aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
13,876 Commits
8 Branches
173 Tags
258 MiB
main
main-7.0.x
main-8.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '5d62995e26'
${ noResults }
Commit Graph

11127 Commits (5d62995e2684ce398a657269e21fdb49d043a52d)

Author SHA1 Message Date
Victor Julien 129fcb5c72 tls: use incomplete API to get full TLS records 
The TLS record header is parsed in streaming mode still, but once the
record size is known we tell the app-layer API to give us the full
record.

Ticket: #5481
 4 years ago
Gleb Smirnoff 7110ea75c4 ipfw: remove setting of SO_BROADCAST on the divert(4) socket 
My review of the FreeBSD kernel code reveals that this setting
a) is ignored by the kernel b) is not required.  The sending
side of divert(4) never checks so->so_options, but always gives
IP_ALLOWBROADCAST to ip_output().
 4 years ago
Andrei Shchapaniak ee5573c4ee dpdk/i40e: fix warning with number of queues for RSS configuration 4 years ago
Philippe Antoine 390cf9248f detect: adds flow.age keyword 
Ticket: #5536
 4 years ago
Philippe Antoine ce2775d331 flow/icmpv4: fix vlan.use-for-tracking 
For ICMPv4 error messages the vlan ids were always considered,
even if the 'vlan.use-for-tracking' option was disabled.

Ticket: #5330
 4 years ago
Sascha Steinbiss 148b53125b ebpf: update deprecated API calls 
This fixes build errors when libbpf 1.0 is used. It removes previously
deprecated API functions that were still in use in Suricata's eBPF
code.
 4 years ago
Jeff Lucovsky 63745a7879 detect/tls: Improve tls.fingerprint rule handling 
Issue: 4581

This commit improves the runtime performance of rules with
tls.fingerprint by using the inspection logic from tls.cert_fingerprint.
 4 years ago
Jeff Lucovsky 6bccd5aa30 detect/uri: Remove unnecessary include 
This commit removes an unnecessary #include for detect-uricontent.h
 4 years ago
Victor Julien d941703cd8 detect/build: minor code cleanup 4 years ago
Victor Julien 040404b093 detect/profiling: track bytes scanned by prefilter engines 4 years ago
Victor Julien 682e2a07fe detect/tls: add tls.cert_chain_len keyword 4 years ago
Victor Julien 224ba82569 eve/tls: warn on unsupported 'custom' options 4 years ago
Victor Julien dbf3d1e977 tls: make SSLSetEvent a macro to help debugging 4 years ago
Victor Julien 0e39c92fcf flow-manager: reduce locks at startup 
Effectively busy looping on a mutex to wait for time to be ready.
 4 years ago
Victor Julien 19e94e93fa common: move u8_tolower to common header 4 years ago
Victor Julien 18e63d4ede htp: remove user setup from request line callback 
This used to be the first callback that was called, but its not anymore.

Codecov confirmed that this is no longer used and therefore not useful.
 4 years ago
Victor Julien faca974f32 ipfw: remove unused func prototype 4 years ago
Victor Julien b9ad1d1260 app-layer: fix compiler warning 4 years ago
Victor Julien e250ef6402 debug: remove empty header 4 years ago
Victor Julien c3c5829f96 reputation: add ipv6 cidr test 4 years ago
Victor Julien e9c4b3719e reputation: fix multiline test 4 years ago
Eric Leblond a9a17c8185 landlock: handle filestore case 
If landlock ABI is inferior to 2 (before Linux 5.19) then the
renaming of files is impossible if the protection is enabled. This
patch disables landlock if ABI < 2 and file-store is enabled.

As file store is initialized in output the call to landlock had to
done after the output initialization.
 4 years ago
Eric Leblond 485d5a4ea4 landlock: basic implementation 
This patch is adding support for Landlock, a Linux
Security Module available since Linux 5.13.

The concept is to prevent any file operation on directories where
Suricata is not supposed to access.

Landlock support is built by default if the header is present. The
feature is disabled by default and need to be activated in the YAML
to be active.

Landlock documentation: https://docs.kernel.org/userspace-api/landlock.html

Feature: #5479
 4 years ago
Juliana Fajardini bbd968c738 exceptions: add reject support to exception policy 
This enables the usage of 'reject' as an exception policy. As for both
IPS and IDS modes the intended result of sending a reject packet is to
reject the related flow, this will effectively mean setting the reject
action to the packet that triggered the exception condition, and then
dropping the associated flow.

Task #5503
 4 years ago
Victor Julien f5bd55dac8 decode/tcp: allow 4 byte TFO with 2 byte cookie 4 years ago
Philippe Antoine 5ef259722b dhcp: adds renewal-time keyword 
Ticket: #5507
 4 years ago
Philippe Antoine dc59389087 dhcp: fix license in detect-dhcp-leasetime.c 
from search and replace overkill
 4 years ago
Philippe Antoine 6faf6299e0 dhcp: adds rebinding-time keyword 
Ticket: #5506
 4 years ago
Josh Soref c23560ec41 detect: function header return value clarification 
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>
 4 years ago
Gleb Smirnoff 5dbbc52b06 ipfw: use PF_DIVERT on modern FreeBSD 4 years ago
Victor Julien bb2e11108b packetpool: fix uaf in debug validation check 
Location of the check meant access to freed packet was possible.

Move check and simplify it to just look at the packet at hand.
 4 years ago
Philippe Antoine b0ce55c9df flow: finish to remove obsolete counters 
As was begun in b3599507f4

Ticket: #5317
 4 years ago
Juliana Fajardini aa5bb2c329 stream: add exception policy for midstream flows 
This allows to set a midstream-policy that can:
- fail closed (stream.midstream-policy=drop-flow)
- fail open (stream.midstream-policy=pass-flow)
- bypass stream (stream.midstream-policy=bypass)
- do nothing (default behavior)

Usage and behavior:

If stream.midstream-policy is set then if Suricata identifies a midstream flow
it will apply the corresponding action associated with the policy.

No setting means Suricata will not apply such policies, either inspecting the
flow (if stream.midstream=true) or ignoring it stream.midstream=false.

Task #5468
 4 years ago
Juliana Fajardini 242b8f7d65 exceptions: add callbacks for drop-flow policy 
Make sure that when the policy is to drop the flow, we set no inspection
for payload and packet and disable applayer inspection as well.

Task #5468
 4 years ago
Victor Julien 1bff888947 detect: fix duplicate detect state issue 
For protocols with multi buffer inspection there could be multiple times
the same sid would be queued into the candidates queue. This triggered
a debug validation check.

W/o debug validation this would lead to duplicate work and possibly multiple
alerts where a single one would be appropriate.

Bug: 5419.
 4 years ago
Victor Julien d31beba8d4 detect/frames: fix too strict debug check 
Frame::len is -1 if it is still unknown. Handle that in the debug
check.
 4 years ago
Victor Julien f04b7a1827 stream/ids: make sure we don't slide past last_ack 
Bug: #5401.
 4 years ago
Victor Julien 55b2077fcd stream: minor code cleanup 4 years ago
Shivani Bhardwaj 78045d3bbf tls/sni: remove unused fn declaration 4 years ago
Shivani Bhardwaj 42c3f418c6 tls: add tls.random* keywords 
Add tls.random keyword that matches on the 32 bytes of the TLS
random field for client as well as server.
Add tls.random_time keyword that matches on the first 4 bytes of the TLS
random field for client as well as server.
Add tls.random_bytes keyword that matches on the last 28 bytes of the TLS
random field for client as well as server.

All these are sticky buffers.

Feature 5190
 4 years ago
Philippe Antoine e587f6792a detect: support file.data for HTTP1 to server 
That is file sent with POST or PUT

Ticket: #4144
 4 years ago
Victor Julien 50f8779128 flow-manager: reduce burstiness in adaptive timing 
Previous adaptive model would have a large time range when scanning the
hash when not so busy. In the default case it would take up to 4 minutes
for a full hash scan. In case of sudden increase in business, where the
hash would fill up rapidily during a few seconds, the flow manager would
be forced to suddenly consider a much larger slice of the hash leading
to a burst of work. This burst would increase pressure on the rest of the
system leading to packet loss as the worker threads would be overloaded
with flow housekeeping tasks.

This patch reduces the max scan time to 10 seconds, and ramps up quickly
to increase the slice of the hash scanned.
 4 years ago
Juliana Fajardini 58ef3cde7a exceptions: error out when invalid policy is used 
Before, if an invalid value was passed as exception policy, Suricata
would log a warning and set the exception policy to "ignore". This is a
very different result, than, say, dropping or bypassing a midstream flow.

Task #5504
 4 years ago
Philippe Antoine 61b73416e2 detect: transforms check for 0-sized buffer 
So as to avoid undefined behavior with a 0-sized variable length
array

Ticket: #5521
 4 years ago
Philippe Antoine d1ebf320f7 fuzz: disable enip detection based on source port 
So as to avoid fuzzing detecting protocol polyglots with enip
 4 years ago
Philippe Antoine 617c9fb7e5 fuzz: remove check about max transactions 
Suricata can indeed pipeline many HTTP1 transactions
 4 years ago
Victor Julien b01c311c1d profiling: fix implicit-int-float-conversion warnings 4 years ago
Victor Julien aa09d5f556 packetpool: ifdef debug check 4 years ago
Juliana Fajardini e7727c3744 decode: remove unused macros, replace w/ functions 
With the recent changes, these macros weren't being used anymore.

Related to
Bug #5458
 4 years ago
Juliana Fajardini d07a6c6174 stream/tcp: remove repeated header declaration 
StreamTcpRegisterTests was being declared twice.
 4 years ago
Juliana Fajardini f897761ecb detect/alert: add unittests to check packet action 
Add unittests to check that packet flags are correctly updated after
detection finds drop or reject rules that match.

Related to
Bug #5458
 4 years ago
Juliana Fajardini abd595d695 decode: validate if dropped packet has drop reason 
Related to
Bug #5458
 4 years ago
Juliana Fajardini 1f54e8611a detect/alert: ensure reject action is applied 
Bug 5458 states that the reject action is no longer working. While SV
tests that use the reject action still pass, it indeed seems that a
regression has happened with commit aa93984, because while the
function that applies rule actions to the flow (RuleActionToFlow) does
check for the reject action, the newly added function PacketApply
SignatureActions only checks for ACTION_DROP or ACTION_PASS when
deciding to call RuleActionToFlow.

Bug #5458
 4 years ago
Juliana Fajardini 1774ff18a6 decode: make PacketDrop use action as parameter 
A Packet may be dropped due to several different reasons. This change
adds action as a parameter, so we can update the packet action when we
drop it, instead of setting it to drop.

Related to
Bug #5458
 4 years ago
Eric Leblond 01bf0ad43d luajit: fix unittests build 
When building with the following options:

 ./configure CC=clang --enable-luajit --enable-geoip --enable-unittests

There is a build failure:

runmode-unittests.c:234:9: error: implicit declaration of function 'LuajitSetupStatesPool' is invalid in C99 [-Werror,-Wimplicit-function-declaration]
    if (LuajitSetupStatesPool() != 0) {
 4 years ago
Philippe Antoine 11f849c3ee protocol-change: sets event in case of failure 
Protocol change can fail if one protocol change is already
occuring.

Ticket: #5509
 4 years ago
Philippe Antoine 461725a9bf dhcp: adds leasetime keyword 
As it is logged

Ticket: #5435
 4 years ago
Jason Ish f1f43cba5e app-layer: don't wrap around on port 65535 
A port value of 65535 caused the port value to wrap-around to 0
resulting in an infinite loop.

Fixes: 53fc70a9a7 ("protodetect: fix int warnings")
 4 years ago
Juliana Fajardini c81b78fd1c detect/parse: test sig parsing for more actions 
Our unittests were only covering sig parsing for alert actions. As in
environments without LibNet the reject action will not work, we must
ensure that our parser properly fails in such cases, instead of silently
accepting an unsupported action.

Added tests for the reject and drop action.

Task #5496
 4 years ago
Eric Leblond 954e3e1f3f smtp/mime: fix url extraction when no config is set 4 years ago
Eric Leblond ad6c2f1411 eve/email: log existing url type 
MIME parsing was setting flag on URL to indicate their
estimated type. This patch attach the information to
the email object so the user can extract interesting
email directly:

```
  "email": {
    "status": "PARSE_DONE",
    "from": "Eric Leblond <regit@regit.org>",
    "to": [
      "eric@regit.org"
    ],
    "has_ipv6_url": false,
    "has_ipv4_url": false,
    "has_exe_url": true,
    "url": [
      "http://www.toto.com",
      "http://perdu.com.",
      "https://hacke.me/pown.exe"
    ]
  }
```
 4 years ago
Eric Leblond 767d2cc9ba util/mime: add some extensions to exe list 4 years ago
Benjamin Wilkins 57ef80f5ec lua: Expose byte extract to lua match scripts 
Allow lua match scripts to access variables defined in rule by
byte_extract or byte_math

Issue: 2871
 4 years ago
Eric Leblond debdff0375 detect/tls: fix descriptions 
Most keywords were presented as content modifiers when they
were in fact sticky buffers.
 4 years ago
Victor Julien 5fbec8ca67 netmap: fix includes 4 years ago
Philippe Antoine 489ac003b2 detect/krb: no more wrapper around DetectEngineInspectGenericList 4 years ago
Philippe Antoine 5c7b5c5fb5 krb: detection for ticket encryption 
As is done for logging.

Ticket: #5442
 4 years ago
Victor Julien 5fec07b87d flow: minor compiler warnings 
flow-util.c: In function 'FlowEndCountersRegister':
flow-util.c:294:34: warning: 'name' may be used uninitialized in this function [-Wmaybe-uninitialized]
  294 |         fec->flow_tcp_state[i] = StatsRegisterCounter(name, t);
      |                                  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 4 years ago
Jeff Lucovsky e133ab029e stream/event: Trigger stream reassembly event 
Issue: 3512

This commit triggers the stream reassembly depth reached event.
 4 years ago
Jeff Lucovsky 1d8cc7791d general: Typo fixup 4 years ago
Jeff Lucovsky 6a039ab316 stream/event: New reassembly depth event 
Issue: 3512

This commit adds a stream event triggered when the stream assembly depth
is reached.
 4 years ago
Philippe Antoine e1e03c25c9 ci: update to macos latest 4 years ago
Philippe Antoine 018fef5ef8 quic: ja3 computation and logging and detection 
Logging as is done in TLS.

Detection using the generic generic ja3.string keyword

Ticket: #5143
 4 years ago
Juliana Fajardini 5f4bcfe313 detect/engine: fix typos in assorted files 4 years ago
Juliana Fajardini 58928b249d commandline: add alert-queue expand failure option 
For testing purposes. Meant to simulate a reallocation failure when
dynamically growing the alert queue in DetectEngineThreadCtx, so we can
check that Suri's behavior doesn't break under such circumstances.

Task #5319
 4 years ago
Victor Julien ebc2714e07 nflog: fix missing util-time include; cleanups 4 years ago
Victor Julien 09c0128138 nflog: update copyright years 4 years ago
Jeff Lucovsky e566563875 classification/config: Propagate validation errors 
Issue: #4554

This commit modifies the workflow to propagate classification parsing
errors when in test mode.

When not in test mode, errors continue to be displayed but they do not
halt Suricata execution.
 4 years ago
Jeff Lucovsky 2621c90ea1 classification/config: Raise error on validation errors 
This commit adds logic which raises an error if parse errors occur while
loading classification.config

Issue: 4554
 4 years ago
Philippe Antoine 83a8cd80b2 detect: remove wrappers around DetectEngineInspectGenericList 4 years ago
Scott Jordan 7eaf1688b5 stream: fix StreamTcpSegmentForSession missing segments 
Bugfix, segment traversal was being initialized at root node, but
should have been started at the min node. Bug resulted in captures
missing segments left of root node.
 4 years ago
Victor Julien ad3e68f378 detect/file: minor cleanups 4 years ago
Victor Julien af145ad125 detect/file: reduce scope of keyword data structures 4 years ago
Victor Julien 73eb7744d8 detect/file: update copyright years 4 years ago
Victor Julien 6f8ca41eb3 detect/cip: cleanup includes 4 years ago
Philippe Antoine 16fc78645d dnp3: do not log empty objects array 
Ticket: #5167
 4 years ago
Philippe Antoine da0be16d36 output: do not log empty arrays for sid 
Ticket: #5167
 4 years ago
Philippe Antoine adeb1fdfc3 threads: cleaner code with one instruction per line 
As reported by Shchelk
 4 years ago
Victor Julien 9fa0033966 detect: reduce datatype scope for various keywords 4 years ago
Victor Julien ad76502df0 detect/cip: remove dead code 4 years ago
Victor Julien 08e349a8bb detect: update copyright years 4 years ago
Victor Julien 0ec9379db9 includes: minor cleanups 4 years ago
Victor Julien 21f76773c7 profiling: minor code cleanups 4 years ago
Philippe Antoine 36b1344680 util: fix integer warnings in profiling 4 years ago
Philippe Antoine 4411ef785d src: remove unused header files 4 years ago
Philippe Antoine 02f2602dde src: rework includes as per cppclean 4 years ago
Jufajardini Reichow 93c2c9743d detect/engine: init alert queue counters on reload 
alert_queue_overflow and alerts_suppressed were not being
reinitialized when there was a reload of Suricata rules, leading to
non-valid stats counters if that happened.

Bug #5457
 4 years ago
Philippe Antoine f8bf581775 output: skip files logging for ICMP packets 
Ticket: #5408
 4 years ago
Philippe Antoine 5781631f85 output: use flow's proto for file loggers 
As there can be an ICMP packet which gets related to a TCP flow.

Ticket: #5408
 4 years ago
Philippe Antoine 7f9d25fa86 fuzz: use forced file store 
to find bugs such as 5408
 4 years ago
Philippe Antoine a2f857ed90 threshold: fix regex to accept by_both and by_rule 
As is done in detect-threshold.c or in DETECT_RATE_REGEX
and is expected by switch (rule_type) which makes the same
for THRESHOLD_TYPE_THRESHOLD and THRESHOLD_TYPE_RATE

Ticket: #5327
 4 years ago
Philippe Antoine 1621f5e453 detect/nfs: use inclusive ranges 4 years ago
Philippe Antoine 8dbb07e4fe detect: use generic integer functions for itype 
Ticket: #4112
 4 years ago
Philippe Antoine 2817f1a6ed detect: use generic integer functions for snmp.version 
Ticket: #4112
 4 years ago
Philippe Antoine c72571ea28 detect: use generic integer functions for rfb.sectype 
Ticket: #4112
 4 years ago
Philippe Antoine 6c9091c86f detect: use generic integer functions for nfs.version 
Ticket: #4112
 4 years ago
Philippe Antoine ddac6165c9 detect: use generic integer functions for nfs.procedure 
Ticket: #4112
 4 years ago
Philippe Antoine ed6955ee98 detect: use generic integer functions for iprep 
Ticket: #4112
 4 years ago
Philippe Antoine bdc359bed3 detect: use generic integer functions for bsize 
Ticket: #4112
 4 years ago
Philippe Antoine cfb60d0fce detect: use generic integer functions for urilen 
Ticket: #4112
 4 years ago
Philippe Antoine e87c53bb55 defrag: use util function for timeout 
To fix timestamp overflow as found by oss-fuzz
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44608

fixu
 4 years ago
jason taylor d600a1603c detect: update text for nocase used with http.host 
Signed-off-by: jason taylor <jtfas90@gmail.com>
 4 years ago
Philippe Antoine c7214be99b snmp: adds usm keyword 
as is logged

Ticker: #5416
 4 years ago
Philippe Antoine 5a31b3508d ftp: optimized tx iterator 
To be more efficient with larger number of transactions.

Ticket: #5314
 4 years ago
Victor Julien 6d3140bc01 mime: remove unused length fields 4 years ago
Victor Julien 816bbeb7dc fuzz/mime: fix call conditions and args 
The SMTP parser should not supply lines w/o EOL chars to the mime
parser unless its in the BODY parsing stage. Mimic this in the fuzz
target by testing the state for inputs that have no EOL.

Additionally, make sure the delim cnt reflects the missing EOL.
 4 years ago
Victor Julien d81582c4a2 mime: fix corner case 
Fix a corner case where a base64 sequence including a space was followed
by a newline in the input data.
 4 years ago
Victor Julien 5805ed47f5 mime: add base64 related debug messages 4 years ago
Victor Julien 41c2c1ed5a mime: improved empty line handling 
Make sure a new body is not set up on empty lines unless it is
a body that is not encoded as base64/quoted printable.
 4 years ago
Victor Julien 074cfb5c68 mime: fix and cleanup tests 
Line count check was failing after recent delim handling updates.
 4 years ago
Victor Julien 6e2c066ce1 smtp: fix passing a wrong delim len around 4 years ago
Victor Julien b82b8825e7 mime: properly pass full lines to non-decoded body 
Use actual delim count and make sure we also pass on empty lines
(so delim(s) only).
 4 years ago
Victor Julien 0d6ab727c5 mime/base64: fix final data not getting processed 
If the last data of the body was not a multple of 4 and not padded
to be a multiple of 4, it would not be processed.
 4 years ago
Victor Julien 100d821a9f stream: fix GAP check 
Gap check would consider a GAP when the current data was in fact
exactly not a gap, but next segment(s) were already available.
 4 years ago
Victor Julien 29ec1b1e7b mime: minor code cleanup 4 years ago
Victor Julien 0871029d17 mime: remove unused 'linerem' logic 4 years ago
Victor Julien 5953a7d2eb smtp/mime: fix parsing edge case 
Correctly track "remaining" bytes after partial base64 decoding.

Add comment clarifications and debug validation checks.
 4 years ago
Victor Julien a38f2f2a52 smtp: skip preprocessing for mime headers 
Mime parser doesn't expect partial lines, which preprocessing can
provide. Add a check to let mime headers be handled by regular line
parsing.
 4 years ago
Juliana Fajardini 2544be4672 source/pcap: fix infinite loop if interface goes down 
When in live-pcap mode, if the sniffed interface went down and up again,
Suri would enter an infinite and keep running, while not registering new
events. This fixes that behavior by allowing Suri to retry to open the
pcap in case of a retry on an already activated capture
('PCAP_ERROR_ACTIVATED').

This change is based on Zhiyuan Liao's work.

Bug #3846
 4 years ago
Philippe Antoine 585e5e0d3c detect: impose limits on pcrexform 
As is done for pcre keyword

Ticket: #5409
 4 years ago
Victor Julien a89840929b detect: set drop reason for rule based drops 
Call `PacketDrop` with drop reason for drops, keep old logic
in place for the rest.
 4 years ago
Victor Julien ad14e71efe stream: suppress exception policy debug message 4 years ago
Victor Julien 046287c2b5 detect/filestore: clean up stream flag handling 4 years ago
Victor Julien 71ef62bfc5 file: consistently track size of gaps 
Until now only the size of gaps counted in the regular append, not
close and open.

Bug: #5392.
 4 years ago
Victor Julien 1594e41b06 stream: remove unused TCP_LISTEN 
Keep the values the same so we might be able to bring it back
w/o issues.
 4 years ago
Victor Julien e05b6f44e3 counter: tcp liberal counter 4 years ago
Victor Julien 0ebe372607 stream: after missing segments, be liberal on RST 
This avoids long lasting inactive flows because in the most likely
case the RST did in fact end the connection. However Suricata may
still consider it to be "established".
 4 years ago
Victor Julien b0993d6fd8 flow: add various flow counters 
Add flow.end state counters

Add active TCP sessions counter

Add flow.active counter

Add flow.total counter

Ticket: #1478.
 4 years ago
Victor Julien aa31d2193f counters: add StatsDecr 4 years ago
Victor Julien 88edc8630c flow/manager: add flow.mgr.rows_sec counter 4 years ago
Victor Julien f271fb4575 flow/recycler: bring back pthread_cond_t sleep 
Bug #4379.
 4 years ago
Victor Julien 633e6cf09e flow/recycler: minor code cleanups 4 years ago
Victor Julien 73138809e2 flow/manager: move counters into util func 4 years ago
Victor Julien 0c048d3e5c flow/manager: minor code cleanups 4 years ago
Victor Julien 7f4e120a97 flow/manager: remove debug and dead code 4 years ago
Victor Julien e6ac2e4e8a flow/manager: sleep handled by pthread_cond_t again 
Use only in live mode to allow FM to respond quickly to time
increases in offline mode.

Bug #4379.
 4 years ago
Victor Julien 39141a8836 time: add timeradd implementation 
timeradd isn't available on MinGW.
 4 years ago
Victor Julien e9d2417e0f flow/manager: adaptive hash eviction timing 
The flow manager scans the hash table in chunks based on the flow timeout
settings. In the default config this will lead to a full hash pass every
240 seconds. Under pressure, this will lead to a large amount of memory
still in use by flows waiting to be evicted, or evicted flows waiting to
be freed.

This patch implements a new adaptive logic to the timing and amount of
work that is done by the flow manager. It takes the memcap budgets and
calculates the proportion of the memcap budgets in use. It takes the max
in-use percentage, and adapts the flow manager behavior based on that.

The memcaps considered are:
    flow, stream, stream-reassembly and app-layer-http

The percentage in use, is inversely applies to the time the flow manager
takes for a full hash pass. In addition, it is also applied to the chunk
size and the sleep time.

Example: tcp.reassembly_memuse is at 90% of the memcap and normal flow
hash pass is 240s. Hash pass time will be:

    240 * (100 - 90) / 100 = 24s

Chunk size and sleep time will automatically be updated for this.

Adds various counters.

Bug: #4650.
Bug: #4808.
 4 years ago
Michael Tremer f50af12068 stream: tcp: Handle retransmitted SYN with TSval 
For connections that use TCP timestamps for which the first SYN packet
does not reach the server, any replies to retransmitted SYNs will be
tropped.

This is happening in StateSynSentValidateTimestamp, where the timestamp
value in a SYN-ACK packet must match the one from the SYN packet.
However, since the server never received the first SYN packet, it will
respond with an updated timestamp from any of the following SYN packets.

The timestamp value inside suricata is not being updated at any time
which should happen. This patch fixes that problem.

Bug: #4376.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 4 years ago
Victor Julien 8109b0017e detect/dcerpc: simplify keyword validation 
Now that the engine understands the relation between SMB and DCERPC better
we can get rid of some of the special case handling in keywords.
 4 years ago
Victor Julien 8d20b40cdd detect/content: fix FNs due to bad depth calc 
When trying to propegate the depth/offset, within/distance chains
a logic error would set too a restrictive depth on a pattern that
followed more than one "unchained" patterns.

Bug: #5162.
 4 years ago
Victor Julien 50d02ebc05 detect/content: simplify int bounds checking 
Use a macro to validate the ranges for overflows. This removes
the clutter of all the checks and warnings, and also no longer
puts the state machine in an undefined state when hitting such
a condition.
 4 years ago
Victor Julien a83f02d4cd detect/dcerpc: apply dcerpc to smb as well 
So 'alert dcerpc' also matches if the DCERPC is over SMB.

Explicitly refuse smb keywords for the 'dcerpc' app proto setting:
`alert dceprc ... smb.share; ...` is rejected.

Remove a now useless special case in the stateless rule processing
matching for dcerpc/smb.

Bug: #5208.
 4 years ago
Philippe Antoine e692530021 event: only sets APPLAYER_UNEXPECTED_PROTOCOL once 
If f->alproto == ALPROTO_UNKNOWN, we do not know the new protocol
yet, so we do not set the event yet.
 4 years ago
Philippe Antoine b0298dd046 events: reset logged event 
Otherwise, if we log a first app_layer_event, then reset
with AppLayerDecoderEventsResetEvents for a new packet,
then get another event, it does not get logged

Ticket: #5391
 4 years ago
Philippe Antoine eb1c2a6083 smb: use default stream-depth 0 by default 
As broken by commit e5c948df87

Ticket: #5390
 4 years ago
Philippe Antoine 7acdece7d0 util: fix integer warnings in mime decoding 
Ticket: #4516
 4 years ago
Philippe Antoine 9d6e5558f1 defrag: do not cast pkt len to u16 
as it can overflow
 4 years ago
Philippe Antoine b8524e70d9 detect: change InspectEngineFuncPtr2 to return uint8_t 4 years ago
Philippe Antoine c5cf2967b3 detect: fix integer warnings 
Ticket: #4516
 4 years ago
Philippe Antoine ac8fb553a1 detect: fix integer warnings for content 
Ticket: #4516
 4 years ago
Philippe Antoine 57fb183d32 detect: fix integer warnings for app-layer-event 
Ticket: #4516
 4 years ago
Philippe Antoine 79d7edb3e0 ftp: fix integer warning 
Ticket: #4516
 4 years ago
Victor Julien df2e408d96 detect/threshold: fix offline time handling issue 
Due to the TIMEVAL_DIFF_SEC calculating the delta into an unsigned
integer, it would underflow to a high positive value leading to
and incorrect result if the packet timestamp was below the timestamp
for the threshold entry. In normal conditions this shouldn't happen,
but in offline mode each thread has its own concept of time which
might differ significantly based on the pcap. In this case the
overflow would be very common.

Changing it to a signed value calculation triggered fuzz undefined
behavior if the packet timeval was very high, so this patch takes a
new approach where it no longer calculates a diff but sets up the
"seconds" value we compare against as a timeval itself, and uses
that to compare.

Fixes: 9fafc1031c ("time: Add TIMEVAL_EARLIER and TIMEVAL_DIFF_SEC macros.")
Fixes: 82dc61f4c3 ("detect/threshold: Refactor threshold calculation to handle by_rule and by_both.")

Uses add `timeradd` specific version where available.

Bug: #5386.
 4 years ago
Victor Julien fea374626a stream/midstream: fix double flow reverse case 
In the case of midstream SYN/ACK pickup, we reverse the flow based on
the SYN/ACK. If we then later get traffic that appears to be in the
reverse direction based on the app-layer, we would reverse it again.
This isn't correct. When we have the SYN/ACK we know the flow's real
direction.
 4 years ago
Lukas Sismis 8845c07a90 bypass: af-packet: fix memory leak - reassign of EBPFBypassData 
AF-Packet bypass function in some situations allocates EBPF bypass data
for an already bypassed flow and assigns it to the flow without any checks

Issue: #5368
 4 years ago
Lukas Sismis 05797c45bb bypass: fix memory leak - reassign of FlowBypassInfo 
In some situations bypass callback is called on already bypassed
flow. This allocates FlowBypassInfo structure for the flow but
does not check if the flow already has one.

Issue: #5368
 4 years ago
Victor Julien 2486d29adb napatech: fix conf API call 4 years ago
Victor Julien 8580499ded exceptions: initial exception-policy implementation 
Adds a framework for setting exception policies. These would be called
when the engine reaches some kind of exception condition, like hitting
a memcap or some traffic processing error.

The policy gives control over what should happen next: drop the packet,
drop the packet and flow, bypass, etc.

Implements the policy for:

    stream: If stream session or reassembly memcaps are hit call the
    memcap policy on the packet and flow.

    flow: Apply policy when memcap is reached and no flow could be
    freed up.

    defrag: Apply policy when no tracker could be picked up.

    app-layer: Apply ppolicy if a parser reaches an error state.

All options default to 'ignore', which means the default behavior
is unchanged.

Adds commandline options: add simulation options for exceptions. These
are only exposed if compiled with `--enable-debug`.

Ticket: #5214.
Ticket: #5215.
Ticket: #5216.
Ticket: #5218.
Ticket: #5194.
 4 years ago
Victor Julien 4567995678 decode: add pass action wrapper 4 years ago
Victor Julien d81ad78444 decode: turn no payload/packet inspect macros into funcs 
Remove unused unset macros.
 4 years ago
Victor Julien 0035673208 eve/drop: log drop reason 
Ticket: #5202.
 4 years ago
Victor Julien 55fb2d5d2d stream/tests: remove bad test; update failing test to new behavior 4 years ago
Victor Julien 2d64ec6585 stream: clarify error handling comment 4 years ago
Victor Julien b6cf79901a stream/reassemble: clarify error handling 4 years ago
Victor Julien f34845858c stream: remove now unused tcp.insert_list_fail counter 4 years ago
Victor Julien 13554f7e44 stream/segtree: simplify error handling 
Now that spurious retransmissions don't propegate into the reassembly
code, error handling can be simplified.
 4 years ago
Victor Julien cc4e8f0936 stream: detect spurious retransmissions early 4 years ago
Victor Julien 84448d3bae tests: remove unnecessary flow locks 
Added once to satisfy debug validation, but we don't mix unittests
and debug validation anymore.

    sed -i -E '/.*FLOWLOCK_.*LOCK/d' *.c
 4 years ago
Victor Julien 579547c849 smtp: minor line loop cleanup 4 years ago
Victor Julien 96bb67f474 smtp: remove defunct check for line with single LF 
Don't fix it as DATA processing needs all the bytes.
 4 years ago
Victor Julien a2924b7141 smtp: constify line arguments where possible 4 years ago
Victor Julien e0d5878e49 smtp: move current line out of state 4 years ago
Victor Julien 1451bd62a6 smtp: move input out of state 4 years ago
Victor Julien 77fae275ef smtp: turn assertions in to debug asserts 4 years ago
Victor Julien 3a631085bb smtp: simplify preprocess loop 4 years ago
Victor Julien 30e47b2171 mime/base64: decode cleanups and simplification 
Addresses edge case: > 4 bytes at the end of the input with 2 or more
spaces.

Changes length type for remainder processing to allow for much longer
lines, which can happen in practice.

Adds a series of debug validation checks with real error handling
as well, to assist the fuzzer to find more edge cases.
 4 years ago
Victor Julien 92cd95b416 base64: no special case for nul char 
Let it be handled like other invalid input.
 4 years ago
Shivani Bhardwaj 5b27619778 base64: make decoder handle decoded data space constraints 
So far, it was the job of caller to send the bae64 decoder a perfect
block of data and take care of the destination buffer (decoded data)
size. Now, make it the decoder's job to take care of any space
constraints that the destination buffer may have and return accordingly.

Also, handle space characters in base64 encoded data as per RFC 2045.

Update MIME parser accordingly to handle the base64 data.

Ticket: 5315
 4 years ago
Shivani Bhardwaj cb01cc6929 base64: add Base64Ecode enum 4 years ago
Shivani Bhardwaj 9131d1d857 base64: add Base64Mode enum 4 years ago
Shivani Bhardwaj 1e3282f363 smtp: treat CR as a line terminator 
The ideal line terminator for an SMTP line is <CRLF>. But, given that
bare LF is still allowed by many systems despite the prohibition by
standards, we have to consider that. In order to simplify things, we
consider bare CR as line terminators as well while updating the
delimiter parameter correctly if they were to be followed by a LF
immediately or as a part of next fragment.

This takes care of some edge cases that made base64 decoder error out
because unexpected data was sent to it at times.

Ticket: 5316
 4 years ago
Philippe Antoine d1a4dae36b detect: use generic integer functions for streamsize 
By the way, adds the prefilter feature

Ticket: #2697
Ticket: #4112
 4 years ago
Philippe Antoine 35b6dcec7e detect: use generic integer functions for filesize 
Ticket: #4112
 4 years ago
Philippe Antoine bfdf5b1952 detect: use generic integer functions for tcp mss 
Ticket: #4112
 4 years ago
Philippe Antoine 025b510cac detect: use generic integer functions for template2 4 years ago
Philippe Antoine 261eebba12 detect: use generic integer functions for ttl 
Ticket: #4112
 4 years ago
Philippe Antoine 2b0be91f28 detect: use generic integer functions for dsize 
Ticket: #4112
 4 years ago
Philippe Antoine f29b43defd detect: rust generic functions for integers 
Move it away from http2 to generic core crate.
And use it for DCERPC (and SMB)

And remove the C version.
Main change in API is the free function is not free itself, but
a rust wrapper around unbox.

Ticket: #4112
 4 years ago
Philippe Antoine c4d9cb02ec util: better hex print function 
Without dangerous snprintf pattern identified by CodeQL
even if this pattern is not a problem in those precise cases,
it may easily get copy pasted in a dangerous place, so better
get rid of it and make CodeQL happy
 4 years ago
Philippe Antoine 6058792bee rust: make suricata context const 
So that it is read only and its pointers do not get modified
 4 years ago
Philippe Antoine 5a00acece2 ftp: remove temporary fields from state 
As input, input_len and direction only last for the scope of
one call of AppLayerParserParse, it is not necessary to keep them
in FtpState which lives longer, so we consume less memory.
 4 years ago
Jason Ish c8a5207083 detect: introduce "like" ip-only signature type 
Rules that look like they should be IP-only but contain a negated rule
address are now marked with an LIKE_IPONLY flag. This is so they are
treated like IPONLY rules with respect to flow action, but don't
interfere with other IPONLY processing like using the radix tree.

Ticket: #5361
 4 years ago
Philippe Antoine d5abaf0b38 decode: fix integer warning 
Newly introduced warning.
Regular cast as value is checked just before.

Ticket: #4516
 4 years ago
Philippe Antoine 717e51b7cf defrag: fix integer warnings 
Ticket: #4516
 4 years ago
Philippe Antoine 2d761810db rust: cbindgen first verifies existing bindings 
So as not to recompile every C file inclusing rust.h
 4 years ago
Philippe Antoine ced96a8aad detect: parsing avoiding infinite loop 
by comparing size_t to strlen result
Instead of uint16_t which would loop

Ticket: #5310
 4 years ago
Philippe Antoine 875eb58fb0 file: use functions on fd to avoid toctou 
Ticket: #5308
 4 years ago
Philippe Antoine ecb8dd4de0 util: check for unsigned overflow in rohash 
To make CodeQL happy
 4 years ago
Jason Ish adda8801d8 conf: remove ConfGetValue 
All uses of ConfGetValue are satisfied by ConfGet
 4 years ago
Philippe Antoine 5bd19135b0 util: remove malloc from streaming buffer config 
as it is unused
 4 years ago
Victor Julien ebf0629615 log-pcap: remove tunnel locks 
The tunnel lock mutex only "protects" the tunnel synchronization,
not the packet data, length or datalink fields.
 4 years ago
Victor Julien e7ab96c389 nflog: fix datalink compile issue 4 years ago
Juliana Fajardini 43d28f251f util/action: convert unittests to FAIL/PASS API 
Task #5371
 4 years ago
Juliana Fajardini 9b9b6aa2ce util/action: unittests clean-up (to sv tests) 
Removing all unittests that work better as suricata-verify tests.

Task #5371
 4 years ago
Victor Julien 4ed6c928aa unittest: minor helper cleanup 4 years ago
Victor Julien 41b5364511 detect/parse: cleanup test 4 years ago
Victor Julien a437dde739 detect: parsing test cleanups/improvements 4 years ago
Victor Julien e738b10e23 host-os-info: add test to show mixed ipv4/ipv6 4 years ago
Victor Julien f3d887310c rule/vars: clean up tests 4 years ago
Victor Julien 1b65af2867 detect/iponly: minor code cleanup 4 years ago
Victor Julien beecc1890f detect/iponly: include postmatch in determination 4 years ago
Victor Julien 4b097460c2 detect/iponly: simplify handling of 'any' parsing 4 years ago
Victor Julien ffef10c5d7 detect: address parsing variable rename to match code style 4 years ago
Victor Julien 51ef6f4e3a detect/iponly: remove unused code 4 years ago
Victor Julien f4f63ebff8 stream: add packet header outside of lock 4 years ago
Victor Julien 419920288c log/pcap: open handles outside of lock 4 years ago
Scott Jordan c751c45850 log/pcap: add buffer timeout 
Set timeout for pcap log so that packets do not sit
in buffer. Set default to one second.
 4 years ago
Scott Jordan 2bf3172dd1 stream: memcap tracking for TcpSegment alloc 4 years ago
Eric Leblond 47a5e6356d log/pcap: handle case of multiple link types 4 years ago
Eric Leblond 2c2fc6cd91 flow: set datalink for pseudo packet 
Set pseudo packet datalink to the global one. This fixes the case
where the pcap handle is open with information coming from a
pseudo packet. Without this, we did end up in most cases with
an Ethernet packet being written in a Raw pcap.
 4 years ago
Eric Leblond 1c2fba57f8 suricata: introduce global linktype 
As Suricata is not supporting pcap-ng we have to stick with one single
datalink type for the capture if ever we want to do pcap logging.
Assuming this, this patch introduces a function to set the link
type globally. This will be used with pcap conditional logging
to get the logging of TCP segments with the correct link type.
 4 years ago
Eric Leblond 584136ecb7 log/pcap: log segments for pseudo packets 4 years ago
Eric Leblond 8f0ef48e82 log/pcap: fix conditional pcap in tag mode 
We were missing the first packet when using condition pcap logging
in tag mode as it was not tagged. As a result we were not getting
the stream data triggering the alert in the pcap file.
 4 years ago
Eric Leblond 9f4d59b3f7 detect/tag: add a tag for first packet 
We may need to know that a packet has been tagged but is the
first one (and thus is not tagged).
 4 years ago
Scott Jordan 6cfc3343e7 log/pcap: dump segments of both sides of tcp session. 
This patch updates tcp segment dumping to dump segments
from both sides of the session in order when capturing
alerts and tags.
 4 years ago
Eric Leblond faab853685 log/pcap and eve/alert: get pcap filename to support multi mode 
This patch adds a function to get the current pcap file name that
will be used to current packet. This patch also  updates EVE
alerts to add pcap output filename when pcap capture is done in
multi or normal mode.
 4 years ago
Eric Leblond 2317fd83ef log/pcap: fix typo in error message 4 years ago
Eric Leblond 3908166f91 stream: count realloc in memcap 
TCP memory cap was not taking into account the memory that can
be used by realloc of Packet headers in TCP segments.
 4 years ago
Eric Leblond 0f14c55e52 log/pcap: update copyright date 4 years ago
Eric Leblond 58ef7bcdee log/pcap: introduce tag as logging condition 
This patch adds the tag as logging condition. If this option is
used all tagged packets are written to the pcap.
 4 years ago
Eric Leblond 626fce0712 log/pcap: fix some indentation and white spaces 4 years ago
Eric Leblond cc04eef007 log/pcap: add support for tunnel logging 
In alert mode, we need to write the root packet to the pcap
file instead of the packet that did trigger the alert.
 4 years ago
Eric Leblond e7b1c52c1c log/pcap: add existing stream logging 
This patch update the alert mode of pcap logging.

It uses the packet header data added to the TCP segments
to build packets corresponding to the acked data that did trigger
the alert. It then write it to the pcap file before starting to
dump all packet for the flow that did alert.
 4 years ago
Eric Leblond b416a4455c stream: conditionally add packet header to segment 
This patch optionally adds packet header to the TCP segment
and update the for each segment function by changing the
callback.

This patch is based on the work by Scott Jordan <scottfgjordan@gmail.com>
 4 years ago
Eric Leblond 435557ee7f detect: add flag when packet is first with alert 
We add a flag to packet to be able to know if this packet was the
first one to get alerts on the flow.
 4 years ago
Eric Leblond 412ca5d64c log/pcap: add PcapWrite function 
It will be used later when multiple writing operations will be
necessary.
 4 years ago
Eric Leblond 4cab5e5262 log/pcap: conditional logging 
Add an option to only write to pcap packets with alerts and flow
that have alerted.
 4 years ago
Jason Ish 3ea6572e22 rules: use primary default-rule-path if set on command line 
When reloading rules, respect `--set default-rule-path=...` from the
command line if set.

Previously the rule reload would always take the default-rule-path from
the configuration file, even if overrided on the command line.

Issue: #1911
 4 years ago
Juliana Fajardini 28ac75b505 detect/alert: directly increment alerts.discarded 
In the unlikely case of AlertQueueExpand failure, we were incrementing
the discarded alerts stats in AlertQueueAppend via the Packet member in the
DetectEngineThreadCtx, which may not be initialized yet.

Bug #5353
 4 years ago