aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
18,836 Commits
8 Branches
173 Tags
252 MiB
main
main-7.0.x
main-8.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '9b12fd9f09'
${ noResults }
Commit Graph

18836 Commits (9b12fd9f09459a5b05a0142f419e440453f94bbe)
 

Author SHA1 Message Date
Philippe Antoine 9b12fd9f09 rust/ffi: move helper trait state_get_tx_iterator to ffi 
Ticket: 7666
 2 months ago
Philippe Antoine 07f37676b6 rust/ffi: move Flags for AppLayerParserState to ffi crate 
Ticket: 7666
 2 months ago
Philippe Antoine fb20c69d8d rust/ffi: move APP_LAYER_PARSER_OPT_X const to ffi crate 
Ticket: 7666
 2 months ago
Philippe Antoine f1c66ff6f0 rust: remove obsolete const exclusions in cbindgen 
As these structs are now bindgened from C to suricata_sys crate
 2 months ago
Philippe Antoine d81a10126e detect/doc: remove unexisting links 
Ticket: 8257

And add TODO comments if rules doc should be written
 2 months ago
Philippe Antoine 8e39539161 detect/doc: fix broken anchor links 
Ticket: 8257
 2 months ago
Philippe Antoine bd6a436893 detect/doc: fix broken files links 
Ticket: 8257
 2 months ago
Philippe Antoine adc0f18463 doc/ci: check keyword links 
Ticket: 8257
 2 months ago
Philippe Antoine b0e63a2c95 detect/dcerpc: move stub_data keyword to rust 
Ticket: 8391
 2 months ago
Philippe Antoine 3d56472d16 detect: bindgen more functions 
To prepare to move dcerpc.stub_data keyword to full rust
 2 months ago
Philippe Antoine ef884b009a detect/dcerpc: move dcepayload unit tests to SV 
Ticket: 8391
 2 months ago
Philippe Antoine cfb1626212 detect/dcerpc: move dce-stub-data unit tests to SV 
Ticket: 8391
 2 months ago
Jeff Lucovsky 1721ba1ba5 doc/subslice: Document the subslice transform 
Add documentation for the subslice transform.

Issue: 7672
 2 months ago
Jeff Lucovsky 746f471382 transform/subslice: Add subslice transform 
Issue: 7672

The subslice transform creates a slice of the input buffer.

Specify the subslice desired -- nbytes and truncate are optional:
        subslice: offset <,nbytes> <,truncate>

offset: Specifies the starting offset for the new subslice. When
negative, expresses how far from the end of the input buffer to begin.

nbytes: Specifies the size of the subslice. When negative, specifies
that the subslice will end that many bytes from the end of the input
buffer. Nbytes must be non-zero.

When nbytes is not specified, the size of the subslice will be the size
of the input buffer - offset.

truncate: Specify behavior when offset + nbytes exceeds buffer length.
When present, trims nbytes such that offset + nbytes equals buffer
length. When not present, an empty buffer is produced.

Examples:
        subslice: 1;     - The subslice will be a copy of the input
            buffer but omits the input buffer's first byte
            "This is Suricata" -> "his is Suricata"
        subslice: 0, 13; - The slice is created from the first 13 bytes
            of the input buffer
            "This is Suricata" -> "This is Suric"
        subslice: 10, -5; - The subslice is created starting at offset 10
            and continues to 5 bytes before the end of the input buffer
            "This is Suricata" -> "r"
        subslice: -3; - The subslice will be the last 3 bytes of the
            input buffer.
            "This is Suricata" -> "ata"
 2 months ago
Philippe Antoine 7e326f291a detect: (m)dns keywords even with "alert udp" 
Ticket: 8501

(m)dns.*.rrname keywords required the rules to start with
alert (m)dns
and refused to load if the rule started with generic alert ip or
alert udp, with error message
Error: detect-parse: invalid alproto 0
 3 months ago
Philippe Antoine 64f003190d doc: move more rules to dedicated css container 
Ticket: 8372

Also remove dead code from script checking the rules
 3 months ago
Philippe Antoine e0d10c0513 scripts: remove dead code in check-doc-rules 3 months ago
Philippe Antoine 4fc6ca5d6c detect/dcerpc: move iface keyword to rust 
Ticket: 8391

Use same buffer dce_generic as for dcerpc.opnum
(name dce_generic is enforced by a SV test currently)
 3 months ago
Jason Ish d1481af94e ssl: convert memcpy to strlcpy to avoid flto issue 
When using ASAN, flto=auto and compiling on a platform that supports
AVX-512, this memcpy is optimized as its exactly 64 bytes. However, when
using ASAN, there is a fake stack that may not be 64 bytes aligned, and
this AVX write lands on an unaligned byte, causing a crash.

Use strlcpy avoids this optimization as it needs to find the NUL byte.
 3 months ago
Philippe Antoine 9677851637 rust/ffi: move app-layer traits to ffi crate 
Ticket: 7666

Traits around structures defined in C and bindgened to rust
 3 months ago
Philippe Antoine f803c25f24 rust/ffi: move export_X_data_get macros to ffi crate 
Ticket: 7666
 3 months ago
Philippe Antoine 54b6885166 rust/ffi: move conf_get_bool helper to ffi crate 
Ticket: 7666
 3 months ago
Philippe Antoine be2d80a8e7 ftp-data: check direction before finished state 
Ticket: 6813

So, in the case we have a ftp-data flow with data to client as
expected, but after to_client side completes (with timeout for
example), the client sends some data to server,

In this case, we want to check first the direction, and bail out,
then do the assertion check about the finished state.
 3 months ago
Victor Julien 28a3337c27 rust: cargo update 3 months ago
Philippe Antoine 40c8620184 detect/http2: fix progress for headers 
Ticket: 8451

Do not wait to see a data frame to run detection on http2 headers
 3 months ago
Philippe Antoine 898446aee8 detect/doh2: prefilter does not use dns engine progress 
to update HTTP2 tx progress

Ticket: 8454
 3 months ago
Philippe Antoine 5f9e436c3f detect/dcerpc: support generic integer for opnum keyword 
Ticket: 8179
 3 months ago
Philippe Antoine 67379b009a detect/dcerpc: move opnum keyword to rust 
Ticket: 8391
 3 months ago
Philippe Antoine a36af353bc rust: bindgen SCFlowGetAppProtocol 3 months ago
Jason Ish fd31e50954 ntp: enable keywords for firewall mode 
Ticket: #8394
 3 months ago
Jason Ish 713e4eb900 ntp: convert reference_id to buffer and add keyword 
Store the NTP reference ID as raw network-order bytes so it can be
exposed as a sticky buffer and matched with payload keywords. The
reference ID is often a 4 character string, or an IP address and not
just an integer identifier.

Updates the log reference ID to be a string of colon separated hex
digits as this matches what tshark does.

Ticket: #8488
 3 months ago
Jason Ish 991e7f3b1d ntp: add ntp.mode keyword 
This keyword also accepts strings for known mode names.

Ticket: #8429
 3 months ago
Jason Ish c10c482290 ntp: add ntp.stratum keyword 
Ticket: #8431
 3 months ago
Jason Ish ec344fe68d ntp: add ntp.version keyword 
SNMP was used as a template.

Ticket: #8430
 3 months ago
Jason Ish 74bb525401 ntp: create tx for all modes; log version, mode and stratum 
Add logging for version, mode and stratum as these will be the first
keywords we will add.

Ticket: #8425
 3 months ago
Jason Ish 879846e153 ntp: remove unused event types 
NotRequest and NotResponse event type have never been used.

Unsolicited is also unused, however there is a rule for it so removing
support would be a breaking change at this time.
 3 months ago
Jason Ish 31b967b089 ntp: add transaction logging 
Adds basic NTP transaction logging for the current supported message
types.

Includes small cleanups around reference ID.

Ticket: #8425
 3 months ago
Lukas Sismis 214e47bea1 dpdk: move to native queue-sized mempools 
As a legacy from Suricata 7, mempool size was kept even internally
as a global size. Since in Suricata 8, mempool allocation moved to
per queue model, it makes sense to calculate the correct size right
when loading the configuration.

The previous implementation misscalculated in some scenarios the size
of the mempool which prevented Suricata starting successfully.
This happened, e.g. when there were 32k RX descriptors and 64 TX descs.
The resulting mempool was incorrectly deduced as 32767 (2^n-1), which
didn't even hold all RX descriptors. Instead, it should result to 65535.

Ticket: 8370
 3 months ago
Victor Julien c7cd3b17c3 snmp: minor snmp.pdu_type type cleanup 3 months ago
Victor Julien 9c450d18e7 eve/drop: minor code cleanup 3 months ago
Victor Julien f9b25dc6ec eve/drop: always enable verdict in firewall mode 3 months ago
Victor Julien ff6fb068c7 detect/firewall: fix 'last_for_progress' logic 
If the last signature in the candidates list is also the last for the
current progress value, it needs to be considered as the last for that
progress, so that if it doesn't match the default policy is applied.
 3 months ago
Victor Julien 2cef1404bc detect/snmp: let generic keyword share the same list 3 months ago
Victor Julien 670fdabd32 detect/snmp: add snmp.trap_type keyword 
Implemented as a U8 integer keyword.

Ticket: #8482.
 3 months ago
Victor Julien c94cb8e098 eve/schema: add snmp trap fields 3 months ago
Philippe Antoine 8ac9a62ec4 detect: enable snmp keywords for firewall mode 
Ticket: #8395
 3 months ago
Philippe Antoine 63603fe14a detect/snmp: sticky buffers at progress 1 
Since snmp txs are created at progress 1 which is the completion,
this does not change detection, except allowing firewall mode
to use these keywords with generic hook like
snmp:request_complete

Ticket: 8395
 3 months ago
Philippe Antoine 8f824458c2 detect: helper for buffer register requires progress 
Ticket: 8395

For protocols where tx are complete at start, that is
the `tx_get_progress` function returns 1 inconditionnally,
we can use the progress 1, not losing time on detection in ips
mode, and getting ready for firewall mode

For the other protocols (where a tx needs both a request and response
for instance), keep progress 0 as was the case before
 3 months ago
Jason Ish f5bf76c0ee examples/plugins/rust: add a rust example plugin 
Only demonstrates EVE callbacks for now, but I plan to turn this into a
show case of a variety of callbacks a Rust plugin can do as we add Rust
bindings to the ffi crate.
 3 months ago
Jason Ish 6512be19aa output-eve: rust.h include is no longer needed 
output-eve.h pulls it in.
 3 months ago