suricata

Commit Graph

Author	SHA1	Message	Date
Sascha Steinbiss	4e1a41a17d	output-json: add MAC address output This commit adds MAC address output to the EVE-JSON format. We follow the remarks made in Redmine ticket #962: for packets, log MAC src/dst as a scalar field in EVE; for flows, log MAC src/dst as lists in EVE. Field names are different between flow and packet context to avoid type confusion (src_mac vs. src_macs). Configuration approach and JSON representation is taken from previous GitHub PR #2700.	6 years ago
Sascha Steinbiss	c31360070b	rust/mqtt: add MQTT parser	6 years ago
Philippe Antoine	1569f3e349	transform: adds url_decode keyword Fixes https://redmine.openinfosecfoundation.org/issues/2689 Adds a new source file to handle this keyword. And modifies documentation, Makefile, and registration accordingly. url_decode decodes url-encoded data, ie replacing '+' with space and '%HH' with its value.	6 years ago
Shivani Bhardwaj	9f9670ebdc	logging: Add DCERPC logger	6 years ago
Victor Julien	2145cf99a3	detect/config: initial version	6 years ago
Victor Julien	f7ff7dbaed	config: common definitions	6 years ago
Jeff Lucovsky	0e4ba7b13e	detect: Add byte_math detector	6 years ago
Jeff Lucovsky	ac01adc260	detect: Add utility module for byte var handling	6 years ago
Emmanuel Thompson	275f6ae96f	detect/asn1: Remove asn1 C parser - In favor of rust parser	6 years ago
Vadym Malakhatko	8a8212d0f6	lua: add functions to get hassh parameters	6 years ago
Vadym Malakhatko	216a75c522	detect: add (mpm) hassh keywords Match on Hassh using ssh.hassh, ssh.hassh.server, ssh.hassh.string, ssh.hassh.server.string keywords, e.g: alert ssh any any -> any any (msg:"match SSH hash"; ssh.hassh; content:"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; sid:1000010;) alert ssh any any -> any any (msg:"match SSH hash-server"; ssh.hassh.server; content:"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; sid:1000020;) alert ssh any any -> any any (msg:"match SSH hash-string"; ssh.hassh.string; content:"none,zlib@openssh.com,zlib"; sid:1000030;) alert ssh any any -> any any (msg:"match SSH hash-server-string"; ssh.hassh.server.string; content:"umac-64-etm@openssh.com,umac-128-etm@openssh.com,"; sid:1000040;)	6 years ago
Jeff Lucovsky	66d15710b8	transform/pcrexform: Add pcrexform source files	6 years ago
Jason Ish	e26718aea3	drop-log: remove drop log (deprecated) Remove the old style line based drop log. Redmine issue: https://redmine.openinfosecfoundation.org/issues/2381	6 years ago
Jason Ish	ca88e4d0e3	filestore v1: remove File store v1 has been deprecated and was scheduled for removal by June 2020. Log an error if a file-store configuration is loaded without version set to 2.	6 years ago
Victor Julien	1893e40e79	build: don't limit C std to c99 (gnu99) Now that C11 atomics and thread local storage are supported, the compiler can figure out what version to use.	6 years ago
Victor Julien	3b877929e3	util/mem: move most logic to functions Reduce macro use and simplify code. Also reduces compiled code size.	6 years ago
Victor Julien	328a94206e	decode/hdlc: initial support	6 years ago
Victor Julien	3d969a1c7d	build: wrap fuzz targets in guard to fix 'make tags'	6 years ago
Philippe Antoine	293eebd999	fuzz: remove obsolete AFL code	6 years ago
Philippe Antoine	bf60959d84	fuzz: simpler way to force usage of CXX linker	6 years ago
Philippe Antoine	440bb4d600	fuzz: remove decodeder fuzz target As we removed decodeder function	6 years ago
Pierre Chifflier	1d9f37a60e	DER: remove the C parser for DER	6 years ago
Philippe Antoine	600b0d7c55	fuzz: adds eight fuzz targets And ways to compile them with enable-fuzztargets at configure time Adds utility function in util-unittest-helper	6 years ago
Frank Honza	1c8943dedd	add RFB parser This commit adds support for the Remote Framebuffer Protocol (RFB) as used, for example, by various VNC implementations. It targets the official versions 3.3, 3.7 and 3.8 of the protocol and provides logging for the RFB handshake communication for now. Logged events include endpoint versions, details of the security (i.e. authentication) exchange as well as metadata about the image transfer parameters. Detection is enabled using keywords for: - rfb.name: Session name as sticky buffer - rfb.sectype: Security type, e.g. VNC-style challenge-response - rfb.secresult: Result of the security exchange, e.g. OK, FAIL, ... The latter could be used, for example, to detect brute-force attempts on open VNC servers, while the name could be used to map unwanted VNC sessions to the desktop owners or machines. We also ship example EVE-JSON output and keyword docs as part of the Sphinx source for Suricata's RTD documentation.	6 years ago
Philippe Antoine	1cd314c500	detect: adds icmpv6.mtu keyword	6 years ago
Philippe Antoine	75ec528384	detect: adds utility file for uint keywords	6 years ago
Jason Ish	688874582a	dhcp: remove C app-layer-dhcp wrapper This just wrapped the Rust function to register the parse, so instead just call the Rust function directly to remove the C wrapper, and the 2 C files.	6 years ago
Jason Ish	a0e3e2d7b4	dns: register parsers from Rust And port the C DNS tests to Rust.	6 years ago
Jason Ish	1b44f839e6	dns: cleanup: move event callbacks into Rust Remove app-layer-dns-common.c as its no longer needed.	6 years ago
Philippe Antoine	8396333493	detect: adds icmpv6.hdr keyword	6 years ago
Jason Ish	d86973b386	unified2: remove deprecated output unified2 Ticket 2385: https://redmine.openinfosecfoundation.org/issues/2385	7 years ago
Jeff Lucovsky	f83b199f2a	feature: feature tracking services	7 years ago
Philippe Antoine	af2a689a99	init: move main to a separate file so as to reuse code from suricata.c with fuzz targets	7 years ago
Danny Browning	b573c16dd5	build: cbindgen Rust headers are now generated using cbindgen. If cbindgen is present, they can be generated during dist, otherwise they will be available for builds.	7 years ago
Victor Julien	1633744fcb	nfq: remove unused queue handler type	7 years ago
Victor Julien	f66e12f7af	dns: rename rust files and funcs	7 years ago
Victor Julien	b4318a11e3	rust: remove build system HAVE_RUST guards	7 years ago
Giuseppe Longo	e06291922f	detect/sip.response_line: add sticky buffer Matches on response line field in SIP.	7 years ago
Giuseppe Longo	17de4a8023	detect/sip.request_line: add sticky buffer Matches on request line field in SIP.	7 years ago
Giuseppe Longo	8939ece538	detect/sip.stat_msg: add sticky buffer Matches on status msg field in SIP.	7 years ago
Giuseppe Longo	bd2219cac6	detect/sip.stat_code: add sticky buffer Matches on status code field in SIP.	7 years ago
Giuseppe Longo	8454122eb2	detect/sip.protocol: add sticky buffer Matches on protocol field in SIP.	7 years ago
Giuseppe Longo	2661c5b298	detect/sip.uri: add sticky buffer Matches on uri field in SIP.	7 years ago
Giuseppe Longo	424eead8c0	detect/sip.method: add sticky buffer Matches on uri field in SIP.	7 years ago
Giuseppe Longo	edc2a583a9	rust/sip: add SIP logger	7 years ago
Giuseppe Longo	2e975a0481	rust/sip: add parser for SIP protocol	7 years ago
Jason Ish	d79c23baa3	dns/detect: dns.opcode keyword Add a rule keyword, dns.opcode to match on the opcode flag found in the DNS request and response headers. Only exact matches are allowed with negation. Examples: - dns.opcode:4; - dns.opcode:!1;	7 years ago
Jeff Lucovsky	7808b946e3	detect/transform: add dotprefix keyword	7 years ago
Zach Kelly	caef8b5b38	protocol parser: rdp Initial implementation of feature 2314: 1. Add protocol parser for RDP 2. Add transactions for RDP negotiation 3. Add eve logging of transactions	7 years ago
Victor Julien	317376f59d	datasets: match on lists of data Datasets are sets/lists of data that can be accessed or added from the rule language. This patch implements 3 data types: 1. string (or buffer) 2. md5 3. sha256 The patch also implements 2 new rule keywords: 1. dataset 2. datarep The dataset keyword allows matching against a list of values to see if it exists or not. It can also add the value to the set. The set can optionally be stored to disk on exit. The datarep support matching/lookups only. With each item in the set a reputation value is stored and this value can be matched against. The reputation value is unsigned 16 bit, so values can be between 0 and 65535. Datasets can be registered in 2 ways: 1. through the yaml 2. through the rules The goal of this rules based approach is that rule writers can start using this without the need for config changes. A dataset is implemented using a thash hash table. Each dataset is its own separate thash.	7 years ago

1 2 3 4 5 ...

560 Commits (e0aa7c1dbcc589702dccefbc3788a589418a99da)