11156 Commits (dfd872c1a79171d4b5257920ba2f06b327a8d8aa)

 

All Branches   

Search

Author	SHA1	Message	Date
Shivani Bhardwaj	dfd872c1a7	enip: remove unnecessarry definition	5 years ago
Shivani Bhardwaj	0dac699197	src: remove multiple uses of atoi ... atoi() and related functions lack a mechanism for reporting errors for invalid values. Replace them with calls to the appropriate ByteExtractString* functions. Closes redmine ticket 3053.	5 years ago
Victor Julien	a98a209732	fuzz/sigpcap: make sure hassh is enabled	5 years ago
Vadym Malakhatko	a80f705d4b	userguide: add documentation for Hassh usage ... 1. Rules keywords 2. Json keywords 3. Usage in lua 4. Enabling in configuration file	5 years ago
Vadym Malakhatko	8a8212d0f6	lua: add functions to get hassh parameters	5 years ago
Vadym Malakhatko	126597144c	eve: add Hassh fields to SSH JSON logger and add ssh log condition	5 years ago
Vadym Malakhatko	216a75c522	detect: add (mpm) hassh keywords ... Match on Hassh using ssh.hassh, ssh.hassh.server, ssh.hassh.string, ssh.hassh.server.string keywords, e.g: alert ssh any any -> any any (msg:"match SSH hash"; ssh.hassh; content:"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; sid:1000010;) alert ssh any any -> any any (msg:"match SSH hash-server"; ssh.hassh.server; content:"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; sid:1000020;) alert ssh any any -> any any (msg:"match SSH hash-string"; ssh.hassh.string; content:"none,zlib@openssh.com,zlib"; sid:1000030;) alert ssh any any -> any any (msg:"match SSH hash-server-string"; ssh.hassh.server.string; content:"umac-64-etm@openssh.com,umac-128-etm@openssh.com,"; sid:1000040;)	5 years ago
Vadym Malakhatko	536cee3ba9	rust/ssh: add hassh generation ... Add generation of hassh fingerprints based on fields in the kexinit record	5 years ago
Jeff Lucovsky	f7a47a4477	detect/bsize: Use U16 bit macros ... This commit changes the flag bit values to be expressed using the BIT_U16 macro instead with hex values.	5 years ago
Jeff Lucovsky	39105917ce	detect/bsize: Use SCLogDebug instead of printf ... This commit updates debug "printf" message to use SCLogDebug	5 years ago
Jeff Lucovsky	620659b5f3	detect: Increase flag size for byte_jump	5 years ago
Jeff Lucovsky	23a65b5824	general: Fix typo in detect-bytejump.c	5 years ago
Jeff Lucovsky	0701d82890	detect/bytejump: Add "from_end" support ... This commit adds support for the byte jump "from_end" keyword and unittests.	5 years ago
Jeff Lucovsky	d5bb41011c	output/ikev2: Convert to JsonBuilder ... Convert the IKEV2 Json logging to use JsonBuilder.	5 years ago
Philippe Antoine	1e8ac7dadb	dnp3: adds unit test against previous bug	5 years ago
Philippe Antoine	d465bb8686	dnp3: fix buffer over read in responses parsing	5 years ago
Philippe Antoine	629a16e373	dnp3: probing parser fixes direction based on dnp3 header	5 years ago
Philippe Antoine	a90b1c1bcb	fuzz: disable DNP3 checksums while fuzzing	5 years ago
Philippe Antoine	00509da286	fuzz: improves fuzz target applayerparserparse ... Does not proceed final chunk if we got an error previously Flips the direction for last chunk as usual	5 years ago
Victor Julien	b440d0b13e	flow: use stream state to string util func	5 years ago
Victor Julien	1b0319ea98	stream: add state to string funcs	5 years ago
Victor Julien	6608b9a5f3	app-layer: set EOF flag in case of unsupported GAP ... If GAP is not supported set EOF flags in the parser.	5 years ago
Victor Julien	54d2f2c300	flow: improve 'under stress' behavior ... When under stress, the packet threads ultimately fall back to walking the hash table until they find a flow they can safely evict and reuse. This could lead to all threads fighting over the FlowBucket locks. Fix by adding a limit to the number of hash rows that are checked for a new flow. If the limit is reached, simply fail to get a flow.	5 years ago
Victor Julien	c50ef8cc21	flow: fix TCP closed default initialization ... TCP closed state was initialized to 0 by default. Clean up 'closed' value setting for other protocols and the common default.	5 years ago
Victor Julien	3bba671273	flow: remove unused function declaration	5 years ago
Victor Julien	cba8efff2a	flow: remove unused sctp enum member ... This caused some arrays to be larger than needed.	5 years ago
Victor Julien	c2561b2655	flow: cleanup validation check	5 years ago
Victor Julien	65e9a7c31c	smb: fix 'dangling' files in lossy sessions ... In case of lossy connections the SMB state would properly clean up transactions, including file transactions. However for files the state was never set to 'truncated', leading to files to stay 'active'. This would lead these files staying in the SMB's state. In long running sessions with lots of files this would lead to performance and memory use issues. This patch cleans truncates the file that was being transmitted when a file transaction is being closed.	5 years ago
Victor Julien	25f2efe977	smb: check post-gap timeouts once a second at most	5 years ago
Victor Julien	8aa380600d	smb: update ts only if it changed	5 years ago
Jeff Lucovsky	8c5c949cfa	output/tftp: Convert to JsonBuilder ... This commit converts the TFTP logging mechanisms to JsonBuilder.	5 years ago
Philippe Antoine	5ac8e41a13	signature: fix linked list for bidirectional signatures ... Bidirectional signatures are really two signatures with one id This needs to be handled with care when changing a linked list	5 years ago
Philippe Antoine	ac76ff9e47	detect: fail properly on invalid transform pcrexform	5 years ago
Antti Tönkyrä	57d0f4bb6f	detect/flowbits: fix stack overflow in analyzer ... Fix stack overflow in DetectFlowbitsAnalyze. Use dynamically allocated array instead of stack and free it after it is no longer needed.	5 years ago
Jason Ish	c09235e327	netflow/eve: convert to JsonBuilder	5 years ago
Jeff Lucovsky	b116a56a32	doc: Correct typos	5 years ago
Jeff Lucovsky	59cc3c6281	doc: Update byte_extract doc	5 years ago
Jeff Lucovsky	297f91479e	doc: Fix spelling error	5 years ago
Jeff Lucovsky	9c47b8c1bf	general: Fix spelling error	5 years ago
Jeff Lucovsky	64912104b3	detect/content: Validate content byte array ... This commit checks whether the content byte array is compatible with the transforms, if any, for the rule.	5 years ago
Jeff Lucovsky	197a593078	detect: Add transform validation api ... This commit extends the API with a function that validates arguments against the transforms for the SM list (if any).	5 years ago
Jeff Lucovsky	0189ff998f	detect/transform: Add validation function ... This commit adds a function to pre-validate buffers. If a content buffer contains whitespace, the validation fails.	5 years ago
Jeff Lucovsky	a4132d8e0f	detect/transform: Add transform "validate" function ... This commit adds an (optional) entry for a validation function. The validation function, if present, will be used during rule processing. Its role is to determine if the arguments are compatible with the transform. E.g., a content string of "this string has whitespace" is not compatible with the `strip_whitespace` transform.	5 years ago
Jason Ish	114b7e5cd9	dhcp/eve: remove erroneous jsonbuilder close ... The JsonBuilder was being closed to early.	5 years ago
Jason Ish	07e88a7479	jsonbuilder: add debug_validate to state ... If debug validation is enabled, panic on invalid state errors. For example, calling close on an already closed jsonbuilder object.	5 years ago
Jason Ish	ca6b70ea1b	rust: macro debug_validate_fail to fail with message ... Add a new debug_validate macro that unconditionally panics with a message. Useful in Rust pattern matching.	5 years ago
Jeff Lucovsky	4127c5fcc8	output/fileinfo: Optimize filename output ... This commit optimizes the JSON preparation of the file name by eliminating the temporary copy before adding to the Json builder buffer.	5 years ago
Jeff Lucovsky	0d298d47a1	output/rdp: Include common output options ... This commit will cause common metadata values and the community id to be included in log output when configured.	5 years ago
Jeff Lucovsky	ef3840e256	output/dhcp: Include common output options ... This commit will cause common metadata values and the community id to be included in log output when configured.	5 years ago
Jeff Lucovsky	c6c4936a20	output/smb: Include common output options ... This commit will cause common metadata values and the community id to be included in log output when configured.	5 years ago