aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
13,851 Commits
8 Branches
173 Tags
258 MiB
main
main-7.0.x
main-8.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '7bfb63210e'
${ noResults }
Commit Graph

11122 Commits (7bfb63210e3a128c999343a4805b1d972ae64b73)

Author SHA1 Message Date
Alice Akaki 8614bff017 detect-filemagic: convert unittests to FAIL/PASS APIs 
Task: #4034
 4 years ago
Victor Julien 55cf11fdc2 flow/storage: use const for getter 4 years ago
Victor Julien 99fd69ee8c eve: mac logging code cleanup 4 years ago
Victor Julien 2d79a5206b eve/drop: log direction if we have a flow 4 years ago
Victor Julien 90f3823cad eve: log mac addresses in packet direction 4 years ago
Victor Julien f1068bbb08 dpdk: fix timestamp issues 
Each thread had its own version of the `machine_start_time`, which
lead to slight time differences. This became apparent mostly in IPS,
where 2 threads each process a side of the flow.

This patch makes the `machine_start_time` global.
 4 years ago
Victor Julien cd2a5ec84f packet: move action functions to packet files 4 years ago
Victor Julien 0977f40d1c detect/tag: improve time handling on windows 
Bug: #5584.
 4 years ago
Victor Julien 410acf226f detect: unittest guards for ut only function 4 years ago
Victor Julien 60285a629f detect: remove unused function 4 years ago
Victor Julien 5d6212183b eve/alert: minor cleanups 4 years ago
Victor Julien 6c200c7793 detect: issue drop to root packet in all cases 
Update DROP action handling in tunnel packets. DROP/REJECT action is set
to outer (root) and inner packet.

Check action flags both against outer (root) and inner packet.

Remove PACKET_SET_ACTION macro. Replace with RESET for the one reset usecase.
The reason to remove is to make the logic easier to understand.

Reduce scope of RESET macros.

Rename PacketTestAction to PacketCheckAction except in unittests. Keep
PacketTestAction as a wrapper around PacketCheckAction. This makes it
easier to trace the action handling in the real code.

Fix rate_filter setting actions directly.

General code cleanups.

Bug: #5571.
 4 years ago
Victor Julien 79fc8e74cb packetpool: debug message to assist drop checks 4 years ago
Victor Julien d1009e295c packetpool: remove debug validation check 
Current packet might be the root or a child. Root would have set
drop action set, but Packet::pkt_src might be set in either.
 4 years ago
Victor Julien fe5a8beb50 decode: minor code cleanup 4 years ago
Victor Julien ba3e0b3155 nfq: set drop reason on verdict error 4 years ago
Victor Julien a7333a3ea5 napatech: reduce size of Packet structure 
Put napatech packet vars in the union that is meant for this type of
data.
 4 years ago
Haleema Khan b31a286952 detect-fileext: convert unittests to FAIL/PASS APIs 
Fixes Bug: #4033
 4 years ago
Lukas Sismis 5365fdccf7 dpdk: fix mempool cache error message 4 years ago
Shivani Bhardwaj 7005443b8b base64: add and clean tests 4 years ago
Shivani Bhardwaj dad52f133d base64: add new mode as per RFC 4648 
As per RFC 4648,
Implementations MUST reject the encoded data if it contains characters
outside the base alphabet when interpreting base-encoded data, unless
the specification referring to this document explicitly states
otherwise.

Add a new mode BASE64_MODE_RFC4648, and handle input strictly as per the
specification.

Bug 5223
 4 years ago
Lukas Sismis e101384e7b transversal: remove suricata-ids.org references 4 years ago
Lukas Sismis aeb690317a dpdk: allow specifying RSS hash function flags in the config 
Ticket: #5400
 4 years ago
Eric Leblond e46a0bd46a eve: explicit default when setting port 4 years ago
Eric Leblond 00c419a6f8 eve: micro simplification 4 years ago
Eric Leblond a0065f4368 eve/alert: add direction field to log data way 
Add a key in the event to specify if the data that did
trigger the alert are in to_client or to_server direction.
 4 years ago
Eric Leblond f1300e68c9 eve/alert: add src and dest info to flow in alert 
When looking at an alert event, it was impossible to determine which
side from src or dest IP in the alert was the client and wich side
was the server with regards to the underlying flow. This was a problem
when you try to known who belongs a metadata property such as a HTTP
hostname or a TLS JA3.

This patch updates the code to add src and dest IP in the flow
subobject as well as src and dst port. This way, we can now which
side is the client and which side is the server.

The result is looking like:

{
  "event_type": "alert",
  "src_ip": "22.47.184.196",
  "src_port": 81,
  "dest_ip": "192.168.1.47",
  "dest_port": 1063,
  "proto": "TCP",
  "tx_id": 0,
  "alert": {
    "signature_id": 2018959,
    "rev": 3,
  },
  "app_proto": "http",
  "flow": {
    "pkts_toserver": 22,
    "pkts_toclient": 35,
    "bytes_toserver": 1370,
    "bytes_toclient": 48852,
    "start": "2009-10-28T10:01:46.755232+0100",
    "src_ip": "192.168.1.47",
    "dest_ip": "22.47.184.196",
    "src_port": 1063,
    "dest_port": 81
  }
}
 4 years ago
Eric Leblond bb93d67ddd unix-socket: add command to get flow stats 
Add a command to extract the accounting data from a live
flow using the unix socket. It takes the flow_id as param
and return the volume of data seen on the flow as well as
its age.
 4 years ago
Eric Leblond 19400a7d69 flow: add function to get flow using flow_id 4 years ago
Eric Leblond 06756314d6 flow: change flow id computation method 
Previous method was truncating the flow hash value when building
the flow_id. It is interesting not to loose the flow hash value
as it can be used in other tools or to interact with a flow that
is still active.
 4 years ago
Eric Leblond 06b6f85c1f json/flow: log if flow had gap in TCP 4 years ago
Eric Leblond f9faff5c4c flow: add function to say if there is gap 4 years ago
Eric Leblond e6768118da stream: flag TCP streams with gap 4 years ago
Eric Leblond 9cb06d4376 detect/smb: add smb.ntlmssp_domain keyword 
Feature #5411.
 4 years ago
Eric Leblond 69ef1bc194 detect/smb: add smb.ntlmssp_user keyword 
Feature #5411.
 4 years ago
Victor Julien a6e86fef04 detect: remove unused data struct 4 years ago
Victor Julien f837146321 flow/worker: process injected flows more gradually 
Worker threads are responsible for final processing of timed out flows.
These are selected by the Flow Manager and inserted into a per thread
queue. The Flow Worker then checks this queue after each packet. Due to
the burstiness of this process, the packet threads would sometimes process
a lot of these flows in the context of a single packet, leading to spike
in latency which might cause packet loss.

This patch changes the behavior to only process at max 2 flows per packet.
This way added processing cost is amortized over many packets.
 4 years ago
Victor Julien ce1bdcb474 flow: count max number of injected flows in workers 4 years ago
Victor Julien 235f369ab9 stream: reduce pool locking overhead 
Add thread local cache to avoid locking overhead for ssns and segments.

A thread will return segments/ssns to a local cache first, and if that
is full, to a return queue where the actual return to the pool returns
a batch, to amortize locking overhead.

Adds segment and session pool/cache counters to see where how effective
the cache is.
 4 years ago
Victor Julien 536d66e344 stream: minor test cleanup 4 years ago
Victor Julien 839a4f5ab4 files: only call loggers is there is work to do 4 years ago
Victor Julien fa6d41ca66 filestore: remove obsolete checks 4 years ago
Victor Julien 0b3053a376 filestore: fix empty file not opening, but trying to close 4 years ago
Victor Julien 23323a961f app-layer: reduce app cleanup and output-tx calls 
Track packets that updated the app-layer, and for those run
the transaction housekeeping and output-tx logging loops.

Do the same of end of flow packets.

This skips needless iterations over the transaction stores.
 4 years ago
Victor Julien 4bb7f827e0 output/tx: minor cleanups/optimizations 4 years ago
Victor Julien 39cf5b151a src: includes cleanup 
Work towards making `suricata-common.h` only introduce system headers
and other things that are independent of complex internal Suricata
data structures.

Update files to compile after this.

Remove special DPDK handling for strlcpy and strlcat, as this caused
many compilation failures w/o including DPDK headers for all files.

Remove packet macros from decode.h and move them into their own file,
turn them into functions and rename them to match our function naming
policy.
 4 years ago
Victor Julien 3e2295a963 detect: clean up detect-engine-state.h 
Remove prototypes that are not about purely the data structures.
 4 years ago
Victor Julien ad0a29cabc detect: remove wrapper func 4 years ago
Victor Julien 1dd0a2fed6 detect: move DetectTransaction to header its used in 4 years ago
Victor Julien 41265a859e detect/files: optimize file.data by skipping non-file txs 
As well as 'file' txs not in our direction.

Implement the same logic for file.name and file.magic prefilter engines.
 4 years ago
Victor Julien db0f9ddc69 files/tx: inspection, logging and loop optimizations 
Introduce AppLayerTxData::file_tx as direction(s) indicator for transactions.
When set to 0, its not a file tx and it will not be considered for file
inspection, logging and housekeeping tasks.

Various tx loop optimizations in housekeeping and output.

Update the "file capable" app-layers to set the fields based on their
directional file support as well as on the traffic.
 4 years ago
Victor Julien 3263202094 detect/tx: add AppLayerTxData to PrefilterTx 
In preparation of some file inspection optimizations, for which we need the
tx data.

Update all users.
 4 years ago
Victor Julien 602c39ed01 files: remove unused code 4 years ago
Victor Julien b1c22169f8 files: don't set NOSTORE in 'store all' case 4 years ago
Victor Julien d39a79b6f2 smtp: remove bad tests 4 years ago
Victor Julien 79499e4769 app-layer: move files into transactions 
Update APIs to store files in transactions instead of the per flow state.

Goal is to avoid the overhead of matching up files and transactions in
cases where there are many of both.

Update all protocol implementations to support this.

Update file logging logic to account for having files in transactions. Instead
of it acting separately on file containers, it is now tied into the
transaction logging.

Update the filestore keyword to consider a match if filestore output not
enabled.
 4 years ago
Victor Julien 01e64d80da app-layer: trunc parser per direction 4 years ago
Victor Julien ff9d1807f9 app-layer: parser flags to u16 4 years ago
Victor Julien a1d728bb65 app-layer: specify direction in tx cleanup 
In preparation of per tx files storage.
 4 years ago
Victor Julien c27df6304d app-layer: introduce common AppLayerStateData API 
Add per state structure for storing flags and other variables.
 4 years ago
Victor Julien 96b642c32d file: minor debug updates 4 years ago
Victor Julien 2218a3716e file: clean up file flags handling 4 years ago
Victor Julien 408b64558f files: debug log flags 4 years ago
Victor Julien bdbaaa3b24 lua: store id with tx ptr 4 years ago
Sascha Steinbiss 8438ee48aa decode-ipv4: adjust validation to RFC 
RFC1108 only specifies a minimum field length of 3, not
a fixed length of 11.
 4 years ago
Sascha Steinbiss fb790121bb decode-ipv4: implement extended security option 
IP option 0x85 (extended security) is mentioned in the
documentation for the ipopts keyword but was not implemented.
 4 years ago
Philippe Antoine ae6abd8ca3 ssl: fix compiler warning 
implicit conversion loses integer precision: 'int' to 'uint16_t'
because C shifts << translates automatically to signed integers
 4 years ago
Victor Julien b06c0579f5 stream: fix reachable assertion 
Fix `Flow::thread_id` not always getting properly set up, leading to
a reachable assertion.

Bug #4582.
 4 years ago
Juliana Fajardini 9d9bc04886 stream/tcp: typo fix 4 years ago
jason taylor 489af24132 detect: update ttl debug log messages 
Signed-off-by: jason taylor <jtfas90@gmail.com>
 4 years ago
Jeff Lucovsky ccd1063e43 detect/bytemath: convert parser to Rust 
Issue: 5077

This commit
- Converts the PCRE based parser to Rust.
- Adds unit tests to the new Rust modules
- Removes the PCRE parser from detect-bytemath.c
- Adjusts the C source modules to refer to the Rust definitions
- Includes the multiply operator (missing from the C parser)
 4 years ago
Philippe Antoine c6d8daecd3 log: fix coverity warning 
CID 1515529

Checks ftell return value for negative/error
 4 years ago
Victor Julien 1701a6b14c tls: handle incomplete header sooner 
Make sure to exit the parser early on incomplete header data.

Additionally, make sure to not create duplicated tls frames in this
case.

Add a debug validation check for the header parser parsing too much
data, which should never happen.
 4 years ago
Victor Julien 9053c49178 ssl: add debug validation check for incomplete api 4 years ago
Victor Julien 0ec136621d debug: add bool string print helper macro 4 years ago
Victor Julien 69be41b241 tls: improve record checks 
Improve unknown record handling. Inspired by Wireshark 'unknown record'
handling, we take a best effort approach for records with unknown content
types in TLS versions 1.0, 1.1 and 1.2.

Improve record length check and set 'invalid_record_length' event instead
of 'invalid_tls_header'.
 4 years ago
Victor Julien c028800ae1 tls: improve versions extension logic 
Skip over unusable versions like GREASE.
 4 years ago
Victor Julien 599791fa33 tls: make version and size checks stricter 
This way bad records won't buffer lots of stream data.
 4 years ago
Victor Julien c73d812026 tls: store cert data in heap buffer 
Cert chain is a list of pointers into this buffer, so can't use a
stream slice approach.
 4 years ago
Victor Julien 4a283d480d eve/tls: implement client cert logging 
Enable client logging in extended mode.

Add "client", "client_certificate" and "client_chain", where the latter two
depend on "client".
 4 years ago
Victor Julien e817a8f968 tls: parse client certificates 
Parse client cerificates and store them in the state similar to how
this is done for server certificates.

Update "progress" handling to not consider the TLS handshake complete
if the server indicated a client cert was needed.
 4 years ago
Victor Julien 10f5e6cb66 tls: prepare for client cert parsing 4 years ago
Victor Julien 6d4cc39c02 eve/tls: prepare for client cert logging 
Code cleanups that work on per direction "connp" instead of hard coding
to the server side.
 4 years ago
Victor Julien 14b2e04b58 tls: make cert handling more generic 
In preparation for client cert handling.
 4 years ago
Victor Julien cf4c201acb tls: avoid tls.invalid_handshake_message FP 
Don't set TLS_DECODER_EVENT_INVALID_HANDSHAKE_MESSAGE event on encrypted
handshake messages.
 4 years ago
Victor Julien e9d63f3355 tls: don't set 2 events for a single exception 
Keep the more specific ones.
 4 years ago
Victor Julien 214e466b29 tls: remove incomplete tests 
These tests are incompatible with the incomplete API usage and should
have been pcap based tests in the first place.
 4 years ago
Victor Julien 82e03bd8fc tls: set event if record size exceeds limit 4 years ago
Victor Julien e857c864ca tls: support server hello done message 4 years ago
Victor Julien 4bab6e24e5 tls: support handshake fragmentation 
Implement TLS record defrag for handshake messages.

Ticket: #5183.
 4 years ago
Victor Julien bcaf0f6f7d tls: remove certificate buffering code 
TCP Buffering is now done in the app-layer using the incomplete API, on
the SSL/TLS record level. TLS level fragmentation will be implemented
separately.
 4 years ago
Victor Julien 0839317ea7 tls: parse handshake protocol records in single pass 4 years ago
Victor Julien 9f0ea5e70c sslv2: use version from client hello 
Remove streaming code that is now unused.

Incomplete handling makes this record parsing work on full data.
 4 years ago
Victor Julien c8d79fb81f ssl: implement 'incomplete' handling for SSLv2 4 years ago
Victor Julien 6076a51511 tls: streaming mode for application records 
To avoid overhead of stream buffering for records we don't do
much with anyway, pass through application records instead of
buffering the entire record in the stream engine.
 4 years ago
Victor Julien 129fcb5c72 tls: use incomplete API to get full TLS records 
The TLS record header is parsed in streaming mode still, but once the
record size is known we tell the app-layer API to give us the full
record.

Ticket: #5481
 4 years ago
Gleb Smirnoff 7110ea75c4 ipfw: remove setting of SO_BROADCAST on the divert(4) socket 
My review of the FreeBSD kernel code reveals that this setting
a) is ignored by the kernel b) is not required.  The sending
side of divert(4) never checks so->so_options, but always gives
IP_ALLOWBROADCAST to ip_output().
 4 years ago
Andrei Shchapaniak ee5573c4ee dpdk/i40e: fix warning with number of queues for RSS configuration 4 years ago
Philippe Antoine 390cf9248f detect: adds flow.age keyword 
Ticket: #5536
 4 years ago
Philippe Antoine ce2775d331 flow/icmpv4: fix vlan.use-for-tracking 
For ICMPv4 error messages the vlan ids were always considered,
even if the 'vlan.use-for-tracking' option was disabled.

Ticket: #5330
 4 years ago
Sascha Steinbiss 148b53125b ebpf: update deprecated API calls 
This fixes build errors when libbpf 1.0 is used. It removes previously
deprecated API functions that were still in use in Suricata's eBPF
code.
 4 years ago
Jeff Lucovsky 63745a7879 detect/tls: Improve tls.fingerprint rule handling 
Issue: 4581

This commit improves the runtime performance of rules with
tls.fingerprint by using the inspection logic from tls.cert_fingerprint.
 4 years ago
Jeff Lucovsky 6bccd5aa30 detect/uri: Remove unnecessary include 
This commit removes an unnecessary #include for detect-uricontent.h
 4 years ago
Victor Julien d941703cd8 detect/build: minor code cleanup 4 years ago
Victor Julien 040404b093 detect/profiling: track bytes scanned by prefilter engines 4 years ago
Victor Julien 682e2a07fe detect/tls: add tls.cert_chain_len keyword 4 years ago
Victor Julien 224ba82569 eve/tls: warn on unsupported 'custom' options 4 years ago
Victor Julien dbf3d1e977 tls: make SSLSetEvent a macro to help debugging 4 years ago
Victor Julien 0e39c92fcf flow-manager: reduce locks at startup 
Effectively busy looping on a mutex to wait for time to be ready.
 4 years ago
Victor Julien 19e94e93fa common: move u8_tolower to common header 4 years ago
Victor Julien 18e63d4ede htp: remove user setup from request line callback 
This used to be the first callback that was called, but its not anymore.

Codecov confirmed that this is no longer used and therefore not useful.
 4 years ago
Victor Julien faca974f32 ipfw: remove unused func prototype 4 years ago
Victor Julien b9ad1d1260 app-layer: fix compiler warning 4 years ago
Victor Julien e250ef6402 debug: remove empty header 4 years ago
Victor Julien c3c5829f96 reputation: add ipv6 cidr test 4 years ago
Victor Julien e9c4b3719e reputation: fix multiline test 4 years ago
Eric Leblond a9a17c8185 landlock: handle filestore case 
If landlock ABI is inferior to 2 (before Linux 5.19) then the
renaming of files is impossible if the protection is enabled. This
patch disables landlock if ABI < 2 and file-store is enabled.

As file store is initialized in output the call to landlock had to
done after the output initialization.
 4 years ago
Eric Leblond 485d5a4ea4 landlock: basic implementation 
This patch is adding support for Landlock, a Linux
Security Module available since Linux 5.13.

The concept is to prevent any file operation on directories where
Suricata is not supposed to access.

Landlock support is built by default if the header is present. The
feature is disabled by default and need to be activated in the YAML
to be active.

Landlock documentation: https://docs.kernel.org/userspace-api/landlock.html

Feature: #5479
 4 years ago
Juliana Fajardini bbd968c738 exceptions: add reject support to exception policy 
This enables the usage of 'reject' as an exception policy. As for both
IPS and IDS modes the intended result of sending a reject packet is to
reject the related flow, this will effectively mean setting the reject
action to the packet that triggered the exception condition, and then
dropping the associated flow.

Task #5503
 4 years ago
Victor Julien f5bd55dac8 decode/tcp: allow 4 byte TFO with 2 byte cookie 4 years ago
Philippe Antoine 5ef259722b dhcp: adds renewal-time keyword 
Ticket: #5507
 4 years ago
Philippe Antoine dc59389087 dhcp: fix license in detect-dhcp-leasetime.c 
from search and replace overkill
 4 years ago
Philippe Antoine 6faf6299e0 dhcp: adds rebinding-time keyword 
Ticket: #5506
 4 years ago
Josh Soref c23560ec41 detect: function header return value clarification 
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>
 4 years ago
Gleb Smirnoff 5dbbc52b06 ipfw: use PF_DIVERT on modern FreeBSD 4 years ago
Victor Julien bb2e11108b packetpool: fix uaf in debug validation check 
Location of the check meant access to freed packet was possible.

Move check and simplify it to just look at the packet at hand.
 4 years ago
Philippe Antoine b0ce55c9df flow: finish to remove obsolete counters 
As was begun in b3599507f4

Ticket: #5317
 4 years ago
Juliana Fajardini aa5bb2c329 stream: add exception policy for midstream flows 
This allows to set a midstream-policy that can:
- fail closed (stream.midstream-policy=drop-flow)
- fail open (stream.midstream-policy=pass-flow)
- bypass stream (stream.midstream-policy=bypass)
- do nothing (default behavior)

Usage and behavior:

If stream.midstream-policy is set then if Suricata identifies a midstream flow
it will apply the corresponding action associated with the policy.

No setting means Suricata will not apply such policies, either inspecting the
flow (if stream.midstream=true) or ignoring it stream.midstream=false.

Task #5468
 4 years ago
Juliana Fajardini 242b8f7d65 exceptions: add callbacks for drop-flow policy 
Make sure that when the policy is to drop the flow, we set no inspection
for payload and packet and disable applayer inspection as well.

Task #5468
 4 years ago
Victor Julien 1bff888947 detect: fix duplicate detect state issue 
For protocols with multi buffer inspection there could be multiple times
the same sid would be queued into the candidates queue. This triggered
a debug validation check.

W/o debug validation this would lead to duplicate work and possibly multiple
alerts where a single one would be appropriate.

Bug: 5419.
 4 years ago
Victor Julien d31beba8d4 detect/frames: fix too strict debug check 
Frame::len is -1 if it is still unknown. Handle that in the debug
check.
 4 years ago
Victor Julien f04b7a1827 stream/ids: make sure we don't slide past last_ack 
Bug: #5401.
 4 years ago
Victor Julien 55b2077fcd stream: minor code cleanup 4 years ago
Shivani Bhardwaj 78045d3bbf tls/sni: remove unused fn declaration 4 years ago
Shivani Bhardwaj 42c3f418c6 tls: add tls.random* keywords 
Add tls.random keyword that matches on the 32 bytes of the TLS
random field for client as well as server.
Add tls.random_time keyword that matches on the first 4 bytes of the TLS
random field for client as well as server.
Add tls.random_bytes keyword that matches on the last 28 bytes of the TLS
random field for client as well as server.

All these are sticky buffers.

Feature 5190
 4 years ago
Philippe Antoine e587f6792a detect: support file.data for HTTP1 to server 
That is file sent with POST or PUT

Ticket: #4144
 4 years ago
Victor Julien 50f8779128 flow-manager: reduce burstiness in adaptive timing 
Previous adaptive model would have a large time range when scanning the
hash when not so busy. In the default case it would take up to 4 minutes
for a full hash scan. In case of sudden increase in business, where the
hash would fill up rapidily during a few seconds, the flow manager would
be forced to suddenly consider a much larger slice of the hash leading
to a burst of work. This burst would increase pressure on the rest of the
system leading to packet loss as the worker threads would be overloaded
with flow housekeeping tasks.

This patch reduces the max scan time to 10 seconds, and ramps up quickly
to increase the slice of the hash scanned.
 4 years ago
Juliana Fajardini 58ef3cde7a exceptions: error out when invalid policy is used 
Before, if an invalid value was passed as exception policy, Suricata
would log a warning and set the exception policy to "ignore". This is a
very different result, than, say, dropping or bypassing a midstream flow.

Task #5504
 4 years ago
Philippe Antoine 61b73416e2 detect: transforms check for 0-sized buffer 
So as to avoid undefined behavior with a 0-sized variable length
array

Ticket: #5521
 4 years ago
Philippe Antoine d1ebf320f7 fuzz: disable enip detection based on source port 
So as to avoid fuzzing detecting protocol polyglots with enip
 4 years ago
Philippe Antoine 617c9fb7e5 fuzz: remove check about max transactions 
Suricata can indeed pipeline many HTTP1 transactions
 4 years ago
Victor Julien b01c311c1d profiling: fix implicit-int-float-conversion warnings 4 years ago
Victor Julien aa09d5f556 packetpool: ifdef debug check 4 years ago
Juliana Fajardini e7727c3744 decode: remove unused macros, replace w/ functions 
With the recent changes, these macros weren't being used anymore.

Related to
Bug #5458
 4 years ago
Juliana Fajardini d07a6c6174 stream/tcp: remove repeated header declaration 
StreamTcpRegisterTests was being declared twice.
 4 years ago
Juliana Fajardini f897761ecb detect/alert: add unittests to check packet action 
Add unittests to check that packet flags are correctly updated after
detection finds drop or reject rules that match.

Related to
Bug #5458
 4 years ago
Juliana Fajardini abd595d695 decode: validate if dropped packet has drop reason 
Related to
Bug #5458
 4 years ago
Juliana Fajardini 1f54e8611a detect/alert: ensure reject action is applied 
Bug 5458 states that the reject action is no longer working. While SV
tests that use the reject action still pass, it indeed seems that a
regression has happened with commit aa93984, because while the
function that applies rule actions to the flow (RuleActionToFlow) does
check for the reject action, the newly added function PacketApply
SignatureActions only checks for ACTION_DROP or ACTION_PASS when
deciding to call RuleActionToFlow.

Bug #5458
 4 years ago
Juliana Fajardini 1774ff18a6 decode: make PacketDrop use action as parameter 
A Packet may be dropped due to several different reasons. This change
adds action as a parameter, so we can update the packet action when we
drop it, instead of setting it to drop.

Related to
Bug #5458
 4 years ago
Eric Leblond 01bf0ad43d luajit: fix unittests build 
When building with the following options:

 ./configure CC=clang --enable-luajit --enable-geoip --enable-unittests

There is a build failure:

runmode-unittests.c:234:9: error: implicit declaration of function 'LuajitSetupStatesPool' is invalid in C99 [-Werror,-Wimplicit-function-declaration]
    if (LuajitSetupStatesPool() != 0) {
 4 years ago