aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
7,427 Commits
7 Branches
155 Tags
192 MiB
master
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '8f56c23468'
${ noResults }
Commit Graph

7427 Commits (8f56c234683551f9418377cd250c434938c08ddc)
 

Author SHA1 Message Date
Jason Ish 8f56c23468 detect-flow: no_frag and only_frag keyword support 
Support flow:no_frag and flow:only_frag keywords from Snort.
 8 years ago
Jason Ish f81619a13e defrag: set flag on packets reassembled from fragments 
Set the PKT_REBUILT_FRAGMENT on packets that are re-assembled
from fragments.
 8 years ago
Jason Ish 571f56cfcf detect-flow: support flow:not_established 8 years ago
Jason Ish dc762cd44d detect-flow: use new unit test macros 8 years ago
Duarte Silva 6948b2332a file-hashing: Fixed line parsing code 8 years ago
Victor Julien 56ffba9fd8 doc: initial app-layer keywords 
Document app-layer-protocol and make a start with app-layer-event.
 9 years ago
Victor Julien 449c93e062 detect-app-layer-protocol: improve rule validation 
Also add tests for PD-only conditions
 9 years ago
Victor Julien 0ed119068d detect-app-layer-protocol: implement prefilter 
Introduce 'Protocol detection'-only rules. These rules will only be
fully evaluated when the protocol detection completed. To allow
mixing of the app-layer-protocol keyword with other types of matches
the keyword can also inspect the flow's app-protos per packet.

Implement prefilter for the 'PD-only' rules.
 9 years ago
Victor Julien 8094b2b12e detect-app-layer-protocol: convert to pkt match 9 years ago
Victor Julien c28d9d0538 eve: print app_proto_ts/app_proto_tc 9 years ago
Victor Julien dbb3a12b32 logging: return string for ALPROTO_FAILED 9 years ago
Victor Julien 93298e91c7 app-layer counters: count failed protocol detect 9 years ago
Victor Julien 3b98feef01 proto-detect: clean up UDP handling 
Set FAILED instead of using a flow flag. Flag packets in both
sides when detection is done. Detection is only done in one
direction.
 9 years ago
Victor Julien 90bf2b5a32 proto detect: improve error case handling 
Improve flags logic, update tests.
 9 years ago
Victor Julien e955cf3366 detect-app-layer-protocol: improve error handling 
Redo tests.
 9 years ago
Victor Julien 9560e8b5b2 proto-detect: update mismatch handling 
Improve protocol mismatch handling. Preserve both protos. Use otherdir
if already sent to parser, use toclient otherwise.
 9 years ago
Victor Julien 7d7ec78cc3 app-layer-protocol: improve detection 
Add negated matches to match list instead of amatch.

Allow matching on 'failed'.

Introduce per packet flags for proto detection. Flags are used to
only inspect once per direction. Flag packet on PD-failure too.
 9 years ago
Victor Julien ac2cf526f1 proto detect: remove flow data tracking 
The Flow::data_al_so_far was used for tracking data already
parsed when protocol for the current direction wasn't known yet. As
this behaviour has changed the tracking can be removed.
 9 years ago
Victor Julien d7c828bcb0 proto detect: update behavior on partial detection 
When the current direction doesn't get a protocol detection, but the
opposing direction did, previously we would send the current data to
the parser. Then when we'd be invoked again (until the protocol
detection finally failed) we'd get the same data + the new data. To
make sure we'd not send the same data to the parser again, the flow
kept track of how much was already sent to the app-layer using
data_al_so_far.

This patch changes the behaviour. Instead of sending the data for
the current direction right away, we only do this when protocol
detection is complete. This way we won't have to track anything.
 9 years ago
Victor Julien 6022fa44a5 proto detect: TCP cleanup 
Split function into multiple smaller ones.
 9 years ago
Victor Julien 8347aa01fa app-layer: clean up counters registration 9 years ago
Victor Julien c6134e007e doc: app-layer tls including no-reassemble 9 years ago
Victor Julien b789d2ae3d tls: change 'no-reassemble' option to default off 
This option was broken so there should be no visible change to
actual deployments.
 9 years ago
Thomas Andrejak c17402fdcb prelude: add IPv6 support 9 years ago
Thomas Andrejak dcce225102 prelude: add missing TCP header to additional data 9 years ago
Thomas ANDREJAK 671320aab8 prelude: update URL 9 years ago
Thomas Andrejak e33060cee0 prelude: coding style, it's better to use macro 9 years ago
Thomas Andrejak b1c1699699 prelude: Add other actions than just ACTION_DROP when packet drop 9 years ago
Thomas Andrejak 4d4a3d0b8f prelude: Add log when failed to create assessment or impact object 9 years ago
Thomas Andrejak 18c9312380 Add macro for TCP and UDP header access 9 years ago
Eric Leblond 4eca40ac34 app-layer-tls: stop detection if no reassembly 
It no-reassembly is asked in TLS conf then we can stop inspection
after handshake and cause bypass to be triggered on the flow.
 9 years ago
Eric Leblond 69e1ff7ba7 stream-tcp: bypass encrypted when both side ready 
Suricata should not completely bypass a flow before both end of it
have reached the stream depth or have reached a certain state.
Justification is that suricata need the ACK to treat the other side
so we can't really decide to cut only one side.
 9 years ago
Nicolas Thill 3750c15632 doc: add SCPacketTimestamp Lua function 
Signed-off-by: Nicolas Thill <ntl@p1sec.com>
 9 years ago
Nicolas Thill e95e6ccded lua: add an SCPacketTimestamp function 
The SCPacketTimestamp function returns packet timestamps as 2 real
numbers (seconds & microseconds).

Example:

  local sec, usec = SCPacketTimestamp()

Signed-off-by: Nicolas Thill <ntl@p1sec.com>
 9 years ago
Victor Julien f4b165de94 file: register filedata loggers before file 
This fixes the issue that 'stored' remained false even if the file
was stored.

Reported-by: Chris Wakelin
 9 years ago
Victor Julien 4126fd82a0 doc: small eve update: add dns 9 years ago
Victor Julien e3b2d95100 doc: add recent tls keywords 9 years ago
Victor Julien 08b875c03b doc: clean up fast_pattern 9 years ago
Victor Julien f1046db113 doc: fix header keywords layout 9 years ago
Victor Julien 43aed70976 detect: during detection sgh is read only so turn into const 9 years ago
Victor Julien 0e31124609 detect: add util func for post-inspect tasks on first sgh 9 years ago
Victor Julien d3fb4de1b5 detect: move file flags update into it's own function 9 years ago
Victor Julien 664f9aa906 flow: use BIT_U32 for flags 9 years ago
Victor Julien c81aaeda7b flow: move file flags into their own variable 
Move FLOW_FILE_* flags into Flow::file_flags. Rename them to
FLOWFILE_* so non updated code will break.
 9 years ago
Jason Ish 3fab684f97 logging: don't log that json is disabled in each logger 
A warning log is already emitted if eve-log is enabled in the
configuration but json support is not built so the logger
registration functions can be silent.
 9 years ago
Jason Ish 0bce4b5534 macOS: thread return value affects newer macOS as well 
ALl OS X/macOS versions since 10.10 return EDEADLK here instead
of EBUSY. Assume they will moving forward as well.
 9 years ago
Victor Julien d80914d350 doc: move rule reload and adding rules into rule-management 9 years ago
Victor Julien e24c3937b3 doc: add rule-management chapter 9 years ago
Victor Julien 80bd59ae86 doc: improve install doc, configure 9 years ago
Victor Julien 48274218df doc: multi-tenancy is not work in progress 9 years ago