Open Information Security Foundation

11/14/2024

03:34 PM Suricata Bug #7331 (Rejected): Packet direction check incorrect for Lua TLS functions

It turns out I'd got the direction wrong in the actual rule. When I added an extra "tls_cert_notbefore:" keyword to t... Chris Wakelin

10/16/2024

11:37 AM Suricata Bug #7331 (Rejected): Packet direction check incorrect for Lua TLS functions

I created a simple Lua rule to check for a TLS "notbefore" certificate date less than three days old. It didn't work ... Chris Wakelin

11/14/2016

01:05 PM Suricata Feature #1956 (Assigned): Add option to re-initialise Lua output scripts

It would be useful to be able to re-initialise Lua output scripts without restarting Suricata; for example when addin... Chris Wakelin

03/23/2016

12:37 PM Suricata Feature #1661: Improved support for xbits/hostbits (in particular ip_pair) when running with multiple threads

Finally got around to doing this - https://github.com/inliniac/suricata/pull/1958 Chris Wakelin

01/05/2016

10:12 AM Suricata Feature #1661 (Closed): Improved support for xbits/hostbits (in particular ip_pair) when running with multiple threads

I have been trying the the new xbit/hostbit features. I've put some test rules in https://github.com/EmergingThreats/... Chris Wakelin

11/20/2013

05:11 AM Suricata Bug #1042 (Closed): Can't match "emailAddress" field in tls.subject and tls.issuerdn

This rule:
@alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"RDG possible Upatre Downloader SSL certificate emai... Chris Wakelin

10/10/2013

04:24 AM Suricata Bug #989: Segfault in HTPStateGetTxCnt after a few minutes

Looks good - I've been running rev a26243a since yesterday afternoon, monitoring ~1Gb/s with no crashes (and slow mem... Chris Wakelin

10/03/2013

12:30 PM Suricata Bug #989 (Closed): Segfault in HTPStateGetTxCnt after a few minutes

I tried Suricata git - 2.0dev (rev 2f4e11b) - on the night of the 30th September on one of our networks.
Unfortuna... Chris Wakelin

05/14/2012

06:14 PM Suricata Bug #459: PF_RING 5.3.1 SVN changes to pfring_open()

PF_RING 5.4.0 has now been released. I got segfaults with the above patch (though I thought I had it working with an ... Chris Wakelin

05/08/2012

08:23 AM Suricata Bug #459 (Closed): PF_RING 5.3.1 SVN changes to pfring_open()

pfring.h in SVN (PF_RING 5.3.1) now has:... Chris Wakelin