Open Information Security Foundation

01/17/2025

04:22 PM Suricata Bug #7466 (Resolved): Lua Flowvar memory leak

Victor Julien

03:58 PM Suricata Feature #7508 (New): rules: ftp.reply keyword

Match on the tracked replies (eve's ftp.reply). Since there can be more than 1, it's probably a multi-buffer. Victor Julien

03:58 PM Suricata Feature #7507 (New): rules: ftp.completion_code keyword

Match on the tracked completion code (eve's ftp.completion_code) Victor Julien

03:57 PM Suricata Feature #7506 (New): rules: ftp.reply_received keyword

Match on the tracked reply received (eve's ftp.reply_received) Victor Julien

03:56 PM Suricata Feature #7505 (New): rules: ftp.mode keyword

Match on the parsed mode (eve's ftp.mode) Victor Julien

03:54 PM Suricata Feature #7504 (New): rules: ftp.dynamic_port keyword

Match on the parsed dynamic port (eve's ftp.dynamic_port) Victor Julien

03:53 PM Suricata Feature #7503 (New): rules: ftp.command_data keyword

Match on the command (eve's ftp.command_data) Victor Julien

03:53 PM Suricata Feature #7502 (Assigned): rules: ftp.command keyword

Match on the command (eve's ftp.command) Victor Julien

01/15/2025

11:34 AM Suricata Feature #7485 (In Progress): rules: allow specifying explicit hooks

Got a working minimal prototype going. Victor Julien

01/14/2025

08:58 PM Suricata-Update Bug #7425: matching: allow matching on a rule revision

Would be nice to have this. Just hit another case where I'd like to disable a bad rule rev, but not the whole rule. Victor Julien