514 Commits (a2356a89f7cb42c91fdf607ffe0af3ecc7df5a4b)

Author	SHA1	Message	Date
Jason Ish	d79c23baa3	dns/detect: dns.opcode keyword ... Add a rule keyword, dns.opcode to match on the opcode flag found in the DNS request and response headers. Only exact matches are allowed with negation. Examples: - dns.opcode:4; - dns.opcode:!1;	7 years ago
Jeff Lucovsky	7808b946e3	detect/transform: add dotprefix keyword	7 years ago
Zach Kelly	caef8b5b38	protocol parser: rdp ... Initial implementation of feature 2314: 1. Add protocol parser for RDP 2. Add transactions for RDP negotiation 3. Add eve logging of transactions	7 years ago
Victor Julien	317376f59d	datasets: match on lists of data ... Datasets are sets/lists of data that can be accessed or added from the rule language. This patch implements 3 data types: 1. string (or buffer) 2. md5 3. sha256 The patch also implements 2 new rule keywords: 1. dataset 2. datarep The dataset keyword allows matching against a list of values to see if it exists or not. It can also add the value to the set. The set can optionally be stored to disk on exit. The datarep support matching/lookups only. With each item in the set a reputation value is stored and this value can be matched against. The reputation value is unsigned 16 bit, so values can be between 0 and 65535. Datasets can be registered in 2 ways: 1. through the yaml 2. through the rules The goal of this rules based approach is that rule writers can start using this without the need for config changes. A dataset is implemented using a thash hash table. Each dataset is its own separate thash.	7 years ago
Victor Julien	b286c14324	thash: generalize hash table as used in flow ... Thread safe hash table implementation based on the Flow hash, IP Pair hash and others. Hash is array of buckets with per bucket locking. Each bucket has a list of elements which also individually use locking.	7 years ago
Jeff Lucovsky	1930b1f504	eve/ftp: Log FTP transactions ... This changeset includes changes that 1. Add transaction support to the FTP parser 2. Support eve json logging of FTP transactions	7 years ago
Victor Julien	24f0092b72	detect: add ipv6.hdr sticky buffer ... Inspects IPv6 header and extension headers.	7 years ago
Victor Julien	4ac327f5b5	detect/ipv4: add ipv4.hdr sticky buffer	7 years ago
Henrik Lund Kramshoej	3519b011b7	decoder/vxlan: initial implementation of decoder	7 years ago
Victor Julien	ac694b089a	detect: add udp.hdr sticky buffer	7 years ago
Victor Julien	bdf53f449c	detect/tcp: rename tcp keyword files	7 years ago
Victor Julien	35be8385eb	detect: tcp.hdr sticky buffer ... Sticky buffer to inspect the TCP header.	7 years ago
Victor Julien	66648df099	detect: add tcp.mss keyword ... Allows matching on TCP option MSS. Syntax: tcp.mss:<value>; tcp.mss:<value1>-<value2>; tcp.mss:<op><value>; Operator can be: >, <.	7 years ago
Pierre Chifflier	9dfec7e734	SNMP: add the "snmp.pdu_type" detection keyword	7 years ago
Pierre Chifflier	e1dd19a0eb	SNMP: add the "snmp.community" detection keyword	7 years ago
Pierre Chifflier	aa608e0ca2	SNMP: add the "snmp.version" detection keyword	7 years ago
Pierre Chifflier	6fc7fc74cb	SNMP: add logger	7 years ago
Pierre Chifflier	2df840a8b8	Add SNMP (v1/v2c/v3) application layer	7 years ago
Mats Klepsland	0b489f329c	detect: add (mpm) keyword ja3s.string ... Match on JA3S string using ja3s.string keyword, e.g: alert tls any any -> any any (msg:"ja3s.string test"; ja3s.string; content:"10-11-12"; sid:1;)	7 years ago
Mats Klepsland	80cee50916	detect: add (mpm) keyword ja3s.hash ... Match on JA3S hash using ja3s.hash keyword, e.g: alert tls any any -> any any (msg:"ja3s.hash test"; ja3s.hash; content:"b26c652e0a402a24b5ca2a660e84f9d5"; sid:1;)	7 years ago
Mats Klepsland	ba857e9739	detect: add tls.certs keyword ... Add keyword to do "raw" matching on each of the certificates in the TLS certificate sticky buffer. Example: alert tls any any -> any any (msg:"tls.certs test"; tls.certs; \ content:"|01 02 03 04|"; sid:1;)	7 years ago
Victor Julien	84da0376fb	detect/http.host: rename file for consistency	7 years ago
Jeff Lucovsky	a8938f449d	logging: Anomaly logging ... This changeset adds anomaly logging to suricata for issue 2282. Anomaly logging is controlled via the `anomaly` section within eve-log. There is a single option -- `packethdr` -- for including the packet header in the anomaly.	7 years ago
Victor Julien	c2cb155ebb	rust/smb: rename files and code from RustSMB to SMB	7 years ago
Victor Julien	f30c05e684	smb: remove C implementation ... Now that Rust is mandatory it is obsolete. Ticket: #2849	7 years ago
Jason Ish	78b82ce6a5	dns-log: remove, not supported now that Rust is required ... The non-json line based DNS log is not supported with Rust only builds and has been scheduled for removal in Suricata 5.0. Redmine issue: https://redmine.openinfosecfoundation.org/issues/2297	7 years ago
Jeff Lucovsky	81c1af0887	detect: implement http {location,server} sticky buffer ... This implements inspection of the Server and Location buffer as a content sticky buffer.	7 years ago
Victor Julien	d6903e70c1	file-log: remove and add warning ... Feature was deprecated and scheduled for removal. Ticket #2376	8 years ago
Victor Julien	aab03dde87	mpm/ac-ks: rename files from -tile to -ks	8 years ago
Victor Julien	6fcd2db043	tile: remove files	8 years ago
Victor Julien	998f32f88c	detect/tls: consolidate validity code	8 years ago
Victor Julien	ccdafe6697	detect/http-server-body: move tests to tests/	8 years ago
Victor Julien	64987f36fb	detect/file-data: move tests into tests/	8 years ago
Victor Julien	9a8092249e	detect/http-client-body: move tests into tests/	8 years ago
Victor Julien	76fd666cad	detect/http_raw_header: move tests into tests/	8 years ago
Victor Julien	ab027cb481	detect/http_cookie: move tests into tests/	8 years ago
Victor Julien	2f342da048	detect/http_stat_code: move tests into tests/	8 years ago
Victor Julien	5dfba01b2e	detect/http_stat_msg: move tests to tests/	8 years ago
Victor Julien	b469938998	detect/http_raw_host: move raw into regular host logic	8 years ago
Victor Julien	dc43f35427	detect/http_host: move tests into tests/	8 years ago
Victor Julien	cb332b4cda	detect/http_method: move all tests into tests/	8 years ago
Victor Julien	0a405e27a0	detect/http_raw_uri: code reorganization ... Move registration into http_uri logic, move tests into the other uri tests. Switch to v2 mpm/inspect APIs.	8 years ago
Victor Julien	10e2731f18	detect/http-uri: move tests into tests/	8 years ago
Victor Julien	3111910fc6	detect/http_user_agent: move tests into tests/	8 years ago
Victor Julien	eb73008ccf	detect/transform: add to_sha1 keyword	8 years ago
Victor Julien	75f9c1ae9f	detect/transform: add to_md5 keyword	8 years ago
Victor Julien	0f1fc1f0c8	hash: move string hash funcs into util files	8 years ago
Eric Leblond	0e3b1eba86	util-binsearch: remove the files	8 years ago
Eric Leblond	3c566e0f89	util-bpf: introduce custom BPF compile functions ... We can't get error from pcap_compile_nopcap() so let's get our own function and output message.	8 years ago
Victor Julien	8b8270e732	eve/json: add common helper funcs ... Add simple helper funcs for option-less loggers	8 years ago