10234 Commits (c68fbfcfe690934e370f90a4f3e04872a1878c37)

 

All Branches   

Search

Author	SHA1	Message	Date
Victor Julien	92f08d85aa	detect/iponly: improve negation handling in parsing	6 years ago
Victor Julien	ba1de99f10	detect/address: clean up 'any' logic	6 years ago
Victor Julien	6a5084ccf9	detect/parse: set the type of signature early ... This way we can know much sooner if the rule is ip-only or not.	6 years ago
Victor Julien	449f169848	detect/parse: reduce scope of main parse func	6 years ago
Victor Julien	ac2fb706d4	detect/content: test cleanup	6 years ago
Victor Julien	5626528c73	smb3: support direction check in midstream ... As the records contain no indicator, fall back to checking the flows port number.	6 years ago
Victor Julien	422e4892cc	proto-detect: improve midstream support ... When Suricata picks up a flow it assumes the first packet is toserver. In a perfect world without packet loss and where all sessions neatly start after Suricata itself started, this would be true. However, in reality we have to account for packet loss and Suricata starting to get packets for flows already active be for Suricata is (re)started. The protocol records on the wire would often be able to tell us more though. For example in SMB1 and SMB2 records there is a flag that indicates whether the record is a request or a response. This patch is enabling the procotol detection engine to utilize this information to 'reverse' the flow. There are three ways in which this is supported in this patch: 1. patterns for detection are registered per direction. If the proto was not recognized in the traffic direction, and midstream is enabled, the pattern set for the opposing direction is also evaluated. If that matches, the flow is considered to be in the wrong direction and is reversed. 2. probing parsers now have a way to feed back their understanding of the flow direction. They are now passed the direction as Suricata sees the traffic when calling the probing parsers. The parser can then see if its own observation matches that, and pass back it's own view to the caller. 3. a new pattern + probing parser set up: probing parsers can now be registered with a pattern, so that when the pattern matches the probing parser is called as well. The probing parser can then provide the protocol detection engine with the direction of the traffic. The process of reversing takes a multi step approach as well: a. reverse the current packets direction b. reverse most of the flows direction sensitive flags c. tag the flow as 'reversed'. This is because the 5 tuple is *not* reversed, since it is immutable after the flows creation. Most of the currently registered parsers benefit already: - HTTP/SMTP/FTP/TLS patterns are registered per direction already so they will benefit from the pattern midstream logic in (1) above. - the Rust based SMB parser uses a mix of pattern + probing parser as described in (3) above. - the NFS detection is purely done by probing parser and is updated to consider the direction in that parser. Other protocols, such as DNS, are still to do. Ticket: #2572	6 years ago
Danny Browning	c0ab45aa6f	source-pcap-file: Pcap File Init Failure Handling (#1694) ... Better handle case where pcap file receive thread fails to initialize. Allow initialize to complete, but terminate the thread quickly. Delay exiting unix socket runmode as late as possible.	6 years ago
Victor Julien	55ab112e77	app-layer/pd: minor code cleanup	6 years ago
Victor Julien	2cf0a34e66	app-layer/pd: set offset and depth in mpm	6 years ago
Victor Julien	7cea1e4181	mpm/hs: track maxdepth	6 years ago
Alexander Gozman	928fe1b859	Bug 2857: NFQ ASAN 'heap-use-after-free' error. ... Global NFQ contexts were not freed properly causing 'use-after-free' error. Moving contexts cleanup to a separate NFQContextsCleanup() and calling it from GlobalsDestroy(), like it's done for AFPacket, solves the problem.	6 years ago
Jeff Lucovsky	74cd6a9ee8	doc: add http.location and http.server	6 years ago
Jeff Lucovsky	81c1af0887	detect: implement http {location,server} sticky buffer ... This implements inspection of the Server and Location buffer as a content sticky buffer.	6 years ago
Max Fillinger	081fdc6804	pcap-log: Don't leak memory in LZ4 error paths	6 years ago
Pascal Delalande	bde65467a9	doc: add ssh protocol in eve log section	6 years ago
Alexander Bluhm	0ea3fa92a8	Avoid use-after-free during pid file cleanup. ... In case the pid file is given in the config file, the file name is stored in volatile memory. Removal of the pid file happens after cleanup of config memory. Create a copy of the name which will be freed after the pid file has been removed.	6 years ago
jason taylor	b98c28a60d	configure.ac: update lzma check and misc doc ... * the lzma check during configure wasn't properly displaying the additional information on how to install if --enable-lzma was passed but lzma devel files were not present * updated additional information blocks to include distribution package names * minor formatting updates to add quotes around variables Signed-off-by: jason taylor <jtfas90@gmail.com>	6 years ago
Giuseppe Longo	c63fea8d0a	reputation: remove dead code ... This removes some code commented long time ago.	6 years ago
Giuseppe Longo	6b2a5ef21e	reputation: declare max value as constant	6 years ago
Victor Julien	f7a41412d6	smb1: fix NT create andx records filename parsing ... Use file name parsing routines that take unicode into account and consider padding bytes as well.	6 years ago
Wesley van der Ree	cc50908f8d	smb: fix NT create filename parsing ... parse_smb_create_andx_request_record skipped 1 byte too much before the filename. Fixes: #2894	6 years ago
Victor Julien	2622006faa	stream: minor test cleanups	6 years ago
Victor Julien	636fb8d387	mpm: track maxdepth ... Track max depth setting per MpmCtx. To make sure the data structure doesn't increase in size change global bool to use a flags field.	6 years ago
Victor Julien	55e5d50496	detect/flow: optimize flow check ... Flow direction doesn't need explicit checking as the rule groups (sgh) are already per direction. So if a rule sets only flow:to_server or flow:to_client, we can avoid adding a sigmatch to the signature.	6 years ago
Victor Julien	119db92c99	detect/tag: minor code cleanup	6 years ago
Victor Julien	6bf35a42f1	detect/mark: use postmatch instead of tag list ... Keep the tag list for just tags. Post match list is better so the keyword also works with pass and noalert rules.	6 years ago
Victor Julien	4dbf600d64	detect/mark: minor code cleanups	6 years ago
Victor Julien	bd31e4e332	detect: packet match micro optimization	6 years ago
Victor Julien	7497c633c4	detect/filestore: use postmatch callback	6 years ago
Victor Julien	065c3379ed	detect/replace: implement post-match ... Implement replace executor as a post match callback so that it is only considered if there actually is a replace keyword in use.	6 years ago
Victor Julien	00beeef031	eve/flow/netflow: log correct tulpe on reversed flows	6 years ago
Victor Julien	9c241fa32c	stream: use flow/packet swap logic for SYN/ACK midstream	6 years ago
Victor Julien	2f1ace64c6	flow: on timeout, consider reverse flows for pseudo packets	6 years ago
Victor Julien	4d6e6b8270	flow: introduce flow swap support	6 years ago
Victor Julien	0225ab3828	common: introduce flags and var swapping macros	6 years ago
Victor Julien	d307cfad05	packet: add 'swap' function to reverse direction	6 years ago
Victor Julien	d5baac3f85	detect/flow: don't require flow for direction options ... Flow isn't directly used for direction checks, so don't require a flow to be present.	6 years ago
Victor Julien	c1dcc26965	detect/parse: improve direction setting on sigs ... Only set both directions if no direction has been explicitly set before.	6 years ago
Victor Julien	9a14cb252d	detect/bytetest: debug cleanup	6 years ago
Victor Julien	cb9b27ab89	app-layer/pd: free memory	6 years ago
Victor Julien	39725907d6	detect: remove BUG_ON from packet path	6 years ago
Victor Julien	042f806362	detect: fix match array reset ... Fix match array reset depending on prefilter matches for the current run. If there were none, the match array of the previous packet was used. This could lead to inspection of rules from the wrong rule group.	6 years ago
Victor Julien	05d9527d01	app-layer/profile: fix udp protocol detection profiling	6 years ago
Victor Julien	f44bbd71f5	app-layer/udp: micro optimization	6 years ago
Jeff Lucovsky	6123d77527	Fix memory leak with TOS handling ... Use `pcre_copy_substring` to avoid memory allocations when parsing TOS values.	6 years ago
jason taylor	1f3dd85216	pfring: update bpf error handling to be consistent ... * updated bpf error handling to be consistent with af-packet * minor internal doc updates Signed-off-by: jason taylor <jtfas90@gmail.com>	6 years ago
Giuseppe Longo	d0e2420faf	reputation: move unit tests ... UTs are moved inside "test/" directory, and reworked to improve readability and reduce lines of code.	6 years ago
Giuseppe Longo	389227d899	detect-iprep: fix memory leaks ... Loading rules with iprep keyword cause memory leaks due to missing frees. Direct leak of 8 byte(s) in 4 object(s) allocated from: #0 0x7f81c862bd28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28) #1 0x7f81c6afea69 in pcre_get_substring (/lib/x86_64-linux-gnu/libpcre.so.3+0x27a69) #2 0x43206f7420676e68 (<unknown module>) SUMMARY: AddressSanitizer: 8 byte(s) leaked in 4 allocation(s).	6 years ago
Eric Leblond	58b804f7d2	flow-bypass: set thread name to FB	6 years ago