aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
14,166 Commits
8 Branches
173 Tags
178 MiB
main
main-7.0.x
main-8.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '935dedf1e8'
${ noResults }
Commit Graph

11331 Commits (935dedf1e8ac789885e5dd5196d2269090acffe4)

Author SHA1 Message Date
Victor Julien 5e5da81cca exception/policy: add more info on defaults 
Be more informative where a exception value came from: defaults,
master switch or an explicit setting.
 4 years ago
Victor Julien a5547564b6 stream/midstream: add bug number to policy warning 4 years ago
Victor Julien 3fcc19e78c exception/policy: 'auto' sets IPS to 'drop-flow' 
In IPS mode set all exception policies to drop-flow by default, both
in the default yaml and if no `exception-policy` is defined.
 4 years ago
Victor Julien 0863544d83 exception/policy: fix formatting issues 4 years ago
Victor Julien a6723bca7c flow: enforce flow assumption 
Enforce assumption that packets in ThreadVars::decode_pq have no flow
attached to it because this is only true for packets while they are
in the FlowWorker.
 4 years ago
Victor Julien 66ed3ae6e4 flow/mgr: remove flows_timeout_inuse counter 4 years ago
Victor Julien 0592e57df5 flow: rearrange Flow struct to be more compact 4 years ago
Victor Julien 7951d8a14f flow: remove use_cnt 
Packets only ever reference the flow while holding its lock. This
means than any code possibly evicting the flow will have to wait
for the existing users to complete their work. Therefore the use_cnt
serves no function anymore and can be removed.
 4 years ago
Victor Julien a2dc9a40e7 flowworker: don't keep unnecessary flow reference 
Flow stream/detect/log flush packets, don't hold on to the flow
beyond the flow worker module.
 4 years ago
Victor Julien 3ca37008d7 stream: remove unused pseudo packet function 4 years ago
Jason Ish 6344501dba tls: fix date logging for dates before 1970 
The Rust time crate used by the x509-parser crate represents dates
before 1970 as negative numbers which do not survive the conversion to
SCTime_t and formatting with the current time formatting functions.

Instead of fixing our formatting functions to handle such dates,
create a Rust function for logging TLS dates directly to JSON using
the time crate that handles such dates properly.

Also add a FFI function for formatting to a provided C buffer for the
legacy tls-log.

Issue: 5817
 4 years ago
Victor Julien 9e41075d5d detect/frames: improve IPS and GAP handling 
Inspect individual chunks in lossy traffic.

Don't use the frame idx as the inspection buffer idx. Engines are running
per frame, so multi inspection can be used for stream chunks instead.

Ticket: #4977.
 4 years ago
Victor Julien 6fcf48d09a detect/frames: handle duplicate sigs in candidates 
Prefilter engines run on each stream chunk in a lossy stream, so
we can get the same sid in the list multiple times.
 4 years ago
Victor Julien 8ff2543343 stream: add util to get absolute right edge of data 4 years ago
Victor Julien a95934b5ee detect/frames: reduce scope of private function 4 years ago
Victor Julien 652de0cc99 output: move function name in non-release output 4 years ago
Victor Julien f834377c5f detect/tls.certs: improve buffer init logic 4 years ago
Victor Julien aa4a128fb0 detect/quic: update buffer initialization logic 4 years ago
Victor Julien 6f1574276f detect/mqtt: update buffer initialization logic 4 years ago
Victor Julien 83e97a9283 detect/krb5.sname: update buffer initialization logic 4 years ago
Victor Julien d3675d5197 detect/krb5.cname: update buffer initialization logic 4 years ago
Victor Julien 849f1cf1b8 detect/ike.vendor: update buffer initialization logic 4 years ago
Victor Julien 158e648d87 detect/http2: update buffer initialization logic 4 years ago
Victor Julien 5e783a01fe detect/file.name: update buffer initialization logic 4 years ago
Victor Julien 576bfc6bf0 detect/file.magic: update buffer initialization logic 4 years ago
Victor Julien 50fd691efb detect/file.data: update buffer initialization logic 4 years ago
Victor Julien 9c34e82471 detect/http.uri: update buffer initialization logic 4 years ago
Victor Julien f6fd1b017f detect/dce.stub_data: update buffer initialization logic 4 years ago
Victor Julien e31ead9bc2 detect/dns: update buffer initialization logic 4 years ago
Victor Julien 70125a29f6 detect/buffer: add initialized flag to simplify buffer logic 4 years ago
Jeff Lucovsky c1c67536b6 decode/stat: Add decode counters for unknown/arp 
Issue: 5761

This commit adds statistics for ARP and unknown ethertype packets for
diagnostic purposes.
 4 years ago
Philippe Antoine e3105a6614 ftp: adds a config option ftp-hash for autofp-scheduler 
This allows ftp-data and ftp flows to be processed by the same
thread. Otherwise, there may be a concurrency issue where the
would-be ftp-data flow is first processed, and thus not recognized
as such. And the ftp flow gets processed later and the expectation
coming from it is never found.

To do so, the flow hash gets used as usual, except for flows that
may be either ftp or ftp-data, that is either one port is 21, or
both ports are high ones.

Ticket: #5205
 4 years ago
Philippe Antoine c1f615b8d2 src: fix coverity warning about sizeof 
CID: 1520601
CID: 1520602

> In this particular case sizeof (char **) happens to be equal to
sizeof (char *), but this is not a portable assumption.
 4 years ago
Jason Ish 84d1ed58bb config: check return value of dotted override 
Fixes commit fbb0d2b0f4.
 4 years ago
Jason Ish 3f4dad8676 ftp: add events for command too long 
Issue: 5235
 4 years ago
Jason Ish dcfa6a6002 suricata: allow additional include files on command line 
Add a new command line option, --include. This will merge additional
configuration files into the configuration specified in the main
suricata.yaml.  It can be provided multiple times and the files will be
included in the order they appear on the command line.

Ticket: 3912
 4 years ago
Jason Ish cb1ae92a1b yaml-loader: add test for fully qualified override 
Also set the parent node for regular nodes on creation as this is
useful in unit-tests to verify the parent of a node.
 4 years ago
Jason Ish fbb0d2b0f4 config: allow fully qualified overrides 
Allow configuration parameters to be overrided usually a fully
qualified name such as:

vars.address-groups.HOME_NET: "7.1.2.0/24"

In configuration files (including "include" files).  This allows the
overriding of a specific value deeply nested in the configuration
without having to redefine the complete top-layer object.

Ticket: 4783
 4 years ago
Philippe Antoine 9cb0bc3332 util/landlock: check return values for ConfGet 
CID 1514671
CID 1514669
 4 years ago
Shivani Bhardwaj f941ceae2b decode/udp: fix payload_len calculation 
Fix payload_len calculation post removal of the condition that returned
error code if the length to the decode fn did not match the length of
header from the UDP packet.

Bug 5379
 4 years ago
Shivani Bhardwaj eebdfe9a3e decode/events: add event type UDP_LEN_INVALID 4 years ago
Lukas Sismis d18e52ed93 decode-udp: Allow shorter UDP packets than the remaining payload length 
If the packet is shorter than IP payload length we no longer flag it as an
invalid UDP packet. UDP packet can be therefore shorter than IP payload.
Keyword "udp.hlen_invalid" became outdated as we no longer flag short UDP
packets as invalid.

Redmine ticket: #5693
 4 years ago
Jason Ish a0fc00bb48 log-pcap: fix inverse logic error 
We shouldn't early initialize when *offline*.  Instead this accidentally
delayed initializing when if an online mode, however its likely not to
have been noticed as delaying initializing in online mode is supported
as well.
 4 years ago
Philippe Antoine e07556b961 runmodes: fix memory leak 
By using constant for string instead of allocating and leaking it

CID: 1520497
CID: 1520500
 4 years ago
Philippe Antoine b281199e9a test: do not output non ascii character 
The unit test for content |aa bz| transforms in place the string
str to replace the 2 characters aa by one character 0xaa
Then, when z is not recognized as a valid hexadeicmal character,
the whole modified string is printed out, inclusing the non-ascii
0xaa

Ticket: #5558
 4 years ago
Victor Julien 7a47eabf82 streaming: fix possible use after free 
Don't use ptr after freeing it. Reported by Coverity Scan.
 4 years ago
Victor Julien f41646a012 streaming: remove dead code 
As reported by Coverity Scan.
 4 years ago
Victor Julien 7b18b9c01c flow: make next_ts unsigned 
To silence a coverity warning.
 4 years ago
Victor Julien 420351eda2 time: fix various time issues 
Found by Coverity Scan.
 4 years ago
Shivani Bhardwaj 06caef988c detect/ftp: use AppLayerResult API 4 years ago