aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
1,624 Commits
8 Branches
163 Tags
202 MiB
main-8.0.x
main-7.0.x
main
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '067e53403c'
${ noResults }
Commit Graph

1536 Commits (067e53403c3318ca79aa54f76856ea222316f187)

Author SHA1 Message Date
Victor Julien e685579231 Add optional structure validation code. 16 years ago
Victor Julien b67fb5229b Fix pcap file auto flow pinned runmode (disabled by default). 16 years ago
Victor Julien 393acd77d2 Detection improvements: uricontent escaping now working, better negated pattern (content) handling. 16 years ago
Gurvinder Singh 154a8b1ed9 fixed the build failure with profiling enabled 16 years ago
Victor Julien 37eb2290b0 Add some checks for 'impossible' conditions that become possible after enabling optimizations :-/ 16 years ago
Victor Julien 017b95f9ef More thoroughly cleanup a Packet when we recycle it. Fixes a corner case where we'd have a invalid tcp packet but p->proto would still say IPPROTO_TCP because of a previous run. Fixes bug #187. 16 years ago
William Metcalf 5580f3d9c2 PacketQueue postp added to TmEcodes for ipfw and pf_ring to silence compiler warnings 16 years ago
William Metcalf 876057a4da missing flow init in DetectTagTestPacket04 fix ut lockup on older os's 16 years ago
Victor Julien 7454336ef5 Make SigWrapper private to detect-parse.c and rename to SigDuplWrapper to reflect it's use and purpose. 16 years ago
Anoop Saldanha 9ecade76b9 in case of duplicate signatures used the one with the latest revision 16 years ago
Pablo Rincon eedafa3a17 Adding unittests for anchored pcres for anchored 16 years ago
Pablo Rincon bcb0b9ef9b Moving urilen inspection to detect-engine-uri. Adding unittests for pcre /U and urilen, in combination with uricontent 16 years ago
Anoop Saldanha 36e4b1830e add pcre with U modifiers to the umatch sigmatch list. fix for bug 155 16 years ago
Gurvinder Singh 8852b83fa7 flowbits, flowvars, pktvars, flow flags and app layer info added to alert-debug.log 16 years ago
Pablo Rincon 95fef55507 Fix threshold handling ip addr 16 years ago
Victor Julien 580b09c2b8 Make sure we inspect all outstanding reassembled stream chunks (smsg) if the stream is shutting down. Make sure to do inspect signatures that use dsize against the tcp packet payload, even if that payload was already added to the stream. Likewise, the dsize signatures are not inspected against the reassembled stream. 16 years ago
Victor Julien a3ff0e7210 Don't scan TCP packet payload if it was added to the stream. Inspect the tcp stream with the correct packet. Should fix #184 and #185. 16 years ago
Victor Julien d500a52b58 Fix valgrind error in tls unittest. 16 years ago
Victor Julien cff0a0bda2 Fix segv conditions caused by broken flow cleanup code. 16 years ago
Pablo Rincon a8cb8d830b Fix for bug 186 and thresholding issue handling ip versions 16 years ago
Victor Julien 6eb7eea705 Fix a data race for packet pool packets when defrag/tunnel code needs a packet. 16 years ago
Victor Julien a4cb7fced0 Fix thresholding code for packets that are neither (valid) ipv4 and ipv6. 16 years ago
Jason MacLulich ae095e585b o Changed SCMalloc to DecodeThreadVarsAlloc in Decode thread initialization. (Ish) o Changed htons to noths. (Ish) o Added support for handling DAG cards running DSM modules and other non-standard ETH ERF types. o Added support for allowing gracefull restarts of the fetch thread if it fails to read an ERF properly. 16 years ago
William Metcalf d5590962ff change LogInfo to LogDebug for icmp seq matches 16 years ago
Victor Julien 38c9d843fd Compiler warning fix for tag, make sure we do timeout checks under lock protection as well. 16 years ago
Pablo Rincon b931895901 Fixing flow cleanup and ctx initialization 16 years ago
Pablo Rincon eed0ef6e69 Adding tag keyword support 16 years ago
Kirby Kuehl 83c2cdabcd remove printf 16 years ago
Kirby Kuehl f49c743d44 dont alloc 0 length fragment 16 years ago
Victor Julien 6d68d7a450 Disable condition based waiting in ringbuffers until we fix lockup issues. 16 years ago
Victor Julien 0231ec612d Atomic macro's typo fix. 16 years ago
Victor Julien 8615e87623 Fix dcerpc unittest, add comments. 16 years ago
Kirby Kuehl 3a985a9f5f fix smb leak 16 years ago
Kirby Kuehl 4545d755dd add uuid to uuid_list for udp 16 years ago
Kirby Kuehl c3b9305259 dcerpc udp support 16 years ago
Kirby Kuehl 22d44b0677 dcerpc udp support 16 years ago
Victor Julien 6519a86ec7 Move packet pool to ringbuffer, update packet pool api and ringbuffer api. Remove memset usage from PACKET_RECYCLE, add proper cleanup macros. 16 years ago
Victor Julien cb2fef8680 In the ringbuffers spin before the wait 16 years ago
Victor Julien c7a744c937 Split ringbuffer queue handler into multiple, for mrsw, srsw, srmw modes. 16 years ago
Victor Julien 1ad289dfff Add thread cond_t based waiting in the ringbuffer. 16 years ago
Victor Julien dce323b1f4 Fix SCondWait -> SCCondWait typo. 16 years ago
Victor Julien 167c0295af Merge different ringbuffer structures. 16 years ago
Victor Julien 012e602c3f Add a (disabled by default) flow pinned runmode for file pcap. 16 years ago
Pablo Rincon 6950537a76 Move rate_filter rule tracking data from Signature to Threshold context 16 years ago
Pablo Rincon 1ae36b9a6a Adding rate_filter support for threshold.config, multiline support and unittests 16 years ago
Victor Julien ca7f54de25 Make sure ICMP unreach packets are not inspected against the flow sgh as it's for the original protocol, not for the ICMP packet. Fixes #174. 16 years ago
Victor Julien b8fec77f37 Fix tcp connections that are reset (RST packet) not always inspecting the reassembled stream. Update transaction id code to make sure both directions of a transaction are inspected before incrementing the inspect_id. 16 years ago
Victor Julien 26f69aa3a6 Bump version to 0.9.2. 16 years ago
Victor Julien e46b72758a Small decode-event code cleanup. 16 years ago
Victor Julien cdc9570f0e Have the detect.alerts counter count actual alerts. 16 years ago
Anoop Saldanha bbb5bf5c51 allow counters clubbing for detect TM 16 years ago
Victor Julien cb94748dab Add missing include resulting in a compiler warning. 16 years ago
William Metcalf 0e4235cc94 FLOW_DESTROY added to clean-up UT's that init flow 16 years ago
William Metcalf 9f0bf35cfd Set -std=gnu99 CFLAG always and Use -march=native by default if supported by installed version of gcc 16 years ago
Victor Julien 2f29b8a724 Improve detection of app layer, making sure we only handle app layer on 'established' packets. Should really fix #166. 16 years ago
Victor Julien 37442a8a84 Prefilter signatures before fully scanning them. 16 years ago
Anoop Saldanha 60668fd01d Reset the flags used during stateful detection in ContinueDetection(). Made the tests more descriptive as well 16 years ago
Anoop Saldanha bb8937477d dce tests to check SigMatchSignatures()'s working against new dce transactions 16 years ago
Victor Julien d6709b0961 Fix a segv caused by invalidly accessing the smsg_pmq array. 16 years ago
Victor Julien 8cea3779fa Move dce payload inspection to stateful detection engine. 16 years ago
Anoop Saldanha 015385c6bd changes to the dce parser stub data processed var. changed to stub data fresh var to indicate if the stub is fresh or not 16 years ago
Anoop Saldanha 45ea0d914e dce stub content keywords support using dcepayload.c support for all dce related content keywords 16 years ago
Anoop Saldanha 98433f407c dce rpc stub data held in separate buffers for request and response pdus 16 years ago
Victor Julien 31261e7583 Improve B2g performance by merging pattern array and hash. 16 years ago
Victor Julien 83b2c8abdb Improve stateful uri detection code. 16 years ago
Victor Julien 9dd753b5f3 Scan uricontent mpm on demand. 16 years ago
Victor Julien dd88e46f0c Fix detect engine state unittest, add another. 16 years ago
Victor Julien e8fce5f7fa Convert uricontent scanning to use the detect engine state. 16 years ago
Jason MacLulich 835630efbd Add initial support for reading packets from a DAG card, we only support reading from a single stream at this time. 
Use the --dag <dagname> cmd line option to specify from which DAG card to read pkts
from.

Issue at the moment with pkts being ejected during shutdown -- at the moment we
ignore any packets that are not of link type Ethernet.
 16 years ago
Victor Julien 49d68169ea Allow the user to disable setting cpu affinity and allow configuring the number of detect threads relative to the number of CPU's/CPU cores. 16 years ago
Victor Julien cb0bb668eb Add support for retrieving float and double variables from the configuration. 16 years ago
Victor Julien b60d2c4345 Fix flags mixup issue in the app layer. 16 years ago
Victor Julien ba12f3c109 Applayer to flow fixes and cleanups. 16 years ago
Pablo Rincon 8cc525c939 UDP support at AppLayer message handling 16 years ago
Ondrej Slanina 6bf7d76005 added possibility to run suricata as WIN32 service 16 years ago
William Metcalf cc76aa4bc6 properly init flows inside of unit-tests caused lock-up when falling back to using mutex locks 16 years ago
Victor Julien a24f288074 Moving the stream content scanning to have it's own mpm ctx. 16 years ago
Victor Julien 9a08d6c11c Fixes to stream pattern matching. 16 years ago
Victor Julien a0c1209a44 Inspect the reassembled stream together with the packet payload in the same direction. 16 years ago
Victor Julien 9f95ab7441 Make sure a stream that has a failing app layer inspection module no longer stops reassembly, but only app layer inspection. This way we can continue to inspect the reassembled stream. 16 years ago
Victor Julien 81f2499834 Store stream msgs processed by the app layer in the tcp session so they can be inspected by the detection module as well. The detection module returns them to the pool. 16 years ago
Victor Julien 3005297af2 Check for being properly setup before activating a thread. Fixes a potential although unlikely null-dereference. 16 years ago
Victor Julien 6c6e6321fc Fix HTTP HEAD detection code. 16 years ago
Victor Julien fdd0f3939e Reduce size of event bit array in the packet structure. 16 years ago
Victor Julien c26434fef1 Move flow use cnt to atomic and outside of the flow mutex protection. 16 years ago
Victor Julien 87345e5c60 Switch flow memuse counter to the atomic api. 16 years ago
Victor Julien 749fc2613d Add subtracktion wrapper to the atomic api. 16 years ago
Victor Julien 3484e2abde Fix flow engine memory handling. 16 years ago
Victor Julien 4dd0169499 Fix detection_filter issue. 16 years ago
Victor Julien 4c3e17d4ab Fix thresholding issues. 16 years ago
Ondrej Slanina 79443b1991 added INT and TERM signals on WIN32 16 years ago
Pablo Rincon b491ef2be0 Removing FlowAllocDirect since it's not needed anymore 16 years ago
Victor Julien 2fd31a1a11 Remove dsize grouping from detection engine grouping reducing memory usage. Store sgh in flow to reduce lookups. Reduce locking in alert handling. Increase default grouping values as we use less memory. 16 years ago
Victor Julien b657705d8c Fix pcap file mode not shutting down on ctrl-c 16 years ago
Victor Julien dff6795df5 Detect cleanups. 16 years ago
Victor Julien 8e7b147a23 Fix a endless loop condition introduced by the threshold cleanup. 16 years ago
Victor Julien d470e11352 Disable flowbits stats. 16 years ago
Victor Julien d8ad975d09 Clean up flags keyword. 16 years ago
Victor Julien 3a8c0d2cfe Fix ringbuffer number wrap around issue causing buffer items getting overwritten and thus lost. 16 years ago
Victor Julien 8514132851 Cleanup thresholding code. 16 years ago
Victor Julien f80016530c Remove unnecessary locking for thread-local packet-queues breaking on Win32. 16 years ago
Anoop Saldanha f4120ff5d5 wrap multi line macros in do while 16 years ago
Ondrej Slanina 1357914d23 added support for synchronous log output on WIN32 16 years ago
Victor Julien 32e3fea9e6 Exclude parts of a flow that are not changing after init from the flow mutex. Cleanup flow-hash function. 16 years ago
Pablo Rincon 29a6fc2f03 Adding some flow improvements and recovery on emergency mode 16 years ago
Victor Julien 329742c10e Small ip to pcap dev cleanup. 16 years ago
Victor Julien 1e707803c0 Enable perf counter updates in the ringbuffer queue handler. 16 years ago
William Metcalf a42fff541f fix for potential NULL deref on error in detect-http-method.c 16 years ago
Victor Julien 0140a14a15 Introduce atomic operations API that supports GCC's atomic operations and a fallback using (spin)locks. Convert ringbuffer api to use the new atomic api. 16 years ago
Victor Julien daea85e491 Lock detection state reset function properly. 16 years ago
Victor Julien 0a0b33ef79 Fix adding the http_uri sigmatch to the uri list twice. 16 years ago
Victor Julien e3fc53ecb9 Fix a corner case where the pcap receive modules could alloc packets at line rate until memory was depleted. 16 years ago
Victor Julien 0a607fce3d Finish http_uri keyword, fix invalid read issue in one of the tests. 16 years ago
Gerardo Iglesias Galvan 55dfa36963 Add support for http_uri keyword 16 years ago
Victor Julien 2fe77bf65e Use ringbuffers in the pcap live auto runmode as well. 16 years ago
Pablo Rincon 3b0c4133fc Fixing asn1 relative offset, negative values 16 years ago
Gurvinder Singh cda664a8c4 memroy leaks fixes in detection module, app layer and counters 16 years ago
Pablo Rincon 18954a2c4c app layer ftp fix (mem leak) 16 years ago
William Metcalf 9ce1399db8 Add option for setting pcap buffer size if it is available 16 years ago
Gurvinder Singh a0fa924c15 fixed the memory leaks in htp and radix tree 16 years ago
Victor Julien 7a6d4b57f0 Add support for class id in classification code. Submitted by firnsy@securixlive.com, thanks. 16 years ago
Gurvinder Singh a8ca5719f6 fixed the typo in byte_jump and host.c, Thanks to rmkml for pointing out 16 years ago
Gurvinder Singh 0881be3b17 added the support for setting up distance sig when previous keyword is byte_jump (bug 163) 16 years ago
Jason Ish ea4b7cc33b add profiling to stateful detection engine + other fixups. 16 years ago
Jason Ish a9ed9a8196 In profiling output, include a % for each rule. 16 years ago
Victor Julien 53acf08996 Add multi packet reading for pcap live mode. Add a partly lock free multi writer, multi reader ringbuffer. 16 years ago
Victor Julien 4e7df60b2f Make pcap file mode read multiple packets per 'read'. Update threading model to deal with this. 16 years ago
Victor Julien 6f502f0da5 lockfree ringbuffer wip2, including proper shutdown. 16 years ago
Victor Julien a48a767efc Lockfree ringbuffer wip. 16 years ago
Victor Julien 7f29166aa8 Improve memory handling in error conditions in the radix implementation. 16 years ago
Victor Julien c73e9318b0 Bump version 0.9.1. 16 years ago
Victor Julien 10a3d7343d Remove unnecessary header inclusion in app layer ssl. 16 years ago
Victor Julien bc7c9d928f Fix radix and stateful detect engine memory leaks. 16 years ago
Victor Julien 747daf4bce Fix typo in depth changes. 16 years ago
Victor Julien dab679889c Properly update depth if offset+content_len < depth. Fixes #164. 16 years ago
William Metcalf e704d90aaa set proper caps based run_mode 16 years ago
Jason Ish a93b2e6b84 Support for reading ERF files. 16 years ago
William Metcalf 2eef905c07 GPL and Copyright header updates. 16 years ago
William Metcalf 0fc8f6cc37 More null deref fixes for util-radix-tree.c 16 years ago
William Metcalf 54da99fe53 compilation fixes for PF_RING and IPFW after removal of mutex_pending 16 years ago
Victor Julien c2fb90c745 Fix thresholding 'both'. Fixes bug #160. 16 years ago
Victor Julien 2c8282a70b Fix small memleak in ip only parsing code. 16 years ago
Victor Julien 54c2804ce4 Fix malformed ipv6 packet causing an endless loop in exthdr decoding. 16 years ago
Victor Julien 2910759943 Rename TranslateIPToPcapDev to PcapTranslateIPToDevice and make the length argument size_t. 16 years ago
Ondrej Slanina 55d0d1e7a1 added support for finding pcap device via it's IP. 16 years ago
William Metcalf 179372978f Null deref fix for detect-id.c 16 years ago
William Metcalf 9728e49773 Null deref fix for detect-tls-version.c 16 years ago
William Metcalf 32a2da147b Null deref fix for detect-engine-iponly.c 16 years ago
William Metcalf 73d2349149 Null deref fix for detect-engine-port.c 16 years ago
William Metcalf afa8a2b8ba Null deref fixe for detect-engine-address.c 16 years ago
William Metcalf b856e607c9 Null deref fixes for util-radix-tree.c 16 years ago
Victor Julien 98c3f0149c Improve SSL input validation. 16 years ago
Gurvinder Singh 5fe1dc1d24 support for sslv2/sslv3 their unit tests and better stream no reassembly flag handling 16 years ago
Victor Julien b8641f300d Rename asn1 files, fix an invalid free, fix improper init of vars in one unittest. 16 years ago
Pablo Rincon 3fa3229e01 ASN1 decoder and keyword implementation 16 years ago
Gurvinder Singh 6b49a90353 added support for setting up bytejump relative when previous keyword is byte_jump (bug 165) 16 years ago
Victor Julien 70b32f7380 First stab at creating a stateful detection engine. 
Stateful detection for app layer detection keywords, except uricontent. Stores it's partial results in the flow structure. Other modifications:

- Generalize transaction tracking, logging and inspection.
- Adapt http and dcerpc to use the new transaction handling.
- Stream engine now always notifies app layer of a stream eof.

This commit fixes bug #124.
 16 years ago
Jason Ish 18e5ac8cde Basic rule profiling even though the results may be skewed by a bad rule in a grouping of rules. 16 years ago
William Metcalf b629b7c5c1 only show cli opts via help that we have support for 16 years ago
Victor Julien 42eeb84c9a Properly lock flow before setting IP only action flags. Small alert api cleanups. 16 years ago
Pablo Rincon 9bae6a8628 Moving alert logic to detect-engine-alert.c 16 years ago
Victor Julien 692eb935ea Fix updated memory api using debug mode by default. Small cleanups. 16 years ago
Gerardo Iglesias Galvan 9f4fae5b1a Fix inconsistent use of dynamic memory allocation 16 years ago
Victor Julien a8dd484aba Fix small potential bug in debug mode found by clang. 16 years ago
William Metcalf 8d66323f62 clang fixes for null derefrences 16 years ago
Gurvinder Singh 32a2658233 support setting up byte_test/relative when byte_jumo is previous keyword 16 years ago
Gurvinder Singh 9378bdbad4 set the byte_jum/byte_test with relative keyword when pcre is previous keyword (bug 142) 16 years ago
Gurvinder Singh ea3165b198 support setting up within keyword when previous keyword is pcre (bug 145) and added unit test for the same 16 years ago
Gurvinder Singh 07e10681d6 fixed a typo in the detect-content.h 16 years ago
Gurvinder Singh 2ea8205063 fixed the flags checking and make it more strict in default case (bug 153) 16 years ago
Victor Julien bb685751d9 Fix NFQ receive/verdict race condition in cases where the packetpool is empty. 16 years ago
Victor Julien 647b1c0eba Fix NFQ compilation. 16 years ago
Victor Julien f4812586de Fix broken ICMPv4 unittests. Fixes #161. 16 years ago
Victor Julien ecf5a8fbcc Fix broken stream unittest. 16 years ago
Victor Julien 76d62778c3 Use bigger stream msg. 16 years ago
Victor Julien 61099cd725 Fix compilation if debug is disabled. 16 years ago
Victor Julien e741bd0202 Cleanup packet recycling code. Fix issues in the packet tunnel/pseudo code. 16 years ago
Victor Julien e1a8c8f76c Switch time api from mutex to spinlock. 16 years ago
Victor Julien 19584d0416 Fix tunneled and defrag reassembled packets with the new pending limits. 16 years ago
Victor Julien ccf22cf563 Move to different way of enforcing max_pending. Should require less locks. 16 years ago
Victor Julien 42c4b5d53c Use one less thread in pcap file mode. Reduces locking overhead. 16 years ago
Victor Julien 53b388b669 Improve flow hash debugging, switch to csv output. 16 years ago
Victor Julien 548a3b2c93 Improve flow hash debugging functions. Make sure ICMP errors don't create flows. Handle ICMP DEST UNREACH errors in the flow they are sending the error about. 16 years ago
Victor Julien 2dc5405d3a Add debug code for tracking flow hash distribution. Only add ICMP DEST_UNREACH packets to the flow engine. 16 years ago
Gurvinder Singh a4625bd333 fixed setting up byte_test relative when byte_jump is previous keyword (bug 146) 16 years ago
Gurvinder Singh b05762a575 added unit test for the bug 144 to test isdataat setup 16 years ago
Gurvinder Singh fdc3f728af set the isdataat keyword when previous sigmatch is either content or pcre (bug 144) 16 years ago
Victor Julien 8dceb2784e Small ICMPV6PayloadTest01 unittest cleanup. 16 years ago
Gurvinder Singh 9a2bcb6a3c added unittest to check the payload setup, which causes the segv in detection module 16 years ago
Gurvinder Singh 21a89e22de fixed the segv caused by null payload due to incorrect icmpv6 decoding 16 years ago
Victor Julien 0ebf7cbc5e Convert flow bucket lock from mutex to spinlock. Locks should be very short, so spinlocks should be faster. 16 years ago
Victor Julien e27cefa6f7 Complete conversion of pattern id mpm storage vs sig id storage. 16 years ago
Victor Julien 46831e0f8f Fix signature grouping bug for protocols without ports. Add debugging code. 16 years ago
Victor Julien 7a427ec7f4 Switch to pattern id based results checking in the mpm. Move app layer proto detection towards a more signature based approach. 16 years ago
William Metcalf 41172f0024 increment packet count before assigning value, tshark/wireshark starts with pkt no 1 so should we 16 years ago
Pablo Rincon 46187bfe73 Fix action logic after last pass changes 16 years ago
Gurvinder Singh 2db6756048 added unit test for the icmp dsize (bug 151) 16 years ago
Gurvinder Singh ad9ec4dbe9 fixed the payload_len for icmpv6 (bug 151) 16 years ago
Gurvinder Singh 3721037de5 unittests for bug 134&139 and some typo correction 16 years ago
Victor Julien 52cdfb332e Fix a compiler warning, add some comments, cleanup layout of smb parser. 16 years ago
root 73c6fb16ba Return 0 instead of -1 when SMB and DCERPC encounter non fatal errors to clean up errors emitted in AppLayerParse. 16 years ago
William Metcalf 7d63fbdaea small CentOS 4 workarounds 16 years ago
William Metcalf 5fb405335e Small wrapper fixes to allow for windows compilation 16 years ago
Victor Julien a372c1d14e Fix/workaround a strange detection issue. 16 years ago
Victor Julien bca75f6255 Bump version to 0.9.0. 16 years ago
Victor Julien ce90e87304 Fix failing thresholding unittests 16 years ago
Pablo Rincon e18e2ec998 Changing threshold logic 16 years ago
Pablo Rincon 8bcdf29ab7 Small fix on pass action handling and added more unittests 16 years ago
Pablo Rincon 1238668961 Adding actions order and suport for rule action "pass" 16 years ago
Victor Julien 6dd5446893 Use proper tcp/udp macro's in alert-debuglog 16 years ago
Victor Julien 26ef58342d Fix typo in uricontent within handling causing within to be wrong. 16 years ago
Victor Julien cc5c78dae9 Add tcp seq info and pcap file packet number to the alert-debuglog. 16 years ago
Victor Julien 543abf145c Fix a within calculation bug for cases where distance + pattern length > within setting. Fixes #148. 16 years ago
Pablo Rincon 9ccfda22ec Radix tree issue fix (from Steve Grubs report) 16 years ago
Victor Julien 2576f4a149 Fix a bug in the signature grouping code that didn't properly setup the mpm ctx's in some cases. 16 years ago
Victor Julien b90ebc1ce5 Add a packet count var for pcap file mode to the Packet structure to ease debugging. 16 years ago
William Metcalf ce01927515 Import of GPLv2 Header 050410 16 years ago
Victor Julien c3392b7c22 Fix checking for the stream GAP after the ssn ptr was initialized. 16 years ago
Victor Julien b6a45fd1a4 Hack around cornercase in debug code in stream engine. Works around #140. 16 years ago
Victor Julien 9676273e6d Kick out streams with gaps in them in the app layer parser until we add proper support. 16 years ago
Pablo Rincon 6abcb0d1fd http_heade fix, check first that we have a connp before checking transactions 16 years ago
Victor Julien 070ed778b8 Libcap-ng support by Gurvinder Singh and myself. Basic support for per thread caps is added, but not activated as it doesn't seem to work yet. Work around for incompatibility between libnet 1.1 and libcap-ng added. 16 years ago
Victor Julien e0c2c86342 Make HTTP proto detection more reliable. Add HEAD keyword. Thanks rmkml for the report/request. 16 years ago
Gurvinder Singh 07ff24301f fixed the depth updation when content_len is small (bug 139) 16 years ago
Pablo Rincon 1891c2a60d Adding missing error msgs at some http_header unittests 16 years ago
Gurvinder Singh e0b4838471 fix bug 133, error caused by seq mismatch in fin_wait_2 state, whis was dicarding the packet which should be accepted 16 years ago
Pablo Rincon 83f5be11e7 Fixing http_header unittest printf errors format 16 years ago
Pablo Rincon ab02ab9ead adding http_header keyword support 16 years ago
William Metcalf 57a679be49 Small fix where a space was added before \n in fast-log if a xref wasn't used 16 years ago
Gurvinder Singh 074b896879 fixed typo in dcerpc (bug 137) 16 years ago
Gurvinder Singh 5b802f6099 fixed type in htp (bug 138) 16 years ago
Gurvinder Singh 7330bcd12c fixed the regex in bug 136 16 years ago
Gurvinder Singh 0c4687f768 correct the typos (but 135) 16 years ago
Victor Julien 294b39bb3a Properly set content and uricontent depth. Fixes #134. 16 years ago
Gurvinder Singh 719fa5f5e1 fixed the incorrect depth update incase of offset is 0 (bug 134) 16 years ago
Victor Julien fc2029ef58 Fix small memuse counter issue in flow subsys, remove emergency printfs 16 years ago
Jason Ish 00974d157b Fix issue 131. 
Flow-timeouts likely don't need to be a sequence, but rather mappings.  We'd only need a sequence if you wanted to list something like "tcp" twice which I don't think makes sense for configuration section.

Also fixup flow.c to not attempt to use the sequence, and put the timeouts into their correct place.
 16 years ago
Pablo Rincon a152623e11 Bug 130: detect-nocase was not recreating the BmCtx with nocase chars, so it was not working with patterns of capital letters as expected 16 years ago
Victor Julien 285c561559 Remove inline from counters to make gnu99 happy. 16 years ago
Victor Julien 0eabde4a9b Gnu99 inline fixes for stream engine. 16 years ago
Victor Julien 23cb020493 Fix thread flag code to compile with gnu99 16 years ago
Victor Julien c942b98f44 Fix radix inline error on gnu99 16 years ago
Victor Julien 951be71f92 Fix pm algo's inline errors in gnu99 16 years ago
Victor Julien 0fa1936923 Fix stream_size detection inline errors in gnu99 16 years ago
Victor Julien 09b48d2697 Fix payload and uri detection inline errors in gnu99 16 years ago
Victor Julien 1789e78f29 Fix compilation of pm algo's with gnu99 16 years ago
Pablo Rincon 591e5e7da7 Moving inline functions to the .h files, so gcc can inline them correctly 16 years ago
Pablo Rincon b1d1ea87ff Moving inline functions to the .h files, so gcc can inline them correctly 16 years ago
Victor Julien 53656f0d5d Remove inline's from spm to satisfy gnu99 16 years ago
Victor Julien be5b547803 Convert DecodeSetNoPayloadInspectionFlag and DecodeSetNoPacketInspectionFlag to macro's. 16 years ago