aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
15,709 Commits
7 Branches
155 Tags
192 MiB
master
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '2b4e10224e'
${ noResults }
Commit Graph

15709 Commits (2b4e10224eaebb613352e9b82556b60035d032a1)
 

Author SHA1 Message Date
Philippe Antoine c4b8fb7aca ssh: limit length for banner logs 
Ticket: 6770
 12 months ago
Philippe Antoine 271ed2008b ssh: avoid quadratic complexity from long banner 
Ticket: 6799

When we find an overlong banner, we get into the state just
waiting for end of line, and we just want to skip the bytes
until then.
Returning AppLayerResult::incomplete made TCP engine retain
the bytes and grow the buffer that we parsed again and again...
 12 months ago
Philippe Antoine cc3b4b01ec detect: flush when setting no_inspection 
Ticket: 6578

When a protocol such as SSH sets no_inspection, we still have to
flush the current streams and packets that contain clear-text
for detection.
 12 months ago
Philippe Antoine 4c4f7ff1a2 detect: update packet action on protocol change 
Ticket: #6305

When running FlowWorkerStreamTCPUpdate, one of the dequeued packet
may set the flow action to drop, without updating the not-pseudo
packet action, as is done usually with a previous call to
FlowHandlePacketUpdate
 12 months ago
Victor Julien ff8597d50b membuffer: annotate printf style function 12 months ago
Victor Julien 926c6e3add eve/alert: break out of payload logging callback if buffer is full 12 months ago
Victor Julien 1dea4fea0b eve/frame: break out of logging callback if buffer is full 12 months ago
Victor Julien 7d5b537f5c membuffer: return bytes written 12 months ago
Victor Julien 9c3669b03f membuffer: use buffer pointer as flexible array member 12 months ago
Victor Julien 3ef98f2b87 membuffer: turn complex macros into functions 
For better readability and type checking.
 12 months ago
Victor Julien ea98df8da2 unix-manager: add \n string to buffer using correct API call 12 months ago
Victor Julien 6e10c66078 eve/frame: improve frame payload logging 
Log using stream callback API, meaning that data will also
be logged if there are GAPs.

Also implement GAP indicators: '[123 bytes missing]'.
 12 months ago
Victor Julien a205583269 eve/frames: pass membuffer to API 
In preparation of stream logging changes.
 12 months ago
Victor Julien 462a6d7913 eve/alert: init membuffer size on missing config 
Don't init buffer to 0 size but use the desired default of 4k.
 12 months ago
Victor Julien 43858f70ad eve/alert: log payload directly from stream buffer 
This avoids looping over partly duplicate segments that cause
output data corruption by logging parts of the stream data multiple
times.

For data with GAPs now add a indicator '[4 bytes missing]' similar
to how Wireshark does it.

Bug: #6553.
 12 months ago
Victor Julien 829bab295b eve/frame: implement payload-buffer-size option 
Modeled after the same option in eve/alert. Defaults to 4k.
 12 months ago
Victor Julien a5a6527d26 stream: const args for StreamReassembleLog 
Needed a workaround cast for RBTREE use.
 12 months ago
Victor Julien f53c4ab149 yaml: remove newline from error message 12 months ago
Jeff Lucovsky e41c2f15c2 gen/typo: Correct comment typo 12 months ago
Jeff Lucovsky 3c5745978f flow: Swap thread_ids 
Issue: 6835

When swapping the flow's direction, also swap the thread_ids.

This should help with the issues identified in
https://redmine.openinfosecfoundation.org/issues/2725
 12 months ago
Jeff Lucovsky 9ad73faa0a flow/inject: Ensure initialized thread value used 
Issue: 6835

When injecting a flow, ensure that the selected thread_id has been
initialized. When a flow is picked up midstream, the initialized thread
can be the second thread element.
 12 months ago
Philippe Antoine 632e52ca2b ci: update ubuntu22.04 builds with clang14+asan 
using a workround about ASLR
 12 months ago
Lukas Sismis 16c88f2db7 dpdk: fix typo in the struct member name 12 months ago
Lukas Sismis 5592ec079d dpdk: refactor the main packet loop into smaller functions 12 months ago
Lukas Sismis 0b5966c347 dpdk: only close the port when workers are synchronized 
When Suricata was running in IPS mode and received a signal to stop,
the first worker of every interface/port stopped the port and
proactively stopped the peered interface as well.
This was done to be as accurate with port stats as possible.
However, in a highly active scenarios (lots of packets moving around)
the peered workers might still be in the process of a packet
release operation. These workers would then attempt to transmit
on a stopped interface - resulting in an errorneous operation.

Instead, this patch proposes a worker synchronization of the given
port. After these workers are synchronized, it is known that no packets
will be sent of the peered interface, therefore the first worker can
stop it. This however cannot be assumed about "its own" port as the
peered workers can still try to send the packets. Therefore, ports
are only stopped by the peered workers.

Ticket: #6790
 12 months ago
Philippe Antoine 45bb936187 http: event on request line missing protocol 
Ticket: 6856
 12 months ago
Jason Ish 8284df3ed4 devguide: add an upgrade section 
Add an upgrade section to the devguide. This should cover any changes
to APIs that users might be using from plugins or as a library user.
 12 months ago
Jason Ish b7b16fb481 eve/filetype: reorder fields to match lifecycle 
Enhances readability.
 12 months ago
Jason Ish a3354e55e6 eve/filetypes: use more const 12 months ago
Jason Ish eee9757dba eve/filetype: ThreadDeinit can return void 
Change ThreadDeinit to return void instead of an int, there is nothing
to be done on success or failure.
 12 months ago
Jason Ish cd85d89f14 output-eve: doxygen docs for SCEveFileType 
Add documentation for the SCEveFileType in Doxygen format.
 12 months ago
Jason Ish 500d29f356 doxygen: document the examples directory 12 months ago
Jason Ish bd55cd4c55 eve/filetypes: common init for threaded and non-threaded 
In 7.0 if EVE was non-threaded, the ThreadInit for the filetype was
not called meaning that the filetype author had to handle the threaded
and non-threaded cases.

To simplify this, if non-threaded, still call ThreadInit (and
ThreadDeinit) once with a thread_id of 0. This should simplify
authoring EVE filetype plugins.
 12 months ago
Jason Ish 3ff72d3efa eve: rename plugin to filetypes 
EVE filetypes are not always plugins, for example, null and syslog
that are built-in filetypes.
 12 months ago
Jason Ish 7c8c9fff32 plugins: remove conf.h from suricata-plugin.h 
Remove "conf.h" from suricata-plugin.h as its not needed by that
header. However, some other files became transitively dependent on
through other includes, so fix those up.
 12 months ago
Jason Ish ead09c2497 eve/filetypes: remove from plugin context 
Remove EVE filetypes from plugin context as they are not only used
from plugins. Plugins allow user code to register filetypes, but we
also have internal file types that use this api including the null
output and syslog.  Additionally library users can use this API to
register filetypes, and they are not plugins.

Ideally this code would go in "output-json.[ch]" as the "primary" eve
API, however there are currently some include circular include issues
there, so start new cleaned up EVE API in "output-eve.[ch]" which is
"clean" with respect to includes, and as we cleanup existing EVE API for
"public" use, it can be moved here.

Ticket: #6838
 12 months ago
Jeff Lucovsky 3bf92bb14f example/plugin: Use ThreadId 12 months ago
Jeff Lucovsky 85d321a689 output/plugin: Use Suri thread-id for plugins 
Issue: 6408

Use the Suricata thread id for plugin thread initialization to give the
plugin a better correlating factor to the actual Suricata threads.
 12 months ago
Victor Julien 1122fa24b6 mpm/ac: minor test cleanups 12 months ago
Victor Julien d47bfbb14d mpm/ac: add endswith test 12 months ago
Victor Julien c312d670d4 mpm/ac: implement endswith 
When a pattern is using endswith, only consider it a match when it
is the end of the data.

Ticket: #6852.
 12 months ago
Victor Julien b499239ef5 mpm: register algo features 
This is so patterns can reply on mpm match meaning a full match.

Not yet used.
 12 months ago
Victor Julien dcfa59bb69 mpm/ac: tidy up main search loop 12 months ago
Victor Julien 4fd0745b78 detect: minor cleanup 12 months ago
Jason Ish ece2029b0b requirements.txt: use suricata-update master 12 months ago
Victor Julien e5d3fad5f4 nfq: stricter thread sync 
No longer update `Packet::flags` for tracking packet modifications,
as thread safety was not guaranteed.

Clearly separate between various kinds of `Packet::nfq_v` accesses for:
- mark
- mark_modified
- verdicted
These are either done under lock (Packet::persistent.tunnel_lock) or,
if the Packet is not part of a tunnel, not under lock.

This is safe as in all the related logic the Packet's tunnel state
is fixed and can no longer change.
 12 months ago
Victor Julien d2f7e89d11 decode/tunnel: split verdict logic 
Allows caller to take their own lock.
 12 months ago
Victor Julien 6066c4d6e7 decode/tunnel: improve tunnel handling 
Give each packet explicit tunnel type `ttype`: none, root, child.

Assigning happens when a (tunnel) packet is set up and is thread
safe.
 12 months ago
Victor Julien 9bc42e3b34 decode/tunnel: move tunnel verdicted logic 
In preparation of cleaning up thread safety, move "verdicted"
logic out of Packet::flags. Unsafe writes to "flags" can potentially
have side effects.
 12 months ago
Victor Julien c31a6f5649 nfq: remove obsolete comment 12 months ago