[Oisf-devel] [COMMIT] OISF branch, master, updated. suricata-2.0beta1-254-gcb15000

noreply at openinfosecfoundation.org noreply at openinfosecfoundation.org
Thu Oct 3 05:25:50 UTC 2013


This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "OISF".

The branch, master has been updated
       via  cb150003879edc0128f1902db903c5466f86a733 (commit)
       via  43b39d333f2b006dc890b881e2e109e9773f20d0 (commit)
       via  85f13c4e2857befe80627393549352410aedc4dd (commit)
       via  636791751e75727fd2adeac1e7b34df1a50d3db1 (commit)
       via  5d10bafdbaa405a4d9c390ef814e625706d4c5b1 (commit)
       via  129b6a65ca20ed04076e2ab7efdd58e15021d8a5 (commit)
       via  2c50e411538f173ffba00823adf04901c1a768d1 (commit)
       via  10b05a6361ba3885d3d9b2ca6bba1b5a06c6fcd0 (commit)
       via  6f1cf9728edc304c37155993e14e9d5cced3dc2a (commit)
       via  f05efeb46f1286c0cb05830c3e85fffab1ea2075 (commit)
       via  64cd49da319d6eba11feed7e8a7e79effe9027c5 (commit)
       via  5f224f87d1e59f90969d45e6dcbbd6918083ee7d (commit)
       via  4e15cf2245186109fb4ec965ca675b95adb2d911 (commit)
       via  efc12b24ae802de6bd925fd8d6374b5e8744a9ce (commit)
       via  9bbd2a103da891ab9e2eccd66f69319c15619010 (commit)
       via  6cf7da30e2321740c94e6c43aa7ecb1f92f71043 (commit)
      from  d8cb821875d5b66f80b0b4bdfd3686d40c69f1c9 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit cb150003879edc0128f1902db903c5466f86a733
Author: Victor Julien <victor at inliniac.net>
Date:   Tue Oct 1 14:08:36 2013 +0200

    http: add new events for invalid host header and host part of uri

commit 43b39d333f2b006dc890b881e2e109e9773f20d0
Author: Victor Julien <victor at inliniac.net>
Date:   Tue Oct 1 13:49:39 2013 +0200

    http: fix some decoder events
    
    Some events we retrieved from error messages are flag now, so check
    those. Not all can be converted though. These are no longer set:
    
    HTTP_DECODER_EVENT_INVALID_TRANSFER_ENCODING_VALUE_IN_RESPONSE
    HTTP_DECODER_EVENT_INVALID_AUTHORITY_PORT
    
    Part of Bug #982.

commit 85f13c4e2857befe80627393549352410aedc4dd
Author: Victor Julien <victor at inliniac.net>
Date:   Tue Oct 1 12:20:07 2013 +0200

    http: update http rules

commit 636791751e75727fd2adeac1e7b34df1a50d3db1
Author: Victor Julien <victor at inliniac.net>
Date:   Tue Oct 1 12:15:41 2013 +0200

    http: fix field too long events

commit 5d10bafdbaa405a4d9c390ef814e625706d4c5b1
Author: Victor Julien <victor at inliniac.net>
Date:   Tue Oct 1 12:13:38 2013 +0200

    http: don't call HTPHandleWarning before HTPHandleError as the latter handles warnings and errors.

commit 129b6a65ca20ed04076e2ab7efdd58e15021d8a5
Author: Victor Julien <victor at inliniac.net>
Date:   Tue Oct 1 11:59:42 2013 +0200

    http: add test for HTTP_DECODER_EVENT_UNKNOWN_ERROR event as a result of a too long request

commit 2c50e411538f173ffba00823adf04901c1a768d1
Author: Eric Leblond <eric at regit.org>
Date:   Tue Oct 1 16:23:47 2013 +0200

    reject: try to fail more gracefully
    
    In the case of reject both, a failure in sending one way do not lead to
    abort the reset procedure.

commit 10b05a6361ba3885d3d9b2ca6bba1b5a06c6fcd0
Author: Eric Leblond <eric at regit.org>
Date:   Tue Oct 1 16:05:34 2013 +0200

    reject: clean respond-reject code.

commit 6f1cf9728edc304c37155993e14e9d5cced3dc2a
Author: Eric Leblond <eric at regit.org>
Date:   Thu Sep 26 19:57:19 2013 +0200

    reject: delete debug line

commit f05efeb46f1286c0cb05830c3e85fffab1ea2075
Author: Eric Leblond <eric at regit.org>
Date:   Wed Sep 18 13:27:49 2013 +0200

    Add reject for IPv6
    
    With this patch reject is now available in IPv6.

commit 64cd49da319d6eba11feed7e8a7e79effe9027c5
Author: Eric Leblond <eric at regit.org>
Date:   Fri Sep 13 13:46:19 2013 +0200

    configure: accept libnet 1.1 and 1.2.

commit 5f224f87d1e59f90969d45e6dcbbd6918083ee7d
Author: Eric Leblond <eric at regit.org>
Date:   Wed Sep 11 17:52:09 2013 +0200

    reject: update computation of seq and ack
    
    We have follow TCP RFC (http://tools.ietf.org/html/rfc793#section-3.4).
    There is two cases depending on wether the original packet contains a
    ACK.
    If packet has no ACK, the RST seq number is 0 and the ACK is built the
    standard way.
    If packet has a ACK, the seq of the RST packet is equal to the ACK of
    incoming packet and the ACK is build using packet sequence number and
    size of the data.
    
    Regarding standard Ack number, it is computed using seq number of captured
    packet added to packet length. Finally 1 is added so we respect the
    RFC:
        If the ACK control bit is set this field contains the value of the
        next sequence number the sender of the segment is expecting to
        receive.  Once a connection is established this is always sent.
    
    With this patch we have some correct results. With the following rule:
        reject ssh any any -> 192.168.56.3 any (msg:"no SSH  way"; sid:3; rev:1;)
    ssh connection to 192.168.56.3 is correctly resetted on client side.
    
    But this is not perfect. If we have the following rule:
        reject tcp any any -> 192.168.56.3 22 (msg:"no way"; sid:2; rev:1;)
    then the connection is not resetted on a standard ethernet network. But
    if we introduce 20ms delay on packets, then it is correctly resetted.
    This is explained when looking at the network trace. The reset is sent
    as answer to the SYN packet and it is emitted after the SYN ACK from
    server because the exchange is really fast. So this is discarded by the
    client OS which has already seen a ACK for the same sequence number.
    
    This should fix #895.

commit 4e15cf2245186109fb4ec965ca675b95adb2d911
Author: Eric Leblond <eric at regit.org>
Date:   Thu Sep 12 15:17:38 2013 +0200

    reject: fix typo

commit efc12b24ae802de6bd925fd8d6374b5e8744a9ce
Author: Eric Leblond <eric at regit.org>
Date:   Wed Sep 11 17:58:28 2013 +0200

    reject: use host-mode to set interface
    
    This patch update reject code to send the packet on the interface
    it comes from when 'host-mode' is set to 'sniffer-only'. When
    'host-mode' is set to 'router', the reject packet is sent via
    the routing interface.
    
    This should fix #957.

commit 9bbd2a103da891ab9e2eccd66f69319c15619010
Author: Eric Leblond <eric at regit.org>
Date:   Wed Sep 11 17:45:20 2013 +0200

    reject: reindent and code cleaning
    
    Reindent file and use some switch instead of if else if.

commit 6cf7da30e2321740c94e6c43aa7ecb1f92f71043
Author: Eric Leblond <eric at regit.org>
Date:   Fri Sep 13 12:21:04 2013 +0200

    Introduce host-mode.
    
    This variable can be used to indicate to suricata that the host
    running is running as a router or is in sniffing only mode.
    This will used at least to determine which interfaces are used to
    send reject message.

-----------------------------------------------------------------------

Summary of changes:
 configure.ac                  |    2 +-
 rules/http-events.rules       |   13 +-
 src/app-layer-htp.c           |  207 +++++++++++++++++++++--
 src/app-layer-htp.h           |    2 +
 src/respond-reject-libnet11.c |  382 ++++++++++++++++++++++++++++++++++------
 src/respond-reject-libnet11.h |    3 +
 src/respond-reject.c          |   81 ++++++---
 src/suricata.c                |   47 +++++
 src/suricata.h                |    9 +
 suricata.yaml.in              |    7 +
 10 files changed, 654 insertions(+), 99 deletions(-)


hooks/post-receive
-- 
OISF


More information about the Oisf-devel mailing list