suricata

Commit Graph

Author	SHA1	Message	Date
Sascha Steinbiss	e2dbdd7fd5	ikev1: add ikev1 parser	4 years ago
Eric Leblond	0dba1b09de	suricata: improve list keywords Exit with error if a keyword is not supported or not existing and display a message.	4 years ago
Jeff Lucovsky	dabd50eeee	detect: Register icmpv4 header	5 years ago
Philippe Antoine	1422b18a99	http2: initial support	5 years ago
Sascha Steinbiss	c31360070b	rust/mqtt: add MQTT parser	5 years ago
Philippe Antoine	1569f3e349	transform: adds url_decode keyword Fixes https://redmine.openinfosecfoundation.org/issues/2689 Adds a new source file to handle this keyword. And modifies documentation, Makefile, and registration accordingly. url_decode decodes url-encoded data, ie replacing '+' with space and '%HH' with its value.	5 years ago
Victor Julien	6ab323d323	detect: hide RegisterTests behind ifdef UNITTESTS Update all callers to more aggressively use UNITTESTS guards as well.	5 years ago
Victor Julien	2145cf99a3	detect/config: initial version	5 years ago
Jeff Lucovsky	fb409664d2	detect: byte_math support	5 years ago
Vadym Malakhatko	216a75c522	detect: add (mpm) hassh keywords Match on Hassh using ssh.hassh, ssh.hassh.server, ssh.hassh.string, ssh.hassh.server.string keywords, e.g: alert ssh any any -> any any (msg:"match SSH hash"; ssh.hassh; content:"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; sid:1000010;) alert ssh any any -> any any (msg:"match SSH hash-server"; ssh.hassh.server; content:"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; sid:1000020;) alert ssh any any -> any any (msg:"match SSH hash-string"; ssh.hassh.string; content:"none,zlib@openssh.com,zlib"; sid:1000030;) alert ssh any any -> any any (msg:"match SSH hash-server-string"; ssh.hassh.server.string; content:"umac-64-etm@openssh.com,umac-128-etm@openssh.com,"; sid:1000040;)	5 years ago
Jeff Lucovsky	a0b81b3c9d	detect: Register pcrexform This commit registers the `pcrexform` transform.	5 years ago
Victor Julien	26bcc97515	detect/keywords: dynamic version part of doc URL	5 years ago
Frank Honza	1c8943dedd	add RFB parser This commit adds support for the Remote Framebuffer Protocol (RFB) as used, for example, by various VNC implementations. It targets the official versions 3.3, 3.7 and 3.8 of the protocol and provides logging for the RFB handshake communication for now. Logged events include endpoint versions, details of the security (i.e. authentication) exchange as well as metadata about the image transfer parameters. Detection is enabled using keywords for: - rfb.name: Session name as sticky buffer - rfb.sectype: Security type, e.g. VNC-style challenge-response - rfb.secresult: Result of the security exchange, e.g. OK, FAIL, ... The latter could be used, for example, to detect brute-force attempts on open VNC servers, while the name could be used to map unwanted VNC sessions to the desktop owners or machines. We also ship example EVE-JSON output and keyword docs as part of the Sphinx source for Suricata's RTD documentation.	5 years ago
Philippe Antoine	1cd314c500	detect: adds icmpv6.mtu keyword	5 years ago
Philippe Antoine	8396333493	detect: adds icmpv6.hdr keyword	5 years ago
Giuseppe Longo	e06291922f	detect/sip.response_line: add sticky buffer Matches on response line field in SIP.	6 years ago
Giuseppe Longo	17de4a8023	detect/sip.request_line: add sticky buffer Matches on request line field in SIP.	6 years ago
Giuseppe Longo	8939ece538	detect/sip.stat_msg: add sticky buffer Matches on status msg field in SIP.	6 years ago
Giuseppe Longo	bd2219cac6	detect/sip.stat_code: add sticky buffer Matches on status code field in SIP.	6 years ago
Giuseppe Longo	8454122eb2	detect/sip.protocol: add sticky buffer Matches on protocol field in SIP.	6 years ago
Giuseppe Longo	2661c5b298	detect/sip.uri: add sticky buffer Matches on uri field in SIP.	6 years ago
Giuseppe Longo	424eead8c0	detect/sip.method: add sticky buffer Matches on uri field in SIP.	6 years ago
Jason Ish	d79c23baa3	dns/detect: dns.opcode keyword Add a rule keyword, dns.opcode to match on the opcode flag found in the DNS request and response headers. Only exact matches are allowed with negation. Examples: - dns.opcode:4; - dns.opcode:!1;	6 years ago
Jeff Lucovsky	7808b946e3	detect/transform: add dotprefix keyword	6 years ago
Victor Julien	317376f59d	datasets: match on lists of data Datasets are sets/lists of data that can be accessed or added from the rule language. This patch implements 3 data types: 1. string (or buffer) 2. md5 3. sha256 The patch also implements 2 new rule keywords: 1. dataset 2. datarep The dataset keyword allows matching against a list of values to see if it exists or not. It can also add the value to the set. The set can optionally be stored to disk on exit. The datarep support matching/lookups only. With each item in the set a reputation value is stored and this value can be matched against. The reputation value is unsigned 16 bit, so values can be between 0 and 65535. Datasets can be registered in 2 ways: 1. through the yaml 2. through the rules The goal of this rules based approach is that rule writers can start using this without the need for config changes. A dataset is implemented using a thash hash table. Each dataset is its own separate thash.	6 years ago
Victor Julien	24f0092b72	detect: add ipv6.hdr sticky buffer Inspects IPv6 header and extension headers.	6 years ago
Victor Julien	4ac327f5b5	detect/ipv4: add ipv4.hdr sticky buffer	6 years ago
Victor Julien	ac694b089a	detect: add udp.hdr sticky buffer	6 years ago
Victor Julien	bdf53f449c	detect/tcp: rename tcp keyword files	6 years ago
Victor Julien	35be8385eb	detect: tcp.hdr sticky buffer Sticky buffer to inspect the TCP header.	6 years ago
Victor Julien	66648df099	detect: add tcp.mss keyword Allows matching on TCP option MSS. Syntax: tcp.mss:<value>; tcp.mss:<value1>-<value2>; tcp.mss:<op><value>; Operator can be: >, <.	6 years ago
Pierre Chifflier	9dfec7e734	SNMP: add the "snmp.pdu_type" detection keyword	6 years ago
Pierre Chifflier	e1dd19a0eb	SNMP: add the "snmp.community" detection keyword	6 years ago
Pierre Chifflier	aa608e0ca2	SNMP: add the "snmp.version" detection keyword	6 years ago
Mats Klepsland	0b489f329c	detect: add (mpm) keyword ja3s.string Match on JA3S string using ja3s.string keyword, e.g: alert tls any any -> any any (msg:"ja3s.string test"; ja3s.string; content:"10-11-12"; sid:1;)	6 years ago
Mats Klepsland	80cee50916	detect: add (mpm) keyword ja3s.hash Match on JA3S hash using ja3s.hash keyword, e.g: alert tls any any -> any any (msg:"ja3s.hash test"; ja3s.hash; content:"b26c652e0a402a24b5ca2a660e84f9d5"; sid:1;)	6 years ago
Mats Klepsland	ba857e9739	detect: add tls.certs keyword Add keyword to do "raw" matching on each of the certificates in the TLS certificate sticky buffer. Example: alert tls any any -> any any (msg:"tls.certs test"; tls.certs; \ content:"\|01 02 03 04\|"; sid:1;)	6 years ago
Victor Julien	84da0376fb	detect/http.host: rename file for consistency	6 years ago
Victor Julien	ccdafe6697	detect/http-server-body: move tests to tests/	7 years ago
Victor Julien	64987f36fb	detect/file-data: move tests into tests/	7 years ago
Victor Julien	9a8092249e	detect/http-client-body: move tests into tests/	7 years ago
Victor Julien	76fd666cad	detect/http_raw_header: move tests into tests/	7 years ago
Victor Julien	ab027cb481	detect/http_cookie: move tests into tests/	7 years ago
Victor Julien	2f342da048	detect/http_stat_code: move tests into tests/	7 years ago
Victor Julien	5dfba01b2e	detect/http_stat_msg: move tests to tests/	7 years ago
Victor Julien	b469938998	detect/http_raw_host: move raw into regular host logic	7 years ago
Victor Julien	dc43f35427	detect/http_host: move tests into tests/	7 years ago
Victor Julien	cb332b4cda	detect/http_method: move all tests into tests/	7 years ago
Victor Julien	0a405e27a0	detect/http_raw_uri: code reorganization Move registration into http_uri logic, move tests into the other uri tests. Switch to v2 mpm/inspect APIs.	7 years ago
Victor Julien	10e2731f18	detect/http-uri: move tests into tests/	7 years ago

1 2

74 Commits (02f98796a76cc7750ca9c30829cc26b90ac256b2)