aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
18,314 Commits
8 Branches
174 Tags
256 MiB
main-8.0.x
main
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.7
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '09e50ac3f4'
${ noResults }
Commit Graph

59 Commits (09e50ac3f4295fa9e1978356352b03a5a2062900)

Author SHA1 Message Date
Eric Leblond 8ae7054f1f decode/tcp: fix some macros 
Ticket: #7509
 2 years ago
Victor Julien 13281109e3 decode/tcp: reduce TCPVars by turning bools into bitfields 
To reduce Packet size and make similar fields follow the same pattern.

Ticket: #6938.
 3 years ago
Victor Julien 68804b8c4b decode/tcp: move tcph into L4 packet data 
To reduce Packet size.

Ticket: #6938.
 3 years ago
Victor Julien 6b8093d7b8 decode/tcp: reduce size needed for SACK tracking 
No longer use a pointer, but rather an offset.

Part of effort to make Packet more compact.

Ticket: #6938.
 3 years ago
Victor Julien 81c4b10dc8 decode/tcp: minor struct layout optimization 
Part of effort to make Packet more compact.

Ticket: #6938.
 3 years ago
Victor Julien 7be0678c3a decode/tcp: reduce size needed for tracking WSCALE 
Part of effort to make Packet more compact.

Ticket: #6938.
 3 years ago
Victor Julien 6cab2480e5 decode/tcp: reduce space needed for tracking TFO 
Part of effort to make Packet more compact.

Ticket: #6938.
 3 years ago
Victor Julien 6a23fafa5f decode/tcp: reduce space needed for MSS tracking 
Part of effort to make Packet more compact.

Ticket: #6938.
 3 years ago
Victor Julien 9632c2f570 decode/tcp: optimize SACKOK storage 
Take less space in the TCPVars for tracking if SACKOK is set.

Reduces size by 16 bytes.

Ticket: #6938.
 3 years ago
Victor Julien 561b81dd9e decode: don't clear computed csums twice 
Already done in a generic way by PACKET_RESET_CHECKSUMS.
 3 years ago
Victor Julien 7c90144d19 decode/tcp: no need to pack the structure 3 years ago
Jason Ish 44388f1b69 src: make include guards more library friendly 
Include guards for libraries should use a prefix that is meaningful for
the library to avoid conflicts with other user code. For Suricata, use
SURICATA.

Additionally, remove the pattern of leading and trailing underscores as
these are reserved for the language implementation per the C and C++
standards.
 3 years ago
Victor Julien d03773840b stream: track packet flags in packet 
These flags can then later be used by stream logging.
 4 years ago
Victor Julien f5bd55dac8 decode/tcp: allow 4 byte TFO with 2 byte cookie 4 years ago
Victor Julien 002b335b4a decode/checksums: constify pointer args 5 years ago
Philippe Antoine b3ab126394 util: fix int warnings 
Ticket: 4516
 5 years ago
Victor Julien 50e2b973ee stream/tcp: handle RST with MD5 or AO header 
Special handling for RST packets if they have an TCP MD5 or AO header option.
The options hash can't be validated. The end host might be able to validate
it, as it can have a key/password that was communicated out of band.

The sender could use this to move the TCP state to 'CLOSED', leading to
a desync of the TCP session.

This patch builds on top of
843d0b7a10 ("stream: support RST getting lost/ignored")

It flags the receiver as having received an RST and moves the TCP state
into the CLOSED state. It then reverts this if the sender continues to
send traffic. In this case it sets the following event:

    stream-event:suspected_rst_inject;

Bug: #4710.
 5 years ago
Jeff Lucovsky 1eeb96696b general: Cleanup bool usage 6 years ago
Jeff Lucovsky f8fef0dd05 decode/tcp: Improved handling of TFO options 
This commit improves handling of TCP fast open options
- Option length must be in [6, 18]
- Option length must be an even value
 6 years ago
Jeff Lucovsky be4c6b85de general: Convert _Bool to bool 
This commit addresses task 3167 and changes usages of '_Bool` to `bool`.
The latter is included from `suricata-common.h`
 7 years ago
Victor Julien 579cc9f02b const: constify decoder, app-layer, detect funcs 7 years ago
Victor Julien 8f8581beda decode/tcp: TCP fast open option decoding 
Support both regular TFO and TFO as part of the experimental
options support.
 7 years ago
Victor Julien 66648df099 detect: add tcp.mss keyword 
Allows matching on TCP option MSS.

Syntax:

    tcp.mss:<value>;
    tcp.mss:<value1>-<value2>;
    tcp.mss:<op><value>;

Operator can be: >, <.
 7 years ago
Victor Julien 11be9bd971 mingw: add SCNtohl and SCNtohs macro's 
On MinGW the result of ntohl needs to be casted to uint32_t and
the result of ntohs to uint16_t. To avoid doing this everywhere
add SCNtohl and SCNtohs macros.
 9 years ago
Jason Ish b79a18ea15 tcp/udp: rename checksum functions for better meaning 
The TCP/UDP checksum functions no longer just calculate
the checksum, they can validate as well as calculate so
use a more generic name.
 10 years ago
Jason Ish f56428d996 tcp/udp: fix checksum validation when 0xffff 
Issue:
https://redmine.openinfosecfoundation.org/issues/2041

One approach to fixing this issue to just validate the
checksum instead of regenerating it and comparing it. This
method is used in some kernels and other network tools.

When validating, the current checksum is passed in as an
initial argument which will cause the final checksum to be 0
if OK. If generating a checksum, 0 is passed and the result
is the generated checksum.
 10 years ago
Thomas Andrejak 18c9312380 Add macro for TCP and UDP header access 10 years ago
Victor Julien c9756caeef packet: make tcp/udp/icmp vars union non-anonymous 
Clean the whole thing after use.
 10 years ago
Victor Julien 76c8c077c5 tcp: fix alignment issues with tcp timestamps 11 years ago
Victor Julien 38f67d88ea tcp: reduce TCP options storage in packets 
Until now, the TCP options would all be stored in the Packet structure.
The commonly used ones (wscale, ts, sack, sackok and mss*) then had a
pointer to the position in the option array. Overall this option array
was large. About 360 bytes on 64bit systems. Since no part of the engine
would every access this array other than through the common short cuts,
this was actually just wasteful.

This patch changes the approach. It stores just the common ones in the
packet. The rest is gone. This shrinks the packet structure with almost
300 bytes.

* even though mss wasn't actually used
 11 years ago
Victor Julien 6b2fb3fd5d Fix minor format string issues 11 years ago
Ken Steele 045966676d Add Packed attribute on Header structures 
Structures that are used to cast packet data into fields need to be packed
so that the compiler doesn't add any padding to these fields. This also helps
Tile-Gx to avoid unaligned loads because the compiler will insert code to
handle the possible unaligned load.
 12 years ago
Ken Steele f16b339fc4 Rename checksums to level3_comp_csum and level4_comp_csum. 
This will also sharing even more memory in the Packet_ structure.
 13 years ago
Ken Steele c6a8d0ab6b Share Packet checksum values for TCP, UDP, IPv6. ICMPv4 and ICMPv6 
Keep a separate checksum for IPV4, since a packet can have both an IPV4
checksum and a TCPV4 checksum, or IPV4 and UDPV4 checksum.

This will allow future sharing of more values.

Use PACKET_RESET_CHECKSUMS() in Unit Tests in place of setting the
individual checksum values.
 13 years ago
Anoop Saldanha 98a8234e0a csum function fixes. Improves alert accuracy. FPs on invalid-csums decoder rules fixed 15 years ago
Victor Julien e1d4e16645 Simplify packet decoding macro's. 16 years ago
Victor Julien 6aa551c558 Small optimizations to IPV4 and TCP header parsing. 16 years ago
Victor Julien d0374ced38 Implement SACK in the stream engine. 16 years ago
Victor Julien 6fc075d4ae Add TCP packet SACK option decoding. 16 years ago
Eric Leblond 0cf05856d0 Fix Packet usage. 
This patch suppresses remaining direct access to pkt and pktlen in the
Packet structure.
 16 years ago
Gurvinder Singh 7d0781b349 added support to log dropped packet as netfilter logs while in inline mode 16 years ago
Anoop Saldanha 7abf3a2123 fix csum handling for tcp/dup 16 years ago
Victor Julien 6519a86ec7 Move packet pool to ringbuffer, update packet pool api and ringbuffer api. Remove memset usage from PACKET_RECYCLE, add proper cleanup macros. 17 years ago
William Metcalf 2eef905c07 GPL and Copyright header updates. 17 years ago
William Metcalf ce01927515 Import of GPLv2 Header 050410 17 years ago
Pablo Rincon b334036d75 Moving inline functions to the .h files, so gcc can inline them correctly 17 years ago
Victor Julien 5eb4095b9a Comment ECN/CWR changes more. 17 years ago
Pablo Rincon 83ddc5813a Support for ecn/cwr TCP sessions 17 years ago
Gurvinder Singh 37b4682407 target based paws handling 17 years ago
Victor Julien 0d0ffb9963 Reorganize header inclusions. 17 years ago