aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
8,158 Commits
8 Branches
154 Tags
166 MiB
dependabot/github_actions/github/codeql-action-3.26.13
master
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '87dbda1d1e'
${ noResults }
Commit Graph

8158 Commits (87dbda1d1e24d97bf99d50aee3cf3e5460c249c0)
 

Author SHA1 Message Date
Pierre Chifflier 87dbda1d1e Add NTP event rules (commented) to the default config 7 years ago
Pierre Chifflier 79ed8c2dd3 Add event rules for NTP events 7 years ago
Pierre Chifflier 8a0549c42e NTP: change parse function to return the number of parsed messages 7 years ago
Pierre Chifflier efe11dc37e Add NTP parser (rust-experimental) 7 years ago
Pierre Chifflier 4f677fd157 Rust gen-c-headers: keep 'const' attribute 7 years ago
Pierre Chifflier 4fe9292ed8 Autotools: add switch to build experimental Rust parsers 7 years ago
Victor Julien fee0fdc595 pcap: fix linktype raw issues 
On OpenBSD 6.0 and 6.1 the following pcap gets a datalink type of
101 instead of our defined DLT_RAW.

    File type:           Wireshark/tcpdump/... - pcap
    File encapsulation:  Raw IP
    File timestamp precision:  microseconds (6)
    Packet size limit:   file hdr: 262144 bytes
    Number of packets:   23
    File size:           11 kB
    Data size:           11 kB
    Capture duration:    7,424945 seconds
    First packet time:   2017-05-25 21:59:31,957953
    Last packet time:    2017-05-25 21:59:39,382898
    Data byte rate:      1536 bytes/s
    Data bit rate:       12 kbps
    Average packet size: 496,00 bytes
    Average packet rate: 3 packets/s
    SHA1:                120cff9878b93ac74b68fb9216027bef3b3c018f
    RIPEMD160:           35fa287bf30d8be8b8654abfe26e8d3883262e8e
    MD5:                 13fe4bc50fe09bdd38f07739bd1ff0f0
    Strict time order:   True
    Number of interfaces in file: 1
    Interface #0 info:
                         Encapsulation = Raw IP (7/101 - rawip)
                         Capture length = 262144
                         Time precision = microseconds (6)
                         Time ticks per second = 1000000
                         Number of stat entries = 0
                         Number of packets = 23

On Linux it is 12.

On the tcpdump/libpcap site the DLT_RAW is defined as 101:
http://www.tcpdump.org/linktypes.html

Strangely, on OpenBSD the DLT_RAW macro is defined as 14 as expected.
So for some reason, libpcap on OpenBSD uses 101 which seems to match
the tcpdump/libpcap documentation.

So this patch adds support for datalink 101 as RAW.
 7 years ago
Victor Julien 885b8cefec detect: fix crash when stream inspect runs on UDP 
Certain rules can apply to both TCP and UDP. For example 'alert dns'
rules are inspected against both TCP and UDP. This lead to the
stream inspect engine being called on a UDP packet.

This patch fixes the issue by exiting early from the stream inspect
engine if a) proto is not TCP or b) ssn is not available

Bug #2158.
 7 years ago
Victor Julien 6226338d5b eve/alert: redo option parsing 
Clean up option parsing. Allow options to be disabled as well as
enabled.

E.g.
    metadata: true
    flow: false

The metadata setting will enable all. Then flow is disabled.
 7 years ago
Eric Leblond 9e581436a7 doc: info about new config for alert events in EVE 7 years ago
Eric Leblond 66da9d0ba6 output-json-alert: rename applayer to metadata 7 years ago
Eric Leblond ef88689f1e doc: add app_proto to alert event 7 years ago
Eric Leblond da9005c404 output-json-alert: add app_proto or flow to events 
This patch adds a partial flow entry in the alert event
(if applayer or flow is selected) or simply app_proto if
it is not.

app_proto is useful as filter and aggregation field. And
the partial flow entry contains more information about the
proto as well as some volumetry info.
 7 years ago
Jason Ish 61d9f4bb0a rust: make distcheck fixes 7 years ago
Jason Ish f5a90e26a9 rust: for sclog*, strip nul bytes before logging 7 years ago
Jason Ish 717b826d25 rust: safe string handling in logging 
In logging (SCLog*), safely convert strings to cstrings instead
of blindly unwrapping them.

Also implement a simple rust logger if the Suricata C context
is not available.
 7 years ago
Jason Ish 1ebad6bd71 rust/dns: cargo unit test prototype 
Do remove compiler warning when building without unit tests.
 7 years ago
Jason Ish 14951e3f00 rust: save cargo and CARGO_HOME to variables 
During configure, substitute the path of cargo, as well as the
value of CARGO_HOME as variables. This fixes the case where a
user might do:
  make
  sudo make install
Which will cause the cargo bits to be rebuilt, including
re-downloading external crates.

By saving these to variables we can be sure that the same
values are used during make install as were used during
make which prevents the Rust artifacts from being rebuild
during "sudo make install".
 7 years ago
Eric Leblond 4be031394b output-json-alert: fallback to payload if stream is void 
If stream logging results in no data then we fallback to payload
data to get somethingi that could be interesting  instead of
nothing.
 7 years ago
Eric Leblond c3806ebd2a suricata.yaml: add some port variables 
These variables are used by Talos ruleset and defining them allow
to get almost all rules of ruleset loaded.
 7 years ago
Eric Leblond eb70b1e195 detect-asn1: fix memory leak 7 years ago
Eric Leblond 170591a0b1 util-print: add 0 at end of buffer 
Add a 0 at the end of the printed buffer to be sure we terminate
with a 0 to avoid problem when calling strlen().
 7 years ago
Victor Julien d61fa0c43c tunnel: refactor tunnel verdict handling 
Observed:

STARTTLS creates 2 pseudo packets which are tied to a real packet.
TPR (tunnel packet ref) counter increased to 2.

Pseudo 1: goes through 'verdict', increments 'ready to verdict' to 1.
Packet pool return code frees this packet and decrements TPR in root
to 1. RTV counter not changed. So both are now 1.

Pseudo 2: verdict code sees RTV == TPR, so verdict is set based on
pseudo packet. This is too soon. Packet pool return code frees this
packet and decrements TPR in root to 0.

Real packet: TRP is 0 so set verdict on this packet. As verdict was
already set, NFQ reports an issue.

The decrementing of TPR doesn't seem to make sense as RTV is not
updated.

Solution:

This patch refactors the ref count and verdict count logic. The beef
is now handled in the generic function TmqhOutputPacketpool(). NFQ
and IPFW call a utility function VerdictTunnelPacket to see if they
need to verdict a packet.

Remove some unused macro's for managing these counters.
 7 years ago
Victor Julien 7c119cc595 nfs: log number of chunks that xfer'd a file 7 years ago
Victor Julien ed706583e9 nfs: add nfs to alerts 
Also add a single 'applayer' option for alert augmentation that
applies to all app-layers.
 7 years ago
Victor Julien e8dae2e093 nfs: add to fileinfo events 7 years ago
Victor Julien db2d928151 rust/nfs: add (file)handle to log as crc32 7 years ago
Jason Ish 671e39642c travis: set dist to trusty (Ubuntu 14.04). 
The default is still 12.04 which is EOL.
 7 years ago
Jason Ish 829155b9d5 rust/dns: pass byte arrays directly to rust/json 
Using the json.set_string_from_bytes which will
safely convert the bytes printable ascii string
before logging.
 7 years ago
Jason Ish 96cc503026 rust/lua: use lua_pushlstring for strings 
Lua strings can contain NULLs, and Rust strings are UTF8 which
can also contain NULLs. Use pushlstring so a NULL containing
string can be pushed.
 7 years ago
Jason Ish 6dbc5be4be rust/json: only output printable characters 
Rust strings are UTF8 and we cannot yet rely on jansson
having json_stringn on all supported OS distributions yet
so sanitize strings to ascii before printing.

Also add set_string_from_bytes which is like set_string, but
accepts a byte array as input.
 7 years ago
Victor Julien becf1a2dfe rust/nfs: fix style warning 7 years ago
Victor Julien e0c6565e68 nfs: nfs_version keyword 
Store nfs version in tx and add keyword to match on it.
 7 years ago
Victor Julien aff576b524 eve/nfs: log nfs version 7 years ago
Victor Julien 0d79181d78 nfs: rename nfs3 to nfs 
Since the parser now also does nfs2, the name nfs3 became confusing.
As it's still in beta, we can rename so this patch renames all 'nfs3'
logic to simply 'nfs'.
 7 years ago
Victor Julien 28cdf7b628 nfs3: create file tx for read on request 
This is done so that we can add creds to it.
 7 years ago
Victor Julien 7e0d9619ac nfs3: add readdirplus path 7 years ago
Victor Julien 41376da03c nfs: log more rpc 7 years ago
Victor Julien 9edbb6f235 nfs: split record parsers into different files 7 years ago
Victor Julien 25edac7666 nfs3: fill bytes corner case 7 years ago
Victor Julien 2a29f79960 nfs: fix rust data type declaration 7 years ago
Victor Julien 5153271b87 nfs2: basic record parsing and tracking 7 years ago
Victor Julien c7e10c73f9 nfs3: support NFS over UDP 7 years ago
Victor Julien d9f87cec3d nfs3: probing parsers in both directions 7 years ago
Victor Julien 8fe32f943b nfs3: search for next record if needed after GAP 7 years ago
Victor Julien 58af39131f rust/nfs: handle GAPs 
In normal records it will try to continue parsing.

GAP 'data' will be passed to file api as '0's. New call is used
so that the file API does know it is dealing with a GAP. Such
files are flagged as truncated at the end of the file and no
checksums are calculated.
 7 years ago
Victor Julien a116c16019 nfs3: parse mkdir and rmdir request records 7 years ago
Victor Julien 1a2985ed76 app-layer: remove checks 
Now that app-layer parser registrations are validated at startup,
a number of runtime checks are no longer necessary. So remove them.
 7 years ago
Victor Julien e930513125 app-layer: detect state registrations are mandatory 7 years ago
Victor Julien ed172985ca app-layer: validate registration 7 years ago