aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
main
main-8.0.x
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.7
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '065dc02ae6'
${ noResults }
suricata/rules
History
Juliana Fajardini f839581dba pgsql: bound tx.responses (configurable) 
Since the PostgreSQL protocol doesn't impose any clear limits to how
many responses a backend could send, add one to the app-proto parser.

Using 21-64 as the accepted values, and 64 as the default:

The Start-up phase may have up to 17-18 ParameterStatus messages, plus
AuthOk, BackendKeyData and ReadyForQuery: 20, with extra room to be on
the safer side: 21

And 64 as upper limit, because as we currently summarize query
responses, we already don't get flooded by DataRow and Copy responses
messages, so we don't expect to see that many responses in a single
transaction for the pgsql, with the current implementation.

Ticket: #7263
 		2 months ago
..
Makefile.am rules: add sip-events.rules 5 months ago
README.md rules: add sip-events.rules 5 months ago
app-layer-events.rules rules: SID allocation range is now documented in README.md 6 months ago
bittorrent-events.rules rules: SID allocation range is now documented in README.md 6 months ago
decoder-events.rules rules: SID allocation range is now documented in README.md 6 months ago
dhcp-events.rules rules: SID allocation range is now documented in README.md 6 months ago
dnp3-events.rules dnp3: bounds reassembly 5 months ago
dns-events.rules dns: improved handling of corrupt additionals 2 years ago
enip-events.rules rules: SID allocation range is now documented in README.md 6 months ago
files.rules rules: spelling 4 years ago
ftp-events.rules ftp: do not error the flow on file before port 4 months ago
http-events.rules http1: limit the number of compression bombs per flow 4 months ago
http2-events.rules http2: respect max-table-size in headers size update 2 months ago
ipsec-events.rules rules: SID allocation range is now documented in README.md 6 months ago
kerberos-events.rules rules: SID allocation range is now documented in README.md 6 months ago
ldap-events.rules ldap: bound the number of responses 5 months ago
mdns-events.rules rules: add mdns rules 1 year ago
modbus-events.rules rules/modbus: remove rule for event that not longer exists 2 years ago
mqtt-events.rules mqtt: add too_many_properties event and limit 2 months ago
nfs-events.rules rules: SID allocation range is now documented in README.md 6 months ago
ntp-events.rules rules: SID allocation range is now documented in README.md 6 months ago
pgsql-events.rules pgsql: bound tx.responses (configurable) 2 months ago
pop3-events.rules rules: SID allocation range is now documented in README.md 6 months ago
quic-events.rules rules: SID allocation range is now documented in README.md 6 months ago
rfb-events.rules rfb: limit strings length 2 months ago
sctp-events.rules decoder/sctp: extend decoder 5 months ago
sip-events.rules rules: add sip-events.rules 5 months ago
smb-events.rules rules: SID allocation range is now documented in README.md 6 months ago
smtp-events.rules smtp: recover from invalid BDAT command syntax 3 months ago
snmp-events.rules rules: SID allocation range is now documented in README.md 6 months ago
ssh-events.rules rules: SID allocation range is now documented in README.md 6 months ago
stream-events.rules rules: SID allocation range is now documented in README.md 6 months ago
tls-events.rules ssl: add TOO_MANY_SUBJECT_ALTERNATIVE_NAMES event 2 months ago
websocket-events.rules rules: SID allocation range is now documented in README.md 6 months ago

README.md

Suricata Reserved SID Allocations

See https://sidallocation.org/ for more information.

Unless otherwise noted, each component or protocol is allocated 1000 signature IDs.

Components

Component Start End
Decoder 2200000 2200999
Firewall 2201000 2201999
Stream 2210000 2210999
Generic App-Layer 2260000 2260999

App-Layer Protocols

Protocol Start End
SMTP 2220000 2220999
HTTP 2221000 2221999
NTP 2222000 2222999
NFS 2223000 2223999
IPsec 2224000 2224999
SMB 2225000 2225999
Kerberos 2226000 2226999
DHCP 2227000 2227999
SSH 2228000 2228999
MQTT 2229000 2229999
TLS 2230000 2230999
QUIC 2231000 2231999
FTP 2232000 2232999
POP3 2236000 2236999
LDAP 2237000 2237999
SNMP 2238000 2238999
SCTP 2239000 2239999
DNS 2240000 2240999
PGSQL 2241000 2241999
mDNS 2242000 2242999
Bittorent 2243000 2243999
MODBUS 2250000 2250999
DNP3 2270000 2270999
SIP 2280000 2280999
HTTP2 2290000 2290999