aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
main
main-8.0.x
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.7
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '8a5bc12156'
${ noResults }
suricata/src/Makefile.am

1447 lines
33 KiB
Makefile
Raw Normal View History Unescape Escape

Rename to Suricata.
17 years ago
bin_PROGRAMS = suricata
fuzz: adds eight fuzz targets And ways to compile them with enable-fuzztargets at configure time Adds utility function in util-unittest-helper
8 years ago
if BUILD_FUZZTARGETS
bin_PROGRAMS += fuzz_applayerprotodetectgetproto \
fuzz_applayerparserparse fuzz_siginit \
fuzz_confyamlloadstring fuzz_decodepcapfile \
fuzz: add target for DecodeBase64 Task 6050
3 years ago
fuzz_sigpcap fuzz_mimedecparseline fuzz_decodebase64
fuzz: adds structure aware target so as not to fuzz libpcap and generate structure aware signatures
6 years ago
if HAS_FUZZPCAP
fuzz: adds one target with predefined rules
5 years ago
bin_PROGRAMS += fuzz_sigpcap_aware fuzz_predefpcap_aware
fuzz: adds structure aware target so as not to fuzz libpcap and generate structure aware signatures
6 years ago
endif
fuzz: only build fuzz_sigpcap_aware if asked With the other fuzz targets, and do not build it if fuzzpcap is available but we did not want to build the fuzz targets
5 years ago
endif
config: use config file in sysconfdir by default.
15 years ago
build: separate private headers from installed headers Create a new list of headers for headers that should never be installed, such as private headers that should only be available within the Suricata project. For now, just the util-device-private.h belongs to this set.
2 years ago
# Headers that should never be installed.
PRIVATE_INCLUDES = \
util-device-private.h
# Headers that are installed with "make install-headers". They are
# declared as "noinst_HEADERS" to avoid them being installed by
# default.
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
noinst_HEADERS = \
action-globals.h \
alert-debuglog.h \
alert-fastlog.h \
alert-syslog.h \
app-layer-detect-proto.h \
app-layer-dnp3.h \
app-layer-dnp3-objects.h \
app-layer-events.h \
app-layer-expectation.h \
app/frames: initial support The idea of stream frames is that the applayer parsers can tag PDUs and other arbitrary frames in the stream while parsing. These frames can then be inspected from the rule language. This will allow rules that are more precise and less costly. The frames are stored per direction in the `AppLayerParserState` and will only be initialized when actual frames are in use. The per direction storage has a fixed size static portion and dynamic support for a larger number. This is done for effeciency. When the Stream Buffer slides, frames are updated as they use offsets relative to the stream. A negative offset is used for frames that started before the current window. Frames have events to inspect/log parser errors that don't fit the TX model. Frame id starts at 1. So implementations can keep track of frame ids where 0 is not set. Frames affect TCP window sliding. The frames keep a "left edge" which signifies how much data to keep for frames that are still in progress.
5 years ago
app-layer-frames.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
app-layer-ftp.h \
app-layer.h \
app-layer-htp-body.h \
app-layer-htp-file.h \
app-layer-htp.h \
app-layer-htp-mem.h \
http/range: reassemble files from different flows with range adds a container, ie a thread safe hash table whose key is the filename keep a tree of unordered ranges, up to a memcap limit adds HTPFileOpenWithRange to handle like HTPFileOpen if there is a range : open 2 files, one for the whole reassembled, and one only for the current range
6 years ago
app-layer-htp-range.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
app-layer-htp-xff.h \
app-layer-http2.h \
ikev1: rename ikev2 to common ike Renaming was done with shell commands, git mv for moving the files and content like find -iname '*.c' | xargs sed -i 's/ikev1/ike/g' respecting the different mixes of upper/lower case.
6 years ago
app-layer-ike.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
app-layer-modbus.h \
app-layer-nfs-tcp.h \
app-layer-nfs-udp.h \
app-layer-parser.h \
app-layer-protos.h \
app-layer-register.h \
app-layer-smb.h \
app-layer-smtp.h \
app-layer-ssh.h \
app-layer-ssl.h \
app-layer-tftp.h \
imap: extend detection patterns Ticket: #2886 Signed-off-by: mmaatuq <mahmoudmatook.mm@gmail.com>
3 years ago
app-layer-imap.h \
rust: integrate bindgen to generate Rust bindings to C Bindgen works by processing a header file which includes all other header files it should generate bindings for. For this I've created bindgen.h which just includes app-layer-protos.h for now as an example. These bindings are then generated and saved in the "suricata-sys" crate and become availale as "suricata_sys::sys". Ticket: #7341
2 years ago
bindgen.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
build-info.h \
conf.h \
conf-yaml-loader.h \
counters.h \
datasets.h \
datasets: introduce ipv4 type This patch introduce the IPv4 type for dataset so Suricata commandmatch on a set of IPv4 addresses. This is meant to complement iprep feature for people that needs more flexibility such as settings the IP on the packet path. Feature: #5383
5 years ago
datasets-ipv4.h \
datasets: introduce new IPv6 type This patch also simplifies IPv6 parsing. Feature: #5383
4 years ago
datasets-ipv6.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
datasets-md5.h \
datasets-reputation.h \
datasets-sha256.h \
datasets-string.h \
decode/arp: implement decoder This adds a decoder for ARP. Ticket #6827
3 years ago
decode-arp.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
decode-chdlc.h \
decode-erspan.h \
decode-esp.h \
decode-ethernet.h \
decode-events.h \
decode-geneve.h \
decode-gre.h \
decode.h \
decode-icmpv4.h \
decode-icmpv6.h \
decode-ipv4.h \
decode-ipv6.h \
decode-mpls.h \
decode-nsh.h \
decode-ppp.h \
decode-pppoe.h \
decode-raw.h \
decode-sctp.h \
decode-sll.h \
decode-tcp.h \
decode-template.h \
decode-teredo.h \
decode-udp.h \
decode-vlan.h \
decode/vntag: VNTAG 802.1Qbh decoder
6 years ago
decode-vntag.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
decode-vxlan.h \
defrag-config.h \
defrag.h \
defrag-hash.h \
defrag: turn queue into stack Only used by the spare tracker logic, which works better as a stack.
2 years ago
defrag-stack.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
defrag-timeout.h \
detect-app-layer-event.h \
detect-app-layer-protocol.h \
detect/app-layer-state: keyword for protocol state Allow matching on the app-layer protocol state.
2 years ago
detect-app-layer-state.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-asn1.h \
detect-base64-data.h \
detect-base64-decode.h \
detect-bsize.h \
detect-bypass.h \
detect-byte-extract.h \
detect-byte.h \
detect-bytejump.h \
detect-bytemath.h \
detect-bytetest.h \
detect-classtype.h \
detect-config.h \
detect-content.h \
detect-csum.h \
detect-datarep.h \
detect-dataset.h \
detect-dce-iface.h \
detect-dce-opnum.h \
detect-dce-stub-data.h \
detect-depth.h \
detect-detection-filter.h \
detect-distance.h \
detect-dnp3.h \
dns: add keywords for additionals and authorities rrnames Add keywords dns.additionals.rrname and dns.authorities.rrname. Along the way, consolidate dns.query.name and dns.answer.name into a single file and register them altogether since there is a lot of common code.
2 years ago
detect-dns-name.h \
dns: add dns.response sticky buffer Feature: 7012 Add dns.response sticky buffer to match on dns response fields. Add rust functions to return dns response packet data. Unit tests verifying signature matching.
2 years ago
detect-dns-response.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-dsize.h \
detect-engine-address.h \
detect-engine-address-ipv4.h \
detect-engine-address-ipv6.h \
detect-engine-alert.h \
detect-engine-analyzer.h \
src: new file detect-engine-buffer.h Taken from detect-engine.h so that we can bindgen this smaller unit.
2 years ago
detect-engine-buffer.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-engine-build.h \
detect-engine-content-inspection.h \
detect-engine-dcepayload.h \
detect-engine-event.h \
detect-engine-file.h \
detect/engine: support frames Implement the low level detect engine support for inspecting frames, including MPM, transforms and inspect API's.
5 years ago
detect-engine-frame.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-engine.h \
detect: helper to have pure rust keywords detect: make number of keywords dynamic Ticket: 4683
3 years ago
detect-engine-helper.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-engine-iponly.h \
detect-engine-loader.h \
detect-engine-mpm.h \
detect-engine-payload.h \
detect-engine-port.h \
detect-engine-prefilter-common.h \
detect-engine-prefilter.h \
detect-engine-profile.h \
detect-engine-proto.h \
detect-engine-register.h \
detect-engine-siggroup.h \
detect-engine-sigorder.h \
detect-engine-state.h \
detect-engine-tag.h \
detect-engine-threshold.h \
detect-engine-uint.h \
detect/entropy: Add entropy keyword This commit adds keyword/build support for the entropy keyword. The entropy keyword compares an entropy value with a value calculated according to the Shannon entropy on the available content. Issue: 4162
2 years ago
detect-entropy.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-fast-pattern.h \
detect-file-data.h \
detect-file-hash-common.h \
detect-filemagic.h \
detect-filemd5.h \
detect-filename.h \
detect-filesha1.h \
detect-filesha256.h \
detect-filesize.h \
detect-filestore.h \
detect-flowbits.h \
detect-flow.h \
detect: adds flow.age keyword Ticket: #5536
4 years ago
detect-flow-age.h \
detect: adds flow integer keywords Ticket: #6164 flow.pkts_toclient flow.pkts_toserver flow.bytes_toclient flow.bytes_toserver
3 years ago
detect-flow-pkts.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-flowint.h \
detect-flowvar.h \
detect-fragbits.h \
detect-fragoffset.h \
detect/frames: implement 'frame' keyword Implement a special sticky buffer to select frames for inspection. This keyword takes an argument to specify the per protocol frame type: alert <app proto name> ... frame:<specific frame name> Or it can specify both in the keyword: alert tcp ... frame:<app proto name>.<specific frame name> The latter is useful in some cases like http, where "http" applies to both HTTP and HTTP/2. alert http ... frame:http1.request; alert http1 ... frame:request; Examples: tls.pdu smb.smb2.hdr smb.smb3.data Consider a rule like: alert tcp ... flow:to_server; content:"|ff|SMB"; content:"some smb 1 issue"; this will scan all toserver TCP traffic, where it will only be limited by a port, depending on how rules are grouped. With this work we'll be able to do: alert smb ... flow:to_server; frame:smb1.data; content:"some smb 1 issue"; This rule will only inspect the data portion of SMB1 frames. It will not affect any other protocol, and it won't need special patterns to "search" for the SMB1 frame in the raw stream.
5 years ago
detect-frame.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-ftpbounce.h \
detect-ftpdata.h \
detect/ftp.command: Add sticky buffer Issue: 7502 Add a sticky buffer for "ftp.command" for matching on FTP command names.
2 years ago
detect-ftp-command.h \
detect/ftp: ftp.command_data keyword Issue: 7503 Add the rule keyword ftp.command_data; a sticky buffer that matches on the values send with FTP commands, e.g., USER someuser
2 years ago
detect-ftp-command-data.h \
detect/ftp: Add ftp.dynamic_port keyword Issue: 7504 Add implementation of the ftp.dynamic_port rule keyword. The implementation uses the U16 integer matching/parsing and thus supports the comparison operations such as <, >, <=, >=, !, !=, and range (-).
2 years ago
detect-ftp-dynamic-port.h \
detect/ftp: Add ftp.reply rule keyword Issue: 7508 Add the rule detection keyword "ftp.reply". This is a multi-buffer command.
2 years ago
detect-ftp-reply.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-geoip.h \
detect-gid.h \
detect.h \
detect-hostbits.h \
detect-http2.h \
detect-http-accept-enc.h \
detect-http-accept.h \
detect-http-accept-lang.h \
detect-http-client-body.h \
detect-http-connection.h \
detect-http-content-len.h \
detect-http-content-type.h \
detect-http-cookie.h \
detect-http-header-common.h \
detect-http-header.h \
detect-http-header-names.h \
detect-http-headers.h \
detect-http-headers-stub.h \
detect-http-host.h \
detect-http-location.h \
detect-http-method.h \
detect-http-protocol.h \
detect-http-raw-header.h \
detect-http-referer.h \
detect-http-request-line.h \
detect-http-response-line.h \
detect-http-server-body.h \
detect-http-server.h \
detect-http-start.h \
detect-http-stat-code.h \
detect-http-stat-msg.h \
detect-http-ua.h \
detect-http-uri.h \
detect-icmp-id.h \
detect-icmp-seq.h \
detect-icmpv4hdr.h \
detect-icmpv6hdr.h \
detect-icmpv6-mtu.h \
detect-icode.h \
detect-id.h \
ikev1: add ikev1 parser
6 years ago
detect-ike-exch-type.h \
detect-ike-spi.h \
detect-ike-vendor.h \
detect-ike-chosen-sa.h \
detect-ike-key-exchange-payload-length.h \
detect-ike-nonce-payload-length.h \
detect-ike-nonce-payload.h \
detect-ike-key-exchange-payload.h \
detect: add ip.src keyword It is a sticky buffer matching on src_ip. Feature: #5383
4 years ago
detect-ipaddr.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-ipopts.h \
detect-ipproto.h \
detect-iprep.h \
detect-ipv4hdr.h \
detect-ipv6hdr.h \
detect-isdataat.h \
detect-itype.h \
ja4: implement for TLS and QUIC Ticket: OISF#6379
3 years ago
detect-ja4-hash.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-krb5-cname.h \
detect-krb5-errcode.h \
detect-krb5-msgtype.h \
detect-krb5-sname.h \
krb: detection for ticket encryption As is done for logging. Ticket: #5442
4 years ago
detect-krb5-ticket-encryption.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-l3proto.h \
detect-lua-extensions.h \
detect-lua.h \
detect-mark.h \
detect-metadata.h \
detect-modbus.h \
detect/quic: add quic.sni sticky buffer
5 years ago
detect-quic-sni.h \
quic: add quic.ua for matching user agent
5 years ago
detect-quic-ua.h \
quic: Add QUIC App Layer Parses quic and logs a CYU hash for gquic frames
6 years ago
detect-quic-version.h \
detect-quic-cyu-hash.h \
detect-quic-cyu-string.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-msg.h \
detect-nfs-procedure.h \
detect-nfs-version.h \
detect-noalert.h \
detect-nocase.h \
detect-offset.h \
detect-parse.h \
detect-pcre.h \
detect-pkt-data.h \
detect-pktvar.h \
detect-prefilter.h \
detect-priority.h \
detect-rawbytes.h \
detect-reference.h \
detect-replace.h \
requires: add requires keyword Add a new rule keyword "requires" that allows a rule to require specific Suricata versions and/or Suricata features to be enabled. Example: requires: feature geoip, version >= 7.0.0, version < 8; requires: version >= 7.0.3 < 8 requires: version >= 7.0.3 < 8 | >= 8.0.3 Feature: #5972 Co-authored-by: Philippe Antoine <pantoine@oisf.net>
3 years ago
detect-requires.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-rev.h \
detect-rpc.h \
detect-sameip.h \
detect-sid.h \
detect-sip-method.h \
detect-sip-uri.h \
detect/smb: add smb.ntlmssp_user keyword Feature #5411.
5 years ago
detect-smb-ntlmssp.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-smb-share.h \
smb: add smb.version keyword Ticket: #5075 Signed-off-by: jason taylor <jtfas90@gmail.com>
5 years ago
detect-smb-version.h \
detect/smtp: smtp.helo keyword Ticket: 7515 It is a sticky buffer mapping to the smtp.helo log field
2 years ago
detect-smtp.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-ssh-hassh.h \
detect-ssh-hassh-server.h \
detect-ssh-hassh-server-string.h \
detect-ssh-hassh-string.h \
detect-ssh-proto.h \
detect-ssh-proto-version.h \
detect-ssh-software.h \
detect-ssh-software-version.h \
detect-ssl-state.h \
detect-ssl-version.h \
detect-stream_size.h \
detect-tag.h \
detect-target.h \
detect-tcp-ack.h \
detect-tcp-flags.h \
detect-tcphdr.h \
detect-tcpmss.h \
detect-tcp-seq.h \
detect-tcp-window.h \
detect-template2.h \
detect-template.h \
detect-threshold.h \
detect: add tls.alpn keyword Ticket: #7108.
2 years ago
detect-tls-alpn.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-tls-cert-fingerprint.h \
detect-tls-cert-issuer.h \
detect-tls-cert-serial.h \
detect-tls-certs.h \
detect-tls-cert-subject.h \
detect-tls-cert-validity.h \
detect/tls-subjectaltname: add sticky buffer Add TLS SubjectAltName sticky buffer. It is implemented as multi-buffer. Feature 5234
3 years ago
detect-tls-subjectaltname.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-tls.h \
detect-tls-ja3-hash.h \
detect-tls-ja3s-hash.h \
detect-tls-ja3s-string.h \
detect-tls-ja3-string.h \
detect-tls-sni.h \
detect-tls-version.h \
tls: add tls.random* keywords Add tls.random keyword that matches on the 32 bytes of the TLS random field for client as well as server. Add tls.random_time keyword that matches on the first 4 bytes of the TLS random field for client as well as server. Add tls.random_bytes keyword that matches on the last 28 bytes of the TLS random field for client as well as server. All these are sticky buffers. Feature 5190
4 years ago
detect-tls-random.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-tos.h \
detect/transform: Add from_base64 transform Issue: 6487 Implement the from_base64 transform: [bytes value] [offset value] [mode strict|rfc4648|rfc2045] The value for bytes and offset may be a byte_ variable or an unsigned integer.
3 years ago
detect-transform-base64.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-transform-pcrexform.h \
detect-ttl.h \
detect-udphdr.h \
detect-uricontent.h \
detect-urilen.h \
detect-within.h \
detect-xbits.h \
detect: add vlan.id keyword vlan.id matches on Virtual Local Area Network IDs It is an unsigned 16-bit integer Valid range = [0-4095] Supports prefiltering Ticket: #1065
2 years ago
detect-vlan.h \
detect: add email.from email.from matches on MIME EMAIL FROM This keyword maps to the EVE field email.from It is a sticky buffer Supports prefiltering Ticket: #7592
2 years ago
detect-email.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
device-storage.h \
feature.h \
flow-bit.h \
flow-bypass.h \
flow: add callbacks for flow init and flow updates Adds user registerable callbacks for flow initialization, flow update and flow finish. Some plugins, such as other DPI libraries like nDPI need a way to hook into these flow lifecycle events. Ticket: #7319 Ticket: #7320
2 years ago
flow-callbacks.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
flow.h \
flow-hash.h \
flow-manager.h \
flow-private.h \
flow-queue.h \
flow-spare-pool.h \
flow-storage.h \
flow-timeout.h \
flow-util.h \
flow-var.h \
flow-worker.h \
host-bit.h \
host.h \
host-queue.h \
host-storage.h \
host-timeout.h \
ippair-bit.h \
ippair.h \
ippair-queue.h \
ippair-storage.h \
ippair-timeout.h \
log-cf-common.h \
main/flush: Support periodic flush logs Issue: 3449
3 years ago
log-flush.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
log-httplog.h \
log-pcap.h \
log-stats.h \
log-tcp-data.h \
log-tlslog.h \
log-tlsstore.h \
eve/filetypes: remove from plugin context Remove EVE filetypes from plugin context as they are not only used from plugins. Plugins allow user code to register filetypes, but we also have internal file types that use this api including the null output and syslog. Additionally library users can use this API to register filetypes, and they are not plugins. Ideally this code would go in "output-json.[ch]" as the "primary" eve API, however there are currently some include circular include issues there, so start new cleaned up EVE API in "output-eve.[ch]" which is "clean" with respect to includes, and as we cleanup existing EVE API for "public" use, it can be moved here. Ticket: #6838
3 years ago
output-eve.h \
eve/stream: per packet stream engine logging Debug facility to get a per packet view into the stream engine's state. Logs after a packet has been processed in the stream engine, so the view into the state includes the updates based on the current packet. Marked as experimental so it can be changed w/o notice. Bug: #5876.
4 years ago
output-eve-stream.h \
output/null: Add the null output device This commit adds the null output device; to use, set the filetype to "nullsink" for each output that should discard and never persist logs/alerts/etc. This is implemented as an "internal eve output plugin" just like the syslog eve output type.
3 years ago
output-eve-null.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
output-filedata.h \
output-file.h \
output-filestore.h \
output-flow.h \
output.h \
output-json-alert.h \
output-json-anomaly.h \
output-json/arp: implement logger This adds a logger for ARP, disabled by default. Ticket #6827
3 years ago
output-json-arp.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
output-json-dcerpc.h \
output-json-dhcp.h \
output-json-dnp3.h \
output-json-dnp3-objects.h \
output-json-dns.h \
output-json-drop.h \
output-json-email-common.h \
output-json-file.h \
output-json-flow.h \
eve: implement frame logging This is mostly to assist development and QA. It produces too much data for practical use.
5 years ago
output-json-frame.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
output-json-ftp.h \
output-json.h \
output-json-http.h \
ikev1: rename ikev2 to common ike Renaming was done with shell commands, git mv for moving the files and content like find -iname '*.c' | xargs sed -i 's/ikev1/ike/g' respecting the different mixes of upper/lower case.
6 years ago
output-json-ike.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
output-json-metadata.h \
output-json-mqtt.h \
output-json-netflow.h \
output-json-nfs.h \
pgsql: add initial support - add nom parsers for decoding most messages from StartupPhase and SimpleQuery subprotocols - add unittests - tests/fuzz: add pgsql to confyaml Feature: #4241
6 years ago
output-json-pgsql.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
output-json-smb.h \
output-json-smtp.h \
output-json-stats.h \
output-json-tls.h \
output/syslog: Convert syslog eve output to plugin This commit converts the "built-in" syslog eve output handler into an internal plugin.
6 years ago
output-eve-syslog.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
output-lua.h \
output-packet.h \
output: public header for use in rust Ticket: 5053 Move enum OutputJsonLogDirection and struct EveJsonTxLoggerRegistrationData to a public header user by rust thanks to bindgen Rename to use SC prefix on the way And make EveJsonSimpleTxLogFunc use a const pointer to transaction
2 years ago
output-eve-bindgen.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
output-stats.h \
output-streaming.h \
output-tx.h \
src: includes cleanup Work towards making `suricata-common.h` only introduce system headers and other things that are independent of complex internal Suricata data structures. Update files to compile after this. Remove special DPDK handling for strlcpy and strlcat, as this caused many compilation failures w/o including DPDK headers for all files. Remove packet macros from decode.h and move them into their own file, turn them into functions and rename them to match our function naming policy.
4 years ago
packet.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
packet-queue.h \
pkt-var.h \
queue.h \
reputation.h \
respond-reject.h \
respond-reject-libnet11.h \
runmode-af-packet.h \
af-xdp: Add AF_XDP socket support AF_XDP support is a recent technology introduced that aims at improving capture performance. With this update, Suricata now provides a new capture source 'af-xdp' that attaches an eBPF program to the network interface card. Packets received in the NIC queue are forwarded to a RX ring in user-space, bypassing the Linux network stack. Note, there is a configuration option (force-xdp-mode) that forces the packet through the normal Linux network stack. libxdp and libbpf is required for this feature and is compile time configured. This capture source operates on single and multi-queue NIC's via suricata.yaml. Here, various features can be enabled, disabled or edited as required by the use case. This feature currently only supports receiving packets via AF_XDP, no TX support has been developed. Ticket: https://redmine.openinfosecfoundation.org/issues/3306 Additional reading: https://www.kernel.org/doc/html/latest/networking/af_xdp.html
4 years ago
runmode-af-xdp.h \
dpdk: initial support with workers runmode Register a new runmode - DPDK. This enables a new flag on Suricata start (--dpdk). With the flag given, DPDK runmode is enabled. Runmode loads the configuration and then initializes EAL. If successful, it configures the physical NICs according to the configuration file. After that, worker threads are initialized and then are in continuous receive loop.
5 years ago
runmode-dpdk.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
runmode-erf-dag.h \
runmode-erf-file.h \
runmode-ipfw.h \
libsuricata: add library runmode Add library source and runmode modules. Reorganized library example to create a worker thread and replay a pcap file using the library mode. No API layer is added at this stage. Edits by Jason Ish: - fix guard - add copyright/license headers Ticket: #7240
3 years ago
runmode-lib.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
runmode-netmap.h \
runmode-nflog.h \
runmode-nfq.h \
runmode-pcap-file.h \
runmode-pcap.h \
runmodes.h \
runmode-unittests.h \
runmode-unix-socket.h \
runmode-windivert.h \
rust-context.h \
rust.h \
source-af-packet.h \
af-xdp: Add AF_XDP socket support AF_XDP support is a recent technology introduced that aims at improving capture performance. With this update, Suricata now provides a new capture source 'af-xdp' that attaches an eBPF program to the network interface card. Packets received in the NIC queue are forwarded to a RX ring in user-space, bypassing the Linux network stack. Note, there is a configuration option (force-xdp-mode) that forces the packet through the normal Linux network stack. libxdp and libbpf is required for this feature and is compile time configured. This capture source operates on single and multi-queue NIC's via suricata.yaml. Here, various features can be enabled, disabled or edited as required by the use case. This feature currently only supports receiving packets via AF_XDP, no TX support has been developed. Ticket: https://redmine.openinfosecfoundation.org/issues/3306 Additional reading: https://www.kernel.org/doc/html/latest/networking/af_xdp.html
4 years ago
source-af-xdp.h \
dpdk: initial support with workers runmode Register a new runmode - DPDK. This enables a new flag on Suricata start (--dpdk). With the flag given, DPDK runmode is enabled. Runmode loads the configuration and then initializes EAL. If successful, it configures the physical NICs according to the configuration file. After that, worker threads are initialized and then are in continuous receive loop.
5 years ago
source-dpdk.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
source-erf-dag.h \
source-erf-file.h \
source-ipfw.h \
libsuricata: add library runmode Add library source and runmode modules. Reorganized library example to create a worker thread and replay a pcap file using the library mode. No API layer is added at this stage. Edits by Jason Ish: - fix guard - add copyright/license headers Ticket: #7240
3 years ago
source-lib.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
source-netmap.h \
source-nflog.h \
source-nfq.h \
source-nfq-prototypes.h \
source-pcap-file-directory-helper.h \
source-pcap-file.h \
source-pcap-file-helper.h \
source-pcap.h \
source-windivert.h \
source-windivert-prototypes.h \
stream.h \
stream-tcp.h \
stream: reduce pool locking overhead Add thread local cache to avoid locking overhead for ssns and segments. A thread will return segments/ssns to a local cache first, and if that is full, to a return queue where the actual return to the pool returns a batch, to amortize locking overhead. Adds segment and session pool/cache counters to see where how effective the cache is.
4 years ago
stream-tcp-cache.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
stream-tcp-inline.h \
stream-tcp-list.h \
stream-tcp-private.h \
stream-tcp-reassemble.h \
stream-tcp-sack.h \
stream-tcp-util.h \
suricata-common.h \
suricata.h \
suricata-plugin.h \
threads: add initialization callbacks For library users and plugins that need to hook into the thread life cycle, perhaps to initialize some thread storage.
2 years ago
thread-callbacks.h \
threads: add storage api, based on flow storage
2 years ago
thread-storage.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
threads-debug.h \
threads.h \
threads-profile.h \
threadvars.h \
tm-modules.h \
tmqh-flow.h \
tmqh-packetpool.h \
tmqh-simple.h \
tm-queuehandlers.h \
tm-queues.h \
tm-threads-common.h \
tm-threads.h \
tree.h \
detect/xbits: implement tx bits Implement `xbits:set,mybit,track tx;` and `xbits:isset,mybit,track tx;`. Store these in the AppLayerTxData. Ticket: #6455.
2 years ago
tx-bit.h \
interval-tree: add augmentation fns to the tree An interval tree uses red-black tree as its base data structure and follows all the properties of a usual red-black tree. The additional params are: 1. An interval such as [low, high] per node. 2. A max attribute per node. This attribute stores the maximum high value of any subtree rooted at this node. At any point in time, an inorder traversal of an interval tree should give the port ranges sorted by the low key in ascending order. This commit modifies the IRB_AUGMENT macro and it's call sites to make sure that on every insertion, the max attribute of the tree is properly updated. Ticket 6792 Bug 6414
3 years ago
interval-tree.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
unix-manager.h \
util-action.h \
util-affinity.h \
util-atomic.h \
util-bpf.h \
util-buffer.h \
util-byte.h \
util-checksum.h \
util-cidr.h \
util-classification-config.h \
util-clock.h \
util-conf.h \
util-config.h \
util-coredump-config.h \
util-cpu.h \
util-daemon.h \
suricata: introduce global linktype As Suricata is not supporting pcap-ng we have to stick with one single datalink type for the capture if ever we want to do pcap logging. Assuming this, this patch introduces a function to set the link type globally. This will be used with pcap conditional logging to get the logging of TCP segments with the correct link type.
6 years ago
util-datalink.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-debug-filters.h \
util-debug.h \
util-detect.h \
util-device.h \
dpdk: initial support with workers runmode Register a new runmode - DPDK. This enables a new flag on Suricata start (--dpdk). With the flag given, DPDK runmode is enabled. Runmode loads the configuration and then initializes EAL. If successful, it configures the physical NICs according to the configuration file. After that, worker threads are initialized and then are in continuous receive loop.
5 years ago
util-dpdk.h \
dpdk: replace global with per-thread mempools It turned out that having global (interface-specific) mempool that is shared by the threads of the interface is slower than having individual mempools per queue for each interface. The commit brings this change and should be user-invisible, the config setting remains still as a number of objects of all mempools summed (of that interface). Ticket: 7382
3 years ago
util-dpdk-bonding.h \
util-dpdk-common.h \
dpdk/i40e: support RSS on Intel i40e PMD driver Due to peculiar behavior of i40e PMD driver, the RSS is required to be set via rte_flow rules or a hash filter as compared to other NICs where RSS is configured through port configuration structure. RTE_FLOW rules are created on 5-tuples (as opposed to 3-tuple configured on the other NICs). Fragmented traffic have been tested with this setup and it has been proven that fragmented packets of the same flow are received on the same queue. At the same time, setting 3-tuple on rte_flow rules have not yield in the expected results. Notes from the experiments: - Configuration of 5-tuple (as is in the commit): fragmented and nonfragmented packets are received by the same workers even when I applied seed to alter them via tcpreplay-edit (option --seed) - Setting only ETH_RSS_FRAG_IPV4 and ETH_RSS_IPV4 (i.e. setting 3-tuple): when setting ETH_RSS_IPV4, the PMD driver says that pctype is not supported (generally this means that the "type" of traffic is not a valid configuration for the i40e) - Setting only ETH_RSS_FRAG_IPV4 and ETH_RSS_NONFRAG_IPV4_OTHER: this doesn't work well, packets of the same flow are received on the different workers (my explanation is that the fragmented packets are matched with ETH_RSS_FRAG_IPV4 but the other UDP packets are not matched with ETH_RSS_NONFRAG_IPV4_OTHER rte_flow rule (they would be matched with ETH_RSS_NONFRAG_IPV4_UDP).
5 years ago
util-dpdk-i40e.h \
dpdk/ice: setup RSS for Intel ICE PMD Set RSS hash function according to Intel ICE PMD available hash functions Set hash functions according to the support by the ICE PMD, so that no warning regarding RSS setting is issued.
5 years ago
util-dpdk-ice.h \
dpdk/ixgbe: setup RSS for Intel IXGBE PMD Set RSS hash function according to Intel IXGBE PMD available hash functions. During configuration, a warning appeared stating that RSS hash function has been changed from one value to the other. This has meant that the supported hash functions did not cover all required hash functions by the configuration. This commit solves the warning.
5 years ago
util-dpdk-ixgbe.h \
dpdk/rss: add rte_flow rss support for mlx5 The configuration of this rule is the same as for ixgbe driver except the hash function is not RTE_ETH_HASH_FUNCTION_DEFAULT but RTE_ETH_HASH_FUNCTION_TOEPLITZ. The syntax in dpdk-testpmd for this rule with attributes: port index == 0 used rx queue indices == 0 1 2 3 <hash_key> == 6d5a symmetric hash key is as follows: "flow create 0 ingress pattern eth / end actions rss types ipv4 ipv6 end queues 0 1 2 3 end key <hash_key> key_len 40 func toeplitz / end" Ticket: 7337
2 years ago
util-dpdk-mlx5.h \
dpdk/rss: move and change rss rte_flow functions Move and adjust the base of RSS configuration from util-dpdk-i40e.c to a new file that can be later utilized by other cards. RSS configuration can be configured via rte_flow rules. This is useful for possible future features such as specific header offload (vxlan, nvgre) also implemented via rte_flow rules, as rte_flow rules can be chained via groups and priorities. i40e uses multiple different rte_flow rules to setup RSS. At first, function DeviceSetRSSFlowQueues() is used to setup rx queues. This rule matches all types of traffic, so the equivalent to dpdk-testpmd pattern would be "pattern end" This rule can not contain hash types (ipv4, ipv6 etc.) nor hash key. The hash function used here is RTE_ETH_HASH_FUNCTION_DEFAULT. The syntax in dpdk-testpmd for this rule with attributes: port index == 0 used rx queue indices == 0 1 2 3 is as follows: "flow create 0 ingress pattern end actions rss queues 0 1 2 3 end func default / end" The other rules configured by i40eDeviceSetRSSFlowIPv4() and i40eDeviceSetRSSFlowIPv6() match specific type of traffic by l4 protocol (none, TCP, UDP, SCTP). For example, pattern to match l3 ipv4 with l4 tcp traffic in dpdk-testpmd syntax would be equivalent of "pattern eth / ipv4 / tcp / end". These rules can not have rx queues configured, but have hash types (l3 src and dst address). This means that the traffic distribution is affected only by l3 addresses, independent of the l4 specifics. Also these pattern matching rules have symmetric 6d5a hash key configured. The length of the key is dependent on DPDK version. The hash function (either RTE_ETH_HASH_FUNCTION_SYMMETRIC_TOEPLITZ or RTE_ETH_HASH_FUNCTION_TOEPLITZ, depending on DPKD version) used in these rules hashes symmetricaly due to the symmetric hash key. The syntax in dpdk-testpmd for rule to match ipv4-tcp traffic with attributes: port index == 0 <hash_key> == 52 bytes long 6d5a symmetric hash key is as follows: "flow create 0 ingress pattern eth / ipv4 / tcp / end actions rss types ipv4-tcp l3-src-only l3-dst-only end queues end key <hash_key> key_len 52 func toeplitz / end" (queues need to be set to NULL) Ticket: 7337
2 years ago
util-dpdk-rss.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-ebpf.h \
util-enum.h \
util-error.h \
exceptions: initial exception-policy implementation Adds a framework for setting exception policies. These would be called when the engine reaches some kind of exception condition, like hitting a memcap or some traffic processing error. The policy gives control over what should happen next: drop the packet, drop the packet and flow, bypass, etc. Implements the policy for: stream: If stream session or reassembly memcaps are hit call the memcap policy on the packet and flow. flow: Apply policy when memcap is reached and no flow could be freed up. defrag: Apply policy when no tracker could be picked up. app-layer: Apply ppolicy if a parser reaches an error state. All options default to 'ignore', which means the default behavior is unchanged. Adds commandline options: add simulation options for exceptions. These are only exposed if compiled with `--enable-debug`. Ticket: #5214. Ticket: #5215. Ticket: #5216. Ticket: #5218. Ticket: #5194.
5 years ago
util-exception-policy.h \
exceptions: make types and ToStr fns more accessible Decode file needed ExceptionPolicy types and exception-policy file needed Decode types, rendering some works quite difficult to work around. ExceptionPolicyToStr is useful for registering exception policy counters, so make that public. Part of Task #5816
3 years ago
util-exception-policy-types.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-file-decompression.h \
util-file.h \
util-file-swf-decompression.h \
util-fix_checksum.h \
util-fmemopen.h \
util-hash.h \
util-hashlist.h \
util-hash-lookup3.h \
util-hash-string.h \
util-host-info.h \
util-host-os-info.h \
dpdk: rework hugepage hints to use per-numa information Previous integration of hugepage analysis only fetched data from /proc/meminfo. However this proved to be often deceiving mainly for providing only global information and not taking into account different hugepage sizes (e.g. 1GB hugepages) and different NUMA nodes. Ticket: #6419
3 years ago
util-hugepages.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-hyperscan.h \
util-ioctl.h \
util-ip.h \
util-ja3.h \
ja4: implement for TLS and QUIC Ticket: OISF#6379
3 years ago
util-ja4.h \
landlock: basic implementation This patch is adding support for Landlock, a Linux Security Module available since Linux 5.13. The concept is to prevent any file operation on directories where Suricata is not supposed to access. Landlock support is built by default if the header is present. The feature is disabled by default and need to be activated in the YAML to be active. Landlock documentation: https://docs.kernel.org/userspace-api/landlock.html Feature: #5479
4 years ago
util-landlock.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-logopenfile.h \
util-log-redis.h \
lua: add base64 lib Export our base64 decoding and encoding functions to Lua. Ticket: #7074
2 years ago
util-lua-base64lib.h \
lua: add "builtins" file to consolidate registration Use a single array of built-ins and provide 2 functions for registering them: - SCLuaLoadBuiltIn: for loading built-in modules in sandboxed environments. - SCLuaRequirefBuiltIns: registers built-in modules with the standard package tool, allows built-ins to be loaded by output scripts that are not restricted I hope to refactor the sandbox so they can use SCLuaRequirefBuiltIns as well.
2 years ago
util-lua-builtins.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-lua-common.h \
lua/datasets: factor out into its own file This is mainly for header sanitization to avoid pulling in detect modules into the Lua sandbox definition. Plus if we namespace modules with names like "suricata.dataset", it probably makes sense to keep those modules in their own files.
2 years ago
util-lua-dataset.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-lua-dnp3.h \
util-lua-dnp3-objects.h \
util-lua-dns.h \
lua: convert lua flowint functions to lib: suricata.flowintlib Ticket: #7487
2 years ago
util-lua-flowintlib.h \
lua: add initial suricata.flow lib Methods: `get` creates the flow object. `id` returns the flow id. `has_alerts` returns a boolean indicating if the flow triggered alerts. `app_layer_proto` returns various app-layer related fields as 5 strings: alproto, alproto_ts, alproto_tc, alproto_orig, alproto_expect. `stats` returns cnts for bytes and packets to sever and to client, as 4 numbers. `tuple` -- returns various fields: srcip, dstip, proto, sp, dp. `timestamps` returns time as 4 numbers: seconds and microseconds, for first and last packet of the flow. `timestring_legacy` returns the first packet from the flow's timestring as a string (like fastlog). `timestring_iso8601` returns the first packet from the flow's timestring as an iso8601 compat timestring (like eve). Example: ``` name = "lua-scflowstats.log" local flow = require("suricata.flow") function init(args) local needs = {} needs["type"] = "flow" return needs end function setup(args) filename = SCLogPath() .. "/" .. name file = assert(io.open(filename, "a")) SCLogInfo("lua SCFlowStats Log Filename " .. filename) end function log(args) local f = flow.get() timestring = f:timestring_legacy() tscnt, tsbytes, tccnt, tcbytes = f:stats() file:write ("[**] " .. timestring .. "\nSCFlowStats is\nPacket count to server: " .. tscnt .. "\nByte count to server: " .. tsbytes .. "\nPacket count to client: " .. tccnt .. "\nByte count to client: " .. tcbytes .. "\n[**]") file:flush() end function deinit(args) file:close(file) end ``` Task #7489
2 years ago
util-lua-flowlib.h \
lua: convert flowvar functions to lib New Lua lib, "suricata.flowvar" for working with flowvars from Lua. Replaces functions: - SCFlowvarGet (and ScFlowvarGet) - SCFlowvarSet (and SCFlowvarSet) Of note, the DetectLuaData has been made available to the init and thread_init methods, instead of just the match. This is due to an issue that if a flow variable is not registered in init, it will not be logged, registering in thread_init is too late. Ticket: #7486
2 years ago
util-lua-flowvarlib.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-lua.h \
lua: expose hashing functions to lua scripts Expose md5, sha1, and sha256 to Lua scripts with `require("suricata.hashing")`. Ticket: 7073
2 years ago
util-lua-hashlib.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-lua-http.h \
util-lua-ja3.h \
lua: add initial suricata.packet lib Example: ``` local packet = require "suricata.packet" function init (args) local needs = {} return needs end function match (args) p = packet.get() payload = p:payload() ts = p:timestring() for line in payload:gmatch("([^\r\n]*)[\r\n]+") do if line == "GET /index.html HTTP/1.0" then ipver, srcip, dstip, proto, sp, dp = p:tuple() SCLogNotice(string.format("%s %s->%s %d->%d (pcap_cnt:%d) match! %s", ts, srcip, dstip, sp, dp, p:pcap_cnt(), line)); return 1 end end return 0 end ``` Methods: `get` creates the packet object. `payload` returns the packet payload as a buffer `packet` returns the whole packet (includes headers) `pcap_cnt` returns the `pcap_cnt` (pcap file mode only) `tuple` returns various fields: srcip, dstip, proto, sp, dp `sp` returns source port `dp` returns destination port `timestamp` returns time as 2 numbers: seconds and microseconds `timestring_legacy` returns a timestamp as a string (like fastlog) `timestring_iso8601` returns a iso8601 compat timestring (like eve) Ticket: #7488.
2 years ago
util-lua-packetlib.h \
lua: add suricata.rule library Add a "suricata.rule" library for accessing rule information from a Lua rule, or a Lua output script. This lib replaces the following global Lua functions: - SCRuleIds - SCRuleAction - SCRuleMsg - SCRuleClass Ticket: #7490
2 years ago
util-lua-rule.h \
lua: Add lua sandbox for detection rules
3 years ago
util-lua-sandbox.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-lua-smtp.h \
util-lua-ssh.h \
util-lua-tls.h \
util: add initial flow rate tracking implementation In order to track flow rate and thus determine a course of action or categorize it as elephant flow, track a flow's byte count per direction in a ring buffer for a given time interval. The implementation is simple and keeps overwriting the buffer and updating the final sum. The sum of all the elements in the ring buffer at any point in time should reflect the number of bytes for the respective flow in the last of a given configured interval. e.g. if the definition says that the flows must be tracked by a rate of 100k bytes in 10 seconds, the ring buffer at any point in time should carry the total number of bytes seen by the respective flow in the last 10 seconds. So far, the implementation only supports reading the flow rate definition from suricata.yaml and using it to track the flows. This solution adds up a space complexity to the existing Flow struct. However, the added space complexity should only take effect if the feature is in use. Since this buffer extends the Flow struct, it does not impact the usual business logic or complexity of the code. This implementation is currently limited to defining the time interval of flow rate in seconds only. However, the number of seconds defined are directly proportional to the aforementioned added space complexity as that's the size of the ring buffer. Feature 5647
2 years ago
util-flow-rate.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-macset.h \
util-magic.h \
util-memcmp.h \
util-memcpy.h \
util-mem.h \
util-memrchr.h \
util-misc.h \
util-mpm-ac.h \
util-mpm-ac-ks.h \
util-mpm.h \
util-mpm-hs.h \
hyperscan: add caching mechanism for hyperscan contexts Cache Hyperscan serialized databases to disk to prevent compilation of the same databases when Suricata is run again with the same ruleset. Hyperscan binary files are stored per rulegroup in the designated folder, by default in the cached library folder. Since caching is per signature group heads, some chunk of the ruleset can change and it still can reuse part of the unchanged signature groups. Loading *fresh* ET Open ruleset: 19 seconds Loading *cached* ET Open ruleset: 07 seconds Ticket: 7170
2 years ago
util-mpm-hs-cache.h \
util-mpm-hs: refactor Hyperscan Pattern DB initialization to smaller functions
2 years ago
util-mpm-hs-core.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-optimize.h \
util-pages.h \
util-path.h \
util-pidfile.h \
util-plugin.h \
util-pool.h \
util-pool-thread.h \
util-prefilter.h \
util-print.h \
util-privs.h \
util-profiling.h \
util-profiling-locks.h \
util-proto-name.h \
radix: implement more compact trees Implement a more compact set of trees specifically for IPv4 and IPv6 addresses. This allows for more compact data structures and fewer memory allocations. Based on the existing radix tree implementation.
5 years ago
util-radix-tree-common.h \
util-radix4-tree.h \
util-radix6-tree.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-random.h \
util-reference-config.h \
util-rohash.h \
util-rule-vars.h \
util-runmodes.h \
util-running-modes.h \
util-signal.h \
util-spm-bm.h \
util-spm-bs2bm.h \
util-spm-bs.h \
util-spm.h \
util-spm-hs.h \
util-storage.h \
util-streaming-buffer.h \
util-syslog.h \
af-xdp: Add AF_XDP socket support AF_XDP support is a recent technology introduced that aims at improving capture performance. With this update, Suricata now provides a new capture source 'af-xdp' that attaches an eBPF program to the network interface card. Packets received in the NIC queue are forwarded to a RX ring in user-space, bypassing the Linux network stack. Note, there is a configuration option (force-xdp-mode) that forces the packet through the normal Linux network stack. libxdp and libbpf is required for this feature and is compile time configured. This capture source operates on single and multi-queue NIC's via suricata.yaml. Here, various features can be enabled, disabled or edited as required by the use case. This feature currently only supports receiving packets via AF_XDP, no TX support has been developed. Ticket: https://redmine.openinfosecfoundation.org/issues/3306 Additional reading: https://www.kernel.org/doc/html/latest/networking/af_xdp.html
4 years ago
util-sysfs.h \
systemd: reimplement sd_notify logic using UNIX socket One of the lessons of the XZ backdoor story was that just linking to libsystemd to call sd_notify is discouraged by the systemd project: Lennart Poettering: "PSA: In context of the xzpocalypse we now added an example reimplementation of sd_notify() to our man page: https://www.freedesktop.org/software/systemd/man/devel/sd_notify.html#Notes It's pretty comprehensive (i.e. uses it for reload notification too), but still relatively short. In the past, I have been telling anyone who wanted to listen that if all you want is sd_notify() then don't bother linking to libsystemd, since the protocol is stable and should be considered the API, not our C wrapper around it. After all, the protocol is so trivial" From: https://mastodon.social/@pid_eins/112202687764571433 This commit takes the example code and uses it to reimplement the notify logic. The code is enabled if Linux is detected in configure. Since the code won't do anything if the NOTIFY_SOCKET env var isn't set, this should also work fine on systems w/o systemd. Ticket: #6913.
3 years ago
util-systemd.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-thash.h \
util-threshold-config.h \
util-time.h \
util-unittest.h \
util-unittest-helper.h \
util-validate.h \
util-var.h \
util-var-name.h \
util/interval-tree: add utility fns Add new utility files to deal with the interval trees. These cover the basic ops: 1. Creation/Destruction of the tree 2. Creation/Destruction of the nodes It also adds the support for finding overlaps for a given set of ports. This function is used by the detection engine is the Stage 2 of signature preparation. Ticket 6792 Bug 6414 Co-authored-by: Victor Julien <vjulien@oisf.net>
3 years ago
util-port-interval-tree.h \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
win32-misc.h \
win32-service.h \
win32-syscall.h \
win32-syslog.h
Initial add of the files.
19 years ago
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
libsuricata_c_a_SOURCES = \
alert-debuglog.c \
alert-fastlog.c \
alert-syslog.c \
app-layer.c \
app-layer-detect-proto.c \
app-layer-dnp3.c \
app-layer-dnp3-objects.c \
app-layer-events.c \
app-layer-expectation.c \
app-layer-ftp.c \
app/frames: initial support The idea of stream frames is that the applayer parsers can tag PDUs and other arbitrary frames in the stream while parsing. These frames can then be inspected from the rule language. This will allow rules that are more precise and less costly. The frames are stored per direction in the `AppLayerParserState` and will only be initialized when actual frames are in use. The per direction storage has a fixed size static portion and dynamic support for a larger number. This is done for effeciency. When the Stream Buffer slides, frames are updated as they use offsets relative to the stream. A negative offset is used for frames that started before the current window. Frames have events to inspect/log parser errors that don't fit the TX model. Frame id starts at 1. So implementations can keep track of frame ids where 0 is not set. Frames affect TCP window sliding. The frames keep a "left edge" which signifies how much data to keep for frames that are still in progress.
5 years ago
app-layer-frames.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
app-layer-htp-body.c \
app-layer-htp.c \
app-layer-htp-file.c \
app-layer-htp-mem.c \
http/range: reassemble files from different flows with range adds a container, ie a thread safe hash table whose key is the filename keep a tree of unordered ranges, up to a memcap limit adds HTPFileOpenWithRange to handle like HTPFileOpen if there is a range : open 2 files, one for the whole reassembled, and one only for the current range
6 years ago
app-layer-htp-range.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
app-layer-htp-xff.c \
app-layer-http2.c \
ikev1: rename ikev2 to common ike Renaming was done with shell commands, git mv for moving the files and content like find -iname '*.c' | xargs sed -i 's/ikev1/ike/g' respecting the different mixes of upper/lower case.
6 years ago
app-layer-ike.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
app-layer-modbus.c \
app-layer-nfs-tcp.c \
app-layer-nfs-udp.c \
app-layer-parser.c \
app-layer-protos.c \
app-layer-register.c \
app-layer-smb.c \
app-layer-smtp.c \
app-layer-ssh.c \
app-layer-ssl.c \
app-layer-tftp.c \
imap: extend detection patterns Ticket: #2886 Signed-off-by: mmaatuq <mahmoudmatook.mm@gmail.com>
3 years ago
app-layer-imap.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
conf.c \
conf-yaml-loader.c \
counters.c \
datasets.c \
datasets: introduce ipv4 type This patch introduce the IPv4 type for dataset so Suricata commandmatch on a set of IPv4 addresses. This is meant to complement iprep feature for people that needs more flexibility such as settings the IP on the packet path. Feature: #5383
5 years ago
datasets-ipv4.c \
datasets: introduce new IPv6 type This patch also simplifies IPv6 parsing. Feature: #5383
4 years ago
datasets-ipv6.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
datasets-md5.c \
datasets-sha256.c \
datasets-string.c \
decode.c \
decode/arp: implement decoder This adds a decoder for ARP. Ticket #6827
3 years ago
decode-arp.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
decode-chdlc.c \
decode-erspan.c \
decode-esp.c \
decode-ethernet.c \
decode-events.c \
decode-geneve.c \
decode-gre.c \
decode-icmpv4.c \
decode-icmpv6.c \
decode-ipv4.c \
decode-ipv6.c \
decode-mpls.c \
decode-nsh.c \
decode-null.c \
decode-ppp.c \
decode-pppoe.c \
decode-raw.c \
decode-sctp.c \
decode-sll.c \
decode-tcp.c \
decode-template.c \
decode-teredo.c \
decode-udp.c \
decode-vlan.c \
decode/vntag: VNTAG 802.1Qbh decoder
6 years ago
decode-vntag.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
decode-vxlan.c \
defrag.c \
defrag-config.c \
defrag-hash.c \
defrag: turn queue into stack Only used by the spare tracker logic, which works better as a stack.
2 years ago
defrag-stack.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
defrag-timeout.c \
detect-app-layer-event.c \
detect-app-layer-protocol.c \
detect/app-layer-state: keyword for protocol state Allow matching on the app-layer protocol state.
2 years ago
detect-app-layer-state.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-asn1.c \
detect-base64-data.c \
detect-base64-decode.c \
detect-bsize.c \
detect-bypass.c \
detect-byte.c \
detect-byte-extract.c \
detect-bytejump.c \
detect-bytemath.c \
detect-bytetest.c \
detect.c \
detect-classtype.c \
detect-config.c \
detect-content.c \
detect-csum.c \
detect-datarep.c \
detect-dataset.c \
detect-dce-iface.c \
detect-dce-opnum.c \
detect-dce-stub-data.c \
detect-depth.c \
detect-detection-filter.c \
detect-distance.c \
detect-dnp3.c \
dns: add keywords for additionals and authorities rrnames Add keywords dns.additionals.rrname and dns.authorities.rrname. Along the way, consolidate dns.query.name and dns.answer.name into a single file and register them altogether since there is a lot of common code.
2 years ago
detect-dns-name.c \
dns: add dns.response sticky buffer Feature: 7012 Add dns.response sticky buffer to match on dns response fields. Add rust functions to return dns response packet data. Unit tests verifying signature matching.
2 years ago
detect-dns-response.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-dsize.c \
detect-engine-address.c \
detect-engine-address-ipv4.c \
detect-engine-address-ipv6.c \
detect-engine-alert.c \
detect-engine-analyzer.c \
detect-engine-build.c \
src: new file detect-engine-buffer.h Taken from detect-engine.h so that we can bindgen this smaller unit.
2 years ago
detect-engine-buffer.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-engine.c \
detect-engine-content-inspection.c \
detect-engine-dcepayload.c \
detect-engine-event.c \
detect-engine-file.c \
detect/engine: support frames Implement the low level detect engine support for inspecting frames, including MPM, transforms and inspect API's.
5 years ago
detect-engine-frame.c \
detect: helper to have pure rust keywords detect: make number of keywords dynamic Ticket: 4683
3 years ago
detect-engine-helper.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-engine-iponly.c \
detect-engine-loader.c \
detect-engine-mpm.c \
detect-engine-payload.c \
detect-engine-port.c \
detect-engine-prefilter.c \
detect-engine-prefilter-common.c \
detect-engine-profile.c \
detect-engine-proto.c \
detect-engine-register.c \
detect-engine-siggroup.c \
detect-engine-sigorder.c \
detect-engine-state.c \
detect-engine-tag.c \
detect-engine-threshold.c \
detect-engine-uint.c \
detect/entropy: Add entropy keyword This commit adds keyword/build support for the entropy keyword. The entropy keyword compares an entropy value with a value calculated according to the Shannon entropy on the available content. Issue: 4162
2 years ago
detect-entropy.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-fast-pattern.c \
detect-file-data.c \
detect-file-hash-common.c \
detect-filemagic.c \
detect-filemd5.c \
detect-filename.c \
detect-filesha1.c \
detect-filesha256.c \
detect-filesize.c \
detect-filestore.c \
detect-flowbits.c \
detect-flow.c \
detect: adds flow.age keyword Ticket: #5536
4 years ago
detect-flow-age.c \
detect: adds flow integer keywords Ticket: #6164 flow.pkts_toclient flow.pkts_toserver flow.bytes_toclient flow.bytes_toserver
3 years ago
detect-flow-pkts.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-flowint.c \
detect-flowvar.c \
detect-fragbits.c \
detect-fragoffset.c \
detect/frames: implement 'frame' keyword Implement a special sticky buffer to select frames for inspection. This keyword takes an argument to specify the per protocol frame type: alert <app proto name> ... frame:<specific frame name> Or it can specify both in the keyword: alert tcp ... frame:<app proto name>.<specific frame name> The latter is useful in some cases like http, where "http" applies to both HTTP and HTTP/2. alert http ... frame:http1.request; alert http1 ... frame:request; Examples: tls.pdu smb.smb2.hdr smb.smb3.data Consider a rule like: alert tcp ... flow:to_server; content:"|ff|SMB"; content:"some smb 1 issue"; this will scan all toserver TCP traffic, where it will only be limited by a port, depending on how rules are grouped. With this work we'll be able to do: alert smb ... flow:to_server; frame:smb1.data; content:"some smb 1 issue"; This rule will only inspect the data portion of SMB1 frames. It will not affect any other protocol, and it won't need special patterns to "search" for the SMB1 frame in the raw stream.
5 years ago
detect-frame.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-ftpbounce.c \
detect-ftpdata.c \
detect/ftp.command: Add sticky buffer Issue: 7502 Add a sticky buffer for "ftp.command" for matching on FTP command names.
2 years ago
detect-ftp-command.c \
detect/ftp: ftp.command_data keyword Issue: 7503 Add the rule keyword ftp.command_data; a sticky buffer that matches on the values send with FTP commands, e.g., USER someuser
2 years ago
detect-ftp-command-data.c \
detect/ftp: Add ftp.dynamic_port keyword Issue: 7504 Add implementation of the ftp.dynamic_port rule keyword. The implementation uses the U16 integer matching/parsing and thus supports the comparison operations such as <, >, <=, >=, !, !=, and range (-).
2 years ago
detect-ftp-dynamic-port.c \
detect/ftp: Add ftp.reply rule keyword Issue: 7508 Add the rule detection keyword "ftp.reply". This is a multi-buffer command.
2 years ago
detect-ftp-reply.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-geoip.c \
detect-gid.c \
detect-hostbits.c \
detect-http2.c \
detect-http-accept.c \
detect-http-accept-enc.c \
detect-http-accept-lang.c \
detect-http-client-body.c \
detect-http-connection.c \
detect-http-content-len.c \
detect-http-content-type.c \
detect-http-cookie.c \
detect-http-header.c \
detect-http-header-common.c \
detect-http-header-names.c \
detect-http-headers.c \
detect-http-host.c \
detect-http-location.c \
detect-http-method.c \
detect-http-protocol.c \
detect-http-raw-header.c \
detect-http-referer.c \
detect-http-request-line.c \
detect-http-response-line.c \
detect-http-server-body.c \
detect-http-server.c \
detect-http-start.c \
detect-http-stat-code.c \
detect-http-stat-msg.c \
detect-http-ua.c \
detect-http-uri.c \
detect-icmp-id.c \
detect-icmp-seq.c \
detect-icmpv4hdr.c \
detect-icmpv6hdr.c \
detect-icmpv6-mtu.c \
detect-icode.c \
detect-id.c \
ikev1: add ikev1 parser
6 years ago
detect-ike-exch-type.c \
detect-ike-spi.c \
detect-ike-vendor.c \
detect-ike-chosen-sa.c \
detect-ike-key-exchange-payload-length.c \
detect-ike-nonce-payload-length.c \
detect-ike-nonce-payload.c \
detect-ike-key-exchange-payload.c \
detect: add ip.src keyword It is a sticky buffer matching on src_ip. Feature: #5383
4 years ago
detect-ipaddr.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-ipopts.c \
detect-ipproto.c \
detect-iprep.c \
detect-ipv4hdr.c \
detect-ipv6hdr.c \
detect-isdataat.c \
detect-itype.c \
ja4: implement for TLS and QUIC Ticket: OISF#6379
3 years ago
detect-ja4-hash.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-krb5-cname.c \
detect-krb5-errcode.c \
detect-krb5-msgtype.c \
detect-krb5-sname.c \
krb: detection for ticket encryption As is done for logging. Ticket: #5442
4 years ago
detect-krb5-ticket-encryption.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-l3proto.c \
detect-lua.c \
detect-lua-extensions.c \
detect-mark.c \
detect-metadata.c \
detect-modbus.c \
detect/quic: add quic.sni sticky buffer
5 years ago
detect-quic-sni.c \
quic: add quic.ua for matching user agent
5 years ago
detect-quic-ua.c \
quic: Add QUIC App Layer Parses quic and logs a CYU hash for gquic frames
6 years ago
detect-quic-version.c \
detect-quic-cyu-hash.c \
detect-quic-cyu-string.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-msg.c \
detect-nfs-procedure.c \
detect-nfs-version.c \
detect-noalert.c \
detect-nocase.c \
detect-offset.c \
detect-parse.c \
detect-pcre.c \
detect-pkt-data.c \
detect-pktvar.c \
detect-prefilter.c \
detect-priority.c \
detect-rawbytes.c \
detect-reference.c \
detect-replace.c \
requires: add requires keyword Add a new rule keyword "requires" that allows a rule to require specific Suricata versions and/or Suricata features to be enabled. Example: requires: feature geoip, version >= 7.0.0, version < 8; requires: version >= 7.0.3 < 8 requires: version >= 7.0.3 < 8 | >= 8.0.3 Feature: #5972 Co-authored-by: Philippe Antoine <pantoine@oisf.net>
3 years ago
detect-requires.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-rev.c \
detect-rpc.c \
detect-sameip.c \
detect-sid.c \
detect-sip-method.c \
detect-sip-uri.c \
detect/smb: add smb.ntlmssp_user keyword Feature #5411.
5 years ago
detect-smb-ntlmssp.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-smb-share.c \
smb: add smb.version keyword Ticket: #5075 Signed-off-by: jason taylor <jtfas90@gmail.com>
5 years ago
detect-smb-version.c \
detect/smtp: smtp.helo keyword Ticket: 7515 It is a sticky buffer mapping to the smtp.helo log field
2 years ago
detect-smtp.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-ssh-hassh.c \
detect-ssh-hassh-server.c \
detect-ssh-hassh-server-string.c \
detect-ssh-hassh-string.c \
detect-ssh-proto.c \
detect-ssh-proto-version.c \
detect-ssh-software.c \
detect-ssh-software-version.c \
detect-ssl-state.c \
detect-ssl-version.c \
detect-stream_size.c \
detect-tag.c \
detect-target.c \
detect-tcp-ack.c \
detect-tcp-flags.c \
detect-tcphdr.c \
detect-tcpmss.c \
detect-tcp-seq.c \
detect-tcp-window.c \
detect-template2.c \
detect-template.c \
detect-threshold.c \
detect-tls.c \
detect: add tls.alpn keyword Ticket: #7108.
2 years ago
detect-tls-alpn.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-tls-cert-fingerprint.c \
detect-tls-cert-issuer.c \
detect-tls-certs.c \
detect-tls-cert-serial.c \
detect-tls-cert-subject.c \
detect-tls-cert-validity.c \
detect/tls-subjectaltname: add sticky buffer Add TLS SubjectAltName sticky buffer. It is implemented as multi-buffer. Feature 5234
3 years ago
detect-tls-subjectaltname.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-tls-ja3-hash.c \
detect-tls-ja3s-hash.c \
detect-tls-ja3s-string.c \
detect-tls-ja3-string.c \
detect-tls-sni.c \
detect-tls-version.c \
tls: add tls.random* keywords Add tls.random keyword that matches on the 32 bytes of the TLS random field for client as well as server. Add tls.random_time keyword that matches on the first 4 bytes of the TLS random field for client as well as server. Add tls.random_bytes keyword that matches on the last 28 bytes of the TLS random field for client as well as server. All these are sticky buffers. Feature 5190
4 years ago
detect-tls-random.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-tos.c \
detect/transform: Add from_base64 transform Issue: 6487 Implement the from_base64 transform: [bytes value] [offset value] [mode strict|rfc4648|rfc2045] The value for bytes and offset may be a byte_ variable or an unsigned integer.
3 years ago
detect-transform-base64.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
detect-transform-pcrexform.c \
detect-ttl.c \
detect-udphdr.c \
detect-uricontent.c \
detect-urilen.c \
detect-within.c \
detect-xbits.c \
detect: add vlan.id keyword vlan.id matches on Virtual Local Area Network IDs It is an unsigned 16-bit integer Valid range = [0-4095] Supports prefiltering Ticket: #1065
2 years ago
detect-vlan.c \
detect: add email.from email.from matches on MIME EMAIL FROM This keyword maps to the EVE field email.from It is a sticky buffer Supports prefiltering Ticket: #7592
2 years ago
detect-email.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
device-storage.c \
feature.c \
flow-bit.c \
flow-bypass.c \
flow: add callbacks for flow init and flow updates Adds user registerable callbacks for flow initialization, flow update and flow finish. Some plugins, such as other DPI libraries like nDPI need a way to hook into these flow lifecycle events. Ticket: #7319 Ticket: #7320
2 years ago
flow-callbacks.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
flow.c \
flow-hash.c \
flow-manager.c \
flow-queue.c \
flow-spare-pool.c \
flow-storage.c \
flow-timeout.c \
flow-util.c \
flow-var.c \
flow-worker.c \
host-bit.c \
host.c \
host-queue.c \
host-storage.c \
host-timeout.c \
ippair-bit.c \
ippair.c \
ippair-queue.c \
ippair-storage.c \
ippair-timeout.c \
log-cf-common.c \
main/flush: Support periodic flush logs Issue: 3449
3 years ago
log-flush.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
log-httplog.c \
log-pcap.c \
log-stats.c \
log-tcp-data.c \
log-tlslog.c \
log-tlsstore.c \
output.c \
eve/stream: per packet stream engine logging Debug facility to get a per packet view into the stream engine's state. Logs after a packet has been processed in the stream engine, so the view into the state includes the updates based on the current packet. Marked as experimental so it can be changed w/o notice. Bug: #5876.
4 years ago
output-eve-stream.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
output-file.c \
output-filedata.c \
output-filestore.c \
output-flow.c \
output-json-alert.c \
output-json-anomaly.c \
output-json/arp: implement logger This adds a logger for ARP, disabled by default. Ticket #6827
3 years ago
output-json-arp.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
output-json.c \
output-json-common.c \
output-json-dcerpc.c \
output-json-dhcp.c \
output-json-dnp3.c \
output-json-dnp3-objects.c \
output-json-dns.c \
output-json-drop.c \
output-json-email-common.c \
output-json-file.c \
output-json-flow.c \
eve: implement frame logging This is mostly to assist development and QA. It produces too much data for practical use.
5 years ago
output-json-frame.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
output-json-ftp.c \
output-json-http.c \
ikev1: rename ikev2 to common ike Renaming was done with shell commands, git mv for moving the files and content like find -iname '*.c' | xargs sed -i 's/ikev1/ike/g' respecting the different mixes of upper/lower case.
6 years ago
output-json-ike.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
output-json-metadata.c \
output-json-mqtt.c \
output-json-netflow.c \
output-json-nfs.c \
pgsql: add initial support - add nom parsers for decoding most messages from StartupPhase and SimpleQuery subprotocols - add unittests - tests/fuzz: add pgsql to confyaml Feature: #4241
6 years ago
output-json-pgsql.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
output-json-smb.c \
output-json-smtp.c \
output-json-stats.c \
output-json-tls.c \
eve/filetypes: remove from plugin context Remove EVE filetypes from plugin context as they are not only used from plugins. Plugins allow user code to register filetypes, but we also have internal file types that use this api including the null output and syslog. Additionally library users can use this API to register filetypes, and they are not plugins. Ideally this code would go in "output-json.[ch]" as the "primary" eve API, however there are currently some include circular include issues there, so start new cleaned up EVE API in "output-eve.[ch]" which is "clean" with respect to includes, and as we cleanup existing EVE API for "public" use, it can be moved here. Ticket: #6838
3 years ago
output-eve.c \
output/syslog: Convert syslog eve output to plugin This commit converts the "built-in" syslog eve output handler into an internal plugin.
6 years ago
output-eve-syslog.c \
output/null: Add the null output device This commit adds the null output device; to use, set the filetype to "nullsink" for each output that should discard and never persist logs/alerts/etc. This is implemented as an "internal eve output plugin" just like the syslog eve output type.
3 years ago
output-eve-null.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
output-lua.c \
output-packet.c \
output-stats.c \
output-streaming.c \
output-tx.c \
src: includes cleanup Work towards making `suricata-common.h` only introduce system headers and other things that are independent of complex internal Suricata data structures. Update files to compile after this. Remove special DPDK handling for strlcpy and strlcat, as this caused many compilation failures w/o including DPDK headers for all files. Remove packet macros from decode.h and move them into their own file, turn them into functions and rename them to match our function naming policy.
4 years ago
packet.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
packet-queue.c \
pkt-var.c \
reputation.c \
respond-reject.c \
respond-reject-libnet11.c \
runmode-af-packet.c \
af-xdp: Add AF_XDP socket support AF_XDP support is a recent technology introduced that aims at improving capture performance. With this update, Suricata now provides a new capture source 'af-xdp' that attaches an eBPF program to the network interface card. Packets received in the NIC queue are forwarded to a RX ring in user-space, bypassing the Linux network stack. Note, there is a configuration option (force-xdp-mode) that forces the packet through the normal Linux network stack. libxdp and libbpf is required for this feature and is compile time configured. This capture source operates on single and multi-queue NIC's via suricata.yaml. Here, various features can be enabled, disabled or edited as required by the use case. This feature currently only supports receiving packets via AF_XDP, no TX support has been developed. Ticket: https://redmine.openinfosecfoundation.org/issues/3306 Additional reading: https://www.kernel.org/doc/html/latest/networking/af_xdp.html
4 years ago
runmode-af-xdp.c \
dpdk: initial support with workers runmode Register a new runmode - DPDK. This enables a new flag on Suricata start (--dpdk). With the flag given, DPDK runmode is enabled. Runmode loads the configuration and then initializes EAL. If successful, it configures the physical NICs according to the configuration file. After that, worker threads are initialized and then are in continuous receive loop.
5 years ago
runmode-dpdk.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
runmode-erf-dag.c \
runmode-erf-file.c \
runmode-ipfw.c \
libsuricata: add library runmode Add library source and runmode modules. Reorganized library example to create a worker thread and replay a pcap file using the library mode. No API layer is added at this stage. Edits by Jason Ish: - fix guard - add copyright/license headers Ticket: #7240
3 years ago
runmode-lib.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
runmode-netmap.c \
runmode-nflog.c \
runmode-nfq.c \
runmode-pcap.c \
runmode-pcap-file.c \
runmodes.c \
runmode-unittests.c \
runmode-unix-socket.c \
runmode-windivert.c \
rust-context.c \
source-af-packet.c \
af-xdp: Add AF_XDP socket support AF_XDP support is a recent technology introduced that aims at improving capture performance. With this update, Suricata now provides a new capture source 'af-xdp' that attaches an eBPF program to the network interface card. Packets received in the NIC queue are forwarded to a RX ring in user-space, bypassing the Linux network stack. Note, there is a configuration option (force-xdp-mode) that forces the packet through the normal Linux network stack. libxdp and libbpf is required for this feature and is compile time configured. This capture source operates on single and multi-queue NIC's via suricata.yaml. Here, various features can be enabled, disabled or edited as required by the use case. This feature currently only supports receiving packets via AF_XDP, no TX support has been developed. Ticket: https://redmine.openinfosecfoundation.org/issues/3306 Additional reading: https://www.kernel.org/doc/html/latest/networking/af_xdp.html
4 years ago
source-af-xdp.c \
dpdk: initial support with workers runmode Register a new runmode - DPDK. This enables a new flag on Suricata start (--dpdk). With the flag given, DPDK runmode is enabled. Runmode loads the configuration and then initializes EAL. If successful, it configures the physical NICs according to the configuration file. After that, worker threads are initialized and then are in continuous receive loop.
5 years ago
source-dpdk.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
source-erf-dag.c \
source-erf-file.c \
source-ipfw.c \
libsuricata: add library runmode Add library source and runmode modules. Reorganized library example to create a worker thread and replay a pcap file using the library mode. No API layer is added at this stage. Edits by Jason Ish: - fix guard - add copyright/license headers Ticket: #7240
3 years ago
source-lib.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
source-netmap.c \
source-nflog.c \
source-nfq.c \
source-pcap.c \
source-pcap-file.c \
source-pcap-file-directory-helper.c \
source-pcap-file-helper.c \
source-windivert.c \
stream.c \
stream-tcp.c \
stream: reduce pool locking overhead Add thread local cache to avoid locking overhead for ssns and segments. A thread will return segments/ssns to a local cache first, and if that is full, to a return queue where the actual return to the pool returns a batch, to amortize locking overhead. Adds segment and session pool/cache counters to see where how effective the cache is.
4 years ago
stream-tcp-cache.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
stream-tcp-inline.c \
stream-tcp-list.c \
stream-tcp-reassemble.c \
stream-tcp-sack.c \
stream-tcp-util.c \
suricata.c \
threads: add initialization callbacks For library users and plugins that need to hook into the thread life cycle, perhaps to initialize some thread storage.
2 years ago
thread-callbacks.c \
threads: add storage api, based on flow storage
2 years ago
thread-storage.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
threads.c \
tm-modules.c \
tmqh-flow.c \
tmqh-packetpool.c \
tmqh-simple.c \
tm-queuehandlers.c \
tm-queues.c \
tm-threads.c \
detect/xbits: implement tx bits Implement `xbits:set,mybit,track tx;` and `xbits:isset,mybit,track tx;`. Store these in the AppLayerTxData. Ticket: #6455.
2 years ago
tx-bit.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
unix-manager.c \
util-action.c \
util-affinity.c \
util-atomic.c \
util-bpf.c \
util-buffer.c \
util-byte.c \
util-checksum.c \
util-cidr.c \
util-classification-config.c \
util-conf.c \
util-coredump-config.c \
util-cpu.c \
util-daemon.c \
suricata: introduce global linktype As Suricata is not supporting pcap-ng we have to stick with one single datalink type for the capture if ever we want to do pcap logging. Assuming this, this patch introduces a function to set the link type globally. This will be used with pcap conditional logging to get the logging of TCP segments with the correct link type.
6 years ago
util-datalink.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-debug.c \
util-debug-filters.c \
util-detect.c \
util-device.c \
dpdk: initial support with workers runmode Register a new runmode - DPDK. This enables a new flag on Suricata start (--dpdk). With the flag given, DPDK runmode is enabled. Runmode loads the configuration and then initializes EAL. If successful, it configures the physical NICs according to the configuration file. After that, worker threads are initialized and then are in continuous receive loop.
5 years ago
util-dpdk.c \
dpdk: replace global with per-thread mempools It turned out that having global (interface-specific) mempool that is shared by the threads of the interface is slower than having individual mempools per queue for each interface. The commit brings this change and should be user-invisible, the config setting remains still as a number of objects of all mempools summed (of that interface). Ticket: 7382
3 years ago
util-dpdk-bonding.c \
util-dpdk-common.c \
dpdk/i40e: support RSS on Intel i40e PMD driver Due to peculiar behavior of i40e PMD driver, the RSS is required to be set via rte_flow rules or a hash filter as compared to other NICs where RSS is configured through port configuration structure. RTE_FLOW rules are created on 5-tuples (as opposed to 3-tuple configured on the other NICs). Fragmented traffic have been tested with this setup and it has been proven that fragmented packets of the same flow are received on the same queue. At the same time, setting 3-tuple on rte_flow rules have not yield in the expected results. Notes from the experiments: - Configuration of 5-tuple (as is in the commit): fragmented and nonfragmented packets are received by the same workers even when I applied seed to alter them via tcpreplay-edit (option --seed) - Setting only ETH_RSS_FRAG_IPV4 and ETH_RSS_IPV4 (i.e. setting 3-tuple): when setting ETH_RSS_IPV4, the PMD driver says that pctype is not supported (generally this means that the "type" of traffic is not a valid configuration for the i40e) - Setting only ETH_RSS_FRAG_IPV4 and ETH_RSS_NONFRAG_IPV4_OTHER: this doesn't work well, packets of the same flow are received on the different workers (my explanation is that the fragmented packets are matched with ETH_RSS_FRAG_IPV4 but the other UDP packets are not matched with ETH_RSS_NONFRAG_IPV4_OTHER rte_flow rule (they would be matched with ETH_RSS_NONFRAG_IPV4_UDP).
5 years ago
util-dpdk-i40e.c \
dpdk/ice: setup RSS for Intel ICE PMD Set RSS hash function according to Intel ICE PMD available hash functions Set hash functions according to the support by the ICE PMD, so that no warning regarding RSS setting is issued.
5 years ago
util-dpdk-ice.c \
dpdk/ixgbe: setup RSS for Intel IXGBE PMD Set RSS hash function according to Intel IXGBE PMD available hash functions. During configuration, a warning appeared stating that RSS hash function has been changed from one value to the other. This has meant that the supported hash functions did not cover all required hash functions by the configuration. This commit solves the warning.
5 years ago
util-dpdk-ixgbe.c \
dpdk/rss: add rte_flow rss support for mlx5 The configuration of this rule is the same as for ixgbe driver except the hash function is not RTE_ETH_HASH_FUNCTION_DEFAULT but RTE_ETH_HASH_FUNCTION_TOEPLITZ. The syntax in dpdk-testpmd for this rule with attributes: port index == 0 used rx queue indices == 0 1 2 3 <hash_key> == 6d5a symmetric hash key is as follows: "flow create 0 ingress pattern eth / end actions rss types ipv4 ipv6 end queues 0 1 2 3 end key <hash_key> key_len 40 func toeplitz / end" Ticket: 7337
2 years ago
util-dpdk-mlx5.c \
dpdk/rss: move and change rss rte_flow functions Move and adjust the base of RSS configuration from util-dpdk-i40e.c to a new file that can be later utilized by other cards. RSS configuration can be configured via rte_flow rules. This is useful for possible future features such as specific header offload (vxlan, nvgre) also implemented via rte_flow rules, as rte_flow rules can be chained via groups and priorities. i40e uses multiple different rte_flow rules to setup RSS. At first, function DeviceSetRSSFlowQueues() is used to setup rx queues. This rule matches all types of traffic, so the equivalent to dpdk-testpmd pattern would be "pattern end" This rule can not contain hash types (ipv4, ipv6 etc.) nor hash key. The hash function used here is RTE_ETH_HASH_FUNCTION_DEFAULT. The syntax in dpdk-testpmd for this rule with attributes: port index == 0 used rx queue indices == 0 1 2 3 is as follows: "flow create 0 ingress pattern end actions rss queues 0 1 2 3 end func default / end" The other rules configured by i40eDeviceSetRSSFlowIPv4() and i40eDeviceSetRSSFlowIPv6() match specific type of traffic by l4 protocol (none, TCP, UDP, SCTP). For example, pattern to match l3 ipv4 with l4 tcp traffic in dpdk-testpmd syntax would be equivalent of "pattern eth / ipv4 / tcp / end". These rules can not have rx queues configured, but have hash types (l3 src and dst address). This means that the traffic distribution is affected only by l3 addresses, independent of the l4 specifics. Also these pattern matching rules have symmetric 6d5a hash key configured. The length of the key is dependent on DPDK version. The hash function (either RTE_ETH_HASH_FUNCTION_SYMMETRIC_TOEPLITZ or RTE_ETH_HASH_FUNCTION_TOEPLITZ, depending on DPKD version) used in these rules hashes symmetricaly due to the symmetric hash key. The syntax in dpdk-testpmd for rule to match ipv4-tcp traffic with attributes: port index == 0 <hash_key> == 52 bytes long 6d5a symmetric hash key is as follows: "flow create 0 ingress pattern eth / ipv4 / tcp / end actions rss types ipv4-tcp l3-src-only l3-dst-only end queues end key <hash_key> key_len 52 func toeplitz / end" (queues need to be set to NULL) Ticket: 7337
2 years ago
util-dpdk-rss.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-ebpf.c \
util-enum.c \
util-error.c \
exceptions: initial exception-policy implementation Adds a framework for setting exception policies. These would be called when the engine reaches some kind of exception condition, like hitting a memcap or some traffic processing error. The policy gives control over what should happen next: drop the packet, drop the packet and flow, bypass, etc. Implements the policy for: stream: If stream session or reassembly memcaps are hit call the memcap policy on the packet and flow. flow: Apply policy when memcap is reached and no flow could be freed up. defrag: Apply policy when no tracker could be picked up. app-layer: Apply ppolicy if a parser reaches an error state. All options default to 'ignore', which means the default behavior is unchanged. Adds commandline options: add simulation options for exceptions. These are only exposed if compiled with `--enable-debug`. Ticket: #5214. Ticket: #5215. Ticket: #5216. Ticket: #5218. Ticket: #5194.
5 years ago
util-exception-policy.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-file.c \
util-file-decompression.c \
util-file-swf-decompression.c \
util-fix_checksum.c \
util-fmemopen.c \
util-hash.c \
util-hashlist.c \
util-hash-lookup3.c \
util-hash-string.c \
util-host-info.c \
util-host-os-info.c \
dpdk: rework hugepage hints to use per-numa information Previous integration of hugepage analysis only fetched data from /proc/meminfo. However this proved to be often deceiving mainly for providing only global information and not taking into account different hugepage sizes (e.g. 1GB hugepages) and different NUMA nodes. Ticket: #6419
3 years ago
util-hugepages.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-hyperscan.c \
util-ioctl.c \
util-ip.c \
util-ja3.c \
landlock: basic implementation This patch is adding support for Landlock, a Linux Security Module available since Linux 5.13. The concept is to prevent any file operation on directories where Suricata is not supposed to access. Landlock support is built by default if the header is present. The feature is disabled by default and need to be activated in the YAML to be active. Landlock documentation: https://docs.kernel.org/userspace-api/landlock.html Feature: #5479
4 years ago
util-landlock.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-logopenfile.c \
util-log-redis.c \
util-lua.c \
lua: add base64 lib Export our base64 decoding and encoding functions to Lua. Ticket: #7074
2 years ago
util-lua-base64lib.c \
lua: add "builtins" file to consolidate registration Use a single array of built-ins and provide 2 functions for registering them: - SCLuaLoadBuiltIn: for loading built-in modules in sandboxed environments. - SCLuaRequirefBuiltIns: registers built-in modules with the standard package tool, allows built-ins to be loaded by output scripts that are not restricted I hope to refactor the sandbox so they can use SCLuaRequirefBuiltIns as well.
2 years ago
util-lua-builtins.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-lua-common.c \
lua/datasets: factor out into its own file This is mainly for header sanitization to avoid pulling in detect modules into the Lua sandbox definition. Plus if we namespace modules with names like "suricata.dataset", it probably makes sense to keep those modules in their own files.
2 years ago
util-lua-dataset.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-lua-dnp3.c \
util-lua-dnp3-objects.c \
util-lua-dns.c \
lua: convert lua flowint functions to lib: suricata.flowintlib Ticket: #7487
2 years ago
util-lua-flowintlib.c \
lua: add initial suricata.flow lib Methods: `get` creates the flow object. `id` returns the flow id. `has_alerts` returns a boolean indicating if the flow triggered alerts. `app_layer_proto` returns various app-layer related fields as 5 strings: alproto, alproto_ts, alproto_tc, alproto_orig, alproto_expect. `stats` returns cnts for bytes and packets to sever and to client, as 4 numbers. `tuple` -- returns various fields: srcip, dstip, proto, sp, dp. `timestamps` returns time as 4 numbers: seconds and microseconds, for first and last packet of the flow. `timestring_legacy` returns the first packet from the flow's timestring as a string (like fastlog). `timestring_iso8601` returns the first packet from the flow's timestring as an iso8601 compat timestring (like eve). Example: ``` name = "lua-scflowstats.log" local flow = require("suricata.flow") function init(args) local needs = {} needs["type"] = "flow" return needs end function setup(args) filename = SCLogPath() .. "/" .. name file = assert(io.open(filename, "a")) SCLogInfo("lua SCFlowStats Log Filename " .. filename) end function log(args) local f = flow.get() timestring = f:timestring_legacy() tscnt, tsbytes, tccnt, tcbytes = f:stats() file:write ("[**] " .. timestring .. "\nSCFlowStats is\nPacket count to server: " .. tscnt .. "\nByte count to server: " .. tsbytes .. "\nPacket count to client: " .. tccnt .. "\nByte count to client: " .. tcbytes .. "\n[**]") file:flush() end function deinit(args) file:close(file) end ``` Task #7489
2 years ago
util-lua-flowlib.c \
lua: convert flowvar functions to lib New Lua lib, "suricata.flowvar" for working with flowvars from Lua. Replaces functions: - SCFlowvarGet (and ScFlowvarGet) - SCFlowvarSet (and SCFlowvarSet) Of note, the DetectLuaData has been made available to the init and thread_init methods, instead of just the match. This is due to an issue that if a flow variable is not registered in init, it will not be logged, registering in thread_init is too late. Ticket: #7486
2 years ago
util-lua-flowvarlib.c \
lua: expose hashing functions to lua scripts Expose md5, sha1, and sha256 to Lua scripts with `require("suricata.hashing")`. Ticket: 7073
2 years ago
util-lua-hashlib.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-lua-http.c \
util-lua-ja3.c \
lua: add initial suricata.packet lib Example: ``` local packet = require "suricata.packet" function init (args) local needs = {} return needs end function match (args) p = packet.get() payload = p:payload() ts = p:timestring() for line in payload:gmatch("([^\r\n]*)[\r\n]+") do if line == "GET /index.html HTTP/1.0" then ipver, srcip, dstip, proto, sp, dp = p:tuple() SCLogNotice(string.format("%s %s->%s %d->%d (pcap_cnt:%d) match! %s", ts, srcip, dstip, sp, dp, p:pcap_cnt(), line)); return 1 end end return 0 end ``` Methods: `get` creates the packet object. `payload` returns the packet payload as a buffer `packet` returns the whole packet (includes headers) `pcap_cnt` returns the `pcap_cnt` (pcap file mode only) `tuple` returns various fields: srcip, dstip, proto, sp, dp `sp` returns source port `dp` returns destination port `timestamp` returns time as 2 numbers: seconds and microseconds `timestring_legacy` returns a timestamp as a string (like fastlog) `timestring_iso8601` returns a iso8601 compat timestring (like eve) Ticket: #7488.
2 years ago
util-lua-packetlib.c \
lua: add suricata.rule library Add a "suricata.rule" library for accessing rule information from a Lua rule, or a Lua output script. This lib replaces the following global Lua functions: - SCRuleIds - SCRuleAction - SCRuleMsg - SCRuleClass Ticket: #7490
2 years ago
util-lua-rule.c \
lua: Add lua sandbox for detection rules
3 years ago
util-lua-sandbox.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-lua-smtp.c \
util-lua-ssh.c \
util-lua-tls.c \
util-macset.c \
util: add initial flow rate tracking implementation In order to track flow rate and thus determine a course of action or categorize it as elephant flow, track a flow's byte count per direction in a ring buffer for a given time interval. The implementation is simple and keeps overwriting the buffer and updating the final sum. The sum of all the elements in the ring buffer at any point in time should reflect the number of bytes for the respective flow in the last of a given configured interval. e.g. if the definition says that the flows must be tracked by a rate of 100k bytes in 10 seconds, the ring buffer at any point in time should carry the total number of bytes seen by the respective flow in the last 10 seconds. So far, the implementation only supports reading the flow rate definition from suricata.yaml and using it to track the flows. This solution adds up a space complexity to the existing Flow struct. However, the added space complexity should only take effect if the feature is in use. Since this buffer extends the Flow struct, it does not impact the usual business logic or complexity of the code. This implementation is currently limited to defining the time interval of flow rate in seconds only. However, the number of seconds defined are directly proportional to the aforementioned added space complexity as that's the size of the ring buffer. Feature 5647
2 years ago
util-flow-rate.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-magic.c \
util-mem.c \
util-memcmp.c \
util-memrchr.c \
util-misc.c \
util-mpm-ac.c \
util-mpm-ac-ks.c \
util-mpm-ac-ks-small.c \
util-mpm.c \
util-mpm-hs.c \
hyperscan: add caching mechanism for hyperscan contexts Cache Hyperscan serialized databases to disk to prevent compilation of the same databases when Suricata is run again with the same ruleset. Hyperscan binary files are stored per rulegroup in the designated folder, by default in the cached library folder. Since caching is per signature group heads, some chunk of the ruleset can change and it still can reuse part of the unchanged signature groups. Loading *fresh* ET Open ruleset: 19 seconds Loading *cached* ET Open ruleset: 07 seconds Ticket: 7170
2 years ago
util-mpm-hs-cache.c \
util-mpm-hs: refactor Hyperscan Pattern DB initialization to smaller functions
2 years ago
util-mpm-hs-core.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-pages.c \
util-path.c \
util-pidfile.c \
util-plugin.c \
util-pool.c \
util-pool-thread.c \
util-prefilter.c \
util-print.c \
util-privs.c \
util-profiling.c \
util-profiling-keywords.c \
util-profiling-locks.c \
util-profiling-prefilter.c \
util-profiling-rulegroups.c \
util-profiling-rules.c \
util-proto-name.c \
radix: implement more compact trees Implement a more compact set of trees specifically for IPv4 and IPv6 addresses. This allows for more compact data structures and fewer memory allocations. Based on the existing radix tree implementation.
5 years ago
util-radix4-tree.c \
util-radix6-tree.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-random.c \
util-reference-config.c \
util-rohash.c \
util-rule-vars.c \
util-runmodes.c \
util-running-modes.c \
util-signal.c \
util-spm-bm.c \
util-spm-bs2bm.c \
util-spm-bs.c \
util-spm.c \
util-spm-hs.c \
util-storage.c \
util-streaming-buffer.c \
util-strlcatu.c \
util-strlcpyu.c \
util-strptime.c \
util-syslog.c \
af-xdp: Add AF_XDP socket support AF_XDP support is a recent technology introduced that aims at improving capture performance. With this update, Suricata now provides a new capture source 'af-xdp' that attaches an eBPF program to the network interface card. Packets received in the NIC queue are forwarded to a RX ring in user-space, bypassing the Linux network stack. Note, there is a configuration option (force-xdp-mode) that forces the packet through the normal Linux network stack. libxdp and libbpf is required for this feature and is compile time configured. This capture source operates on single and multi-queue NIC's via suricata.yaml. Here, various features can be enabled, disabled or edited as required by the use case. This feature currently only supports receiving packets via AF_XDP, no TX support has been developed. Ticket: https://redmine.openinfosecfoundation.org/issues/3306 Additional reading: https://www.kernel.org/doc/html/latest/networking/af_xdp.html
4 years ago
util-sysfs.c \
systemd: reimplement sd_notify logic using UNIX socket One of the lessons of the XZ backdoor story was that just linking to libsystemd to call sd_notify is discouraged by the systemd project: Lennart Poettering: "PSA: In context of the xzpocalypse we now added an example reimplementation of sd_notify() to our man page: https://www.freedesktop.org/software/systemd/man/devel/sd_notify.html#Notes It's pretty comprehensive (i.e. uses it for reload notification too), but still relatively short. In the past, I have been telling anyone who wanted to listen that if all you want is sd_notify() then don't bother linking to libsystemd, since the protocol is stable and should be considered the API, not our C wrapper around it. After all, the protocol is so trivial" From: https://mastodon.social/@pid_eins/112202687764571433 This commit takes the example code and uses it to reimplement the notify logic. The code is enabled if Linux is detected in configure. Since the code won't do anything if the NOTIFY_SOCKET env var isn't set, this should also work fine on systems w/o systemd. Ticket: #6913.
3 years ago
util-systemd.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
util-thash.c \
util-threshold-config.c \
util-time.c \
util-unittest.c \
util-unittest-helper.c \
util-var.c \
util-var-name.c \
util/interval-tree: add utility fns Add new utility files to deal with the interval trees. These cover the basic ops: 1. Creation/Destruction of the tree 2. Creation/Destruction of the nodes It also adds the support for finding overlaps for a given set of ports. This function is used by the detection engine is the Stage 2 of signature preparation. Ticket 6792 Bug 6414 Co-authored-by: Victor Julien <vjulien@oisf.net>
3 years ago
util-port-interval-tree.c \
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
win32-misc.c \
win32-service.c \
win32-syscall.c
plugins: initial support for a filetype plugin A filetype plugin is a plugin that implements an eve filetype. Most of the current filetypes could likely be implemented as such a plugin. Such a plugin must implement Open, Close and Write, where Write is provided the formatted JSON to be logged. This commit also includes the plumbing for plugin loading. Example plugin to come. Plugins are loaded by the "plugin" section in the configuration file: plugins: - /path/to/directory/plugins - /path/to/plugin_file.so This can also be done on the command line with: --set plugins.0=/path/plugin_file.so
6 years ago
makefile: don't include the whole test/ directory Including the whole directory results in .deps files ending up in the distribution archive which shouldn't be there. Instead we have to list all the test sources individually.
6 years ago
EXTRA_DIST = \
build: separate private headers from installed headers Create a new list of headers for headers that should never be installed, such as private headers that should only be available within the Suricata project. For now, just the util-device-private.h belongs to this set.
2 years ago
${PRIVATE_INCLUDES} \
makefile: don't include the whole test/ directory Including the whole directory results in .deps files ending up in the distribution archive which shouldn't be there. Instead we have to list all the test sources individually.
6 years ago
tests/stream-tcp-inline.c \
tests/stream-tcp-list.c \
tests/detect-ipv4hdr.c \
tests/detect-ipv6hdr.c \
tests/detect-tcphdr.c \
tests/detect-udphdr.c \
tests/reputation.c \
tests/detect-bsize.c \
tests/detect-http2.c \
tests/detect-icmpv6-mtu.c \
tests/detect-icmpv6hdr.c \
tests/detect-template.c \
tests/detect-transform-pcrexform.c \
tests/detect-ttl.c \
tests/source-pcap.c \
tests/app-layer-htp-file.c \
detect/alert: add unittests to check packet action Add unittests to check that packet flags are correctly updated after detection finds drop or reject rules that match. Related to Bug #5458
4 years ago
tests/detect-engine-alert.c \
makefile: don't include the whole test/ directory Including the whole directory results in .deps files ending up in the distribution archive which shouldn't be there. Instead we have to list all the test sources individually.
6 years ago
tests/detect-engine-content-inspection.c \
tests/detect-icmpv4hdr.c \
tests/detect-parse.c \
tests/stream-tcp-reassemble.c \
tests/detect-file-data.c \
tests/detect-http-client-body.c \
tests/detect-http-cookie.c \
tests/detect-http-header.c \
tests/detect-http-host.c \
tests/detect-http-method.c \
tests/detect-http-raw-header.c \
tests/detect-http-server-body.c \
tests/detect-http-stat-code.c \
tests/detect-http-stat-msg.c \
tests/detect-http-uri.c \
tests/detect-http-user-agent.c \
tests/detect-ssl-state.c \
tests/detect-ssl-version.c \
tests/detect-tls-cert-fingerprint.c \
tests/detect-tls-cert-issuer.c \
tests/detect-tls-cert-serial.c \
tests/detect-tls-cert-subject.c \
tests/detect-tls-cert-validity.c \
tests/detect-tls-certs.c \
tests/detect-tls-version.c \
detect: add ip.src keyword It is a sticky buffer matching on src_ip. Feature: #5383
4 years ago
tests/detect-ipaddr.c \
makefile: don't include the whole test/ directory Including the whole directory results in .deps files ending up in the distribution archive which shouldn't be there. Instead we have to list all the test sources individually.
6 years ago
tests/detect.c \
stats: Add unittest for basic stats serialization Main purpose is to validate that the 30 of bond0.30 isn't expanded into a nested object during serialization.
3 years ago
tests/stream-tcp.c \
tests/output-json-stats.c
Fix CUDA build from a release tarball.
15 years ago
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
install-headers:
mkdir -p $(DESTDIR)${includedir}/suricata
for header in $(noinst_HEADERS); do \
$(INSTALL_DATA) $$header "$(DESTDIR)${includedir}/suricata"; \
done
make: install-headers: rust-bindings.h rust-bindings.h was not being installed with "make install-headers", and its now pulled in by a header used for plugin support, so make sure its installed. We first attempt to install the "dist" version if exists, otherwise install the "gen" one. Also install the "gen" even if the "dist" one exists, as its going to be newer.
2 years ago
if test -e ../rust/dist/rust-bindings.h; then \
$(INSTALL_DATA) ../rust/dist/rust-bindings.h "$(DESTDIR)${includedir}/suricata"; \
fi
if test -e ../rust/gen/rust-bindings.h; then \
$(INSTALL_DATA) ../rust/gen/rust-bindings.h "$(DESTDIR)${includedir}/suricata"; \
fi
Makefile: break headers and source into 2 vars Split the headers and source into 2 variables. Headers are marked noinst so they don't get automatically installed on "make install". Instead they will be installed by a custom Makefile target, "make install-headers".
6 years ago
build: remove autoconf.h from dist We were including "autoconf.h" in our dist releases, however this file is generated by ./configure. This can be problematic in out of tree builds as the one included in the dist, not the generated one may be used. Also using "autoconf.h" instead of <autoconf.h> so it is searched for relative to the file including it which is necessary if a library/plugin does something like "#include "suricata/foo.h".
3 years ago
# Until we can remove autoconf.h from our headers, we need to to
# provide this for library/plugin users.
$(INSTALL_DATA) autoconf.h "$(DESTDIR)${includedir}/suricata"
Initial add of the files.
19 years ago
# set the include path found by configure
autotool: INCLUDES usage is deprecated
14 years ago
AM_CPPFLAGS = $(all_includes)
import of integrated htp lib and small libnet fixes
17 years ago
build: use a static convenience library for C code With the circular reference gone, we can now make use of a convenience library for the Suricata program as well as any other programs that depend on the same source such as the fuzzer. While its not a libtool convenience library, it serves the same purpose and is a common idiom in Make and CMake projects whereas the COMMON_SOURCES approach was more of a hack we had to resort to until the circular reference was resolved.
6 years ago
noinst_LIBRARIES = libsuricata_c.a
suricata_SOURCES = main.c
fuzz: adds eight fuzz targets And ways to compile them with enable-fuzztargets at configure time Adds utility function in util-unittest-helper
8 years ago
Initial add of the files.
19 years ago
# the library search path.
gccprotect: fix SECLDFLAGS not getting used
11 years ago
suricata_LDFLAGS = $(all_libraries) ${SECLDFLAGS}
detect: helper to have pure rust keywords detect: make number of keywords dynamic Ticket: 4683
3 years ago
# rust library depends also on c
if LINKER_SUPPORTS_GROUP
http: Use libhtp-rs. Ticket: #2696 There are a lot of changes here, which are described below. In general these changes are renaming constants to conform to the libhtp-rs versions (which are generated by cbindgen); making all htp types opaque and changing struct->member references to htp_struct_member() function calls; and a handful of changes to offload functionality onto libhtp-rs from suricata, such as URI normalization and transaction cleanup. Functions introduced to handle opaque htp_tx_t: - tx->parsed_uri => htp_tx_parsed_uri(tx) - tx->parsed_uri->path => htp_uri_path(htp_tx_parsed_uri(tx) - tx->parsed_uri->hostname => htp_uri_hostname(htp_tx_parsed_uri(tx)) - htp_tx_get_user_data() => htp_tx_user_data(tx) - htp_tx_is_http_2_upgrade(tx) convenience function introduced to detect response status 101 and “Upgrade: h2c" header. Functions introduced to handle opaque htp_tx_data_t: - d->len => htp_tx_data_len() - d->data => htp_tx_data_data() - htp_tx_data_tx(data) function to get the htp_tx_t from the htp_tx_data_t - htp_tx_data_is_empty(data) convenience function introduced to test if the data is empty. Other changes: Build libhtp-rs as a crate inside rust. Update autoconf to no longer use libhtp as an external dependency. Remove HAVE_HTP feature defines since they are no longer needed. Make function arguments and return values const where possible htp_tx_destroy(tx) will now free an incomplete transaction htp_time_t replaced with standard struct timeval Callbacks from libhtp now provide the htp_connp_t and the htp_tx_data_t as separate arguments. This means the connection parser is no longer fetched from the transaction inside callbacks. SCHTPGenerateNormalizedUri() functionality moved inside libhtp-rs, which now provides normalized URI values. The normalized URI is available with accessor function: htp_tx_normalized_uri() Configuration settings added to control the behaviour of the URI normalization: - htp_config_set_normalized_uri_include_all() - htp_config_set_plusspace_decode() - htp_config_set_convert_lowercase() - htp_config_set_double_decode_normalized_query() - htp_config_set_double_decode_normalized_path() - htp_config_set_backslash_convert_slashes() - htp_config_set_bestfit_replacement_byte() - htp_config_set_convert_lowercase() - htp_config_set_nul_encoded_terminates() - htp_config_set_nul_raw_terminates() - htp_config_set_path_separators_compress() - htp_config_set_path_separators_decode() - htp_config_set_u_encoding_decode() - htp_config_set_url_encoding_invalid_handling() - htp_config_set_utf8_convert_bestfit() - htp_config_set_normalized_uri_include_all() - htp_config_set_plusspace_decode() Constants related to configuring uri normalization: - HTP_URL_DECODE_PRESERVE_PERCENT => HTP_URL_ENCODING_HANDLING_PRESERVE_PERCENT - HTP_URL_DECODE_REMOVE_PERCENT => HTP_URL_ENCODING_HANDLING_REMOVE_PERCENT - HTP_URL_DECODE_PROCESS_INVALID => HTP_URL_ENCODING_HANDLING_PROCESS_INVALID htp_config_set_field_limits(soft_limit, hard_limit) changed to htp_config_set_field_limit(limit) because libhtp didn't implement soft limits. libhtp logging API updated to provide HTP_LOG_CODE constants along with the message. This eliminates the need to perform string matching on message text to map log messages to HTTP_DECODER_EVENT values, and the HTP_LOG_CODE values can be used directly. In support of this, HTP_DECODER_EVENT values are mapped to their corresponding HTP_LOG_CODE values. New log events to describe additional anomalies: HTP_LOG_CODE_REQUEST_TOO_MANY_LZMA_LAYERS HTP_LOG_CODE_RESPONSE_TOO_MANY_LZMA_LAYERS HTP_LOG_CODE_PROTOCOL_CONTAINS_EXTRA_DATA HTP_LOG_CODE_CONTENT_LENGTH_EXTRA_DATA_START HTP_LOG_CODE_CONTENT_LENGTH_EXTRA_DATA_END HTP_LOG_CODE_SWITCHING_PROTO_WITH_CONTENT_LENGTH HTP_LOG_CODE_DEFORMED_EOL HTP_LOG_CODE_PARSER_STATE_ERROR HTP_LOG_CODE_MISSING_OUTBOUND_TRANSACTION_DATA HTP_LOG_CODE_MISSING_INBOUND_TRANSACTION_DATA HTP_LOG_CODE_ZERO_LENGTH_DATA_CHUNKS HTP_LOG_CODE_REQUEST_LINE_UNKNOWN_METHOD HTP_LOG_CODE_REQUEST_LINE_UNKNOWN_METHOD_NO_PROTOCOL HTP_LOG_CODE_REQUEST_LINE_UNKNOWN_METHOD_INVALID_PROTOCOL HTP_LOG_CODE_REQUEST_LINE_NO_PROTOCOL HTP_LOG_CODE_RESPONSE_LINE_INVALID_PROTOCOL HTP_LOG_CODE_RESPONSE_LINE_INVALID_RESPONSE_STATUS HTP_LOG_CODE_RESPONSE_BODY_INTERNAL_ERROR HTP_LOG_CODE_REQUEST_BODY_DATA_CALLBACK_ERROR HTP_LOG_CODE_RESPONSE_INVALID_EMPTY_NAME HTP_LOG_CODE_REQUEST_INVALID_EMPTY_NAME HTP_LOG_CODE_RESPONSE_INVALID_LWS_AFTER_NAME HTP_LOG_CODE_RESPONSE_HEADER_NAME_NOT_TOKEN HTP_LOG_CODE_REQUEST_INVALID_LWS_AFTER_NAME HTP_LOG_CODE_LZMA_DECOMPRESSION_DISABLED HTP_LOG_CODE_CONNECTION_ALREADY_OPEN HTP_LOG_CODE_COMPRESSION_BOMB_DOUBLE_LZMA HTP_LOG_CODE_INVALID_CONTENT_ENCODING HTP_LOG_CODE_INVALID_GAP HTP_LOG_CODE_ERROR The new htp_log API supports consuming log messages more easily than walking a list and tracking the current offset. Internally, libhtp-rs now provides log messages as a queue of htp_log_t, which means the application can simply call htp_conn_next_log() to fetch the next log message until the queue is empty. Once the application is done with a log message, they can call htp_log_free() to dispose of it. Functions supporting htp_log_t: htp_conn_next_log(conn) - Get the next log message htp_log_message(log) - To get the text of the message htp_log_code(log) - To get the HTP_LOG_CODE value htp_log_free(log) - To free the htp_log_t
3 years ago
LDADD_GENERIC = "-Wl,--start-group,libsuricata_c.a,$(RUST_SURICATA_LIB),--end-group" $(RUST_LDADD)
detect: helper to have pure rust keywords detect: make number of keywords dynamic Ticket: 4683
3 years ago
else
http: Use libhtp-rs. Ticket: #2696 There are a lot of changes here, which are described below. In general these changes are renaming constants to conform to the libhtp-rs versions (which are generated by cbindgen); making all htp types opaque and changing struct->member references to htp_struct_member() function calls; and a handful of changes to offload functionality onto libhtp-rs from suricata, such as URI normalization and transaction cleanup. Functions introduced to handle opaque htp_tx_t: - tx->parsed_uri => htp_tx_parsed_uri(tx) - tx->parsed_uri->path => htp_uri_path(htp_tx_parsed_uri(tx) - tx->parsed_uri->hostname => htp_uri_hostname(htp_tx_parsed_uri(tx)) - htp_tx_get_user_data() => htp_tx_user_data(tx) - htp_tx_is_http_2_upgrade(tx) convenience function introduced to detect response status 101 and “Upgrade: h2c" header. Functions introduced to handle opaque htp_tx_data_t: - d->len => htp_tx_data_len() - d->data => htp_tx_data_data() - htp_tx_data_tx(data) function to get the htp_tx_t from the htp_tx_data_t - htp_tx_data_is_empty(data) convenience function introduced to test if the data is empty. Other changes: Build libhtp-rs as a crate inside rust. Update autoconf to no longer use libhtp as an external dependency. Remove HAVE_HTP feature defines since they are no longer needed. Make function arguments and return values const where possible htp_tx_destroy(tx) will now free an incomplete transaction htp_time_t replaced with standard struct timeval Callbacks from libhtp now provide the htp_connp_t and the htp_tx_data_t as separate arguments. This means the connection parser is no longer fetched from the transaction inside callbacks. SCHTPGenerateNormalizedUri() functionality moved inside libhtp-rs, which now provides normalized URI values. The normalized URI is available with accessor function: htp_tx_normalized_uri() Configuration settings added to control the behaviour of the URI normalization: - htp_config_set_normalized_uri_include_all() - htp_config_set_plusspace_decode() - htp_config_set_convert_lowercase() - htp_config_set_double_decode_normalized_query() - htp_config_set_double_decode_normalized_path() - htp_config_set_backslash_convert_slashes() - htp_config_set_bestfit_replacement_byte() - htp_config_set_convert_lowercase() - htp_config_set_nul_encoded_terminates() - htp_config_set_nul_raw_terminates() - htp_config_set_path_separators_compress() - htp_config_set_path_separators_decode() - htp_config_set_u_encoding_decode() - htp_config_set_url_encoding_invalid_handling() - htp_config_set_utf8_convert_bestfit() - htp_config_set_normalized_uri_include_all() - htp_config_set_plusspace_decode() Constants related to configuring uri normalization: - HTP_URL_DECODE_PRESERVE_PERCENT => HTP_URL_ENCODING_HANDLING_PRESERVE_PERCENT - HTP_URL_DECODE_REMOVE_PERCENT => HTP_URL_ENCODING_HANDLING_REMOVE_PERCENT - HTP_URL_DECODE_PROCESS_INVALID => HTP_URL_ENCODING_HANDLING_PROCESS_INVALID htp_config_set_field_limits(soft_limit, hard_limit) changed to htp_config_set_field_limit(limit) because libhtp didn't implement soft limits. libhtp logging API updated to provide HTP_LOG_CODE constants along with the message. This eliminates the need to perform string matching on message text to map log messages to HTTP_DECODER_EVENT values, and the HTP_LOG_CODE values can be used directly. In support of this, HTP_DECODER_EVENT values are mapped to their corresponding HTP_LOG_CODE values. New log events to describe additional anomalies: HTP_LOG_CODE_REQUEST_TOO_MANY_LZMA_LAYERS HTP_LOG_CODE_RESPONSE_TOO_MANY_LZMA_LAYERS HTP_LOG_CODE_PROTOCOL_CONTAINS_EXTRA_DATA HTP_LOG_CODE_CONTENT_LENGTH_EXTRA_DATA_START HTP_LOG_CODE_CONTENT_LENGTH_EXTRA_DATA_END HTP_LOG_CODE_SWITCHING_PROTO_WITH_CONTENT_LENGTH HTP_LOG_CODE_DEFORMED_EOL HTP_LOG_CODE_PARSER_STATE_ERROR HTP_LOG_CODE_MISSING_OUTBOUND_TRANSACTION_DATA HTP_LOG_CODE_MISSING_INBOUND_TRANSACTION_DATA HTP_LOG_CODE_ZERO_LENGTH_DATA_CHUNKS HTP_LOG_CODE_REQUEST_LINE_UNKNOWN_METHOD HTP_LOG_CODE_REQUEST_LINE_UNKNOWN_METHOD_NO_PROTOCOL HTP_LOG_CODE_REQUEST_LINE_UNKNOWN_METHOD_INVALID_PROTOCOL HTP_LOG_CODE_REQUEST_LINE_NO_PROTOCOL HTP_LOG_CODE_RESPONSE_LINE_INVALID_PROTOCOL HTP_LOG_CODE_RESPONSE_LINE_INVALID_RESPONSE_STATUS HTP_LOG_CODE_RESPONSE_BODY_INTERNAL_ERROR HTP_LOG_CODE_REQUEST_BODY_DATA_CALLBACK_ERROR HTP_LOG_CODE_RESPONSE_INVALID_EMPTY_NAME HTP_LOG_CODE_REQUEST_INVALID_EMPTY_NAME HTP_LOG_CODE_RESPONSE_INVALID_LWS_AFTER_NAME HTP_LOG_CODE_RESPONSE_HEADER_NAME_NOT_TOKEN HTP_LOG_CODE_REQUEST_INVALID_LWS_AFTER_NAME HTP_LOG_CODE_LZMA_DECOMPRESSION_DISABLED HTP_LOG_CODE_CONNECTION_ALREADY_OPEN HTP_LOG_CODE_COMPRESSION_BOMB_DOUBLE_LZMA HTP_LOG_CODE_INVALID_CONTENT_ENCODING HTP_LOG_CODE_INVALID_GAP HTP_LOG_CODE_ERROR The new htp_log API supports consuming log messages more easily than walking a list and tracking the current offset. Internally, libhtp-rs now provides log messages as a queue of htp_log_t, which means the application can simply call htp_conn_next_log() to fetch the next log message until the queue is empty. Once the application is done with a log message, they can call htp_log_free() to dispose of it. Functions supporting htp_log_t: htp_conn_next_log(conn) - Get the next log message htp_log_message(log) - To get the text of the message htp_log_code(log) - To get the HTP_LOG_CODE value htp_log_free(log) - To free the htp_log_t
3 years ago
LDADD_GENERIC = libsuricata_c.a $(RUST_SURICATA_LIB) libsuricata_c.a $(RUST_SURICATA_LIB) $(RUST_LDADD)
detect: helper to have pure rust keywords detect: make number of keywords dynamic Ticket: 4683
3 years ago
endif
suricata_LDADD = $(LDADD_GENERIC)
rust: cbindgen first verifies existing bindings So as not to recompile every C file inclusing rust.h
5 years ago
suricata_DEPENDENCIES = libsuricata_c.a $(RUST_SURICATA_LIB)
import of integrated htp lib and small libnet fixes
17 years ago
lib: build shared library on Linux Building the shared library on Linux is not something by default. Instead a user must opt-in to building by running the "make libsuricata.so" target in the src/ directory. Currently shared library support is only available on Linux. More OSs will be supported as we can test them.
6 years ago
if BUILD_SHARED_LIBRARY
libsuricata.so.$(VERSION): libsuricata_c.a
$(CC) -shared -o $@ -Wl,-soname,$@ -Wl,--whole-archive \
libsuricata_c.a \
$(RUST_SURICATA_LIB) \
-Wl,--no-whole-archive
libsuricata.so: libsuricata.so.$(VERSION)
else
libsuricata.so:
@echo "shared library support not enabled"
@exit 1
endif
install: makefile target to install libraries As we don't install the libraries by default, provide a make target, "install-library" to install the libsuricata library files. If shared library support exists, both the static and shared libraries will be installed, otherwise only the static libraries will be installed.
6 years ago
if BUILD_SHARED_LIBRARY
install-library: libsuricata.so.$(VERSION)
else
install-library:
endif
$(MKDIR_P) "$(DESTDIR)$(libdir)"
$(INSTALL_DATA) libsuricata_c.a "$(DESTDIR)$(libdir)"
if BUILD_SHARED_LIBRARY
$(INSTALL) libsuricata.so.$(VERSION) "$(DESTDIR)$(libdir)"
ln -sf libsuricata.so.$(VERSION) "$(DESTDIR)$(libdir)/libsuricata.so"
endif
uninstall-local:
rm -f "$(DESTDIR)$(libdir)/libsuricata_c.a"
rm -f "$(DESTDIR)$(libdir)/libsuricata.so"
rm -f "$(DESTDIR)$(libdir)/libsuricata.$(VERSION)"
build: wrap fuzz targets in guard to fix 'make tags'
7 years ago
if BUILD_FUZZTARGETS
build: use a static convenience library for C code With the circular reference gone, we can now make use of a convenience library for the Suricata program as well as any other programs that depend on the same source such as the fuzzer. While its not a libtool convenience library, it serves the same purpose and is a common idiom in Make and CMake projects whereas the COMMON_SOURCES approach was more of a hack we had to resort to until the circular reference was resolved.
6 years ago
LDFLAGS_FUZZ = $(all_libraries) $(SECLDFLAGS)
detect: helper to have pure rust keywords detect: make number of keywords dynamic Ticket: 4683
3 years ago
LDADD_FUZZ = $(LDADD_GENERIC)
build: use a static convenience library for C code With the circular reference gone, we can now make use of a convenience library for the Suricata program as well as any other programs that depend on the same source such as the fuzzer. While its not a libtool convenience library, it serves the same purpose and is a common idiom in Make and CMake projects whereas the COMMON_SOURCES approach was more of a hack we had to resort to until the circular reference was resolved.
6 years ago
fuzz: make confyaml.c an explicit source Ticket: 7181 Allows confyaml.c to be in the release archive
2 years ago
fuzz_applayerprotodetectgetproto_SOURCES = tests/fuzz/fuzz_applayerprotodetectgetproto.c tests/fuzz/confyaml.c
build: use a static convenience library for C code With the circular reference gone, we can now make use of a convenience library for the Suricata program as well as any other programs that depend on the same source such as the fuzzer. While its not a libtool convenience library, it serves the same purpose and is a common idiom in Make and CMake projects whereas the COMMON_SOURCES approach was more of a hack we had to resort to until the circular reference was resolved.
6 years ago
fuzz_applayerprotodetectgetproto_LDFLAGS = $(LDFLAGS_FUZZ)
fuzz_applayerprotodetectgetproto_LDADD = $(LDADD_FUZZ)
fuzz: build with dependencies on rust and c lib So that there is no need to remove the final binary, to recompile it if there has been changes in the code.
3 years ago
fuzz_applayerprotodetectgetproto_DEPENDENCIES = libsuricata_c.a $(RUST_SURICATA_LIB)
fuzz: adds eight fuzz targets And ways to compile them with enable-fuzztargets at configure time Adds utility function in util-unittest-helper
8 years ago
if HAS_FUZZLDFLAGS
fuzz_applayerprotodetectgetproto_LDFLAGS += $(LIB_FUZZING_ENGINE)
else
makefile: don't include the whole test/ directory Including the whole directory results in .deps files ending up in the distribution archive which shouldn't be there. Instead we have to list all the test sources individually.
6 years ago
fuzz_applayerprotodetectgetproto_SOURCES += tests/fuzz/onefile.c
fuzz: adds eight fuzz targets And ways to compile them with enable-fuzztargets at configure time Adds utility function in util-unittest-helper
8 years ago
endif
# force usage of CXX for linker
fuzz: simpler way to force usage of CXX linker
7 years ago
nodist_EXTRA_fuzz_applayerprotodetectgetproto_SOURCES = force-cxx-linking.cxx
fuzz: adds eight fuzz targets And ways to compile them with enable-fuzztargets at configure time Adds utility function in util-unittest-helper
8 years ago
fuzz: make confyaml.c an explicit source Ticket: 7181 Allows confyaml.c to be in the release archive
2 years ago
fuzz_applayerparserparse_SOURCES = tests/fuzz/fuzz_applayerparserparse.c tests/fuzz/confyaml.c
build: use a static convenience library for C code With the circular reference gone, we can now make use of a convenience library for the Suricata program as well as any other programs that depend on the same source such as the fuzzer. While its not a libtool convenience library, it serves the same purpose and is a common idiom in Make and CMake projects whereas the COMMON_SOURCES approach was more of a hack we had to resort to until the circular reference was resolved.
6 years ago
fuzz_applayerparserparse_LDFLAGS = $(LDFLAGS_FUZZ)
fuzz_applayerparserparse_LDADD = $(LDADD_FUZZ)
fuzz: build with dependencies on rust and c lib So that there is no need to remove the final binary, to recompile it if there has been changes in the code.
3 years ago
fuzz_applayerparserparse_DEPENDENCIES = libsuricata_c.a $(RUST_SURICATA_LIB)
fuzz: adds eight fuzz targets And ways to compile them with enable-fuzztargets at configure time Adds utility function in util-unittest-helper
8 years ago
if HAS_FUZZLDFLAGS
fuzz_applayerparserparse_LDFLAGS += $(LIB_FUZZING_ENGINE)
else
makefile: don't include the whole test/ directory Including the whole directory results in .deps files ending up in the distribution archive which shouldn't be there. Instead we have to list all the test sources individually.
6 years ago
fuzz_applayerparserparse_SOURCES += tests/fuzz/onefile.c
fuzz: adds eight fuzz targets And ways to compile them with enable-fuzztargets at configure time Adds utility function in util-unittest-helper
8 years ago
endif
fuzz: simpler way to force usage of CXX linker
7 years ago
# force usage of CXX for linker
nodist_EXTRA_fuzz_applayerparserparse_SOURCES = force-cxx-linking.cxx
fuzz: adds eight fuzz targets And ways to compile them with enable-fuzztargets at configure time Adds utility function in util-unittest-helper
8 years ago
makefile: don't include the whole test/ directory Including the whole directory results in .deps files ending up in the distribution archive which shouldn't be there. Instead we have to list all the test sources individually.
6 years ago
fuzz_siginit_SOURCES = tests/fuzz/fuzz_siginit.c
build: use a static convenience library for C code With the circular reference gone, we can now make use of a convenience library for the Suricata program as well as any other programs that depend on the same source such as the fuzzer. While its not a libtool convenience library, it serves the same purpose and is a common idiom in Make and CMake projects whereas the COMMON_SOURCES approach was more of a hack we had to resort to until the circular reference was resolved.
6 years ago
fuzz_siginit_LDFLAGS = $(LDFLAGS_FUZZ)
fuzz_siginit_LDADD = $(LDADD_FUZZ)
fuzz: build with dependencies on rust and c lib So that there is no need to remove the final binary, to recompile it if there has been changes in the code.
3 years ago
fuzz_siginit_DEPENDENCIES = libsuricata_c.a $(RUST_SURICATA_LIB)
fuzz: adds eight fuzz targets And ways to compile them with enable-fuzztargets at configure time Adds utility function in util-unittest-helper
8 years ago
if HAS_FUZZLDFLAGS
fuzz_siginit_LDFLAGS += $(LIB_FUZZING_ENGINE)
else
makefile: don't include the whole test/ directory Including the whole directory results in .deps files ending up in the distribution archive which shouldn't be there. Instead we have to list all the test sources individually.
6 years ago
fuzz_siginit_SOURCES += tests/fuzz/onefile.c
fuzz: adds eight fuzz targets And ways to compile them with enable-fuzztargets at configure time Adds utility function in util-unittest-helper
8 years ago
endif
# force usage of CXX for linker
fuzz: simpler way to force usage of CXX linker
7 years ago
nodist_EXTRA_fuzz_siginit_SOURCES = force-cxx-linking.cxx
fuzz: adds eight fuzz targets And ways to compile them with enable-fuzztargets at configure time Adds utility function in util-unittest-helper
8 years ago
makefile: don't include the whole test/ directory Including the whole directory results in .deps files ending up in the distribution archive which shouldn't be there. Instead we have to list all the test sources individually.
6 years ago
fuzz_confyamlloadstring_SOURCES = tests/fuzz/fuzz_confyamlloadstring.c
build: use a static convenience library for C code With the circular reference gone, we can now make use of a convenience library for the Suricata program as well as any other programs that depend on the same source such as the fuzzer. While its not a libtool convenience library, it serves the same purpose and is a common idiom in Make and CMake projects whereas the COMMON_SOURCES approach was more of a hack we had to resort to until the circular reference was resolved.
6 years ago
fuzz_confyamlloadstring_LDFLAGS = $(LDFLAGS_FUZZ)
fuzz_confyamlloadstring_LDADD = $(LDADD_FUZZ)
fuzz: build with dependencies on rust and c lib So that there is no need to remove the final binary, to recompile it if there has been changes in the code.
3 years ago
fuzz_confyamlloadstring_DEPENDENCIES = libsuricata_c.a $(RUST_SURICATA_LIB)
fuzz: adds eight fuzz targets And ways to compile them with enable-fuzztargets at configure time Adds utility function in util-unittest-helper
8 years ago
if HAS_FUZZLDFLAGS
fuzz_confyamlloadstring_LDFLAGS += $(LIB_FUZZING_ENGINE)
else
makefile: don't include the whole test/ directory Including the whole directory results in .deps files ending up in the distribution archive which shouldn't be there. Instead we have to list all the test sources individually.
6 years ago
fuzz_confyamlloadstring_SOURCES += tests/fuzz/onefile.c
fuzz: adds eight fuzz targets And ways to compile them with enable-fuzztargets at configure time Adds utility function in util-unittest-helper
8 years ago
endif
# force usage of CXX for linker
fuzz: simpler way to force usage of CXX linker
7 years ago
nodist_EXTRA_fuzz_confyamlloadstring_SOURCES = force-cxx-linking.cxx
fuzz: adds eight fuzz targets And ways to compile them with enable-fuzztargets at configure time Adds utility function in util-unittest-helper
8 years ago
makefile: don't include the whole test/ directory Including the whole directory results in .deps files ending up in the distribution archive which shouldn't be there. Instead we have to list all the test sources individually.
6 years ago
fuzz_decodepcapfile_SOURCES = tests/fuzz/fuzz_decodepcapfile.c
build: use a static convenience library for C code With the circular reference gone, we can now make use of a convenience library for the Suricata program as well as any other programs that depend on the same source such as the fuzzer. While its not a libtool convenience library, it serves the same purpose and is a common idiom in Make and CMake projects whereas the COMMON_SOURCES approach was more of a hack we had to resort to until the circular reference was resolved.
6 years ago
fuzz_decodepcapfile_LDFLAGS = $(LDFLAGS_FUZZ)
fuzz_decodepcapfile_LDADD = $(LDADD_FUZZ)
fuzz: build with dependencies on rust and c lib So that there is no need to remove the final binary, to recompile it if there has been changes in the code.
3 years ago
fuzz_decodepcapfile_DEPENDENCIES = libsuricata_c.a $(RUST_SURICATA_LIB)
fuzz: adds eight fuzz targets And ways to compile them with enable-fuzztargets at configure time Adds utility function in util-unittest-helper
8 years ago
if HAS_FUZZLDFLAGS
fuzz_decodepcapfile_LDFLAGS += $(LIB_FUZZING_ENGINE)
else
makefile: don't include the whole test/ directory Including the whole directory results in .deps files ending up in the distribution archive which shouldn't be there. Instead we have to list all the test sources individually.
6 years ago
fuzz_decodepcapfile_SOURCES += tests/fuzz/onefile.c
fuzz: adds eight fuzz targets And ways to compile them with enable-fuzztargets at configure time Adds utility function in util-unittest-helper
8 years ago
endif
# force usage of CXX for linker
fuzz: simpler way to force usage of CXX linker
7 years ago
nodist_EXTRA_fuzz_decodepcapfile_SOURCES = force-cxx-linking.cxx
fuzz: adds eight fuzz targets And ways to compile them with enable-fuzztargets at configure time Adds utility function in util-unittest-helper
8 years ago
fuzz: make confyaml.c an explicit source Ticket: 7181 Allows confyaml.c to be in the release archive
2 years ago
fuzz_sigpcap_SOURCES = tests/fuzz/fuzz_sigpcap.c tests/fuzz/confyaml.c
build: use a static convenience library for C code With the circular reference gone, we can now make use of a convenience library for the Suricata program as well as any other programs that depend on the same source such as the fuzzer. While its not a libtool convenience library, it serves the same purpose and is a common idiom in Make and CMake projects whereas the COMMON_SOURCES approach was more of a hack we had to resort to until the circular reference was resolved.
6 years ago
fuzz_sigpcap_LDFLAGS = $(LDFLAGS_FUZZ)
fuzz_sigpcap_LDADD = $(LDADD_FUZZ)
fuzz: build with dependencies on rust and c lib So that there is no need to remove the final binary, to recompile it if there has been changes in the code.
3 years ago
fuzz_sigpcap_DEPENDENCIES = libsuricata_c.a $(RUST_SURICATA_LIB)
fuzz: adds eight fuzz targets And ways to compile them with enable-fuzztargets at configure time Adds utility function in util-unittest-helper
8 years ago
if HAS_FUZZLDFLAGS
fuzz_sigpcap_LDFLAGS += $(LIB_FUZZING_ENGINE)
else
makefile: don't include the whole test/ directory Including the whole directory results in .deps files ending up in the distribution archive which shouldn't be there. Instead we have to list all the test sources individually.
6 years ago
fuzz_sigpcap_SOURCES += tests/fuzz/onefile.c
fuzz: adds eight fuzz targets And ways to compile them with enable-fuzztargets at configure time Adds utility function in util-unittest-helper
8 years ago
endif
# force usage of CXX for linker
fuzz: simpler way to force usage of CXX linker
7 years ago
nodist_EXTRA_fuzz_sigpcap_SOURCES = force-cxx-linking.cxx
fuzz: adds eight fuzz targets And ways to compile them with enable-fuzztargets at configure time Adds utility function in util-unittest-helper
8 years ago
fuzz: adds structure aware target so as not to fuzz libpcap and generate structure aware signatures
6 years ago
if HAS_FUZZPCAP
fuzz: make confyaml.c an explicit source Ticket: 7181 Allows confyaml.c to be in the release archive
2 years ago
fuzz_sigpcap_aware_SOURCES = tests/fuzz/fuzz_sigpcap_aware.c tests/fuzz/confyaml.c
fuzz: adds structure aware target so as not to fuzz libpcap and generate structure aware signatures
6 years ago
fuzz_sigpcap_aware_LDFLAGS = $(LDFLAGS_FUZZ)
fuzz_sigpcap_aware_LDADD = $(LDADD_FUZZ) -lfuzzpcap
fuzz: build with dependencies on rust and c lib So that there is no need to remove the final binary, to recompile it if there has been changes in the code.
3 years ago
fuzz_sigpcap_aware_DEPENDENCIES = libsuricata_c.a $(RUST_SURICATA_LIB)
fuzz: adds structure aware target so as not to fuzz libpcap and generate structure aware signatures
6 years ago
if HAS_FUZZLDFLAGS
fuzz_sigpcap_aware_LDFLAGS += $(LIB_FUZZING_ENGINE)
else
makefile: don't include the whole test/ directory Including the whole directory results in .deps files ending up in the distribution archive which shouldn't be there. Instead we have to list all the test sources individually.
6 years ago
fuzz_sigpcap_aware_SOURCES += tests/fuzz/onefile.c
fuzz: adds structure aware target so as not to fuzz libpcap and generate structure aware signatures
6 years ago
endif
# force usage of CXX for linker
nodist_EXTRA_fuzz_sigpcap_aware_SOURCES = force-cxx-linking.cxx
fuzz: adds one target with predefined rules
5 years ago
fuzz: make confyaml.c an explicit source Ticket: 7181 Allows confyaml.c to be in the release archive
2 years ago
fuzz_predefpcap_aware_SOURCES = tests/fuzz/fuzz_predefpcap_aware.c tests/fuzz/confyaml.c
fuzz: adds one target with predefined rules
5 years ago
fuzz_predefpcap_aware_LDFLAGS = $(LDFLAGS_FUZZ)
fuzz_predefpcap_aware_LDADD = $(LDADD_FUZZ) -lfuzzpcap
fuzz: build with dependencies on rust and c lib So that there is no need to remove the final binary, to recompile it if there has been changes in the code.
3 years ago
fuzz_predefpcap_aware_DEPENDENCIES = libsuricata_c.a $(RUST_SURICATA_LIB)
fuzz: adds one target with predefined rules
5 years ago
if HAS_FUZZLDFLAGS
fuzz_predefpcap_aware_LDFLAGS += $(LIB_FUZZING_ENGINE)
else
fuzz_predefpcap_aware_SOURCES += tests/fuzz/onefile.c
endif
# force usage of CXX for linker
nodist_EXTRA_fuzz_predefpcap_aware_SOURCES = force-cxx-linking.cxx
fuzz: adds structure aware target so as not to fuzz libpcap and generate structure aware signatures
6 years ago
endif
fuzz: add target for DecodeBase64 Task 6050
3 years ago
fuzz_decodebase64_SOURCES = tests/fuzz/fuzz_decodebase64.c
fuzz_decodebase64_LDFLAGS = $(LDFLAGS_FUZZ)
fuzz_decodebase64_LDADD = $(LDADD_FUZZ)
fuzz: build with dependencies on rust and c lib So that there is no need to remove the final binary, to recompile it if there has been changes in the code.
3 years ago
fuzz_decodebase64_DEPENDENCIES = libsuricata_c.a $(RUST_SURICATA_LIB)
fuzz: add target for DecodeBase64 Task 6050
3 years ago
if HAS_FUZZLDFLAGS
fuzz_decodebase64_LDFLAGS += $(LIB_FUZZING_ENGINE)
else
fuzz_decodebase64_SOURCES += tests/fuzz/onefile.c
endif
# force usage of CXX for linker
nodist_EXTRA_fuzz_decodebase64_SOURCES = force-cxx-linking.cxx
makefile: don't include the whole test/ directory Including the whole directory results in .deps files ending up in the distribution archive which shouldn't be there. Instead we have to list all the test sources individually.
6 years ago
fuzz_mimedecparseline_SOURCES = tests/fuzz/fuzz_mimedecparseline.c
build: use a static convenience library for C code With the circular reference gone, we can now make use of a convenience library for the Suricata program as well as any other programs that depend on the same source such as the fuzzer. While its not a libtool convenience library, it serves the same purpose and is a common idiom in Make and CMake projects whereas the COMMON_SOURCES approach was more of a hack we had to resort to until the circular reference was resolved.
6 years ago
fuzz_mimedecparseline_LDFLAGS = $(LDFLAGS_FUZZ)
fuzz_mimedecparseline_LDADD = $(LDADD_FUZZ)
fuzz: build with dependencies on rust and c lib So that there is no need to remove the final binary, to recompile it if there has been changes in the code.
3 years ago
fuzz_mimedecparseline_DEPENDENCIES = libsuricata_c.a $(RUST_SURICATA_LIB)
fuzz: adds eight fuzz targets And ways to compile them with enable-fuzztargets at configure time Adds utility function in util-unittest-helper
8 years ago
if HAS_FUZZLDFLAGS
fuzz_mimedecparseline_LDFLAGS += $(LIB_FUZZING_ENGINE)
else
makefile: don't include the whole test/ directory Including the whole directory results in .deps files ending up in the distribution archive which shouldn't be there. Instead we have to list all the test sources individually.
6 years ago
fuzz_mimedecparseline_SOURCES += tests/fuzz/onefile.c
fuzz: adds eight fuzz targets And ways to compile them with enable-fuzztargets at configure time Adds utility function in util-unittest-helper
8 years ago
endif
# force usage of CXX for linker
fuzz: simpler way to force usage of CXX linker
7 years ago
nodist_EXTRA_fuzz_mimedecparseline_SOURCES = force-cxx-linking.cxx
build: wrap fuzz targets in guard to fix 'make tags'
7 years ago
endif
fuzz: adds eight fuzz targets And ways to compile them with enable-fuzztargets at configure time Adds utility function in util-unittest-helper
8 years ago
autotools: cleanup Remove most of the CFLAGS updates from configure. Flags are now (mostly) set in AM_CLFLAGS. Update all -DBLAH additions to CFLAGS to use AC_DEFINE([BLAH], ...) Improve Lua vs LuaJIT checking. Improve the configure output a bit. Lots of smaller cleanups.
11 years ago
# default CFLAGS
compiler: more strict compiler warnings Set flags by default: -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wwrite-strings -Wcast-align -Wbad-function-cast -Wformat-security -Wno-format-nonliteral -Wmissing-format-attribute -funsigned-char Fix minor compiler warnings for these new flags on gcc and clang.
10 years ago
AM_CFLAGS = ${OPTIMIZATION_CFLAGS} ${GCC_CFLAGS} ${CLANG_CFLAGS} \
build: pass LOCAL_STATE_DIR through autoconf.h Helps tooling like cppcheck, clang-tidy.
2 years ago
${SECCFLAGS} ${PCAP_CFLAGS} \
compiler: more strict compiler warnings Set flags by default: -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wwrite-strings -Wcast-align -Wbad-function-cast -Wformat-security -Wno-format-nonliteral -Wmissing-format-attribute -funsigned-char Fix minor compiler warnings for these new flags on gcc and clang.
10 years ago
-Wall -Wno-unused-parameter -Wmissing-prototypes -Wmissing-declarations \
-Wstrict-prototypes -Wwrite-strings -Wbad-function-cast \
-Wformat-security -Wno-format-nonliteral -Wmissing-format-attribute \
-funsigned-char
autotools: cleanup Remove most of the CFLAGS updates from configure. Flags are now (mostly) set in AM_CLFLAGS. Update all -DBLAH additions to CFLAGS to use AC_DEFINE([BLAH], ...) Improve Lua vs LuaJIT checking. Improve the configure output a bit. Lots of smaller cleanups.
11 years ago
# different flags for different cases
if DEBUG
AM_CFLAGS += -ggdb -O0
endif
build cuda modules with make
17 years ago
autotools: cleanup Remove most of the CFLAGS updates from configure. Flags are now (mostly) set in AM_CLFLAGS. Update all -DBLAH additions to CFLAGS to use AC_DEFINE([BLAH], ...) Improve Lua vs LuaJIT checking. Improve the configure output a bit. Lots of smaller cleanups.
11 years ago
AM_LDFLAGS = ${SECLDFLAGS}
Initial add of the files.
19 years ago
Add suricata unittests to 'make check' This patch adds a run of suricata's unittests to 'make check'
16 years ago
if BUILD_UNITTESTS
autotools: fix duplicate check command in Makefile. It seems that check target can not be used in Makefile.am. Using check-am fix a make failure.
16 years ago
check-am:
autotools: use builddir instead of srcdir srcdir is supposed to be read-only when running distcheck so it is better to create the log directory in builddir.
13 years ago
-mkdir $(top_builddir)/qa/log/
$(top_builddir)/src/suricata -u -l $(top_builddir)/qa/log/
-rm -rf $(top_builddir)/qa/log
Add suricata unittests to 'make check' This patch adds a run of suricata's unittests to 'make check'
16 years ago
endif
Fix latest build-info modification The creation of build-info.h should have been made in build directory and not in source directory. This should fix changes introduced in #738.
14 years ago
distclean-local:
-rm -rf $(top_builddir)/src/build-info.h