aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
16,863 Commits
8 Branches
174 Tags
252 MiB
main
main-8.0.x
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.7
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '65b863b087'
${ noResults }
Commit Graph

40 Commits (65b863b087d8f6d7c0800700f89ca33f06ad861f)

Author SHA1 Message Date
Jason Ish ad6d9e0d93 base64: prefix base64 C API with "SC" 2 years ago
Shivani Bhardwaj 6ff0f72f4d detect/base64: minor cleanups 
1. decode_len can be u32 as it stores min of two u32s.
2. Add defensive check for payload_len calculation underflow.
 2 years ago
Shivani Bhardwaj cbb571a61c rust/base64: add decoder 
Add a pure rust base64 decoder. This supports 3 modes of operation just
like the C decoder as follows.
1. RFC 2045
2. RFC 4648
3. Strict

One notable change is that "strict" mode is carried out by the rust
base64 crate instead of native Rust. This crate was already used for
encoding in a few places like datasets of string type. As a part of this
mode, now, only the strings that can be reliably converted back are
decoded.

The decoder fn is available to C via FFI.

Bug 6280
Ticket 7065
Ticket 7058
 2 years ago
Jeff Lucovsky 5b97f4040c detect/base64: Use Rust defined modes everywhere 
Issue: 6487

To avoid ambiguity, a single definition for base 64 decoding modes will
be used. The Rust base64 transform contains the definitions for the
existing mode types: Strict, RFC2045, RFC4648
 2 years ago
Philippe Antoine c272a646c5 detect: SigMatchAppendSMToList can fail 
Ticket: #6104

And failures should be handled to say that the rule failed to load

Reverts the fix by 299ee6ed55
that was simple, but not complete (memory leak),
to have this bigger API change which simplifies code.
 3 years ago
Jeff Lucovsky 3286c3b912 detect/pcre: Use local match variables 
pcre2 is not thread-safe wrt match objects so use locally scoped
objects.

Issue: 4797
 3 years ago
Victor Julien 27aa35cd5b detect/base64_decode: use local pcre2_match_data 3 years ago
Victor Julien af87b105dd detect/base64_decode: remove obsolete test; test cleanups 4 years ago
Victor Julien 0eed8cefdf detect/base64_decode: remove obsolete debug code 4 years ago
Victor Julien b31ffde6f4 output: remove error codes from output 4 years ago
Shivani Bhardwaj dad52f133d base64: add new mode as per RFC 4648 
As per RFC 4648,
Implementations MUST reject the encoded data if it contains characters
outside the base alphabet when interpreting base-encoded data, unless
the specification referring to this document explicitly states
otherwise.

Add a new mode BASE64_MODE_RFC4648, and handle input strictly as per the
specification.

Bug 5223
 4 years ago
Victor Julien 9fa0033966 detect: reduce datatype scope for various keywords 4 years ago
Victor Julien 08e349a8bb detect: update copyright years 4 years ago
Philippe Antoine 02f2602dde src: rework includes as per cppclean 4 years ago
Shivani Bhardwaj 5b27619778 base64: make decoder handle decoded data space constraints 
So far, it was the job of caller to send the bae64 decoder a perfect
block of data and take care of the destination buffer (decoded data)
size. Now, make it the decoder's job to take care of any space
constraints that the destination buffer may have and return accordingly.

Also, handle space characters in base64 encoded data as per RFC 2045.

Update MIME parser accordingly to handle the base64 data.

Ticket: 5315
 4 years ago
Shivani Bhardwaj 9131d1d857 base64: add Base64Mode enum 4 years ago
Philippe Antoine 23fb139e00 detect: do not upgrade base64 decode when fuzzing 
As fuzzing will put a very big value, and then
ThreadCtxDoInit will try to allocate it,
ending in out of memory
 5 years ago
Philippe Antoine 3de99a214c pcre2: migrate keywords parsing 5 years ago
Victor Julien 6ab323d323 detect: hide RegisterTests behind ifdef UNITTESTS 
Update all callers to more aggressively use UNITTESTS guards as well.
 6 years ago
Victor Julien 26bcc97515 detect/keywords: dynamic version part of doc URL 7 years ago
Jeff Lucovsky d3a65fe156 detect: Provide `de_ctx` to free functions 
This commit makes sure that the `DetectEngineCtx *` is available
to each detector's "free" function.
 7 years ago
Shivani Bhardwaj 0e4f261224 Use StringParse* for all parsers and configurations 7 years ago
Jeff Lucovsky 7f6af10fed general: copyright bump 7 years ago
Jeff Lucovsky 4b0085b03c detect: Update to take advantage of PCRE refactor 
This commit changes the keyword detectors to use the refactored PCRE
modifications from detect-parse.[ch]
 7 years ago
Eric Leblond 2d11e9394c detect-base64: fix url in list keywords commands 7 years ago
Victor Julien 579cc9f02b const: constify decoder, app-layer, detect funcs 7 years ago
Victor Julien ab1200fbd7 compiler: more strict compiler warnings 
Set flags by default:

    -Wmissing-prototypes
    -Wmissing-declarations
    -Wstrict-prototypes
    -Wwrite-strings
    -Wcast-align
    -Wbad-function-cast
    -Wformat-security
    -Wno-format-nonliteral
    -Wmissing-format-attribute
    -funsigned-char

Fix minor compiler warnings for these new flags on gcc and clang.
 10 years ago
Victor Julien dfac5276b8 detect: remove unused SIGMATCH_PAYLOAD flag 10 years ago
Victor Julien e7d5e845c7 http_header / http_raw_header: dynamic buffers 10 years ago
Victor Julien 779d40cedf detect: remove hardcoded sm_list logic from setup 
Introduce utility functions to aid this.
 10 years ago
Victor Julien f370e88135 detect: move init only Signature members to init_data 10 years ago
Victor Julien 8edc954e82 detect: get rid of Signature::sm_lists 
Instead use the lists in init_data during setup and the SigMatchData
arrays during runtime.
 10 years ago
Victor Julien bd456076a8 detect: pass SigMatchData to inspect functions 10 years ago
Victor Julien bfd4bc8233 detect: constify Signature/SigMatch use at runtime 10 years ago
Eric Leblond a2e2f50fb9 documentation: fix list keywords URLs 
Update URLs in keyword definition to point to sphinx documentation.
 10 years ago
maxtors 9d3fd82849 Removed duplicate include statements. 11 years ago
Victor Julien e67ae0f174 detect keywords: use parse regex util func 11 years ago
Jason Ish 796dd5223b tests: no longer necessary to provide successful return code 
1 pass, 0 is fail.
 11 years ago
Victor Julien c858bfea4a base64_decode: fix potential keyword parsing issue (CID 1340064) 11 years ago
Jason Ish 6b15686fd1 base64_decode, base64_data: decode and match base64 11 years ago