aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
17,100 Commits
8 Branches
174 Tags
255 MiB
main
main-8.0.x
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.7
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'ef8b13c1ef'
${ noResults }
Commit Graph

17100 Commits (ef8b13c1ef0f6b001912c2ca337e0d036efb2140)
 

Author SHA1 Message Date
Lukas Sismis 9272fd9d98 dpdk: adjust auto mempool calculation when no TX queues set 2 years ago
Lukas Sismis 4f2ce17dc5 dpdk: allow zero TX queues when running in IDS mode 
When running in non-forwarding (IDS) mode, it is not required
to create TX queues for the interface.
This can be acheived by setting tx-descriptors configuration
field to 0.

Ticket: 7633
 2 years ago
Lukas Sismis 1be1c65b6e docs: double quote technical terms in DPDK section 2 years ago
Lukas Sismis e6811c51c6 dpdk: NULL freed variables 
The DPDKDeviceResourcesDeinit function now accepts second-level
reference to NULL the provided variable after deinitialization..
 2 years ago
Lukas Sismis fbe5ce7a2b dpdk: document vlan stripping offload 
Ticket: 5838
 2 years ago
Lukas Sismis 640d0985c2 dpdk: check for link up before full startup 
ICE card (Intel E810) was not receiving packets immediatelly
after startup, Suricata workers would act as processing while
it was not. This eliminates the problem by only continuing
in the initialization if the link is already up.

The setting can be turned off manually from the configuraiton
file.

Ticket: 7381
 2 years ago
Lukas Sismis 31fbfc322c dpdk: use default iface-copy value if not specified 
Ticket: 7374
 2 years ago
Lukas Sismis cb997a64dc dpdk: replace global with per-thread mempools 
It turned out that having global (interface-specific) mempool
that is shared by the threads of the interface is slower than
having individual mempools per queue for each interface.

The commit brings this change and should be user-invisible,
the config setting remains still as a number of objects of
all mempools summed (of that interface).

Ticket: 7382
 2 years ago
Lukas Sismis 5e2974458d dpdk: remove mempool pointer from the thread structure 2 years ago
Lukas Sismis 2ef2a9e26f dpdk: auto configure Rx/Tx descriptors and mempool size 
Ticket: 7380
Ticket: 7373
 2 years ago
Philippe Antoine 3a092f3027 detect: allow rule which need both directions to match 
Ticket: 5665

This is done with `alert ip any any => any any`
The => operator means that we will need both directions
 2 years ago
Jason Ish 81915548de ndpi: ignore packets that have a different proto than the flow 
This can happen when the flow is UDP, but an ICMP unreachable is
returned, which gets assigned to the same flow.

Reference: https://github.com/ntop/nDPI/issues/2762
 2 years ago
Jason Ish 66eb29affd doc/ndpi: move ndpi docs to new plugins section 
Moves the nDPI documentation to an nDPI page in the plugins
section. Remove the duplication of installation and setup
documentation.

Includes some minor cleanups.
 2 years ago
Jason Ish 10ed6280ff ndpi: fix memory in keyword setup 
- remove duplicate calls to ndpi_init_detection_module
- cleanup ndpi_init_detection_module when no longer needed
 2 years ago
Jason Ish d3835bbb11 detect: split new keyword id from registration 
Split DetectHelperKeywordRegister into 2 functions, one for acquiring
a new keyword ID, and another to perform the registration.

This makes it easier to do the traditional C keyword initialization
with a dynamic ID.
 2 years ago
Jason Ish 9c522a0ac9 eve/schema: add top level ndpi object 
The format is left free-form, as its controled by a plugin.
 2 years ago
Jason Ish 078b7a4251 github-ci: add ndpi build to the centos-stream9 build 
- Download and build nDPI
- Enable nDPI during Suricata ./configure
- Test that the plugin was built and installed
 2 years ago
Alfredo Cardigliano dfd9ef5784 ndpi: initial implementation of nDPI plugin 
Ticket: #7231
 2 years ago
Alice Akaki ce2e7aed74 detect: add email.date keyword 
email.date matches on MIME EMAIL DATE
This keyword maps to the EVE field email.date
It is a sticky buffer
Supports prefiltering

Ticket: #7591
 2 years ago
Alice Akaki 7750129c65 mime/email: log date and subject fields 2 years ago
Victor Julien 834378ff88 detect: per tx detect flags to a u8 progress value 
Reduce per tx space for tracking detection/prefilter progress. Instead
of a per direction u64 of flags, where each bit reflected a progress
value, use a simple u8 to track the linear progression through the
progress values. Use an offset to allow 0 to mean no value.

Add flags field as well to track "skip detect" and "inspect complete".
 2 years ago
Victor Julien 1542bcdc67 app-layer: add helper for AppLayerTxData cleanup 2 years ago
Victor Julien 8c9dfafc6d doc/tls: add more detail on tls.random 2 years ago
Victor Julien 682f1aac84 detect: reorder struct 2 years ago
Lukas Sismis 4a20baa6a8 landlock: add read/write permission to MPM cache directory 2 years ago
Lukas Sismis 7dc65c2f8a hyperscan: add caching mechanism for hyperscan contexts 
Cache Hyperscan serialized databases to disk to prevent compilation
of the same databases when Suricata is run again with the same
ruleset.
Hyperscan binary files are stored per rulegroup in the designated
folder, by default in the cached library folder.
Since caching is per signature group heads,
some chunk of the ruleset can change and it still can reuse part of
the unchanged signature groups.

Loading *fresh* ET Open ruleset:  19 seconds
Loading *cached* ET Open ruleset: 07 seconds

Ticket: 7170
 2 years ago
Lukas Sismis 59c3b8912b util-mpm: prepare MPM codebase for ruleset caching 2 years ago
Lukas Sismis 65cfc6d926 util-mpm-hs: refactor Hyperscan Pattern DB initialization to smaller functions 2 years ago
Lukas Sismis 939e16b12c detect-engine: remove commented out code 2 years ago
Lukas Sismis a5027e41e9 util-path: remove dead code 2 years ago
Lukas Sismis 2188cfca24 util-hash: add iterator for hash function 2 years ago
Lukas Sismis bd1885c71a hashlittle: add a safe variant of hashlittle2 function 
This variant of hashlittle2() ensures that it avoids
accesses beyond the last byte of the string, which will
cause warnings from tools like Valgrind or Address
Sanitizer.
 2 years ago
Philippe Antoine 879a733c12 doc/http2: explicit behavior for some http keywords 
HTTP/2 does not define a way to carry the version or reason phrase
that is included in an HTTP/1.1 status line.

Ticket: 6548
 2 years ago
Philippe Antoine 91389a40ce ci: test cargo fmt for some subdirs 
The ones that respect it as new
 2 years ago
Philippe Antoine c164cfcf6b plugins: check version for all plugins 2 years ago
Philippe Antoine 5742df3783 plugins: bind constant SC_PLUGIN_API_VERSION 2 years ago
Philippe Antoine 52862e50be plugin: constify some fields 
including the tx parameter to the logger function
 2 years ago
Philippe Antoine 1db49487a1 rust/detect: extend visibility of SIGMATH_NOOPT 
so that it can be used by plugins

Avoid export by cbindgen as this constant is also defined in C
 2 years ago
Philippe Antoine 2fa3a9fe62 template: rustfmt 
and use generic logger callback prototype with later cast

and do some other small modifications so that the plugin
has less diff
 2 years ago
Shivani Bhardwaj a4b8c5319c stream: make counter fns static 2 years ago
Shivani Bhardwaj 6aea48e8a6 util/stream: remove duplicate nested statement 2 years ago
Shivani Bhardwaj 7f98683d45 stream: use max-region setting from suricata.yaml 
1. Add key (commented) to suricata.yaml
2. Give the configured/default key preference, save a check
 2 years ago
Shivani Bhardwaj 22d05c289c stream: replace explicit logic w pre-existing fn 2 years ago
Shivani Bhardwaj 6d05e603cd stream: combine statements w same outcome 2 years ago
Shivani Bhardwaj 863c96f30d stream: fix minor typos 2 years ago
Shivani Bhardwaj 32d6fb9403 stream: use bool wherever possible 2 years ago
Shivani Bhardwaj d096b989c8 stream: add defensive checks and comments 2 years ago
Shivani Bhardwaj ce027af269 stream: remove unneeded else 2 years ago
Jeff Lucovsky a654ad9c9a output/buffer: Change buffer-size default value 
The buffer-size value that controls file output buffering defaults to
8k. To be consistent with previous logic, the default is being changed
to 0 (e.g., needed if there are old config files that don't specifically
enable the new value).
 2 years ago
Philippe Antoine ed5aed3f52 detect/ja: use multi-protocol support 
instead of hardcoding list : removes usage of ALPROTO_QUIC and
ALPROTO_TLS in generic SigValidate

Ticket: 7304
 2 years ago