aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
19,351 Commits
8 Branches
174 Tags
251 MiB
main
main-8.0.x
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.7
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '23d5cad872'
${ noResults }
Commit Graph

19351 Commits (23d5cad872b78aed6a7d574098d6e9984138bea7)
 

Author SHA1 Message Date
Philippe Antoine 23d5cad872 detect/dataset: delay set operation after signature full match 
The set operation of dataset keyword was done even if signature
did not fully match, which is not the expected behavior.
We want dataset to behave like flowbits for instance.

This patch changes the behavior of the dataset keyword to do a
match and a post match for the set operation.
The postmatch retrieves the data, using the list identifier
associated to the buffer for this signature.

This avoids to store the buffer(s), when we do not have a
dedicated storage (per signature and per tx) that can own
and clean arbitrary buffers over multiple packets, in
the case the transaction spans over multiple packets
with different tx progresses for instance.

Thanks to delay_postmatch, the callback DetectDatasetTxMatch
should be called on the last packet taking the final match
decision. At this point, the inspection buffers are cached
and easy to get.
The most complex case is for multi-buffers, where we need
to know which buffers/local_ids matched. We use the ephemeral
storage (lives with one packet detection) provided by
DetectThreadCtxGetKeywordThreadCtx

For multi-buffers, we also return DETECT_ENGINE_INSPECT_SIG_MATCH_MORE_BUF
to indicate that we want to know all the instances which match.

Ticket: #5576
 4 months ago
Philippe Antoine e66eaec6c9 detect: allow inspection of multi-buffers beyond first match 
DETECT_ENGINE_INSPECT_SIG_MATCH_MORE_BUF is the new return status
to allow dataset/set to pick all matching and only the matching
buffers in case of a multi-buffer
 4 months ago
Philippe Antoine 6772a43a95 detect: delay_postmatch ability for buffers 
Buffers can be put at the tail of inspections whatever their progress.

This will allow dataset/set to be inspected in the context of
the final packet matching or not, and thus use the ephemeral
data from DetectThreadCtxGetKeywordThreadCtx
 4 months ago
Philippe Antoine 2d5e922125 detect: postmatch can run AppLayerTxMatch callbacks 
Will be useful for dataset, when it needs to find a transaction
buffer again.
 4 months ago
Philippe Antoine 70157b1e15 ci/live: test for sid 1 existence, not in last position 4 months ago
Victor Julien 8455efd9ac app-layer: add substate support to list hooks 
Add substates to the --list-app-layer-hooks option.
 4 months ago
Victor Julien 8a5e8c63b2 detect: strict validation of buffers 
Make sure that every buffer in a signature is actually used in the
setup of the engines. Reject sigs that are locked to a certain substate
and use buffers that require another.
 4 months ago
Victor Julien 89baff01c9 output/tx: allow registering logging at substate 
Register HTTP/2 and DOH2 this way.
 4 months ago
Victor Julien a824d97d71 detect: use sub state to select inspect engines 
When building the per signature app_inspect list, only add engines
that match the sub state specified in the hook.
 4 months ago
Victor Julien c5d4a250b5 detect/firewall: avoid passing state match for policy 4 months ago
Victor Julien 9a294bf73b app-layer: check if protocol is enabled for sub state callbacks 4 months ago
Victor Julien f545f06cf2 doh2: do not enable parser if http2 is disabled 
DOH2 depends on HTTP/2, so it makes no sense to enable it separately.

It would also put the sub state handling in a weird state, as the DOH2
side reuses the registered HTTP/2 callbacks.
 4 months ago
Victor Julien cf216b6309 http2: rename state *start to *started 
This is to make the hook use names consistent with the default
hooks and other protocols.
 4 months ago
Victor Julien f8f28c6f6f detect: sync prefilter and app inspect alproto logic 
In firewall mode the alproto logic when building prefilter and rule
engines is strict, but was out of sync between prefilter and rule app
inspect engines.

For SIGNATURE_HOOK_TYPE_APP rules the logic is strict, with an exception
for HTTP/2 and DOH2. DOH2 is not a full protocol implementation, but
rather HTTP/2 with a different alproto.

Fixes: d64954a873 ("detect: don't register unrelated inspect engines")
 4 months ago
Victor Julien 56d9670af7 eve/alert: log sub state progress values 4 months ago
Victor Julien f02a427059 eve/alert: clean up state logging 4 months ago
Victor Julien 110e74642e detect/firewall: harden policy lookup logic 4 months ago
Victor Julien cfc98aeeaf detect: add debug validation checks to assert assumptions 4 months ago
Victor Julien 7517ba9f98 detect: give clear errors for http2 w/o substate 
http2 states were not yet supported even if the built-in states could
already work. Clearly error out on a hook w/o substate.
 4 months ago
Victor Julien e4176d2b9a detect/firewall: support substate in analyzer 4 months ago
Victor Julien 2511070a58 detect/firewall: support lte mode for substate 4 months ago
Victor Julien e1e24d6cb4 eve/alert: add sub state output 4 months ago
Victor Julien 7e60c3205e detect/alert: store sub-state in PacketAlert 
In preparation of being able to log it.
 4 months ago
Victor Julien 17a3e0d44f app-layer: use macro for progress ceiling 4 months ago
Victor Julien 2e1003a026 detect: add debug validation checks 
Check that sub state handling is correct.
 4 months ago
Victor Julien af1c72c37e detect/mpm: don't register engines for disabled protocols 4 months ago
Victor Julien 3b6b381f90 detect/firewall: add default alert signature to policy object 
Now that there is a policy hash, make the alert signature object a
member of that to avoid another hash table lookup.
 4 months ago
Victor Julien bffea309db detect/firewall: implement app policy as hash table 
With substate support the fixed table approach for policies was no
longer a good fit, so convert to a hash table. The policies are stored
per alproto, sub_state, progress and direction.
 4 months ago
Victor Julien eb87137471 detect/parse: allow bigger protocol/hook specifications 4 months ago
Victor Julien 6a3f9bc0b0 app-layer: for sub state API treat DOH2 as HTTP/2 
Otherwise we'd have to re-register the relevant callbacks.
 4 months ago
Victor Julien 956030452f detect/parse: don't setup sub states if protocol doesn't support it 4 months ago
Victor Julien bb41ef9caf http2: update push promise to account for stream id 0 filtering 4 months ago
Victor Julien c17ab6a65e http2: set event on frame types not allowed on stream id 4 months ago
Victor Julien 3ef0d2ce16 detect/parse: parse sub state hooks 
Register a generic list for each sub state / progress combo.
 4 months ago
Victor Julien 116a060092 detect/firewall: policy for substates 
For the most part hard coded for HTTP/2 for now.
 4 months ago
Victor Julien 63b8143577 http2: register names for states per sub-state 4 months ago
Victor Julien 14100d795c http2: mark HTTP2TxProgress and HTTP2TxGlobalProgress as AppLayerState 4 months ago
Victor Julien cedb836d01 output/dns: update for DOH2 change 4 months ago
Victor Julien 5735b87c3a detect: change how DOH2 inspection works 
DNS/HTTP2 no longer automatically registers all keywords also for DOH2.

Instead, the DNS keywords and HTTP/2 stream keywords are registered for
DOH2 explicitly as well.

- flow alproto DOH2 + engine DOH2  -> inspect inner DNS
- flow alproto DOH2 + engine HTTP2 -> inspect outer HTTP/2
- flow alproto DOH2 + engine UNKNOWN -> inspect outer HTTP/2
 4 months ago
Victor Julien 17953d2355 detect/http: register keywords for HTTP/2 
Now that HTTP keywords are no longer automatically registered for
HTTP/2, register them manually.
 4 months ago
Victor Julien b36ec146aa detect/dns: register keywords for DOH2 as well 
Now that DNS keywords are no longer registered for DOH2, the keywords
need to manually registered for DOH2.
 4 months ago
Victor Julien 1bb843d83f detect/http2: don't double register engines 
Each keyword supporting DOH2 must register explicitly
 4 months ago
Victor Julien 416b9c12ae detect/file: register http/2 with sub-state 4 months ago
Victor Julien c943de4fac detect/parse: initial http2 substate support 
Hard coded for now.
 4 months ago
Victor Julien 7ebc699df0 http2: split transaction state machines 
Split into 2 sub-states:
- stream, which has the "HTTP" requests and responses, including DOH2
- global, which has the settings and other global or control handling

Introduce a simpler progress tracking for the global sub state:
- HTTP2ProgGlobalStart and HTTP2ProgGlobalComplete.

The stream sub state uses the same state machine as before.

Ticket: #8386.
 4 months ago
Victor Julien 2f41e0ef2d output/tx: support substate completion flags 4 months ago
Victor Julien 67e2cb538a detect/app-layer-event: support sub-state progress handling 4 months ago
Victor Julien 59e2c5a40c detect/parse: initial substate support 4 months ago
Victor Julien 95365ce05b detect: support per tx sub states 
Support for per transaction sub states: different state machines per
transaction type.

Skip engines not belonging to our substate.

Store tx_type in DetectTransaction.

Each protocol supporting sub states will register states from 1 and up.

To support:

Ticket: #8386.
 4 months ago
Victor Julien b6bc025789 app-layer: start of substate API support 
Allow registration of per substate progress name mappings.

Implement logic for getting sub-state names, id's.

Add transaction type and end of progress values to AppLayerTxData.

Introduce helpers to keep logic clean.
 4 months ago