aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
19,663 Commits
8 Branches
174 Tags
248 MiB
main
main-8.0.x
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.7
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '49aefe7093'
${ noResults }
Commit Graph

19663 Commits (49aefe7093a8d553ddc480f6d1733c377eeded9d)
 

Author SHA1 Message Date
Victor Julien dde0d7295b tls: improve client/server hello parsing loops 
Bug: #8795.
 3 months ago
Philippe Antoine 46880985ef http2: find content-encoding without case-sensitivity 
See RFC 9110 8.4.1

> All content codings are case-insensitive

Ticket: 8760
 3 months ago
Philippe Antoine 425b9c6777 ftp/expectation: fix ippair leak 
Ticket: 5204

ippair use_cnt increased by AppLayerExpectationCreate calling
IPPairGetIPPairFromHash was never decreased
 3 months ago
Philippe Antoine dee0f03db4 detect/modbus: move modbus keyword to rust 
Ticket: 3195
 3 months ago
Philippe Antoine 3e70a79ed2 detect/nfs: move nfs.version to rust 
Ticket: 3195
 3 months ago
Philippe Antoine e976db7261 detect/template: remove template2 
Ticket: 7278

Its usage was removed in 512bbe4de8
 3 months ago
Philippe Antoine d0cc39c79a rfb/jsonschema: add missing field 
Ticket: 6478
 3 months ago
dependabot[bot] 060808f36e github-actions: bump ossf/scorecard-action from 2.4.3 to 2.4.4 
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.3 to 2.4.4.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](4eaacf0543...2d1146689b)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-version: 2.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 3 months ago
dependabot[bot] 279317327c github-actions: bump github/codeql-action from 4.36.2 to 4.37.3 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.36.2 to 4.37.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/v4.36.2...v4.37.3)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.37.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 3 months ago
dependabot[bot] c6164c6ef1 github-actions: bump github/codeql-action/upload-sarif 
Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 1f34ec16430d82636d18716acc7aaa6d843b35a9 to 1cd4d01d58f636bbdbffbfd3c121b3446d07e9f3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](1f34ec1643...1cd4d01d58)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 1cd4d01d58f636bbdbffbfd3c121b3446d07e9f3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 3 months ago
dependabot[bot] bc04ca0f00 github-actions: bump actions/checkout from 7.0.0 to 7.0.1 
Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](https://github.com/actions/checkout/compare/v7...v7.0.1)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 3 months ago
dependabot[bot] 050290b636 github-actions: bump vmactions/freebsd-vm from 1.5.0 to 1.5.2 
Bumps [vmactions/freebsd-vm](https://github.com/vmactions/freebsd-vm) from 1.5.0 to 1.5.2.
- [Release notes](https://github.com/vmactions/freebsd-vm/releases)
- [Commits](5a72679103...77ed28d336)

---
updated-dependencies:
- dependency-name: vmactions/freebsd-vm
  dependency-version: 1.5.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 3 months ago
Jeff Lucovsky e7f1692a5c defrag: fix defrag.memuse counter reporting memcap 
Populate defrag.memuse from DefragTrackerGetMemuse() rather than
DefragTrackerGetMemcap(), so it reports actual usage, not the cap.

Issue: 8752
 3 months ago
Jason Ish 62fdb771b0 smtp: check transaction before to-client completion 
Make sure the transaction still exists before completing it in the
to-client direction. A pipelined RSET reply may already have completed and
freed it while a later end-of-DATA marker still refers to it.

Found by OSS-Fuzz testcase 5498180758994944.

Bug #8739.
 3 months ago
Shivani Bhardwaj 9afab955c3 conf: disable flowbits.max-per-signature by default 3 months ago
Jason Ish b364f28387 github-ci: update RUST_VERSION_KNOWN 
To 1.97 as that is where we are clippy clean to.
 4 months ago
Jason Ish e9b08dbb2d rust: clippy fixups for 1.97 
Mostly provided by clippy --fix, and one `.to_string()` removal where
not needed.
 4 months ago
Victor Julien 8455efd9ac app-layer: add substate support to list hooks 
Add substates to the --list-app-layer-hooks option.
 4 months ago
Victor Julien 8a5e8c63b2 detect: strict validation of buffers 
Make sure that every buffer in a signature is actually used in the
setup of the engines. Reject sigs that are locked to a certain substate
and use buffers that require another.
 4 months ago
Victor Julien 89baff01c9 output/tx: allow registering logging at substate 
Register HTTP/2 and DOH2 this way.
 4 months ago
Victor Julien a824d97d71 detect: use sub state to select inspect engines 
When building the per signature app_inspect list, only add engines
that match the sub state specified in the hook.
 4 months ago
Victor Julien c5d4a250b5 detect/firewall: avoid passing state match for policy 4 months ago
Victor Julien 9a294bf73b app-layer: check if protocol is enabled for sub state callbacks 4 months ago
Victor Julien f545f06cf2 doh2: do not enable parser if http2 is disabled 
DOH2 depends on HTTP/2, so it makes no sense to enable it separately.

It would also put the sub state handling in a weird state, as the DOH2
side reuses the registered HTTP/2 callbacks.
 4 months ago
Victor Julien cf216b6309 http2: rename state *start to *started 
This is to make the hook use names consistent with the default
hooks and other protocols.
 4 months ago
Victor Julien f8f28c6f6f detect: sync prefilter and app inspect alproto logic 
In firewall mode the alproto logic when building prefilter and rule
engines is strict, but was out of sync between prefilter and rule app
inspect engines.

For SIGNATURE_HOOK_TYPE_APP rules the logic is strict, with an exception
for HTTP/2 and DOH2. DOH2 is not a full protocol implementation, but
rather HTTP/2 with a different alproto.

Fixes: d64954a873 ("detect: don't register unrelated inspect engines")
 4 months ago
Victor Julien 56d9670af7 eve/alert: log sub state progress values 4 months ago
Victor Julien f02a427059 eve/alert: clean up state logging 4 months ago
Victor Julien 110e74642e detect/firewall: harden policy lookup logic 4 months ago
Victor Julien cfc98aeeaf detect: add debug validation checks to assert assumptions 4 months ago
Victor Julien 7517ba9f98 detect: give clear errors for http2 w/o substate 
http2 states were not yet supported even if the built-in states could
already work. Clearly error out on a hook w/o substate.
 4 months ago
Victor Julien e4176d2b9a detect/firewall: support substate in analyzer 4 months ago
Victor Julien 2511070a58 detect/firewall: support lte mode for substate 4 months ago
Victor Julien e1e24d6cb4 eve/alert: add sub state output 4 months ago
Victor Julien 7e60c3205e detect/alert: store sub-state in PacketAlert 
In preparation of being able to log it.
 4 months ago
Victor Julien 17a3e0d44f app-layer: use macro for progress ceiling 4 months ago
Victor Julien 2e1003a026 detect: add debug validation checks 
Check that sub state handling is correct.
 4 months ago
Victor Julien af1c72c37e detect/mpm: don't register engines for disabled protocols 4 months ago
Victor Julien 3b6b381f90 detect/firewall: add default alert signature to policy object 
Now that there is a policy hash, make the alert signature object a
member of that to avoid another hash table lookup.
 4 months ago
Victor Julien bffea309db detect/firewall: implement app policy as hash table 
With substate support the fixed table approach for policies was no
longer a good fit, so convert to a hash table. The policies are stored
per alproto, sub_state, progress and direction.
 4 months ago
Victor Julien eb87137471 detect/parse: allow bigger protocol/hook specifications 4 months ago
Victor Julien 6a3f9bc0b0 app-layer: for sub state API treat DOH2 as HTTP/2 
Otherwise we'd have to re-register the relevant callbacks.
 4 months ago
Victor Julien 956030452f detect/parse: don't setup sub states if protocol doesn't support it 4 months ago
Victor Julien bb41ef9caf http2: update push promise to account for stream id 0 filtering 4 months ago
Victor Julien c17ab6a65e http2: set event on frame types not allowed on stream id 4 months ago
Victor Julien 3ef0d2ce16 detect/parse: parse sub state hooks 
Register a generic list for each sub state / progress combo.
 4 months ago
Victor Julien 116a060092 detect/firewall: policy for substates 
For the most part hard coded for HTTP/2 for now.
 4 months ago
Victor Julien 63b8143577 http2: register names for states per sub-state 4 months ago
Victor Julien 14100d795c http2: mark HTTP2TxProgress and HTTP2TxGlobalProgress as AppLayerState 4 months ago
Victor Julien cedb836d01 output/dns: update for DOH2 change 4 months ago