aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
8,155 Commits
8 Branches
173 Tags
201 MiB
main
main-8.0.x
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'efe11dc37e'
${ noResults }
Commit Graph

7316 Commits (efe11dc37e7f5be575981eefa50cb2891b62bb67)

Author SHA1 Message Date
Jason Ish b588b49779 rust: lua support for DNS based Rust 
Uses Rust wrappers around Lua to populate Lua
data structures.
 9 years ago
Jason Ish 73388042b2 rust: DNS app-layer. 
A DNS application layer in Rust. This is different than the
C based one, as it is partially stateless by not matching
up responses to replies.
 9 years ago
Jason Ish 94032d3ada rust: wrapper around C logging, and "context" 
Where the context is a struct passed from C with pointers
to all the functions that may be called.

Instead of referencing C functions directly, wrap them
in function pointers so pure Rust unit tests can still run.
 9 years ago
Jason Ish f6f126d53d rust: example of how an app-layer may be initialized 
Also shows basic usage of the configuration API from Rust.
 9 years ago
Jason Ish de5bb1f953 rust: stub out logging from rust 9 years ago
Jason Ish 8f81792da5 rust: hook rust into the build 
Rust is currently optional, use the --enable-rust configure
argument to enable Rust.

By default Rust will be built in release mode. If debug is enabled
then it will be built in debug mode.

On make dist, "cargo vendor" will be run to make a local copy
of Rust dependencies for the distribution archive file.

Add autoconf checks to test for the vendored source, and if it
exists setup the build to use the vendored code instead of
fetching it from the network.

Also, as Cargo requires semantic versioning, the Suricata version
had to change from 4.0dev to 4.0.0-dev.
 9 years ago
Victor Julien b332551dbb stream: suppress GAP notice message 9 years ago
Victor Julien fae822d82e netmap: minor output cleanup 9 years ago
Victor Julien 1fef8569a5 stream: minor output cleanup 9 years ago
Victor Julien f702e6c33d flow-hash: optimize to avoid branch misses 
Profiling showed a lot of branch misses in flow hashing. Restructure
code to avoid branching.
 9 years ago
Jason Ish c8ac479f90 dns: accept gaps in TCP DNS 
On gap notification a flag is set, on the next call the input
data is reprobed to make sure it can be processed.
 9 years ago
Jason Ish c862bbdc4b app-layer: notify parsers of gaps if enabled 
A parser can now set a flag that will tell the application
layer that it is capable of handling gaps. If enabled, and a
gap occurs, the app-layer needs to be prepared to accept
input that is NULL with a length, where the length is the
number of bytes lost. It is up to the app-layer to
determine if it can sync up with the input data again.
 9 years ago
Victor Julien dfff228f75 stream/async: more liberal RST acceptance 9 years ago
Victor Julien 5ea1d3bd53 stream/async: improvements for IPS 
Initialize midstream with async if enabled. Unset async on seeing
bidirectional traffic.

If only async-oneside is enabled, set ASYNC flag on session creation
when receiving a SYN packet.

Let last_ack stay in sync with next_seq so that various checks work
better.
 9 years ago
Victor Julien b767f1d306 output/streaming: fixes and redo tcp logging 
Fix HTTP body logging.

Redo TCP data logging based on the streaming API.
 9 years ago
Victor Julien f4c4ef12c0 stream: introduce optional 'log' progress tracker 
For logging streaming TCP data so far the individual segments where
used. However since the last big stream changes, the segments are
no longer the proper place for this. Segments can now have overlaps
etc.

This patch introduces a new tracker. Next to the existing 'app' and
'raw' trackers, the new tracker is 'log'. When the TCP logging is
used, a flag in the config is set and the log tracker is used to
determine how much of the stream window can be moved.
 9 years ago
Victor Julien 5b1d8c7e94 streaming/lua: add direction indication to streamer 
Call SCStreamingBuffer as follows:

    data, sb_open, sb_close, sb_ts, sb_tc = SCStreamingBuffer()

sb_ts and sb_tc are bools indicating the direction of the data.
 9 years ago
Victor Julien 35edc5264d luajit: cleanup states before return to pool 9 years ago
Victor Julien 888ed9db0d streaming: small code cleanup 9 years ago
Victor Julien 30a8b2def0 lua/streaming: fix http body logging 9 years ago
Victor Julien 0f4a9d740e flow-worker: improve no-flow case 9 years ago
Jason Ish 922a27ed97 detect-dns-query: use unit test macros 9 years ago
Victor Julien a636d96b15 detect/file: cleanups 
TX id is enfored in the engine, so the keywords don't need to.

Unify detect file engines.
 9 years ago
Victor Julien 9492a43060 output-tx: small cleanups and scan-build suppression 9 years ago
Jason Ish bb10bd7fca profiling: fix const compiler warnings 9 years ago
Victor Julien 43b0bc8c8e unix socket: improve runmode handling 
Improve output of unix mode in --list-runmodes

Honor the runmode commandline setting. Supported are 'single'
and 'autofp', with the latter still the default.
 9 years ago
Victor Julien 75edfcc2cd unix-socket: fix minor memleak 9 years ago
Eric Leblond 1655a67654 log-tlsstore: fix error handling 
In case of realloc error, the length of the encoding buffer was not
reset and this could result in trying to write to NULL pointer.
 9 years ago
Victor Julien 41e6c6dc36 flow: enforce 51 bits id globally 9 years ago
Victor Julien 71c6df1655 lua: add SCFlowId for getting the flow id 9 years ago
Victor Julien 8127730f00 bug 2113: fix live modes 9 years ago
Jason Ish c7ddbbc586 dns: fix log filtering 
Previously only a subset of the records could be selected
in custom. Now allow any to be selected.
 9 years ago
Victor Julien 4217c6839a stream: single GAP check 
Move all GAP checks into CheckGap. Remove seg_list based check.
Also remove seg_list == NULL check to make sure the Gap check is
done on an empty list as well.

Improve next_seq < last_ack check, but add data beyond gap check.
 9 years ago
Victor Julien 39183f7a8e doc: fix doc links for http keywords 9 years ago
Victor Julien c513896786 bug 2113: unix-socket start up race 9 years ago
Victor Julien 5b56d324c4 app-layer: optimize many-tx case 9 years ago
Victor Julien 4459b88782 output: tx logging optimizations 9 years ago
Victor Julien 5c01b40931 tests: update tests for app-layer changes 9 years ago
Victor Julien 3148ff34b6 app-layer API optimizations and cleanups 9 years ago
Victor Julien cd97fa80f1 file: fix pruning for parallel files 
Allow pruning of random files, not just list head.
 9 years ago
Victor Julien afedd5c6df file: fix storing parallel files 
When looping available files 'flags' misuse would lead to all files
being closed after the first close.

This patch separates per file and per call flags.
 9 years ago
Victor Julien ae99e08396 file: update loops to account for parallel files 9 years ago
Victor Julien c4c93872f8 file: introduce per file 'track id' 
Some protocols transfer multiple files in parallel. To support this add
a 'track id' to the API. This track id is set by the protocol parser. It
will use this id to indicate what file in the FileContainer it wants to
act on.
 9 years ago
Victor Julien 1062a9213b file-store: small cleanup 9 years ago
Victor Julien 944ab48b20 file: clarify file store id name 9 years ago
Victor Julien f18c976a8e flow: counters for total number of flows 
flow.tcp
flow.udp
flow.icmpv4
flow.icmpv6
 9 years ago
Victor Julien 312ad9e3ad pfring: compiler warning fixes 9 years ago
Victor Julien f6e3755b5c lua: extend SCFlowAppLayerProto 
Change SCFlowAppLayerProto to return 5 values:
<alproto> <alproto_ts> <alproto_tc> <alproto_orig> <alproto_expect>:

alproto: detected protocol
alproto_ts: detected protocol in toserver direction
alproto_tc: detected protocol in toclient direction
alproto_orig: pre-change/upgrade protocol
alproto_expected: expected protocol in change/upgrade

Orig and expect are used when changing and upgrading protocols. In a
SMTP STARTTLS case, orig would normally be set to "smtp" and expect
to "tls".
 9 years ago
Victor Julien 9c071d1724 eve.flow: log original and expected app_protocols 
Log protocols if they are available.
 9 years ago
Victor Julien 88177694fd nfq: don't try to verdict detect/log flush pkts 9 years ago
Victor Julien d9908216d8 connect/starttls: handle detection corner cases 
When switching protocol from http to tls the following corner case
was observed:

 pkt 6, TC "200 connection established"
 pkt 7, TS acks pkt 6 + adds "client hello"
 pkt 8 TC, acks pkt 7
 pkt 8 is where normally the detect on the 200 connection established
       would run however before detection runs the app-layer is called
       and it resets the state

So the issue is missed detection on the last data in the original
protocol before the switch.

Another case was:

TS ->    STARTTLS
TC ->    Ack "STARTTLS data"
         220
TS ->    Ack "220 data"
         Client Hello

In IDS mode, this made a rule that wanted to look at content:"STARTTLS"
in combination with the protocol SMTP 'alert smtp ... content:"STARTTLS";'
impossible. By the time the content would match, the protocol was already
switched.

This patch fixes this case by creating a 'Detect/Log Flush' packet in
both directions. This will force final inspection and logging of the
pre-upgrade protocol (SMTP in this example) before doing the final
switch.
 9 years ago
Victor Julien 6f42ae91c7 app-layer: protocol change API 
Add API calls to upgrade to TLS or to request a protocol change
without a specific protocol expectation.

If the HTTP CONNECT session includes a port on the url, use that to
look up the probing parser during protocol detection. Solves a
missed detection of a SSLv2 session that upgrades to TLSv1. SSLv2
relies on the probing parser which is limited to certain ports.

In case of STARTTLS in SMTP and FTP, the port is hardcoded to 443.

A new event APPLAYER_UNEXPECTED_PROTOCOL is set if there was a
mismatch.
 9 years ago
Mats Klepsland 72c757433a app-layer: add decoder event for missing TLS after STARTTLS 9 years ago
Mats Klepsland 11b9e6fdab app-layer-ftp: add STARTTLS support 9 years ago
Mats Klepsland 8125f78f5f app-layer-ftp: detect FTP alproto when using AUTH TLS 
Try to detect FTP using the patterns '220 (' and 'FEAT', since 'USER '
and 'PASS ' are not sent in cleartext when using AUTH TLS.
 9 years ago
Mats Klepsland 74aa65073b output-json-tls: log 'from_proto' field 
Log the original application level protocol when protocol have been
changed because of STARTTLS, HTTP CONNECT or similar.
 9 years ago
Mats Klepsland e8800b1893 app-layer-smtp: add STARTTLS support 9 years ago
Mats Klepsland b6c2b7052b app-layer-htp: add HTTP CONNECT support 9 years ago
Victor Julien 893f868b42 proto-detect: add debug output 9 years ago
Mats Klepsland b8d13f354b app-layer: support changing flow alproto 
Support changing the application level protocol for a flow. This is
needed by STARTTLS and HTTP CONNECT to switch from the original
alproto to tls.

This commit allows a flag to be set 'FLOW_CHANGE_PROTO', which
triggers a new protocol detection on the next packet for a flow.
 9 years ago
Victor Julien 9b1f74409b magic: fix compile warnings 9 years ago
Victor Julien 3ff5dc3653 nfq: remove obsolete and broken netfilterforwin support 9 years ago
Victor Julien ea99099c64 isdataat: add test for leading space 9 years ago
Victor Julien 6142e88ed5 nflog: compiler warning fix 9 years ago
Victor Julien ab1200fbd7 compiler: more strict compiler warnings 
Set flags by default:

    -Wmissing-prototypes
    -Wmissing-declarations
    -Wstrict-prototypes
    -Wwrite-strings
    -Wcast-align
    -Wbad-function-cast
    -Wformat-security
    -Wno-format-nonliteral
    -Wmissing-format-attribute
    -funsigned-char

Fix minor compiler warnings for these new flags on gcc and clang.
 9 years ago
Victor Julien 342059835f detect-parse: improve common parser 
In preparation of turning input to keyword parsers to const add
options to the common rule parser to enforce and strip double
quotes and parse negation support.

At registration, the keyword can register 3 extra flags:

    SIGMATCH_QUOTES_MANDATORY: value to keyword must be quoted

    SIGMATCH_QUOTES_OPTIONAL: value to keyword may be quoted

    SIGMATCH_HANDLE_NEGATION: leading ! is parsed

In all cases leading spaces are removed. If the 'quote' flags are
set, the quotes are removed from the input as well.
 9 years ago
Victor Julien 842dfbc3f8 detect: enforce isdataat:!1,relative earlier 
The expression 'isdataat:!1,relative' is used to make sure a match
is at the end of a buffer quite often. This patch optimizes this case
for 'content' followed by the expression. It enforces it by setting
and 'ends with' flag on the content and then taking that flag into
account while doing the pattern match.
 9 years ago
Victor Julien c0275c2b29 detect: more content inspection tests 9 years ago
Victor Julien 7eda6beade detect: don't rescan when just distance is used 
Content inspection optimization: when just distance is used without
within we don't need to search recursively.

E.g. content:"a"; content:"b"; distance:1; will scan the buffer for
'a' and when it finds 'a' it will scan the remainder for 'b'. Until
now, the failure to find 'b' would lead to looking for the next 'a'
and then for 'b' after that. However, we already inspected the
entire buffer for 'b', so we know this will fail.
 9 years ago
Victor Julien 84b97ca155 detect: content-inspection tests 
Add tests for the content inspection engine that count the number
of steps it takes to eval a rule.
 9 years ago
Victor Julien b9579fbe7d detect: avoid needless recursive scanning 
Don't recursively inspect a detect list if the recursion
doesn't increase chance of success.
 9 years ago
Victor Julien bc7c01ecbc detect: use BIT_U32 macro for content flags 9 years ago
Victor Julien c65a119cc0 debug: suppress notice message 9 years ago
Victor Julien 276125c1ef cleanup: remove unused ringbuffer code 9 years ago
Victor Julien cda6e0291f cleanup: remove libpcap < 1 support 9 years ago
Victor Julien d31cb083e9 detect: update tests that mix state/stream inspect 9 years ago
Victor Julien eb5857b68a unittests: add/improve helpers for stream/flow 9 years ago
Victor Julien 15dcac92f2 http_header: enable trailer prefilter engines 
Now that the mpm engines run only for the proper 'progress'
value, the trailing headers need their own engine registration.
 9 years ago
Victor Julien cf7f819888 state: check progress before calling engine 
Make sure progress of an inspect engine is available.
 9 years ago
Victor Julien 1bbf555318 detect: improve stateful detection 
Now that MPM runs when the TX progress is right, stateful detection
operates differently.

Changes:

1. raw stream inspection is now also an inspect engine

   Since this engine doesn't take the transactions into account, it
   could potentially run multiple times on the same data. To avoid
   this, basic result caching is in place.

2. the engines are sorted by progress, but the 'MPM' engine is first
   even if the progress is higher

   If MPM flags a rule to be inspected, the inspect engine for that
   buffer runs first. If this step fails, the rule is no longer
   evaluated. No state is stored.
 9 years ago
Victor Julien d1b7a83905 detect: change mask logic 
Previously the MPM/Prefilter engines would suggest the same rule
candidates multiple times.

For example, while processing the request body, the http headers
would be inspected by MPM multiple times.

The mask check was one way to quickly decide which rules could be
skipped.

Now that the MPM engines normally return a rule just once, this
mask check no longer makes sense. If the rule meets the ip/port/
direction based conditions, it needs to be evaluated if the MPM
said so. Even if not all conditions are yet true.

WIP disable mask as it no longer makes sense

WIP redo mask match
 9 years ago
Victor Julien a0fad6bb7f mpm: run engines as few times as possible 
In various scenarios buffers would be checked my MPM more than
once. This was because the buffers would be inspected for a
certain progress value or higher.

For example, for each packet in a file upload, the engine would
not just rerun the 'http client body' MPM on the new data, it
would also rerun the method, uri, headers, cookie, etc MPMs.

This was obviously inefficent, so this patch changes the logic.

The patch only runs the MPM engines when the progress is exactly
the intended progress. If the progress is beyond the desired
value, it is run once. A tracker is added to the app layer API,
where the completed MPMs are tracked.

Implemented for HTTP, TLS and SSH.
 9 years ago
Victor Julien d304be5bc3 detect: register progress in inspect engines 
Register required progress so we can stop inspecting as soon
as the progress isn't far enough yet.
 9 years ago
Victor Julien bc1698cfbe detect-state: don't use casts to uint 9 years ago
Victor Julien 53b21e5ee1 http_uri: unittest cleanup 9 years ago
Victor Julien 8d2f3b46e6 http_header: add another trailer test 9 years ago
Victor Julien 8d18be1fdb http_header (trailer) test cleanup 9 years ago
Victor Julien 1c46af477e ssh: fix test 9 years ago
Victor Julien a744d00f45 ssh: fix banner state setting 9 years ago
Victor Julien e3bd5f371d detect: more detailed state profiling 9 years ago
Victor Julien 6d562f3b5e app-layer: set stream-depth after stream init 9 years ago
Victor Julien 358e41b935 detect: clean up stateful detect 9 years ago
Victor Julien 9f4884a132 stream: reduce scope of new ssn func 9 years ago
Victor Julien 5c31f22e09 autotools: add src/tests to extra dist 9 years ago
Victor Julien 5a210984d5 stream: move inline tests 9 years ago
Victor Julien bea2b2c00c stream: list management cleanups 9 years ago
Victor Julien 34f7cb2b55 stream: debug improvements 9 years ago
Victor Julien aba9cd7d02 stream inspection: add debug counters 9 years ago
Victor Julien 2b433fab53 stream: pack config struct 9 years ago
Victor Julien 606f515fe9 stream: enforce gap earlier in app reassembly 9 years ago