7097 Commits (db6c80fd8e4232d963553def0451f191a9c81888)

Author	SHA1	Message	Date
Victor Julien	402eb645a0	ftp: parser and ftpbounce update ... Convert parser to TX API. Convert ftpbounce keyword to use that.	10 years ago
Victor Julien	d9a300cd8c	detect: move lua smtp support to dynamic list	10 years ago
Victor Julien	96b8100a51	lua: convert lua output to be tx aware	10 years ago
Victor Julien	a10b2fdecf	detect: make ssh detection use dynamic list	10 years ago
Victor Julien	c412352474	ssh: remove single logger limit	10 years ago
Victor Julien	3ee4989ba7	ssh: convert app-layer parser to be tx aware ... Like with SSL, there is only a single 'tx'.	10 years ago
Victor Julien	4ae4fd0802	lua: use tls_generic list for ssl/tls	10 years ago
Victor Julien	a8975c68e0	detect ssl/tls: use dynamic lists	10 years ago
Victor Julien	1cacba435b	ssl/tls: clean up keywords	10 years ago
Victor Julien	6ef4712cd6	detect: convert old tls keywords to dynamic list	10 years ago
Victor Julien	ef149bed7b	tls.store: convert to postmatch	10 years ago
Victor Julien	8b3a71a285	tls.store: cleanup	10 years ago
Victor Julien	8eac1156c6	app-layer-events: remove unused API options	10 years ago
Victor Julien	1087495d6d	detect: http_start sticky buffer ... Matches on the start of a HTTP request or response. Uses a buffer constructed from the request line and normalized request headers, including the Cookie header. Or for the response side, it uses the response line plus the normalized response headers, including the Set-Cookie header. Both buffers are terminated by an extra \r\n.	10 years ago
Victor Julien	36535efa04	detect: add http_protocol sticky buffer ... Matches on protocol field in HTTP.	10 years ago
Victor Julien	f2fc5a255f	http_header: convert to use common code	10 years ago
Victor Julien	6279ec399e	http_header: common detection code	10 years ago
Victor Julien	5ee68ca2b2	http_header: remove old files	10 years ago
Victor Julien	2bb0cae05a	http_header: move all code into keyword files	10 years ago
Victor Julien	aaeeae0722	detect: http_header_names sticky buffer keyword ... A sticky buffer that allows content inspection on a contructed buffer of HTTP header names. The buffer starts with \r\n, the names are separated by \r\n and the end of the buffer contains an extra \r\n. E.g. \r\nHost\r\nUser-Agent\r\n\r\n The leading \r\n is to make sure one can match on a full name in all cases.	10 years ago
Victor Julien	cf9678d926	detect: global registery for keyword thread data ... Some keywords need a scratch space where they can do store the results of expensive operations that remain valid for the time of a packets journey through the detection engine. An example is the reconstructed 'http_header' field, that is needed in MPM, and then for each rule that manually inspects it. Storing this data in the flow is a waste, and reconstructing multiple times on demand as well. This API allows for registering a keyword with an init and free function. It it mean to be used an initialization time, when the keyword is registered.	10 years ago
Victor Julien	75907fce06	profiling: output all sort options for rules ... Limit the default number of sids to 10.	10 years ago
Victor Julien	7d8a5a75ef	profiling: honor limit in json rule output	10 years ago
Victor Julien	a9a228a289	profiling: fix keyword profiling	10 years ago
Victor Julien	a1465bc4fa	detect-engine-mpm: api cleanup	10 years ago
Victor Julien	8bd1422948	detect: detect engine registration cleanup	10 years ago
Victor Julien	49fbd28ceb	detect: cleanup built-in list id's	10 years ago
Victor Julien	40851eecf0	template: dynamic buffer	10 years ago
Victor Julien	815120896b	app-layer-events: dynamic list	10 years ago
Victor Julien	b68343e372	files: use dynamic list	10 years ago
Victor Julien	e4bfdd53c2	cip/enip: dynamic buffer	10 years ago
Victor Julien	f2393c1ae0	modbus: dynamic buffer	10 years ago
Victor Julien	cfdd934aba	dnp3: dynamic buffers/lists	10 years ago
Victor Julien	9ba386a141	tls: dynamic buffers	10 years ago
Victor Julien	d9b3ae6cd6	dns: use dynamic buffers	10 years ago
Victor Julien	d2f77978ec	detect-parse: content modifier cleanup	10 years ago
Victor Julien	6f867c3c73	http_raw_uri: dynamic buffer	10 years ago
Victor Julien	ee55aefa1c	http_client_body: dynamic buffer	10 years ago
Victor Julien	e7d5e845c7	http_header / http_raw_header: dynamic buffers	10 years ago
Victor Julien	b694d96e22	http_stat_msg: dynamic buffer	10 years ago
Victor Julien	7e3ab4f5ea	http_stat_code: dynamic buffer	10 years ago
Victor Julien	128b59d4f6	http_raw_host: dynamic buffer	10 years ago
Victor Julien	296c275e23	http_host: dynamic buffer	10 years ago
Victor Julien	67b7d9734e	http_cookie: dynamic buffer	10 years ago
Victor Julien	54604c7bf2	http_user_agent: dynamic buffer	10 years ago
Victor Julien	9262fa3dcf	http_response_line: dynamic buffer	10 years ago
Victor Julien	6346a074a7	http_uri: dynamic buffer ... Clean up tests	10 years ago
Victor Julien	e34102d67a	http_method: make list dynamic	10 years ago
Victor Julien	6bd37611ee	file_data: dynamic buffer	10 years ago
Victor Julien	7052f9b933	http_request_line: dynamic buffer	10 years ago
Victor Julien	779d40cedf	detect: remove hardcoded sm_list logic from setup ... Introduce utility functions to aid this.	10 years ago
Victor Julien	04592efb76	detect: buffer type API ... To replace the hardcoded SigMatch list id's, use this API to register and query lists by name. Also allow for registering descriptions and whether mpm is supported. Registration is only allowed at startup.	10 years ago
Victor Julien	58e1180efe	detect: inspect engine setup cleanup	10 years ago
Victor Julien	debc1a6334	detect: dce test fixes and improvements	10 years ago
Victor Julien	a2b521b7fa	detect-csum: redo tests	10 years ago
Victor Julien	f370e88135	detect: move init only Signature members to init_data	10 years ago
Victor Julien	0a5ae415b8	detect: shrink Signature::sm_arrays ... Signature::sm_arrays now only contains 'built-in' lists, and so is sized appropriately.	10 years ago
Victor Julien	4978a7a133	detect: reorganize id's in prep of dynamic lists	10 years ago
Victor Julien	59303d1fbb	threshold: fix and redo tests	10 years ago
Victor Julien	6f7e4adbe8	detect: improve memory handling & comments	10 years ago
Victor Julien	8edc954e82	detect: get rid of Signature::sm_lists ... Instead use the lists in init_data during setup and the SigMatchData arrays during runtime.	10 years ago
Victor Julien	f281481b67	detect: use detect list passed to generic funcs ... Until now the GenericList users used hardcoded list id's.	10 years ago
Victor Julien	bd456076a8	detect: pass SigMatchData to inspect functions	10 years ago
Victor Julien	a0fe67a3c0	detect: template list in engine	10 years ago
Victor Julien	da7c816c7c	detect: enip/cip list in engine	10 years ago
Victor Julien	e94a7bddb3	detect: modbus list in engine	10 years ago
Victor Julien	7f7d4296da	detect: file list in engine	10 years ago
Victor Julien	f5adccba1d	detect: app-event list in engine	10 years ago
Victor Julien	747dbf92ce	detect: dns & tls lists in engine	10 years ago
Victor Julien	5a2e568385	detect: http lists in engine	10 years ago
Victor Julien	1ee32da2ca	detect-engine: memory handling of sm_lists ... For lists that are registered multiple times, like http_header and http_cookie, making the engines owner of the lists is complicated. Multiple engines in a sig may be pointing to the same list. To address this the 'free' code needs to be extra careful about not double freeing, so it takes an approach to first fill an array of the to-free pointers before freeing them.	10 years ago
Victor Julien	f81b90dacd	detect: when freeing sig also see sm in inspect engine	10 years ago
Victor Julien	2f87c975d4	detect: add SigMatch arg to inspect functions	10 years ago
Victor Julien	cf42fbf51f	detect: use InspectEngineFuncPtr in inspect engines ... Replace explicit function pointer use by InspectEngineFuncPtr typedef	10 years ago
Victor Julien	5f7e096be4	detect: shrink inspect engine by using 'id' as state flag	10 years ago
Victor Julien	715ff60087	detect: remove unused SIG_FLAG_INIT_PAYLOAD init_flag	10 years ago
Victor Julien	859cb89c7e	detect alert/threshold/tag: sm_list -> sm_array	10 years ago
Victor Julien	99580487e5	detect: fix file_data / http_server_body tests	10 years ago
Victor Julien	faadec0d7f	detect file_data: improve error messages	10 years ago
Victor Julien	e2c6e1be33	detect-parse: set ipprotos earlier ... A high level proto like HTTP implies TCP. However this wasn't set until after all the parsing was complete which means that keywords couldn't test if the ipproto matched. This patch populates the ipprotos right when the higher level proto is parsed.	10 years ago
Victor Julien	5e0b0eea4b	detect: remove unused flags	10 years ago
Victor Julien	39613778cd	detect: make setup/free/match funcs static where possible	10 years ago
Victor Julien	bfd4bc8233	detect: constify Signature/SigMatch use at runtime	10 years ago
Victor Julien	a44da9f5cb	detect: simplify SIG_FLAG_STATE_MATCH set logic	10 years ago
Victor Julien	be3ee5330f	detect: remove alproto from keyword registration ... It was already marked as depricated and no longer in use anywhere.	10 years ago
Victor Julien	113a238e90	Open 4.0 development branch	10 years ago
Victor Julien	71710f088e	dns: fix outputs with 0-len A/AAAA records	10 years ago
Victor Julien	20990f7a7e	dns: fix out of bounds read ... On a zero size A or AAAA record, 4 or 16 bytes would still be read. Found with AFL+ASAN.	10 years ago
Jason Ish	4a04f814b1	defrag - take protocol into account during re-assembly ... The IP protocol was not being used to match fragments with their packets allowing a carefully constructed packet with a different protocol to be matched, allowing re-assembly to complete, creating a packet that would not be re-assembled by the destination host.	10 years ago
Victor Julien	292baf0872	afl: add ethernet and erspan entry points	10 years ago
Victor Julien	49c41fc79e	afl: clean up commandline parsing	10 years ago
Victor Julien	b56b04f84c	afl: pass a packet queue to decoder calls	10 years ago
Jason Ish	35488eefda	afl: set the packet data so pktlen gets set	10 years ago
Victor Julien	fbd69729aa	afl: improve packet fuzz testing ... Due to the use of AFL_LOOP and initialization/deinit outside of it, part of the fuzzing relied on the global 'state' in flow and defrag. Because of this crashes that were found could not be reproduced. The saved crash input was only the last in the series. This patch addresses that. It requires a new output directory 'dump' where the packet fuzzers will store all their input. If the AFL_LOOP fails the files will not be removed and this 'serie' can be read again for reproducing the issue. e.g.: AFL would work with: --afl-decoder-ppp=@@ and after a crash is found the produced serie can be read with: --afl-decoder-ppp-serie=1486656919-514163 The series have a timestamp as name and a suffix that controls the order in which the files will be 'replayed' in Suricata.	10 years ago
Victor Julien	923d93f314	afl: add decoder ipv4 option	10 years ago
Sascha Steinbiss	5e96977983	mpm-ac: fix integer overflow on allocation ... The size of a memory buffer to be allocated was kept in a signed int instead of a size_t, leading to an overflow when large lists of long and diverse patterns cause the amount of AC states to blow up (>2GB). Fixes Redmine issues #1827 and #1843. Signed-off-by: Sascha Steinbiss <sascha@steinbiss.name>	10 years ago
Sascha Steinbiss	b25b067d93	alert: silence compiler type warning ... The `ts_ecr' and `ts_val' struct fields are integer types, not pointers. This leads GCC 6.3.0 to complain about comparisons to NULL. Signed-off-by: Sascha Steinbiss <sascha@steinbiss.name>	10 years ago
Victor Julien	86222428dd	detect: don't run IP inspection on non-IP packets ... The code to get the rule group (sgh) would return the group for IP proto 0 instead of nothing. This lead to certain types of rules unintentionally matching (False Positive). Since the packets weren't actually IP, the logged alert records were missing the IP header. Bug #2017.	10 years ago
Victor Julien	4683b0e662	afl: fix ENIP, switch DNS to UDP and add --afl-dnstcp*	10 years ago
Victor Julien	c89ce17017	afl: with -Wshadow issues	10 years ago
Eric Leblond	ecf59be413	af-packet: add VLAN header when needed in IPS mode ... When packet is coming from a real ethernet card, the kernel is stripping the vlan header and delivering a modified packet so we need to insert the VLAN header back before sending the packet on the wire. To do so, we pass an option to the raw socket to add a reserve before the packet data. It will get Suricata some head room to to move the ethernet addresses before there actual place and and insert the VLAN header in the correct place. We get VLAN info from the ring buffer as the call of AFPWrite is always done in the release function so we still have access to the memory.	10 years ago
Eric Leblond	f407d77016	detect-tls-sni: add link to documentation	10 years ago
Eric Leblond	1af713d67d	detect-tls: add url field pointing to doc	10 years ago
Eric Leblond	0695ad4bf0	detect-xbits: set documentation URL	10 years ago
Jason Ish	21bbac5648	dns-log: log requests even when there is no response ... The JSON logger had already been updated to handle transactions without a response. Apply the same logic to the older dns-log where a logger is registered for each direction. Fixes issue 2012.	10 years ago
Andreas Herz	d8b5bf9bc6	app-layer-parsing: detect malformed input ... If the app-layer-parsing has a very long content it exceeds the maximum defined in "alproto_name". This adds a check for the too long content before it will be passed to "strlcpy" and logs an error.	10 years ago
Victor Julien	f91d490d25	detect: remove unused flow_locked hint	10 years ago
Victor Julien	31a96d5a79	detect: make tenant loading less verbose	10 years ago
Victor Julien	addf64f1f7	profiling: fix memory leaks	10 years ago
Victor Julien	6e876182d7	detect: use TLS_STATE_CERT_READY in cert inspect	10 years ago
Victor Julien	473dae75b5	tls: introduce 'cert ready' state	10 years ago
Victor Julien	15accc86c9	common: add BIT_U8 macro	10 years ago
Sascha Steinbiss	e6044aaf1c	mpm/spm: check for SSSE3 and enable/disable HS ... The new Hyperscan 4.4 API provides a function to check for SSSE3 presence at runtime. This allows us to fall back to non-Hyperscan matchers on systems without SSSE3 even when the suricata executable is built with Hyperscan support. Addresses Redmine issue #2010. Signed-off-by: Sascha Steinbiss <sascha@steinbiss.name> Tested-by: Arturo Borrero Gonzalez <arturo@debian.org>	10 years ago
Victor Julien	a0580d8805	stream: initialize stream segment pool from mtu ... If segments section in the yaml is ommitted (default) or when the pool size is set to 'from_mtu', the size of the pool will be MTU minus 40. If the MTU couldn't be determined, it's assumed to be 1500, so the segment size for the bool will be 1460.	10 years ago
Victor Julien	1ba15d3721	mtu: track max mtu for capture devices	10 years ago
Victor Julien	7ca466c598	shutdown: remove pid file last	10 years ago
Victor Julien	816dd7b301	startup: clean up main loop	10 years ago
Victor Julien	2eec07cc3a	unittests: clean up registration and startup	10 years ago
Victor Julien	f452df761a	shutdown: move global shutdown steps into func	10 years ago
Victor Julien	babe8a299e	startup/shutdown: cleanup and unify with unix mode	10 years ago
Victor Julien	3c64cfb384	threads: fix missed logging at shutdown ... At shutdown, all flows that still need work are handled by the flow force reassembly logic. This means one or more flow end pseudo packets are generated and pushed through the engine for final detection and logging. In some cases this would not work correctly. This was caused by the flow timeout logic kicking in before all the 'live' packets were processed. Before the flow timeout handling runs the receive threads are disabled, however the engine did not wait for the in-flight packets to be fully processed. In autofp mode, packets could still be in the queue between receive thread(s) and flow worker(s). This patch adds a new function that 'drains' all the packet threads of any in-progress packets before moving on the flow timeout logic. Bug #1946.	10 years ago
Mats Klepsland	a2659ed7ec	output-json-flow: add has_alerts field ... Add has_alerts field to flow eve-log to indicate if a flow has any alerts or not.	10 years ago
Mats Klepsland	c531e8f77c	lua: add SCFlowHasAlerts function ... Add SCFlowHasAlerts() to check if a flow has alerts. Returns true on alerts, false otherwise. Example: has_alerts = SCFlowHasAlerts() if has_alerts then -- do something end	10 years ago
Mats Klepsland	d9b87e502d	flow: set flag to indicate that a flow has alerts ... Set FLOW_HAS_ALERTS flag on the flow on alerts. Add FlowHasAlerts(..) and FlowSetHasAlertsFlag(..) to check and set this flag.	10 years ago
Eric Leblond	569cc5d238	util-file: introduce new functions for file size ... This patch introduces the FileDataSize and FileTrackedSize functions. The first one is just a renaming of the initial FilSize function whereas the other one is using the newly introduced size field as value.	10 years ago
Eric Leblond	a098896b28	output-json-file: use size instead of FileSize ... FileSize is not returning the actual value when file store is not used.	10 years ago
Eric Leblond	fbc2dbac28	util-file: change file size computation ... The file size returned by FileSize is invalid if file store is not used so we introduce a new size field in File structure that is used to store the size.	10 years ago
Alexander Gozman	187a6f392c	Bug #2009: added CAP_NET_ADMIN for PCAP and af-packet modes. ... Without this capability suricata is unable to get network interface's settings.	10 years ago
Jason Ish	19e578a740	pcap-log: fix pcre_study error check ... Code was failing on a NULL return value which can be returned when there was nothing todo instead of an error. Instead check the errbuf for a non-NULL value to determine error.	10 years ago
Jason Ish	5c55373679	app-layer-detect-proto.c: fix indent ... A recent commit was outdented by 1 column.	10 years ago
Jason Ish	ec44585dca	app-layer - fix secondary probing parser logic ... Apply the same logic to pe2 as pe1 for determining which probe to call. Missed in previous commit.	10 years ago
Victor Julien	cb36dee477	hyperscan: fix minor coverity issue in error path ... *** CID 1398951: API usage errors (LOCK) /src/util-mpm-hs.c: 722 in SCHSPreparePatterns() 716 SCMutexUnlock(&g_db_table_mutex); 717 718 SCHSFreeCompileData(cd); 719 return 0; 720 721 error: >>> CID 1398951: API usage errors (LOCK) >>> "pthread_mutex_unlock" unlocks "g_db_table_mutex" while it is unlocked. 722 SCMutexUnlock(&g_db_table_mutex); 723 if (pd) { 724 PatternDatabaseFree(pd); 725 } 726 if (cd) {	10 years ago
Victor Julien	fa8cbd8741	smb: detect protocol in both directions	10 years ago
Jason Ish	e9fccfa67c	tx logging: only update logged tx id if all loggers logged ... Prevents the case where the logged id is incremented if a newer transaction is complete and an older one is still outstanding. For example, dns request0, unsolicited dns response, dns response0 would result in the valid response0 never being logged. Similarily this could happen for: request0, request1, response1, response0 which would end up having request0, request1 and response1 logged, but response0 would not be logged.	10 years ago
Eric Leblond	0d5fd0f658	util-file: fix error logic in hash computation ... This patch fixes an issue with hash computation resulting in the invalidity of at least one hash when at least two different hashes functions were used. Impact was setting as `force-hash: [md5, sha256]` not to be valid. Also it could lead to false negative if too different hash functions had to be used on a single file due to signatures.	10 years ago
Jason Ish	20111cab23	unix-socket: fix shadowed variable ... ret does not need to be redefined here, the existing declaration of ret can be used.	10 years ago
Victor Julien	f964cdbc93	address parsing: fix memory leak in error path	10 years ago
Victor Julien	a6fccd952e	ssl: suppress scan-build warnings	10 years ago
Victor Julien	61b72c6981	output: clean up output function ... Don't allocate memory per call.	10 years ago
Victor Julien	709d20f8c6	smb/dcerpc: suppress scan-build warnings	10 years ago
Victor Julien	618ab4e177	ac-bs: fix scan-build warnings	10 years ago
Victor Julien	bbc02205fb	queue: add debug assertions to TAILQ ... To avoid scan-build fp's add assertions that are only active if built with scan-build.	10 years ago
Mats Klepsland	03ad9d4ec0	tls-store: fix bug that causes Suricata to crash ... Fix bug that causes Suricata to crash when the tls.store keyword is used. *** Error in `/usr/bin/suricata': free(): invalid next size (fast): 0x00007fd4b4373180 ***	10 years ago
Jason Ish	87b5bf9541	proto detect - fix coverity CID 1204325 ... CID 1204325 (#1 of 1): Logically dead code (DEADCODE) dead_error_line: Execution cannot reach this statement: mask = 0U;. 433 mask = 0; additionally, mask is initialized to 0	10 years ago
Jason Ish	d09cd16c8c	template logger - fix coverity CID 1324964 ... null: At condition templatejs != NULL, the value of templatejs must be NULL. dead_error_condition: The condition templatejs != NULL cannot be true. 113 if (templatejs != NULL) { CID 1324964 (#1 of 1): Logically dead code (DEADCODE) dead_error_line: Execution cannot reach this statement: json_decref(templatejs);. 114 json_decref(templatejs); 115 }	10 years ago
Jason Ish	a10a9220cf	dns (tcp) - fix coverity CIDs 1374306, 1374305 ... CID 1374306 (#1 of 1): Dereference before null check (REVERSE_INULL) check_after_deref: Null-checking dns_state suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 585 if (dns_state != NULL && f != NULL) { 586 dns_state->last_req = f->lastts; 587 } CID 1374305 (#1 of 1): Dereference before null check (REVERSE_INULL) check_after_deref: Null-checking dns_state suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 366 if (dns_state != NULL && f != NULL) { 367 dns_state->last_req = f->lastts; 368 }	10 years ago
Jason Ish	dfbfb50f64	dns (tcp) - fix coverity cid 1374307 ... CID 1374307 (#1 of 1): Dereference before null check (REVERSE_INULL) check_after_deref: Null-checking dns_state suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 317 if (dns_state != NULL && f != NULL) { 318 dns_state->last_resp = f->lastts; 319 }	10 years ago
Eric Leblond	5b1de57d73	detect-parse: simplify port prefiltering ... Regular expression was not matching some authorized setting like "![1234, 1235]". This patch simplify the regexp to match on possible character and let the port parsing code handle the complete verification.	10 years ago
Jason Ish	b0de5ad1a8	dns: increment tx id when allocated during response	10 years ago
Victor Julien	fe4e119278	common: improve BUG_ON ... When BUG_ON is a wrapper for assert(), we risk getting rid of certain code lines. Assert is a no-op when NDEBUG is defined. This patch defines an alternate path for BUG_ON that exits after printing an error. Bug #2003.	10 years ago