aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
19,307 Commits
8 Branches
174 Tags
252 MiB
main
main-8.0.x
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.7
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '7ebc699df0'
${ noResults }
Commit Graph

74 Commits (7ebc699df09cb3ab1d8c18e7c51f14314a55f5d6)

Author SHA1 Message Date
Philippe Antoine 6bb271cee9 conf: uses SCConfGetNonNull 
Ticke: 8651

Uses it in place when we dereferenced the value straight away
after checking SCConfGet result but not its value
 5 months ago
Philippe Antoine 54cc752cf9 ssh: hassh can be truly disabled 
Rules will not re-enable it

Ticket: 8223
 9 months ago
Philippe Antoine 458211dcf2 detect/ssh: move ssh.proto to rust 9 months ago
Philippe Antoine ea8ac2a02a detect/ssh: move ssh.software to rust 
Adds helper function SCDetectHelperBufferProgressMpmRegister on the way
 9 months ago
Philippe Antoine 89b6ab6730 rust: rename EncryptionHandling 
as it is no longer specific to SSH
 10 months ago
Victor Julien 948d9a805c unittests: clean up memory for ssh tests 
Flow requires IP proto to be set for flow cleanup to work.
 1 year ago
Philippe Antoine b29d46d81f rust: bindgen SCAppLayerParserStateIssetFlag 
Ticket: 7667
 1 year ago
Philippe Antoine 7bb0c94ae9 rust: bindgen app-layer-detect-proto.h 
Ticket: 7667
 1 year ago
Lukas Sismis 5e8c775d77 ssh: add option to select behavior of encrypted parts 
Ticket: 6788
 2 years ago
Jason Ish 22b77b0c56 conf: prefix conf API with SC 2 years ago
Jason Ish 9c87ac1b9b ssh: cleanup rust visibility and naming 
Remove pub and no_mangle from non-exported functions and rename to
Rust as-needed.

Ticket: 7498
 2 years ago
Jeff Lucovsky 310dcd1dc4 general: Use bool instead of int for condition fns 
This commit changes the conditional logging functions to use bool rather
than int values.
 3 years ago
Victor Julien e250ef6402 debug: remove empty header 4 years ago
Philippe Antoine 02f2602dde src: rework includes as per cppclean 4 years ago
Jason Ish adda8801d8 conf: remove ConfGetValue 
All uses of ConfGetValue are satisfied by ConfGet
 4 years ago
Jeff Lucovsky 1eeb96696b general: Cleanup bool usage 6 years ago
Vadym Malakhatko 126597144c eve: add Hassh fields to SSH JSON logger and add ssh log condition 6 years ago
Vadym Malakhatko 536cee3ba9 rust/ssh: add hassh generation 
Add generation of hassh fingerprints based on fields in the kexinit record
 6 years ago
Philippe Antoine 69b4fffdae parse: move SSH parser from C to Rust 7 years ago
Victor Julien 44d3f264bf app-layer: update API to return more details 
Add AppLayerResult struct as the Parser return type in
preparation of allowing returning 'Incomplete(size)' similar
to what nom in Rust allows.
 7 years ago
Victor Julien 3bcf948a75 app-layer: change return codes 
This patch simplifies the return codes app-layer parsers use,
in preparation of a patch set for overhauling the return type.

Introduce two macros:

APP_LAYER_OK (value 0)
APP_LAYER_ERROR (value -1)

Update all parsers to use this.
 7 years ago
Victor Julien 579cc9f02b const: constify decoder, app-layer, detect funcs 7 years ago
Victor Julien 3526569b25 ssh: test cleanup 
Remove explicit locks. Set ALPROTO_SSH in all tests.
 8 years ago
Victor Julien 76cc03010a ssh: fix banner overflow issue 
Reported-by: Sirko Höer - Code Intelligence
 8 years ago
Philippe Antoine ff52bb14b7 ssh : code style consistency 
Adds SSH_FLAG_VERSION_PARSED to flags before each return
This way, we are sure SSHParseBanner does not get called again
And proto_version does not get leaked
 8 years ago
Victor Julien 9ba89a31ef ssh: fix out of bounds read in banner parsing 
Reported-by: Henning Perl
 8 years ago
Victor Julien 7bc3c3ac6e app-layer: pass STREAM_* flags to parser 
Pass the STREAM_* flags to the app-layer parser functions so that
the parser can know more about how it is called.
 8 years ago
Victor Julien 7548944b49 app-layer: remove unused HasTxDetectState call 
Also remove the now useless 'state' argument from the SetTxDetectState
calls. For those app-layer parsers that use a state == tx approach,
the state pointer is passed as tx.

Update app-layer parsers to remove the unused call and update the
modified call.
 9 years ago
Victor Julien 1bed6e9cae ssh: implement DetectFlags API 9 years ago
Victor Julien bca0cd71ae app-layer: use logger bits to avoid looping 
Avoid looping in transaction output.

Update app-layer API to store the bits in one step
and retrieve the bits in a single step as well.

Update users of the API.
 9 years ago
Eric Leblond 2979a0a2e1 app-layer-ssh: trigger bypass when done 
Trigger bypass when application layer will not inspect anymore.
 9 years ago
Victor Julien ab1200fbd7 compiler: more strict compiler warnings 
Set flags by default:

    -Wmissing-prototypes
    -Wmissing-declarations
    -Wstrict-prototypes
    -Wwrite-strings
    -Wcast-align
    -Wbad-function-cast
    -Wformat-security
    -Wno-format-nonliteral
    -Wmissing-format-attribute
    -funsigned-char

Fix minor compiler warnings for these new flags on gcc and clang.
 10 years ago
Victor Julien a0fad6bb7f mpm: run engines as few times as possible 
In various scenarios buffers would be checked my MPM more than
once. This was because the buffers would be inspected for a
certain progress value or higher.

For example, for each packet in a file upload, the engine would
not just rerun the 'http client body' MPM on the new data, it
would also rerun the method, uri, headers, cookie, etc MPMs.

This was obviously inefficent, so this patch changes the logic.

The patch only runs the MPM engines when the progress is exactly
the intended progress. If the progress is beyond the desired
value, it is run once. A tracker is added to the app layer API,
where the completed MPMs are tracked.

Implemented for HTTP, TLS and SSH.
 10 years ago
Victor Julien a744d00f45 ssh: fix banner state setting 10 years ago
Victor Julien 3ee4989ba7 ssh: convert app-layer parser to be tx aware 
Like with SSL, there is only a single 'tx'.
 10 years ago
Giuseppe Longo 675fa56497 app-layer: add ThreadVars to AppLayerParserParse 
To be able to add a transaction counter we will need a ThreadVars
in the AppLayerParserParse function.
This function is massively used in unittests
and this result in an long commit.
 10 years ago
Victor Julien 48b3cb0492 unittests: fix tests 10 years ago
Victor Julien 6530c3d0d8 unittests: replace SCMutex* calls by FLOWLOCK_* 10 years ago
Victor Julien 48771c1acf debug: fix compiler warnings 11 years ago
Jason Ish 796dd5223b tests: no longer necessary to provide successful return code 
1 pass, 0 is fail.
 11 years ago
Victor Julien 5f39728509 ssh: fix string handling in unittest 11 years ago
Victor Julien f4f53924bb app-layer: fix coverity warnings 12 years ago
Victor Julien 4e7cb7b863 app-layer: update all protocols to accept NULL+EOF 
Update all non-HTTP protocol parsers to accept a NULL+EOF input.
 12 years ago
Victor Julien 04afcf2717 ssh: convert error message to debug statement 
Don't print errors based on traffic issues.
 12 years ago
Eric Leblond 0f61264d68 app-layer-ssh: fix banner parser 
Carefully crafted SSH banner could result in parser error.

Signed-off-by: Eric Leblond <eric@regit.org>
 12 years ago
Ken Steele 8f1d75039a Enforce function coding standard 
Functions should be defined as:

int foo(void)
{
}

Rather than:
int food(void) {
}

All functions where changed by a script to match this standard.
 12 years ago
Victor Julien f6bb867df8 ssh: fix scan-build warnings 
app-layer-ssh.c:165:5: warning: Value stored to 'input_len' is never read
    input_len -= 1;
    ^            ~
1 warning generated.

app-layer-ssh.c:160:5: warning: Value stored to 'input_len' is never read
    input_len -= 4;
    ^            ~
1 warning generated.
 13 years ago
Victor Julien 0967f0777c ssh: improve banner checking 
Don't use input_len as banner length. Instead, look for banner end
to calculate banner length.

Add test for banner buffering corner case.
 13 years ago
Victor Julien 669b351dad ssh: fixes for minor scan-build warnings 
/usr/share/clang/scan-build/ccc-analyzer -DHAVE_CONFIG_H -I. -I..   -I./../libhtp/  -I/usr/include/nspr   -I/usr/include/nss -I/usr/include/nspr   -DLOCAL_STATE_DIR=\"/usr/local/var\" -g -O2 -Wall -Wno-unused-parameter -std=gnu99 -DHAVE_LIBNET11 -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -DHAVE_LIBNET_ICMPV6_UNREACH  -I/usr/include -DLIBPCAP_VERSION_MAJOR=1 -DHAVE_PCAP_SET_BUFF -DHAVE_LIBCAP_NG -DREVISION="51e0dee" -MT app-layer-ssh.o -MD -MP -MF .deps/app-layer-ssh.Tpo -c -o app-layer-ssh.o app-layer-ssh.c
app-layer-ssh.c:164:5: warning: Value stored to 'input' is never read
    input += 1;
    ^        ~
app-layer-ssh.c:165:5: warning: Value stored to 'input_len' is never read
    input_len -= 1;
    ^            ~
app-layer-ssh.c:212:13: warning: Value stored to 'ret' is never read
            ret = 0;
            ^     ~
3 warnings generated.
 13 years ago
Victor Julien 65b228ccfd ssh: improve large and fragmented banner handling 
Including tests.
 13 years ago