aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
19,665 Commits
8 Branches
174 Tags
248 MiB
main
main-8.0.x
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.7
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '5a5dcdab3e'
${ noResults }
Commit Graph

604 Commits (5a5dcdab3ed7da488efd58eb20e8cde43391f2c3)

Author SHA1 Message Date
Victor Julien 6298c47145 doc/userguide: improve protocol docs 7 months ago
Victor Julien 2e2132a16f doc/userguide: improve pkthdr docs 7 months ago
Victor Julien 61a7f47a69 detect: add ether.hdr keyword 
Sticky buffer to inspect the ethernet header.

Example rule:

        alert ether any any -> any any ( \
                ether.hdr; content:"|08 06|"; offset:12; depth:2; \
                sid:1;)

Ticket: #8327.
 7 months ago
Juliana Fajardini 8c29c471b4 userguide: add references to rules/README to docs 
To make it more visible/easier to find.
 8 months ago
Philippe Antoine 1e0f344ab7 doc: be more precise for decompress transforms 
Ticket: 7846
 8 months ago
Victor Julien 2480f8c038 doc: fix dcerpc.opnum documentation 
Docs were claiming greater than, less than, etc. support even though this was never supported.

Fixes: 51be8f0238 ("doc/dcerpc: add proto keywords")

Ticket: #8330.
 8 months ago
Victor Julien fe3cce895c doc/userguide: add igmp keyword docs 8 months ago
Victor Julien 7e6fd09e90 doc/userguide: add missing ipopts values 8 months ago
Philippe Antoine d5ea973791 detect/ike: move ike.ike.chosen_sa_attribute keyword to rust 
Ticket: 8310

And increases expressivity on the way by supporting other modes
than equality
 8 months ago
Sven Cuyt 1246f1cf8c doc/userguide: add link to differences-from-snort 
Ticket: #8031.
 8 months ago
Sven Cuyt a0cc534471 doc/userguide: fix table showing example payload 
Ticket: #8031.
 8 months ago
Sven Cuyt 2d662538e5 doc/userguide: add example with non-zero offset for relative isdataat 
Ticket: #8031.
 8 months ago
Victor Julien 7c5285e5e6 doc/userguide: explain isdataat absolute vs relative difference 
Ticket: #8031.
 8 months ago
Philippe Antoine 539e4ee665 detect/transforms: add zlib_deflate transform 
Ticket: 7846
 8 months ago
Philippe Antoine dbea660729 detect/transforms: add gunzip transform 
Ticket: 7846
 8 months ago
Andreas Dolp 69eb567dea doc/userguide: fix within-distance pointer graphics in payload-keywords doc 
Redmine ticket: #8261

According to [1], the within pointer (if combined with distance)
includes the distance pointer, which is not clearly visible in the
graphic.

Fixed this in a new graphic by some GIMP arts.

PS: Special thanks to one of our team members Annika C. for initially
spotting this!

[1] https://forum.suricata.io/t/is-within-affected-by-distance/1688
 9 months ago
Mingyu Jeon c98112eb67 doc: update tls_cert_notafter/before 
refs #3065

* add explanation on omitted values
 9 months ago
Jeff Lucovsky 45a36e961f doc/byte_jump: Clarify bitmask operation 
Issue: 6693

Clarify how the bitmask value is used for byte_jump

Snort compatibility says:
- The bitmask value is applied to the extracted value before the
  multiplier is applied.
- The result of the bitmask operation is to be right shifted by the
  number of trailing 0's in the bitmask value.
 9 months ago
Ofer Dagan 7627756360 detect/detection_filter: add unique_on option 
Add optional unique_on {src_port|dst_port} to detection_filter for
exact distinct port counting within the seconds window.

Features:
- Runtime uses a single 64k-bit (8192 bytes) union bitmap per
  threshold entry with O(1) updates.
- Follows detection_filter semantics: alerting starts after the
  threshold (> count), not at it.
- On window expiry, the window is reset and the current packet's
  port is recorded as the first distinct of the new window.

Validation:
- unique_on requires a ported transport protocol; reject rules
  that are not tcp/udp/sctp or that use ip (protocol any).

Memory management:
- Bitmap memory is bounded by detect.thresholds.memcap.
- New counters: bitmap_memuse and bitmap_alloc_fail.

Tests:
- C unit tests for parsing, distinct counting, window reset, and
  allocation failure fallback.
- suricata-verify tests for distinct src/dst port counting.

Task #7928
 9 months ago
Victor Julien 73a873ecfe doc/userguide: endswith can be mixed with offset/distance/within 
Bug: #5030.
 10 months ago
Shivani Bhardwaj 30bdaa44e1 doc: add elephant.flow usage section 10 months ago
Shivani Bhardwaj 06eafb79d6 detect/flow-pkts: check for both dir 
The functionality of "both" can already be easily achieved by using both
"toclient" and "toserver" in a rule. This just adds the ease of
expression in rule. As it is added now, check the direction for the
pre-existing users of direction as well.
 10 months ago
Jeff Lucovsky 845544aad3 doc/luaxform: Clarify luaxform calling convention 
Issue: 8135

Clarify the calling convention for the Lua transform's `transform`
function.
 11 months ago
Juliana Fajardini 907f4faff8 doc/thresholding: minor fix for backoff subsection 11 months ago
Philippe Antoine c93e69830a detect/ssl: properly handle negation in ssl_version keyword 
Ticket: 3220

DetectSslVersionMatch did not handle properly negation.
It could never match on a signatrue with ssl_version: !tls1.3
That is because, if we had such a signature and network traffic
with tls1.1, we were looking into DetectSslVersionData field
for tls1.1, which was not set, instead of looking at field
for tls1.3 which was set with negated flag.

Previous DetectSslVersionData was holding redundant information.
It did not need to have it for each ssl version, but just globally.
Also, it did not need to hold the version as a value in the array,
as it was redundant with the index of the array.
 11 months ago
Philippe Antoine 1329786f84 detect: new command line option : list-rule-protos 
To list the protocols we can use a in a rule header

Ticket: 635
 11 months ago
Philippe Antoine d94aea8331 detect: tcp.window is now a generic integer 
Ticket: 7889
 12 months ago
Philippe Antoine 68bb783e97 detect: tcp.seq is now a generic integer 
Ticket: 7889
 12 months ago
Philippe Antoine ed907bbd78 detect: tcp.ack is now a generic integer 
Ticket: 7889
 12 months ago
Philippe Antoine 7a8eb28cae detect: id is now a generic integer 
Ticket: 7889
 12 months ago
Philippe Antoine bff7413488 detect: icmp_seq is now a generic integer 
Ticket: 7889
 12 months ago
Philippe Antoine 79e66f76e6 detect: icmp_id is now a generic integer 
Ticket: 7889
 12 months ago
Philippe Antoine 09531447d1 detect: fragoffset is now a generic integer 
Ticket: 7889
 12 months ago
Philippe Antoine 85fa894425 detect: dnp3.func is now a generic integer 
Ticket: 7889
 12 months ago
Jeff Lucovsky b02d9bb4f1 doc/luaxform: Remove init function from example 
Issue: 8035

The `luaxform` transform doesn't support the `init` function. This
commit removes that from the example and clarifies how functions in the
Lua script are used.
 12 months ago
Philippe Antoine c61f1cb6d0 detect/integers: rename index all1 to all 
And all to all_or_absent

Ticket: 7929
 12 months ago
David Wharton 9d2d1c4f8f doc: minor verbiage tweaks and reST fix 1 year ago
Philippe Antoine d8cb00e795 detect/tcp: make tcp.flags a generic integer with bitflags 
Ticket: 6724

Allows to use numerical values for example

Also fixes some unit tests that were returning 1 after goto error
FlagsTestParse05 especially took this path as
de->ignored_flags != (TH_SYN|TH_RST) was false
we had de->ignored_flags == 0xff ^ (TH_SYN|TH_RST)
And then, we had a match, instead of what the not-run code
was supposing.
 1 year ago
Philippe Antoine 1f9236a6d8 detect/ipv4: make fragbits a generic uint16 bitflags keyword 
Ticket: 6724

Allows to use numerical values
 1 year ago
Philippe Antoine 633180c93f detect/integers: generalize support for bitflags modifier 
Ticket: 6724

Allows sugar syntax for bitflags keywords.
While the expressivity does not increase, because we could already
use numerial values with all generic integer modes, this modifier
prefix is used with the strings, and follows the syntax
that is already used for fragbits and tcp.flags keyword.
 1 year ago
Philippe Antoine 4b69a31dc3 detect/integers: count argument for multi-integers 
Ticket: 7211

Allows to count the number of elements, without matching on
individual elements
 1 year ago
Philippe Antoine 969739d067 detect: http2.errorcode is now a generic integer 
Ticket: 7889
 1 year ago
Philippe Antoine 401b2fcae6 detect: http2.frametype is now a generic integer 
Ticket: 7889
 1 year ago
Victor Julien 48972d544c doc/userguide: link to protocol details from transactional rules 1 year ago
Victor Julien 480e664b4c doc/userguide: add xbits tx scope support 
Ticket #7680.
 1 year ago
Victor Julien a1c4167d94 doc/userguide: add initial protocols overview 
Explain per protocol mechanics for rule matching.
 1 year ago
Victor Julien e2a5bc058c doc/userguide: fix DCERPC headings 1 year ago
Victor Julien be5c83ed53 doc/userguide: add rule hooks to protocol doc 
Ticket #7662.
 1 year ago
Victor Julien 91f258e2bc doc/userguide: add missing app-layer protocols 1 year ago
Victor Julien 2623e67a80 doc/userguide: add missing rule protocols 1 year ago
Philippe Antoine 3641b4eda1 detect/nfs: move nfs_procedure to rust 
Make it able to use strings on the way

Ticket: 6723
 1 year ago
Philippe Antoine 9869fb776b detect/snmp: pdu_type keyword now accepts strings 
Ticket: 6723
 1 year ago
Philippe Antoine 0553dfa814 detect/krb5: move krb5_msg_type to rust 
Makes it a generic u32 on the way

Unit tests are covered by SV tests

Ticket: 6723
 1 year ago
Philippe Antoine da486af881 detect: list-keywords cli shows integers 
Ticket: 7875
 1 year ago
Philippe Antoine b298bce0e7 detect: list-keywords cli shows multi-buffers 
Ticket: 7571
 1 year ago
Andreas Dolp cc590b54c7 doc: fix typo and missing newline in rules/ssh_keywords. 1 year ago
Juliana Fajardini 21b27597d6 doc/rules/internals: minor fixes 
Fix typo and add a reference about the classtype keyword effect.

Related to
Task #5449
 1 year ago
Fupeng Zhao e79d735374 decode/etag: ETag 802.1BR decoder 
Ticket: #3953.
 1 year ago
Philippe Antoine cb9ab951b9 detect/integers: subslice for multi-integers 1 year ago
Philippe Antoine 82f0e725a2 detect/integers: index or_absent and or_oob 
To match if array is empty, or index is out of bounds
 1 year ago
Philippe Antoine 1480cf47ab detect/integers: nb index to match a specific number of times 
For example
dns.rrtype: !A,nb>3
will match if we have more than 3 dns records which are not A
 1 year ago
Philippe Antoine 6f848eeaaf detect/integers: all1 index to match only on non-empty arrays 1 year ago
Philippe Antoine 5add185f22 http2/detect: http2.window can now use index 
Ticket: 7480
 1 year ago
Philippe Antoine 83868778b9 http2/detect: http2.priority can now use index 
Ticket: 7480
 1 year ago
Philippe Antoine 9fc407fd75 mqtt/detect: mqtt.type can now use index 
Ticket: 7480
 1 year ago
Philippe Antoine dad424d74a doc: multi-integers section for rules 
Ticket: 7480

Describing the usage of index
 1 year ago
Alice Akaki 8e0b0ef35f detect: add email.body_md5 keyword 
email.body_md5 matches on md5 hash generated from email body
This keyword maps to the EVE field email.body_md5
It is a sticky buffer
Supports prefiltering

Ticket: #7587
 1 year ago
Victor Julien 46203de0e9 doc: adjust for master to main rename 1 year ago
Juliana Fajardini 27e165f760 doc/rules/index: keep rule types doc near the end 
As this chapter is more meta than about rule keywords, keep it by the
end of the index, to have some semantic separation from the other
sections.
 1 year ago
Juliana Fajardini d5810a42e1 userguide: document how suricata processes rules 
Added a page that explains how rules are prioritized by Suri, as well
as what main different types of inspection happen and what elements are
involved when ordering rules.

Task #5449
 1 year ago
Philippe Antoine 0026019dcf doc: complete list of multi-buffers 
Ticket: 7867
 1 year ago
Philippe Antoine d0a513df6a detect/integers: support kibibyte unit 
Ticket: 7869
 1 year ago
Philippe Antoine be9858d3aa detect/integers: document usage of units 
Ticket: 7190
 1 year ago
Jeff Lucovsky 21707ab26c doc/from_base64: Emphasize keyword only values 
Emphasize that specifying the keyword only will result in the defaults
for each option to be used.

Issue: 7853
 1 year ago
Jason Ish 7a65ca10e2 doc/lua-detection: fix example script; remove most buffers 
- Reference rule hooks instead

Ticket: #7728
 1 year ago
Jason Ish 4791f37ca2 doc/lua-detection: update note to mention rules are enabled by default 
In 8.0, Lua rules are enabled by default.
 1 year ago
Philippe Antoine f4378eb306 doc/devguide: document app-layer protocol detection 
Ticket: 6022
 1 year ago
Jeff Lucovsky a300df4c4d detect/entropy: Clarify when entropy is logged 
Clarify when entropy values are logged and associated with non-alert log
records.
 1 year ago
Eric Leblond 751f3eef3b doc/userguide: fix some typos 1 year ago
Eric Leblond 6236574b9c doc/userguide: enrichment_key is now context_key 1 year ago
Eric Leblond 20a0575d96 doc/userguide: fix some typos 
Suggestions from Juliana.

Co-authored-by: Juliana Fajardini Reichow <jufajardini@gmail.com>
 1 year ago
Eric Leblond 40c545f8d9 doc/userguide: jsonline is now standard ndjson 1 year ago
Eric Leblond f724c75cc9 doc/userguide: improve datajson doc 1 year ago
Eric Leblond a652eee508 doc/userguide: remove left over datajson reference 1 year ago
Eric Leblond 7d28758a54 doc/userguide: improve datajson doc 
Patch adds ``remove_key`` option and clarifies the text.
 1 year ago
Eric Leblond 0ae88a408a doc/userguide: basic doc for jsonline format 1 year ago
Eric Leblond 9873c5d2e1 doc/userguide: add dataset with json 1 year ago
Victor Julien f2faba5a23 detect/config: add flow tracking doc 1 year ago
Victor Julien ecbcccf355 detect: add tcp.wscale keyword 
Allows matching on wscale option value in TCP header options.

Ticket: #7713.
 1 year ago
Jeff Lucovsky a8a3780276 doc/entropy: Document the entropy log output 1 year ago
Juliana Fajardini c5b9277474 doc/payload: fix typo, minor formatting changes 1 year ago
Juliana Fajardini 627b8900ef doc/rule-types: fix typo 1 year ago
Jason Ish 4a655053e8 mdns: add mdns parser, logger and detection 
The mDNS support is based heavily on the DNS support, reusing the
existing DNS parser where possible. This meant adding variations on
DNS, as mDNS is a little different. Mainly being that *all* mDNS
traffic is to_server, yet there is still the concept of request and
responses.

Keywords added are:
- mdns.queries.rrname
- mdns.answers.rrname
- mdns.additionals.rrname
- mdns.authorities.rrname
- mdns.response.rrname

They are mostly in-line with the DNS keywords, except
mdns.answers.rdata which is a better than that mdns.response.rrname,
as its actually looking at the rdata, and not rrnames.

mDNS has its own logger that differs from the DNS logger:

- No grouped logging

- In answers/additionals/authorities, the rdata is logged in a field
  that is named after the rdata type. For example, "txt" data is no
  longer logged in the "rdata" field, but instead a "txt" field. We
  currently already did this in DNS for fields that were not a single
  buffer, like SOA, SRV, etc. So this makes things more consistent. And
  gives query like semantics that the "grouped" object was trying to
  provide.

- Types are logged in lower case ("txt" instead of "TXT")

- Flags are logged as an array: "flags": ["aa", "z"]

Ticket: #3952
 1 year ago
Juliana Fajardini 404bb53ce9 pgsql: add query keyword 
Add the `pgsql.query` rule keyword to match on PGSQL's query
request message contents. This currently matches on the EVE field:

pgsql.request.simple_query

`pgsql.query` is a sticky buffer and can be used as a fast_pattern.

Task #6259
 1 year ago
jason taylor ca9b29c2d0 doc: update http.header_names normalization info 1 year ago
Jeff Lucovsky 77139e0cb1 doc/ftp: Document ftp.completion_code sticky buffer 
This commit adds documentation for the ftp.completion_code sticky
buffer. This is a multi-buffer match.

Issue: 7507
 1 year ago
Jeff Lucovsky 53c8a0f8f1 doc: Document luaxform transform 
Issue: 2290
 1 year ago
Jeff Lucovsky aec2513799 doc/ftp: Document ftp.reply_received 
Add documentation for the ftp.reply_received keyword.
 1 year ago
Jeff Lucovsky 0b02b1d2d1 doc/ftp: Document ftp.mode keyword 
Document the ftp.mode keyword
Fixup a typo in the ftp.reply keyword section.

Issue: 7505
 1 year ago
Philippe Antoine daabab7381 doc/ssh: document hooks 
Ticket: 7607
 2 years ago