aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
9,627 Commits
7 Branches
155 Tags
200 MiB
master
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'c0ab45aa6f'
${ noResults }
Commit Graph

9627 Commits (c0ab45aa6fbe1a299facf45e34ba2bcb3d76ce75)
 

Author SHA1 Message Date
Danny Browning c0ab45aa6f source-pcap-file: Pcap File Init Failure Handling (#1694) 
Better handle case where pcap file receive thread fails to initialize. Allow
initialize to complete, but terminate the thread quickly. Delay exiting
unix socket runmode as late as possible.
 6 years ago
Victor Julien 55ab112e77 app-layer/pd: minor code cleanup 6 years ago
Victor Julien 2cf0a34e66 app-layer/pd: set offset and depth in mpm 6 years ago
Victor Julien 7cea1e4181 mpm/hs: track maxdepth 6 years ago
Alexander Gozman 928fe1b859 Bug 2857: NFQ ASAN 'heap-use-after-free' error. 
Global NFQ contexts were not freed properly causing
'use-after-free' error. Moving contexts cleanup to a
separate NFQContextsCleanup() and calling it from
GlobalsDestroy(), like it's done for AFPacket, solves
the problem.
 6 years ago
Jeff Lucovsky 74cd6a9ee8 doc: add http.location and http.server 6 years ago
Jeff Lucovsky 81c1af0887 detect: implement http {location,server} sticky buffer 
This implements inspection of the Server and Location buffer as a
content sticky buffer.
 6 years ago
Max Fillinger 081fdc6804 pcap-log: Don't leak memory in LZ4 error paths 6 years ago
Pascal Delalande bde65467a9 doc: add ssh protocol in eve log section 6 years ago
Alexander Bluhm 0ea3fa92a8 Avoid use-after-free during pid file cleanup. 
In case the pid file is given in the config file, the file name is
stored in volatile memory.  Removal of the pid file happens after
cleanup of config memory.  Create a copy of the name which will be
freed after the pid file has been removed.
 6 years ago
jason taylor b98c28a60d configure.ac: update lzma check and misc doc 
* the lzma check during configure wasn't properly displaying the
additional information on how to install if --enable-lzma was passed
but lzma devel files were not present

* updated additional information blocks to include distribution
package names

* minor formatting updates to add quotes around variables

Signed-off-by: jason taylor <jtfas90@gmail.com>
 6 years ago
Giuseppe Longo c63fea8d0a reputation: remove dead code 
This removes some code commented long time ago.
 6 years ago
Giuseppe Longo 6b2a5ef21e reputation: declare max value as constant 6 years ago
Victor Julien f7a41412d6 smb1: fix NT create andx records filename parsing 
Use file name parsing routines that take unicode into account
and consider padding bytes as well.
 6 years ago
Wesley van der Ree cc50908f8d smb: fix NT create filename parsing 
parse_smb_create_andx_request_record skipped 1 byte too much before
the filename.

Fixes: #2894
 6 years ago
Victor Julien 2622006faa stream: minor test cleanups 6 years ago
Victor Julien 636fb8d387 mpm: track maxdepth 
Track max depth setting per MpmCtx.

To make sure the data structure doesn't increase in size change global
bool to use a flags field.
 6 years ago
Victor Julien 55e5d50496 detect/flow: optimize flow check 
Flow direction doesn't need explicit checking as the rule groups (sgh)
are already per direction. So if a rule sets only flow:to_server or
flow:to_client, we can avoid adding a sigmatch to the signature.
 6 years ago
Victor Julien 119db92c99 detect/tag: minor code cleanup 6 years ago
Victor Julien 6bf35a42f1 detect/mark: use postmatch instead of tag list 
Keep the tag list for just tags. Post match list is better so the
keyword also works with pass and noalert rules.
 6 years ago
Victor Julien 4dbf600d64 detect/mark: minor code cleanups 6 years ago
Victor Julien bd31e4e332 detect: packet match micro optimization 6 years ago
Victor Julien 7497c633c4 detect/filestore: use postmatch callback 6 years ago
Victor Julien 065c3379ed detect/replace: implement post-match 
Implement replace executor as a post match callback so that it
is only considered if there actually is a replace keyword in use.
 6 years ago
Victor Julien 00beeef031 eve/flow/netflow: log correct tulpe on reversed flows 6 years ago
Victor Julien 9c241fa32c stream: use flow/packet swap logic for SYN/ACK midstream 6 years ago
Victor Julien 2f1ace64c6 flow: on timeout, consider reverse flows for pseudo packets 6 years ago
Victor Julien 4d6e6b8270 flow: introduce flow swap support 6 years ago
Victor Julien 0225ab3828 common: introduce flags and var swapping macros 6 years ago
Victor Julien d307cfad05 packet: add 'swap' function to reverse direction 6 years ago
Victor Julien d5baac3f85 detect/flow: don't require flow for direction options 
Flow isn't directly used for direction checks, so don't require
a flow to be present.
 6 years ago
Victor Julien c1dcc26965 detect/parse: improve direction setting on sigs 
Only set both directions if no direction has been explicitly set before.
 6 years ago
Victor Julien 9a14cb252d detect/bytetest: debug cleanup 6 years ago
Victor Julien cb9b27ab89 app-layer/pd: free memory 6 years ago
Victor Julien 39725907d6 detect: remove BUG_ON from packet path 6 years ago
Victor Julien 042f806362 detect: fix match array reset 
Fix match array reset depending on prefilter matches for the
current run. If there were none, the match array of the previous
packet was used. This could lead to inspection of rules from the
wrong rule group.
 6 years ago
Victor Julien 05d9527d01 app-layer/profile: fix udp protocol detection profiling 6 years ago
Victor Julien f44bbd71f5 app-layer/udp: micro optimization 6 years ago
Jeff Lucovsky 6123d77527 Fix memory leak with TOS handling 
Use `pcre_copy_substring` to avoid memory allocations when parsing
TOS values.
 6 years ago
jason taylor 1f3dd85216 pfring: update bpf error handling to be consistent 
* updated bpf error handling to be consistent with af-packet
* minor internal doc updates

Signed-off-by: jason taylor <jtfas90@gmail.com>
 6 years ago
Giuseppe Longo d0e2420faf reputation: move unit tests 
UTs are moved inside "test/" directory,
and reworked to improve readability and reduce lines of code.
 6 years ago
Giuseppe Longo 389227d899 detect-iprep: fix memory leaks 
Loading rules with iprep keyword cause
memory leaks due to missing frees.

Direct leak of 8 byte(s) in 4 object(s) allocated from:
    #0 0x7f81c862bd28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
    #1 0x7f81c6afea69 in pcre_get_substring (/lib/x86_64-linux-gnu/libpcre.so.3+0x27a69)
    #2 0x43206f7420676e68  (<unknown module>)

SUMMARY: AddressSanitizer: 8 byte(s) leaked in 4 allocation(s).
 6 years ago
Eric Leblond 58b804f7d2 flow-bypass: set thread name to FB 6 years ago
Eric Leblond abe2836caf suricata.yaml: fix name of encryption-handling var 6 years ago
Jason Ish a69afd5cf9 autoconf/python: check for distutils 
Require distutils to install the Python tools. Update the logic
to only install suricatactl (and suricatasc) if Python and
distutils are found. Suricata-Update will only be installed if
bundled, and python-distutils and python-yaml are found.
 6 years ago
Jason Ish a228986caa autoconf: prefer python 3 over python 2 
When looking for Python, prefer "python3" over "python2" and
"python".

Also add information about the Python path and version to the
./configure summary.

Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2808
 6 years ago
Victor Julien 69d0d484eb af-packet: don't use anonymous unions 6 years ago
Victor Julien acd9e1c2e7 af-packet: fix v3 code using v2 union member 6 years ago
Victor Julien 96c6cf98d5 doc/userguide: add 3rd-party-integration to dist 6 years ago
Pierre Chifflier f90733fe3f rust/ikev2: fix events not being raised in first message 
The `set_event` function requires that the transaction is already
inserted, or the event set is silently lost.
When parsing first IKEv2 message, first insert transaction, prepare
values, and borrow back inserted transaction to update it.
 6 years ago