aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
19,751 Commits
8 Branches
174 Tags
255 MiB
main
main-8.0.x
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.7
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'd6f0597c17'
${ noResults }
Commit Graph

131 Commits (d6f0597c17e2ea50a3de50a8ce3cd6b7a9e25e68)

Author SHA1 Message Date
Jeff Lucovsky 15a068258d detect/mpm: use content after must_succeed as fast_pattern 
transform_result stopped fast_pattern selection, and the validator
rejected fast_pattern on its buffer. Content after must_succeed only
matches when the transform succeeded, and the prefilter scans the same
transformed bytes, so "http.uri; from_base64; transform_result:
must_succeed; content:"evil";" lost its only fast pattern and ran on
every HTTP transaction.

Let content after must_succeed be the fast pattern, and accept
fast_pattern there.

Issue: 7313
Issue: 7114
 7 days ago
Jeff Lucovsky a9d70166ec detect/mpm: honor absent in every fast_pattern pass 
RetrieveFPForSig stopped at absent and transform_result only while
marking candidate lists; the max_len pass and GetMpmForList walked
every instance of the chosen list to its end. Repeated multi-instance
buffers with no transforms, or with transforms such as to_lowercase,
share a list id, so in "http.request_header; content:"Host";
http.request_header; absent: or_else; content:"<longer>";" the or_else
content became the fast pattern.

Stop at absent and transform_result in all three passes.

Issue: 7313
Issue: 7114
 7 days ago
Jeff Lucovsky 99ab49638d detect/transform_result: add keyword for transform outcome 
Add transform_result, which matches on the error flag a transform sets
on its buffer: must_succeed does not match on an error, must_error
matches only on one, and error_or matches on an error, an absent
buffer, or the keywords after it. It shares DetectAbsentData with
absent, whose bool or_else becomes an enum DetectAbsentMode, and absent
rejects the transform_result arguments.

The validator requires a transform that can fail before
transform_result, rejects absent: or_else on such a buffer, rejects
must_error with other keywords and fast_pattern on the buffer, and says
when a transform placed after the keyword started a new buffer. The
engine analyzer reports a mode string for both keywords in place of the
or_else boolean.

Issue: 7313
Issue: 7114
 7 days ago
Philippe Antoine 8461e3f3e7 src: do not include "util-unittest.h" directly 
It is included in suricata-common.h

Ticket: 945
 3 weeks ago
Philippe Antoine df495d7e22 rust: bindgen SCDetectGetLastSMFromLists 
to use it from rust keywords
 9 months ago
Victor Julien 325f0cc02a detect/absent: constify signature pointer in callback 1 year ago
Jeff Lucovsky cd4e728b77 detect: Ensure byte* variable usages is for same buffers 
Issue: 7549

Use the active buffer list to fetch SM variables to ensure that they are
part of the same list so a variable created with bytemath or byteextract
will have context when used with bytejump, e.g

Not needed for content modifiers.
 1 year ago
Philippe Antoine a2b5225612 rust: bindgen SCSigMatchAppendSMToList 
Ticket: 7667
 1 year ago
Philippe Antoine 78034b218d rust: bindgen SCDetectSignatureSetAppProto 
Ticket: 7667
 1 year ago
Philippe Antoine 0024de5e9e src: new file detect-engine-buffer.h 
Taken from detect-engine.h so that we can bindgen this smaller
unit.
 2 years ago
Philippe Antoine 4ec90bd227 detect: absent keyword to test absence of sticky buffer 
Ticket: 2224

It takes an argument to match only if the buffer is absent,
or it can still match if the buffer is present, but we test
the absence of some content.

For multi buffers, absent matches if there are 0 buffers.

For file keywords, absent matches if there is no file.
 2 years ago
Philippe Antoine c272a646c5 detect: SigMatchAppendSMToList can fail 
Ticket: #6104

And failures should be handled to say that the rule failed to load

Reverts the fix by 299ee6ed55
that was simple, but not complete (memory leak),
to have this bigger API change which simplifies code.
 3 years ago
Jeff Lucovsky 3286c3b912 detect/pcre: Use local match variables 
pcre2 is not thread-safe wrt match objects so use locally scoped
objects.

Issue: 4797
 3 years ago
Victor Julien 45d92a330c detect/isdataat: use list util in tests; cleanups 4 years ago
Victor Julien 243c285fe9 detect/isdataat: remove obsolete test; reduce sm_lists use 4 years ago
Victor Julien b31ffde6f4 output: remove error codes from output 4 years ago
Victor Julien 39f5c7f56a error: use SC_EINVAL for invalid input 4 years ago
Victor Julien e250ef6402 debug: remove empty header 4 years ago
Philippe Antoine 02f2602dde src: rework includes as per cppclean 4 years ago
Philippe Antoine 3de99a214c pcre2: migrate keywords parsing 5 years ago
Victor Julien 6ab323d323 detect: hide RegisterTests behind ifdef UNITTESTS 
Update all callers to more aggressively use UNITTESTS guards as well.
 6 years ago
Jeff Lucovsky fb409664d2 detect: byte_math support 6 years ago
Victor Julien 26bcc97515 detect/keywords: dynamic version part of doc URL 7 years ago
Jeff Lucovsky d3a65fe156 detect: Provide `de_ctx` to free functions 
This commit makes sure that the `DetectEngineCtx *` is available
to each detector's "free" function.
 7 years ago
Shivani Bhardwaj 0e4f261224 Use StringParse* for all parsers and configurations 7 years ago
Jeff Lucovsky 7f6af10fed general: copyright bump 7 years ago
Jeff Lucovsky 4b0085b03c detect: Update to take advantage of PCRE refactor 
This commit changes the keyword detectors to use the refactored PCRE
modifications from detect-parse.[ch]
 7 years ago
Shivani Bhardwaj 85b56b633e detect: Improve rule keyword alproto registration 
1. Set WARN_UNUSED macro on DetectSignatureSetAppProto.
2. Replace all direct 'sets' of Signature::alproto from keyword registration.

Closes redmine ticket #3006.
 7 years ago
Eric Leblond 8c1b16e22d doc: fix some links in list-keywords command 8 years ago
Victor Julien cb2008fb27 detect: fix coverity memory leak warnings 8 years ago
Victor Julien 0d0da7880e isdataat: fix mem leak in error path 8 years ago
Victor Julien 313661451d content inspection: support transforms 
Make sure content is applied to the transformed version of a buffer.

Support content with its modifiers, and also isdataat, pcre, bytetest
and bytejump.
 9 years ago
Victor Julien d588237235 detect/content: implement endswith 9 years ago
Victor Julien 862780c7c3 detect: add debug statements for byte_extract/isdataat 9 years ago
Victor Julien c18e950d7d isdataat: fix mem leak 9 years ago
Victor Julien ea99099c64 isdataat: add test for leading space 10 years ago
Victor Julien ab1200fbd7 compiler: more strict compiler warnings 
Set flags by default:

    -Wmissing-prototypes
    -Wmissing-declarations
    -Wstrict-prototypes
    -Wwrite-strings
    -Wcast-align
    -Wbad-function-cast
    -Wformat-security
    -Wno-format-nonliteral
    -Wmissing-format-attribute
    -funsigned-char

Fix minor compiler warnings for these new flags on gcc and clang.
 10 years ago
Victor Julien 842dfbc3f8 detect: enforce isdataat:!1,relative earlier 
The expression 'isdataat:!1,relative' is used to make sure a match
is at the end of a buffer quite often. This patch optimizes this case
for 'content' followed by the expression. It enforces it by setting
and 'ends with' flag on the content and then taking that flag into
account while doing the pattern match.
 10 years ago
Victor Julien dfac5276b8 detect: remove unused SIGMATCH_PAYLOAD flag 10 years ago
Victor Julien fe415ae518 detect: remove DMATCH list 10 years ago
Victor Julien d9b3ae6cd6 dns: use dynamic buffers 10 years ago
Victor Julien ee55aefa1c http_client_body: dynamic buffer 10 years ago
Victor Julien e7d5e845c7 http_header / http_raw_header: dynamic buffers 10 years ago
Victor Julien 67b7d9734e http_cookie: dynamic buffer 10 years ago
Victor Julien 6346a074a7 http_uri: dynamic buffer 
Clean up tests
 10 years ago
Victor Julien e34102d67a http_method: make list dynamic 10 years ago
Victor Julien 6bd37611ee file_data: dynamic buffer 10 years ago
Victor Julien 779d40cedf detect: remove hardcoded sm_list logic from setup 
Introduce utility functions to aid this.
 10 years ago
Victor Julien f370e88135 detect: move init only Signature members to init_data 10 years ago
Victor Julien 8edc954e82 detect: get rid of Signature::sm_lists 
Instead use the lists in init_data during setup and the SigMatchData
arrays during runtime.
 10 years ago