You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
suricata/rules
Sascha Steinbiss 8f1e08b28e rfb: never return error on unknown traffic
We only try to parse a small subset of what is possible in
RFB. Currently we only understand some standard auth schemes
and stop parsing when the server-client handshake is complete.
Since in IPS mode returning an error from the parser causes
drops that are likely uncalled for, we do not want to return
errors when we simply do not understand what happens in the
traffic. This addresses Redmine #5912.

Bug: #5915.
(cherry picked from commit 1f8a5874fb)
3 years ago
..
Makefile.am rfb: never return error on unknown traffic 3 years ago
app-layer-events.rules app-layer: protocol change API 9 years ago
decoder-events.rules decode/events: add strict mode for udp.hlen_invalid; remove rule 4 years ago
dhcp-events.rules dhcp: add dhcp app-layer rules file 8 years ago
dnp3-events.rules rules: add missing classtypes for event.rules 9 years ago
dns-events.rules dns: parse and alert on invalid opcodes 3 years ago
files.rules rules: fix files.rules typo 7 years ago
http-events.rules http: adds debug check against too many warnings 6 years ago
http2-events.rules http2: decompression for files 5 years ago
ipsec-events.rules rules: fix event names for ikev2 (weak authentication and DH parameters) 8 years ago
kerberos-events.rules Kerberos 5: rename weak crypto to weak encryption, and log it 8 years ago
modbus-events.rules rules: add missing classtypes for event.rules 9 years ago
mqtt-events.rules mqtt: limits the number of active transactions per flow 4 years ago
nfs-events.rules rust/nfs: implement events 9 years ago
ntp-events.rules Add event rules for NTP events 9 years ago
rfb-events.rules rfb: never return error on unknown traffic 3 years ago
smb-events.rules smb: checks against nbss records length 4 years ago
smtp-events.rules smtp/mime: Set event when name exceeds limit 7 years ago
ssh-events.rules rules: add SSH decoder events rules 6 years ago
stream-events.rules stream: accept and flag ack of ZWP data 4 years ago
tls-events.rules rules/tls: sync with changes to the TLS events 6 years ago