aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
9,597 Commits
8 Branches
173 Tags
192 MiB
main
main-7.0.x
main-8.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'd5baac3f85'
${ noResults }
Commit Graph

8314 Commits (d5baac3f8507450e44284e0200f52a1f702c7472)

Author SHA1 Message Date
Victor Julien 7811498d49 windows: allow multiple pcap devices on commandline 
Ticket #2774
 8 years ago
Victor Julien 3d4d2ecc0e ips: set host mode only after engine mode 
Make sure it is set after the final engine mode update.
 8 years ago
Victor Julien 0a106fe2ea stream: fix 'stream.inline=auto' for L2 IPS 
Make sure the livedev setup is finalized before initializing the
stream engine.

Bug #2811

Reported-by: Ad Schellevis
 8 years ago
Victor Julien f98b5ecd6a flow: log gap state per direction 8 years ago
Victor Julien 2a3cb32071 stream: no more stream events after known issue 
No longer set stream events after a gap or wrong thread. We know
we lost sync and are now in 'lets make the best of it'-mode. No
point in flooding the system with stream events.

Ticket #2484
 8 years ago
Victor Julien 87019ff22b dcerpc/udp: fix int mishandling in opnum parsing 
For Big Endian support in the protocol, the opnum would not be set
correctly.

Found using undefined sanitizer.
 8 years ago
Victor Julien 9aa4e53434 file/swf: fix undefined int behaviour 
Fix warnings by the undefined sanitizer.
 8 years ago
Victor Julien 94191ea960 detect/bytetest: don't print errors at runtime 8 years ago
Maurizio Abba 6c0ec0b2f3 eve/http: add request/response http headers 
Add a keyword configuration dump-all-headers, with allowed values
{both, request, response}, dumping all HTTP headers in the eve-log http
object. Each header is a single object in the list request_headers
(response_headers) with the following notation:

{
    "name": <header name>,
    "value": <header value>
}

To avoid forged malicious headers, the header name size is capped at 256
bytes, the header value size at 2048.

By default, dump-all-headers is disabled.
 8 years ago
Maurizio Abba 4697351188 smtp: create raw-extraction feature 
Add a raw-extraction option for smtp. When enabled, this feature will
store the raw e-mail inside a file, including headers, e-mail content,
attachments (base64 encoded). This content is stored in a normal File *,
allowing for normal file detection.
It'd also allow for all-emails extraction if a rule has
detect-filename:"rawmsg" matcher (and filestore).
Note that this feature is in contrast with decode-mime.

This feature is disabled by default, and will be disabled automatically
if decode-mime is enabled.
 8 years ago
Alexander Gozman b2a6c60dee source-nfq: increase maximum queues number to 65535 
Previously this was limited to 16, however Netfilter allows
up to 65535 queues. Suricata now is able to create as many
queues as possible, but at the same time warns user if one
specifies more queues than available CPU cores.

This change involves dynamic (de)allocation of NFQ contexts
instead of on-stack arrays to use less memory.
 8 years ago
Alexander Gozman bdd69d13e0 source-nfq: support queue range 
If one needs to use multiple sequential Netfilter queues,
it can be done with a new '-q' option's syntax: "start:end"
(just like it's done with iptables '--queue-balance' option).
 8 years ago
Jason Ish 9bf6f7d5a9 rust/dns: add dns to dns alerts 8 years ago
Victor Julien e710b06669 detect: add file.name sticky buffer 8 years ago
Victor Julien ca8471387a detect: add http.response_body sticky buffer 
As a mirror of the http_server_body content modifier.
 8 years ago
Victor Julien 998f32f88c detect/tls: consolidate validity code 8 years ago
Victor Julien ccdafe6697 detect/http-server-body: move tests to tests/ 8 years ago
Victor Julien 2221dd9403 detect: add http.request_body sticky buffer 
Sticky buffer version of the http_client_body content modifier.
 8 years ago
Victor Julien 64987f36fb detect/file-data: move tests into tests/ 8 years ago
Victor Julien 2fa8066f3a detect/file-data: consolidate matching code 8 years ago
Victor Julien 9a8092249e detect/http-client-body: move tests into tests/ 8 years ago
Victor Julien 477e46da78 detect/http-client-body: convert to inspect api v2 8 years ago
Victor Julien ce677abdf0 detect/file-data: minor cleanups 8 years ago
Victor Julien c0767ece9b detect/file-data: minor cleanups and clarifications 8 years ago
Victor Julien 58aa9dca65 detect/http-server-body: code cleanup and test cleanups 8 years ago
Victor Julien 3413757027 detect/http-client-body: code cleanups and test cleanups 8 years ago
Victor Julien 645acb1089 detect: add http.header.raw sticky buffer keyword 
Add parsing tests as well.
 8 years ago
Victor Julien 76fd666cad detect/http_raw_header: move tests into tests/ 8 years ago
Victor Julien 25f974eb29 detect/http_raw_header: use inspect v2 api 8 years ago
Victor Julien c298412947 detect/http_raw_header: minor code cleanups 8 years ago
Victor Julien 85697671b8 detect: add http.header sticky buffer keyword 8 years ago
Victor Julien 31444cd088 detect/http_header: convert parsing tests to use helper 8 years ago
Victor Julien b9bcd4e115 detect/http_header: move tests into tests/ 8 years ago
Victor Julien 5e951a8b06 detect/http_header: inspect v2 api 8 years ago
Victor Julien 74b06b56f2 detect/http_header: test cleanups 8 years ago
Victor Julien 2a61ee13e1 detect/http_header: remove unused func args 8 years ago
Victor Julien dac182741b detect: add http.cookie sticky buffer keyword 8 years ago
Victor Julien ab027cb481 detect/http_cookie: move tests into tests/ 8 years ago
Victor Julien 988cc8468e detect/http_cookie: switch to inspect v2 api 8 years ago
Victor Julien 0aab3ac336 detect/http_cookie: minor cleanups 8 years ago
Victor Julien e222017a29 detect/http_user_agent: set alternative and info flags 8 years ago
Victor Julien b8a0a0d6ea detect: add http.stat_code sticky buffer keyword 8 years ago
Victor Julien 2f342da048 detect/http_stat_code: move tests into tests/ 8 years ago
Victor Julien 382fa2e81d detect/http_stat_code: use inspect v2 api 8 years ago
Victor Julien db7d7b2401 detect/http_stat_code: minor code cleanups 8 years ago
Victor Julien 59c3c748c9 detect: add http.stat_msg sticky buffer keyword 8 years ago
Victor Julien 5dfba01b2e detect/http_stat_msg: move tests to tests/ 8 years ago
Victor Julien 9b9cf2cc5f detect/http_stat_msg: switch to inspect v2 8 years ago
Victor Julien 880724d2ee detect/http_stat_msg: minor code cleanups 8 years ago
Victor Julien e9d43254c8 detect: add http.host.raw sticky buffer 8 years ago
Victor Julien b469938998 detect/http_raw_host: move raw into regular host logic 8 years ago
Victor Julien dc43f35427 detect/http_host: move tests into tests/ 8 years ago
Victor Julien 2c57037611 detect/http_raw_host: use inspect v2 api 8 years ago
Victor Julien 8c8a3473c9 detect/http_raw_host: minor cleanups 8 years ago
Victor Julien e9fcb9d5ef detect/http_method: add http.method sticky buffer 8 years ago
Victor Julien cb332b4cda detect/http_method: move all tests into tests/ 8 years ago
Victor Julien d00732175a detect/http_method: use inspect v2 api 8 years ago
Victor Julien 5fbee04306 detect/http_method: minor cleanups 8 years ago
Victor Julien 4e50df0f55 detect/http: add http.uri.raw sticky buffer keyword 8 years ago
Victor Julien 0a405e27a0 detect/http_raw_uri: code reorganization 
Move registration into http_uri logic, move tests into the other uri
tests. Switch to v2 mpm/inspect APIs.
 8 years ago
Victor Julien e29f13502b detect/http_raw_uri: small cleanups 8 years ago
Victor Julien 10e2731f18 detect/http-uri: move tests into tests/ 8 years ago
Victor Julien 0c879d5041 detect: add http.uri sticky buffer keyword 8 years ago
Victor Julien 789f302d1a detect: add http.host sticky buffer 8 years ago
Victor Julien a0e4c5e79b detect/http-hh: code cleanups 8 years ago
Victor Julien 3111910fc6 detect/http_user_agent: move tests into tests/ 8 years ago
Victor Julien 123ebb2c41 detect: add http.user_agent sticky buffer 8 years ago
Victor Julien fe738014e4 detect/http-ua: remove dead code 8 years ago
Victor Julien e62c75335e detect/http-ua: test cleanups 8 years ago
Victor Julien 33b81f7439 detect: add verbosity of --list-keywords 
Add indicators of content modifier or sticky buffer, and also
allow registering an alternative to a keyword.
 8 years ago
Victor Julien d3e953e5f2 detect: switch keyword flags u16 8 years ago
Victor Julien eb73008ccf detect/transform: add to_sha1 keyword 8 years ago
Victor Julien 75f9c1ae9f detect/transform: add to_md5 keyword 8 years ago
Victor Julien 42d22ddb2a unittests: add signature parse test helper 8 years ago
Victor Julien 705d3b6130 Open 5.0.0-dev branch 8 years ago
Victor Julien 7f38ffc8bc log/stats: fix formatting of long decoder events 8 years ago
Jingyu Yang bb26e6216e source-pcap:set PktAcqBreakLoop as pcap_breakloop 8 years ago
Victor Julien d8634daf74 stream: fix false negative on bad RST 
If a bad RST was received the stream inspection would not happen
for that packet, but it would still move the 'raw progress' tracker
forward. Following good packets would then fail to detect anything
before the 'raw progress' position.

Bug #2770

Reported-by: Alexey Vishnyakov
 8 years ago
Victor Julien fb18a1655c eve.stats: warn that output might miss decoder-events 8 years ago
Victor Julien 0d86263efd eve.stats: make decoder event prefix configurable 8 years ago
Victor Julien 932c2a7ec5 eve: fix missing decoder-events in stats 
In the eve log the decoder events are added as optional counters. This
behaviour is enabled by default. However, lots of the counters are
missing, as the names colide with other counters.

E.g.

decoder.ipv6 counts ipv6 packets
decoder.ipv6.unknown_next_header counts how often an unknown next
    header is encountered.

In this example 'ipv6' would be both a json integer and a json object.
It appears that jansson favours the first that is generated, so the
event counters are mostly missing.

This patch registers them as 'decoder.events.<event>' instead. As
these names are generated on the fly, a hash table to contain the
allocated strings was added as well.
 8 years ago
Victor Julien 0f1fc1f0c8 hash: move string hash funcs into util files 8 years ago
Victor Julien c140505bec decoder: add gre over ipv6 support 8 years ago
Victor Julien 8709a20d94 af-packet: minor code cleanups 8 years ago
Victor Julien c99dc5a7bf af-packet: re-enable sync for tpacket v2 
Synchronize start was disabled for v2 when v3 was introduced, without
a reason being given.

Re-enable as v2 will otherwise also start reading packets before the
other threads are set up. This will lead to hashing issues.

Part of bug #2788.
 8 years ago
Victor Julien cebbe06f70 af-packet: fix sync start for tpacket v3 
The tpacket-v3 implementation of the synchonize start logic would
not correctly consider the timestamp parameter, leading to threads
starting before synchronization between threads was complete.

Bug #2788
 8 years ago
Alexander Gozman 03af3e1ed8 nfqueue: inject fake packet on timeout 
Fixes nfqueue and delayed-detect.

On systems with small amount of traffic (or with no traffic at all)
nfqueue with 'delayed-detect' enabled hanged in 'workers' mode.

Bug #2362.
 8 years ago
Eric Leblond 0e3b1eba86 util-binsearch: remove the files 8 years ago
Travis Green 6f5eb487a1 doc: add missing and fix 404 for --list-keywords 8 years ago
Travis Green c2adb9e669 doc: added tos keyword 
Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2583
 8 years ago
Philippe Antoine 7fca771ef4 Fixes other affected tests for smtp pipelining 
Either checking state has pipelining
Or removing pipelining from input
 8 years ago
Philippe Antoine 447c1042f4 smtp: improve pipelining support 
Fixes #1863
 8 years ago
Victor Julien 8357ef3f8f proto/detect: workaround dns misdetected as dcerpc 
The DCERPC UDP detection would misfire on DNS with transaction
ID 0x0400. This would happen as the protocol detection engine
gives preference to pattern based detection over probing parsers for
performance reasons.

This hack/workaround fixes this specific case by still running the
probing parser if DCERPC has been detected on UDP. The probing
parser result will take precedence.

Bug #2736.
 8 years ago
Victor Julien 11f3659f64 teredo: be stricter on what to consider valid teredo 
Invalid Teredo can lead to valid DNS traffic (or other UDP traffic)
being misdetected as Teredo. This leads to false negatives in the
UDP payload inspection.

Make the teredo code only consider a packet teredo if the encapsulated
data was decoded without any 'invalid' events being set.

Bug #2736.
 8 years ago
Victor Julien e30212c5d8 detect: fix crash during startup with malformed yaml 
detect-engine:
  custom-values:
    toclient-groups: 200
    toserver-groups: 200

Bug #2745
 8 years ago
Victor Julien 4c8f6b2246 offloading: on bsd, disable rxcsum and v6 variants 8 years ago
Victor Julien fa6b73d1c9 offloading: don't set multiple times per interface 
This could happen with netmap igb0->igb0^ IPS mode.
 8 years ago
Victor Julien ad1945aae4 detect: fix content inspection flags 
Fix generic inspect function content inspection flags so that
streaming buffers work correctly.
 8 years ago
Victor Julien 394e115036 detect/rawbytes: improve error message plus do minor cleanups 8 years ago
Victor Julien f336ba3217 detect/file-data: fix enabling http body tracking 8 years ago