508 Commits (2d217e66611b767b70634c5c9901a828ac00d690)

Author	SHA1	Message	Date
Victor Julien	24f0092b72	detect: add ipv6.hdr sticky buffer ... Inspects IPv6 header and extension headers.	7 years ago
Victor Julien	4ac327f5b5	detect/ipv4: add ipv4.hdr sticky buffer	7 years ago
Henrik Lund Kramshoej	3519b011b7	decoder/vxlan: initial implementation of decoder	7 years ago
Victor Julien	ac694b089a	detect: add udp.hdr sticky buffer	7 years ago
Victor Julien	bdf53f449c	detect/tcp: rename tcp keyword files	7 years ago
Victor Julien	35be8385eb	detect: tcp.hdr sticky buffer ... Sticky buffer to inspect the TCP header.	7 years ago
Victor Julien	66648df099	detect: add tcp.mss keyword ... Allows matching on TCP option MSS. Syntax: tcp.mss:<value>; tcp.mss:<value1>-<value2>; tcp.mss:<op><value>; Operator can be: >, <.	7 years ago
Pierre Chifflier	9dfec7e734	SNMP: add the "snmp.pdu_type" detection keyword	7 years ago
Pierre Chifflier	e1dd19a0eb	SNMP: add the "snmp.community" detection keyword	7 years ago
Pierre Chifflier	aa608e0ca2	SNMP: add the "snmp.version" detection keyword	7 years ago
Pierre Chifflier	6fc7fc74cb	SNMP: add logger	7 years ago
Pierre Chifflier	2df840a8b8	Add SNMP (v1/v2c/v3) application layer	7 years ago
Mats Klepsland	0b489f329c	detect: add (mpm) keyword ja3s.string ... Match on JA3S string using ja3s.string keyword, e.g: alert tls any any -> any any (msg:"ja3s.string test"; ja3s.string; content:"10-11-12"; sid:1;)	7 years ago
Mats Klepsland	80cee50916	detect: add (mpm) keyword ja3s.hash ... Match on JA3S hash using ja3s.hash keyword, e.g: alert tls any any -> any any (msg:"ja3s.hash test"; ja3s.hash; content:"b26c652e0a402a24b5ca2a660e84f9d5"; sid:1;)	7 years ago
Mats Klepsland	ba857e9739	detect: add tls.certs keyword ... Add keyword to do "raw" matching on each of the certificates in the TLS certificate sticky buffer. Example: alert tls any any -> any any (msg:"tls.certs test"; tls.certs; \ content:"|01 02 03 04|"; sid:1;)	7 years ago
Victor Julien	84da0376fb	detect/http.host: rename file for consistency	7 years ago
Jeff Lucovsky	a8938f449d	logging: Anomaly logging ... This changeset adds anomaly logging to suricata for issue 2282. Anomaly logging is controlled via the `anomaly` section within eve-log. There is a single option -- `packethdr` -- for including the packet header in the anomaly.	7 years ago
Victor Julien	c2cb155ebb	rust/smb: rename files and code from RustSMB to SMB	7 years ago
Victor Julien	f30c05e684	smb: remove C implementation ... Now that Rust is mandatory it is obsolete. Ticket: #2849	7 years ago
Jason Ish	78b82ce6a5	dns-log: remove, not supported now that Rust is required ... The non-json line based DNS log is not supported with Rust only builds and has been scheduled for removal in Suricata 5.0. Redmine issue: https://redmine.openinfosecfoundation.org/issues/2297	7 years ago
Jeff Lucovsky	81c1af0887	detect: implement http {location,server} sticky buffer ... This implements inspection of the Server and Location buffer as a content sticky buffer.	7 years ago
Victor Julien	d6903e70c1	file-log: remove and add warning ... Feature was deprecated and scheduled for removal. Ticket #2376	8 years ago
Victor Julien	aab03dde87	mpm/ac-ks: rename files from -tile to -ks	8 years ago
Victor Julien	6fcd2db043	tile: remove files	8 years ago
Victor Julien	998f32f88c	detect/tls: consolidate validity code	8 years ago
Victor Julien	ccdafe6697	detect/http-server-body: move tests to tests/	8 years ago
Victor Julien	64987f36fb	detect/file-data: move tests into tests/	8 years ago
Victor Julien	9a8092249e	detect/http-client-body: move tests into tests/	8 years ago
Victor Julien	76fd666cad	detect/http_raw_header: move tests into tests/	8 years ago
Victor Julien	ab027cb481	detect/http_cookie: move tests into tests/	8 years ago
Victor Julien	2f342da048	detect/http_stat_code: move tests into tests/	8 years ago
Victor Julien	5dfba01b2e	detect/http_stat_msg: move tests to tests/	8 years ago
Victor Julien	b469938998	detect/http_raw_host: move raw into regular host logic	8 years ago
Victor Julien	dc43f35427	detect/http_host: move tests into tests/	8 years ago
Victor Julien	cb332b4cda	detect/http_method: move all tests into tests/	8 years ago
Victor Julien	0a405e27a0	detect/http_raw_uri: code reorganization ... Move registration into http_uri logic, move tests into the other uri tests. Switch to v2 mpm/inspect APIs.	8 years ago
Victor Julien	10e2731f18	detect/http-uri: move tests into tests/	8 years ago
Victor Julien	3111910fc6	detect/http_user_agent: move tests into tests/	8 years ago
Victor Julien	eb73008ccf	detect/transform: add to_sha1 keyword	8 years ago
Victor Julien	75f9c1ae9f	detect/transform: add to_md5 keyword	8 years ago
Victor Julien	0f1fc1f0c8	hash: move string hash funcs into util files	8 years ago
Eric Leblond	0e3b1eba86	util-binsearch: remove the files	8 years ago
Eric Leblond	3c566e0f89	util-bpf: introduce custom BPF compile functions ... We can't get error from pcap_compile_nopcap() so let's get our own function and output message.	8 years ago
Victor Julien	8b8270e732	eve/json: add common helper funcs ... Add simple helper funcs for option-less loggers	8 years ago
Jason Ish	35fd10bc2e	rust: app-layer detect template for rust parsers	8 years ago
Jason Ish	ee3aba9008	templates: C stub output for Rust logger	8 years ago
Jason Ish	96dc20abb1	templates: C stub template for Rust parser	8 years ago
Victor Julien	486054595a	detect/template2: template with prefilter (copy of ttl)	8 years ago
Victor Julien	555fb15ab4	tree: add 2-clause BSD licensed tree.h	8 years ago
Jacob Masen-Smith	ec77632e84	Adds WinDivert support to Windows builds ... Enables IPS functionality on Windows using the open-source (LGPLv3/GPLv2) WinDivert driver and API. From https://www.reqrypt.org/windivert-doc.html : "WinDivert is a user-mode capture/sniffing/modification/blocking/re-injection package for Windows Vista, Windows Server 2008, Windows 7, and Windows 8. WinDivert can be used to implement user-mode packet filters, packet sniffers, firewalls, NAT, VPNs, tunneling applications, etc., without the need to write kernel-mode code." - adds `--windivert [filter string]` and `--windivert-forward [filter string]` command-line options to enable WinDivert IPS mode. `--windivert[-forward] true` will open a filter for all traffic. See https://www.reqrypt.org/windivert-doc.html#filter_language for more information. Limitation: currently limited to `autofp` runmode. Additionally: - `tmm_modules` now zeroed during `RegisterAllModules` - fixed Windows Vista+ `inet_ntop` call in `PrintInet` - fixed `GetRandom` bug (nonexistent keys) on fresh Windows installs - fixed `RandomGetClock` building on Windows builds - Added WMI queries for MTU	8 years ago