aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
5,729 Commits
8 Branches
174 Tags
255 MiB
main
main-8.0.x
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.7
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '04ccfda639'
${ noResults }
Commit Graph

5276 Commits (04ccfda6398820ccc570497ea76aea5966dc368c)

Author SHA1 Message Date
Victor Julien 5c880377ae detect: hostbits keyword 
Per host bit similar to 'flowbits'.

Initial code that uses just the 'src' ip for the operations.
 12 years ago
Victor Julien 99ae643e4e ippair: track ippairs, enable tests 12 years ago
Alexander Gozman 45ba20bcb0 DetectAddressParseString(): fix IPv6 address handling 12 years ago
Eric Leblond 605ef33972 runmodes: improve listing output 
This patch removes some multiple line displayed before the
information about unix socket mode.
 12 years ago
Eric Leblond e5ae808b0f runmodes: fix typo in output 12 years ago
Eric Leblond ef3290bb2e flow-manager: don't set cpu affinity twice 
It is already set in the thread creation function.
 12 years ago
Victor Julien 8e83d0073e stream: fix bad last_ack update leading to gaps 
A bad last_ack update where it would be set beyond next_seq could
lead to rejection of valid segments and thus stream gaps.

Update tests to reflect new last_ack/next_seq behaviour.
 12 years ago
Victor Julien 4e177bc9d6 detect-state: cleanups and comments 12 years ago
Victor Julien 304c711a27 detect-state: use f->protomap instead of FlowGetProtoMapping(f->proto) 12 years ago
Victor Julien e1efa7a0b5 detect-flowbits: locking update 
Make matches that can be in the POSTMATCH list aware of the lock hint.
 12 years ago
Victor Julien 4609495c60 detect-flowint: conditional locking 12 years ago
Victor Julien 5111aa2ec0 detect-state: handle 'post match' locking 
The post match list was called with an unlocked flow until now.
However, recent de_state handling updates changed this. The stateful
detection code can now call the post match functions while keeping
the flow locked. The normal detection code still calls it with an
unlocked flow.

This patch adds a hint to the DetectEngineThreadCtx called
'flow_locked' that is set to true if the caller has already locked
the flow.
 12 years ago
Victor Julien 9bcb02119f detect-flowint: fix unlocked flow access 
Some of the access to the flow and to structures retrieved from the
flow was unlocked.

This patch changes the logic to be wrapped in lock calls.
 12 years ago
Victor Julien 18f0351d9b detect-state: fix profiling 12 years ago
Victor Julien 0b262cbfda dns: optimize tx list walks 
The detection engine and log engines can walk the tx list indirectly,
by looping AppLayerParserGetTx. This would lead to new list walks in
the DNS tx list though. Leading to bad performance.

This patch stores the last returned tx and uses that to determine if
the next tx is what we need next. If so, we can return that w/o list
walk.
 12 years ago
Victor Julien 0704ece4d7 detect-reload: enable unconditionally 
Reloading is available unconditionally now.
 12 years ago
Victor Julien 724c7044e1 detect-reload: 0 detect threads is no error 
The reload code would consider 0 detect threads to be an error,
but it's not in case of unix socket mode.
 12 years ago
Victor Julien 7c9e015748 unix-socket: implement reload-rules 
Implement the reload-rules unix socket command. The unix command
thread signals the main thread to do the reload and it waits for
it to complete.
 12 years ago
Victor Julien 71d01f06b9 detect reload: load config 
Load the YAML into a prefix "detect-engine-reloads.N" where N is the
reload counter. This way we can load the updated config w/o overwriting
the current one.
 12 years ago
Victor Julien b51075e804 detect: remove config at prefix 
Remove config at prefix when freeing a detect engine.
 12 years ago
Victor Julien 85e12f2bc6 rule vars: support prefix 
Support the detection engine's prefix when retrieving rule vars.
 12 years ago
Victor Julien 0bc27c7dc7 rule-vars: take detect engine as arg 12 years ago
Victor Julien 3083f51cc6 detect:pass DetectEngineCtx to port parsing 
Preparation for prefix handling in port parsing.
 12 years ago
Victor Julien 2be9ccfe9c detect: pass DetectEngineCtx to address parsing 
Preparation for prefix handling in address parsing.
 12 years ago
Victor Julien 7108085d33 detect: initialize detection engine by prefix 
Initalize detection engine by configuration prefix.

    DetectEngineCtxInitWithPrefix(const char *prefix)

Takes the detection engine configuration from:
<prefix>.<config>

If prefix is NULL the regular config will be used.

Update sure that DetectLoadCompleteSigPath considers the prefix when
retrieving the configuration.
 12 years ago
Victor Julien 97d77e3540 conf: add ConfYamlLoadFileWithPrefix 
Add function to load a yaml file and insert it into the conf tree at
a specific prefix.

Example YAML:
somefile: myfile.txt

If loaded using ConfYamlLoadFileWithPrefix with prefix "myprefix", it
can be retrieved by the name of "myprefix.somefile".
 12 years ago
Victor Julien a80cc696d7 detect: allow det_ctx->de_ctx to be NULL 
When freeing det_ctx, allow de_ctx to be NULL.
 12 years ago
Victor Julien c9a8262ccf detect: reload thread init cleanup 
Rename the thread init function DetectEngineThreadCtxInitForLiveRuleSwap
to DetectEngineThreadCtxInitForReload and change it's logic to take the
new detection engine as argument and let it return the
DetectEngineThreadCtx or NULL on error.

The old approach used the thread init API format, but it wasn't used in
that way.
 12 years ago
Victor Julien 55e7370fc5 detect reload: allow master update during reload 
Add DetectEngineReference, which takes a reference to a detect engine,
and make DetectEngineThreadCtxInitForLiveRuleSwap use it. This way
reload will not depend on master staying the same. This allows master
to be updated in between w/o affecting the reload that is in progress.
 12 years ago
Victor Julien b1c54a8673 detect: remove old live reload implementation 
Remove code that ran the reload in it's own thread. Simplify the
signal handling.
 12 years ago
Victor Julien 0c263105cd detect: move reload into main loop 
Use new DetectEngineReload() function. It's called from the main loop
instead of it being spawned into it's own temporary thread. This greatly
simplifies the signal handling.

An added advantage is that this seems to improve the memory usage.

Related to bug #1358
 12 years ago
Victor Julien e7882da178 detect: introduce 'minimal' detect engine 
The minimal detect engine has only the minimal memory use and setup
time. It's to be used for 'delayed' detect where the first detection
engine is essentially empty.

The threads setup are also minimal.
 12 years ago
Victor Julien f4617d5357 threading: remove 'dummy' slot logic 
Now that delayed detect is not using it anymore, the dummy logic
can be removed.
 12 years ago
Victor Julien b0cb4c17ec detect: unify delayed detect and reload 
Instead of threading logic with dummy slots and all, use the regular
reload logic for delayed detect.

This means we pass a empty detect engine to the threads and then
reload (live swap) it as soon as the engine is running.
 12 years ago
Victor Julien 38b349af1e runmodes: remove DetectEngineCtx passing from API 
No longer pass a pointer to the current detection engine to the
runmode API calls.

Note: breaks delayed detect. Will be fixed in a future commit.
 12 years ago
Victor Julien b038b6a2f8 unittests: add exception to detect engine setup 
Add code to allow for unittests not following the complete api.

Update replace tests as they don't use the unittests runmode that
powers the workaround based on RunmodeIsUnittests().
 12 years ago
Victor Julien d66fa1add1 detect: update detect engine management 
Update detect engine management to make it easier to reload the detect
engine.

Core of the new approach is a 'master' ctx, that keeps a list of one or
more detect engines. The detect engines will not be passed to any thread
directly, but instead will only be accessed through the detect engine
thread contexts. As we can replace those atomically, replacing a detect
engine becomes easier.

Each thread keeps a reference to its detect context. When a detect engine
is replaced or removed, it's added to a free list. Once its reference
count reaches 0, it is freed.
 12 years ago
Victor Julien 092ddc1853 detect: no exit on reference/classification errors 
Don't exit on errors during classification and reference parsing.

Add some suppression of error messages when in unittest mode.
 12 years ago
Victor Julien 49bad2cfba detect: consolidate more setup into DetectEngineCtxInit 
Loading of classifications, references and action order was done
unconditionally, so can be done in one place.
 12 years ago
Victor Julien 69f99245c5 unix-command: fix duplicate registration error msg 12 years ago
Victor Julien 60a49657df Bug 1401: on midstream pickup, fix packet direction 
On midstream SYN/ACK pickups, we would flip the direction of packets
after the first. This meant the first (pickup) packet's direction
was wrong.

This patch fixes that.
 12 years ago
Jason Ish ee7e813256 Bug 1417 - Record sequence nodes as sequences. 
Nodes that are sequences weren't being recorded as such, causing
rules to fail to load.

Change sequence test name to reflect better what it tests, and
test that the sequence node is detected as a sequence.
 12 years ago
Victor Julien e250040b72 detect-state: implement tx state reset for reload 
In case of Detect Reload, we need to reset active tx' state.
 12 years ago
Victor Julien da3e8ad8f6 detect-state: split flow and tx state 
Use separate data structures for storing TX and FLOW (AMATCH) detect
state.

- move state storing into util funcs
- remove de_state_m
- simplify reset state logic on reload
 12 years ago
Victor Julien 840efe17fe modbus: tx de_state 12 years ago
Victor Julien e984a57203 smtp: tx de_state 12 years ago
Victor Julien 2a23627a82 dns: implement tx de_state 12 years ago
Victor Julien 774bb90351 http: clean up tx destate at tx destroy 12 years ago
Victor Julien 6279da0fbd http: support per TX destate storage 12 years ago
Victor Julien 1cf02560c8 app-layer: per tx destate 
Add API calls for storing detection state in the TX.
 12 years ago
Victor Julien 866d9684ea detect-state: fix profiling 12 years ago
Victor Julien 7e75279977 detect-state: various cleanups 12 years ago
Victor Julien eec22ce19b detect-state: rip per sig detect out of ContinueDetect 12 years ago
Victor Julien bf818b8fb2 detect-state: remove DeStateResetFileInspection 
It was effectively unused.
 12 years ago
Victor Julien 206f9d4010 detect-state: remove redundant code 12 years ago
Victor Julien e390e24a7c detect-state: add helper to test state 
Add little helper function StateIsValid() to test if the state
can be inspected safely.

Cleans up stateful detection loops.
 12 years ago
Victor Julien 072ae12771 detect-state: add helper to indicate last tx 
Add little helper to indicate current tx is that last we have.
 12 years ago
Victor Julien b710f2dd59 detect-state: cleanup ContinueDetection 
Only lock f->de_state->m when we start to access it. So after
declaration and initialization of local vars.
 12 years ago
Victor Julien 54cb2b6877 detect-state: cleanup retvals 
Use DETECT_ENGINE_INSPECT_SIG_* instead of 0, 1, 2 and 3.
 12 years ago
Victor Julien 97cab030d7 modbus: shrink data structure 12 years ago
Victor Julien 9f1b417660 file: don't 'close' file if we need to track it 12 years ago
Victor Julien 6723d03c7e http: add inspection engine for http request line 
No MPM though.
 12 years ago
Victor Julien c0f265fd82 http: fix stat_msg and stat_code state tracking 12 years ago
Victor Julien 5b8c94db30 Remove spinning PacketPoolWait 
PacketPoolWait in autofp can wait for considerable time. Until now
it was essentially spinning, keeping the CPU 100% busy.

This patch introduces a condition to wait in such cases.

Atomically flag pool that consumer is waiting, so that we can sync
the pending pool right away instead of waiting for the
MAX_PENDING_RETURN_PACKETS limit.
 12 years ago
Victor Julien 2d7f79a62b drop json log: log out 'drop' signature 
If no normal sig was logged as the 'drop' reason, try the stored
drop signature instead, this will also log out 'noalert' sigs.
 12 years ago
Victor Julien 2e754ca6fa drop json: make alerts logging optional 
Make logging out alerts that caused the drop optional.
 12 years ago
Victor Julien 6b172bb010 drop json: add sids (if applicable) 
If a drop is caused by a SID match, add it to the drop record.
 12 years ago
Victor Julien 8a97bb0d04 alert json: move alert info into function 
Move adding the alert info (sid,rev,gid,etc) into it's own function,
so it can be called from other outputs as well.
 12 years ago
Victor Julien e9857200b3 detect: set action from utility function 
Set actions that are set directly from Signatures using the new
utility function DetectSignatureApplyActions. This will apply
the actions and also store info about the 'drop' that first made
the rule drop.
 12 years ago
Victor Julien c914f7bcdc detect: cleanup, remove unused order_id 
No longer used, so remove.
 12 years ago
Eric Leblond b8e7d3a259 flow-timeout: fix init of pseudo packet 
The code was not checking if we had enough room in the direct
data. In case default_packet_size was set really small, this was
resulting in data being written over the data and causing a crash.

The patch fixes the issue by forcing an allocation if the direct
data size in the Packet is to small.
 12 years ago
Eric Leblond e138a2ac1e decode: introduce PacketCallocExtPkt function 
In flow timeout handling we need a function that allocate and blank
a place that will be used to put constructed packet data. This new
function has no other goal.
 12 years ago
Jason Ish ab1d69fc4e When re-opening a log file on HUP, always append. 
This will prevent log files that have not been rotated by some
external tool from being deleted, but log files that were
rotated (moved out of the way) will be re-opened.

This is a better default behaviour, especially when not all
log files are rotated at the same time.

Thanks to iro on IRC.
 12 years ago
Jason Ish 6ed246c041 Don't attempt to load the rule files if the rule-files configuration 
node is not a sequence.  Instead log a warning as this is usually
a configuration error.
 12 years ago
Jason Ish a243a42bdf New function to test if a configuration node is a sequence or not. 12 years ago
Eric Leblond 290b01f95e af-packet: don't unlock twice the bpf mutex 12 years ago
Eric Leblond 47d9c7b211 json-alert: use getter for appstate 12 years ago
Eric Leblond 54b13851cc flow: constify getters param 
Some potential callers are already using constified values so it
is good to do it.
 12 years ago
Eric Leblond 881f32cc02 json-alert: add SSH fields in alert logging 12 years ago
Eric Leblond c1970a3655 json-ssh: export logging function 
It will be use in alert logging to display SSH information.
 12 years ago
Eric Leblond 180faece7c json-alert: log tls info in alert 
This patch adds the capabilities to log the TLS information the
same way it is currently possible to do with HTTP. As it is
quite hard to read ASN.1 directly in the stream, this will help
people to understand why suricata is firing on alert relative
to TLS.
 12 years ago
Eric Leblond 22182e7a84 json-tls: refactor to export logging function 
To be able to add TLS data in alert we need to do the same as what
is done with HTTP ie export the logging functions.
 12 years ago
Ken Steele fb0ecaba05 Inject pseudo packet periodically when there is not traffic in mPIPE. 
To prevent pseudo packets from not being processed when there is no traffic,
inject a pseudo packet if no traffic is seen by a thread for ~100ms.
 12 years ago
Victor Julien 20b9849999 util-magic: make unittests less specific 
So they pass on CentOS 5.11 as well.
 12 years ago
Victor Julien ec2be2643b app-layer: init flow in tests 12 years ago
Eric Leblond ee7422de0a pcap-file: add missing atomic init 
It is mandatory to init all atomic to avoid problem on system
without atomic support.
 12 years ago
Eric Leblond ed147d3b91 runmode-pcap-file: suppress useless include 12 years ago
Victor Julien ae6ef9acb4 flow-manager: init global atomics 12 years ago
Victor Julien ae8f2a4e62 stream: fix unittests wrt flow 12 years ago
Victor Julien 256388325d Fix compiler warning on CentOS 5.11 
cc1: warnings being treated as errors
app-layer-smtp.c: In function ‘SMTPParseCommandBDAT’:
app-layer-smtp.c:908: warning: dereferencing type-punned pointer will break strict-aliasing rules
 12 years ago
Eric Leblond bed5b28412 util-ioctl: don't build code RX ring on old system 
If ETHTOOL_GRXRINGS is undefined we will not be able to build the
RX rings code. So we can make the build conditional to the
definition of ETHTOOL_GRXRINGS.
 12 years ago
Victor Julien e78e33a428 http: add event for suspicious method delimeter 
Add event and rule for suspicious delim(s) between method and uri.

Add unittests as well.
 12 years ago
Victor Julien 5ad7198dc0 http: add libhtp uri warning event 
Add event for libhtp warning added 0.5.17 for URI's with suspicious
delimeters.
 12 years ago
Victor Julien 67d80c36b4 stream: init global config after flow engine 
Stream depends on flow engine.
 12 years ago
Victor Julien e90714afd6 http: remove unused and broken 'content-len' logic 
The HTTP tracking code would parse the content lenght and store it
in the TX user data. It didn't take the possibility or errors into
account though, leading to a possible negative int being cases to
unsigned int. Luckily, the result was unused.

This patch simply removes the offending code.

Reported-by: The Yahoo pentest team
 12 years ago
Victor Julien 647985d20d dcerpc: don't exit() on malloc failure 
In 2 places we would exit() if malloc failed. We should never exit in
such cases. This patch silently handles it.
 12 years ago
Victor Julien 5cd7bb2f14 dcerpc: fix error handling for alloc errors 
Fix error handling of stub parsers. In case of SCRealloc error the
function would return a non-error code. This could possibly lead to
memory corruption.

Reported-By: The Yahoo pentest team
 12 years ago
Victor Julien 7426a9c645 flow: make TCP reuse handling in flow engine optional 
In case of autofp (or more general, when flow and stream engine
run in different threads) the flow engine should not trigger a flow
reuse as this can lead to race conditions between the flow and the
stream engine.

In such cases, the flow engine can be far ahead of the stream engine
as packets are in a queue between the threads.

Observed:

Flow engine tags packet 10 as start of new flow. Flow is tagged as
'reused'.

Stream engine evaluates packet 5 which belongs to the old flow. It
rejects the flow as it's tagged 'reused'. Attaches packet 5 to the
new flow which is wrong.

Solution:

This patch connects the flow engines handling of reuse cases to
the runmode. It hooks into the RunmodeSetFlowStreamAsync() call to
notify the flow engine that it shouldn't handle the reuse.
 12 years ago
Victor Julien d78be75b9f tcp reuse: don't double 'reuse' 
If the flow engine already reused a flow then the stream engine
won't have to do the same.
 12 years ago
Victor Julien 6ad53627de flow: tag first packet in each direction 
Set a flowflag for the first packet in each direction:

FLOW_PKT_TOSERVER_FIRST and FLOW_PKT_TOCLIENT_FIRST
 12 years ago