suricata

Commit Graph

Author	SHA1	Message	Date
Giuseppe Longo	ae4341eb5f	swf: validate configured depth limits SWF depth settings were previously limited only to values representable by uint32_t. This is not sufficient for the buffer-size calculations performed during SWF decompression. The decompressed output requires an additional 8-byte FWS header. The inspection buffer also grows by doubling a uint32_t size, so a required buffer larger than 2 GiB can cause the growth calculation to wrap. For LZMA input, a synthesized 13-byte header to the compressed data is used. The configured compressed-data limit must leave room for this header. This patch applies the following upper limits: - decompress-depth: 2147483640 bytes (2 GiB minus the 8-byte FWS header) - compress-depth: 4294967282 bytes (UINT32_MAX minus the 13-byte LZMA header Ticket: #8914	2 months ago
Giuseppe Longo	e707b21e21	swf: ignore FileLength when sizing output SWF FileLength was used to determine the decompressed buffer size when decompress-depth is set to zero, but this field can be manipulated and it can lead to evasion. This patch treat FileLength as metadata, the length bytes are just copied, and when decompress-depth is set to 0, a maximum value of 50MB is considered for the decompressed buffer. Ticket: #8855	2 months ago
Philippe Antoine	bcbec8d615	doc: fix eol content in http rules	6 months ago
Philippe Antoine	15f45be672	doc: fix rules Ticket: 8372 Somes rules in the doc had typos, fix them so suricata can load them when you copy/paste the doc	6 months ago
Victor Julien	a1c4167d94	doc/userguide: add initial protocols overview Explain per protocol mechanics for rule matching.	1 year ago
Juliana Fajardini	d5810a42e1	userguide: document how suricata processes rules Added a page that explains how rules are prioritized by Suri, as well as what main different types of inspection happen and what elements are involved when ordering rules. Task #5449	1 year ago
jason taylor	ca9b29c2d0	doc: update http.header_names normalization info	1 year ago
Philippe Antoine	879a733c12	doc/http2: explicit behavior for some http keywords HTTP/2 does not define a way to carry the version or reason phrase that is included in an HTTP/1.1 status line. Ticket: 6548	2 years ago
jason taylor	abb74245cc	doc: update normalization notes Ticket: #6781 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	5dacf4d92b	doc: add http.connection ref and fix location Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	7de16809ef	doc: update http keyword listing order Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	8b3db3c3b5	doc: update file.name keyword information Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	49dba7bb94	doc: update file.data keyword information Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	bee3aa9709	doc: update http.response_header keyword Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	dcb548106e	doc: update http.request_header keyword Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	3f5d228b9e	doc: update http.host http.host.raw keyword Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	739dfe5e5e	doc: update http.location keyword information Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	9ddd8cf9e0	doc: update http.server keyword information Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	3af98f3b92	doc: update http.response_body keyword information Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	64760e2e75	doc: update http.response_line keyword information Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	566bc0d39c	doc: update http.stat_msg keyword information Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	271321249f	doc: update http.stat_code keyword information Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	71d8488cb5	doc: update http.request_body keyword information Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	c2783e9391	doc: update http.header_names keyword information Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	5eadbc2ff0	doc: update http.start keyword information Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	7e65554462	doc: update http.referer keyword information Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	876dfb99ca	doc: update http.content_len keyword information Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	8ff06c1bc0	doc: update http.content_type keyword information Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	b2854486dd	doc: update http.connection keyword information Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	75436dff9c	doc: update http.accept_lang keyword information Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	f6375e487e	doc: update http.accept_enc keyword information Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	7e3288f5a7	doc: update http keyword normalization notes Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	9e87d89d2e	doc: update http.accept keyword information Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	8307168ae7	doc: update http.user_agent keyword Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	75c4cdfa1c	doc: update http.cookie keyword information Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	7a28874c8d	doc: update http.header keyword information Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	b3af723486	doc: remove legacy description/duplicated data Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	292b3eb9b3	doc: update http.request_line keyword information Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	c7f351bd6e	doc: update http.protocol keyword documentation Ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	2d0ceedeba	doc: update urilen keyword documentation ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	ef118aa582	doc: remove legacy uricontent information ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	96e8c10276	doc: update http.uri and http.uri.raw keywords ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	bf192926a8	doc: update http.method keyword ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	0cce5ba447	doc: add http keyword links ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	fd46175203	doc: update http primer information ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	54fd35c5b4	doc: remove legacy tables and image references ticket: 3025 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
Philippe Antoine	b8bc2c7e0f	doc: integer keywords Ticket: 6628 Document the generic detection capabilities for integer keywords. and make every integer keyword pointing to this section.	3 years ago
jason taylor	bbc17b1c7d	doc: add file.name information to http keyword doc Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	c50002978d	doc: update file.data keyword documentation Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	c95fce39f0	doc: add multi buffer support note to keyword docs Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago

1 2

88 Commits (9c9c787592dcefb833ad64c9f0521ed4b4addbc0)