aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
18,837 Commits
8 Branches
173 Tags
193 MiB
main-8.0.x
main
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '7d66eb5f04'
${ noResults }
Commit Graph

241 Commits (7d66eb5f04f3d312a5d035637979f095d00c79ac)

Author SHA1 Message Date
Victor Julien b8ed01e23e eve/schema: map tls fields to keywords 1 year ago
Shivani Bhardwaj fc1dbf6eb4 schema: add rule keyword mapping for dcerpc 1 year ago
Jason Ish 744f301df4 eve-parity: handle arrays of scalars 
And add an example with "client_alpns".
 1 year ago
Jason Ish 771d9d9d8b schema: mark dns.version and dns.grouped as having no keywords 1 year ago
Jason Ish 00a571a25c schema: mark "stats" and "drop" as having no keywords 1 year ago
Jason Ish 115d7d3c6d schema: add an object for mapping fields to keywords 
To some EVE fields and a "suricata" object that contains an array of
keywords. These are the keywords that map directly to this field, or
somehow cover this field.

This is an attempt at tooling to help with EVE and keyword parity.

Related to tickets: #5642, #6463, #4772
 1 year ago
Jeff Lucovsky cbda276aeb output: Log ethernet type 
Issue 7129

When configured with the existing "ethernet" switch, include the ether
type in the output.

This is most useful with anomaly records indicating unknown ethertypes.
 2 years ago
Jeff Lucovsky 123b36b9f5 decode/ethertype: Event on unknown ethertype 
Issue: 7129

Create a decode/engine event if unknown ethertypes are observed.
 2 years ago
Philippe Antoine b967fcaf8f stats: remove unused pseudo_failed stat 2 years ago
Philippe Antoine b0282f49af http2: complete json schema 
git grep js.set_string rust/src/http2/logger.rs | grep '"' |
cut -d'"' -f2 | sort | uniq | while read i;
do echo -n $i; git grep $i etc/schema.json | wc -l; done

shows only has_multiple was missing
 2 years ago
Victor Julien 779f9d8ba3 eve/flow: add per flow TCP oob urg data counter 
If TCP urgent handling is set to the OOB processing, the number of OOB
bytes is tracked for SEQ offset calculations. If this offset is
non-zero, add the field to the flow record.

Ticket: #7411.
 2 years ago
Victor Julien 6882bcb3e5 stream: add TCP urgent handling options 
TCP urgent handling is a complex topic due to conflicting RFCs and
implementations.

Until now the URG flag and urgent pointer values were simply ignored,
leading to an effective "inline" processing of urgent data. Many
implementations however, do not default to this behavior.

Many actual implementations use the urgent mechanism to send 1 byte of
data out of band to the application.

Complicating the matter is that the way the urgent logic is handled is
generally configurable both of the OS and the app level. So from the
network it is impossible to know with confidence what the settings are.

This patch adds the following policies:

`stream.reassembly.urgent.policy`:

- drop: drop URG packets before they affect the stream engine

- inline: ignore the urgent pointer and process all data inline

- oob (out of band): treat the last byte as out of band

- gap: skip the last byte, but do no adjust sequence offsets, leading to
       gaps in the data

For the `oob` option, tracking of a sequence number offset is required,
as the OOB data does "consume" sequence number space. This is limited to
64k. For this reason, there is a second policy:

`stream.reassembly.urgent.oob-limit-policy`:

- drop: drop URG packets before they affect the stream engine

- inline: ignore the urgent pointer and process all data inline

- gap: skip the last byte, but do no adjust sequence offsets, leading to
       gaps in the data

Bug: #7411.
 2 years ago
Victor Julien ac02a71479 decode/tcp: count urg flag 2 years ago
Jason Ish 37f4c52b22 eve/dns: add truncation flags for fields that are truncated 
If rrname, rdata or mname are truncated, set a flag field like
'rrname_truncated: true' to indicate that the name is truncated.

Ticket: #7280
 2 years ago
Philippe Antoine f2c3776314 detect: log app-layer metadata in alert with single tx 
Ticket: 7199

Uses a config parameter detect.guess-applayer-tx to enable
this behavior (off by default)

This feature is requested for use cases with signatures not
using app-layer keywords but still targetting application
layer transactions, such as pass/drop rule combination,
or lua usage.

This overrides the previous behavior of checking if the signature
has a content match, by checking if there is only one live
transaction, in addition to the config parameter being set.
 2 years ago
Philippe Antoine 09ba69cfb0 output/http: log invalid status as a string 
Ticket: 7311

If response_status_number is not a valid poisitive integer,
we should not try to parse it again, and fail again,
but just log the raw string.
 2 years ago
Jeff Lucovsky b30df19f1a app-layer/stats: Expand memuse/memcap handling 
This commit adds memcap/memuse handling to the unix-socket interface:
- ftp
- http-byterange
- host

New stats:
- ippair: memuse, memcap
- host: memuse, memcap
- http-byterange: memuse, memcap
 2 years ago
Jason Ish b44fc62e60 eve/schema: add missing field "code" anomaly events 2 years ago
Juliana Fajardini 2eefc4dac8 schema/tls: add missing custom fields chain/cert 
Task #7287
 2 years ago
Jason Ish 6ae5ae701b doc/userguide: generate eve documentation 
Add EVE documentation for QUIC and Pgsql to their respective sections of
the userguide.

Also add a complete EVE reference as an appendix.

Other protocols can be done, but its a manual process to document in the
schema, then add the glue to pull them into the documentation.

The documentation is generated during "make dist", or if it doesn't
exist, "conf.py" will attempt to generate the eve documentation for
building on Readthedocs.
 2 years ago
Jeff Lucovsky a7b70ce5ce config: Update reference keys 
Issue: 4974

1. Use https instead of http everywhere
2. Organize and annotate references by
    - Referenced by ET/Open and ET/Pro
        - URL resolves and works as intended (to provide supplemental
          information regarding a reference value, e.g., bug id, cve
          value)
        - URL no longer resolves
        - URL resolves but doesn't work as intended (to provide
          supplemental information)
    - Not referenced by ET/Open nor ET/Pro
        - URL resolves and works as intended (to provide supplemental
          information regarding a reference value, e.g., bug id, cve
          value)
        - URL no longer resolves
        - URL resolves but doesn't work as intended (to provide
          supplemental information)
 2 years ago
Jeff Lucovsky 9bc468e63a alert/reference: Optionally add reference(s) 
Issue: 4974

Optionally include rule references with the alert. Since there can be
multiple reference keywords, they are collected into an array.
 2 years ago
Giuseppe Longo edf70276d6 rust/ldap: enable parser for udp 
This introduces a new parser registration function for LDAP/UDP, and update
ldap configuration in order to be able to enable/disable a single parser
independently (such as dns).
Also, GAPs are accepted only for TCP parser and not for UDP.

Ticket #7203
 2 years ago
Shivani Bhardwaj 638b5c4da7 eve/stats: add description for flow stats 
Ticket 6434
 2 years ago
Philippe Antoine 1e82e20c65 doh: implement dns over http2 app-proto 
Ticket: 5773
 2 years ago
Giuseppe Longo 910a5b226c rust/ldap: implement logger 2 years ago
Jason Ish fcc1b1067b eve/dns: make version required 
The "eve.version" field is not always logged. Update the schema to
enforce that it is, and fix it for records that don't log it.

Ticket: #7167
 2 years ago
Jason Ish df656324ba dns: new v3 style logging for alerts 
V3 style DNS logging fixes the discrepancies between request and
response logging better dns records and alert records.

The main change is that queries and answers are always logged as
arrays, and header fields are not logged in array items.

For alerts this means that answers are now logged as arrays, queries
already were.

DNS records will get this new format as well, but with a configuration
parameter.

Bug: #6281
 2 years ago
Nathan Scrivens 9ecc3573a7 dns: parse and populate OPT rdata struct 
Feature: 7017
Add DNSRDataOPT struct and DNSRData enum type OPT.
Add OPT parsing function and test function.
Add DNSRData OPT type to lua.rs match.
Log OPT rdata.
 2 years ago
Nathan Scrivens 4598ca164d dns log: add additional section 
Feature: 7011
dns_log_json_answer: log additional section records.
update schema.json with new "additionals" section.
 2 years ago
Philippe Antoine c9ce43b31e output: configurable payload_length field for alerts 
Ticket: 7098
 2 years ago
Victor Julien 869d5492dc eve/schema: update for alpn 2 years ago
Victor Julien 7f474af1d0 eve/schema: minor enip reformat 2 years ago
Philippe Antoine 82c03f72c3 enip: convert to rust 
Ticket: 3958

- transactions are now bidirectional
- there is a logger
- gap support is improved with probing for resync
- frames support
- app-layer events
- enip_command keyword accepts now string enumeration as values.
- add enip.status keyword
- add keywords :
    enip.product_name, enip.protocol_version, enip.revision,
    enip.identity_status, enip.state, enip.serial, enip.product_code,
    enip.device_type, enip.vendor_id, enip.capabilities,
    enip.cip_attribute, enip.cip_class, enip.cip_instance,
    enip.cip_status, enip.cip_extendedstatus
 2 years ago
Shivani Bhardwaj de1de53e2f eve/stats: add description for flow mgr & recycler 
Ticket 6434
 2 years ago
Philippe Antoine 9332bc2c45 dns: adds missing NS field in json schema 2 years ago
Philippe Antoine 8d4699fbba eve/schema: complete and reorder smtp fields 
received and cc were missing
 2 years ago
Victor Julien 1190e426f9 defrag: remove trackers on lookup 
When looking up a tracker, remove any timed out / completed trackers.
 2 years ago
Victor Julien 75b78d7643 defrag: add defrag.memuse counter 
Gives a current snapshot of the memory in use by the defrag engine.
 2 years ago
Victor Julien 83dc703d1f defrag: add various counters 2 years ago
Victor Julien fc05d253d2 defrag: add defrag.mgr.tracker_timeout counter 
Updated by flow manager.
 2 years ago
Victor Julien 76e05c72f6 eve/schema: reformat 2 years ago
Jason Ish 10e6028175 lua: track memory limit exceede errors 
Update the Lua allocated to set a code on memory allocation limit
exceeded errors so an appropriate error message can be logged and a
state incremented.

Fixes the tracking of the allocated size by using the difference
between original size, and new size and toss in some debug
validations.
 2 years ago
Jason Ish 5a1cba72f0 lua: add logging and counter for instruction limit being exceeded 2 years ago
Jason Ish c8fa454cb2 lua: add blocked functions as a special log type plus stat 
Distinguish between a generic Lua script error and an error created by a
function being blocked, so each is logged once respective of each other.

Also add a stat that is incremented when a script fails due to a
blocked function.

NOTE: This does not catch calls to functions that are blocked by not
having the library loaded, such as "io.open", as they are blocked by
not even loading the "io" library.
 2 years ago
Shivani Bhardwaj f073cf2350 eve/schema: add tls.subjectaltname fields 
Feature 5234
 2 years ago
Jason Ish 224f55ba21 detect/lua: don't treat a crashed script as no match 
If a rule script crashed, the return value was treated as a no
match. This would make a negation of the rule match and alert.

Instead cleanup and exit early if the rule script crashed and don't
run negation logic.

A stat, detect.lua.errors has been added to count how many times a
script crashes.

Also consolidates the running of the Lua script and return value
handling to a common function.

Bug: #6940
 2 years ago
Philippe Antoine 2c305ba37e pop3: protocol detection 
Ticket: #6366
 2 years ago
Giuseppe Longo 01586d884d output-json/arp: implement logger 
This adds a logger for ARP, disabled by default.

Ticket #6827
 2 years ago
Giuseppe Longo 5219a5da5f decode/arp: implement decoder 
This adds a decoder for ARP.

Ticket #6827
 2 years ago
Shivani Bhardwaj 329ac61961 eve/stats: add description for ips 
Ticket 6434
 2 years ago
Shivani Bhardwaj 861ffff972 eve/stats: add description for transactions 
Ticket 6434
 2 years ago
Giuseppe Longo bff790b6ac rust/sdp: implement logger 
This implements a logger for the SDP protocol.
Given that SDP is encapsulated within other protocols (such as SIP),
enabling it separately is not necessary.

Ticket #6627
 2 years ago
Philippe Antoine 0291d37009 websocket: configurable logging of payload in alerts 2 years ago
Philippe Antoine 44b6aa5e4b app-layer: websockets protocol support 
Ticket: 2695
 2 years ago
Sascha Steinbiss 120313f4da ja4: implement for TLS and QUIC 
Ticket: OISF#6379
 2 years ago
Jeff Lucovsky 2dfa4cecb5 stats: Memcap pressure max relocation 
This commit moves the memcap pressure/pressure_max stats from the global
stats namespace into the memcap namespace.

With per-thread stats, they will be within the flow-manager's values.

Issue: 6398
 2 years ago
Juliana Fajardini caf590d51f stream/midstream: add counter for exception policy 
Add stats counters for when there is an exception policy applied in case
of a session picked up midstream.

Task #5816
 2 years ago
Juliana Fajardini fd9a20ffcf stream/reassemble: add exception policy counters 
Add stats counters for exception policies applied in case of memcap hit
during stream reassembly.

Task #5816
 2 years ago
Juliana Fajardini 2dee3772bf stream/tcp: add ssnmemcap exception policy counter 
Add stats counters for exception policies applied in case a stream
session memcap is hit.

Task #5816
 2 years ago
Juliana Fajardini a71ace8575 applayer: add stats counters for exception errors 
Add stats counters for exception policy are applied for app-layer errors

Part of
Task #5816
 2 years ago
Juliana Fajardini 485c0e1d9a defrag: add exception policy memcap stats counters 
Add defrag memcap stats counter.

Task #5816
 2 years ago
Juliana Fajardini 657419b53e decode/flow: add exception policy stats counters 
We will register stats counters for all policies, even though for now
Suri only uses one possible configuration policy at a time. The idea is
that this could change in the near future, so we want to have this
ready.

Task #5816
 2 years ago
Juliana Fajardini ce001d8eae schema: apply clang formatting changes 2 years ago
Arne Welzel f9cf87a003 schema: Add stats.capture and in_iface properties 
New suricata-verify test listens on loopback interface, resulting
in the capture and in_iface fields in the stats and event objects.
 2 years ago
Jason Ish c2ecae9b82 schema: add flow.wrong_thread 2 years ago
Giuseppe Longo c9d309219e rust/sip: register parser for tcp 
This patch lets the parser to work over tcp protocol, taking care of handling
data before calling the request/response parsers.

Ticket #3351.
 2 years ago
Hadiqa Alamdar Bukhari 6c193b1a3d dns: add missing dns keywords to schema.json 
Found and added missing dns fields in schema.json after manual code review.
Added description to these newly added dns fields.
Feature #5642
 2 years ago
Shivani Bhardwaj 487ba82fb9 eve/stats: add description for applayer flows 
Ticket 6434
 3 years ago
Shivani Bhardwaj 8817514bea eve/stats: add description for expectations 
Ticket 6434
 3 years ago
Shivani Bhardwaj 1816e98ef0 eve/stats: add description for applayer errors 
Ticket 6434
 3 years ago
Shivani Bhardwaj 5a1a32ba5b eve/stats: add description for common fields 
Ticket 6434
 3 years ago
Jason Ish 90ae3a223f eve/schema: allow authorities in dns.answers in alert 
Factor out dns.authorities to a definition.
 3 years ago
Jason Ish b453eea150 stats: add rules skipped 
Rule skipped is a count of the number of rules that are skipped due to
missing requirements.

Feature: #6637
 3 years ago
Philippe Antoine f714678d72 schema: adds missing modbus field 
./stats/app_layer/error/modbus
 3 years ago
Juliana Fajardini 467c3f2c64 schema: apply clang formatting changes 3 years ago
Juliana Fajardini 30ac77ce65 pgsql: add cancel request message 
A CanceldRequest can occur after any query request, and is sent over a
new connection, leading to a new flow. It won't take any reply, but, if
processed by the backend, will lead to an ErrorResponse.

Task #6577
 3 years ago
Philippe Antoine 8c5310aefd doc: quic in eve/schema 
Ticket: #6076
 3 years ago
Jeff Lucovsky 904f0ddeee stats: Track stream reassembly drops 
Issue: 6235
 3 years ago
Yatin Kanetkar b67ff4badf dhcp: Log Vendor Client Identifier (dhcp option 60) 
* Log vendor client identifier (dhcp option 60) if extended dhcp
logging is turned on. This required the `vendor_client_identifier` to
be added to the json schema. Validation done using an SV Test
* Added `requested_ip` to the json schema as well, since it was
missed. My SV test failed without it.

Feature #4587
 3 years ago
Jason Ish 3802a51552 eve/schema: add host 
The "host" field is added to EVE events if the "sensor-name" field is
configured in suricata.yaml.
 3 years ago
Jeff Lucovsky 424f12d1b3 schema: Add memcap pressure values 
Issue: 6094

This commit extends the EVE schema with memcap_pressure values; these
are included in the stat event type records.
 3 years ago
Philippe Antoine b12a35c3cf output: add storing boolean for files 
When filestore keyword is triggered, the file is not yet stored,
when the alert is generated, but only marked for storing.

Ticket: 4881
 3 years ago
Philippe Antoine f35052941d jsonschema: add missing field .files[].file_id 3 years ago
Victor Julien 1f9767a9cb stats: add drop reason counters 
{
  "accepted": 296185,
  "blocked": 162,
  "rejected": 0,
  "replaced": 0,
  "drop_reason": {
    "decode_error": 0,
    "defrag_error": 0,
    "defrag_memcap": 0,
    "flow_memcap": 0,
    "flow_drop": 94,
    "applayer_error": 0,
    "applayer_memcap": 0,
    "rules": 3,
    "threshold_detection_filter": 0,
    "stream_error": 63,
    "stream_memcap": 0,
    "stream_midstream": 2,
    "nfq_error": 0,
    "tunnel_packet_drop": 0
  }
}

Ticket: #6230.
 3 years ago
Victor Julien 735c37c668 eve/schema: add ips capture stats 3 years ago
Juliana Fajardini 0437173848 output/drop: add verdict field 
Related to
Bug #5464
 3 years ago
Juliana Fajardini 53b8defd79 output/alert: add verdict field 
Related to
Bug #5464
 3 years ago
Philippe Antoine 4f4651e360 output/file: http2 metdata is logged in http object 
as is done for http2 events and alerts.
The http.version integer can help to determine if this is HTTP2

Ticket: #6165
 3 years ago
Juliana Fajardini 05417407b3 schema: add missing flow event property: emergency 3 years ago
Jeff Lucovsky 9dc68ac59a json/schema: Add additional VLAN layer stat 
Issue: 2816

This commit extends the JSON schema with the additional VLAN stat for
tracking VLAN encapsulated packets with 3 levels.
 3 years ago
Eric Leblond a73c9b0e40 output: target keys have port 
Update JSON schema to support signature with target keyword
 3 years ago
Victor Julien a8057eeed8 eve/schema: spelling 3 years ago
Philippe Antoine 416a780f69 jsonschema: do not enforce keys for alert metadata 
As this is a free field and can have any key based on a rule
 3 years ago
Jason Ish 3a44197183 schema: add "message_id" to email 3 years ago
Jason Ish bf079c9214 schema: fix optional 
"optional" is not part of jsonschema. Instead an array named "required"
is used to list all field names that are required.
 3 years ago
Jason Ish 49ba378d38 schema: fix engines section 
The definition of items is an object, not an array.
 3 years ago
Lancer Cheng 08b17e9778 eve: add version and warning in ntlmssp 
Bug OISF#5783
 3 years ago
Victor Julien 7e6154a26f stream: add counter for acks for unseen data 
This is another indicator for packet loss or strange captures.
 4 years ago
Victor Julien 83a16a7a89 eve/stream: per packet stream engine logging 
Debug facility to get a per packet view into the stream engine's state.

Logs after a packet has been processed in the stream engine, so the view
into the state includes the updates based on the current packet.

Marked as experimental so it can be changed w/o notice.

Bug: #5876.
 4 years ago
Victor Julien 66ed3ae6e4 flow/mgr: remove flows_timeout_inuse counter 4 years ago
Jason Ish 59d9a51bad eve: remove dcerpc.interface from schema 
Looks like this was due to an error in the dcerpc logging where the
interfaces should have been logged to the "interfaces" array that was
already defined.

Issue: 5814
 4 years ago
Jason Ish ef48c5064f schema: add regular expression for tls date format 4 years ago
Jeff Lucovsky c1c67536b6 decode/stat: Add decode counters for unknown/arp 
Issue: 5761

This commit adds statistics for ARP and unknown ethertype packets for
diagnostic purposes.
 4 years ago
Shivani Bhardwaj 8e3acf1695 eve/schema: add udp.len_invalid 4 years ago
Jason Ish c98c49d4ba dns: parse and alert on invalid opcodes 
Accept DNS messages with an invalid opcode that are otherwise
valid. Such DNS message will create a parser event.

This is a change of behavior, previously an invalid opcode would cause
the DNS message to not be detected or parsed as DNS.

Issue: #5444
 4 years ago
Victor Julien 96dfd65b96 eve: log max regions 4 years ago
Jeff Lucovsky f8474344cd log: Add module and subsystem identifiers to log 
Issue: 2497

This changeset provides subsystem and module identifiers in the log when
the log format string contains "%S". By convention, the log format
surrounds "%S" with brackets.

The subsystem name is generally the same as the thread name. The module
name is derived from the source code module name and usually consists of
the first one or 2 segments of the name using the dash character as the
segment delimiter.
 4 years ago
Victor Julien 62a451a9ab eve/schema: bittorrent format fixup 4 years ago
Philippe Antoine 37af957d83 eve/schema: check that each array has at least one element 
Ticket: #5167
 4 years ago
Juliana Fajardini 84f9ea7254 eve/schema: pgsql - allow flexible parameters list 
Pgsql's parameters - for message types like StartupMessage and
ParameterStatus, for instance, don't have a finite, definitive set, as
per their documentation. Our json schema was allow expecting a fixed set
of parameters, though, resulting in SV tests failing if different, valid
parameters appeared.

Bug #5579
 4 years ago
Jason Ish e3e7d007b2 eve/schema: bittorrent-dht updates 
Some values that were previously strings are now parsed down into
objects.
 4 years ago
Jason Ish 0d3cfbbe3f bittorrent-dht/eve: log as bittorrent_dht 4 years ago
Jason Ish 66fc92276a eve-schema: add bittorrent-dht 4 years ago
Eric Leblond 27cdfec28a eve/schema: update following flow changes 4 years ago
Victor Julien 38fdfd8718 eve/schema: flow/stream updates 4 years ago
Victor Julien 308fe31cb5 eve/schema: add tls client logging 4 years ago
Victor Julien 036686e21c etc/schema: clang (re)format 4 years ago
Philippe Antoine b0ce55c9df flow: finish to remove obsolete counters 
As was begun in b3599507f4

Ticket: #5317
 4 years ago
Eric Leblond 2cc9152fc9 rust/smb: log uuid of interface in dcerpc 
When doing a DCERPC request, we can use the context id to log the
interface that is used. Doing that we can see in one single event
what is the DCERPC interface and opnum that are used. This allows
to have all the information needed to resolve the request to a
function call.

Feature #5413.
 4 years ago
Philippe Antoine e94920b49f smb: do not use tree id to match create request and response 
As an SMB2 async response does not have a tree id, even if
the request has it.

Per spec, MessageId should be enough to identifiy a message request
and response uniquely across all messages that are sent on the same
SMB2 Protocol transport connection.
So, the tree id is redundant anyways.

Ticket: #5508
 4 years ago
Shivani Bhardwaj 14561ffe72 eve/schema: add smtp url bool fields 4 years ago
Philippe Antoine 64b2385c64 krb: log for ticket encryption 
Also logs if the ticket encryption is weak.
It is different from the encryption used for the rest of the
packet, and this allows to detect kerberoasting attack.

Ticket: #5442
 4 years ago
Philippe Antoine 896f0d91ce quic: complete schema.json 
adding ja3 and extension fields
 4 years ago
Victor Julien 929faae6d4 eve/schema: add drop.udplen, email fields 4 years ago
Victor Julien 3617be326c eve/schema: add pcap_filename field 4 years ago
Victor Julien fc566037b4 eve/schema: add new flow fields 4 years ago
Victor Julien 2ba9da4815 eve/schema: add missing magic from files array 4 years ago
Victor Julien 2a7349406c eve/schema: add missing capture_file field 4 years ago
Victor Julien 42adaf5627 eve/schema: add missing http fields 4 years ago
Victor Julien d58f9e54d0 eve/schema: add missing alert fields 4 years ago
Victor Julien 2abce12b5b eve/schema: add missing smb fields 4 years ago
Victor Julien b24e1f1e46 eve/schema: add missing drop fields for ipv6 4 years ago
Victor Julien 6ad5d6a148 eve/schema: add profiling detect fields 4 years ago
Victor Julien 0035673208 eve/drop: log drop reason 
Ticket: #5202.
 4 years ago
Philippe Antoine 284ad462fc output: adds schema.json 
Ticket: #1369
 4 years ago
Victor Julien f037f6f4ff classification: sync and update 
Sync to latest ET open and introduce inappropriate as a classification
to replace something some find inappropriate.
 6 years ago
Jason Ish 400b26ad68 logrotate: reindent to 4 spaces 
4 spaces seems to be the norm on Linux, so reindent from a mix
of 8 spaces and tabs to 4 spaces.
 6 years ago
Jason Ish 99d9e09599 config: install classification.config (and ref) to $datadir 
Install classification.config and reference.config to $datadir,
where they can be updated on every upgrade.

This required moving them into a sub-directory for autotools
to do its thing.

Redmine issue:
https://redmine.openinfosecfoundation.org/issues/3209
 7 years ago
Jason Ish 7cc0067be0 Sample systemd unit file for Suricata. 
Create a sample systemd unit file based on the build time
configuration.

Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2138
 9 years ago
Jason Ish ddf6bce5d8 Sample logrotate configuration file. 
Create a sample logrotate configuration file with filenames
set for the configuration.
 9 years ago