8299 Commits (08fb4d790e469a71e2c4e154443ad387194973d7)

Author	SHA1	Message	Date
Victor Julien	9948c96c68	stream/ips: set proper payload len for inspection ... On mem(cap) presure we fall back to the packet payload. The previous patch failed to properly set the payload length.	8 years ago
Victor Julien	d6903e70c1	file-log: remove and add warning ... Feature was deprecated and scheduled for removal. Ticket #2376	8 years ago
Eric Leblond	2b1fa53c66	detect-hostbits: error on some invalid config	8 years ago
Eric Leblond	e09fa43ba5	detect-xbits: error on some invalid config	8 years ago
Eric Leblond	910c3691af	detect-flowbits: error on some invalid syntax ... The regular expression was accepting something like "flowbits:!isset,isma;" without complaining even if it is not correct and don't have the expected result.	8 years ago
Eric Leblond	033fbc0f85	suricata: fix list keywords URL in release mode ... The tags are suricata-X.X.X so we need to update the chain to get URLs right.	8 years ago
Shivani Bhardwaj	bb08040df6	unix-socket: Fix the message for unregister-tenant-handler	8 years ago
Victor Julien	74a42f683c	eve/http: add proxy related custom headers	8 years ago
Victor Julien	ac7ab4ef01	eve/http: fix custom header table	8 years ago
Victor Julien	e99063b6b8	smtp: minor code cleanup and debug addition	8 years ago
Victor Julien	bf905bcbca	checksum: use u64 types	8 years ago
Victor Julien	02ba360903	ips/stream: handle low mem(cap) crash ... In low memory or memcap reached conditions a crash could happen in inline stream detection. The crash had the following path: A packet would come in and it's data was added to the stream. Due to earlier packet loss, the stream buffer uses a stream buffer block tree to track the data blocks. When trying to add the current packets block to the tree, the memory limit was reached and the add fails. A bit later in the pipeline for the same packet, the inline stream mpm inspection function gets the data to inspect. For inline mode this is the current packet + stream data before and after the packet, if available. The code looking up the packets data in the stream would not consider the possibility that the stream block returned wasn't the right one. The tree search returns either the correct or the next block. In adjusting the returned block to add the extra stream data it would miscalculate offsets leading to a corrupt pointer to the data. This patch more carefully checks the result of the lookup, and falls back to simply inspecting the packet payload if the lookup didn't produce the expected result. Bug 2842. Reported-by: Ad Schellevis <ad@opnsense.org>	8 years ago
Victor Julien	ff920472f6	stream-buffer: fix block search compare func ... Sbb search function could return the wrong block due to an off by one error.	8 years ago
Victor Julien	c306c02f8f	stream-buffer: fix streaming buffer size issue ... It was using buffer size instead of the real usage of the buffer.	8 years ago
Victor Julien	034724ec72	flow-manager: improve thread shutdown loops	8 years ago
Victor Julien	8a9cbb37a0	threads: move sleep macros into common header	8 years ago
Victor Julien	aab03dde87	mpm/ac-ks: rename files from -tile to -ks	8 years ago
Victor Julien	6fcd2db043	tile: remove files	8 years ago
Victor Julien	3f253cb8c0	mpm: rename internal id for ac-tile to ac-ks	8 years ago
Victor Julien	2bd23bc1d5	detect/pcre: fix false positive ... Fix case where a HTTP modifier in PCRE statements would lead to the rule alerting when it should not. Bug #2769	8 years ago
Victor Julien	43698a975a	decoder: improve stats hash error handling	8 years ago
Victor Julien	517b45ea2d	netmap: switch to nm_* API ... Process multiple packets at nm_dispatch. Use zero copy for workers recv mode. Add configure check netmap check for API 11+ and find netmap api version. Add netmap guide to the userguide.	8 years ago
magenbluten	1378f376a1	filestore v2: print sid in json output	8 years ago
Travis Green	1743cf5dcd	engine-analysis: add support for http_host buffer ... Add support for http_host buffer for more accurate reporting. Bug: #2798	8 years ago
Alexander Gozman	2869f8a746	nfqueue: more descriptive queue names (e.g. 'NFQ#1' instead of '1') ... This will also make 'iface-list' output more informative.	8 years ago
Alexander Gozman	86d7dddfab	nfqueue: added received packets counter for 'iface-stat' command ... Previously nfqueue did not update received packets counter in a livedev so 'iface-stat' UNIX-socket command always showed zeros.	8 years ago
Victor Julien	dadac4ae4f	eve/fileinfo: don't alloc filename during logging	8 years ago
Victor Julien	7e1235c9c8	eve/ftp: don't alloc memory to log filename	8 years ago
Victor Julien	3749caadd7	eve/http: use stack for buffer to string conversions	8 years ago
Victor Julien	20f9b0d9c6	byte: add bytes to string w/o allocation	8 years ago
Mats Klepsland	d62d33cdff	app-layer-ssl: check that cipher suites length is divisible by two ... Cipher suites length should always be divisible by two. If it is a odd number, which should not happen with normal traffic, it ends up reading one byte too much.	8 years ago
Mats Klepsland	22d8fc802e	util-ja3: fix AddressSanitizer heap-buffer-overflow ... No resizing is done in Ja3BufferResizeIfFull() when the buffer is empty. This leads to a potential overflow when this happens, since a ',' is appended even when the buffer is empty. Bug #2762	8 years ago
Victor Julien	d143ac6e89	windows/syscall: fix unused function warning	8 years ago
Victor Julien	759040a75a	windows/syscall: convert file to use unix newlines ... ran: dos2unix src/win32-syscall.[ch]	8 years ago
Victor Julien	d522746c01	windows: fix sc_log_stream_lock handling	8 years ago
Victor Julien	7811498d49	windows: allow multiple pcap devices on commandline ... Ticket #2774	8 years ago
Victor Julien	3d4d2ecc0e	ips: set host mode only after engine mode ... Make sure it is set after the final engine mode update.	8 years ago
Victor Julien	0a106fe2ea	stream: fix 'stream.inline=auto' for L2 IPS ... Make sure the livedev setup is finalized before initializing the stream engine. Bug #2811 Reported-by: Ad Schellevis	8 years ago
Victor Julien	f98b5ecd6a	flow: log gap state per direction	8 years ago
Victor Julien	2a3cb32071	stream: no more stream events after known issue ... No longer set stream events after a gap or wrong thread. We know we lost sync and are now in 'lets make the best of it'-mode. No point in flooding the system with stream events. Ticket #2484	8 years ago
Victor Julien	87019ff22b	dcerpc/udp: fix int mishandling in opnum parsing ... For Big Endian support in the protocol, the opnum would not be set correctly. Found using undefined sanitizer.	8 years ago
Victor Julien	9aa4e53434	file/swf: fix undefined int behaviour ... Fix warnings by the undefined sanitizer.	8 years ago
Victor Julien	94191ea960	detect/bytetest: don't print errors at runtime	8 years ago
Maurizio Abba	6c0ec0b2f3	eve/http: add request/response http headers ... Add a keyword configuration dump-all-headers, with allowed values {both, request, response}, dumping all HTTP headers in the eve-log http object. Each header is a single object in the list request_headers (response_headers) with the following notation: { "name": <header name>, "value": <header value> } To avoid forged malicious headers, the header name size is capped at 256 bytes, the header value size at 2048. By default, dump-all-headers is disabled.	8 years ago
Maurizio Abba	4697351188	smtp: create raw-extraction feature ... Add a raw-extraction option for smtp. When enabled, this feature will store the raw e-mail inside a file, including headers, e-mail content, attachments (base64 encoded). This content is stored in a normal File *, allowing for normal file detection. It'd also allow for all-emails extraction if a rule has detect-filename:"rawmsg" matcher (and filestore). Note that this feature is in contrast with decode-mime. This feature is disabled by default, and will be disabled automatically if decode-mime is enabled.	8 years ago
Alexander Gozman	b2a6c60dee	source-nfq: increase maximum queues number to 65535 ... Previously this was limited to 16, however Netfilter allows up to 65535 queues. Suricata now is able to create as many queues as possible, but at the same time warns user if one specifies more queues than available CPU cores. This change involves dynamic (de)allocation of NFQ contexts instead of on-stack arrays to use less memory.	8 years ago
Alexander Gozman	bdd69d13e0	source-nfq: support queue range ... If one needs to use multiple sequential Netfilter queues, it can be done with a new '-q' option's syntax: "start:end" (just like it's done with iptables '--queue-balance' option).	8 years ago
Jason Ish	9bf6f7d5a9	rust/dns: add dns to dns alerts	8 years ago
Victor Julien	e710b06669	detect: add file.name sticky buffer	8 years ago
Victor Julien	ca8471387a	detect: add http.response_body sticky buffer ... As a mirror of the http_server_body content modifier.	8 years ago