aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
10,950 Commits
8 Branches
175 Tags
258 MiB
main-8.0.x
main
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.8
suricata-8.0.7
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'eef7760870'
${ noResults }
Commit Graph

9306 Commits (eef7760870d99beca75cf96262f4721563198a42)

Author SHA1 Message Date
Victor Julien 01cea2ec89 datasets: suppress noisy debug statement 7 years ago
Victor Julien 505b2dd256 log-pcap: don't print (null) for compression method 7 years ago
Victor Julien fb26268c6b tcp: don't set event on empty SACK opt 
TCP_OPT_INVALID_LEN was set if the opt len was 2. While useless
an empty SACK is not uncommon.

Seen on an iOS device talking to an Apple server.

Bug #3254.
 7 years ago
Victor Julien aae76a84cd suricata: use version from autoconf 7 years ago
Eric Leblond 2d11e9394c detect-base64: fix url in list keywords commands 7 years ago
Jason Ish 6eada54fc8 eve/dns: don't log warning if dns log version not set 
If the DNS log version is not set, we default to v2. This should
not be warning, but better logged at the config level.

A warning will still be logged if the value is set but is not
1 or 2.
 7 years ago
Philippe Antoine 989a6461b0 signature: leak fix in DetectAddressParse2 7 years ago
Philippe Antoine c1e41632c1 config: use logging instead of stderr 7 years ago
Wesley van der Ree bf1b65558b mpls: Allow MPLS after vlan. 
Fixes #2771
 7 years ago
Victor Julien 7cca9005fb dns: minor cleanup 7 years ago
Victor Julien 4164c0bbd6 app-layer: make dns,smb,tls parsers less noisy w/o config 7 years ago
Victor Julien 0526878fee detect/tls: set alternatives for legacy tls keywords 7 years ago
Victor Julien 3019f10ac7 detect/tls: tls.cert_fingerprint is a sticky buffer 
Not a content modifier.
 7 years ago
Jeff Lucovsky 42452b327c mem: Use correct len with strlcpy 7 years ago
Victor Julien d19ded6c43 stream: fix progress for min_inspect_depth 
Make sure progress don't exceed raw_progress.
 7 years ago
Victor Julien 5f15e7c6a4 smtp: implement min_inspect_depth logic 
Implement min_inspect_depth for SMTP so that file_data and
regular stream matches don't go out of sync on the stream start.

Added toserver bytes tracking.

Bug #3190.
 7 years ago
Victor Julien 58e48bcb87 debug: make it easier to trace flush logic 7 years ago
Victor Julien 876f05aa28 eve/dhcp: remove leftover template comments 7 years ago
Victor Julien 9716c24ba1 eve/alert: clean up proto metadata 
Use a switch statement to select the protocol specific function.
 7 years ago
Victor Julien f66e12f7af dns: rename rust files and funcs 7 years ago
Victor Julien 842037d327 jansson: remove explicit <jansson.h> includes 
Header is included from suricata-common.h
 7 years ago
Victor Julien edd2cd626f jansson: remove HAVE_LIBJANSSON guards 7 years ago
Victor Julien b4318a11e3 rust: remove build system HAVE_RUST guards 7 years ago
Victor Julien 5e9714e384 rust: remove all HAVE_RUST guards 7 years ago
Jason Ish 8425259c88 help: better description for -v 
-v: be more verbose (use multiple times to increase verbosity)
 7 years ago
Jason Ish 71c53484ee logging: used fixed levels of verbosity for -v, -vv... 
Change the meaning of the verbosity flag to change the log
level to fixed levels instead of being relative to whats
configured.

-v    => INFO
-vv   => PERF
-vvv  => CONIFG
-vvvv => DEBUG

But do now allow -v to decrease the verbosity.

Bug #1851
 7 years ago
Jason Ish 89634b6508 logging: respect individual log levels 
The log level of individual loggers (console, file, syslog) was
being capped by the default log level. For example, if the
default log level was notice, setting the file level to info
would still result in notice level logging.

Bug #3210
 7 years ago
Konstantin Klinger 808ea0dba9 app-layer: remove obsolete msn protocol detection 7 years ago
Victor Julien 6d2bd6607e datasets: make clear the feature is experimental 7 years ago
Jeff Lucovsky d514a38913 log/anomaly: remove leading underscore from static var 7 years ago
Jeff Lucovsky 95879c0d5a logging/alert: Warn if metadata not selected 
Warn when HTTP body logging has been selected but applayer/metadata
logging is not configured.
 7 years ago
Jeff Lucovsky 354074bac6 ftp: Handle malformed RETR/STOR 
Ensure that RETR (STOR) have a filename -- otherwise, treat the command
string as malformed.

Added unittests for each command and verified that SEGV's occur without
parser change and no longer occur with the parser change.
 7 years ago
Victor Julien 7609adb05d Revert "runmode: consider test mode a user mode" 
This reverts commit 6dca50a322.

The test mode should actually test in system mode by default as
that is what tools like Suricata-Update need before issuing a
reload command.
 7 years ago
Victor Julien 0771eb1e0e detect/ja3: print error for one rule only 
Use 'silent error' logic for any other rules using ja3 as well.
 7 years ago
Victor Julien 4d44ca7739 detect/parse: allow signature parsing to fail silently 
A sigmatches 'Setup' function may indicate it intends to fail
silently after the first error. It will return -2 instead of -1
in this case.

This is tracked in the DetectEngineCtx object, so errors will
be shown again at rule reloads.
 7 years ago
Victor Julien aa5a6ab5f1 detect/parser: minor cleanup 7 years ago
Victor Julien c582fd28d9 tls/ja3: allow 'auto' setting for ja3 7 years ago
Victor Julien ca5226f0c7 tls/ja3: try to enable ja3 if rule keywords need it 7 years ago
Victor Julien 29dcd98ed1 tls/ja3: add way to check active config 7 years ago
Victor Julien 4cd3b84606 tls/ja3: allow dynamic enabling of ja3 7 years ago
Victor Julien 09882ec4cb detect/reference: implement strict parsing option 7 years ago
Victor Julien 89a717d41c detect/classtype: implement strict parsing option 7 years ago
Victor Julien b5521b58bc detect/parse: add --strict-rule-keywords option 
Add --strict-rule-keywords commandline option to enable strict rule
parsing.

It can be used without options or with a comma separated list:
--strict-rule-keywords
--strict-rule-keywords=all
--strict-rule-keywords=classtype,reference

Parsing implementations can use SigMatchStrictEnabled to check
if strict parsing is enabled for them and act accordingly.
 7 years ago
Victor Julien 88e26ea914 detect: use named enum for keyword types 7 years ago
Victor Julien 0b40d4ae93 detect/reference: allow undefined references 
References are currently not used in Suricata, so erroring out on
rules using a undefined reference is too harsh.

Just issue a warning once per unique missing reference.
 7 years ago
Victor Julien 61185cc9ba reference: change scope of add func to global 7 years ago
Victor Julien d17a3b3c2b reference: use global defines for size limits 7 years ago
Victor Julien e278953455 detect/reference: code cleanups 7 years ago
Victor Julien 523e91b231 detect/classtype: check size of rule input 7 years ago
Victor Julien e5f6f38481 classtype: handle missing classification.config 
Still initialize the classtype hash table so that the classtypes
rules use can be added to it.

The file missing now reports a warning instead of error, as we
will continue to work.
 7 years ago
Victor Julien 517834e327 classtype: use global defines for size limits 7 years ago
Victor Julien 99bdb54d9f detect/classtype: show file and line for unknown classtype 7 years ago
Victor Julien 43b5234055 detect/priority: use global define for default prio 7 years ago
Victor Julien 954c43daf4 detect/classtype: allow undefined classtypes 
Effect of classification on Suricata's working is minimal. Impact
of adding undefined classtypes is large: rules will fail to load
completely. This also leads multiple lines of log output per rule,
which in a large ruleset can lead to excessive output.

This patch changes the classtype keyword behavior. Instead of erroring
and invalidating a rule, we will merely warn.

The undefined classtype is then defined with a default priority,
so other rules using the classtype will not also warn. This way
there will be just a single warning per missing classtype.
 7 years ago
Victor Julien 323a747f39 classtype: increase id size 
Switch from u8 to u16 to allow for more classtypes.

Rename Signature::class to Signature::class_id to make it clear
it is an id.
 7 years ago
Victor Julien ccf6c5a6ef classtype: small memory reduction 
Reduce memory use by making sure SCClassConfClasstype
has a more optimal memory layout.
 7 years ago
Victor Julien 26e2370f99 classtype: put UNITTESTS guards where appropriate 7 years ago
Victor Julien e104c3d913 classtype: reduce scope of functions 7 years ago
Victor Julien a37e09cbe0 detect/classtype: change duplicate classtype behavior 
Detect duplicate instances and use the one with the highest
priority.

Use new priority flag to make the logic around explicit priority
sets easier to follow.

Minor code cleanups. Also clean up unittests.
 7 years ago
Victor Julien c471d81f04 detect/priority: change duplicate priority behavior 
Introduce Signature init_flag to indicate priority has been set.
This will be needed in a follow-up classtype update.

Detect duplicate priority instances in a keyword, and use the
highest priority in the rule. Do issue a warning in this case.
 7 years ago
Victor Julien 828d2572f8 detect: use BIT_U32 macros for INIT flags 7 years ago
Victor Julien 3fd4e7bd05 detect/priority: minor cleanups 7 years ago
Victor Julien bfee28db5e detect/classtype: clean up error handling 7 years ago
Victor Julien 5e5761a29c detect/classtype: warn on duplicate classtype 
Issue warning instead of erroring and invalidating the rule.

It's not a very serious issue, so don't error out.
 7 years ago
Victor Julien 282e1c2520 detect/classtype: fix parsing error checking 7 years ago
Jason Ish 2d0b3d7320 detect/test: update test for file prune changes 
As the file prune is now moved to the flow worker, the file
prune is run later, meaning the first file has not yet
been pruned from the file container list.

Adjust test to look for a second file, and check the
flags on that file.

For commit addressing bug 2490.
 7 years ago
Jason Ish ebcc4db84a file extraction: always prune files after detect 
If a keyword like filemd5 was being used without a filestore,
or a file output enabled, it would be pruned before detection
had a chance to match.

Consolidate file pruning to the end of the flow worker so files
are available for detection even when a file output is not
enabled.

Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2490
 7 years ago
Victor Julien c7e4433fe9 afl/decode: fix stats related memleak reports 7 years ago
Shivani Bhardwaj 8940a9d326 afp: nicer error message in case of fanout failure 
Use clearer message in case fanout is not supported or cluster_id is
already in use.

Closes redmine ticket #1940.
 7 years ago
Shivani Bhardwaj ac55b21184 suricata: Check if default log dir is writable 
At the startup, if the default log dir provided either by command line
options or suricat.yaml is not writable, the error comes quite later.
This patch makes suricata exit if there is such an error in the
beginning itself.

Closes redmine ticket #2386.
 7 years ago
Victor Julien 6dca50a322 runmode: consider test mode a user mode 7 years ago
Victor Julien 914c5b7975 datasets: fix error handling 7 years ago
Victor Julien 1021465f23 datasets: improve and doc return codes 7 years ago
Jason Ish a2fcc304e7 dataset: fix return value check on isnotset 
The dataset api returns -1 for not found.
 7 years ago
Victor Julien c6cda99bcd thash: fix prealloc config setting 7 years ago
Victor Julien e264a0cee8 datasets: fix hash table config 
Example:

datasets:
  ua-seen:
    type: string
    state: ua-seen.lst
    hash:
      hash-size: 100000
      prealloc: 1000
      memcap: 256mb
 7 years ago
Victor Julien 9b64b6794b datasets: change config to map 
Example:

datasets:
  ua-seen:
    type: string
    state: ua-seen.lst
  dns-sha256-seen:
    type: sha256
    state: dns-sha256-seen.lst
 7 years ago
Jason Ish 342fa8ee26 magic/test: remove NULL as format string 
Remove passing NULL as a format string parameter
in test. Convert to FAIL_IF_NULL.
 7 years ago
Jason Ish 0b02539ea9 drop.log: log deprecation warning if used 7 years ago
Jason Ish bfacedfad1 unified2: log deprecation warning when used 7 years ago
Jason Ish 57b4259640 filestore(v1): deprecation log warning when enabled 
Notify the user with a warning log that this feature is
deprecated and will be remove in v6 of Suricata.
 7 years ago
Jeff Lucovsky 04ee27bcd2 log/anomaly: Remove event_no from alert 7 years ago
Victor Julien 9340769ad2 enip: fix compile warnings in gcc-8 
In file included from suricata-common.h:471,
                 from app-layer-enip-common.c:27:
app-layer-enip-common.c: In function ‘DecodeCIPRequestPathPDU’:
util-debug.h:222:31: warning: ‘req_path_class8’ may be used uninitialized in this function [-Wmaybe-uninitialized]
             int _sc_log_ret = snprintf(_sc_log_msg, SC_LOG_MAX_LOG_MSG_LEN, __VA_ARGS__);   \
                               ^~~~~~~~
app-layer-enip-common.c:589:13: note: ‘req_path_class8’ was declared here
     uint8_t req_path_class8;
             ^~~~~~~~~~~~~~~
app-layer-enip-common.c:607:9: warning: ‘segment’ may be used uninitialized in this function [-Wmaybe-uninitialized]
         switch (segment)
         ^~~~~~
app-layer-enip-common.c: In function ‘DecodeCIPResponsePDU’:
app-layer-enip-common.c:773:13: warning: ‘service’ may be used uninitialized in this function [-Wmaybe-uninitialized]
     service &= 0x7f; //strip off top bit to get service code.  Responses have first bit as 1
             ^~
app-layer-enip-common.c: In function ‘DecodeCIPRequestPDU’:
app-layer-enip-common.c:503:25: warning: ‘path_size’ may be used uninitialized in this function [-Wmaybe-uninitialized]
     offset += path_size * sizeof(uint16_t); //move offset past pathsize
               ~~~~~~~~~~^~~~~~~~~~~~~~~~~~
app-layer-enip-common.c:506:5: warning: ‘service’ may be used uninitialized in this function [-Wmaybe-uninitialized]
     switch (service)
     ^~~~~~

Bug #3139.
 7 years ago
Victor Julien c769909dad eve/stats: update warning for new default behavior 7 years ago
Victor Julien 76e1836aed counters: improve handling missing global config 
Improve warnings when eve.stats can't work because of the global config
missing or disabled.

Issue warning if global config is missing but stats are still enabled due
to the legacy stats.log.

Issue clearer warning when stats are disabled and unix socket dump-counters
command is issued.

Warnings include links to docs.

Bug #2465.
 7 years ago
Victor Julien 2d381f93f3 stats: add global way to check if API is enabled 7 years ago
Victor Julien 5bfedf78fc posix: replace bzero with memset 
bzero(3): The bzero() function is deprecated (marked as LEGACY in
POSIX.1-2001); use memset(3) in new programs.  POSIX.1-2008 removes
the specification of bzero().

Use memset instead.
 7 years ago
Victor Julien 2da90a1cd8 posix: remove deprecated index/rindex calls 
Replace index by strchr and rindex by strrchr.

index(3) states "POSIX.1-2008 removes the specifications of index() and
rindex(), recommending strchr(3) and strrchr(3) instead."

Add index/rindex to banned function check so they don't get reintroduced.

Bug #1443.
 7 years ago
Victor Julien b82a0e2cad detect/port: more cleanups 
Remove unused funcs. Minor style updates.
 7 years ago
Victor Julien 8b0b301a15 detect/port: remove function only used in tests 7 years ago
Victor Julien ada0708e51 detect/port: unittest cleanups 7 years ago
Victor Julien 7864e8e7cc der/asn1: reduce max depth limit to 32 
OpenSSL uses 30, so this seems a reasonable limit.

Set a smaller limit than before to reduce the resources spent on
specially crafted input designed to be maximally expensive.
 7 years ago
Victor Julien 335ad2d8cc der/asn1: don't pass on more data than is specified 
Set and Sequence parsers would pass on max available data instead
of the size of their object.

Malformed data could trigger massive recursion this way, leading
to spending much more resources than necessary.

Found using AFL.

Bug #3185.
 7 years ago
Victor Julien 4ca83ca489 decode/ipv4: fix ts opt flags decoding 
Field is at data+1 offset, not +3. Also makes sure we always stay
within checked data bounds.

Reported-by: Sirko Höer -- Code Intelligence for DCSO.

Bug #3176.
 7 years ago
Victor Julien 7bb3dfcfc8 decode/ipv4: unittest to show parsing issue 7 years ago
Victor Julien 922f4f7d78 ssl: fix bounds checking in version decoding 
Reported-by: Sirko Höer -- Code Intelligence for DCSO.

Bug #3169.
 7 years ago
Jason Ish c8b49aee56 defrag: check minimum size of reassembled packet 
Before re-assembling, check that the first fragment is large
enough to contain the IPv4 or IPv6 header to prevent
an out of bounds read (IPv4) or write (IPv6).

Reported-by: Sirko Höer -- Code Intelligence for DCSO.

Bug #3171.
 7 years ago
Victor Julien 229eccdd04 ssl: minor cleanups 7 years ago
Mats Klepsland 05f6f5481a tls-log: restructure code for writing to buffer 
Restructure code to make it clearer that either 'basic', 'extended'
or 'custom' is being printed, by creating one function for each of
the possibilities.
 7 years ago
Mats Klepsland 03c8b82bfe tls-log: quick code cleanup 7 years ago
Mats Klepsland a151fe2225 tls-log: remove a wrongful comment 
The app-layer parser for TLS has been TX aware for quite some time.
Remove a comment that is stating that it is not.
 7 years ago
Mats Klepsland 85536e8918 tls-log: fix so buffer is reset on custom logging 
Move MemBufferReset() so it also works when using custom tls
logging. This avoids duplicate tls log entries.

Bug #3177
 7 years ago
Philippe Antoine af4f816204 http: sets compression bomb limit 7 years ago
Philippe Antoine c09ad01836 http: disable lzma decompression from configuration 7 years ago
Philippe Antoine 94aa36df1b lzma: replaces liblzma with own sdk for swf decompression 
so as to avoid memory exhaustion
 7 years ago
Yujie Zhao a121c7b460 Avoid to shutdown NSS if it is not initialized 7 years ago
Jason Ish 178d420f36 main: enable coredumps after privileges are dropped 
On Linux, by default, coredumps are disabled after
privileges are dropped. This re-enables coredumps
after privileges are dropped.

Redmine issue:
https://redmine.openinfosecfoundation.org/issues/1271

Credit to Elazar Broad for the pull request:
https://github.com/OISF/suricata/pull/3362
 7 years ago
Jeff Lucovsky b4070b6dcd ftp: Use rust parsers to parse dynamic ports 7 years ago
Philippe Antoine 9cbf9ef7a4 HTTP new parser warning for Ambiguous C-L 7 years ago
Shivani Bhardwaj d801c3e588 detect: Make keyword description consistent 
Closes redmine ticket #3137.
 7 years ago
Victor Julien d4bc460381 smtp: fix file_data inspection 
Continue tracking data if API is used with detect. Detection engine
then manages the tracking.

Bug #2395.
 7 years ago
Jason Ish afe065c7ac sip fixup: _Bool -> bool 7 years ago
Giuseppe Longo e06291922f detect/sip.response_line: add sticky buffer 
Matches on response line field in SIP.
 7 years ago
Giuseppe Longo 17de4a8023 detect/sip.request_line: add sticky buffer 
Matches on request line field in SIP.
 7 years ago
Giuseppe Longo 8939ece538 detect/sip.stat_msg: add sticky buffer 
Matches on status msg field in SIP.
 7 years ago
Giuseppe Longo bd2219cac6 detect/sip.stat_code: add sticky buffer 
Matches on status code field in SIP.
 7 years ago
Giuseppe Longo 8454122eb2 detect/sip.protocol: add sticky buffer 
Matches on protocol field in SIP.
 7 years ago
Giuseppe Longo 2661c5b298 detect/sip.uri: add sticky buffer 
Matches on uri field in SIP.
 7 years ago
Giuseppe Longo 424eead8c0 detect/sip.method: add sticky buffer 
Matches on uri field in SIP.
 7 years ago
Giuseppe Longo c88559dc72 output/json-alert: add sip metadata 
Put SIP information to alert event.
 7 years ago
Giuseppe Longo edc2a583a9 rust/sip: add SIP logger 7 years ago
Giuseppe Longo 2e975a0481 rust/sip: add parser for SIP protocol 7 years ago
Victor Julien a2356a89f7 detect/dns.opcode: improve error reporting 7 years ago
Jason Ish d79c23baa3 dns/detect: dns.opcode keyword 
Add a rule keyword, dns.opcode to match on the opcode flag
found in the DNS request and response headers.

Only exact matches are allowed with negation.

Examples:
  - dns.opcode:4;
  - dns.opcode:!1;
 7 years ago
Victor Julien c68fbfcfe6 htp: simplify depth check 7 years ago
Giuseppe Longo de904db830 app-layer-htp: use stream depth with filestore 
This permits to use stream-depth value set for file-store.

Currently if a file is being stored and hits a limit,
such as request or response body, it will be truncated
although file-store.stream-depth is enabled but the file should be
closed and not truncated.

Two unit tests have been added to verify that:
- a file is stored correctly
- chunk's length computation doesn’t cause an underflow
 7 years ago
Giuseppe Longo ed5a439b8e app-layer-parser: flag a tx to use stream depth 
This adds a new API that permit to set the stream-depth
file for file-storing when a rule with filestore keyword is matched.
 7 years ago
Shivani Bhardwaj b5b429c288 detect: Add missing keyword URLs and description 
Add missing keyword URLs and their description. Fix the ones that
were incorrect.

Partially closes redmine ticket #2974.
 7 years ago
Travis Green 08423282aa doc: add to sigmatch_table 7 years ago
Travis Green 4612d4b50a detect: syntax regex logic update 
Updated regex logic to include more spaces. Fixed spelling.
 7 years ago
Mats Klepsland e976d8cf74 output-lua: register app-layer parser logger for SSH 
Bug #3162
 7 years ago
Mats Klepsland 1e9f767deb output-lua: register app-layer parser logger for TLS 
Bug #3162
 7 years ago
Jason Ish 61a6eaf330 htp/lzma: set limit from configuration 
Also use a default defined in Suricata, not libhtp.
 7 years ago
Victor Julien c9c23d5cda htp: set lzma memlimit from config 7 years ago
Jeff Lucovsky 7808b946e3 detect/transform: add dotprefix keyword 7 years ago
Jeff Lucovsky 9df44afa30 logging/anomaly: Add warning code for anomaly log 7 years ago
Jeff Lucovsky aaacbf28c2 logging/anomaly: Support configuration filter types 7 years ago
Jason Ish 664605b5f1 rdp: disable rdp by default for 5.0 7 years ago
Jason Ish 0f10298990 rdp: address comments in pull request 
Pull request:
https://github.com/OISF/suricata/pull/4174

- fix commit: range -> set
- OUTPUT_BUFFER_SIZE -> JSON_OUTPUT_BUFFER_SIZE
- output: check for initdata first
 7 years ago
Zach Kelly caef8b5b38 protocol parser: rdp 
Initial implementation of feature 2314:
1. Add protocol parser for RDP
2. Add transactions for RDP negotiation
3. Add eve logging of transactions
 7 years ago
Shivani Bhardwaj 59da7ae302 counters: Add new default for decoder events 
Set the new default for decoder events to `decoder.event` instead of the
previously used `decoder`. Remove the corresponding warning for 5.0.
 7 years ago
Victor Julien 7cabb025ea ips: fix wrong thread for bridge ips modes 7 years ago
Phil Young 8aeff8f973 stream: fix bypass callback for stream.depth 
Fix bug with bypass callback when called with stream depth threshold.
bug report: https://redmine.openinfosecfoundation.org/issues/2986
 7 years ago
Jason Ish 52187d8548 ftp: removing uninitialized variable warning 
output-json-ftp.c: In function ‘JsonFTPLogger’:
output-json-ftp.c:129:9: warning: ‘js_respcode_list’ may be used uninitialized in this function [-Wmaybe-uninitialized]
  129 |         json_object_set_new(cjs, "completion_code", js_respcode_list);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
output-json-ftp.c:74:13: note: ‘js_respcode_list’ was declared here
   74 |     json_t *js_respcode_list;
      |             ^~~~~~~~~~~~~~~~
output-json-ftp.c:128:9: warning: ‘js_resplist’ may be used uninitialized in this function [-Wmaybe-uninitialized]
  128 |         json_object_set_new(cjs, "reply", js_resplist);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
output-json-ftp.c:73:13: note: ‘js_resplist’ was declared here
   73 |     json_t *js_resplist;
      |             ^~~~~~~~~~~
 7 years ago
Victor Julien a272e433a8 pd: don't reverse flow if TCP session not midstream 7 years ago
Jason Ish 5f1d21f247 dns: handle mid stream pickup on response packet 
Related Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2146
 7 years ago
Travis Green 9f8dcad287 doc: update of ssh-kewords documentation 
Modifies ssh-keywords.rst to fix syntax error in example rule as well as
update descriptions to indicate older keywords have been deprecated.
 7 years ago
Jeff Lucovsky 79d308db73 detect/analyzer: Add missing http_accept_enc handling 7 years ago
Victor Julien a3e5b91668 detect/dataset: fix 'state' path handling 7 years ago
Victor Julien 7ae86a0ae9 datarep: remove notice messages 7 years ago
Victor Julien 8045746bd1 datasets: remove notice messages and improve errors 7 years ago
Victor Julien 1d6a358d8a datasets: unix socket dataset-add command 7 years ago
Victor Julien 317376f59d datasets: match on lists of data 
Datasets are sets/lists of data that can be accessed or added from
the rule language.

This patch implements 3 data types:

1. string (or buffer)
2. md5
3. sha256

The patch also implements 2 new rule keywords:

1. dataset
2. datarep

The dataset keyword allows matching against a list of values to see if
it exists or not. It can also add the value to the set. The set can
optionally be stored to disk on exit.

The datarep support matching/lookups only. With each item in the set a
reputation value is stored and this value can be matched against. The
reputation value is unsigned 16 bit, so values can be between 0 and 65535.

Datasets can be registered in 2 ways:

1. through the yaml
2. through the rules

The goal of this rules based approach is that rule writers can start using
this without the need for config changes.

A dataset is implemented using a thash hash table. Each dataset is its own
separate thash.
 7 years ago
Victor Julien b286c14324 thash: generalize hash table as used in flow 
Thread safe hash table implementation based on the Flow hash, IP Pair
hash and others.

Hash is array of buckets with per bucket locking. Each bucket has a
list of elements which also individually use locking.
 7 years ago
Victor Julien 0b120bbe34 suricata: expose system as global 7 years ago
Victor Julien 5d5612f98e suricata: --data-dir option 7 years ago
Victor Julien dbbdfedb98 lzma: make mandatory 
Libhtp is starting to use it as well, so its safe to make it mandatory
here.

Remove guards for flash file decompression code.
 7 years ago
Philippe Antoine 8d4cbb3f7b http: fixes stream flags for http tests 7 years ago
Philippe Antoine 9665ab0409 http: wait for response line for filename 
See http evader case 481
 7 years ago
Victor Julien 579cc9f02b const: constify decoder, app-layer, detect funcs 7 years ago
Victor Julien 399ab35aa1 afl: fix compile warnings for decoder fuzz funcs 7 years ago
Philippe Antoine aa73d834b5 boyermoore: avoid one tolower call 
Fixes #1218
 7 years ago
Jeff Lucovsky 86deaefe66 ftp: Ensure non-zero command length with MPM init 7 years ago
Shivani Bhardwaj 85b56b633e detect: Improve rule keyword alproto registration 
1. Set WARN_UNUSED macro on DetectSignatureSetAppProto.
2. Replace all direct 'sets' of Signature::alproto from keyword registration.

Closes redmine ticket #3006.
 7 years ago
Nick Price d0a85b7550 ja3: Mention LibNSS dependency for JA3 7 years ago
Fabrice Fontaine 9b05db7db0 fix build on m68k with uclibc 
uclibc on m68k defines _POSIX_SPIN_LOCKS but does not define
pthread_spin_unlock so check for this function before using
pthread_spin_xxx functions

Fixes:
 - http://autobuild.buildroot.org/results/ed923bcc1454ce90444b8dac7c064b5f4ea4a0a5

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
 7 years ago
Jeff Lucovsky 86fabef093 ftp: address review comments 7 years ago
Jeff Lucovsky f79316d71a ftp: remove RUST guards 7 years ago
Jeff Lucovsky cc5e9ca179 eve/ftp: Modifications for MPM-enabled command descriptor table 7 years ago
Jeff Lucovsky bc68ef4657 app-layer: Invoke FTP parser cleanup function 7 years ago
Jeff Lucovsky 09ab032a8d ftp: Use MPM for command lookup 7 years ago
Jeff Lucovsky 4f2a485c55 ftp: Remove LIBJANSSON guards 7 years ago
Jeff Lucovsky 3df2b3437c eve/ftp: Move "get next line" into app-layer-ftp.c 7 years ago
Victor Julien f43584661c stream: support debug notice message in tfo 7 years ago
Eric Leblond 5366f80941 bypass: fix build on Windows 
For the sake of unittests, we need to build capture bypass so we
end up with a Windows build of flow bypass.
 7 years ago
Eric Leblond 53a62953e9 bypass: introduce CAPTURE_OFFLOAD 
This define is used to remove reference to capture bypass in case
no capture method implementing this is active.

This patch also introduces CAPTURE_OFFLOAD_MANAGER that is defined
if we need the flow bypass manager code.
 7 years ago
Eric Leblond 094d28d40e flow-hash: generalize function 
THis patch generalizes the function to get a flow by its flowkey
by removing the call setting it to capture bypassed state.
 7 years ago
Victor Julien 7384744c3e detect: fix FP on ICMP unreachable errors 
ICMP unreachable errors are linked to the flow they send an error for.
This would lead to the detection engine calling the TX inspection
engines on them.

The stream inspect engine would default to a match for non-UDP
and non-TCP as for ICMP we're not expected to use a TX inspect engine
for stream data.

This all would lead to a false positive match.

This patch fixes this by making sure the TX engines are not called if
the packet protocol and flow protocol are not the same.

Bug #2769.
 7 years ago
Jeff Lucovsky 240520a3cc main: fix typo in output 7 years ago
Jeff Lucovsky ef327ab194 stream/tcp: correct spelling typos 7 years ago
Victor Julien bc2267f131 stream/tcp: support TCP fast open 7 years ago
Victor Julien 8f8581beda decode/tcp: TCP fast open option decoding 
Support both regular TFO and TFO as part of the experimental
options support.
 7 years ago
Philippe Antoine c775a4af43 signature: fixes leak with duplicate signatures 7 years ago
Philippe Antoine 63deb8862f boyermoore: optimization with one alloc less 
Fixes #1220
 7 years ago
Philippe Antoine 5ff50773bd detectproto: adding missing probing parsers 
In direction TO_CLIENT for symetric protocols
 7 years ago
Eric Leblond cf98b0223e detect-geoip: add info for list keywords 7 years ago
Shivani Bhardwaj 9d6f1d318a unix/socket: Add rev date to version info 7 years ago
Jeff Lucovsky be22b23d2e cleanup: eliminate warnings/errors with debug build on macos 7 years ago
Shivani Bhardwaj 26bc0d6e1d src/detect: check DetectBufferSetActiveList return code 
Make sure to always check the return codes of DetectBufferSetActiveList.
Also, force this warning on function prototype.

Closes redmine ticket #3005.
 7 years ago
Philippe Antoine 15783fb322 signature: avoids overflow from VariableNameHash 7 years ago
Jeff Lucovsky 140bfd7b0c detect/analyzer: remove HAVE_LIBJANSSON cpp guards 7 years ago
Jeff Lucovsky 87bfce025d spelling: correct spelling typo 7 years ago
Jeff Lucovsky dcf5e247ca detect/analyzer: add support for http_content_type 7 years ago
jason taylor da2c4d7382 applayer: fix typo in debug output 
Signed-off-by: jason taylor <jtfas90@gmail.com>
 7 years ago
Andreas Herz 6ebb1b2cc4 rule-reload: enable rule-reload for -s and -S run as well 7 years ago
Victor Julien 3a912446ad pcap: fix breakloop error handling 
Ticket #3004
 7 years ago
Victor Julien 06d3e1d3d8 netmap: suppress format truncation warning 
CC       source-netmap.o
source-netmap.c: In function ‘NetmapOpen’:
source-netmap.c:327:56: error: ‘%s’ directive output may be truncated writing up to 15 bytes into a region of size between 10 and 57 [-Werror=format-truncation=]
         snprintf(devname, sizeof(devname), "netmap:%s%s%s",
                                                        ^~
                 ns->iface, strlen(optstr) ? "/" : "", optstr);
                                                       ~~~~~~
source-netmap.c:327:9: note: ‘snprintf’ output 8 or more bytes (assuming 70) into a destination of size 64
         snprintf(devname, sizeof(devname), "netmap:%s%s%s",
         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                 ns->iface, strlen(optstr) ? "/" : "", optstr);
                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
source-netmap.c:330:59: error: ‘%s’ directive output may be truncated writing up to 15 bytes into a region of size between 8 and 55 [-Werror=format-truncation=]
         snprintf(devname, sizeof(devname), "netmap:%s-%d%s%s",
                                                           ^~
                 ns->iface, ring, strlen(optstr) ? "/" : "", optstr);
                                                             ~~~~~~
source-netmap.c:330:9: note: ‘snprintf’ output 10 or more bytes (assuming 72) into a destination of size 64
         snprintf(devname, sizeof(devname), "netmap:%s-%d%s%s",
         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                 ns->iface, ring, strlen(optstr) ? "/" : "", optstr);
                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
source-netmap.c:316:54: error: ‘snprintf’ output may be truncated before the last format character [-Werror=format-truncation=]
         snprintf(devname, sizeof(devname), "%s}%d%s%s",
                                                      ^
source-netmap.c:316:9: note: ‘snprintf’ output 3 or more bytes (assuming 65) into a destination of size 64
         snprintf(devname, sizeof(devname), "%s}%d%s%s",
         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                 ns->iface, ring, strlen(optstr) ? "/" : "", optstr);
                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors

Gcc 8 with -Wformat-truncation=1
 7 years ago
Victor Julien bdd74d413b detect/mpm: put transform into 'profile name' 
So that profiling gives more info about cost of the mpm
engines when they use transforms.
 7 years ago
Victor Julien 5c735f340f detect/dns: register correct profile name 7 years ago
Victor Julien 8a59ad6096 string: making shortening function global 7 years ago
Victor Julien 26c5249574 device: break string shortening out of device shortening 7 years ago
Victor Julien 7eff6ec500 device: remove duplicate length check 
Shorten code handles all cases correctly.
 7 years ago
Victor Julien 2a136c917f detect: move includes/declarations closer to use 7 years ago
Victor Julien bc866ff2a0 detect: fix inaccurate comments 7 years ago
Max Fillinger 4f3bb48f83 pfring: Fix kernel version in comment 7 years ago
Eric Leblond b37554e0bc af-packet: fix build on recent Linux kernels 7 years ago
Philippe Antoine 477328f79b ssl: register probing for port 443 if no config 7 years ago
Shivani Bhardwaj 8c2c78f0b6 configure: Add date with rev information 
Date makes it even clearer that when was the last commit for the build
that one is running. Add this info alongwith rev. Change inspired by
rustc.

Before
```
$ suricata -V
This is Suricata version 5.0.0-dev (rev 2d217e666)
```

After
```
This is Suricata version 5.0.0-dev (2d217e666 2019-07-12)
```

Closes redmine ticket #3092
 7 years ago
Jeff Lucovsky 3d5eccf084 output/json: Refactor output buffer size macro 7 years ago
Jeff Lucovsky 66c565e9e7 eve/json: Break multiline FTP responses into array 
This changeset breaks multi-line FTP responses into separate array
entries. Multi-line responses are those with "text-1\r\ntext-2[...]".
Each of \r\n delimited text segments is reported in the `reply` array;
each text segment _may_ include a completion code; completion codes are
reported in the `completion_code` array.
 7 years ago
Jeff Lucovsky 9cf4e2e432 eve/ftp: Refactor and reduce logging functions 7 years ago
Jeff Lucovsky 911d423a6b ftp: Generalize prelim positive reply 
Extend special case for reply code 150 to handle all preliminary
positive reply -- reply codes with `1xy`.
 7 years ago
Victor Julien 343ba45916 ftp: reply code 150 doesn't end tx 7 years ago
Victor Julien b595da6c51 ftp: fix reply without request 
Permit picking up any reply w/o a request. Observed unsolicited server
messages before connection termination.

Previously the code assumed that this could only happen on connection
start when there was no previously recorded command.
 7 years ago
Victor Julien dc80d520af ftp: implement progress tracking 
Make sure FTP_STATE_FINISHED is returned for transactions that
are marked 'done'.

This is necessary for timely logging and inspection.
 7 years ago
Victor Julien 8ae691155d ftp: be more strict with tx type 7 years ago
Jeff Lucovsky fb019213e7 eve/ftp: minor cleanups and fixes 7 years ago
Zach Kelly 1588cd8735 eve/ftp: Bug fix and banner capture 
1. Correct off-by-one error in server response whitespace removal
2. Include banner response (before first command entered)
 7 years ago
Jeff Lucovsky a04b1c1664 eve/ftp: Log initial responses 
This changeset ensures that unknown commands are logged.
Unknown commands are either
- Banner responses when connecting to the FTP port
- Commands not includes in the FtpCommands descriptor table
 7 years ago
Jeff Lucovsky 2149807bd6 eve/ftp: Transaction support for unmatched requests 
Modified transaction logic to create a new transaction with each
request; replies location transactions by using the oldest "open"
(unmatched) transaction or the last transaction if none are open.
 7 years ago
Jeff Lucovsky 1930b1f504 eve/ftp: Log FTP transactions 
This changeset includes changes that
1. Add transaction support to the FTP parser
2. Support eve json logging of FTP transactions
 7 years ago
Philippe Antoine 2d217e6661 http: fixes overflow in range parsing 7 years ago
Victor Julien 5ddfc42b87 stream: fix midstream reverse flow handling 
When a TCP session is picked up from the response the flow is
reversed by the protocol detection code.

This would lead to duplicate logging of the response. The reason this
happened was that the per stream app progress tracker was not handled
correctly by the direction reversing code. While the streams were
swapped the stream engine would continue to use a now outdated pointer
to what had become the wrong direction.

This patches fixes this by making the stream a ptr to ptr that can be
updated by the protocol detection as well.

In addition, the progress tracking was cleaned up and the GAP error
handling in this case was improved as well.
 7 years ago
Philippe Antoine 94a976d47e ftp: removes one use of atoi 
Fixes only one small part of #3053
 7 years ago
Victor Julien 66d6196e9b pcap: code reformatting and minor cleanups 7 years ago
Victor Julien 255ab1528b flow: minor formatting updates 7 years ago
Max Fillinger bcc03f172a af-packet: Always fill in vlan_id 
The vlan tag will be filled in either from the extended header (for
kernel version >= 3.0) or from the packet itself.

Related to https://redmine.openinfosecfoundation.org/issues/3076
 7 years ago
Max Fillinger 09c54471e5 pfring: Always fill in vlan_id 
Previously, source-pfring.c would copy the vlan_id from the extended
header only if vlan.use-for-tracking was enabled. This commit removes
that check.

Related to https://redmine.openinfosecfoundation.org/issues/3076
 7 years ago
Max Fillinger 44bea80d3c decode erspan: Always fill in vlan_id 
Fill in the vlan_id fields unconditionally. We can now remove the check
for the vlan.use-for-tracking setting in decode.c. The debug log message
is moved to suricata.c.
 7 years ago
Max Fillinger 8d3b04b0e3 decode vlan: Always fill in vlan_id 
Since the vlan.use-for-tracking setting is now handled in flow-hash.c,
we can fill in the vlan_id fields unconditionally. This makes the vlanh
fields unnecessary.

Related to https://redmine.openinfosecfoundation.org/issues/3076
 7 years ago
Max Fillinger cef9961f59 flow hash: Mask vlan_id if not used for tracking 
If vlan.use-for-tracking is disabled, set the vlan_id fields to 0 when
hashing or comparing flows. This is done using a bitmask as suggested by
Victor Julien in IRC, in order to avoid adding more branches to this
code.

Currently, suricata does not fill in vlan_id fields if
vlan.use-for-tracking is disabled and instead leaves them at the default
0 value, so this commit makes no functional change. This change is in
preparation for future commits where the vlan_ids will be always filled
in.

Related to https://redmine.openinfosecfoundation.org/issues/3076
 7 years ago
Max Fillinger 38731d30da flow hash: Make CMP_FLOW macro an inline function 7 years ago
Victor Julien 7ccf14bc60 runmodes: remove unused prototypes 7 years ago
Victor Julien c12252617c afl: fix afl-ftp causing FPE due to missing ippair 7 years ago
Victor Julien 9e70716d5a runmodes: remove no-Rust logic 7 years ago
Victor Julien 8c6251ea6c runmodes: simply default runmode logic 7 years ago
Victor Julien 3282fb4967 runmodes: code cleanups 7 years ago
Philippe Antoine feda5e7392 leak: Fixes leak in AppLayerProtoDetectPMRegisterPattern 
Fixes #3070
 7 years ago
Philippe Antoine 66c500eaac leak: Fixes leak in DetectAppLayerEventPrepare 7 years ago
Philippe Antoine 684f101710 log: use SCLogError instead of fprintf 7 years ago
Philippe Antoine 19ab85f17e leak: fixes leak in DetectAddressParse2 7 years ago
Victor Julien 8b87801b80 geoip: fix unittests w/o db present 7 years ago
Victor Julien a7d65668ae mem: avoid potential shadow vars with 'len' name 7 years ago
Bill Meeks d1525c6fb8 mem: add SCStrndup() function to wrap strndup(). 7 years ago
Bill Meeks a291209e47 detect/geoip: migrate to GeoIP2 database format 
Issue #2765
 7 years ago
Victor Julien d6323ae33d detect/mpm: improve stats reporting 7 years ago
Victor Julien 24f0092b72 detect: add ipv6.hdr sticky buffer 
Inspects IPv6 header and extension headers.
 7 years ago
Victor Julien 3c9a557810 decode/ipv6: track length of ext hdrs 7 years ago
Victor Julien 9252400f68 decoder/ipv6: minor cleanups 
Remove unused field and macros.

Minor code style cleanups.
 7 years ago
Victor Julien 4ac327f5b5 detect/ipv4: add ipv4.hdr sticky buffer 7 years ago
Victor Julien 367e3e1895 detect/tcp/udp: minor cleanups 7 years ago
Victor Julien 4dff903b35 detect: introduce pkt mpm engines 
Instead of the hardcode L4 matching in MPM that was recently introduced,
add an API similar to the AppLayer MPM and inspect engines.

Share part of the registration code with the AppLayer.

Implement for the tcp.hdr and udp.hdr keywords.
 7 years ago
Victor Julien 14896365ef detect: remove Threadvars argument from API calls 
Remove it as it's (almost) never used. If it is really needed it can
be accessed through DetectEngineThreadCtx::tv as well.
 7 years ago
Victor Julien c1dd4534d9 detect/bsize: support transforms in case w/o content 7 years ago
Victor Julien 82de6e0659 decoder/vxlan: improvements and cleanups 
Implement port config handling. Also check both src port and dest
port for tunnels that only set the destination port to the VXLAN
port. At the point of the check we don't know the packet direction
yet.

Implement as Suricata tunnel similar to Teredo.

Cleanups.
 7 years ago
Henrik Lund Kramshoej 3519b011b7 decoder/vxlan: initial implementation of decoder 7 years ago
Victor Julien 35b88991c3 mem: fix shadow declaration warning 
Avoid clash by adding a leading underscore to the declaration in the
macro. These temporary vars should never clash with valid variables
from the code where they are called from.
 7 years ago
Philippe Antoine e30a77c5a1 warnings : Fixes integer sizes in format strings 7 years ago
Victor Julien ba5679de0f profiling: fix undefined profiling code use 7 years ago
Victor Julien ac694b089a detect: add udp.hdr sticky buffer 7 years ago
Victor Julien bdf53f449c detect/tcp: rename tcp keyword files 7 years ago
Victor Julien 47919fd0e4 detect/tcp: add tcp.<field> notation variants 7 years ago
Victor Julien 0cecb1c3b2 detect/prefilter: minor error handling cleanup 7 years ago
Victor Julien 35be8385eb detect: tcp.hdr sticky buffer 
Sticky buffer to inspect the TCP header.
 7 years ago
Victor Julien 47ef8f5822 detect/mpm: add l4-header support 
Prepare MPM part of the detection engine for a new type of per
packet matching, where the L4 header will be inspected.

Preparation for TCP header inspection keyword.
 7 years ago
Victor Julien 0965afd661 detect: pkt inspect engines 
Instead of hard coded calls to the inspection logic for
payload inspection and 'MATCH'-list inspection use a callback
approach. This will register a callback per 'sm_list' much like
how app-layer inspect engines are registered.

This will allow for adding more types later without adding
runtime overhead.

Implement the callback for the PMATCH and MATCH logic.
 7 years ago
Victor Julien 2a778e439a detect/build: minor code cleanups 7 years ago
Victor Julien 66648df099 detect: add tcp.mss keyword 
Allows matching on TCP option MSS.

Syntax:

    tcp.mss:<value>;
    tcp.mss:<value1>-<value2>;
    tcp.mss:<op><value>;

Operator can be: >, <.
 7 years ago
Jeff Lucovsky d2fdbc7d6f output/json: Avoid use of uninitialized value 
In JsonPacket, a Base64Decode error could cause an uninitialized
variable to be used because its return value is ignored.
 7 years ago
Jeff Lucovsky a5d9d37c34 rust/parser: Extend Rust parser for event-by-id 
Extend the Rust parsing infrastructure with the "get event info by id"
calls. This changeset extends the parser structure, the C-based
registration handlers and the template parser.
 7 years ago
Jeff Lucovsky 294d0e8cba snmp: Fix type 7 years ago
Jeff Lucovsky 9ccc28baeb rust/smb: Implement get event by id 7 years ago
Victor Julien 28ed0d3a18 nfs: implement get_event_info_by_id callback 7 years ago
Victor Julien 429ca858dc rust/gen: turn *mut*const T into const T ** 7 years ago
Jeff Lucovsky d568e7fadd eve/logging: 2991 Optimize logging by TX 
This changeset makes changes to the TX logging path. Since the txn
is passed to the TX logger, the TX can be used directly instead of
through the TX id.
 7 years ago
Jeff Lucovsky 488446cf37 logging/anomaly: Track event log progress 
This changeset adds a mechanism to track when individual events
are logged. Transactions can be provided more than once; track
events to prevent event re-logging.
 7 years ago
Jeff Lucovsky 4a39d7a1ee app-layer: Extend event container with progress 7 years ago
Jeff Lucovsky 07c05f7dd8 logging/anomaly: TX based logging addition 7 years ago
Jeff Lucovsky 36644907f5 app-layer/logging Add TX packet logging support 
Add transactional logging support for packet based loggers, like
the anomaly logger.
 7 years ago
Jeff Lucovsky f7b934f83f app-layer/logging: protocol parser updates 7 years ago
Jeff Lucovsky 49438569a2 logging: anomaly log updates 7 years ago
Jeff Lucovsky 50e23ba93a app-layer: Initial app layer logging 7 years ago
Victor Julien 4e8d38348f flow: no bypass manager for Windows 7 years ago
Victor Julien 287b87b81b bypass: switch to gettimeofday 7 years ago
Victor Julien d8614a15c6 mingw: fix compile error 
Declare _POSIX_C_SOURCE before sys/time.h to avoid:

util-time.c: In function 'SCUtcTime':
util-time.c:222:12: error: implicit declaration of function 'gmtime_r'; did you mean 'gmtime_s'? [-Werror=implicit-function-declaration]
  222 |     return gmtime_r(&timep, result);
      |            ^~~~~~~~
      |            gmtime_s
util-time.c:222:12: warning: returning 'int' from a function with return type 'struct tm *' makes pointer from integer without a cast [-Wint-conversion]
  222 |     return gmtime_r(&timep, result);
      |            ^~~~~~~~~~~~~~~~~~~~~~~~
util-time.c: In function 'SCLocalTime':
util-time.c:305:9: error: implicit declaration of function 'localtime_r'; did you mean 'localtime_s'? [-Werror=implicit-function-declaration]
  305 |         localtime_r(&timep, &cached_local_tm[lru]);
      |         ^~~~~~~~~~~
      |         localtime_s
util-time.c:321:56: warning: comparison between pointer and integer
  321 |         if (localtime_r(&timep, &cached_local_tm[lru]) == NULL)
      |                                                        ^~
cc1.exe: some warnings being treated as errors

Tickets: #2994 #3051
 7 years ago
Eric Leblond 6126f105ea util-ebpf: fix creation of flow from pinned maps 7 years ago
Eric Leblond 7df3007066 af-packet: xdp pinned maps need to be read 7 years ago
Eric Leblond 4ba02830b6 flow-bypass: registration of non periodic check 
This patch adds the capability to register a set of functions
without providing a periodic check function. This permit to
run a task only at init.
 7 years ago
Eric Leblond 3e8fd26ee3 flow-hash: real hash computation for FlowKey 7 years ago
Eric Leblond 0963fea390 util-ebpf: log bypassed flow maps count 7 years ago
Eric Leblond 7e5439bc15 bypass: add counter for local captured bypass 
Packets from captured bypassed flows that are received by Suricata
before the capture method start to bypass them can represent an
important part due to various buffer and insertion delay.

This patch adds a two counters to know the number of packets and
bytes in this case.
 7 years ago
Eric Leblond de52e78e65 bypass: flow bypass is not ebpf only 7 years ago
Eric Leblond c938dbde27 util-ebpf: early exit if no map 7 years ago
Eric Leblond e5d325a6ca util-ebpf: reindex 7 years ago
Eric Leblond aa989a7445 af-packet: some conditional fields 7 years ago
Eric Leblond abbb066a96 bypass: bytes and pkts counters for local bypass 7 years ago
Eric Leblond 9206b30fe1 af-packet: better accounting and error handling 
This patch improves the bypass error handling add adds more counters
to the interface so it is possible to get a view on success and
failure of insertion in the eBPF maps via the `iface-bypassed-stat`
command.
 7 years ago
Eric Leblond aeb2bd3aa1 util-ebpf: optimization on flow storage queries 7 years ago
Eric Leblond 288f335aa5 util-ebpf: simplify free function 
First key can't be null.
 7 years ago
Eric Leblond f4abe2f9c0 util-ebpf: set livedev in flow 
This will fix the accounting for pinned maps as the livedev field
of Flow is used to do the accounting of bypass flows.
 7 years ago
Eric Leblond 98e7d9d1c0 util-device: introduce bypassed stats sub function 7 years ago
Eric Leblond f29a4b8bee flow-manager: move bypass timeout to a inline func 7 years ago
Eric Leblond 89e8cb50ed util-ebpf: case is not possible so remove warning 7 years ago
Eric Leblond 8c97998cb9 bypass: implement iface-bypassed-stat for callback 7 years ago
Eric Leblond 51ab06256a bypass: account callback method in stats 7 years ago
Eric Leblond f78e5ba1e1 bypass: restore interface counter 7 years ago
Eric Leblond d119845d98 bypass: compress flow keys structure 7 years ago
Eric Leblond 69d2c8eb75 ebpf: get rid of hash in map value 7 years ago
Eric Leblond b07bda7a7b bypass: new callback stragegy 
This patch introduces and uses a new bypass strategy
based on a callback. EBPF bypass implementation is
updated to use this new strategy.

Once the flow manager detect that a flow should be timeouted,
it asks the capture method if it has seen packets in the interval.
If it is the case the lastts of the flow is updated and the timeout
is postponed.
 7 years ago
Eric Leblond fcae1c18de af-packet: improve error handling for some hw 
Some cards seems to return EAGAIN when there is no more place in
the hash table.
 7 years ago
Eric Leblond 0bfbb4a889 bypass: fix accounting 
The flow bypass stats is computed at every pass so the accounting
needs to be done at each pass. This patch fixes the accounting
in the flow_bypassed counters.
 7 years ago
Eric Leblond 44566e5a24 ebpf: only display that file is loaded if we do it 7 years ago
Eric Leblond 5e62ae6d28 af-packet: avoid error flooding when bypass fails 7 years ago
Eric Leblond af6daceeda util-ebpf: more useful error message 
At the time of the writing, libbpf output useful error message
on strdout only and errno is not really interesting. So let's
tell user to look at stdout.
 7 years ago
Eric Leblond 0f64c25b73 util-ebpf: improve code readability 
As pointed by Victor Julien, the pkts_cnt usage was quite confusing
so functions are now returning a bool.
 7 years ago
Eric Leblond a8f35cc30e util-ebpf: discard flow if no Flow storage 7 years ago
Eric Leblond efb648aa24 util-ebpf: fix ebpf bypass 
Fix endian order in eBPF bypass. It has to be updated after the
bypassed flows handling change.
 7 years ago
Eric Leblond f8aa9ee986 bypass: fix wait time at exit 
The loop on bypassed flow maps can take a few seconds on heavily
loaded system causing Suricata to not honor a stop before a few
seconds.

This patch adds the code needed to detect the need to exit from
the check loop.
 7 years ago
Eric Leblond a277f2eb0c af-packet: fix use after free on config 
ASAN did find that afp config was used after free. This was in
fact done in the Flow bypass manager hence this patch.
 7 years ago
Eric Leblond fc2f2fa7d3 bypass: allow bypass for packet without flow 
For capture method that have their own flow structure (not maintained
by Suricata), it can make sense to bypass a packet even if there is
no Flow in Suricata.

For AF_PACKET it does not make sense as the eBPF map entry will
be destroyed as soon as it will be checked by the flow bypass
manager. Thus we shortcut the bypass function if ever no Flow is
attached to the packet.

This path also removes reference to Flow in the bypass functions
for AF_PACKET. It was not necessary and we possibly could benefit
of it if ever we change the bypass algorithm.
 7 years ago
Eric Leblond 6ab1cbcb8e bypass: use flow storage for bypass counter 
There is a synchronization issue occuring when a flow is
added to the eBPF bypass maps. The flow can have packets
in the ring buffer that have already passed the eBPF stage.
By consequences, they are not accounted in the eBPF counter
but are accounted by Suricata flow engine.

This was causing counters to be completely wrong. This code
fixes the issue by avoiding the counter change in invalid
case.

To avoid adding 4 64bits integers to the Flow structure for the
bypass accounting, we use instead a FlowStorage. This limits the
memory usage to the size of a pointer.
 7 years ago
Eric Leblond 4e6add7faa bypass: generalize iface bypass stats 
Introduce functions in util-device.c to be able to manage the
flow bypassed count stats.
 7 years ago
Eric Leblond 258e90be76 util-ebpf: change flow accounting logic 
Update the flow counters during the life of a bypassed flow
instead of just accounting at the end of it.
 7 years ago
Eric Leblond 3026e9a80d util-ebpf: better error handling 7 years ago
Eric Leblond 2ffd3ad2b7 util-ebpf: better error handling of map unlink 7 years ago
Eric Leblond b952b32a26 util-ebpf: rename field 'unlink' to avoid confusion 7 years ago
Eric Leblond edf2db4e30 af-packet: improve warning message 7 years ago
Eric Leblond 567b5ee1bc af-packet: rename option 'no-percpu-hash' 7 years ago
Eric Leblond 0f6b1297a9 af-packet: warn when XDP is not supported 7 years ago
Eric Leblond b1c9b39435 af-packet: remove question from code 7 years ago
Eric Leblond 1992093c88 flow-bypass: rename variables 7 years ago
Eric Leblond d239e0f2d5 flow-hash: doc and code cleaning 7 years ago
Eric Leblond b736344975 flow-bypass: clock_gettime error handling 
Only reason clock_gettime could fail is a permission so let's
error and leave the flow bypass manager if it is the case.

Also let's suppress the error message if ever the error appear in
the middle of a run (which is unlikely).
 7 years ago
Eric Leblond 4129938c21 util-ebpf: log level fixes and code cleaning 7 years ago
Eric Leblond 140269a6be util-ebpf: init code optimization 7 years ago
Eric Leblond c5e2af0545 util-ebpf: fix error reported by coccinelle check 
Some allocation errors were not checked during init phase.
 7 years ago
Eric Leblond c1fd0da550 af-packet: add vlan_id in bypass key 
Bypassing on vlan was not supported due to the missing key.
 7 years ago
Eric Leblond 651a27e4fb ebpf: fix percpu hash handling 
An alignement issue was preventing the code to work properly.
We introduce macros taken from Linux source code sample to get
something that should work on the long term.
 7 years ago
Eric Leblond 142c69e1ef flow-bypass: increase bypass timeout 
This is needed as we did switch from counter maintained in kernel
to internal polling so we need a bigger value.
 7 years ago
Eric Leblond b8e184ceb5 flow-bypass: fix timeout of maps bypassed flows 
The time is taken from the parameter and is checked against real
flow entries so we need a standard time.
 7 years ago
Eric Leblond 07d0bd3a0f util-ebpf: fix IPv6 deletion loop 7 years ago
Eric Leblond b481f290e2 af-packet: fix bypass for IPv6 7 years ago
Eric Leblond 3bd8ba5d00 util-ebpf: add message if key deletion fails 7 years ago
Eric Leblond 269f601f8a util-ebpf: can't delete in place so update algo 7 years ago
Eric Leblond 5b056c15bf af-packet: fix default in pinned maps name 7 years ago
Eric Leblond eff56acca5 af-packet: be sure to nullify option if not set 7 years ago
Eric Leblond 36c6a62954 util-ebpf: simplify function declarations 7 years ago
Eric Leblond 69630d7a17 util-ebpf: micro optimization 7 years ago
Eric Leblond d21c3a6555 util-ebpf: create flow from bypassed flows 7 years ago
Eric Leblond 04c65a309e flow-hash: new function to get flow from flowkey 7 years ago
Eric Leblond 885fc992de ebpf: make table iterator generic 
Also adds a basic skeleton for flow creation loop.
 7 years ago
Eric Leblond 880c42f11c af-packet: bypass with init function 7 years ago
Eric Leblond 522e98d830 util-ebpf: fix iteration in flow timeout 
We were not setting the key using the correct item in map. Result
was deletion of wrong flow.
 7 years ago
Eric Leblond 0c3e1e8579 af-packet: correctly set up hardware offload 7 years ago
Eric Leblond bd28f77a1e af-packet: fix loading of ebpf filter 7 years ago
Eric Leblond 6fdcb127e9 af-packet: fix the start when XDP is pinned 7 years ago
Eric Leblond 7e0ef4cec8 util-ebpf: change return of pinned maps loading 
The calling function needs to be able to see when this is a success
and XDP do not need to be reloaded.
 7 years ago
Eric Leblond d950a9f272 util-ebpf: conditional flow table loading 7 years ago
Eric Leblond d25e8dbfc7 af-packet: implement pinned-maps-name 7 years ago
Eric Leblond 36838017fe af-packet: fix build when eBPF not built-in 7 years ago
Eric Leblond b1769d5f8f util-ebpf: implement pinned maps loading 
Load flow tables at start if asked to.
 7 years ago
Eric Leblond 96f1454ebf util-ebpf: only unlink pinned maps in eBPF filter 7 years ago
Eric Leblond 4cf531008e af-packet: conditionaly remove XDP filter 
Only remove the XDP filter if we are in XDP mode and not using the
pinned maps.
 7 years ago
Eric Leblond 4f48c45727 util-ebpf: conditional pinning of maps 
Only pin maps if `pinned-maps` is set in the configuration. This
ensure backward compatibility.
 7 years ago
Eric Leblond 73a928fa0b util-ebpf: fix loop on maps 
We were missing the last element of the map by working on previous
key instead of current key.
 7 years ago
Eric Leblond 3ce69c446b util-ebpf: suppress spaces at end of line 7 years ago
Eric Leblond 954762a429 ebpf: add filter by maps on example filter 7 years ago
Eric Leblond 5d8ac36a49 util-ebpf: pin the maps 
By pinning the maps we are creating a file in /sys/fs/bpf that can
be used by external program to access the map. This has multiple
benefits such as handling list from an external program.

The pinned maps could be persistent accross Suricata reload but
this can be complicated in term of handling everything in the life
of Suricata.
 7 years ago
Eric Leblond bf4381b17b ebpf: document XDP iface redirect 7 years ago
Eric Leblond a37a7c4a21 ebpf: reduce counter size to allow netronome offload 7 years ago
Eric Leblond 315c29a8e6 ebpf: change the logic to avoid ktime usage 
Kernel time is not available (and/or costly) on NIC such as
Netronome so we update the logic to detect dead flows based on a
lack of update of packets counters. This way, the XDP filter will
be usable by network card.

This patch also updates the ebpf code to support per CPU and
regular mapping. Netronome is not supporting it and the structure
is using atomic for counter so the cost of simultaneous update
is really low.

This patch also updates the xdp_filter to be able to select if the
flow table is per CPU on shared. Second option will be used for
hardward offload. To deactivate the per cpu hash, you need to set
USE_PERCPU_HASH to 0.

This patch also adds an new option to af-packet named no-percpu-hash
If this option is set to yes then the Flow bypassed manager thread
will use one CPU instead of the number of cores. By doing that
we are able to handle the case where USE_PERCPU_HASH is unset (so
hardware offload for Netronome).

This patch also remove aligment indications in the eBPF filter. This
was not really needed and it seems it is causing problem with
some recent version of LLVM toolchain.
 7 years ago
Eric Leblond 1745408c13 flow-manager: no force reassembly on bypassed flow 
When a bypassed flow is created we are forcing the reassembly so
we don't need to do it again when it timeout.
 7 years ago
Shivani Bhardwaj 7c7e04487f detect/content: Message for escaping backslash 
So far, if the rule loaded had a backslash character ("\") in its
content field, the rule will fail to load but without giving a
descriptive error message. This patch tells the user to escape the
troubling character.

Before
```
9409] 7/6/2019 -- 16:12:22 - (detect-engine-loader.c:184) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"Backslash needs escaping msg"; flow:established,to_server; content:"MyBackslash\here"; sid:86; rev:1; )" from file /var/lib/suricata/rules/myrule.rules at line 1
```

After
```
[9409] 7/6/2019 -- 16:12:22 - (detect-content.c:155) <Error> (DetectContentDataParse) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - '\' has to be escaped
[9409] 7/6/2019 -- 16:12:22 - (detect-engine-loader.c:184) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"Backslash needs escaping msg"; flow:established,to_server; content:"MyBackslash\here"; sid:86; rev:1; )" from file /var/lib/suricata/rules/myrule.rules at line 1
```

Closes redmine ticket #2626
 7 years ago
Victor Julien 7513f6cae2 threads: minor code cleanups 7 years ago
Victor Julien 92d38683ce threads: improve flow timeout loop 
Improve thread safety and remove BUG_ON
 7 years ago
Victor Julien e6b633cf95 stats: walk tv_root under lock 7 years ago
Victor Julien 9474b84683 stats: more accurate time handling for wakeup thread 7 years ago
Victor Julien ab1268cfea stats: minor code cleanups 7 years ago
Philippe Antoine b5f3e03209 New app layer event for invalid http request line 
Handles logs from libhtp even if case of error
 8 years ago
Philippe Antoine 4a74e9edcc signature: error for rules with illegal port 
Fixes #2080
 8 years ago
Philippe Antoine 248f9c66cf warnings: fixes integer sizes in format strings 
Fixes #3009
 8 years ago
Philippe Antoine a3e38861b9 http: adds unit tests for HTPParseContentRange 8 years ago
Philippe Antoine 90ab0b0ec2 http: fix overflow in HTPParseContentRange 8 years ago
Victor Julien 39cf5b0c8b snmp: fix 'defined but not used' warning 
Remove HAVE_RUST guards as well.
 8 years ago
Pierre Chifflier 8c61cfdca5 snmp.version: move unittests to tests/ 8 years ago
Pierre Chifflier 58d85b1460 snmp.pdu_type: move unittests to tests/ 8 years ago
Pierre Chifflier ff0ff6344f snmp.community: move unittests to tests/ 8 years ago
Pierre Chifflier 509a54281f detect/snmp: convert snmp.community keyword to v2, and MPM 8 years ago
Pierre Chifflier c67a53773b detect/snmp: rename keywords to snmp.<name>, and make rust mandatory 8 years ago
Pierre Chifflier 9dfec7e734 SNMP: add the "snmp.pdu_type" detection keyword 8 years ago
Pierre Chifflier e1dd19a0eb SNMP: add the "snmp.community" detection keyword 8 years ago
Pierre Chifflier aa608e0ca2 SNMP: add the "snmp.version" detection keyword 8 years ago
Pierre Chifflier ed4823bbe8 SNMP: add missing case for profiling enum 8 years ago
Pierre Chifflier 6fc7fc74cb SNMP: add logger 8 years ago
Pierre Chifflier 2df840a8b8 Add SNMP (v1/v2c/v3) application layer 8 years ago
Victor Julien cdd061ba37 ikev2: clean up c glue code 8 years ago
Victor Julien 3f36a6ce59 tftp: c glue code cleanup 8 years ago
Victor Julien ade2b1e6cf output: get rid of BUG_ONs 8 years ago
Victor Julien 9ea6db3889 pool: don't call Cleanup after failed Init 
Stream reassembly memcap is regulated by the Init and Cleanup
callbacks. If Init fails due to memcap reached, Cleanup had no
way of knowing and it would decrease the memcap even if it hadn't
been increased by Init. This could lead to too much memory use and
memcap counter underflow.

This patch fixes the issue by not calling Cleanup in this case. It's
fair to see a failed Init the responsibility of Init.
 8 years ago
Victor Julien 597ff3c8e3 pool/thread: clean up tests 8 years ago
Victor Julien 025cc64f55 pool/thread: remove old grow function 8 years ago
Victor Julien 67ba132c10 stream: simplify segment and ssn pool inits 8 years ago
Victor Julien 0b02efdf01 pool/thread: introduce simpler way to grow thread pool 8 years ago
Victor Julien 6e6c1bad7d pool/thread: minor code cleanups 8 years ago
Victor Julien 924982e792 app-layer: minor cleanups 8 years ago
Victor Julien ce71bf1fff capture: check for flow packets on capture timeout 
The capture threads can receive packets from the flow manager in their
Threadvars::stream_pq packet queue. This mechanism makes sure the packets
the flow manager injects into the engine are processed by the correct
worker thread.

If the capture thread(s) would not receive packets for a long time, the
Threadvars::stream_pq would not be checked and processed. This could
lead to packet pool depletion in the flow manager. It would also lead
to flows not being timed out/logged until either packets started flowing
again or until the engine was shut down.

The scenario is more likely to happen in a test (e.g. replay) but could
also delay logging on low traffic sensors.
 8 years ago
Victor Julien 952cbb563c app-layer: mandatory tx registration checks 
All protocols now implement the TX API, so the runtime checks for
whether or not a protocol supports the TX API can be removed.
 8 years ago
Victor Julien 8bc1e120ea app-layer: make tests tx aware 
Make tests minimally TX-aware so we can asume all parsers use
the tx API.
 8 years ago
Victor Julien 3526569b25 ssh: test cleanup 
Remove explicit locks. Set ALPROTO_SSH in all tests.
 8 years ago
Victor Julien 480f497d05 packetpool: move return stack to pool earlier 
If waiting for N packets move the return stack to the main
stack every time we take the return stack lock.

Make sure we consider enough packets when setting the pending pool
flush logic. This should at least make sure to have the 9 packets
the flow manager requires per run.
 8 years ago
jason taylor fa0008dbbe detect/content: clean up logging output 
Signed-off-by: jason taylor <jtfas90@gmail.com>
 8 years ago
Jeff Lucovsky 0960ca0d00 detect/analyzer Add missing HTTP values 
This changeset adds recognition of missing HTTP values
- Raw host
- Header names
- Server body
- User agent
 8 years ago
Philippe Antoine a370d2a91d signature: fix memory leak in DetectBytejumpSetup 8 years ago
Philippe Antoine 8a339e73d3 http: adds an event for double encoded uri 8 years ago
Philippe Antoine e5879650bb http: fixes double-encode configuration keywords 8 years ago
Mats Klepsland f634da61c9 ja3s-string: move unittests to tests/ 8 years ago
Mats Klepsland 736d35f36e ja3s-hash: move unittests to tests/ 8 years ago
Mats Klepsland 0b489f329c detect: add (mpm) keyword ja3s.string 
Match on JA3S string using ja3s.string keyword, e.g:

  alert tls any any -> any any (msg:"ja3s.string test";
      ja3s.string; content:"10-11-12"; sid:1;)
 8 years ago
Mats Klepsland 80cee50916 detect: add (mpm) keyword ja3s.hash 
Match on JA3S hash using ja3s.hash keyword, e.g:

  alert tls any any -> any any (msg:"ja3s.hash test";
      ja3s.hash; content:"b26c652e0a402a24b5ca2a660e84f9d5"; sid:1;)
 8 years ago
Mats Klepsland 03e8e658d7 lua: add Ja3SGetString function 
Add Ja3SGetString() to return the content of the JA3S string buffer from
the TLS session.

Example:

  function init (args)
      local needs = {}
      needs["protocol"] = "tls"
      return needs
  end

  function setup (args)
      filename = SCLogPath() .. "/ja3s_string.log"
      file = assert(io.open(filename, "a"))
  end

  function log (args)
      ja3s_string = Ja3SGetString()
      if ja3s_string == nil then
          return
      end

      file:write(ja3s_string .. "\n")
      file:flush()
  end

  function deinit (args)
      file:close()
  end
 8 years ago
Mats Klepsland b1d5fe9657 lua: add Ja3SGetHash function 
Add Ja3SGetHash() to return the content of the JA3S hash buffer from
the TLS session.

Example:

  function init (args)
      local needs = {}
      needs["protocol"] = "tls"
      return needs
  end

  function setup (args)
      filename = SCLogPath() .. "/ja3s_hash.log"
      file = assert(io.open(filename, "a"))
  end

  function log (args)
      ja3s_hash = Ja3SGetHash()
      if ja3s_hash == nil then
          return
      end

      file:write(ja3s_hash .. "\n")
      file:flush()
  end

  function deinit (args)
      file:close()
  end

In the example above, each JA3S hash is logged to a log file.
 8 years ago
Mats Klepsland a4eaef25d6 eve: add JA3S field to TLS JSON logger 
Add JA3S object to TLS JSON logger (extended log).
 8 years ago
Mats Klepsland a4471987ba app-layer-ssl: generate JA3S fingerprints 
Generate JA3S fingerprints based on fields in the ServerHello record.
 8 years ago
Alexander Gozman 3a16009966 Bug #2965: fix NFQ arguments parsing 8 years ago
Andreas Herz 8baf64f5e9 af-packet: fix setting block_timeout value through afpconfig 8 years ago
Jeff Lucovsky 462a4e2b5b detect/analyzer: Improve warning message 
This changeset modifies the warning printed when a rule
is determined to detect in both directions.
 8 years ago
Eric Leblond 5d76f0897c af-packet: remove rollover reference 
This patch removes reference to rollover in the configuration file
and add warnings when it is used.
 8 years ago
Philippe Antoine 037d50ef06 signature: fix overflow in parsing 8 years ago
Philippe Antoine 3e12066819 http: adds events for each libhtp log 
Fixes #997
 8 years ago
Mats Klepsland 3c57ac144c detect-ssl-version: move unittests to tests/ 8 years ago
Mats Klepsland 238797cc66 detect-ssl-state: move unittests to tests/ 8 years ago
Mats Klepsland 479e73b98e detect-tls-version: move unittests to tests/ 8 years ago
Mats Klepsland 767bde5e74 detect-tls-cert-validity: move unittests to tests/ 8 years ago
Mats Klepsland a260a57b68 detect-tls-sni: move unittests to tests/ 8 years ago
Mats Klepsland adb4da3975 detect-tls-ja3-string: move unittests to tests/ 8 years ago
Mats Klepsland 74a7b7e3cf detect-tls-ja3-hash: move unittests to tests/ 8 years ago
Mats Klepsland 5d3b94b3e4 detect-tls-cert-subject: move unittests to tests/ 8 years ago
Mats Klepsland 0d728ee4c6 detect-tls-cert-serial: move unittests to tests/ 8 years ago
Mats Klepsland e125e58c97 detect-tls-cert-issuer: move unittests to tests/ 8 years ago
Mats Klepsland 3646234ac5 detect-tls-cert-fingerprint: move unittests to tests/ 8 years ago
Mats Klepsland 12d37b8b2c detect-tls: tidy up unittests 
By doing the following:
- removing unnecessary locks
- moving variable declarations
- removing redundant function 'SigCleanSignatures'
 8 years ago
Mats Klepsland 15012fc908 ja3: check if JA3 is disabled on one line 8 years ago
Mats Klepsland 285855d928 detect-tls: remove NULL settings from keyword registration 8 years ago
Mats Klepsland 008f08c1b3 detect-tls: declare ssl_state as const in GetData() 8 years ago
Mats Klepsland 0f7f35bd85 detect-tls: check return values of functions on setup 
Check the return values of DetectBufferSetActiveList() and
DetectSignatureSetAppProto().
 8 years ago
Mats Klepsland 1c04d7cdae detect-tls: remove confusing underscores from variables 
Remove confusing underscore prefix from variables in GetData() for
all tls keywords.
 8 years ago
Jeff Lucovsky de983fb7c9 app-layer-ftp: Potential memory leak fixed 
Ensure that when handling failures during STOR command
processing, that all memory is freed on the error path.
 8 years ago
Mats Klepsland ba857e9739 detect: add tls.certs keyword 
Add keyword to do "raw" matching on each of the certificates in the
TLS certificate sticky buffer.

Example:
  alert tls any any -> any any (msg:"tls.certs test"; tls.certs; \
          content:"|01 02 03 04|"; sid:1;)
 8 years ago
Victor Julien edae50de94 detect/ssh: fix ssh.protoversion memory leak 8 years ago
Victor Julien 567a7c3cef detect/ssh: mark old ssh keywords as deprecated 8 years ago