581 Commits (aa8871a5bed5c7d2977f82a392e25e6fced98e8f)

Author	SHA1	Message	Date
Philippe Antoine	8396333493	detect: adds icmpv6.hdr keyword	6 years ago
Jason Ish	d86973b386	unified2: remove deprecated output unified2 ... Ticket 2385: https://redmine.openinfosecfoundation.org/issues/2385	7 years ago
Jeff Lucovsky	f83b199f2a	feature: feature tracking services	7 years ago
Philippe Antoine	af2a689a99	init: move main to a separate file ... so as to reuse code from suricata.c with fuzz targets	7 years ago
Danny Browning	b573c16dd5	build: cbindgen ... Rust headers are now generated using cbindgen. If cbindgen is present, they can be generated during dist, otherwise they will be available for builds.	7 years ago
Victor Julien	1633744fcb	nfq: remove unused queue handler type	7 years ago
Victor Julien	f66e12f7af	dns: rename rust files and funcs	7 years ago
Victor Julien	b4318a11e3	rust: remove build system HAVE_RUST guards	7 years ago
Giuseppe Longo	e06291922f	detect/sip.response_line: add sticky buffer ... Matches on response line field in SIP.	7 years ago
Giuseppe Longo	17de4a8023	detect/sip.request_line: add sticky buffer ... Matches on request line field in SIP.	7 years ago
Giuseppe Longo	8939ece538	detect/sip.stat_msg: add sticky buffer ... Matches on status msg field in SIP.	7 years ago
Giuseppe Longo	bd2219cac6	detect/sip.stat_code: add sticky buffer ... Matches on status code field in SIP.	7 years ago
Giuseppe Longo	8454122eb2	detect/sip.protocol: add sticky buffer ... Matches on protocol field in SIP.	7 years ago
Giuseppe Longo	2661c5b298	detect/sip.uri: add sticky buffer ... Matches on uri field in SIP.	7 years ago
Giuseppe Longo	424eead8c0	detect/sip.method: add sticky buffer ... Matches on uri field in SIP.	7 years ago
Giuseppe Longo	edc2a583a9	rust/sip: add SIP logger	7 years ago
Giuseppe Longo	2e975a0481	rust/sip: add parser for SIP protocol	7 years ago
Jason Ish	d79c23baa3	dns/detect: dns.opcode keyword ... Add a rule keyword, dns.opcode to match on the opcode flag found in the DNS request and response headers. Only exact matches are allowed with negation. Examples: - dns.opcode:4; - dns.opcode:!1;	7 years ago
Jeff Lucovsky	7808b946e3	detect/transform: add dotprefix keyword	7 years ago
Zach Kelly	caef8b5b38	protocol parser: rdp ... Initial implementation of feature 2314: 1. Add protocol parser for RDP 2. Add transactions for RDP negotiation 3. Add eve logging of transactions	7 years ago
Victor Julien	317376f59d	datasets: match on lists of data ... Datasets are sets/lists of data that can be accessed or added from the rule language. This patch implements 3 data types: 1. string (or buffer) 2. md5 3. sha256 The patch also implements 2 new rule keywords: 1. dataset 2. datarep The dataset keyword allows matching against a list of values to see if it exists or not. It can also add the value to the set. The set can optionally be stored to disk on exit. The datarep support matching/lookups only. With each item in the set a reputation value is stored and this value can be matched against. The reputation value is unsigned 16 bit, so values can be between 0 and 65535. Datasets can be registered in 2 ways: 1. through the yaml 2. through the rules The goal of this rules based approach is that rule writers can start using this without the need for config changes. A dataset is implemented using a thash hash table. Each dataset is its own separate thash.	7 years ago
Victor Julien	b286c14324	thash: generalize hash table as used in flow ... Thread safe hash table implementation based on the Flow hash, IP Pair hash and others. Hash is array of buckets with per bucket locking. Each bucket has a list of elements which also individually use locking.	7 years ago
Jeff Lucovsky	1930b1f504	eve/ftp: Log FTP transactions ... This changeset includes changes that 1. Add transaction support to the FTP parser 2. Support eve json logging of FTP transactions	7 years ago
Victor Julien	24f0092b72	detect: add ipv6.hdr sticky buffer ... Inspects IPv6 header and extension headers.	7 years ago
Victor Julien	4ac327f5b5	detect/ipv4: add ipv4.hdr sticky buffer	7 years ago
Henrik Lund Kramshoej	3519b011b7	decoder/vxlan: initial implementation of decoder	7 years ago
Victor Julien	ac694b089a	detect: add udp.hdr sticky buffer	7 years ago
Victor Julien	bdf53f449c	detect/tcp: rename tcp keyword files	7 years ago
Victor Julien	35be8385eb	detect: tcp.hdr sticky buffer ... Sticky buffer to inspect the TCP header.	7 years ago
Victor Julien	66648df099	detect: add tcp.mss keyword ... Allows matching on TCP option MSS. Syntax: tcp.mss:<value>; tcp.mss:<value1>-<value2>; tcp.mss:<op><value>; Operator can be: >, <.	7 years ago
Pierre Chifflier	9dfec7e734	SNMP: add the "snmp.pdu_type" detection keyword	7 years ago
Pierre Chifflier	e1dd19a0eb	SNMP: add the "snmp.community" detection keyword	7 years ago
Pierre Chifflier	aa608e0ca2	SNMP: add the "snmp.version" detection keyword	7 years ago
Pierre Chifflier	6fc7fc74cb	SNMP: add logger	7 years ago
Pierre Chifflier	2df840a8b8	Add SNMP (v1/v2c/v3) application layer	7 years ago
Mats Klepsland	0b489f329c	detect: add (mpm) keyword ja3s.string ... Match on JA3S string using ja3s.string keyword, e.g: alert tls any any -> any any (msg:"ja3s.string test"; ja3s.string; content:"10-11-12"; sid:1;)	7 years ago
Mats Klepsland	80cee50916	detect: add (mpm) keyword ja3s.hash ... Match on JA3S hash using ja3s.hash keyword, e.g: alert tls any any -> any any (msg:"ja3s.hash test"; ja3s.hash; content:"b26c652e0a402a24b5ca2a660e84f9d5"; sid:1;)	7 years ago
Mats Klepsland	ba857e9739	detect: add tls.certs keyword ... Add keyword to do "raw" matching on each of the certificates in the TLS certificate sticky buffer. Example: alert tls any any -> any any (msg:"tls.certs test"; tls.certs; \ content:"|01 02 03 04|"; sid:1;)	7 years ago
Victor Julien	84da0376fb	detect/http.host: rename file for consistency	7 years ago
Jeff Lucovsky	a8938f449d	logging: Anomaly logging ... This changeset adds anomaly logging to suricata for issue 2282. Anomaly logging is controlled via the `anomaly` section within eve-log. There is a single option -- `packethdr` -- for including the packet header in the anomaly.	7 years ago
Victor Julien	c2cb155ebb	rust/smb: rename files and code from RustSMB to SMB	7 years ago
Victor Julien	f30c05e684	smb: remove C implementation ... Now that Rust is mandatory it is obsolete. Ticket: #2849	7 years ago
Jason Ish	78b82ce6a5	dns-log: remove, not supported now that Rust is required ... The non-json line based DNS log is not supported with Rust only builds and has been scheduled for removal in Suricata 5.0. Redmine issue: https://redmine.openinfosecfoundation.org/issues/2297	7 years ago
Jeff Lucovsky	81c1af0887	detect: implement http {location,server} sticky buffer ... This implements inspection of the Server and Location buffer as a content sticky buffer.	7 years ago
Victor Julien	d6903e70c1	file-log: remove and add warning ... Feature was deprecated and scheduled for removal. Ticket #2376	8 years ago
Victor Julien	aab03dde87	mpm/ac-ks: rename files from -tile to -ks	8 years ago
Victor Julien	6fcd2db043	tile: remove files	8 years ago
Victor Julien	998f32f88c	detect/tls: consolidate validity code	8 years ago
Victor Julien	ccdafe6697	detect/http-server-body: move tests to tests/	8 years ago
Victor Julien	64987f36fb	detect/file-data: move tests into tests/	8 years ago
Victor Julien	9a8092249e	detect/http-client-body: move tests into tests/	8 years ago
Victor Julien	76fd666cad	detect/http_raw_header: move tests into tests/	8 years ago
Victor Julien	ab027cb481	detect/http_cookie: move tests into tests/	8 years ago
Victor Julien	2f342da048	detect/http_stat_code: move tests into tests/	8 years ago
Victor Julien	5dfba01b2e	detect/http_stat_msg: move tests to tests/	8 years ago
Victor Julien	b469938998	detect/http_raw_host: move raw into regular host logic	8 years ago
Victor Julien	dc43f35427	detect/http_host: move tests into tests/	8 years ago
Victor Julien	cb332b4cda	detect/http_method: move all tests into tests/	8 years ago
Victor Julien	0a405e27a0	detect/http_raw_uri: code reorganization ... Move registration into http_uri logic, move tests into the other uri tests. Switch to v2 mpm/inspect APIs.	8 years ago
Victor Julien	10e2731f18	detect/http-uri: move tests into tests/	8 years ago
Victor Julien	3111910fc6	detect/http_user_agent: move tests into tests/	8 years ago
Victor Julien	eb73008ccf	detect/transform: add to_sha1 keyword	8 years ago
Victor Julien	75f9c1ae9f	detect/transform: add to_md5 keyword	8 years ago
Victor Julien	0f1fc1f0c8	hash: move string hash funcs into util files	8 years ago
Eric Leblond	0e3b1eba86	util-binsearch: remove the files	8 years ago
Eric Leblond	3c566e0f89	util-bpf: introduce custom BPF compile functions ... We can't get error from pcap_compile_nopcap() so let's get our own function and output message.	8 years ago
Victor Julien	8b8270e732	eve/json: add common helper funcs ... Add simple helper funcs for option-less loggers	8 years ago
Jason Ish	35fd10bc2e	rust: app-layer detect template for rust parsers	8 years ago
Jason Ish	ee3aba9008	templates: C stub output for Rust logger	8 years ago
Jason Ish	96dc20abb1	templates: C stub template for Rust parser	8 years ago
Victor Julien	486054595a	detect/template2: template with prefilter (copy of ttl)	8 years ago
Victor Julien	555fb15ab4	tree: add 2-clause BSD licensed tree.h	8 years ago
Jacob Masen-Smith	ec77632e84	Adds WinDivert support to Windows builds ... Enables IPS functionality on Windows using the open-source (LGPLv3/GPLv2) WinDivert driver and API. From https://www.reqrypt.org/windivert-doc.html : "WinDivert is a user-mode capture/sniffing/modification/blocking/re-injection package for Windows Vista, Windows Server 2008, Windows 7, and Windows 8. WinDivert can be used to implement user-mode packet filters, packet sniffers, firewalls, NAT, VPNs, tunneling applications, etc., without the need to write kernel-mode code." - adds `--windivert [filter string]` and `--windivert-forward [filter string]` command-line options to enable WinDivert IPS mode. `--windivert[-forward] true` will open a filter for all traffic. See https://www.reqrypt.org/windivert-doc.html#filter_language for more information. Limitation: currently limited to `autofp` runmode. Additionally: - `tmm_modules` now zeroed during `RegisterAllModules` - fixed Windows Vista+ `inet_ntop` call in `PrintInet` - fixed `GetRandom` bug (nonexistent keys) on fresh Windows installs - fixed `RandomGetClock` building on Windows builds - Added WMI queries for MTU	8 years ago
Jason Ish	9210d8743b	rust/dhcp: Rust based DHCP decoder and logger. ... This is a DHCP decoder and logger written in Rust. Unlike most parsers, this one is stateless so responses are not matched up to requests by Suricata. However, the output does contain enough fields to match them up in post-processing. Rules are included to alert of malformed or truncated options.	8 years ago
Pierre Chifflier	1076c7cd47	Add krb5_err_code detection keyword	8 years ago
Pierre Chifflier	d6b9c0294a	Add krb5_cname and krb5_sname detection keywords	8 years ago
Pierre Chifflier	0bd81ff838	Add krb5_msg_type detection keyword	8 years ago
Pierre Chifflier	fd175f2bfb	Add logger for Kerberos 5 metadata	8 years ago
Pierre Chifflier	77f0c11c9e	Add Kerberos 5 application layer	8 years ago
Mats Klepsland	3e597512ea	app-layer-tls-handshake: remove since it is no longer needed ... Remove this file and all its content, since the functionality was reimplemented in app-layer-ssl.	8 years ago
Pierre Chifflier	d94346282c	Add logger for IKEv2	8 years ago
Pierre Chifflier	c99b9462d7	Add new parser: IKEv2 ... Add a new parser for Internet Key Exchange version (IKEv2), defined in RFC 7296. The IKEv2 parser itself is external. The embedded code includes the parser state and associated variables, the state machine, and the detection code. The parser looks the first two messages of a connection, and analyzes the client and server proposals to check the cryptographic parameters.	8 years ago
Mats Klepsland	195fa9d272	lua: add Ja3GetHash function ... Add Ja3GetHash() to return the content of the JA3 hash buffer from the TLS session. Example: function init (args) local needs = {} needs["protocol"] = "tls" return needs end function setup (args) filename = SCLogPath() .. "/ja3_hash.log" file = assert(io.open(filename, "a")) end function log (args) ja3_hash = Ja3GetHash() if ja3_hash == nil then return end file:write(ja3_hash .. "\n") file:flush() end function deinit (args) file:close() end In the (useless) example above, each JA3 hash is logged to a log file.	8 years ago
Mats Klepsland	6e23ae230b	detect: add (mpm) keyword ja3_string ... Match on JA3 string using ja3_string keyword, e.g: alert tls any any -> any any (msg:"JA3 string test"; ja3_string; content:"65-68-69-102"; sid:1;)	8 years ago
Mats Klepsland	6c7aacce9e	detect: add (mpm) keyword ja3_hash ... Match on JA3 hash using ja3_hash keyword, e.g: alert tls any any -> any any (msg:"JA3 hash test"; ja3_hash; content:"e7eca2baf4458d095b7f45da28c16c34"; sid:1;)	8 years ago
Mats Klepsland	0c16cd0120	app-layer-ssl: generate JA3 fingerprints ... Decode additional fields from the client hello packet and generate JA3 fingerprints.	8 years ago
Victor Julien	75d7c9d64a	rust/smb: initial support ... Implement SMB app-layer parser for SMB1/2/3. Features: - file extraction - eve logging - existing dce keyword support - smb_share/smb_named_pipe keyword support (stickybuffers) - auth meta data extraction (ntlmssp, kerberos5)	9 years ago
Victor Julien	4d1fa4aaf9	detect: bsize keyword ... Allows matching on stickybuffers. Like dsize, it allows matching on exact values, greater than and less than, and ranges. For streaming buffers, such as HTTP bodies, the final size of the body is only known at the end of the transaction.	9 years ago
Victor Julien	7f97fc40d5	detect/transform: initial to_sha256 implementation ... Takes input buffer and replaces it with hash value for that buffer. Hash value is in raw bytes.	9 years ago
Victor Julien	016d65fdf8	detect/transform: initial compress_whitespace implementation	9 years ago
Victor Julien	38ed6cd050	detect/transform: initial strip_whitespace implementation	9 years ago
Eric Leblond	3ae714d354	device-storage: introduce feature ... The capture method may have to store data depending related to the offloading so having a per interface storage via LiveDevice seems interesting.	9 years ago
Eric Leblond	06173267c6	af-packet: kernel bypass implementation ... This patch implements bypass capability for af-packet. The filter only bypass TCP and UDP in IPv4 and IPv6. It don't don't bypass IPv6 with extended headers. This patch also introduces a bypassed flow manager that takes care of timeouting the bypassed flows. It uses a 60 sec timeout on flow. As they are supposed to be active we can try that. If they are not active then we don't care to get them back in Suricata.	9 years ago
Eric Leblond	91e1256b01	af-packet: add support for eBPF cluster and filter ... This patch introduces the ebpf cluster mode. This mode is using an extended BPF function that is loaded into the kernel and provide the load balancing. An example of cluster function is provided in the ebpf subdirectory and provide ippair load balancing function. This is a function which uses the same method as the one used in autofp ippair to provide a symetrical load balancing based on IP addresses. A simple filter example allowing to drop IPv6 is added to the source. This patch also prepares the infrastructure to be able to load and use map inside eBPF files. This will be used later for flow bypass.	9 years ago
Giuseppe Longo	7b23d30542	util-file-decompression: add swf decompression API ... This adds a new module that permits to decompress swf file compressed with zlib or lzma algorithms. The API that performs decompression will take a compressed buffer and build a new decompressed buffer following the FWS format which represents an uncompressed file. The maximum buffer that can be created is up to 50mb.	9 years ago
Jason Ish	572a62f35a	output-json-vars: rename to metadata ... No functional change, just rename of files and functions to reflect the metadata event type now used.	9 years ago
Clement Galland	b9cf49e933	rust/tftp: add tftp parsing and logging ... TFTP parsing and logging written in Rust. Log on eve.json the type of request (read or write), the name of the file and the mode. Example of output: "tftp":{"packet":"read","file":"rfc1350.txt","mode":"octet"}	9 years ago
Victor Julien	cf2feeecf4	detect/prefilter: redo profiling	9 years ago
Jason Ish	4a97315057	filestore v2 - initial version ... Filestore v2 is starts as a copy of log-filestore with the following changes. - NSS is required as file names as based on the SHA256. - Work/tmp files are stored in a temp. directory, then moved into a directory tree where the directory names are the first 2 characters of the hex SHA256. - Removes the need for a waldo file or pid in the filenames.	9 years ago
Victor Julien	746638b220	cuda: remove ... Remove CUDA support as it has been broken for a long time. Ticket #2382.	9 years ago