aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
7,868 Commits
7 Branches
155 Tags
192 MiB
master
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'aca27ff383'
${ noResults }
Commit Graph

7868 Commits (aca27ff383d74f0eaf78f48d89f88f97f1285dd1)
 

Author SHA1 Message Date
Victor Julien 1ee32da2ca detect-engine: memory handling of sm_lists 
For lists that are registered multiple times, like http_header and
http_cookie, making the engines owner of the lists is complicated.
Multiple engines in a sig may be pointing to the same list. To
address this the 'free' code needs to be extra careful about not
double freeing, so it takes an approach to first fill an array
of the to-free pointers before freeing them.
 8 years ago
Victor Julien f81b90dacd detect: when freeing sig also see sm in inspect engine 8 years ago
Victor Julien 2f87c975d4 detect: add SigMatch arg to inspect functions 8 years ago
Victor Julien cf42fbf51f detect: use InspectEngineFuncPtr in inspect engines 
Replace explicit function pointer use by InspectEngineFuncPtr typedef
 8 years ago
Victor Julien 5f7e096be4 detect: shrink inspect engine by using 'id' as state flag 8 years ago
Victor Julien 715ff60087 detect: remove unused SIG_FLAG_INIT_PAYLOAD init_flag 8 years ago
Victor Julien 859cb89c7e detect alert/threshold/tag: sm_list -> sm_array 8 years ago
Victor Julien 99580487e5 detect: fix file_data / http_server_body tests 8 years ago
Victor Julien faadec0d7f detect file_data: improve error messages 8 years ago
Victor Julien e2c6e1be33 detect-parse: set ipprotos earlier 
A high level proto like HTTP implies TCP. However this wasn't set
until after all the parsing was complete which means that keywords
couldn't test if the ipproto matched.

This patch populates the ipprotos right when the higher level proto
is parsed.
 8 years ago
Victor Julien 5e0b0eea4b detect: remove unused flags 8 years ago
Victor Julien 39613778cd detect: make setup/free/match funcs static where possible 8 years ago
Victor Julien bfd4bc8233 detect: constify Signature/SigMatch use at runtime 8 years ago
Victor Julien a44da9f5cb detect: simplify SIG_FLAG_STATE_MATCH set logic 8 years ago
Victor Julien be3ee5330f detect: remove alproto from keyword registration 
It was already marked as depricated and no longer in use anywhere.
 8 years ago
Victor Julien 113a238e90 Open 4.0 development branch 8 years ago
Victor Julien e072a10f64 changelog: update for 3.2.1 release 8 years ago
Victor Julien 71710f088e dns: fix outputs with 0-len A/AAAA records 8 years ago
Victor Julien 20990f7a7e dns: fix out of bounds read 
On a zero size A or AAAA record, 4 or 16 bytes would still be
read.

Found with AFL+ASAN.
 8 years ago
Jason Ish 4a04f814b1 defrag - take protocol into account during re-assembly 
The IP protocol was not being used to match fragments with
their packets allowing a carefully constructed packet
with a different protocol to be matched, allowing re-assembly
to complete, creating a packet that would not be re-assembled
by the destination host.
 8 years ago
Victor Julien 292baf0872 afl: add ethernet and erspan entry points 8 years ago
Victor Julien 49c41fc79e afl: clean up commandline parsing 8 years ago
Victor Julien b56b04f84c afl: pass a packet queue to decoder calls 8 years ago
Jason Ish 35488eefda afl: set the packet data so pktlen gets set 8 years ago
Victor Julien 322c260749 afl: minimalistic script to start AFL fuzzers 
in suricata source dir:

mkdir afl
cd afl
bash ../scripts/afl/runafl.sh decoder-ipv4
 8 years ago
Victor Julien 6bd265258e afl: util script to list crashed series 8 years ago
Victor Julien fbd69729aa afl: improve packet fuzz testing 
Due to the use of AFL_LOOP and initialization/deinit outside of it,
part of the fuzzing relied on the global 'state' in flow and defrag.
Because of this crashes that were found could not be reproduced. The
saved crash input was only the last in the series.

This patch addresses that. It requires a new output directory 'dump'
where the packet fuzzers will store all their input. If the AFL_LOOP
fails the files will not be removed and this 'serie' can be read
again for reproducing the issue.

e.g.: AFL would work with:
--afl-decoder-ppp=@@

and after a crash is found the produced serie can be read with:
--afl-decoder-ppp-serie=1486656919-514163

The series have a timestamp as name and a suffix that controls the
order in which the files will be 'replayed' in Suricata.
 8 years ago
Victor Julien 923d93f314 afl: add decoder ipv4 option 8 years ago
Sascha Steinbiss 5e96977983 mpm-ac: fix integer overflow on allocation 
The size of a memory buffer to be allocated was kept in a signed int
instead of a size_t, leading to an overflow when large lists of long
and diverse patterns cause the amount of AC states to blow up (>2GB).
Fixes Redmine issues #1827 and #1843.

Signed-off-by: Sascha Steinbiss <sascha@steinbiss.name>
 8 years ago
Sascha Steinbiss b25b067d93 alert: silence compiler type warning 
The `ts_ecr' and `ts_val' struct fields are integer types, not
pointers. This leads GCC 6.3.0 to complain about comparisons to
NULL.

Signed-off-by: Sascha Steinbiss <sascha@steinbiss.name>
 8 years ago
Victor Julien 86222428dd detect: don't run IP inspection on non-IP packets 
The code to get the rule group (sgh) would return the group for
IP proto 0 instead of nothing. This lead to certain types of rules
unintentionally matching (False Positive).

Since the packets weren't actually IP, the logged alert records
were missing the IP header.

Bug #2017.
 8 years ago
Victor Julien 4683b0e662 afl: fix ENIP, switch DNS to UDP and add --afl-dnstcp* 8 years ago
Victor Julien c89ce17017 afl: with -Wshadow issues 8 years ago
Eric Leblond ecf59be413 af-packet: add VLAN header when needed in IPS mode 
When packet is coming from a real ethernet card, the kernel is
stripping the vlan header and delivering a modified packet so
we need to insert the VLAN header back before sending the packet
on the wire.

To do so, we pass an option to the raw socket to add a reserve
before the packet data. It will get Suricata some head room to
to move the ethernet addresses before there actual place and
and insert the VLAN header in the correct place.

We get VLAN info from the ring buffer as the call of AFPWrite is
always done in the release function so we still have access to the
memory.
 8 years ago
Eric Leblond f407d77016 detect-tls-sni: add link to documentation 8 years ago
Eric Leblond c357dafed9 doc: document the tls_sni keyword 8 years ago
Eric Leblond 1af713d67d detect-tls: add url field pointing to doc 8 years ago
Eric Leblond 0695ad4bf0 detect-xbits: set documentation URL 8 years ago
Jason Ish 21bbac5648 dns-log: log requests even when there is no response 
The JSON logger had already been updated to handle
transactions without a response. Apply the same logic
to the older dns-log where a logger is registered
for each direction.

Fixes issue 2012.
 8 years ago
Andreas Herz d8b5bf9bc6 app-layer-parsing: detect malformed input 
If the app-layer-parsing has a very long content it exceeds the maximum
defined in "alproto_name". This adds a check for the too long content
before it will be passed to "strlcpy" and logs an error.
 8 years ago
Victor Julien f91d490d25 detect: remove unused flow_locked hint 8 years ago
Victor Julien 31a96d5a79 detect: make tenant loading less verbose 8 years ago
Victor Julien addf64f1f7 profiling: fix memory leaks 8 years ago
Victor Julien 6e876182d7 detect: use TLS_STATE_CERT_READY in cert inspect 8 years ago
Victor Julien 473dae75b5 tls: introduce 'cert ready' state 8 years ago
Victor Julien 15accc86c9 common: add BIT_U8 macro 8 years ago
Sascha Steinbiss e6044aaf1c mpm/spm: check for SSSE3 and enable/disable HS 
The new Hyperscan 4.4 API provides a function to check for SSSE3
presence at runtime. This allows us to fall back to non-Hyperscan
matchers on systems without SSSE3 even when the suricata executable
is built with Hyperscan support. Addresses Redmine issue #2010.

Signed-off-by: Sascha Steinbiss <sascha@steinbiss.name>
Tested-by: Arturo Borrero Gonzalez <arturo@debian.org>
 8 years ago
Victor Julien a0580d8805 stream: initialize stream segment pool from mtu 
If segments section in the yaml is ommitted (default) or when the
pool size is set to 'from_mtu', the size of the pool will be MTU
minus 40. If the MTU couldn't be determined, it's assumed to be
1500, so the segment size for the bool will be 1460.
 8 years ago
Victor Julien 1ba15d3721 mtu: track max mtu for capture devices 8 years ago
Victor Julien 7ca466c598 shutdown: remove pid file last 8 years ago