aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
9,597 Commits
8 Branches
173 Tags
189 MiB
main
main-7.0.x
main-8.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'd5baac3f85'
${ noResults }
Commit Graph

8314 Commits (d5baac3f8507450e44284e0200f52a1f702c7472)

Author SHA1 Message Date
Victor Julien d5baac3f85 detect/flow: don't require flow for direction options 
Flow isn't directly used for direction checks, so don't require
a flow to be present.
 7 years ago
Victor Julien c1dcc26965 detect/parse: improve direction setting on sigs 
Only set both directions if no direction has been explicitly set before.
 7 years ago
Victor Julien 9a14cb252d detect/bytetest: debug cleanup 7 years ago
Victor Julien cb9b27ab89 app-layer/pd: free memory 7 years ago
Victor Julien 39725907d6 detect: remove BUG_ON from packet path 7 years ago
Victor Julien 042f806362 detect: fix match array reset 
Fix match array reset depending on prefilter matches for the
current run. If there were none, the match array of the previous
packet was used. This could lead to inspection of rules from the
wrong rule group.
 7 years ago
Victor Julien 05d9527d01 app-layer/profile: fix udp protocol detection profiling 7 years ago
Victor Julien f44bbd71f5 app-layer/udp: micro optimization 7 years ago
Jeff Lucovsky 6123d77527 Fix memory leak with TOS handling 
Use `pcre_copy_substring` to avoid memory allocations when parsing
TOS values.
 8 years ago
jason taylor 1f3dd85216 pfring: update bpf error handling to be consistent 
* updated bpf error handling to be consistent with af-packet
* minor internal doc updates

Signed-off-by: jason taylor <jtfas90@gmail.com>
 8 years ago
Giuseppe Longo d0e2420faf reputation: move unit tests 
UTs are moved inside "test/" directory,
and reworked to improve readability and reduce lines of code.
 8 years ago
Giuseppe Longo 389227d899 detect-iprep: fix memory leaks 
Loading rules with iprep keyword cause
memory leaks due to missing frees.

Direct leak of 8 byte(s) in 4 object(s) allocated from:
    #0 0x7f81c862bd28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
    #1 0x7f81c6afea69 in pcre_get_substring (/lib/x86_64-linux-gnu/libpcre.so.3+0x27a69)
    #2 0x43206f7420676e68  (<unknown module>)

SUMMARY: AddressSanitizer: 8 byte(s) leaked in 4 allocation(s).
 8 years ago
Eric Leblond 58b804f7d2 flow-bypass: set thread name to FB 8 years ago
Victor Julien 69d0d484eb af-packet: don't use anonymous unions 8 years ago
Victor Julien acd9e1c2e7 af-packet: fix v3 code using v2 union member 8 years ago
Victor Julien 9948c96c68 stream/ips: set proper payload len for inspection 
On mem(cap) presure we fall back to the packet payload. The previous
patch failed to properly set the payload length.
 8 years ago
Victor Julien d6903e70c1 file-log: remove and add warning 
Feature was deprecated and scheduled for removal.

Ticket #2376
 8 years ago
Eric Leblond 2b1fa53c66 detect-hostbits: error on some invalid config 8 years ago
Eric Leblond e09fa43ba5 detect-xbits: error on some invalid config 8 years ago
Eric Leblond 910c3691af detect-flowbits: error on some invalid syntax 
The regular expression was accepting something like
"flowbits:!isset,isma;" without complaining even if it is not
correct and don't have the expected result.
 8 years ago
Eric Leblond 033fbc0f85 suricata: fix list keywords URL in release mode 
The tags are suricata-X.X.X so we need to update the chain to get
URLs right.
 8 years ago
Shivani Bhardwaj bb08040df6 unix-socket: Fix the message for unregister-tenant-handler 8 years ago
Victor Julien 74a42f683c eve/http: add proxy related custom headers 8 years ago
Victor Julien ac7ab4ef01 eve/http: fix custom header table 8 years ago
Victor Julien e99063b6b8 smtp: minor code cleanup and debug addition 8 years ago
Victor Julien bf905bcbca checksum: use u64 types 8 years ago
Victor Julien 02ba360903 ips/stream: handle low mem(cap) crash 
In low memory or memcap reached conditions a crash could happen in
inline stream detection.

The crash had the following path:

A packet would come in and it's data was added to the stream. Due
to earlier packet loss, the stream buffer uses a stream buffer block
tree to track the data blocks. When trying to add the current packets
block to the tree, the memory limit was reached and the add fails.

A bit later in the pipeline for the same packet, the inline stream
mpm inspection function gets the data to inspect. For inline mode
this is the current packet + stream data before and after the packet,
if available.

The code looking up the packets data in the stream would not
consider the possibility that the stream block returned wasn't
the right one. The tree search returns either the correct or the
next block. In adjusting the returned block to add the extra stream
data it would miscalculate offsets leading to a corrupt pointer to the
data.

This patch more carefully checks the result of the lookup, and
falls back to simply inspecting the packet payload if the lookup
didn't produce the expected result.

Bug 2842.

Reported-by: Ad Schellevis <ad@opnsense.org>
 8 years ago
Victor Julien ff920472f6 stream-buffer: fix block search compare func 
Sbb search function could return the wrong block due to an off by
one error.
 8 years ago
Victor Julien c306c02f8f stream-buffer: fix streaming buffer size issue 
It was using buffer size instead of the real usage of the buffer.
 8 years ago
Victor Julien 034724ec72 flow-manager: improve thread shutdown loops 8 years ago
Victor Julien 8a9cbb37a0 threads: move sleep macros into common header 8 years ago
Victor Julien aab03dde87 mpm/ac-ks: rename files from -tile to -ks 8 years ago
Victor Julien 6fcd2db043 tile: remove files 8 years ago
Victor Julien 3f253cb8c0 mpm: rename internal id for ac-tile to ac-ks 8 years ago
Victor Julien 2bd23bc1d5 detect/pcre: fix false positive 
Fix case where a HTTP modifier in PCRE statements would lead to
the rule alerting when it should not.

Bug #2769
 8 years ago
Victor Julien 43698a975a decoder: improve stats hash error handling 8 years ago
Victor Julien 517b45ea2d netmap: switch to nm_* API 
Process multiple packets at nm_dispatch. Use zero copy for workers
recv mode.

Add configure check netmap check for API 11+ and find netmap api version.

Add netmap guide to the userguide.
 8 years ago
magenbluten 1378f376a1 filestore v2: print sid in json output 8 years ago
Travis Green 1743cf5dcd engine-analysis: add support for http_host buffer 
Add support for http_host buffer for more accurate reporting.
Bug: #2798
 8 years ago
Alexander Gozman 2869f8a746 nfqueue: more descriptive queue names (e.g. 'NFQ#1' instead of '1') 
This will also make 'iface-list' output more informative.
 8 years ago
Alexander Gozman 86d7dddfab nfqueue: added received packets counter for 'iface-stat' command 
Previously nfqueue did not update received packets counter in a
livedev so 'iface-stat' UNIX-socket command always showed zeros.
 8 years ago
Victor Julien dadac4ae4f eve/fileinfo: don't alloc filename during logging 8 years ago
Victor Julien 7e1235c9c8 eve/ftp: don't alloc memory to log filename 8 years ago
Victor Julien 3749caadd7 eve/http: use stack for buffer to string conversions 8 years ago
Victor Julien 20f9b0d9c6 byte: add bytes to string w/o allocation 8 years ago
Mats Klepsland d62d33cdff app-layer-ssl: check that cipher suites length is divisible by two 
Cipher suites length should always be divisible by two. If it is a
odd number, which should not happen with normal traffic, it ends up
reading one byte too much.
 8 years ago
Mats Klepsland 22d8fc802e util-ja3: fix AddressSanitizer heap-buffer-overflow 
No resizing is done in Ja3BufferResizeIfFull() when the buffer is
empty. This leads to a potential overflow when this happens, since
a ',' is appended even when the buffer is empty.

Bug #2762
 8 years ago
Victor Julien d143ac6e89 windows/syscall: fix unused function warning 8 years ago
Victor Julien 759040a75a windows/syscall: convert file to use unix newlines 
ran: dos2unix src/win32-syscall.[ch]
 8 years ago
Victor Julien d522746c01 windows: fix sc_log_stream_lock handling 8 years ago