suricata

Commit Graph

Author	SHA1	Message	Date
Jeff Lucovsky	dfcc8a88f6	util/proto: Convert validation routine to bool This commit changes the signature of the protocol validation code to bool and simplifies the validation steps.	6 years ago
Jeff Lucovsky	1e8d4af29a	output/json: Improve protocol output handling Improve protocol label handling by eliminating an unneeded copy. Additionally, unknown protocol values are no longer zero-padded.	6 years ago
Jeff Lucovsky	a06a706078	output/flow: Improve protocol output handling This commit improves handling of the protocol label by removing an unnecessary copy. Additionally, unknown protocol values are no longer zero-padded.	6 years ago
Jeff Lucovsky	5776a98f67	log/syslog: Improve protocol output handling Move protocol handling outside of the packet alert loop.	6 years ago
Jeff Lucovsky	0a1c36759a	log: Use updated SCProtoNameValid signature	6 years ago
Jeff Lucovsky	a843b36c97	output/lua: Remove unused proto code This commit removes unused protocol string handling logic.	6 years ago
Jason Ish	43b9bfaed4	applayer template (rust): convert to JsonBuilder	6 years ago
Jason Ish	d71fc50212	applayer template (C): convert to JsonBuilder	6 years ago
Shivani Bhardwaj	0ebeaf4fe4	modbus: align comments properly	6 years ago
Shivani Bhardwaj	d5a672fbcf	modbus: make subfunction uint16_t	6 years ago
Shivani Bhardwaj	dfd872c1a7	enip: remove unnecessarry definition	6 years ago
Shivani Bhardwaj	0dac699197	src: remove multiple uses of atoi atoi() and related functions lack a mechanism for reporting errors for invalid values. Replace them with calls to the appropriate ByteExtractString* functions. Closes redmine ticket 3053.	6 years ago
Victor Julien	a98a209732	fuzz/sigpcap: make sure hassh is enabled	6 years ago
Vadym Malakhatko	8a8212d0f6	lua: add functions to get hassh parameters	6 years ago
Vadym Malakhatko	126597144c	eve: add Hassh fields to SSH JSON logger and add ssh log condition	6 years ago
Vadym Malakhatko	216a75c522	detect: add (mpm) hassh keywords Match on Hassh using ssh.hassh, ssh.hassh.server, ssh.hassh.string, ssh.hassh.server.string keywords, e.g: alert ssh any any -> any any (msg:"match SSH hash"; ssh.hassh; content:"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; sid:1000010;) alert ssh any any -> any any (msg:"match SSH hash-server"; ssh.hassh.server; content:"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; sid:1000020;) alert ssh any any -> any any (msg:"match SSH hash-string"; ssh.hassh.string; content:"none,zlib@openssh.com,zlib"; sid:1000030;) alert ssh any any -> any any (msg:"match SSH hash-server-string"; ssh.hassh.server.string; content:"umac-64-etm@openssh.com,umac-128-etm@openssh.com,"; sid:1000040;)	6 years ago
Vadym Malakhatko	536cee3ba9	rust/ssh: add hassh generation Add generation of hassh fingerprints based on fields in the kexinit record	6 years ago
Jeff Lucovsky	f7a47a4477	detect/bsize: Use U16 bit macros This commit changes the flag bit values to be expressed using the BIT_U16 macro instead with hex values.	6 years ago
Jeff Lucovsky	39105917ce	detect/bsize: Use SCLogDebug instead of printf This commit updates debug "printf" message to use SCLogDebug	6 years ago
Jeff Lucovsky	620659b5f3	detect: Increase flag size for byte_jump	6 years ago
Jeff Lucovsky	23a65b5824	general: Fix typo in detect-bytejump.c	6 years ago
Jeff Lucovsky	0701d82890	detect/bytejump: Add "from_end" support This commit adds support for the byte jump "from_end" keyword and unittests.	6 years ago
Jeff Lucovsky	d5bb41011c	output/ikev2: Convert to JsonBuilder Convert the IKEV2 Json logging to use JsonBuilder.	6 years ago
Philippe Antoine	1e8ac7dadb	dnp3: adds unit test against previous bug	6 years ago
Philippe Antoine	d465bb8686	dnp3: fix buffer over read in responses parsing	6 years ago
Philippe Antoine	629a16e373	dnp3: probing parser fixes direction based on dnp3 header	6 years ago
Philippe Antoine	a90b1c1bcb	fuzz: disable DNP3 checksums while fuzzing	6 years ago
Philippe Antoine	00509da286	fuzz: improves fuzz target applayerparserparse Does not proceed final chunk if we got an error previously Flips the direction for last chunk as usual	6 years ago
Victor Julien	b440d0b13e	flow: use stream state to string util func	6 years ago
Victor Julien	1b0319ea98	stream: add state to string funcs	6 years ago
Victor Julien	6608b9a5f3	app-layer: set EOF flag in case of unsupported GAP If GAP is not supported set EOF flags in the parser.	6 years ago
Victor Julien	54d2f2c300	flow: improve 'under stress' behavior When under stress, the packet threads ultimately fall back to walking the hash table until they find a flow they can safely evict and reuse. This could lead to all threads fighting over the FlowBucket locks. Fix by adding a limit to the number of hash rows that are checked for a new flow. If the limit is reached, simply fail to get a flow.	6 years ago
Victor Julien	c50ef8cc21	flow: fix TCP closed default initialization TCP closed state was initialized to 0 by default. Clean up 'closed' value setting for other protocols and the common default.	6 years ago
Victor Julien	3bba671273	flow: remove unused function declaration	6 years ago
Victor Julien	cba8efff2a	flow: remove unused sctp enum member This caused some arrays to be larger than needed.	6 years ago
Victor Julien	c2561b2655	flow: cleanup validation check	6 years ago
Jeff Lucovsky	8c5c949cfa	output/tftp: Convert to JsonBuilder This commit converts the TFTP logging mechanisms to JsonBuilder.	6 years ago
Philippe Antoine	5ac8e41a13	signature: fix linked list for bidirectional signatures Bidirectional signatures are really two signatures with one id This needs to be handled with care when changing a linked list	6 years ago
Philippe Antoine	ac76ff9e47	detect: fail properly on invalid transform pcrexform	6 years ago
Antti Tönkyrä	57d0f4bb6f	detect/flowbits: fix stack overflow in analyzer Fix stack overflow in DetectFlowbitsAnalyze. Use dynamically allocated array instead of stack and free it after it is no longer needed.	6 years ago
Jason Ish	c09235e327	netflow/eve: convert to JsonBuilder	6 years ago
Jeff Lucovsky	9c47b8c1bf	general: Fix spelling error	6 years ago
Jeff Lucovsky	64912104b3	detect/content: Validate content byte array This commit checks whether the content byte array is compatible with the transforms, if any, for the rule.	6 years ago
Jeff Lucovsky	197a593078	detect: Add transform validation api This commit extends the API with a function that validates arguments against the transforms for the SM list (if any).	6 years ago
Jeff Lucovsky	0189ff998f	detect/transform: Add validation function This commit adds a function to pre-validate buffers. If a content buffer contains whitespace, the validation fails.	6 years ago
Jeff Lucovsky	a4132d8e0f	detect/transform: Add transform "validate" function This commit adds an (optional) entry for a validation function. The validation function, if present, will be used during rule processing. Its role is to determine if the arguments are compatible with the transform. E.g., a content string of "this string has whitespace" is not compatible with the `strip_whitespace` transform.	6 years ago
Jason Ish	114b7e5cd9	dhcp/eve: remove erroneous jsonbuilder close The JsonBuilder was being closed to early.	6 years ago
Jeff Lucovsky	4127c5fcc8	output/fileinfo: Optimize filename output This commit optimizes the JSON preparation of the file name by eliminating the temporary copy before adding to the Json builder buffer.	6 years ago
Jeff Lucovsky	0d298d47a1	output/rdp: Include common output options This commit will cause common metadata values and the community id to be included in log output when configured.	6 years ago
Jeff Lucovsky	ef3840e256	output/dhcp: Include common output options This commit will cause common metadata values and the community id to be included in log output when configured.	6 years ago
Jeff Lucovsky	c6c4936a20	output/smb: Include common output options This commit will cause common metadata values and the community id to be included in log output when configured.	6 years ago
Jeff Lucovsky	414bb25c93	output/tftp: Include common options This commit will cause common metadata values and the community id to be included in log output when configured.	6 years ago
Angelo Mirabella	0cdc009da1	detect/http_raw_header: Correct type mismatch This changeset fixes a bug on the computation of the buffer lenght for raw http headers. The bug is due to a mismatch on the data type of the length (uint8_t vs uint32_t) and it was causing signature misses.	6 years ago
Victor Julien	37d228dae0	rule/parse: minor action parsing cleanup	6 years ago
Victor Julien	14e1a342ac	reject: support single vlan layer Support sending RST/ICMP errors for packet with a single VLAN header.	6 years ago
Victor Julien	9f3f07dd97	reject: get MTU for reject-dev and use it	6 years ago
Victor Julien	498ae0180b	reject: minor optimization of reset entry code	6 years ago
Victor Julien	279865b145	reject: remove L3 from function names	6 years ago
Victor Julien	c594d0c1ad	reject: allow configuration of the reject interface Using the '--reject-dev <dev>' commandline option. This is a global option that applies to all 'reject' actions. If the interface specified is using ethernet, libnet will use the faster L2 (link) layer. Suricata sets up the ethernet header based on the packet. When the interface is specified, cache libnet_t ctx for (much) better performance.	6 years ago
Victor Julien	604aa65c80	reject: don't respond to tunnel packets	6 years ago
Victor Julien	a6ed9b11d5	reject: check tcp header sooner to avoid potential leak	6 years ago
Victor Julien	1b042cf108	reject: optimize and simplify run test	6 years ago
Victor Julien	66257f37eb	reject: never return error Errors by thread modules are not handled.	6 years ago
Jason Ish	b8d1677b9c	file-hash-common: fix rule_file truncation Loading file hash lists uses dirname(3) on the de_ctx->rule_file which modifies the contents, removing the last part of the path. So on subsequent calls the rule_file no longer contains the rule_file, but instead just the directory name. Mostly noticed when using "-S" with rule files outside of the default-rule-path which requires more hunting for the rule file.	6 years ago
Jeff Lucovsky	648bd5afff	output/ftp: Use "Eve" prefix with FTP helpers This commit changes the prefix of the FTP helper routines from Json to Eve.	6 years ago
Jeff Lucovsky	1f19ab1013	output/eve: Remove unused helper function This commit removes an unused helper function no longer required/used after conversion to JsonBuilder.	6 years ago
Jeff Lucovsky	03de315bc2	ftp/eve: Convert FTP logging to use JsonBuilder This commit converts the FTP logging mechanisms to use JsonBuilder.	6 years ago
Shivani Bhardwaj	a7535099b4	smb/eve: convert to jsonbuilder Closes redmine ticket 3712.	6 years ago
Jeff Lucovsky	d14a14fa13	output/anomaly: Use helpers for string output	6 years ago
Jeff Lucovsky	9097df3a3b	output/flow: Use helpers for string output	6 years ago
Jeff Lucovsky	ff92745851	output/json: Include fileinfo in alerts This commit adds fileinfo to alerts when `metadata` is configured.	6 years ago
Jeff Lucovsky	cc99f95ecd	json: macro for setting formatted false value	6 years ago
Jeff Lucovsky	ae50d1a225	output/json: Refactor file output helper This commit creates a common file output helper function based on the logic in output-file-info.c:BuildBuildFileInfoRecord The refactored helper will be used to create "fileinfo" information during the alert output path.	6 years ago
Shivani Bhardwaj	f2dbee4787	util: check if parsed data is in range	6 years ago
Shivani Bhardwaj	2162c52b17	src: remove multiple uses of atoi atoi() and related functions lack a mechanism for reporting errors for invalid values. Replace them with calls to the appropriate ByteExtractString* and StringParse* functions. Partially closes redmine ticket #3053.	6 years ago
Shivani Bhardwaj	271e33fbaa	affinity: Convert nb_threads to uint32_t	6 years ago
Shivani Bhardwaj	a516435443	napatech: make stream_id uint8_t	6 years ago
Shivani Bhardwaj	f4c9d33923	redis: Change port type to uint16_t	6 years ago
Victor Julien	79681bf655	app-layer: remove old MPMId API calls Had been deprecated and non-functional since 2017.	6 years ago
Jason Ish	74053f43cb	json: macros for setting formatted true and string values JB_SET_TRUE(jb, key), and JB_SET_STRING(string, key, val) are C macros around jb_set_formatted to set static string and true values as a (micro) optimization.	6 years ago
Philippe Antoine	e5d4332ede	signature: adds file flag for file_data keyword So that SigValidate can check if a protocol not supporting files was set after this keyword	6 years ago
Philippe Antoine	baf5f52f22	ssh/eve: convert to jsonbuilder	6 years ago
Jeff Lucovsky	a0b81b3c9d	detect: Register pcrexform This commit registers the `pcrexform` transform.	6 years ago
Jeff Lucovsky	66d15710b8	transform/pcrexform: Add pcrexform source files	6 years ago
Jeff Lucovsky	c1875d8532	detect/pcrexform: New transform: applies RE This commit adds a new transform -- pcrexform -- that applies a regular expression to the transformation buffer. If an expression was captured, that is output to the transformation buffer. Otherwise, the transformation buffer is unchanged.	6 years ago
Jeff Lucovsky	c8eca52804	detect: Add constant for new transform This commit adds the definition of the new `pcrexform` transform.	6 years ago
Jeff Lucovsky	5d10db88bc	detect/transform: Support transform options This commit adds support for transform-specific options. During Setup, transforms have the signature string available for options detection. When a transform detects an option, it should convert the option into an internal format and supply a pointer to this format as the last argument to DetectSignatureAddTransform. Transforms that support options must provide a function in their Sigmatch table entry. When the transform is freed, a pointer to the internal format of the option is passed to this function.	6 years ago
Jeff Lucovsky	b569670c33	general: Correct typos	6 years ago
Jeff Lucovsky	4407cf8979	general: Update copyright year	6 years ago
Emmanuel Thompson	be3379f00e	detect/asn1: Fix relative_offset keyword option - Fix relative_offset keyword option to be relative in regards to the last content match - Change relative_offset to int32_t with bounds check to allow the full range of the packet buffer size (uint16_t) - Added checks for over/underflows - Changed the offset type to uint16_t because the offset is applied to the payload length, which is a uint16_t - Adjusted test cases to work relative to the content match - Added test case to verify bounds	6 years ago
Eric Leblond	f5e2968f12	redis: ensure a dump per second In sync mode, Suricata was waiting to have batch size alerts before logging them. This was introducing delay in some configuration with low traffic.	6 years ago
Eric Leblond	ec8eba28a8	redis: fix reconnect in batch mode In case of redis outage, the redis session was reset but the replies were still fetch even if there is none replies in the new session.	6 years ago
Eric Leblond	025de61f43	redis: add support for unix socket If there is a '/' in the redis server string then we consider that the connection should be done other a unix socket.	6 years ago
Joshua Lumb	82fb72678f	cmdline: --list-app-layer-protos respects -c arg	6 years ago
Victor Julien	a4568a634d	htp: enforce body limits more exact	6 years ago
Victor Julien	0db3ee26d0	eve/alert: convert decoder event logging to jsonbuilder	6 years ago
Victor Julien	aa0286d925	eve/anomaly: don't add timestamp twice Timestamp is added unconditionally by CreateEveHeader(), so no need to have a local timestamp in case of non-IP packets.	6 years ago
Victor Julien	bd3fdeb53f	eve/alert: clean up decoder event logging	6 years ago
Victor Julien	b3b5802c85	eve/nfs: switch output to jsonbuilder	6 years ago
Giuseppe Longo	cb7e72e602	jsonbuilder: fix build error Clang's build in travis-ci is actually failing because of this error: output-json-alert.c:476:40: error: missing field 'state_index' initializer [-Werror,-Wmissing-field-initializers] JsonBuilderMark mark = { 0 };	6 years ago

1 2 3 4 5 ...

9522 Commits (8fe9faecb2a1584ef6e706d5ee4ee914e4fe8ef0)