aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
13,160 Commits
8 Branches
173 Tags
179 MiB
main
main-7.0.x
main-8.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'ced96a8aad'
${ noResults }
Commit Graph

603 Commits (ced96a8aadd8a9a4ce3d8d689ac53f7eedbbe8e9)

Author SHA1 Message Date
Jeff Lucovsky ac01adc260 detect: Add utility module for byte var handling 6 years ago
Emmanuel Thompson 275f6ae96f detect/asn1: Remove asn1 C parser 
- In favor of rust parser
 6 years ago
Vadym Malakhatko 8a8212d0f6 lua: add functions to get hassh parameters 6 years ago
Vadym Malakhatko 216a75c522 detect: add (mpm) hassh keywords 
Match on Hassh using ssh.hassh, ssh.hassh.server, ssh.hassh.string, ssh.hassh.server.string keywords, e.g:

alert ssh any any -> any any (msg:"match SSH hash"; ssh.hassh; content:"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; sid:1000010;)
alert ssh any any -> any any (msg:"match SSH hash-server"; ssh.hassh.server; content:"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; sid:1000020;)
alert ssh any any -> any any (msg:"match SSH hash-string"; ssh.hassh.string; content:"none,zlib@openssh.com,zlib"; sid:1000030;)
alert ssh any any -> any any (msg:"match SSH hash-server-string"; ssh.hassh.server.string; content:"umac-64-etm@openssh.com,umac-128-etm@openssh.com,"; sid:1000040;)
 6 years ago
Jeff Lucovsky 66d15710b8 transform/pcrexform: Add pcrexform source files 6 years ago
Jason Ish e26718aea3 drop-log: remove drop log (deprecated) 
Remove the old style line based drop log.

Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2381
 6 years ago
Jason Ish ca88e4d0e3 filestore v1: remove 
File store v1 has been deprecated and was scheduled for removal
by June 2020.

Log an error if a file-store configuration is loaded without
version set to 2.
 6 years ago
Victor Julien 1893e40e79 build: don't limit C std to c99 (gnu99) 
Now that C11 atomics and thread local storage are supported, the
compiler can figure out what version to use.
 6 years ago
Victor Julien 3b877929e3 util/mem: move most logic to functions 
Reduce macro use and simplify code. Also reduces compiled code
size.
 6 years ago
Victor Julien 328a94206e decode/hdlc: initial support 6 years ago
Victor Julien 3d969a1c7d build: wrap fuzz targets in guard to fix 'make tags' 6 years ago
Philippe Antoine 293eebd999 fuzz: remove obsolete AFL code 6 years ago
Philippe Antoine bf60959d84 fuzz: simpler way to force usage of CXX linker 6 years ago
Philippe Antoine 440bb4d600 fuzz: remove decodeder fuzz target 
As we removed decodeder function
 6 years ago
Pierre Chifflier 1d9f37a60e DER: remove the C parser for DER 6 years ago
Philippe Antoine 600b0d7c55 fuzz: adds eight fuzz targets 
And ways to compile them with enable-fuzztargets at configure time
Adds utility function in util-unittest-helper
 6 years ago
Frank Honza 1c8943dedd add RFB parser 
This commit adds support for the Remote Framebuffer Protocol (RFB) as
used, for example, by various VNC implementations. It targets the
official versions 3.3, 3.7 and 3.8 of the protocol and provides logging
for the RFB handshake communication for now. Logged events include
endpoint versions, details of the security (i.e. authentication)
exchange as well as metadata about the image transfer parameters.
Detection is enabled using keywords for:

 - rfb.name: Session name as sticky buffer
 - rfb.sectype: Security type, e.g. VNC-style challenge-response
 - rfb.secresult: Result of the security exchange, e.g. OK, FAIL, ...

The latter could be used, for example, to detect brute-force attempts
on open VNC servers, while the name could be used to map unwanted VNC
sessions to the desktop owners or machines.

We also ship example EVE-JSON output and keyword docs as part of the
Sphinx source for Suricata's RTD documentation.
 6 years ago
Philippe Antoine 1cd314c500 detect: adds icmpv6.mtu keyword 6 years ago
Philippe Antoine 75ec528384 detect: adds utility file for uint keywords 6 years ago
Jason Ish 688874582a dhcp: remove C app-layer-dhcp wrapper 
This just wrapped the Rust function to register the parse,
so instead just call the Rust function directly to remove
the C wrapper, and the 2 C files.
 6 years ago
Jason Ish a0e3e2d7b4 dns: register parsers from Rust 
And port the C DNS tests to Rust.
 6 years ago
Jason Ish 1b44f839e6 dns: cleanup: move event callbacks into Rust 
Remove app-layer-dns-common.c as its no longer needed.
 6 years ago
Philippe Antoine 8396333493 detect: adds icmpv6.hdr keyword 6 years ago
Jason Ish d86973b386 unified2: remove deprecated output unified2 
Ticket 2385:
https://redmine.openinfosecfoundation.org/issues/2385
 7 years ago
Jeff Lucovsky f83b199f2a feature: feature tracking services 7 years ago
Philippe Antoine af2a689a99 init: move main to a separate file 
so as to reuse code from suricata.c with fuzz targets
 7 years ago
Danny Browning b573c16dd5 build: cbindgen 
Rust headers are now generated using cbindgen. If cbindgen is present, they can
be generated during dist, otherwise they will be available for builds.
 7 years ago
Victor Julien 1633744fcb nfq: remove unused queue handler type 7 years ago
Victor Julien f66e12f7af dns: rename rust files and funcs 7 years ago
Victor Julien b4318a11e3 rust: remove build system HAVE_RUST guards 7 years ago
Giuseppe Longo e06291922f detect/sip.response_line: add sticky buffer 
Matches on response line field in SIP.
 7 years ago
Giuseppe Longo 17de4a8023 detect/sip.request_line: add sticky buffer 
Matches on request line field in SIP.
 7 years ago
Giuseppe Longo 8939ece538 detect/sip.stat_msg: add sticky buffer 
Matches on status msg field in SIP.
 7 years ago
Giuseppe Longo bd2219cac6 detect/sip.stat_code: add sticky buffer 
Matches on status code field in SIP.
 7 years ago
Giuseppe Longo 8454122eb2 detect/sip.protocol: add sticky buffer 
Matches on protocol field in SIP.
 7 years ago
Giuseppe Longo 2661c5b298 detect/sip.uri: add sticky buffer 
Matches on uri field in SIP.
 7 years ago
Giuseppe Longo 424eead8c0 detect/sip.method: add sticky buffer 
Matches on uri field in SIP.
 7 years ago
Giuseppe Longo edc2a583a9 rust/sip: add SIP logger 7 years ago
Giuseppe Longo 2e975a0481 rust/sip: add parser for SIP protocol 7 years ago
Jason Ish d79c23baa3 dns/detect: dns.opcode keyword 
Add a rule keyword, dns.opcode to match on the opcode flag
found in the DNS request and response headers.

Only exact matches are allowed with negation.

Examples:
  - dns.opcode:4;
  - dns.opcode:!1;
 7 years ago
Jeff Lucovsky 7808b946e3 detect/transform: add dotprefix keyword 7 years ago
Zach Kelly caef8b5b38 protocol parser: rdp 
Initial implementation of feature 2314:
1. Add protocol parser for RDP
2. Add transactions for RDP negotiation
3. Add eve logging of transactions
 7 years ago
Victor Julien 317376f59d datasets: match on lists of data 
Datasets are sets/lists of data that can be accessed or added from
the rule language.

This patch implements 3 data types:

1. string (or buffer)
2. md5
3. sha256

The patch also implements 2 new rule keywords:

1. dataset
2. datarep

The dataset keyword allows matching against a list of values to see if
it exists or not. It can also add the value to the set. The set can
optionally be stored to disk on exit.

The datarep support matching/lookups only. With each item in the set a
reputation value is stored and this value can be matched against. The
reputation value is unsigned 16 bit, so values can be between 0 and 65535.

Datasets can be registered in 2 ways:

1. through the yaml
2. through the rules

The goal of this rules based approach is that rule writers can start using
this without the need for config changes.

A dataset is implemented using a thash hash table. Each dataset is its own
separate thash.
 7 years ago
Victor Julien b286c14324 thash: generalize hash table as used in flow 
Thread safe hash table implementation based on the Flow hash, IP Pair
hash and others.

Hash is array of buckets with per bucket locking. Each bucket has a
list of elements which also individually use locking.
 7 years ago
Jeff Lucovsky 1930b1f504 eve/ftp: Log FTP transactions 
This changeset includes changes that
1. Add transaction support to the FTP parser
2. Support eve json logging of FTP transactions
 7 years ago
Victor Julien 24f0092b72 detect: add ipv6.hdr sticky buffer 
Inspects IPv6 header and extension headers.
 7 years ago
Victor Julien 4ac327f5b5 detect/ipv4: add ipv4.hdr sticky buffer 7 years ago
Henrik Lund Kramshoej 3519b011b7 decoder/vxlan: initial implementation of decoder 7 years ago
Victor Julien ac694b089a detect: add udp.hdr sticky buffer 7 years ago
Victor Julien bdf53f449c detect/tcp: rename tcp keyword files 7 years ago
Victor Julien 35be8385eb detect: tcp.hdr sticky buffer 
Sticky buffer to inspect the TCP header.
 7 years ago
Victor Julien 66648df099 detect: add tcp.mss keyword 
Allows matching on TCP option MSS.

Syntax:

    tcp.mss:<value>;
    tcp.mss:<value1>-<value2>;
    tcp.mss:<op><value>;

Operator can be: >, <.
 7 years ago
Pierre Chifflier 9dfec7e734 SNMP: add the "snmp.pdu_type" detection keyword 7 years ago
Pierre Chifflier e1dd19a0eb SNMP: add the "snmp.community" detection keyword 7 years ago
Pierre Chifflier aa608e0ca2 SNMP: add the "snmp.version" detection keyword 7 years ago
Pierre Chifflier 6fc7fc74cb SNMP: add logger 7 years ago
Pierre Chifflier 2df840a8b8 Add SNMP (v1/v2c/v3) application layer 7 years ago
Mats Klepsland 0b489f329c detect: add (mpm) keyword ja3s.string 
Match on JA3S string using ja3s.string keyword, e.g:

  alert tls any any -> any any (msg:"ja3s.string test";
      ja3s.string; content:"10-11-12"; sid:1;)
 7 years ago
Mats Klepsland 80cee50916 detect: add (mpm) keyword ja3s.hash 
Match on JA3S hash using ja3s.hash keyword, e.g:

  alert tls any any -> any any (msg:"ja3s.hash test";
      ja3s.hash; content:"b26c652e0a402a24b5ca2a660e84f9d5"; sid:1;)
 7 years ago
Mats Klepsland ba857e9739 detect: add tls.certs keyword 
Add keyword to do "raw" matching on each of the certificates in the
TLS certificate sticky buffer.

Example:
  alert tls any any -> any any (msg:"tls.certs test"; tls.certs; \
          content:"|01 02 03 04|"; sid:1;)
 7 years ago
Victor Julien 84da0376fb detect/http.host: rename file for consistency 7 years ago
Jeff Lucovsky a8938f449d logging: Anomaly logging 
This changeset adds anomaly logging to suricata for issue 2282.

Anomaly logging is controlled via the `anomaly` section within eve-log.
There is a single option -- `packethdr` -- for including the packet header
in the anomaly.
 7 years ago
Victor Julien c2cb155ebb rust/smb: rename files and code from RustSMB to SMB 7 years ago
Victor Julien f30c05e684 smb: remove C implementation 
Now that Rust is mandatory it is obsolete.

Ticket: #2849
 7 years ago
Jason Ish 78b82ce6a5 dns-log: remove, not supported now that Rust is required 
The non-json line based DNS log is not supported with Rust only
builds and has been scheduled for removal in Suricata 5.0.

Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2297
 7 years ago
Jeff Lucovsky 81c1af0887 detect: implement http {location,server} sticky buffer 
This implements inspection of the Server and Location buffer as a
content sticky buffer.
 7 years ago
Victor Julien d6903e70c1 file-log: remove and add warning 
Feature was deprecated and scheduled for removal.

Ticket #2376
 8 years ago
Victor Julien aab03dde87 mpm/ac-ks: rename files from -tile to -ks 8 years ago
Victor Julien 6fcd2db043 tile: remove files 8 years ago
Victor Julien 998f32f88c detect/tls: consolidate validity code 8 years ago
Victor Julien ccdafe6697 detect/http-server-body: move tests to tests/ 8 years ago
Victor Julien 64987f36fb detect/file-data: move tests into tests/ 8 years ago
Victor Julien 9a8092249e detect/http-client-body: move tests into tests/ 8 years ago
Victor Julien 76fd666cad detect/http_raw_header: move tests into tests/ 8 years ago
Victor Julien ab027cb481 detect/http_cookie: move tests into tests/ 8 years ago
Victor Julien 2f342da048 detect/http_stat_code: move tests into tests/ 8 years ago
Victor Julien 5dfba01b2e detect/http_stat_msg: move tests to tests/ 8 years ago
Victor Julien b469938998 detect/http_raw_host: move raw into regular host logic 8 years ago
Victor Julien dc43f35427 detect/http_host: move tests into tests/ 8 years ago
Victor Julien cb332b4cda detect/http_method: move all tests into tests/ 8 years ago
Victor Julien 0a405e27a0 detect/http_raw_uri: code reorganization 
Move registration into http_uri logic, move tests into the other uri
tests. Switch to v2 mpm/inspect APIs.
 8 years ago
Victor Julien 10e2731f18 detect/http-uri: move tests into tests/ 8 years ago
Victor Julien 3111910fc6 detect/http_user_agent: move tests into tests/ 8 years ago
Victor Julien eb73008ccf detect/transform: add to_sha1 keyword 8 years ago
Victor Julien 75f9c1ae9f detect/transform: add to_md5 keyword 8 years ago
Victor Julien 0f1fc1f0c8 hash: move string hash funcs into util files 8 years ago
Eric Leblond 0e3b1eba86 util-binsearch: remove the files 8 years ago
Eric Leblond 3c566e0f89 util-bpf: introduce custom BPF compile functions 
We can't get error from pcap_compile_nopcap() so let's get our
own function and output message.
 8 years ago
Victor Julien 8b8270e732 eve/json: add common helper funcs 
Add simple helper funcs for option-less loggers
 8 years ago
Jason Ish 35fd10bc2e rust: app-layer detect template for rust parsers 8 years ago
Jason Ish ee3aba9008 templates: C stub output for Rust logger 8 years ago
Jason Ish 96dc20abb1 templates: C stub template for Rust parser 8 years ago
Victor Julien 486054595a detect/template2: template with prefilter (copy of ttl) 8 years ago
Victor Julien 555fb15ab4 tree: add 2-clause BSD licensed tree.h 8 years ago
Jacob Masen-Smith ec77632e84 Adds WinDivert support to Windows builds 
Enables IPS functionality on Windows using the open-source
(LGPLv3/GPLv2) WinDivert driver and API.

From https://www.reqrypt.org/windivert-doc.html : "WinDivert is a
user-mode capture/sniffing/modification/blocking/re-injection package
for Windows Vista, Windows Server 2008, Windows 7, and Windows 8.
WinDivert can be used to implement user-mode packet filters, packet
sniffers, firewalls, NAT, VPNs, tunneling applications, etc., without
the need to write kernel-mode code."

- adds `--windivert [filter string]` and `--windivert-forward [filter
    string]` command-line options to enable WinDivert IPS mode.
    `--windivert[-forward] true` will open a filter for all traffic. See
    https://www.reqrypt.org/windivert-doc.html#filter_language for more
    information.

Limitation: currently limited to `autofp` runmode.

Additionally:
- `tmm_modules` now zeroed during `RegisterAllModules`
- fixed Windows Vista+ `inet_ntop` call in `PrintInet`
- fixed `GetRandom` bug (nonexistent keys) on fresh Windows installs
- fixed `RandomGetClock` building on Windows builds
- Added WMI queries for MTU
 8 years ago
Jason Ish 9210d8743b rust/dhcp: Rust based DHCP decoder and logger. 
This is a DHCP decoder and logger written in Rust. Unlike most
parsers, this one is stateless so responses are not matched
up to requests by Suricata. However, the output does contain
enough fields to match them up in post-processing.

Rules are included to alert of malformed or truncated options.
 8 years ago
Pierre Chifflier 1076c7cd47 Add krb5_err_code detection keyword 8 years ago
Pierre Chifflier d6b9c0294a Add krb5_cname and krb5_sname detection keywords 8 years ago
Pierre Chifflier 0bd81ff838 Add krb5_msg_type detection keyword 8 years ago
Pierre Chifflier fd175f2bfb Add logger for Kerberos 5 metadata 8 years ago