aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
18,779 Commits
8 Branches
173 Tags
193 MiB
main-8.0.x
main
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '42a85c37f1'
${ noResults }
Commit Graph

555 Commits (42a85c37f129cd984d77de19c6316fa245275457)

Author SHA1 Message Date
Victor Julien 6c3169cee0 doc/userguide: add ether and arp to intro 4 months ago
Victor Julien 6298c47145 doc/userguide: improve protocol docs 4 months ago
Victor Julien 2e2132a16f doc/userguide: improve pkthdr docs 4 months ago
Victor Julien 61a7f47a69 detect: add ether.hdr keyword 
Sticky buffer to inspect the ethernet header.

Example rule:

        alert ether any any -> any any ( \
                ether.hdr; content:"|08 06|"; offset:12; depth:2; \
                sid:1;)

Ticket: #8327.
 4 months ago
Juliana Fajardini 8c29c471b4 userguide: add references to rules/README to docs 
To make it more visible/easier to find.
 5 months ago
Philippe Antoine 1e0f344ab7 doc: be more precise for decompress transforms 
Ticket: 7846
 5 months ago
Victor Julien 2480f8c038 doc: fix dcerpc.opnum documentation 
Docs were claiming greater than, less than, etc. support even though this was never supported.

Fixes: 51be8f0238 ("doc/dcerpc: add proto keywords")

Ticket: #8330.
 5 months ago
Victor Julien fe3cce895c doc/userguide: add igmp keyword docs 5 months ago
Victor Julien 7e6fd09e90 doc/userguide: add missing ipopts values 5 months ago
Philippe Antoine d5ea973791 detect/ike: move ike.ike.chosen_sa_attribute keyword to rust 
Ticket: 8310

And increases expressivity on the way by supporting other modes
than equality
 6 months ago
Sven Cuyt 1246f1cf8c doc/userguide: add link to differences-from-snort 
Ticket: #8031.
 6 months ago
Sven Cuyt a0cc534471 doc/userguide: fix table showing example payload 
Ticket: #8031.
 6 months ago
Sven Cuyt 2d662538e5 doc/userguide: add example with non-zero offset for relative isdataat 
Ticket: #8031.
 6 months ago
Victor Julien 7c5285e5e6 doc/userguide: explain isdataat absolute vs relative difference 
Ticket: #8031.
 6 months ago
Philippe Antoine 539e4ee665 detect/transforms: add zlib_deflate transform 
Ticket: 7846
 6 months ago
Philippe Antoine dbea660729 detect/transforms: add gunzip transform 
Ticket: 7846
 6 months ago
Andreas Dolp 69eb567dea doc/userguide: fix within-distance pointer graphics in payload-keywords doc 
Redmine ticket: #8261

According to [1], the within pointer (if combined with distance)
includes the distance pointer, which is not clearly visible in the
graphic.

Fixed this in a new graphic by some GIMP arts.

PS: Special thanks to one of our team members Annika C. for initially
spotting this!

[1] https://forum.suricata.io/t/is-within-affected-by-distance/1688
 6 months ago
Mingyu Jeon c98112eb67 doc: update tls_cert_notafter/before 
refs #3065

* add explanation on omitted values
 6 months ago
Jeff Lucovsky 45a36e961f doc/byte_jump: Clarify bitmask operation 
Issue: 6693

Clarify how the bitmask value is used for byte_jump

Snort compatibility says:
- The bitmask value is applied to the extracted value before the
  multiplier is applied.
- The result of the bitmask operation is to be right shifted by the
  number of trailing 0's in the bitmask value.
 6 months ago
Ofer Dagan 7627756360 detect/detection_filter: add unique_on option 
Add optional unique_on {src_port|dst_port} to detection_filter for
exact distinct port counting within the seconds window.

Features:
- Runtime uses a single 64k-bit (8192 bytes) union bitmap per
  threshold entry with O(1) updates.
- Follows detection_filter semantics: alerting starts after the
  threshold (> count), not at it.
- On window expiry, the window is reset and the current packet's
  port is recorded as the first distinct of the new window.

Validation:
- unique_on requires a ported transport protocol; reject rules
  that are not tcp/udp/sctp or that use ip (protocol any).

Memory management:
- Bitmap memory is bounded by detect.thresholds.memcap.
- New counters: bitmap_memuse and bitmap_alloc_fail.

Tests:
- C unit tests for parsing, distinct counting, window reset, and
  allocation failure fallback.
- suricata-verify tests for distinct src/dst port counting.

Task #7928
 6 months ago
Victor Julien 73a873ecfe doc/userguide: endswith can be mixed with offset/distance/within 
Bug: #5030.
 7 months ago
Shivani Bhardwaj 30bdaa44e1 doc: add elephant.flow usage section 8 months ago
Shivani Bhardwaj 06eafb79d6 detect/flow-pkts: check for both dir 
The functionality of "both" can already be easily achieved by using both
"toclient" and "toserver" in a rule. This just adds the ease of
expression in rule. As it is added now, check the direction for the
pre-existing users of direction as well.
 8 months ago
Jeff Lucovsky 845544aad3 doc/luaxform: Clarify luaxform calling convention 
Issue: 8135

Clarify the calling convention for the Lua transform's `transform`
function.
 8 months ago
Juliana Fajardini 907f4faff8 doc/thresholding: minor fix for backoff subsection 8 months ago
Philippe Antoine c93e69830a detect/ssl: properly handle negation in ssl_version keyword 
Ticket: 3220

DetectSslVersionMatch did not handle properly negation.
It could never match on a signatrue with ssl_version: !tls1.3
That is because, if we had such a signature and network traffic
with tls1.1, we were looking into DetectSslVersionData field
for tls1.1, which was not set, instead of looking at field
for tls1.3 which was set with negated flag.

Previous DetectSslVersionData was holding redundant information.
It did not need to have it for each ssl version, but just globally.
Also, it did not need to hold the version as a value in the array,
as it was redundant with the index of the array.
 8 months ago
Philippe Antoine 1329786f84 detect: new command line option : list-rule-protos 
To list the protocols we can use a in a rule header

Ticket: 635
 8 months ago
Philippe Antoine d94aea8331 detect: tcp.window is now a generic integer 
Ticket: 7889
 9 months ago
Philippe Antoine 68bb783e97 detect: tcp.seq is now a generic integer 
Ticket: 7889
 9 months ago
Philippe Antoine ed907bbd78 detect: tcp.ack is now a generic integer 
Ticket: 7889
 9 months ago
Philippe Antoine 7a8eb28cae detect: id is now a generic integer 
Ticket: 7889
 9 months ago
Philippe Antoine bff7413488 detect: icmp_seq is now a generic integer 
Ticket: 7889
 9 months ago
Philippe Antoine 79e66f76e6 detect: icmp_id is now a generic integer 
Ticket: 7889
 9 months ago
Philippe Antoine 09531447d1 detect: fragoffset is now a generic integer 
Ticket: 7889
 9 months ago
Philippe Antoine 85fa894425 detect: dnp3.func is now a generic integer 
Ticket: 7889
 9 months ago
Jeff Lucovsky b02d9bb4f1 doc/luaxform: Remove init function from example 
Issue: 8035

The `luaxform` transform doesn't support the `init` function. This
commit removes that from the example and clarifies how functions in the
Lua script are used.
 9 months ago
Philippe Antoine c61f1cb6d0 detect/integers: rename index all1 to all 
And all to all_or_absent

Ticket: 7929
 9 months ago
David Wharton 9d2d1c4f8f doc: minor verbiage tweaks and reST fix 10 months ago
Philippe Antoine d8cb00e795 detect/tcp: make tcp.flags a generic integer with bitflags 
Ticket: 6724

Allows to use numerical values for example

Also fixes some unit tests that were returning 1 after goto error
FlagsTestParse05 especially took this path as
de->ignored_flags != (TH_SYN|TH_RST) was false
we had de->ignored_flags == 0xff ^ (TH_SYN|TH_RST)
And then, we had a match, instead of what the not-run code
was supposing.
 10 months ago
Philippe Antoine 1f9236a6d8 detect/ipv4: make fragbits a generic uint16 bitflags keyword 
Ticket: 6724

Allows to use numerical values
 10 months ago
Philippe Antoine 633180c93f detect/integers: generalize support for bitflags modifier 
Ticket: 6724

Allows sugar syntax for bitflags keywords.
While the expressivity does not increase, because we could already
use numerial values with all generic integer modes, this modifier
prefix is used with the strings, and follows the syntax
that is already used for fragbits and tcp.flags keyword.
 10 months ago
Philippe Antoine 4b69a31dc3 detect/integers: count argument for multi-integers 
Ticket: 7211

Allows to count the number of elements, without matching on
individual elements
 10 months ago
Philippe Antoine 969739d067 detect: http2.errorcode is now a generic integer 
Ticket: 7889
 10 months ago
Philippe Antoine 401b2fcae6 detect: http2.frametype is now a generic integer 
Ticket: 7889
 10 months ago
Victor Julien 48972d544c doc/userguide: link to protocol details from transactional rules 11 months ago
Victor Julien 480e664b4c doc/userguide: add xbits tx scope support 
Ticket #7680.
 11 months ago
Victor Julien a1c4167d94 doc/userguide: add initial protocols overview 
Explain per protocol mechanics for rule matching.
 11 months ago
Victor Julien e2a5bc058c doc/userguide: fix DCERPC headings 11 months ago
Victor Julien be5c83ed53 doc/userguide: add rule hooks to protocol doc 
Ticket #7662.
 11 months ago
Victor Julien 91f258e2bc doc/userguide: add missing app-layer protocols 11 months ago