aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
17,897 Commits
8 Branches
174 Tags
251 MiB
main
main-8.0.x
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.7
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '9869fb776b'
${ noResults }
Commit Graph

310 Commits (9869fb776bf3e3a3d2aa006a5e8bf5da75e3d475)

Author SHA1 Message Date
Philippe Antoine f6856eac9c fuzz: fix -Wshorten-64-to-32 warnings 
Ticket: #6186
 1 year ago
Philippe Antoine b29d46d81f rust: bindgen SCAppLayerParserStateIssetFlag 
Ticket: 7667
 1 year ago
Philippe Antoine 249131e9de src: clean includes for app-layer-parser.h 
To prepare bindgening
 1 year ago
Victor Julien 84a9673af6 flow: remove FLOW_NOPACKET_INSPECTION flag 
It was not used separately from FLOW_ACTION_PASS.
 2 years ago
Jason Ish 22b77b0c56 conf: prefix conf API with SC 2 years ago
Philippe Antoine 09aed7e243 fuzz: set flow flags as in Suricata 
Fixes: d8ddef4c14 ("detect: delay tx cleanup in some edge case")
 2 years ago
Philippe Antoine a7713db709 detect: add configurable limits for datasets 
Ticket: 7615

Avoids signatures setting extreme hash sizes, which would lead to very
high memory use.

Default to allowing:
- 65536 per dataset
- 16777216 total

To override these built-in defaults:

```yaml
datasets:
  # Limits for per rule dataset instances to avoid rules using too many
  # resources.
  limits:
    # Max value for per dataset `hashsize` setting
    #single-hashsize: 65536
    # Max combined hashsize values for all datasets.
    #total-hashsizes: 16777216
```
 2 years ago
Philippe Antoine b9b797f1f4 detect: non infinite default value for inspection-recursion-limit 
So that empty config are protected by this setting as was intended.

Set to unlimited for fuzz testing.
 2 years ago
Jason Ish ad6d9e0d93 base64: prefix base64 C API with "SC" 2 years ago
Philippe Antoine e47f4f997d fuzz: init reverse before calling AppLayerProtoDetectGetProto 
Completes commit fec06f8ac3

The 2 callers in suricata itself already do that
 2 years ago
Philippe Antoine c00e13772e fuzz: better init for signature parsing target 
Fixes https://issues.oss-fuzz.com/u/1/issues/391975646
 2 years ago
Victor Julien d6b56929d3 detect: set mpm/prefilter during signature parsing 
In preparation of flowbit prefilter work that needs this info
earlier.

Track potential prefilter sm's to avoid unnecessary looping during
setup.
 2 years ago
Philippe Antoine 637708acb4 fuzz: remove unused macro 2 years ago
Philippe Antoine a92212d6e5 fuzz: better init for signature parsing harness 
It needs app-layer registration for the names
 2 years ago
Philippe Antoine ae1a4ef757 app-layer: make number of alprotos dynamic 
Ticket: 5053

The names are now dynamically registered at runtime.
The AppProto alproto enum identifiers are still static for now.

This is the final step before app-layer plugins.
 2 years ago
Philippe Antoine f8136eff9a fuzz: use dynamic number of app-layer protos 
Ticket: 5053

delay after initialization so that StringToAppProto works
 2 years ago
Philippe Antoine e5b98be41f fuzz: simplify target for protocol detection 
As too many cases are found when splitting tcp payload
 2 years ago
Philippe Antoine 261c15d0e1 fuzz: better init for protocol detection 
Ticket: 7435
 2 years ago
Jason Ish 2ac16ee1a6 detect: break apart sigtable setup and initialization 
Allows initialization to be done early, so the table is ready for
dynamic registration by plugins which are loaded before signature
setup.
 2 years ago
Philippe Antoine 8984bc6801 transforms: move xor to rust 
Ticket: 7229
 2 years ago
Philippe Antoine 96c8470cdd template: move detect keywords to pure rust 
Ticket: 3195

Also remove unused src/tests/detect-template-buffer.c

Completes commit 4a7567b3f0
to remove references to template-rust
 2 years ago
Philippe Antoine 58556b7f8b template: remove -rust references 
Ticket: 7315

Completes commit 4a7567b3f0

Allows keyword template.buffer to work properly when template
protocol is enabled
 2 years ago
Shivani Bhardwaj cbb571a61c rust/base64: add decoder 
Add a pure rust base64 decoder. This supports 3 modes of operation just
like the C decoder as follows.
1. RFC 2045
2. RFC 4648
3. Strict

One notable change is that "strict" mode is carried out by the rust
base64 crate instead of native Rust. This crate was already used for
encoding in a few places like datasets of string type. As a part of this
mode, now, only the strings that can be reliably converted back are
decoded.

The decoder fn is available to C via FFI.

Bug 6280
Ticket 7065
Ticket 7058
 2 years ago
Victor Julien 96a0ffadde packetpool: allow larger max-pending-packets 
Original limit was due to a specific data structure.
 2 years ago
Philippe Antoine 3f8251bd47 fuzz: make confyaml.c an explicit source 
Ticket: 7181

Allows confyaml.c to be in the release archive
 2 years ago
Philippe Antoine daad7f2d41 detect/integers: harmonize parser return handling 
Ticket: 7172

When parsing an integer for a rule keyword fails, we return error
straight away, without bothering to try to free the NULL pointer.

On the way, remove some one-line wrapper around DetectUxParse
 2 years ago
Jeff Lucovsky 5b97f4040c detect/base64: Use Rust defined modes everywhere 
Issue: 6487

To avoid ambiguity, a single definition for base 64 decoding modes will
be used. The Rust base64 transform contains the definitions for the
existing mode types: Strict, RFC2045, RFC4648
 2 years ago
Philippe Antoine e3034a6f54 tests: move detect http.uri tests to suricata-verify 
Ticket: 3725
 2 years ago
Philippe Antoine d59c60410f fuzz: adapt target to number of keywords being dynamic 
Ticket: 4683
 2 years ago
Philippe Antoine ae72376ebe detect/snmp: move keywords to rust 
Ticket: 4863

On the way, convert unit test DetectSNMPCommunityTest to a SV test.

And also, make snmp.pdu_type use a generic uint32 for detection,
allowing operators, instead of just equality.
 2 years ago
Philippe Antoine a10c1f1dde smtp: use rust for mime parsing 
Ticket: #3487
 2 years ago
Philippe Antoine b91e7fe2ae detect/http-server-body: clean up tests 
Ticket: 4083
 2 years ago
Philippe Antoine ce9bfba76a ci: fix and test with Wunused-macros 
Ticket: 6937
 2 years ago
Victor Julien 52a008e358 detect/http-host: clean up tests 2 years ago
Shivani Bhardwaj 2e6777c8e3 fuzz: add target for DecodeBase64 
Task 6050
 2 years ago
Philippe Antoine ce4119ae3d snmp: remove community keyword unit test 
Ticket: 3725

This test was moved to suricata-verify snmp-community
 3 years ago
Victor Julien 68804b8c4b decode/tcp: move tcph into L4 packet data 
To reduce Packet size.

Ticket: #6938.
 3 years ago
Victor Julien 28ac86096a decode/udp: move udph into L4 packet data 
To recude Packet size.

Ticket: #6938.
 3 years ago
Victor Julien 54362d44db decode/ethernet: move ethh into L2 section 
L2 section similar to L3 and L4 sections.

Ticket: #6938.
 3 years ago
Victor Julien 852ff83d70 decode/icmpv4: move icmpv4h into L4 packet data 
To reduce Packet size.

Ticket: #6938.
 3 years ago
Victor Julien 329fb2affa decode: start l4 packet area; convert csum handling 3 years ago
Victor Julien a40d6f5c4f decode/ipv6: prep for turning ip4h/ip6h into union 
Store IPv6 decoder vars in a new Packet::l3 section in the packet.

Use inline functions instead of the often multi-layer macro's for
various IPv6 header getters.

Ticket: #6938.
 3 years ago
Victor Julien 2d5c381c3b decode/ipv4: prep for turning ip4h/ip6h into union 
Store IPv4 decoder vars in a new Packet::l3 section in the packet.

Use inline functions instead of the often multi-layer macro's for
various IPv4 header getters.

Ticket: #6938.
 3 years ago
Jason Ish d2537361f4 run-mode: remove duplicate var; add setter function 
Remove the global "run_mode" var as it was a duplicate of the runmode on
the "instance" struct. For direct access outside of suricata.c, use the
getter function.

Also expose a setter function for unit tests that need to change it.
 3 years ago
Victor Julien e651cf922a detect/http: fix compile warning in body tests 
When --enable-unittests w/o --enable-debug is used.
 3 years ago
Arne Welzel f17204191d stats: Fix non-worker stats missing 
Commit b8b8aa69b4 used tm_name of the
first StatsRecord of a thread block as key for the "threads" object.
However, depending on the type of thread, tm_name can be NULL and would
result in no entry being included for that thread at all. This caused
non-worker metrics to vanish from the "threads" object in the
dump-counters output.

This patch fixes this by remembering the first occurrence of a valid
tm_name within the per-thread block and adds another unittest to
cover this scenario.
 3 years ago
Arne Welzel 08db0f302b stats: Add unittest for basic stats serialization 
Main purpose is to validate that the 30 of bond0.30 isn't expanded into
a nested object during serialization.
 3 years ago
Victor Julien 2911656d6c detect/content: fix offset for negative distance 
Fix offset calculation on sigs with negative distance. Can lead to FN
in certain cases.

Bug: #6661.
 3 years ago
Victor Julien 18eafb622f detect/content-inspect: add more tests 3 years ago
Victor Julien 4558c5c515 detect/http_server_body: modernize test 3 years ago