aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
8,540 Commits
8 Branches
173 Tags
211 MiB
main-8.0.x
main
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '73b59bda53'
${ noResults }
Commit Graph

117 Commits (73b59bda532a6bb232deddf79b5287b6ae0bb20f)

Author SHA1 Message Date
Victor Julien bca0cd71ae app-layer: use logger bits to avoid looping 
Avoid looping in transaction output.

Update app-layer API to store the bits in one step
and retrieve the bits in a single step as well.

Update users of the API.
 9 years ago
Eric Leblond 31a0783865 app-layer: add Flow to probing parser functions 9 years ago
Victor Julien c0d8def0e5 tls: don't set event on small input data 
On very small data the max loop count could be 0. Make sure
it's always at least 1.
 9 years ago
Mats Klepsland d363a165c1 app-layer-ssl: fix bug with >255 records in one stream 9 years ago
Mats Klepsland 23f8cc4a03 app-layer-tls: don't decode client certificates 
Decoding client certificate overwrites the validity dates from the
server certificate, so we therefore don't decode it, since we don't
do anything with it (right now) anyway.

Fixes Bug #2050
 9 years ago
Victor Julien 96b2e8afc0 gcc7: fixes for format string warnings 
GCC 7.1.1 on Fedora gave several warnings with -Wimplicit-fallthrough
and -Wformat-truncation

This patch addresses the warnings.
 9 years ago
Victor Julien 8dd077943c ssl: minor code reformatting 9 years ago
Eric Leblond 26eb49d721 bypass: add explicit flag in stream engine 
TCP reassembly is now deactivated more frequently and triggering a
bypass on it is resulting in missing some alerts due forgetting
about packet based signature.

So this patch is introducing a dedicated flag that can be set in
the app layer and transmitted in the streaming to trigger bypass.

It is currently used by the SSL app layer to trigger bypass when
the stream becomes encrypted.
 9 years ago
Victor Julien 5c01b40931 tests: update tests for app-layer changes 9 years ago
Victor Julien ab1200fbd7 compiler: more strict compiler warnings 
Set flags by default:

    -Wmissing-prototypes
    -Wmissing-declarations
    -Wstrict-prototypes
    -Wwrite-strings
    -Wcast-align
    -Wbad-function-cast
    -Wformat-security
    -Wno-format-nonliteral
    -Wmissing-format-attribute
    -funsigned-char

Fix minor compiler warnings for these new flags on gcc and clang.
 10 years ago
Victor Julien a0fad6bb7f mpm: run engines as few times as possible 
In various scenarios buffers would be checked my MPM more than
once. This was because the buffers would be inspected for a
certain progress value or higher.

For example, for each packet in a file upload, the engine would
not just rerun the 'http client body' MPM on the new data, it
would also rerun the method, uri, headers, cookie, etc MPMs.

This was obviously inefficent, so this patch changes the logic.

The patch only runs the MPM engines when the progress is exactly
the intended progress. If the progress is beyond the desired
value, it is run once. A tracker is added to the app layer API,
where the completed MPMs are tracked.

Implemented for HTTP, TLS and SSH.
 10 years ago
Victor Julien 2d223b69cd stream: set 'trigger raw' per direction 10 years ago
Ray Ruvinskiy 7539973109 tls: logging for session resumption 
We assume session resumption has occurred if the Client Hello message
included a session id, we have not seen the server certificate, but
we have seen a Change Cipher Spec message from the server.

Previously, these transactions were not logged at all because the
server cert was never seen.

Ticket: https://redmine.openinfosecfoundation.org/issues/1969
 10 years ago
Mats Klepsland 2c1a36dd6e app-layer-tls: decode certificate serial number 10 years ago
Victor Julien 473dae75b5 tls: introduce 'cert ready' state 10 years ago
Victor Julien a6fccd952e ssl: suppress scan-build warnings 10 years ago
Jason Ish c35c18a797 app-layer: support to server and to client probing parsers 
When registering a probing parser allow to_server and
to_client parsers to be registered. Previously the
probing parser may be called for both directions which
in some cases works OK, but in others can cause
the to_client side to be detected as failed.
 10 years ago
Mats Klepsland 10c93221fa tls: increase max number of tls records per packet 
Tls packets may contain several records. This increase the number
of allowed records per packet from 30 to 255, and adds a new and
more informative decoder event when this limit is reached.
 10 years ago
Mats Klepsland 554065189c tls: don't trigger decoder event on no extensions in CLIENT_HELLO 
No extensions are allowed in <TLSv.1.2, so don't trigger SURICATA
TLS handshake invalid length decoder event when no extensions are
specified in CLIENT HELLO.
 10 years ago
Victor Julien b789d2ae3d tls: change 'no-reassemble' option to default off 
This option was broken so there should be no visible change to
actual deployments.
 10 years ago
Eric Leblond 4eca40ac34 app-layer-tls: stop detection if no reassembly 
It no-reassembly is asked in TLS conf then we can stop inspection
after handshake and cause bypass to be triggered on the flow.
 10 years ago
Giuseppe Longo 675fa56497 app-layer: add ThreadVars to AppLayerParserParse 
To be able to add a transaction counter we will need a ThreadVars
in the AppLayerParserParse function.
This function is massively used in unittests
and this result in an long commit.
 10 years ago
Mats Klepsland b914861692 app-layer-ssl: use new unit test macros 10 years ago
Mats Klepsland 9d23ad9d25 tls: fix faulty unittests 10 years ago
Mats Klepsland b74f3fd978 coverty: fix CID 1361873 10 years ago
Mats Klepsland c36595eb35 tls: set event if input buffer overflows 
Set HANDSHAKE_INVALID_LENGTH event if input buffer overflows while
decoding client_hello/server_hello.
 10 years ago
Mats Klepsland 1f7b813080 app-layer-tls: add name to authors 10 years ago
Mats Klepsland 12da0e8681 tls: add function for decoding client_hello 
Add function TLSDecodeHandshakeHello() to enable using the same code
for decoding both client_hello and server_hello.
 10 years ago
Victor Julien 48b3cb0492 unittests: fix tests 10 years ago
Victor Julien 6530c3d0d8 unittests: replace SCMutex* calls by FLOWLOCK_* 10 years ago
Jason Ish afc796a099 ssl: store current state separately from cumulative state 
The ssl_state keyword needs the current state, not the cumulative state
in order be compatible with Snort's implementation.
 10 years ago
Mats Klepsland 663273a31e tls: change flag checking in SSLParserTest23 
Change flag checking in SSLParserTest23 to check each flag individually
to enable adding more flags without the test failing.
 10 years ago
Mats Klepsland 1f98915ebe tls: register logger functions 10 years ago
Mats Klepsland c4b918b6c4 tx: do not store ProgressCompletionStatus per ipproto 
Change AppLayerParserRegisterGetStateProgressCompletionStatus to
only store one ProgressCompletionStatus callback function for each
alproto, instead of storing one for each ipproto.

This enables us to use AppLayerParserGetStateProgressCompletionStatus
in functions where we do not know the ipproto used.
 10 years ago
Mats Klepsland e4f03b18ba tls: make TX aware 10 years ago
Mats Klepsland a422ae9f3c tls-sni: fix alignment issues 10 years ago
Mats Klepsland e117461d4b app-layer-ssl: code cleanup 11 years ago
Jason Ish 796dd5223b tests: no longer necessary to provide successful return code 
1 pass, 0 is fail.
 11 years ago
Mats Klepsland eb39487f48 app-layer-ssl: fix out of bounds memory read 
Added several checks to avoid out of bounds memory read caused
by malformed traffic.
 11 years ago
Mats Klepsland 7602f650b1 app-layer-ssl: fix memleak 
Avoid that the SNI extension code is executed twice sometimes, causing
memory leaks.
 11 years ago
Victor Julien ee5fd4613b tls-sni: fix uninitialized memory use 
On bad traffic the parser could allocated memory that was not
intialized. This was later used in the JSON output logging as
a valid null terminated string.
 11 years ago
Victor Julien a7f54d63b7 tls: fix compiler warnings 11 years ago
Mats Klepsland 3ac1a3d9fe app-layer-ssl: get server name from SNI extension 
Decode client hello handshake to get server name from SNI extension.
 11 years ago
Victor Julien f4f53924bb app-layer: fix coverity warnings 11 years ago
Victor Julien 4e7cb7b863 app-layer: update all protocols to accept NULL+EOF 
Update all non-HTTP protocol parsers to accept a NULL+EOF input.
 11 years ago
Victor Julien cf839c931f tls: force 'raw' reassembly after each record 
Trigger raw reassembly after each record and after the handshake.
 12 years ago
Victor Julien db563ed4b0 tls: check SSL3/TLS version per record 
Set event if SSL3/TLS record isn't within the acceptable range.
 12 years ago
Victor Julien f0bdb009ed tls/heartbleed: fix test 
Now that we continue to track ssl/tls after the handshake, we need
to fix tests that checked for the cutoff flags.
 13 years ago
Victor Julien 31655aef7e tls/heartbleed: improve encrypted logic 
Don't assume that if the type field isn't 01 or 02 it's an encrypted
heartbeat. Instead, use our knowledge of the SSL state.
 13 years ago
Victor Julien fdbd9b3f25 tls/heartbleed: formatting fixes 13 years ago