aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
7,173 Commits
7 Branches
155 Tags
197 MiB
master
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '68d9677eea'
${ noResults }
Commit Graph

7173 Commits (68d9677eea1fce8553223c49e7d808d0deee200c)
 

Author SHA1 Message Date
Victor Julien 78b4db8a95 flow: introduce function to generate flow id 
The flow id itself is not stored in the flow, but generated based on
properties that do not change during the lifetime of the flow.

As it's meant for use with the json output, it is limited to a signed
64 bit integer (int64_t) because that is the time json_integer_t uses.
 9 years ago
Victor Julien 666bba8121 detect: implement continue detect for dcepayload 
Also fix a corner case in start detection.

Bug 1853.
 9 years ago
Victor Julien ecf4a2862c detect: cleanup 9 years ago
Victor Julien 6b078e4f51 detect: fix ICMP error handling issue 
The first packet in both directions of a flow looks up the rule group
(sgh) and stores it in the flow. This makes sure the lookup doesn't
have to be performed for each packet.

ICMPv4 error messages are connected to the TCP or UDP flow they apply
to. In the case of such an ICMP error being the first packet in a
flow's direction, this would lead to an issue.

The packet would look up the rule group based on the ICMP protocol,
not based on the embedded TCP/UDP. This makes sense, as the ICMP
packet is inspected as ICMP packet. The consequence however, was that
this rule group pointer (sgh) would be stored in the flow. This is
wrong, as TCP/UDP packets that follow the ICMP packet would have no sgh
or the wrong sgh.

In normal traffic this shouldn't normally happen, but it could be
used to evade Suricata's inspection.
 9 years ago
Victor Julien 2eb941f9d9 output dns: fix bit declarations 9 years ago
Victor Julien 5c6ffe5653 common: introduce macro for bit declarations 9 years ago
Tom DeCanio 0f6c8806a0 output-json-dns: dns output filtering. 9 years ago
Jason Ish 1691c10681 eve: make logging of tagged packets optional 
But it is enabled in the default configuration.
 9 years ago
Jason Ish 040660556e eve: log tag packets as packet events 
Create a new eve event type, "packet" for logging packets that
are tagged as part of an event. The packet is still at the top
level to keep it consistent with alert event types.

In addition to the packet being logged, a packet_info object
is created to hold the linktype and any future meta data
we may want to add about the packet.
 9 years ago
Victor Julien 305b1b90fd detect: minor cleanup 9 years ago
Victor Julien ec0217f52c detect: minor style fixes 9 years ago
Victor Julien 7d11af16ef detect: minor debug output cleanup 9 years ago
Victor Julien 0e2ea4e63b detect: remove unused debug code 9 years ago
Victor Julien b79d9cda3a detect: minor cleanups 9 years ago
Victor Julien 199bb3bae3 stream-tcp: fix ssn returning to wrong thread pool 9 years ago
Jason Ish cf61472619 app-layer-dcerpc-udp: style cleanups 
- consistent 4 space indent
- cleanup file header
 9 years ago
Jason Ish e55334fb37 detect-flowbits: fix misleading indentation 
detect-flowbits.c: In function ‘FlowBitsTestSig02’:
detect-flowbits.c:475:4: warning: this ‘if’ clause does not guard... [-Wmisleading-indentation]
    if(error_count == 5)
    ^~
detect-flowbits.c:478:5: note: ...this statement, but the latter is misleadingly indented as if it is guarded by the ‘if’
     SigGroupBuild(de_ctx);
     ^~~~~~~~~~~~~
 9 years ago
Jason Ish a975fdcfeb app-layer-dcerpc-udp: fix missleading indentation 
app-layer-dcerpc-udp.c: In function ‘DCERPCUDPParserTest01’:
app-layer-dcerpc-udp.c:1105:5: warning: this ‘if’ clause does not guard... [-Wmisleading-indentation]
     if (alp_tctx != NULL)
     ^~
app-layer-dcerpc-udp.c:1107:2: note: ...this statement, but the latter is misleadingly indented as if it is guarded by the ‘if’
  StreamTcpFreeConfig(TRUE);
  ^~~~~~~~~~~~~~~~~~~
 9 years ago
Jason Ish 95015a3f6d decode: support Cisco Fabric Path / DCE 
Cisco Fabric Path is ethernet wrapped in an ethernet like header
with 2 extra bytes.  The ethernet type is in the same location
so the ethernet decoder can be used with some validation
for the extra length.
 9 years ago
Victor Julien a8da6bbd71 output: use safer logic for fingerprint printing 9 years ago
Jason Ish d3c0135eec app-layer-tls: accomodate trailing \0 in hash output 9 years ago
Jason Ish 73a0451070 output-json-dns: allocate correct size hexstring buffer 
The buffer allocated for the hexstring was not large enough
for a ':' separated hex string.
 9 years ago
Victor Julien b3b78d4326 detect: log earlier that rule reload is happening 9 years ago
Victor Julien 731d4a7049 dns: fix OOB read on malformed TXT record 9 years ago
Jason Ish 7e6ce01600 unified2: fix logging of tagged packets 
The structure for create the alert preceding each tagged packet
was not being initialized, preventing tagged packets from being
logged.

Note: Snort unified2 does not precede tagged packets with an
alert like is done here, so this just fixes what the code
intended to do, it does not make it Snort unified2
compatible.

Address issue:
https://redmine.openinfosecfoundation.org/issues/1854
 9 years ago
Victor Julien 26e67400ba dns: fix name parsing issue leading to events 9 years ago
Victor Julien 884fddf035 packet: remove empty and unused UDPVars struct 9 years ago
Victor Julien c9756caeef packet: make tcp/udp/icmp vars union non-anonymous 
Clean the whole thing after use.
 9 years ago
Victor Julien 79388df887 commandline: fix strlcpy usage 9 years ago
Jason Ish 2403af5177 pcap: don't fail with --pcap with no device present 
Issue: 1856.

A device with the name of "" (empty string) was being added
with LiveRegisterDevice which failed to initialize causing
Suricata to fail.
 9 years ago
Victor Julien ec602089a0 Update Changelog for 3.1.1 9 years ago
Victor Julien 2856dfd119 output lua: improve debugging output 9 years ago
Victor Julien a26e59cb6d output lua: set proper logging progress values 9 years ago
Victor Julien 7188c2630f outputs: small code cleanup 9 years ago
Jason Ish f397e7bfc2 dns: directional logging 
Register loggers for to server and to client so requests
and responses can be logged independently of each other.

This results in the request log having the actual timestamp of
the request instead of the reply.
 9 years ago
Jason Ish fcad270d96 logging: setup all registered loggers for a name 
When setting up a configured logger, do so for all registered
loggers of that name instead of just the first registered one.

This allows a logger to register itself more than once, which
can allow for independent logging of requests and replies without
touching the core transaction handling logic.

We do this so just having "dns" in the eve-log can configured
multiple "dns" loggers instead of having something like "dns-tc"
and "dns-ts" in the configuration file.
 9 years ago
Victor Julien 9d01ef58fc lua smtp: fix SMTPGetMimeField arg checking 
Properly check argument before passing it on: CID 1363385: (NULL_RETURNS)
 9 years ago
Victor Julien 37b10c13c1 configure: require libhtp 0.5.20 
Ticket #1839
 9 years ago
Victor Julien 2b10b8374c cmdline: fix --list-keywords and --list-app-layer-protos 
Ticket #1840
 9 years ago
Victor Julien ed483b4e13 output: don't register loggers for disabled protocols 9 years ago
Victor Julien 01913f6a56 app-layer: add AppLayerParserIsTxAware 
This function globally checks if the protocol is registered and
enabled by testing for the per alproto callback:
StateGetProgressCompletionStatus

This check is to be used before enabling Tx-aware code, like loggers.
 9 years ago
Victor Julien f302a6cf86 output: fix debug messages 9 years ago
Victor Julien b73098e990 smb: style fix in log message 9 years ago
Victor Julien 3bb408940f af-packet: improve threads selection logic 
Only use RSS queue count when cluster_qm is used. Only use core count
when cluster_flow is used.

Use a local variable to simplify the check so that we don't have to deal
with the extra flags.
 9 years ago
Victor Julien da8f9c1896 lua: add smtp for detection 9 years ago
Victor Julien 928cb1eba9 lua output: expose smtp functions to output scripts 9 years ago
Victor Julien 7501bf744f lua: SMTPGetRcptList use position as key, not value 9 years ago
tobiass1 7581f5129f Lua: SMTP support; Addresses feature ticket #1775; v5 9 years ago
Victor Julien ff3baeee90 lua: support smtp tx logging 9 years ago
Victor Julien 5e4d071b76 lua-output: don't crash on script setup error 9 years ago