9751 Commits (15eac12a3920b6a30f178beac2ef1721d0045ea6)

 

All Branches   

Search

Author	SHA1	Message	Date
Victor Julien	15eac12a39	afl: fix compilation	6 years ago
Victor Julien	3ae2edb22a	ftp: fix realloc handling to avoid valgrind warning ... Bug #2951	6 years ago
Victor Julien	84881bf1b8	detect/file.magic: add sticky buffer ... Add sticky buffer to inspect file magic. Includes mpm support.	6 years ago
Victor Julien	d78c6ff714	detect/thread: ctx info is allowed to have NULL data	6 years ago
Victor Julien	aa52dfab04	detect/smb: clean up keywords	6 years ago
Victor Julien	d64fbb71ae	detect/file: add file.data, small cleanups	6 years ago
Victor Julien	b5d5389438	detect/ssh: minor --list-keywords improvements	6 years ago
Victor Julien	f246e319b2	detect/http.header.raw: minor cleanups	6 years ago
Victor Julien	a21a7d16bd	detect/http.host.raw: minor cleanups	6 years ago
Victor Julien	0e1d47c87b	detect/http.method: minor cleanups	6 years ago
Victor Julien	bdd8e6152b	detect/http.start: modernize name and code	6 years ago
Victor Julien	cd2e6511c9	detect/http: cleanup http stat *	6 years ago
Victor Julien	84da0376fb	detect/http.host: rename file for consistency	6 years ago
Victor Julien	2b8311beff	detect/http.host: fix --list-keywords output	6 years ago
Victor Julien	0e5c987533	detect/http.uri: fix up --list-keywords output	6 years ago
Victor Julien	19163ca2e1	detect/http: request/response line keyword modernization	6 years ago
Victor Julien	fb2e4e4453	detect/http.header_names: use v2 api and new name	6 years ago
Victor Julien	65039d4acc	changelog: update for 5.0.0-beta1	6 years ago
Victor Julien	63ab296cca	nfs: fix integer underflow ... Fix int underflow that leads to Rust panic in NFS3 readdirplus parsing. Reported-by: Sirko Höer -- Code Intelligence for DCSO.	6 years ago
Philippe Antoine	316a411b6b	ssl : SSLProbingParser overflow fix ... Found by fuzzing Fixes ssl detection evasion by packet splitting	6 years ago
Victor Julien	666bb1b6e4	parse/ip: fix potential oob write in ipv4 validation ... Found using AFL.	6 years ago
Jason Ish	8be4142aaf	dhcp: verify client id len before parsing data ... Verify that the client id length is at least 2 per the DHCP protocol rfc before parsing the data. Redmine issue: https://redmine.openinfosecfoundation.org/issues/2902	6 years ago
Jason Ish	9d75fdc6ea	rust/ftp: validate port components in passive reponse ... Make sure they are valid 8 bit integers before combining the two parts into a u16 to prevent an overflow of the u16 return value. Add unit tests to check parsing of invalid ports. Redmine issue: https://redmine.openinfosecfoundation.org/issues/2904	6 years ago
Jason Ish	275e8f280d	rules: add mpls packet too small decoder rule	6 years ago
Jason Ish	b8ce7f2885	mpls: check buffer length before peeking at next header ... Check that we have enough bytes before peaking into the MPLS packet payload. Redmine issue: https://redmine.openinfosecfoundation.org/issues/2884	6 years ago
Jason Ish	8d7d6a96a5	ethernet: fix next packet size on DCE packet ... Missing parans on the DCE length caused the length update for the next call to DecodeEthernet to be wrong. Tests added. Redmine issue: https://redmine.openinfosecfoundation.org/issues/2887	6 years ago
Victor Julien	76cc03010a	ssh: fix banner overflow issue ... Reported-by: Sirko Höer - Code Intelligence	6 years ago
Victor Julien	2b75222250	runmodes: for test runmodes, clean up properly ... For conf test and engine analysis, clean up memory correctly. This helps valgrind tests for leaks.	6 years ago
Jeff Lucovsky	74f436d209	logging: display base64 decoded string for packet ... This changeset changes the packet display to be base64, rather than hex.	6 years ago
Jeff Lucovsky	7d28c19f05	logging: Ensure all anomalous events have an event_type ... This change ensures that each anomaly is tagged with an event type to support querying. Each anomalous event will include `"event_type": "anomaly"` in the log record.	6 years ago
Jeff Lucovsky	5e222129d5	eve/alert: Remove unused results from PrintRawLineHexBuf ... This changeset removes the call to `PrintRawLineHexBuf`. The return values were never used.	6 years ago
Jeff Lucovsky	a8938f449d	logging: Anomaly logging ... This changeset adds anomaly logging to suricata for issue 2282. Anomaly logging is controlled via the `anomaly` section within eve-log. There is a single option -- `packethdr` -- for including the packet header in the anomaly.	6 years ago
Philippe Antoine	a1c6e091ac	http: new event for auth unrecognized ... activates libhtp auth parsing Fixes #984	6 years ago
Jeff Lucovsky	7d6875fb68	documentation: Correct rst for ssh-keywords ... This changeset corrects an error in the ssh-keywords where 3 "`" characters were used instead of 2 "`" characters.	6 years ago
Jeff Lucovsky	97fc7c1e1a	documentation: sticky buffer updates ... This changeset updates the userguide for the TLS and JA3 keywords that have been renamed from <id>_<name> to <id.name>	6 years ago
Jeff Lucovsky	7f102d95b6	detect: Modernize TLS keywords ... This changeset adds keywords for "tls.<name>" and moves the existing value of "tls_<name>" to an alias.	6 years ago
Alexander Bluhm	36796de731	init: pledge(2) needs "fattr" during suricata reload. ... When killed with SIGHUP, suricata reopens the log files. If filemode is set in the config, it needs pledge promise "fattr" to allow the chmod(2) on OpenBSD.	6 years ago
Giuseppe Longo	76357350fd	doc: update http.protocol description	6 years ago
Giuseppe Longo	af9399f2ac	detect-http-protocol: use v2 inspect/mpm engines ... This updates inspect/mpm engines to v2.	6 years ago
Shivani Bhardwaj	4705314fd2	doc: Add manpages for suricatasc and suricatactl ... Add the missing manpages and the corresponding Sphinx configuration for the command line tools `suricatasc` and `suricatactl`. Closes redmine ticket #884.	6 years ago
Victor Julien	a6a0b0aa4a	detect/files: fix file sigs state handling ... Make sure all file sig mismatches indicate this in their return code, not just the ones with filestore enabled. This is needed to tell the stateful detect engine that it is dealing with a file sig, so it can make sure these are inspected correctly even if there are possibly multiple files per tx.	6 years ago
Victor Julien	225cdf996e	eve/alert: take vlan from packet, not flow ... Flow is not guaranteed to exist.	6 years ago
Eric Leblond	360a6ace43	doc: add info about buffer usage in lua	6 years ago
Eric Leblond	497f35164b	detect-filename: avoid multiple inspections of buf ... If the filename inspection function is returning nomatch this will trigger iterative inspections with same content (aka filename) being inspected. To avoid this we change the return as the buffer inspection has not to be inspected anymore.	6 years ago
Eric Leblond	63f2032ed6	doc: fix way to build URL	6 years ago
Eric Leblond	f48ac1860a	detect-lua: implement sticky buffer ... This patch implement an option named 'buffer' that can be used in the init function of a lua signature: function init (args) local needs = {} needs["buffer"] = tostring(true) return needs end With this, the lua script will get access to the sticky buffer content.	6 years ago
Eric Leblond	62a11dd3ed	detect-lua: fix DNP3 value	6 years ago
Mark Janssen	600f2ab391	eve/json: always output vlan field as array	6 years ago
Mark Janssen	0cc3c2cc6c	eve/flow: add in_iface field ... Fixes #2057	6 years ago
Mark Janssen	fed9b7a180	eve/flow: add vlan field	6 years ago