smtp: commands and replies are not case sensitive 
RFC states that "Commands and replies are not case sensitive" and
patterns were registered to be case sensitive. So this patch fixes
a trivial evasion of SMTP signatures.
 10 years ago
Mats Klepsland ffcb4ad232 tls: fix tls_cert_subject prefilter bug 
If check in prefilter was checking that issuer was non-NULL, when
it in fact should be checking subject.
 10 years ago
Mats Klepsland 10c93221fa tls: increase max number of tls records per packet 
Tls packets may contain several records. This increase the number
of allowed records per packet from 30 to 255, and adds a new and
more informative decoder event when this limit is reached.
 10 years ago
Mats Klepsland 554065189c tls: don't trigger decoder event on no extensions in CLIENT_HELLO 
No extensions are allowed in <TLSv.1.2, so don't trigger SURICATA
TLS handshake invalid length decoder event when no extensions are
specified in CLIENT HELLO.
 10 years ago
Victor Julien 810e43f373 magic: make optional 
Make libmagic optional. If installed it will be enabled by default in
configure. Use --disable-libmagic to disable.
 10 years ago
Jason Ish 79a3c6c7b1 log-pcap: use a snaplen of 262144 instead of -1. 
Newer versions of libpcap will not open pcap files with a
snaplen of -1, instead use the current maximum value of
262144.

Issue:
https://redmine.openinfosecfoundation.org/issues/1987
 10 years ago
Victor Julien a44b612a41 hostbits/xbits: free hostbit 
Fix memory leak. Hostbits were not actually freed.

Bug #1975.
 10 years ago