aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
7,368 Commits
10 Branches
154 Tags
165 MiB
dependabot/github_actions/actions/checkout-4.2.1
dependabot/github_actions/github/codeql-action-3.26.12
dependabot/github_actions/actions/upload-artifact-4.4.3
master
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'aaf0fe4d29'
${ noResults }
Commit Graph

7368 Commits (aaf0fe4d29e5c9d0319732c07c17bd3c1df381ea)
 

Author SHA1 Message Date
Victor Julien 9cab3ea2cd http_stat_code: mpm prefilter engine 8 years ago
Victor Julien 4d57b2fc63 http_stat_msg: mpm prefilter engine 8 years ago
Victor Julien 86d303e32b http_raw_host: mpm prefilter engine 8 years ago
Victor Julien 5218849213 http_host: mpm prefilter engine 8 years ago
Victor Julien 61c3748fc4 http_user_agent: mpm prefilter engine 8 years ago
Victor Julien a43a69305d http_cookie: mpm prefilter engine 8 years ago
Victor Julien 7a46364e42 http_raw_uri: mpm prefilter engine 8 years ago
Victor Julien 746a169127 dns_query: mpm prefilter engine 8 years ago
Victor Julien 9ff5703c49 packet/stream: mpm prefilter engine 8 years ago
Victor Julien 72f2a78b1f http_method: mpm prefilter engine 8 years ago
Victor Julien b62c4cc359 http_uri: mpm prefilter engine 
Inspect partial request line as well.
 8 years ago
Victor Julien 5bcdbe3922 prefilter: introduce prefilter engines 
Introduce abstraction layer for prefilter engines.
 8 years ago
Victor Julien 3dad824fb2 detect: rename SignatureNonMpmStore 
New name is SignatureNonPrefilterStore to reflect that it's not just
about MPM anymore.
 8 years ago
Victor Julien 17bc0299fe detect: rename non_mpm lists/vars to non_pf 
Rename to non_pf: non prefilter.
 8 years ago
Victor Julien bb0cd0e883 prefilter: rename PatternMatcherQueue datatype 
In preparation of the introduction of more general purpose prefilter
engines, rename PatternMatcherQueue to PrefilterRuleStore. The new
engines will fill this structure a similar way to the current mpm
prefilters.
 8 years ago
Victor Julien 4c0ab681f2 mpm: remove Cleanup API call 
It's unused by all of the implementations.
 8 years ago
Victor Julien 7c47016913 detect-fragoffset: minor cleanup 8 years ago
Victor Julien a41695f29f uricontent: remove left over func decl 8 years ago
Victor Julien ff70e0cca0 mpm tls: remove unused function args 8 years ago
Victor Julien ad3a55d938 mpm dns query: remove unused function args 8 years ago
Victor Julien d647db1775 mpm stat code: remove unused function args 8 years ago
Victor Julien bd03307921 mpm stat msg: remove unused function args 8 years ago
Victor Julien 6d54b70db4 mpm ua: remove unused function args 8 years ago
Victor Julien 704afeb078 mpm cookie: remove unused function args 8 years ago
Victor Julien 4229e603f0 mpm raw host: remove unused function args 8 years ago
Victor Julien 1380853ee8 mpm host: remove unused function args 8 years ago
Victor Julien b40ecb7356 mpm method: remove unused function args 8 years ago
Victor Julien 3d5807ba44 mpm raw uri: remove unused function args 8 years ago
Victor Julien d461c7888a mpm uri: remove unused function args 8 years ago
Victor Julien c4dcb20522 detect-parse: add new func to get last sigmatch 
Add SigMatchGetLastSM which simply returns the very last SM added
to the signature.

Minor cleanups.
 8 years ago
Victor Julien 3ab405dc50 doc: reorganize hyperscan guide 8 years ago
Victor Julien 99d5bf4e68 doc: improve tuning/perf docs 8 years ago
Victor Julien c7c8de7d59 doc: fix ET example URL 8 years ago
Victor Julien 485544d885 doc: improve commandline options 8 years ago
Eric Leblond 3ca663d7ff output-json-flow: display bypass method 
In the case of a bypassed flow we add a 'bypass' key that can
be 'local' or 'capture'. This will allow the user to know if
capture bypass method is failing by looking at the 'bypass' key.
 8 years ago
Giuseppe Longo e6bac998d9 flow: add timeout for local bypass 
This adds a new timeout value for local bypassed state. For user
simplication it is called only `bypassed`. The patch also adds
a emergency value so we can clean bypassed flows a bit faster.
 8 years ago
Eric Leblond 51bfe4960a flow: discard packets belonging to bypassed flows 8 years ago
Eric Leblond 724069626d flow: downgrade to local bypass if we see packets 
If we see packets for a capture bypassed flow after some times, it
means that the capture method is not handling correctly the bypass
so it is better to switch to local bypass method.
 8 years ago
Eric Leblond 4cf887b4f7 flow: update lastts in FlowHandlePacketUpdate 
This allows to make it conditional to the state of packet and
then trigger modified behavior.
 8 years ago
Giuseppe Longo 5b71b5834f filestore: avoid conflict with bypass keyword 
If a packet triggers a rule which contains both
bypass and filestore keywords,
it won't be stored since it's not inspected.

To avoid that, when a rule containing filestore keyword
we make sure that also bypass keyword is present.
 8 years ago
Giuseppe Longo 07564c4e41 detect: add bypass keyword 
This adds a new keyword which permits to call the
bypass callback when a sig is matched.

The callback must be called when the match of the sig
is complete.
 8 years ago
Eric Leblond c19cd12620 flow: bypass encrypted and after stream depth flow 
This patch activates bypass for encrypted flow and for flow
that have reached stream depth on both side.

For encrypted flow , suricata is stopping the inspection so
we can just get it out via bypass. The same logic apply
for flow that have reached the stream depth.

For a basic test of feature, use the following ruleset:

```
table ip filter {
	chain output {
		type filter hook output priority 0; policy accept;
		ct mark 0x1 counter accept
		oif lo counter queue num 0
	}

	chain connmark_save {
		type filter hook output priority 1; policy accept;
		mark 0x1 ct mark set mark counter
		ct mark 0x1 counter
	}
}
```

And use bypass mark and mask of 1 in nfq configuration. Then you
can test the system by scp big file to 127.0.0.1. You can also
use iperf to measure the performance on localhost. It is recommended
to lower the MTU to 1500 to get something more realistic by increasing
the number of packets..
 8 years ago
Giuseppe Longo 177df305d4 stream-tcp: enable bypass setting 
This permits to enable/disable in suricata.yaml
and the bypass function will be called
when stream.depth is reached.
 8 years ago
Giuseppe Longo 97783f8142 nfq: introduce bypass function 8 years ago
Eric Leblond 285b4dd981 decode: implement bypass function 
Call the packet bypass callback if necessary and update the flow
state. In case of failure we switch to local bypassed state and set
capture bypassed state if the callback is successful.
 8 years ago
Eric Leblond 68d9677eea flow: force reassembly for bypassed flows 
As capture method like nfq will cut both side of the flow instantly
we will not get the hack for most data which have been received. So
it is better to force reassembly to be sure to get the timeout of
the entry.
 8 years ago
Eric Leblond 39c8786a8e flow: get bypass info in get used flow function 8 years ago
Eric Leblond 07ef451c2b flow: add pruned bypassed flow counter 8 years ago
Eric Leblond 745dad9809 flow: display info about bypass in log 8 years ago
Eric Leblond e88555caf9 flow: add bypassed states 
This patch adds two new states to the flow:
* local bypass: for suricata only bypass, packets belonging to
a flow in this state will be discard fast
* capture bypass: capture method is handling the bypass and suricata
will discard packets that are currently queued

A bypassed state to flow that will be set on flow when a bypass
decision is taken. In the case of capture bypass this will allow
to remove faster the flow entry from the flow table instead of
waiting for the "established" timeout.
 8 years ago