aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
14,231 Commits
8 Branches
173 Tags
258 MiB
main
main-7.0.x
main-8.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '901e99fa95'
${ noResults }
Commit Graph

84 Commits (901e99fa951c9735b4d5b256f7a2d47727177226)

Author SHA1 Message Date
Victor Julien b31ffde6f4 output: remove error codes from output 4 years ago
Philippe Antoine 1f066cbbe8 unittest: fix unneeded includes as per cppclean 
Especially because there is conditional inclusion from a header
 4 years ago
Victor Julien 39cf5b151a src: includes cleanup 
Work towards making `suricata-common.h` only introduce system headers
and other things that are independent of complex internal Suricata
data structures.

Update files to compile after this.

Remove special DPDK handling for strlcpy and strlcat, as this caused
many compilation failures w/o including DPDK headers for all files.

Remove packet macros from decode.h and move them into their own file,
turn them into functions and rename them to match our function naming
policy.
 4 years ago
Juliana Fajardini f897761ecb detect/alert: add unittests to check packet action 
Add unittests to check that packet flags are correctly updated after
detection finds drop or reject rules that match.

Related to
Bug #5458
 4 years ago
Eric Leblond 01bf0ad43d luajit: fix unittests build 
When building with the following options:

 ./configure CC=clang --enable-luajit --enable-geoip --enable-unittests

There is a build failure:

runmode-unittests.c:234:9: error: implicit declaration of function 'LuajitSetupStatesPool' is invalid in C99 [-Werror,-Wimplicit-function-declaration]
    if (LuajitSetupStatesPool() != 0) {
 4 years ago
Philippe Antoine 02f2602dde src: rework includes as per cppclean 4 years ago
Shivani Bhardwaj 9131d1d857 base64: add Base64Mode enum 4 years ago
Sascha Steinbiss 5ec6f3ba51 util: add unit tests for CIDRFromMask() 4 years ago
Jeff Lucovsky 3bd1d258a9 detect/tests: Register protoname tests 
Issue: 5072

This commit registers the proto-name unit tests.
 4 years ago
Victor Julien e04d378e58 util/cidr: simplify IPv4 CIDR handling; add IPv6 
Instead of building a table at init just calculate it on demand.

Callsites are all during init, so its not performance critical.

Add similar function for IPv6.
 5 years ago
Modupe Falodun 26c9e66586 detect-engine-enip: remove unittests 
These test is reimplemented in Suricata-Verify

Task: 4911
 5 years ago
Jeff Lucovsky 6e149cdec3 unittests/enip: Register ENIP unittests 5 years ago
Shivani Bhardwaj 581cb6223d dcerpc/udp: Add rust registration function 
Get rid of the C glue code and move registration completely to Rust.
 5 years ago
Shivani Bhardwaj bac69af7e4 dcerpc: Add rust registration function 
Get rid of the C glue code and move registration completely to Rust.
 5 years ago
Jeff Lucovsky e77e8dbe18 proto: Remove dependency on /etc/protocols 
This commit eliminates the dependency on /etc/protocols and equivalent
on other platforms by using a static table of IANA assigned protocol
values (names, description).
 5 years ago
Simon Dugas 8342641477 modbus: move tests from c to rust 
Move tests in a seperate commit so that we can use the previous one for
regression testing. This also gets rid of the temporary glue that made
the C tests work with the rust implementation.
 5 years ago
Jeff Lucovsky 596d760833 tests/vntag: VNTAG decoder unittests 5 years ago
Emmanuel Thompson f12daa710f decode/flow/esp: Add ESP decoder & flow 
- Adds an ESP (Encapsulating Security Payload) header decoder
- Tracks ESP flows via the SPI field
 6 years ago
Jason Ish 7525295e63 hashing: remove remaining HAVE_NSS guards 
For features, we pretend to HAVE_NSS so scripts, external tests
continue to work.
 6 years ago
Carl Smith 660b68a083 nsh: Parsing of Network Services Header and payload 
Support for EtherType 0x894F and basic header
 6 years ago
Ali Jad Khalil 5d955c1836 decode/geneve: Add Geneve decoding functionality 
These changes are in response to feature request 3063. Geneve is
very similar to VXLAN, but uses a slightly different encapsulation
scheme.
 6 years ago
Jason Ish 900f1522b4 plugins: config.h: move into src and rename to autoconf.h 
While fixing files that include config.h, just remove the
include if possible.
 6 years ago
Sascha Steinbiss 4e1a41a17d output-json: add MAC address output 
This commit adds MAC address output to the EVE-JSON format. We follow the
remarks made in Redmine ticket #962: for packets, log MAC src/dst as a
scalar field in EVE; for flows, log MAC src/dst as lists in EVE. Field names
are different between flow and packet context to avoid type confusion
(src_mac vs. src_macs). Configuration approach and JSON representation is
taken from previous GitHub PR #2700.
 6 years ago
Shivani Bhardwaj 6f7d8e50c8 src: use FatalError whenever possible 
Replaces all patterns of SCLogError() followed by exit() with
FatalError(). Cocci script to do this:

@@
constant C;
constant char[] msg;
@@

- SCLogError(C,
+ FatalError(SC_ERR_FATAL,
  msg);
- exit(EXIT_FAILURE);

Closes redmine ticket 3188.
 6 years ago
Emmanuel Thompson 275f6ae96f detect/asn1: Remove asn1 C parser 
- In favor of rust parser
 6 years ago
Victor Julien 48bb26abe7 util/mem: remove old debug code for counting allocs 6 years ago
Victor Julien 328a94206e decode/hdlc: initial support 6 years ago
Victor Julien 82de6e0659 decoder/vxlan: improvements and cleanups 
Implement port config handling. Also check both src port and dest
port for tunnels that only set the destination port to the VXLAN
port. At the point of the check we don't know the packet direction
yet.

Implement as Suricata tunnel similar to Teredo.

Cleanups.
 7 years ago
Henrik Lund Kramshoej 3519b011b7 decoder/vxlan: initial implementation of decoder 7 years ago
Victor Julien f30c05e684 smb: remove C implementation 
Now that Rust is mandatory it is obsolete.

Ticket: #2849
 7 years ago
Victor Julien ccdafe6697 detect/http-server-body: move tests to tests/ 8 years ago
Victor Julien 64987f36fb detect/file-data: move tests into tests/ 8 years ago
Victor Julien 9a8092249e detect/http-client-body: move tests into tests/ 8 years ago
Victor Julien 76fd666cad detect/http_raw_header: move tests into tests/ 8 years ago
Victor Julien ab027cb481 detect/http_cookie: move tests into tests/ 8 years ago
Victor Julien 2f342da048 detect/http_stat_code: move tests into tests/ 8 years ago
Victor Julien 5dfba01b2e detect/http_stat_msg: move tests to tests/ 8 years ago
Victor Julien b469938998 detect/http_raw_host: move raw into regular host logic 8 years ago
Victor Julien dc43f35427 detect/http_host: move tests into tests/ 8 years ago
Victor Julien cb332b4cda detect/http_method: move all tests into tests/ 8 years ago
Victor Julien 0a405e27a0 detect/http_raw_uri: code reorganization 
Move registration into http_uri logic, move tests into the other uri
tests. Switch to v2 mpm/inspect APIs.
 8 years ago
Victor Julien 10e2731f18 detect/http-uri: move tests into tests/ 8 years ago
Victor Julien 3111910fc6 detect/http_user_agent: move tests into tests/ 8 years ago
Victor Julien 1360e030b1 storage: don't leak memory for unittests 8 years ago
Jacob Masen-Smith ec77632e84 Adds WinDivert support to Windows builds 
Enables IPS functionality on Windows using the open-source
(LGPLv3/GPLv2) WinDivert driver and API.

From https://www.reqrypt.org/windivert-doc.html : "WinDivert is a
user-mode capture/sniffing/modification/blocking/re-injection package
for Windows Vista, Windows Server 2008, Windows 7, and Windows 8.
WinDivert can be used to implement user-mode packet filters, packet
sniffers, firewalls, NAT, VPNs, tunneling applications, etc., without
the need to write kernel-mode code."

- adds `--windivert [filter string]` and `--windivert-forward [filter
    string]` command-line options to enable WinDivert IPS mode.
    `--windivert[-forward] true` will open a filter for all traffic. See
    https://www.reqrypt.org/windivert-doc.html#filter_language for more
    information.

Limitation: currently limited to `autofp` runmode.

Additionally:
- `tmm_modules` now zeroed during `RegisterAllModules`
- fixed Windows Vista+ `inet_ntop` call in `PrintInet`
- fixed `GetRandom` bug (nonexistent keys) on fresh Windows installs
- fixed `RandomGetClock` building on Windows builds
- Added WMI queries for MTU
 8 years ago
Victor Julien 746638b220 cuda: remove 
Remove CUDA support as it has been broken for a long time.

Ticket #2382.
 9 years ago
Victor Julien ac0ae2dcd1 file_data: smtp file_data to generic file_data 
Generalize the SMTP file_data inspection into a 'files'
file_data inspection that can be used for any protocol
that uses the File API.
 9 years ago
Jason Ish 73d1e4bc84 detect-parse: don't use pcre for rule parsing 
Don't use pcre for the high level rule parsing, instead
using a tokenizing parser for breaking out the rule
into keywords and options.

Much faster, especially on older CPUs. Should also allow
us to provide better context where a rule parse error
occurs.
 9 years ago
Mats Klepsland 6ab5d42c92 unittests: initialize NSS in unittests runmode 
Initialize NSS in unittests runmode when Suricata is compiled with
libnss. Otherwise, calculating SHA-1 sums for TLS fingerprints
will fail.
 9 years ago
Victor Julien ab1200fbd7 compiler: more strict compiler warnings 
Set flags by default:

    -Wmissing-prototypes
    -Wmissing-declarations
    -Wstrict-prototypes
    -Wwrite-strings
    -Wcast-align
    -Wbad-function-cast
    -Wformat-security
    -Wno-format-nonliteral
    -Wmissing-format-attribute
    -funsigned-char

Fix minor compiler warnings for these new flags on gcc and clang.
 9 years ago