493 Commits (edae50de949d626dcc169de41937951cd4b4cf2d)

Author	SHA1	Message	Date
Victor Julien	84da0376fb	detect/http.host: rename file for consistency	7 years ago
Jeff Lucovsky	a8938f449d	logging: Anomaly logging ... This changeset adds anomaly logging to suricata for issue 2282. Anomaly logging is controlled via the `anomaly` section within eve-log. There is a single option -- `packethdr` -- for including the packet header in the anomaly.	7 years ago
Victor Julien	c2cb155ebb	rust/smb: rename files and code from RustSMB to SMB	7 years ago
Victor Julien	f30c05e684	smb: remove C implementation ... Now that Rust is mandatory it is obsolete. Ticket: #2849	7 years ago
Jason Ish	78b82ce6a5	dns-log: remove, not supported now that Rust is required ... The non-json line based DNS log is not supported with Rust only builds and has been scheduled for removal in Suricata 5.0. Redmine issue: https://redmine.openinfosecfoundation.org/issues/2297	7 years ago
Jeff Lucovsky	81c1af0887	detect: implement http {location,server} sticky buffer ... This implements inspection of the Server and Location buffer as a content sticky buffer.	7 years ago
Victor Julien	d6903e70c1	file-log: remove and add warning ... Feature was deprecated and scheduled for removal. Ticket #2376	8 years ago
Victor Julien	aab03dde87	mpm/ac-ks: rename files from -tile to -ks	8 years ago
Victor Julien	6fcd2db043	tile: remove files	8 years ago
Victor Julien	998f32f88c	detect/tls: consolidate validity code	8 years ago
Victor Julien	ccdafe6697	detect/http-server-body: move tests to tests/	8 years ago
Victor Julien	64987f36fb	detect/file-data: move tests into tests/	8 years ago
Victor Julien	9a8092249e	detect/http-client-body: move tests into tests/	8 years ago
Victor Julien	76fd666cad	detect/http_raw_header: move tests into tests/	8 years ago
Victor Julien	ab027cb481	detect/http_cookie: move tests into tests/	8 years ago
Victor Julien	2f342da048	detect/http_stat_code: move tests into tests/	8 years ago
Victor Julien	5dfba01b2e	detect/http_stat_msg: move tests to tests/	8 years ago
Victor Julien	b469938998	detect/http_raw_host: move raw into regular host logic	8 years ago
Victor Julien	dc43f35427	detect/http_host: move tests into tests/	8 years ago
Victor Julien	cb332b4cda	detect/http_method: move all tests into tests/	8 years ago
Victor Julien	0a405e27a0	detect/http_raw_uri: code reorganization ... Move registration into http_uri logic, move tests into the other uri tests. Switch to v2 mpm/inspect APIs.	8 years ago
Victor Julien	10e2731f18	detect/http-uri: move tests into tests/	8 years ago
Victor Julien	3111910fc6	detect/http_user_agent: move tests into tests/	8 years ago
Victor Julien	eb73008ccf	detect/transform: add to_sha1 keyword	8 years ago
Victor Julien	75f9c1ae9f	detect/transform: add to_md5 keyword	8 years ago
Victor Julien	0f1fc1f0c8	hash: move string hash funcs into util files	8 years ago
Eric Leblond	0e3b1eba86	util-binsearch: remove the files	8 years ago
Eric Leblond	3c566e0f89	util-bpf: introduce custom BPF compile functions ... We can't get error from pcap_compile_nopcap() so let's get our own function and output message.	8 years ago
Victor Julien	8b8270e732	eve/json: add common helper funcs ... Add simple helper funcs for option-less loggers	8 years ago
Jason Ish	35fd10bc2e	rust: app-layer detect template for rust parsers	8 years ago
Jason Ish	ee3aba9008	templates: C stub output for Rust logger	8 years ago
Jason Ish	96dc20abb1	templates: C stub template for Rust parser	8 years ago
Victor Julien	486054595a	detect/template2: template with prefilter (copy of ttl)	8 years ago
Victor Julien	555fb15ab4	tree: add 2-clause BSD licensed tree.h	8 years ago
Jacob Masen-Smith	ec77632e84	Adds WinDivert support to Windows builds ... Enables IPS functionality on Windows using the open-source (LGPLv3/GPLv2) WinDivert driver and API. From https://www.reqrypt.org/windivert-doc.html : "WinDivert is a user-mode capture/sniffing/modification/blocking/re-injection package for Windows Vista, Windows Server 2008, Windows 7, and Windows 8. WinDivert can be used to implement user-mode packet filters, packet sniffers, firewalls, NAT, VPNs, tunneling applications, etc., without the need to write kernel-mode code." - adds `--windivert [filter string]` and `--windivert-forward [filter string]` command-line options to enable WinDivert IPS mode. `--windivert[-forward] true` will open a filter for all traffic. See https://www.reqrypt.org/windivert-doc.html#filter_language for more information. Limitation: currently limited to `autofp` runmode. Additionally: - `tmm_modules` now zeroed during `RegisterAllModules` - fixed Windows Vista+ `inet_ntop` call in `PrintInet` - fixed `GetRandom` bug (nonexistent keys) on fresh Windows installs - fixed `RandomGetClock` building on Windows builds - Added WMI queries for MTU	8 years ago
Jason Ish	9210d8743b	rust/dhcp: Rust based DHCP decoder and logger. ... This is a DHCP decoder and logger written in Rust. Unlike most parsers, this one is stateless so responses are not matched up to requests by Suricata. However, the output does contain enough fields to match them up in post-processing. Rules are included to alert of malformed or truncated options.	8 years ago
Pierre Chifflier	1076c7cd47	Add krb5_err_code detection keyword	8 years ago
Pierre Chifflier	d6b9c0294a	Add krb5_cname and krb5_sname detection keywords	8 years ago
Pierre Chifflier	0bd81ff838	Add krb5_msg_type detection keyword	8 years ago
Pierre Chifflier	fd175f2bfb	Add logger for Kerberos 5 metadata	8 years ago
Pierre Chifflier	77f0c11c9e	Add Kerberos 5 application layer	8 years ago
Mats Klepsland	3e597512ea	app-layer-tls-handshake: remove since it is no longer needed ... Remove this file and all its content, since the functionality was reimplemented in app-layer-ssl.	8 years ago
Pierre Chifflier	d94346282c	Add logger for IKEv2	8 years ago
Pierre Chifflier	c99b9462d7	Add new parser: IKEv2 ... Add a new parser for Internet Key Exchange version (IKEv2), defined in RFC 7296. The IKEv2 parser itself is external. The embedded code includes the parser state and associated variables, the state machine, and the detection code. The parser looks the first two messages of a connection, and analyzes the client and server proposals to check the cryptographic parameters.	8 years ago
Mats Klepsland	195fa9d272	lua: add Ja3GetHash function ... Add Ja3GetHash() to return the content of the JA3 hash buffer from the TLS session. Example: function init (args) local needs = {} needs["protocol"] = "tls" return needs end function setup (args) filename = SCLogPath() .. "/ja3_hash.log" file = assert(io.open(filename, "a")) end function log (args) ja3_hash = Ja3GetHash() if ja3_hash == nil then return end file:write(ja3_hash .. "\n") file:flush() end function deinit (args) file:close() end In the (useless) example above, each JA3 hash is logged to a log file.	8 years ago
Mats Klepsland	6e23ae230b	detect: add (mpm) keyword ja3_string ... Match on JA3 string using ja3_string keyword, e.g: alert tls any any -> any any (msg:"JA3 string test"; ja3_string; content:"65-68-69-102"; sid:1;)	8 years ago
Mats Klepsland	6c7aacce9e	detect: add (mpm) keyword ja3_hash ... Match on JA3 hash using ja3_hash keyword, e.g: alert tls any any -> any any (msg:"JA3 hash test"; ja3_hash; content:"e7eca2baf4458d095b7f45da28c16c34"; sid:1;)	8 years ago
Mats Klepsland	0c16cd0120	app-layer-ssl: generate JA3 fingerprints ... Decode additional fields from the client hello packet and generate JA3 fingerprints.	8 years ago
Victor Julien	75d7c9d64a	rust/smb: initial support ... Implement SMB app-layer parser for SMB1/2/3. Features: - file extraction - eve logging - existing dce keyword support - smb_share/smb_named_pipe keyword support (stickybuffers) - auth meta data extraction (ntlmssp, kerberos5)	9 years ago
Victor Julien	4d1fa4aaf9	detect: bsize keyword ... Allows matching on stickybuffers. Like dsize, it allows matching on exact values, greater than and less than, and ranges. For streaming buffers, such as HTTP bodies, the final size of the body is only known at the end of the transaction.	9 years ago