aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
11,102 Commits
7 Branches
155 Tags
194 MiB
master
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '75727c05e0'
${ noResults }
Commit Graph

11102 Commits (75727c05e0502d32b76bc9720212475905793dd1)
 

Author SHA1 Message Date
Victor Julien 26bcc97515 detect/keywords: dynamic version part of doc URL 5 years ago
Victor Julien 8f2df0f938 logging: fix default log format for release mode 5 years ago
Victor Julien eef7760870 datasets: reputation value validation 5 years ago
Philippe Antoine ae102ca096 detect: refactoring parsing of ip range 
To optimize first netmask
 5 years ago
Philippe Antoine 8ca9c0e8f0 signature: minimizes ip CIDR for ip range 
Example leading to over allocation is 41.232.107.2-43.252.37.6
 5 years ago
Jeff Lucovsky fa082d04dc decode/erspan: Warn on ERSPAN Type I config 
This commit checks whether pre-6.x settings for ERSPAN Type I are
present. ERSPAN Type I is no longer enabled/disabled through a
configuration setting -- it's always enabled.

When a setting exists to enable/disable ERSPAN Type I decoding, a
warning message is logged.

Enabling/disabling ERSPAN Type I decode has been deprecated in 6.x
 5 years ago
Jeff Lucovsky 82da71bbc4 decode/erspan: Add warning ERSPAN Type I config 
This commit adds a warning value when ERSPAN Type I configuration
settings are detected; specifically, when ERSPAN Type I `enabled` is
specified.

Enabling/disabling ERSPAN Type I decode has been deprecated in 6.x
 5 years ago
Jason Ish 0dd1b2a616 doc: typo: http.server_body should be http.response_body 
Thanks to Jason Williams for pointing this out.
 5 years ago
Victor Julien ad448da3f4 flowbits: fix hang in flowbits 'or' parsing 5 years ago
Victor Julien 07ed0dadae fuzz: suppress too noisy htp errors check 5 years ago
Jeff Lucovsky 2b93898771 napatech: Correct timestamp rounding issue 
This commit fixes the conversion of timestamps. Without the extra
parens, the resulting timestamp value for usecs will be 1 or 0 due to
the operator precedence order (+ takes precedence over ?:)
 5 years ago
Jeff Lucovsky f12adcc58c napatech: Check for out-of-band control operations 
This commit causes the packet source to check for out of band control
operations when there are no packets immediately available.
 5 years ago
Jeff Lucovsky 5b13468bfc dag: Check for out-of-band control operations 
This commit causes the packet source to check for out of band control
operations when there are no packets immediately available.
 5 years ago
Phil Young b48049c51c napatech: Restructure Packet/Hostbuffer release 
The end-of-processing has been restructured so that Packet and Hostbuffer
data structures are now released within the NapatechReleasePacket() callback
function.
 5 years ago
Shivani Bhardwaj e22b345bb6 af-packet: change type of cluster_id to uint16_t 5 years ago
Shivani Bhardwaj e7c0f0ad91 src: remove multiple uses of atoi 
atoi() and related functions lack a mechanism for reporting errors for
invalid values. Replace them with calls to the appropriate
ByteExtractString* functions.

Partially closes redmine ticket #3053.
 5 years ago
Shivani Bhardwaj 92bb52f430 Add wrappers for validating range checks 5 years ago
Victor Julien c2d36ed261 fastlog: copyright year bump and remove stale comments 5 years ago
Victor Julien 28837b203e fastlog: fix unlikely memleak 
Fix memleak is case of alloc error during startup.
 5 years ago
Victor Julien b763885d1b thash: suppress coverity fp's 5 years ago
Victor Julien b0c79c6996 datasets: suppress coverity fp's 5 years ago
frank honza bbe9137f20 rfb: Update incomplete handling in parser. 
This commit adds an updated incomplete handling for the RFB-Parser. If
incomplete data is processed, the successfully consumed position and
length of remainder + 1 is returned. If the next packet is not empty
suricata will call the parser again.

This commit is a result of discussion on https://github.com/OISF/suricata/pull/4792.
 5 years ago
Jason Ish d955acc01c github-ci: check all commits on pr 
On a pull request, attempt to compile all commits from
the base branch to the head of the PR branch.

The job is in a separate workflow file to limit it to
pull-requests only, as the base branch is not available
on push (something to look into).
 5 years ago
Philippe Antoine 053c728871 http: adds debug check against too many warnings 5 years ago
Jeff Lucovsky aa3f784d32 detect/ftp: FTP memory accounting fixes 
This commit continues the work started by @vanlink and corrects the
accounting of FTP memory usage against the memcap limit.
 5 years ago
Victor Julien 7ca94ba0a2 app-layer: fix protocol detection bail conditions for TCP fastopen 5 years ago
Jeff Lucovsky e8ad67fa4f detect/lua: Unregister object during free 
This commit removes the registration for the object being freed.
 5 years ago
Jeff Lucovsky d3a65fe156 detect: Provide `de_ctx` to free functions 
This commit makes sure that the `DetectEngineCtx *` is available
to each detector's "free" function.
 5 years ago
Jeff Lucovsky d1151f3f8e detect: Provide function to clear per-thread ctx 
This commit provides an interface to free previously allocated
per-thread contextual information on the keyword lists.
 5 years ago
Shivani Bhardwaj cf4e4e4ac3 flowbits: Allow support for flowbit ORing 
This patch allows to OR multiple flowbits on isset and isnotset flowbit
actions.

e.g.
Earlier in order to check if either fb1 or fb2 was set, it was required
to write two rules,
```
alert ip any any -> any any (msg:\"Flowbit fb1 isset\"; flowbits:isset,fb1; sid:1;)
alert ip any any -> any any (msg:\"Flowbit fb2 isset\"; flowbits:isset,fb2; sid:2;)
```

now, the same can be achieved with
```
alert ip any any -> any any (msg:\"Flowbit fb2 isset\"; flowbits:isset,fb1|fb2; sid:23;)
```

This operator can be used to check if one of the many flowbits is set
and also if one of the many flowbits is not set.
 5 years ago
Victor Julien a611ae2102 doc/perf: minor improvements 5 years ago
Andreas Herz 1d9db2b5f9 doc: add performance analysis section 5 years ago
Philippe Antoine fef124b92d ftp: use switch for ftp commands for style 5 years ago
Philippe Antoine 6f36403219 ftp: FTPGetAlstateProgress for done port commands 
For a done transaction with command PORT,
we expect FTP_STATE_FINISHED
and we got FTP_STATE_PORT_DONE instead
which prevented logging of these transactions

We change the order of the evaluations to get the right result
 5 years ago
Philippe Antoine 699d6682da ftp: indent FTPParseResponse again 5 years ago
Philippe Antoine a6294d6ec2 ftp: FTPParseResponse bufferizes lines 
Protects against evasion by TCP packet splitting

The problem arised if the FTP response is split on multiple packets

The fix is to bufferize the content, until we get a complete line
 5 years ago
Philippe Antoine cd26fc139e detect: fix insertion in linked list for fast pattern 
Make sure we do not add the same list_id twice
by checking at least all the lists with the current priority
 5 years ago
Victor Julien 0ce489bcc9 conf/datadir: fix possible out of bounds array access 5 years ago
Victor Julien 1d8d03184d datasets: remove useless variables 5 years ago
Victor Julien 7a6269798b datasets: add 'dataset-remove' unix command 5 years ago
Victor Julien af06883f65 datasets: add 'remove' support 5 years ago
Victor Julien 51726e0a0f thash: add 'remove' support 5 years ago
Victor Julien b80ab56d10 datasets: improve 'dataset-add' error checking 5 years ago
Victor Julien ff55a444d4 datasets: fix return values for 'add's 5 years ago
Victor Julien 381bc2dd64 datasets: fix ref cnt handling 
Each 'add' and 'lookup' would increment the use_cnt, without anything
bringing it back down.

Since there is no removal yet, nothing is actually affected by it yet.
 5 years ago
Victor Julien 03dc5d1d74 datasets: silence noisy 'dataset-add' log 5 years ago
Victor Julien f8159bd372 build: default to c11 standard 
Rearrange pcap includes to fix builds on MinGW
 5 years ago
Victor Julien 1893e40e79 build: don't limit C std to c99 (gnu99) 
Now that C11 atomics and thread local storage are supported, the
compiler can figure out what version to use.
 5 years ago
Victor Julien 7691fc4f9e configure: check for u_int and friends 5 years ago
Victor Julien cb4b5296da fuzz: include pcap headers through suricata-common.h 5 years ago