aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
10,200 Commits
8 Branches
174 Tags
252 MiB
main
main-8.0.x
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.7
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '0bb07b550c'
${ noResults }
Commit Graph

8762 Commits (0bb07b550c1f00a95e6803aba7cdeb22d637fbc2)

Author SHA1 Message Date
Mats Klepsland 0f7f35bd85 detect-tls: check return values of functions on setup 
Check the return values of DetectBufferSetActiveList() and
DetectSignatureSetAppProto().
 8 years ago
Mats Klepsland 1c04d7cdae detect-tls: remove confusing underscores from variables 
Remove confusing underscore prefix from variables in GetData() for
all tls keywords.
 8 years ago
Jeff Lucovsky de983fb7c9 app-layer-ftp: Potential memory leak fixed 
Ensure that when handling failures during STOR command
processing, that all memory is freed on the error path.
 8 years ago
Mats Klepsland ba857e9739 detect: add tls.certs keyword 
Add keyword to do "raw" matching on each of the certificates in the
TLS certificate sticky buffer.

Example:
  alert tls any any -> any any (msg:"tls.certs test"; tls.certs; \
          content:"|01 02 03 04|"; sid:1;)
 8 years ago
Victor Julien edae50de94 detect/ssh: fix ssh.protoversion memory leak 8 years ago
Victor Julien 567a7c3cef detect/ssh: mark old ssh keywords as deprecated 8 years ago
Victor Julien d623dc4ac0 detect/parse: add flag to indicate keyword is deprecated 
Issue warning when it is still used.
 8 years ago
Victor Julien b84eba80aa detect/nfs.version: minor cleanups 8 years ago
Victor Julien 2ea11da230 detect/nfs: add nfs.version 8 years ago
Victor Julien 3299f007f8 detect/dcerpc: add dcerpc.iface 
Keep dce_iface as an alias.
 8 years ago
Victor Julien cdff1d50b7 detect/dcerpc.opnum: minor code cleanups 8 years ago
Victor Julien 6840e5c7df detect/dcerpc: add dcerpc.opnum as new name for dce_opnum 8 years ago
Philippe Antoine b6b7778e2d http: adds event for header repetition 8 years ago
Jason Ish 9d8eb7b5f0 filestore: remove jansson ifdefs 
Jansson is now required.
 8 years ago
Jason Ish 3dc973d4b1 eve/file: remove rust and jansson ifdefs. 
Both Rust and Jansson are required now.
 8 years ago
Jason Ish 42c327adc4 filestore: fix leak in contructing json 
Use json_array_append_new instead of json_array_append to transfer
ownership of the integer object to jansson so it gets freed.

Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2961
 8 years ago
Victor Julien ddfcf76c57 detect/engine: make DetectAppLayerMpmRegister decprecated 8 years ago
Victor Julien 752bb1c410 detect/dnp3: add dnp3.data with v2 api support 
Adds MPM support as well. Add TxDetectFlags support to the parser
to avoid duplicate matches.
 8 years ago
magenbluten 09a21627d5 filestore: fix dropping of unwanted files (Issue #2853) 8 years ago
Victor Julien 9132e4032a files: open files with track id only 8 years ago
Victor Julien 3b31bad855 detect/dce_stub_data: add dcerpc.stub_data 
Also use v2 API for inspect and mpm registration.
 8 years ago
Victor Julien d270a7603a detect/inspect: add flags to inspect buffer 8 years ago
Victor Julien 32fb7d773a detect/content-inspect: turn void arg into Packet 
Replace the 'void *data' argument by a 'Packet *p' as this was
the only user left of the data pointer.
 8 years ago
Victor Julien b7a7517273 detect/dce_stub_data: minor cleanups 8 years ago
Victor Julien 55db6d6fb4 detect/dcerpc: move endian handling from pointer to flags 8 years ago
Victor Julien b2638f7195 detect/krb5: add krb5.sname and krb5.cname 8 years ago
Victor Julien aefce4d761 detect/nfs: remove HAVE_RUST guards 8 years ago
Victor Julien 15eac12a39 afl: fix compilation 8 years ago
Victor Julien 3ae2edb22a ftp: fix realloc handling to avoid valgrind warning 
Bug #2951
 8 years ago
Victor Julien 84881bf1b8 detect/file.magic: add sticky buffer 
Add sticky buffer to inspect file magic. Includes mpm support.
 8 years ago
Victor Julien d78c6ff714 detect/thread: ctx info is allowed to have NULL data 8 years ago
Victor Julien aa52dfab04 detect/smb: clean up keywords 8 years ago
Victor Julien d64fbb71ae detect/file: add file.data, small cleanups 8 years ago
Victor Julien b5d5389438 detect/ssh: minor --list-keywords improvements 8 years ago
Victor Julien f246e319b2 detect/http.header.raw: minor cleanups 8 years ago
Victor Julien a21a7d16bd detect/http.host.raw: minor cleanups 8 years ago
Victor Julien 0e1d47c87b detect/http.method: minor cleanups 8 years ago
Victor Julien bdd8e6152b detect/http.start: modernize name and code 8 years ago
Victor Julien cd2e6511c9 detect/http: cleanup http stat * 8 years ago
Victor Julien 84da0376fb detect/http.host: rename file for consistency 8 years ago
Victor Julien 2b8311beff detect/http.host: fix --list-keywords output 8 years ago
Victor Julien 0e5c987533 detect/http.uri: fix up --list-keywords output 8 years ago
Victor Julien 19163ca2e1 detect/http: request/response line keyword modernization 8 years ago
Victor Julien fb2e4e4453 detect/http.header_names: use v2 api and new name 8 years ago
Philippe Antoine 316a411b6b ssl : SSLProbingParser overflow fix 
Found by fuzzing
Fixes ssl detection evasion by packet splitting
 8 years ago
Victor Julien 666bb1b6e4 parse/ip: fix potential oob write in ipv4 validation 
Found using AFL.
 8 years ago
Jason Ish b8ce7f2885 mpls: check buffer length before peeking at next header 
Check that we have enough bytes before peaking into the MPLS
packet payload.

Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2884
 8 years ago
Jason Ish 8d7d6a96a5 ethernet: fix next packet size on DCE packet 
Missing parans on the DCE length caused the length update
for the next call to DecodeEthernet to be wrong.

Tests added.

Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2887
 8 years ago
Victor Julien 76cc03010a ssh: fix banner overflow issue 
Reported-by: Sirko Höer - Code Intelligence
 8 years ago
Victor Julien 2b75222250 runmodes: for test runmodes, clean up properly 
For conf test and engine analysis, clean up memory correctly.

This helps valgrind tests for leaks.
 8 years ago
Jeff Lucovsky 74f436d209 logging: display base64 decoded string for packet 
This changeset changes the packet display to be base64, rather than hex.
 8 years ago
Jeff Lucovsky 7d28c19f05 logging: Ensure all anomalous events have an event_type 
This change ensures that each anomaly is tagged with an
event type to support querying.

Each anomalous event will include `"event_type": "anomaly"`
in the log record.
 8 years ago
Jeff Lucovsky 5e222129d5 eve/alert: Remove unused results from PrintRawLineHexBuf 
This changeset removes the call to `PrintRawLineHexBuf`. The
return values were never used.
 8 years ago
Jeff Lucovsky a8938f449d logging: Anomaly logging 
This changeset adds anomaly logging to suricata for issue 2282.

Anomaly logging is controlled via the `anomaly` section within eve-log.
There is a single option -- `packethdr` -- for including the packet header
in the anomaly.
 8 years ago
Philippe Antoine a1c6e091ac http: new event for auth unrecognized 
activates libhtp auth parsing
Fixes #984
 8 years ago
Jeff Lucovsky 7f102d95b6 detect: Modernize TLS keywords 
This changeset adds keywords for "tls.<name>" and moves the existing
value of "tls_<name>" to an alias.
 8 years ago
Alexander Bluhm 36796de731 init: pledge(2) needs "fattr" during suricata reload. 
When killed with SIGHUP, suricata reopens the log files.  If filemode
is set in the config, it needs pledge promise "fattr" to allow the
chmod(2) on OpenBSD.
 8 years ago
Giuseppe Longo af9399f2ac detect-http-protocol: use v2 inspect/mpm engines 
This updates inspect/mpm engines to v2.
 8 years ago
Victor Julien a6a0b0aa4a detect/files: fix file sigs state handling 
Make sure all file sig mismatches indicate this in their return
code, not just the ones with filestore enabled. This is needed
to tell the stateful detect engine that it is dealing with a file
sig, so it can make sure these are inspected correctly even if
there are possibly multiple files per tx.
 8 years ago
Victor Julien 225cdf996e eve/alert: take vlan from packet, not flow 
Flow is not guaranteed to exist.
 8 years ago
Eric Leblond 497f35164b detect-filename: avoid multiple inspections of buf 
If the filename inspection function is returning nomatch this will
trigger iterative inspections with same content (aka filename) being
inspected. To avoid this we change the return as the buffer inspection
has not to be inspected anymore.
 8 years ago
Eric Leblond 63f2032ed6 doc: fix way to build URL 8 years ago
Eric Leblond f48ac1860a detect-lua: implement sticky buffer 
This patch implement an option named 'buffer' that can be used in the
init function of a lua signature:

 function init (args)
     local needs = {}
     needs["buffer"] = tostring(true)
     return needs
 end

With this, the lua script will get access to the sticky buffer
content.
 8 years ago
Eric Leblond 62a11dd3ed detect-lua: fix DNP3 value 8 years ago
Mark Janssen 600f2ab391 eve/json: always output vlan field as array 8 years ago
Mark Janssen 0cc3c2cc6c eve/flow: add in_iface field 
Fixes #2057
 8 years ago
Mark Janssen fed9b7a180 eve/flow: add vlan field 8 years ago
Bendik Hagen f558ef2c55 Flow/Stream: set psuedopacket iface/vlan from flow 
This fixes redmine bug #2057 by setting pseudopacket iface and vlan from
flow values, solving the problem of missing vlan/iface when psuedopacket
gets logged/alerted on.
 8 years ago
Bendik Hagen b7b40393dc Flow: Set flow iface and vlan_idx 
Setting flow iface and vlan_idx from packet, making it possible to log
iface and vlan on psuedopackets and in flow-logs.
 8 years ago
Bendik Hagen ec0dd0209a Flow: Adding livedev and vlan_idx on flow 
Adding livedev and vlan_idx on flow, making it possible to use it for
logging in_iface on flow-logs and fix in_iface on psuedopackets.
 8 years ago
Philippe Antoine bef190f767 http: logs content range 
Fixes #2485
 8 years ago
Philippe Antoine 43e205fc32 smtp: rset command resets bdat chunks length 
Fixes #1860
 8 years ago
Philippe Antoine ff52bb14b7 ssh : code style consistency 
Adds SSH_FLAG_VERSION_PARSED to flags before each return
This way, we are sure SSHParseBanner does not get called again
And proto_version does not get leaked
 8 years ago
Jeff Lucovsky 4f33b8c18d decode: Improved FTP active mode handling 
This changeset addresses 2 issues:
- 2459
- 2527
and improves handling for FTP active mode over IPv4 and IPv6.

Active mode is triggered when the FTP client conveys the port
that should be used for a data connection (PORT, EPRT).

When this occurs, the FTP state is marked as "active".
 8 years ago
Jason Ish 164fb71898 mpls: fix misaligned read 
Instead of casting the packet buffer to a uint32, memcpy it to
avoid misaligned read error, as caught by the undefined behavior
detector (ubsan).

Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2903
 8 years ago
Victor Julien f7d8401c2e eve/smb: minor cleanup now Rust is mandatory 8 years ago
Victor Julien c2cb155ebb rust/smb: rename files and code from RustSMB to SMB 8 years ago
Victor Julien e572324c5a detect/dcerpc: cleanup now Rust is mandatory 8 years ago
Victor Julien 50709144f9 detect/app-layer-event: cleanup test 8 years ago
Victor Julien f30c05e684 smb: remove C implementation 
Now that Rust is mandatory it is obsolete.

Ticket: #2849
 8 years ago
Jason Ish 67b2692d34 dns: remove as much C DNS code as possible 
As some of the C code is still used it can't all be removed.

Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2850
 8 years ago
Jason Ish 78b82ce6a5 dns-log: remove, not supported now that Rust is required 
The non-json line based DNS log is not supported with Rust only
builds and has been scheduled for removal in Suricata 5.0.

Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2297
 8 years ago
Phil Young 05271bfbe5 napatech: simplify integration with Napatech cards 
- There is now an option to automatically create streams on the
  correct NUMA node when using cpu affinity.

- When not using cpu affinity the user can specify streams to be
  created in the suricata.yaml file.  It is no longer required to
  use NTPL to create streams before running suricata.

- The legacy usage model of running NTPL to create streams is still
  available. This can be used for legacy configurations and complex
  configurations that cannot be satisfied by the auto-config option.
 8 years ago
Victor Julien fd9f64d00f byte: suppress errors in byte extraction utils 8 years ago
Victor Julien a496c8be0c detect/bytejump: suppress runtime error messages 8 years ago
Victor Julien 5703ce371e detect/byteextract: suppress runtime error messages 8 years ago
jason taylor 7f63ec185a pfring: update PfringThreadVars_ for gcc 4.x 
Signed-off-by: jason taylor <jtfas90@gmail.com>
 8 years ago
Emmanuel Roullit 00917a0415 init: use pledge(2) after suricata initialization. 
pledge(2) can be used on OpenBSD to restrict suricata possible
operation on the system once initialization is completed.
The process promises to only make use of:
- "stdio" to allow read(2) on IPS rules and write(2) on log file
- "rpath wpath cpath" to allow log rotation
- "unix" to operate the control unix socket and log unix sockets
- "dns" to retrieve DNS from recvfrom(2)/sento(2) in IPFW mode
- "bpf" as suricata uses libpcap, which uses the BIOCGSTATS operation

Signed-off-by: Emmanuel Roullit <emmanuel.roullit@cognitix.de>
 8 years ago
Emmanuel Roullit 8b75e69165 log: output file mode in octal on chmod warning 
The mode input in chmod is an octal integer. However when the warning is logged,
the file mode is printed in decimal which is confusing.

Signed-off-by: Emmanuel Roullit <emmanuel.roullit@cognitix.de>
 8 years ago
Jeff Lucovsky 8e464530ef decode: Change return type of IPv4 and TCP options decode 
The return value from the options decoder in TCP and IPv4 is ignored.
This commit changes the return type of the function to `void` and
modifies existing return points to return without a value.

When an error occurs, the packet state is being set to indicate whether
it's valid or not and the existing return value is never used.
 8 years ago
Jeff Lucovsky 03b0e4272b parse: Improve unknown protocol parse message 
The message associated with unknown protocols during parsing is incomplete.
This commit improves the message readability.
 8 years ago
Jeff Lucovsky b10125af07 sticky: Convert ssh_software to new format 8 years ago
Jeff Lucovsky ceba8c89e9 sticky: Convert ssh_proto to new format 
This changest converts the 'ssh_proto' sticky buffer
into the v2 framework.
 8 years ago
Jeff Lucovsky 80be07a534 detect/http: Use v2 inspect and mpm engines 
This changeset updates the http stub detect logic to use the v2 inspect
and npm engines.
 8 years ago
Victor Julien aaf502d383 stream: suppress noisy debug info messages 8 years ago
Victor Julien 63569aeb57 pcap: suppress info messages 8 years ago
Victor Julien ee128c7460 detect/disable-detect: suppress info message 
The message would be displayed even when level was higher than
info.
 8 years ago
Victor Julien d00950be81 log/file: use default-log-dir for suricata.log 
Default to just suricata.log instead of the full path, so that
in user mode we can log in the user mode location.
 8 years ago
Victor Julien a36482e924 user mode: use CWD as logdir 
Introduce util func for handling user mode settings.
 8 years ago
Victor Julien c72dd84ade logopenfile: remove duplicate ifdefs 8 years ago
Victor Julien 56e4c348e1 runmodes: improve error messaging 8 years ago
Victor Julien 1a7e93f4a6 startup: log system mode with version 8 years ago
Victor Julien 86ed5815cb instance: set system vs user mode 8 years ago
Victor Julien 968e613037 list-keywords: don't load yaml 
Avoids a useless warning if the file is not found.
 8 years ago
Jeff Lucovsky 1b1fc9fee2 rule-analyzer: Ensure content counts are accurate 
Fix for issue 2605.  Make sure that content is counted,
even if none of the specific content types are matched.
 8 years ago
Giuseppe Longo 1c97423adf source-nflog: fix memleaks 
This fixes two memleaks found with ASAN.

Direct leak of 96 byte(s) in 1 object(s) allocated from:
   #0 0x7f59cf4a4d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
   #1 0xd7f92f in ReceiveNFLOGThreadInit /home/glongo/suricata/src/source-nflog.c:221
   #2 0xe9c8eb in TmThreadsSlotPktAcqLoop /home/glongo/suricata/src/tm-threads.c:293
   #3 0x7f59cd7aa4a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)

Indirect leak of 70000 byte(s) in 1 object(s) allocated from:
   #0 0x7f59cf4a4d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
   #1 0xd814ea in ReceiveNFLOGThreadInit /home/glongo/suricata/src/source-nflog.c:324
   #2 0xe9c8eb in TmThreadsSlotPktAcqLoop /home/glongo/suricata/src/tm-threads.c:293
   #3 0x7f59cd7aa4a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)

SUMMARY: AddressSanitizer: 70096 byte(s) leaked in 2 allocation(s).
 8 years ago
Emmanuel Roullit 4b4bb31c30 log: add NULL ptr guard on fclose when reopening. 
Signed-off-by: Emmanuel Roullit <emmanuel.roullit@cognitix.de>
 8 years ago
Victor Julien 884ca0cd3a detect/ftp: small ftpdata_command cleanups 8 years ago
Victor Julien 834d579f7e detect/uricontent: suggest http.uri as alternative 8 years ago
Victor Julien 6974eb3116 detect/dns: add dns.query for dns_query keyword 
Improve error checking.

Part of #2283.
 8 years ago
Victor Julien 822a434036 nfs: implement midstream reverse flow support 
Register special midstream version of protocol detection that
can indicate the flow is the wrong direction based on the record
properties.
 8 years ago
Victor Julien bb78d48c0a app-layer/probing-parser: implement reverse flow 
Implement midstream support for the pure probing parsers. These
need to look up the appropriate parsers based on the reverse
tuple.
 8 years ago
Victor Julien 34cb49f1e9 flow: add macro to get sp/dp 
Account for possibility of a reversed flow.
 8 years ago
Victor Julien 37893d8874 alert/unified2: remove useless packed attributes 8 years ago
Victor Julien 9dd200b5c9 decode: remove useless packed attributes 8 years ago
Victor Julien 948a4ccb3b detect/iponly: only run iponly address parsers for iponly rules 8 years ago
Victor Julien 92f08d85aa detect/iponly: improve negation handling in parsing 8 years ago
Victor Julien ba1de99f10 detect/address: clean up 'any' logic 8 years ago
Victor Julien 6a5084ccf9 detect/parse: set the type of signature early 
This way we can know much sooner if the rule is ip-only
or not.
 8 years ago
Victor Julien 449f169848 detect/parse: reduce scope of main parse func 8 years ago
Victor Julien ac2fb706d4 detect/content: test cleanup 8 years ago
Victor Julien 5626528c73 smb3: support direction check in midstream 
As the records contain no indicator, fall back to checking the
flows port number.
 8 years ago
Victor Julien 422e4892cc proto-detect: improve midstream support 
When Suricata picks up a flow it assumes the first packet is
toserver. In a perfect world without packet loss and where all
sessions neatly start after Suricata itself started, this would be
true. However, in reality we have to account for packet loss and
Suricata starting to get packets for flows already active be for
Suricata is (re)started.

The protocol records on the wire would often be able to tell us more
though. For example in SMB1 and SMB2 records there is a flag that
indicates whether the record is a request or a response. This patch
is enabling the procotol detection engine to utilize this information
to 'reverse' the flow.

There are three ways in which this is supported in this patch:

1. patterns for detection are registered per direction. If the proto
   was not recognized in the traffic direction, and midstream is
   enabled, the pattern set for the opposing direction is also
   evaluated. If that matches, the flow is considered to be in the
   wrong direction and is reversed.

2. probing parsers now have a way to feed back their understanding
   of the flow direction. They are now passed the direction as
   Suricata sees the traffic when calling the probing parsers. The
   parser can then see if its own observation matches that, and
   pass back it's own view to the caller.

3. a new pattern + probing parser set up: probing parsers can now
   be registered with a pattern, so that when the pattern matches
   the probing parser is called as well. The probing parser can
   then provide the protocol detection engine with the direction
   of the traffic.

The process of reversing takes a multi step approach as well:

a. reverse the current packets direction
b. reverse most of the flows direction sensitive flags
c. tag the flow as 'reversed'. This is because the 5 tuple is
   *not* reversed, since it is immutable after the flows creation.

Most of the currently registered parsers benefit already:

- HTTP/SMTP/FTP/TLS patterns are registered per direction already
  so they will benefit from the pattern midstream logic in (1)
  above.

- the Rust based SMB parser uses a mix of pattern + probing parser
  as described in (3) above.

- the NFS detection is purely done by probing parser and is updated
  to consider the direction in that parser.

Other protocols, such as DNS, are still to do.

Ticket: #2572
 8 years ago
Danny Browning c0ab45aa6f source-pcap-file: Pcap File Init Failure Handling (#1694) 
Better handle case where pcap file receive thread fails to initialize. Allow
initialize to complete, but terminate the thread quickly. Delay exiting
unix socket runmode as late as possible.
 8 years ago
Victor Julien 55ab112e77 app-layer/pd: minor code cleanup 8 years ago
Victor Julien 2cf0a34e66 app-layer/pd: set offset and depth in mpm 8 years ago
Victor Julien 7cea1e4181 mpm/hs: track maxdepth 8 years ago
Alexander Gozman 928fe1b859 Bug 2857: NFQ ASAN 'heap-use-after-free' error. 
Global NFQ contexts were not freed properly causing
'use-after-free' error. Moving contexts cleanup to a
separate NFQContextsCleanup() and calling it from
GlobalsDestroy(), like it's done for AFPacket, solves
the problem.
 8 years ago
Jeff Lucovsky 81c1af0887 detect: implement http {location,server} sticky buffer 
This implements inspection of the Server and Location buffer as a
content sticky buffer.
 8 years ago
Max Fillinger 081fdc6804 pcap-log: Don't leak memory in LZ4 error paths 8 years ago
Alexander Bluhm 0ea3fa92a8 Avoid use-after-free during pid file cleanup. 
In case the pid file is given in the config file, the file name is
stored in volatile memory.  Removal of the pid file happens after
cleanup of config memory.  Create a copy of the name which will be
freed after the pid file has been removed.
 8 years ago
Giuseppe Longo c63fea8d0a reputation: remove dead code 
This removes some code commented long time ago.
 8 years ago
Giuseppe Longo 6b2a5ef21e reputation: declare max value as constant 8 years ago
Victor Julien 2622006faa stream: minor test cleanups 8 years ago
Victor Julien 636fb8d387 mpm: track maxdepth 
Track max depth setting per MpmCtx.

To make sure the data structure doesn't increase in size change global
bool to use a flags field.
 8 years ago
Victor Julien 55e5d50496 detect/flow: optimize flow check 
Flow direction doesn't need explicit checking as the rule groups (sgh)
are already per direction. So if a rule sets only flow:to_server or
flow:to_client, we can avoid adding a sigmatch to the signature.
 8 years ago
Victor Julien 119db92c99 detect/tag: minor code cleanup 8 years ago
Victor Julien 6bf35a42f1 detect/mark: use postmatch instead of tag list 
Keep the tag list for just tags. Post match list is better so the
keyword also works with pass and noalert rules.
 8 years ago
Victor Julien 4dbf600d64 detect/mark: minor code cleanups 8 years ago
Victor Julien bd31e4e332 detect: packet match micro optimization 8 years ago
Victor Julien 7497c633c4 detect/filestore: use postmatch callback 8 years ago
Victor Julien 065c3379ed detect/replace: implement post-match 
Implement replace executor as a post match callback so that it
is only considered if there actually is a replace keyword in use.
 8 years ago
Victor Julien 00beeef031 eve/flow/netflow: log correct tulpe on reversed flows 8 years ago
Victor Julien 9c241fa32c stream: use flow/packet swap logic for SYN/ACK midstream 8 years ago
Victor Julien 2f1ace64c6 flow: on timeout, consider reverse flows for pseudo packets 8 years ago
Victor Julien 4d6e6b8270 flow: introduce flow swap support 8 years ago
Victor Julien 0225ab3828 common: introduce flags and var swapping macros 8 years ago
Victor Julien d307cfad05 packet: add 'swap' function to reverse direction 8 years ago
Victor Julien d5baac3f85 detect/flow: don't require flow for direction options 
Flow isn't directly used for direction checks, so don't require
a flow to be present.
 8 years ago
Victor Julien c1dcc26965 detect/parse: improve direction setting on sigs 
Only set both directions if no direction has been explicitly set before.
 8 years ago
Victor Julien 9a14cb252d detect/bytetest: debug cleanup 8 years ago
Victor Julien cb9b27ab89 app-layer/pd: free memory 8 years ago
Victor Julien 39725907d6 detect: remove BUG_ON from packet path 8 years ago
Victor Julien 042f806362 detect: fix match array reset 
Fix match array reset depending on prefilter matches for the
current run. If there were none, the match array of the previous
packet was used. This could lead to inspection of rules from the
wrong rule group.
 8 years ago
Victor Julien 05d9527d01 app-layer/profile: fix udp protocol detection profiling 8 years ago
Victor Julien f44bbd71f5 app-layer/udp: micro optimization 8 years ago
Jeff Lucovsky 6123d77527 Fix memory leak with TOS handling 
Use `pcre_copy_substring` to avoid memory allocations when parsing
TOS values.
 8 years ago
jason taylor 1f3dd85216 pfring: update bpf error handling to be consistent 
* updated bpf error handling to be consistent with af-packet
* minor internal doc updates

Signed-off-by: jason taylor <jtfas90@gmail.com>
 8 years ago
Giuseppe Longo d0e2420faf reputation: move unit tests 
UTs are moved inside "test/" directory,
and reworked to improve readability and reduce lines of code.
 8 years ago
Giuseppe Longo 389227d899 detect-iprep: fix memory leaks 
Loading rules with iprep keyword cause
memory leaks due to missing frees.

Direct leak of 8 byte(s) in 4 object(s) allocated from:
    #0 0x7f81c862bd28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
    #1 0x7f81c6afea69 in pcre_get_substring (/lib/x86_64-linux-gnu/libpcre.so.3+0x27a69)
    #2 0x43206f7420676e68  (<unknown module>)

SUMMARY: AddressSanitizer: 8 byte(s) leaked in 4 allocation(s).
 8 years ago
Eric Leblond 58b804f7d2 flow-bypass: set thread name to FB 8 years ago
Victor Julien 69d0d484eb af-packet: don't use anonymous unions 8 years ago
Victor Julien acd9e1c2e7 af-packet: fix v3 code using v2 union member 8 years ago
Victor Julien 9948c96c68 stream/ips: set proper payload len for inspection 
On mem(cap) presure we fall back to the packet payload. The previous
patch failed to properly set the payload length.
 8 years ago
Victor Julien d6903e70c1 file-log: remove and add warning 
Feature was deprecated and scheduled for removal.

Ticket #2376
 8 years ago
Eric Leblond 2b1fa53c66 detect-hostbits: error on some invalid config 8 years ago
Eric Leblond e09fa43ba5 detect-xbits: error on some invalid config 8 years ago
Eric Leblond 910c3691af detect-flowbits: error on some invalid syntax 
The regular expression was accepting something like
"flowbits:!isset,isma;" without complaining even if it is not
correct and don't have the expected result.
 8 years ago
Eric Leblond 033fbc0f85 suricata: fix list keywords URL in release mode 
The tags are suricata-X.X.X so we need to update the chain to get
URLs right.
 8 years ago
Shivani Bhardwaj bb08040df6 unix-socket: Fix the message for unregister-tenant-handler 8 years ago
Victor Julien 74a42f683c eve/http: add proxy related custom headers 8 years ago
Victor Julien ac7ab4ef01 eve/http: fix custom header table 8 years ago
Victor Julien e99063b6b8 smtp: minor code cleanup and debug addition 8 years ago
Victor Julien bf905bcbca checksum: use u64 types 8 years ago
Victor Julien 02ba360903 ips/stream: handle low mem(cap) crash 
In low memory or memcap reached conditions a crash could happen in
inline stream detection.

The crash had the following path:

A packet would come in and it's data was added to the stream. Due
to earlier packet loss, the stream buffer uses a stream buffer block
tree to track the data blocks. When trying to add the current packets
block to the tree, the memory limit was reached and the add fails.

A bit later in the pipeline for the same packet, the inline stream
mpm inspection function gets the data to inspect. For inline mode
this is the current packet + stream data before and after the packet,
if available.

The code looking up the packets data in the stream would not
consider the possibility that the stream block returned wasn't
the right one. The tree search returns either the correct or the
next block. In adjusting the returned block to add the extra stream
data it would miscalculate offsets leading to a corrupt pointer to the
data.

This patch more carefully checks the result of the lookup, and
falls back to simply inspecting the packet payload if the lookup
didn't produce the expected result.

Bug 2842.

Reported-by: Ad Schellevis <ad@opnsense.org>
 8 years ago
Victor Julien ff920472f6 stream-buffer: fix block search compare func 
Sbb search function could return the wrong block due to an off by
one error.
 8 years ago
Victor Julien c306c02f8f stream-buffer: fix streaming buffer size issue 
It was using buffer size instead of the real usage of the buffer.
 8 years ago
Victor Julien 034724ec72 flow-manager: improve thread shutdown loops 8 years ago
Victor Julien 8a9cbb37a0 threads: move sleep macros into common header 8 years ago
Victor Julien aab03dde87 mpm/ac-ks: rename files from -tile to -ks 8 years ago
Victor Julien 6fcd2db043 tile: remove files 8 years ago
Victor Julien 3f253cb8c0 mpm: rename internal id for ac-tile to ac-ks 8 years ago
Victor Julien 2bd23bc1d5 detect/pcre: fix false positive 
Fix case where a HTTP modifier in PCRE statements would lead to
the rule alerting when it should not.

Bug #2769
 8 years ago
Victor Julien 43698a975a decoder: improve stats hash error handling 8 years ago
Victor Julien 517b45ea2d netmap: switch to nm_* API 
Process multiple packets at nm_dispatch. Use zero copy for workers
recv mode.

Add configure check netmap check for API 11+ and find netmap api version.

Add netmap guide to the userguide.
 8 years ago
magenbluten 1378f376a1 filestore v2: print sid in json output 8 years ago
Travis Green 1743cf5dcd engine-analysis: add support for http_host buffer 
Add support for http_host buffer for more accurate reporting.
Bug: #2798
 8 years ago
Alexander Gozman 2869f8a746 nfqueue: more descriptive queue names (e.g. 'NFQ#1' instead of '1') 
This will also make 'iface-list' output more informative.
 8 years ago
Alexander Gozman 86d7dddfab nfqueue: added received packets counter for 'iface-stat' command 
Previously nfqueue did not update received packets counter in a
livedev so 'iface-stat' UNIX-socket command always showed zeros.
 8 years ago
Victor Julien dadac4ae4f eve/fileinfo: don't alloc filename during logging 8 years ago
Victor Julien 7e1235c9c8 eve/ftp: don't alloc memory to log filename 8 years ago
Victor Julien 3749caadd7 eve/http: use stack for buffer to string conversions 8 years ago
Victor Julien 20f9b0d9c6 byte: add bytes to string w/o allocation 8 years ago
Mats Klepsland d62d33cdff app-layer-ssl: check that cipher suites length is divisible by two 
Cipher suites length should always be divisible by two. If it is a
odd number, which should not happen with normal traffic, it ends up
reading one byte too much.
 8 years ago
Mats Klepsland 22d8fc802e util-ja3: fix AddressSanitizer heap-buffer-overflow 
No resizing is done in Ja3BufferResizeIfFull() when the buffer is
empty. This leads to a potential overflow when this happens, since
a ',' is appended even when the buffer is empty.

Bug #2762
 8 years ago
Victor Julien d143ac6e89 windows/syscall: fix unused function warning 8 years ago
Victor Julien 759040a75a windows/syscall: convert file to use unix newlines 
ran: dos2unix src/win32-syscall.[ch]
 8 years ago
Victor Julien d522746c01 windows: fix sc_log_stream_lock handling 8 years ago
Victor Julien 7811498d49 windows: allow multiple pcap devices on commandline 
Ticket #2774
 8 years ago
Victor Julien 3d4d2ecc0e ips: set host mode only after engine mode 
Make sure it is set after the final engine mode update.
 8 years ago
Victor Julien 0a106fe2ea stream: fix 'stream.inline=auto' for L2 IPS 
Make sure the livedev setup is finalized before initializing the
stream engine.

Bug #2811

Reported-by: Ad Schellevis
 8 years ago
Victor Julien f98b5ecd6a flow: log gap state per direction 8 years ago
Victor Julien 2a3cb32071 stream: no more stream events after known issue 
No longer set stream events after a gap or wrong thread. We know
we lost sync and are now in 'lets make the best of it'-mode. No
point in flooding the system with stream events.

Ticket #2484
 8 years ago
Victor Julien 87019ff22b dcerpc/udp: fix int mishandling in opnum parsing 
For Big Endian support in the protocol, the opnum would not be set
correctly.

Found using undefined sanitizer.
 8 years ago
Victor Julien 9aa4e53434 file/swf: fix undefined int behaviour 
Fix warnings by the undefined sanitizer.
 8 years ago
Victor Julien 94191ea960 detect/bytetest: don't print errors at runtime 8 years ago
Maurizio Abba 6c0ec0b2f3 eve/http: add request/response http headers 
Add a keyword configuration dump-all-headers, with allowed values
{both, request, response}, dumping all HTTP headers in the eve-log http
object. Each header is a single object in the list request_headers
(response_headers) with the following notation:

{
    "name": <header name>,
    "value": <header value>
}

To avoid forged malicious headers, the header name size is capped at 256
bytes, the header value size at 2048.

By default, dump-all-headers is disabled.
 8 years ago
Maurizio Abba 4697351188 smtp: create raw-extraction feature 
Add a raw-extraction option for smtp. When enabled, this feature will
store the raw e-mail inside a file, including headers, e-mail content,
attachments (base64 encoded). This content is stored in a normal File *,
allowing for normal file detection.
It'd also allow for all-emails extraction if a rule has
detect-filename:"rawmsg" matcher (and filestore).
Note that this feature is in contrast with decode-mime.

This feature is disabled by default, and will be disabled automatically
if decode-mime is enabled.
 8 years ago
Alexander Gozman b2a6c60dee source-nfq: increase maximum queues number to 65535 
Previously this was limited to 16, however Netfilter allows
up to 65535 queues. Suricata now is able to create as many
queues as possible, but at the same time warns user if one
specifies more queues than available CPU cores.

This change involves dynamic (de)allocation of NFQ contexts
instead of on-stack arrays to use less memory.
 8 years ago
Alexander Gozman bdd69d13e0 source-nfq: support queue range 
If one needs to use multiple sequential Netfilter queues,
it can be done with a new '-q' option's syntax: "start:end"
(just like it's done with iptables '--queue-balance' option).
 8 years ago
Jason Ish 9bf6f7d5a9 rust/dns: add dns to dns alerts 8 years ago
Victor Julien e710b06669 detect: add file.name sticky buffer 8 years ago
Victor Julien ca8471387a detect: add http.response_body sticky buffer 
As a mirror of the http_server_body content modifier.
 8 years ago
Victor Julien 998f32f88c detect/tls: consolidate validity code 8 years ago
Victor Julien ccdafe6697 detect/http-server-body: move tests to tests/ 8 years ago
Victor Julien 2221dd9403 detect: add http.request_body sticky buffer 
Sticky buffer version of the http_client_body content modifier.
 8 years ago
Victor Julien 64987f36fb detect/file-data: move tests into tests/ 8 years ago
Victor Julien 2fa8066f3a detect/file-data: consolidate matching code 8 years ago
Victor Julien 9a8092249e detect/http-client-body: move tests into tests/ 8 years ago
Victor Julien 477e46da78 detect/http-client-body: convert to inspect api v2 8 years ago
Victor Julien ce677abdf0 detect/file-data: minor cleanups 8 years ago
Victor Julien c0767ece9b detect/file-data: minor cleanups and clarifications 8 years ago
Victor Julien 58aa9dca65 detect/http-server-body: code cleanup and test cleanups 8 years ago
Victor Julien 3413757027 detect/http-client-body: code cleanups and test cleanups 8 years ago
Victor Julien 645acb1089 detect: add http.header.raw sticky buffer keyword 
Add parsing tests as well.
 8 years ago
Victor Julien 76fd666cad detect/http_raw_header: move tests into tests/ 8 years ago
Victor Julien 25f974eb29 detect/http_raw_header: use inspect v2 api 8 years ago
Victor Julien c298412947 detect/http_raw_header: minor code cleanups 8 years ago
Victor Julien 85697671b8 detect: add http.header sticky buffer keyword 8 years ago
Victor Julien 31444cd088 detect/http_header: convert parsing tests to use helper 8 years ago
Victor Julien b9bcd4e115 detect/http_header: move tests into tests/ 8 years ago
Victor Julien 5e951a8b06 detect/http_header: inspect v2 api 8 years ago
Victor Julien 74b06b56f2 detect/http_header: test cleanups 8 years ago
Victor Julien 2a61ee13e1 detect/http_header: remove unused func args 8 years ago
Victor Julien dac182741b detect: add http.cookie sticky buffer keyword 8 years ago
Victor Julien ab027cb481 detect/http_cookie: move tests into tests/ 8 years ago
Victor Julien 988cc8468e detect/http_cookie: switch to inspect v2 api 8 years ago
Victor Julien 0aab3ac336 detect/http_cookie: minor cleanups 8 years ago
Victor Julien e222017a29 detect/http_user_agent: set alternative and info flags 8 years ago
Victor Julien b8a0a0d6ea detect: add http.stat_code sticky buffer keyword 8 years ago
Victor Julien 2f342da048 detect/http_stat_code: move tests into tests/ 8 years ago
Victor Julien 382fa2e81d detect/http_stat_code: use inspect v2 api 8 years ago
Victor Julien db7d7b2401 detect/http_stat_code: minor code cleanups 8 years ago
Victor Julien 59c3c748c9 detect: add http.stat_msg sticky buffer keyword 8 years ago
Victor Julien 5dfba01b2e detect/http_stat_msg: move tests to tests/ 8 years ago
Victor Julien 9b9cf2cc5f detect/http_stat_msg: switch to inspect v2 8 years ago
Victor Julien 880724d2ee detect/http_stat_msg: minor code cleanups 8 years ago
Victor Julien e9d43254c8 detect: add http.host.raw sticky buffer 8 years ago
Victor Julien b469938998 detect/http_raw_host: move raw into regular host logic 8 years ago
Victor Julien dc43f35427 detect/http_host: move tests into tests/ 8 years ago
Victor Julien 2c57037611 detect/http_raw_host: use inspect v2 api 8 years ago
Victor Julien 8c8a3473c9 detect/http_raw_host: minor cleanups 8 years ago
Victor Julien e9fcb9d5ef detect/http_method: add http.method sticky buffer 8 years ago
Victor Julien cb332b4cda detect/http_method: move all tests into tests/ 8 years ago
Victor Julien d00732175a detect/http_method: use inspect v2 api 8 years ago
Victor Julien 5fbee04306 detect/http_method: minor cleanups 8 years ago
Victor Julien 4e50df0f55 detect/http: add http.uri.raw sticky buffer keyword 8 years ago
Victor Julien 0a405e27a0 detect/http_raw_uri: code reorganization 
Move registration into http_uri logic, move tests into the other uri
tests. Switch to v2 mpm/inspect APIs.
 8 years ago
Victor Julien e29f13502b detect/http_raw_uri: small cleanups 8 years ago
Victor Julien 10e2731f18 detect/http-uri: move tests into tests/ 8 years ago
Victor Julien 0c879d5041 detect: add http.uri sticky buffer keyword 8 years ago
Victor Julien 789f302d1a detect: add http.host sticky buffer 8 years ago
Victor Julien a0e4c5e79b detect/http-hh: code cleanups 8 years ago
Victor Julien 3111910fc6 detect/http_user_agent: move tests into tests/ 8 years ago
Victor Julien 123ebb2c41 detect: add http.user_agent sticky buffer 8 years ago
Victor Julien fe738014e4 detect/http-ua: remove dead code 8 years ago
Victor Julien e62c75335e detect/http-ua: test cleanups 8 years ago
Victor Julien 33b81f7439 detect: add verbosity of --list-keywords 
Add indicators of content modifier or sticky buffer, and also
allow registering an alternative to a keyword.
 8 years ago
Victor Julien d3e953e5f2 detect: switch keyword flags u16 8 years ago
Victor Julien eb73008ccf detect/transform: add to_sha1 keyword 8 years ago
Victor Julien 75f9c1ae9f detect/transform: add to_md5 keyword 8 years ago
Victor Julien 42d22ddb2a unittests: add signature parse test helper 8 years ago
Victor Julien 705d3b6130 Open 5.0.0-dev branch 8 years ago
Victor Julien 7f38ffc8bc log/stats: fix formatting of long decoder events 8 years ago
Jingyu Yang bb26e6216e source-pcap:set PktAcqBreakLoop as pcap_breakloop 8 years ago
Victor Julien d8634daf74 stream: fix false negative on bad RST 
If a bad RST was received the stream inspection would not happen
for that packet, but it would still move the 'raw progress' tracker
forward. Following good packets would then fail to detect anything
before the 'raw progress' position.

Bug #2770

Reported-by: Alexey Vishnyakov
 8 years ago
Victor Julien fb18a1655c eve.stats: warn that output might miss decoder-events 8 years ago
Victor Julien 0d86263efd eve.stats: make decoder event prefix configurable 8 years ago
Victor Julien 932c2a7ec5 eve: fix missing decoder-events in stats 
In the eve log the decoder events are added as optional counters. This
behaviour is enabled by default. However, lots of the counters are
missing, as the names colide with other counters.

E.g.

decoder.ipv6 counts ipv6 packets
decoder.ipv6.unknown_next_header counts how often an unknown next
    header is encountered.

In this example 'ipv6' would be both a json integer and a json object.
It appears that jansson favours the first that is generated, so the
event counters are mostly missing.

This patch registers them as 'decoder.events.<event>' instead. As
these names are generated on the fly, a hash table to contain the
allocated strings was added as well.
 8 years ago
Victor Julien 0f1fc1f0c8 hash: move string hash funcs into util files 8 years ago
Victor Julien c140505bec decoder: add gre over ipv6 support 8 years ago
Victor Julien 8709a20d94 af-packet: minor code cleanups 8 years ago
Victor Julien c99dc5a7bf af-packet: re-enable sync for tpacket v2 
Synchronize start was disabled for v2 when v3 was introduced, without
a reason being given.

Re-enable as v2 will otherwise also start reading packets before the
other threads are set up. This will lead to hashing issues.

Part of bug #2788.
 8 years ago
Victor Julien cebbe06f70 af-packet: fix sync start for tpacket v3 
The tpacket-v3 implementation of the synchonize start logic would
not correctly consider the timestamp parameter, leading to threads
starting before synchronization between threads was complete.

Bug #2788
 8 years ago
Alexander Gozman 03af3e1ed8 nfqueue: inject fake packet on timeout 
Fixes nfqueue and delayed-detect.

On systems with small amount of traffic (or with no traffic at all)
nfqueue with 'delayed-detect' enabled hanged in 'workers' mode.

Bug #2362.
 8 years ago
Eric Leblond 0e3b1eba86 util-binsearch: remove the files 8 years ago
Travis Green 6f5eb487a1 doc: add missing and fix 404 for --list-keywords 8 years ago
Travis Green c2adb9e669 doc: added tos keyword 
Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2583
 8 years ago
Philippe Antoine 7fca771ef4 Fixes other affected tests for smtp pipelining 
Either checking state has pipelining
Or removing pipelining from input
 8 years ago
Philippe Antoine 447c1042f4 smtp: improve pipelining support 
Fixes #1863
 8 years ago
Victor Julien 8357ef3f8f proto/detect: workaround dns misdetected as dcerpc 
The DCERPC UDP detection would misfire on DNS with transaction
ID 0x0400. This would happen as the protocol detection engine
gives preference to pattern based detection over probing parsers for
performance reasons.

This hack/workaround fixes this specific case by still running the
probing parser if DCERPC has been detected on UDP. The probing
parser result will take precedence.

Bug #2736.
 8 years ago
Victor Julien 11f3659f64 teredo: be stricter on what to consider valid teredo 
Invalid Teredo can lead to valid DNS traffic (or other UDP traffic)
being misdetected as Teredo. This leads to false negatives in the
UDP payload inspection.

Make the teredo code only consider a packet teredo if the encapsulated
data was decoded without any 'invalid' events being set.

Bug #2736.
 8 years ago
Victor Julien e30212c5d8 detect: fix crash during startup with malformed yaml 
detect-engine:
  custom-values:
    toclient-groups: 200
    toserver-groups: 200

Bug #2745
 8 years ago
Victor Julien 4c8f6b2246 offloading: on bsd, disable rxcsum and v6 variants 8 years ago
Victor Julien fa6b73d1c9 offloading: don't set multiple times per interface 
This could happen with netmap igb0->igb0^ IPS mode.
 8 years ago
Victor Julien ad1945aae4 detect: fix content inspection flags 
Fix generic inspect function content inspection flags so that
streaming buffers work correctly.
 8 years ago
Victor Julien 394e115036 detect/rawbytes: improve error message plus do minor cleanups 8 years ago
Victor Julien f336ba3217 detect/file-data: fix enabling http body tracking 8 years ago
Victor Julien 3eec088d31 detect/parse: error out on unused sticky buffers 8 years ago
Victor Julien b36e921cf9 detect/prefilter: add closing debug return statement 8 years ago
Victor Julien 3a057c5f54 capture: fix mtu plus sign names for non-netmap 
Bug #2502.
 8 years ago
Victor Julien 31f81429c2 stats: more accurate interval handling 
In the stats loop sleep for a time period more closely matching
the stats.interval setting. Fix an off by one that would make
the loop wake up ~1 second early.

Bug #2716
 8 years ago
Jason Ish d03a5be118 dns json v2 (C) - log rrtype in response 
Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2723
 8 years ago
Jason Ish 87250da0fc rust/dns: add v1 dns logging 
Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2704
 8 years ago
Victor Julien 9d36182b74 unix: fix deadlock in unix runmode on many cores 
Same issue as in 7f8795c756, with the
solution now also applied to the unix socket runmode.

Bug #2734
 8 years ago
Victor Julien 8d2883f3fa output/tx: fix multi-instance logger output 
Fix transactions not being logged after the first tx logger had
logged.
 8 years ago
Victor Julien 0e40231189 app-layer: improve transaction cleanup handling 
The app layers with a custom iterator would skip a tx if during
the ..Cleanup() pass a transaction was removed.

Address this by storing the current index instead of the next
index. Also pass in the next "min_tx_id" to be incremented from
the last TX. Update loops to do this increment.

Also make sure that the min_id is properly updated if the last
TX is removed when out of order.

Finally add a SMB unittest to test this.

Reported by: Ilya Bakhtin
 8 years ago
Victor Julien d34e41068f app-layer: fix tx tracking updates in tx cleanup 
Fix min_id not getting updated in all cases.

Reported by: Ilya Bakhtin
 8 years ago
Victor Julien e62e4bdc49 app-layer: add debug statements to tx cleanup logic 8 years ago
Victor Julien 37203c98a1 unittests/app-layer: add helper to get app tx trackers 8 years ago
Eric Leblond f3be8eaaf4 detect-depth: remove semi coma from desc 
It was breaking the CSV export.
 8 years ago
Eric Leblond 8c1b16e22d doc: fix some links in list-keywords command 8 years ago
Eric Leblond 64df672cf7 util-bpf: workaround OpenBSD old libpcap 
OpenBSD is not using a pcap_compile_* function so we can just
comment the code for OpenBSD users.
 8 years ago
Eric Leblond 6853683085 af-packet: remove unused field in AFPThreadVars 8 years ago
Eric Leblond 6bfecd6906 af-packet: remove years old todos 8 years ago
Eric Leblond 017acaa465 netmap: use custom BPF compile function 8 years ago
Eric Leblond 28e9e4c85c af-packet: use the new BPF compilation function 8 years ago
Eric Leblond 3c566e0f89 util-bpf: introduce custom BPF compile functions 
We can't get error from pcap_compile_nopcap() so let's get our
own function and output message.
 8 years ago
Eric Leblond e98b5e4946 af-packet: micro optimization 
Use a else if instead of two chained if constructs.
 8 years ago
Eric Leblond 9efa4ace69 af-packet: improve error handling 
Stress condition in Suricata could lead to interface to disconnect
when it is not necessary. This patch updates the error handling
code to try to continue reading when such a case occurs.
 8 years ago
jason taylor 74761b04fe bypass:added new documentation reference 
Documentation didn't previously exist for the bypass keyword

Signed-off-by: jason taylor <jtfas90@gmail.com>
 8 years ago
Eric Urban 90a0731564 debug/log: add log level for JSON type 
resolves #2671
 8 years ago
Victor Julien 6f2b974f9c detect/mpm: fix fast_pattern handling of len >255 
The fast pattern selection logic would truncate a patterns len to
255 leading to assigning the same pid to different patterns.

This in turn would be caught by the hyperscan setup code which would
abort.

Bug #2714.
 8 years ago
Victor Julien 961610489a iprep: small cleanups 8 years ago
Victor Julien 5740c79b93 iprep: improve error checking of path handling 8 years ago
Victor Julien 0b3220a0df detect: improve inspect buffer handling 
Fix and Optimize cleanup. For the simple single inspect buffer optimize
the cleanup by keeping track of the actually used buffers. This avoid
looping over unused buffers.

Fix the case of cleaning not being done after a tx if the next tx is
also inspected in the context of the same packet.

Fix cleanup of the multi-inspect buffers. Optimize in 2 ways. First
like with single keep track of which multi-inspect buffers have been
used. Second, keep a max of the buffers within a multi-inspect buffer.
Use this max to limit (nested) looping.
 8 years ago
jason taylor 683be94830 profiling: set loop limit to match array size 
Signed-off-by: jason taylor <jtfas90@gmail.com>
 8 years ago
Victor Julien 5aef72efd1 prelude: fix potential uninitialized value use 8 years ago
Victor Julien ca1161d798 detect: suppress coverity deadcode warnings 
Suppress as scan-build-7 relies on this 'dead' code to not issue
a warning.
 8 years ago
Victor Julien 7b318592e6 filestore: suppress coverity toctou warning 8 years ago
Victor Julien cb2008fb27 detect: fix coverity memory leak warnings 8 years ago
Victor Julien 16100e592d file: use u32 file id everywhere 8 years ago
Victor Julien 59d526481c detect/distance: improve value parsing and fix broken test 8 years ago
Victor Julien 9cce1995ef detect/within: clean up option value parsing 8 years ago
Victor Julien 8814b994b5 detect/within: test cleanups 8 years ago
Victor Julien 1803af7aa6 eve/dns: improve version warning message 8 years ago
Victor Julien 758acd4b7e detect/offset: improve value parsing 8 years ago
Mats Klepsland b5dfc9ed41 app-layer-ssl: fix coverty error (RESOURCE_LEAK) 
Bug #2677
 8 years ago
Victor Julien 36e84b929c smtp/mime: fix null ptr deref on bad traffic 
Due to missing error handling, a bad mime message could put the
mime parser in an error state, without the SMTP layer taking this
into account. So the SMTP layer would continue to pass data to the
mime parser, even though it was in an error state.

When the parser would be fed a very long line while in this state,
it would try to set an error flag in the state. However, due to
the error state, this setting of the flag would dereference a null
pointer.

This patch fixes this issue by updating the mime parser to check
the state it is in when receiving new input. It will refuse to
process futher data while in the error state. It will also return
a new error code to indicate to the SMTP layer that the parser
was in an error state.
 8 years ago
Jason Ish 961931e73a filestore: fix compiler truncation warnings 
And error out if the constructed filename is truncated.
 8 years ago
Mats Klepsland 033e756905 app-layer-ssl: add Facebook TLSv1.3 draft versions 
Add draft versions for Facebooks custom TLSv1.3 implementation "fizz"
to SSLVersionToString().
 8 years ago
Mats Klepsland dd5374c20d app-layer-ssl: change how TLSv1.3 drafts are logged 
Change from logging TLSv1.3 drafts as "TLS 1.3 (draft 28)" to
"TLS 1.3 draft-28" instead.
 8 years ago
Victor Julien 9291d434c6 pfring: default to runmode workers 
Now that threads:auto is implemented workers is a better default
as it generally performs better.
 8 years ago
Victor Julien 1467c30883 pfring: implement 'threads: auto' 
If threads is set to auto, first try the CPU count. If that would
fail, fall back to RSS queue count.
 8 years ago
Victor Julien 5f2831d60f pfring: support checking/disabling offloading 8 years ago
Victor Julien 7c02b40be6 pfring: fix bypass counter print uninitialized values 
If the option was disabled in the config the value would be uninitialized.
 8 years ago
Victor Julien 1360e030b1 storage: don't leak memory for unittests 8 years ago
Victor Julien 121b3021df radix: fix a memleak when removing the last node 8 years ago
Victor Julien 3836fe2353 detect/address: minor memory handling cleanups 8 years ago
Victor Julien 00e9fd7a36 detect: suppress scan-build warnings 8 years ago