aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
19,118 Commits
8 Branches
173 Tags
211 MiB
main-8.0.x
main
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '823322cb1c'
${ noResults }
Commit Graph

19118 Commits (823322cb1c71d90529eb5af3f8da369c7dc69684)
 

Author SHA1 Message Date
Philippe Antoine aea7ee21b8 nfs: bound namemap by using lru 
Ticket: 8418
 4 months ago
Philippe Antoine a50f494ef6 nfs: bound requestmap and use lru 
Ticket: 8418
 4 months ago
Victor Julien 367ca7f430 detect/tx: minor debug additions and fixes 4 months ago
Victor Julien b29226c7ea firewall/analyzer: include all hooks 
For protocols using default 0-1 states, add support.

For others, print 'unknown' if no name is yet supported.

Ticket: #8514.
 4 months ago
Victor Julien f7c44c4c23 detect/analyzer: log actual policy for app firewall 4 months ago
Victor Julien 7134592fea detect/firewall: configurable default policies 
Allow configurable policies, including accept. For app-layer this
requires looping all available hooks to apply the policies.

Support configurable policies for packet-filter, pre-stream, pre-flow.

If there are no rules there is also no rule group (sgh). Make sure
the app hooks policies are correctly handled in this case by allowing
a NULL sgh to be handled as well.

For tx rule match actually apply drop directly. Previously this was
always handled by the default drop:flow policy.

Ticket: #7701.
 4 months ago
Victor Julien eaacb41aaf firewall: accept:flow no longer implies pass:flow 
Previously a `accept:flow` action would act as both a firewall "accept" and
a threat detection "pass" for the rest of the flow.

This patch changes that. The `accept:flow` action now only accepts the
rest of the packets for the firewall ruleset, but does still continue
threat detection rule evaluation.

Ticket: #8444.
 4 months ago
Victor Julien 0093bd6123 detect/firewall: rename flow control variable 
For improved readability.
 4 months ago
Victor Julien e76728a536 firewall: support multi-action statements in rules 
For firewall rules, allow multiple actions to be specified in a list

        accept:flow,pass:flow,alert
        accept:flow,alert
        accept:flow,pass:flow

It is mandatory to make the first action the primary firewall policy
action: accept, drop, reject.

Ticket: #8480.
 4 months ago
Victor Julien b7a625d368 detect: suppress noisy debug messages 
Fixes: 232276ac19 ("detect: ethernet/arp matching")
 4 months ago
Victor Julien b695100491 detect/firewall: apply default policy in no rules case 
When there are no rules after prefilter the default policy needs to be invoked.
 4 months ago
Victor Julien 33b3793372 firewall: limit action scope packet for app-hooks 
For non-UDP (so TCP), don't allow `accept:packet` or `drop:packet` as
this makes the evaluation of other rule hooks unpredictable.

Ticket: #8497.
 4 months ago
Victor Julien d561f6184a detect/firewall: add single call for applying app default policy 4 months ago
Victor Julien 171b14786b detect: clean up firewall rule match handling 4 months ago
Victor Julien b922142865 detect: clean up of last_tx check 4 months ago
Victor Julien 4fd5bbed35 detect: minor code cleanup 4 months ago
Victor Julien 900ae89ed8 firewall: fix hooks getting skipped in some rulesets 
If a ruleset would use `dns:request_complete` but not have a rule for
`dns:request_started`, the `request_started` hook default policy would
not get invoked.

Add a check to make sure it is invoked.

Ticket: #8495.
 4 months ago
Victor Julien 6d3599e1c2 detect/firewall: clean up flow control 
Use an enum for the firewall related flow control, to improve
readability of the firewall inspection logic.
 4 months ago
Victor Julien c33c8674d4 reject/respond: use dst livedev for rejectdst 
Update ctx caching to take direction into account.
 4 months ago
Victor Julien 564b2d47bb packet: track outgoing livedev id 4 months ago
Victor Julien a6ec0e617b af-packet: shrink AFPPeer struct by better layout 4 months ago
Victor Julien 32afba47dd packet: store livedev by id 4 months ago
Victor Julien 293662fc2e flow: store livedev by id 
In prep for storing both directions for IPS.
 4 months ago
Victor Julien 10367750f1 device: add get id func 
Most code uses an opague type for LiveDevice, so add an id getter.
 4 months ago
Victor Julien 4a7ded0eea device: start id space at 1 
So a value of 0 means no device.
 4 months ago
Victor Julien a7ee12c921 device: add O(1) lookup by id 4 months ago
Victor Julien 943fa5f453 respond/reject: use livedev in bridge mode 
Clean up host mode tracking, which is used by reject to control how
rejects are sent. Before this patch there were 2 modes: sniffer only
and router. This patch introduces a bridge mode that is automatically
set by the bridge modes. In bridge mode the `Packet::livedev` is used.

Ticket: #8390.
 4 months ago
Juliana Fajardini 3c46e36930 detect/tcp: opt-in tcp.flags for firewall mode 
The firewall enabling flag for tcp.flags was being overwritten by
another line of code.

Related to
Ticket #8387
 4 months ago
Juliana Fajardini d442c3544c detect: opt-in keywords for firewall mode 
- tls.cert_chain_len
- datarep
- dataset
- dns.opcode

Part of
Ticket #8387
 4 months ago
Lukas Sismis 7b0afb3bbd github-ci: add FreeBSD build test 
Expand the Github-CI build coverage by adding another OS that
Suricata targets.

Ticket: 8487
 4 months ago
Urval Kheni 121d736560 decode/tcp: avoid unaligned 16-bit option reads 
Use a byte-wise helper for 16-bit TCP option parsing instead of
casting option data to uint16_t *.

Ticket: 8543
 4 months ago
Philippe Antoine cb62d6d73d frames: do not free on log+flush packet 
As we expect a second log+flush packet in the other direction

Ticket: 8336
 4 months ago
Philippe Antoine cefd134461 stream: log flush packets in the other order 
Ticket: 8336

At the end of a TLS handshake, in IDS mode, the client acks,
and we parse the server hello and use tls.encryption-handling
to know what to do next (for example bypass)

Everything is parsed, but we have not run detection yet on neither
side.

So, in IDS mode, we need to first flush the client side, as the
comment on the function already stated.
 4 months ago
Philippe Antoine 1ba411458c detect: do not wait for more in log_flush 
Ticket: 8336

When a packet has flag PKT_PSEUDO_DETECTLOG_FLUSH, we do not
expect to rerun detection on the same tx and direction again

So, do not set mpm_in_progress whose purpose is to not store
the state as we will run again.

Allows transactional bidirectional signatures to work on
thse log+flush pair of packets
 4 months ago
Sergey Pinaev bb4e79c4f7 reputation: deduplicate skipping empty lines/comments 4 months ago
Sergey Pinaev 2e22ba65e7 reputation: remove unused code 
Remove useless while() that led to buffer underflow

Ticket: #8500
 4 months ago
Jason Ish 029fd1be59 eve: add rule generation source to alert record 
When an alert is generated from firewall context, add an engine value of
"fw", otherwise "td" (for threat detect).

The engine field is only added when firewall mode is enabled.

Ticket: #8456
 4 months ago
Philippe Antoine f0e246de34 detect/mqtt: reason_code keyword is now a multi-integer 
Ticket: 7929

Builds a vector of the reason code in a tx to do so,
except if we use the default "any", where we do not append
to the vector, but just run detection while iterating
 4 months ago
Juliana Fajardini 376eddbe98 security: minor formatting and re-structuring 
For readability.
 4 months ago
Philippe Antoine 68c9b63831 doc: security policy 
Update security levels to triage less reports as critical.
Improve instructions on how to report issues.
 4 months ago
Philippe Antoine 614c48d3c3 ikev2: remove unused field 
Ticket: 8415
 4 months ago
Victor Julien 2f9573f84c doc: address config conversion note 
Message is:
```
Converting `source_suffix = '.rst'` to `source_suffix = {'.rst': 'restructuredtext'}`.
```
 4 months ago
alinse-pltzr c48bb1b26c ftp: add rule for too many transactions 
Issue: 8489
 4 months ago
alinse-pltzr 86fe20dd48 conf: add comment for ftp.max-tx 
Add missing FTP configuration value to suricata.yaml.in showing the
default value.

Issue: 8489
 4 months ago
Jeff Lucovsky 5ddd808e9b ftp: don't halt the flow when raising too_many_transactions 
The first version of the event set done=true on state->curr_tx and
returned NULL when the limit hit. curr_tx is usually the active
command just received — marking it done mid-request throws off
response matching, and subsequent commands in the flow stop getting
logged.

SMB behavior is mirrored here:
Walk the tx list, find the oldest tx that isn't done, mark
it done and tag it with the event, then fall through and
create the new tx so the flow parsing continues. One stale tx gets
reaped per overflow so memory stays bounded.

Issue: 8489
 4 months ago
Jeff Lucovsky 9ea2e29581 ftp: raise too_many_transactions event on overflow 
Other parsers (SMB, POP3, ENIP) already raise a too_many_transactions
event when a flow exceeds its per-flow transaction limit. FTP had
the limit wired up through app-layer.protocols.ftp.max-tx but just
dropped the excess transaction on the floor with a "FTP does not set
events yet..." TODO, so no event was raised when the limit was
reached.

Add the FtpEventTooManyTransactions variant, a stock rule at
sid 2232002, and raise the event from FTPTransactionCreate when the
live-tx count goes past ftp_config_maxtx.

Issue: 8489
 4 months ago
Jason Ish aa4946547b github-ci: check formatting and clippy on example rust plugin 4 months ago
Jason Ish 5e2a33d080 examples: add flow callbacks to rust plugin example 
Ticket: #8446
 4 months ago
Jason Ish 91b9dda0bf doc: document flow life cycle callback API 
Document for C and Rust, as the C documentation was missing.

Ticket: #8446
 4 months ago
Jason Ish cb69fa4e53 rust/ffi: add flow lifecycle callback wrappers 
Provide Rust friendly callback registrations for flow init, update and finish events. These
callbacks are implemented as Rust closures.

Ticket: #8446
 4 months ago