5956 Commits (1cd97713c2945a1e55ea6e3b8df804ab3f06fca4)

 

All Branches   

Search

Author	SHA1	Message	Date
Eric Leblond	1cd97713c2	file-json: add file_id to message ... This will allow to get the filename and by consequence the file after a parsing of the EVEV log file.	10 years ago
Eric Leblond	8fde842f97	af-packet: implement rollover option ... This patch implements the rollover option in af_packet capture. This should heavily minimize the packet drops as well as the maximum bandwidth treated for a single flow. The option has been deactivated by default but it is activated in the af_packet default section. This ensure there is no change for old users using an existing YAML. And new users will benefit from the change. This option is available since Linux 3.10. An analysis of af_packet kernel code shows that setting the flag in all cases should not cause any trouble for older kernel.	10 years ago
Eric Leblond	dc306f3bad	af-packet: implement new load balancing modes ... This patch implements the fanout load balancing modes available in kernel 4.0. The more interesting is cluster_qm that does the load balancing based on the RSS queues. So if the network card is doing a flow based load balancing then a given socket will receive all packets of a flow indepently of the CPU affinity.	10 years ago
Eric Leblond	851fcef962	af-packet: sync header with latest features ... Sync the replacement define with the latest Linux code. This patch also updates the detection part in configure.ac to do a declaration of all fields if the newest features are not present.	10 years ago
Aleksey Katargin	caa2438b98	netmap: support SW rings ... Netmap uses SW rings to send and receive packets from OS.	10 years ago
Aleksey Katargin	823167bde2	netmap: strict check for zero copy mode ... Netmap does not guarantees that mmap'ed regions for different interfaces would be the same.	10 years ago
Aleksey Katargin	5104b02f32	netmap: fixed autofp mode. ... Previous implementation does not work with this mode.	10 years ago
Aleksey Katargin	491fca468d	netmap: support non-equal count of Rx and Tx rings on interface. ... Netmap does not guarantees that NIC will have equal number of transmit and receive rings.	10 years ago
Schnaffon	6484299701	Use unlikely for error treatment in alert-prelude.c ... When handling error cases on creation of a new idmef field, we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc.	10 years ago
Victor Julien	334e8656bf	introduce fatal error macro's ... Add 'FatalError' and 'FatalErrorConditonal' that will take the same args as SCLogError. FatalError logs the error using SCLogError and then exits with return code EXIT_FAILURE. FatalErrorOnInit does the same only during init and with --init-errors-fatal enabled, otherwise it just calls SCLogWarning. So then the macro returns to the caller. Implement this for output setup.	10 years ago
Victor Julien	4dd53c8f03	lua: dns support	10 years ago
Victor Julien	433e511b63	dns: generic inspect engines for DNS	10 years ago
Victor Julien	110e23964e	detect: add AppLayerTxMatch call	10 years ago
Victor Julien	e6129f7b47	dns: generic request/response detect lists	10 years ago
Victor Julien	2c8e8c2516	dns: rename type so it's purpose is more clear	10 years ago
Victor Julien	a1e50b3138	lua: dns extensions ... Add DNS lua calls for getting queries, answers, authorities. Also rcode and recusion desired flags.	10 years ago
Victor Julien	c46d472921	lua: initial DNS logging support	10 years ago
Eric Leblond	159a6d1cb4	tls-store: avoid log flooding ... In case we can't write in the certs directory, this is possible we flood the log for each TLS session or even worse each TLS packet. So this patch puts a limit in the number of logged messages related to file creation.	10 years ago
Eric Leblond	cbf5d88447	filestore: use SCFree instead of free	10 years ago
Eric Leblond	b77cd22b98	tls-store: backward compatibility ... This patch implements backward compatibility in suricata.yaml file. In case the new 'tls-store' output is not present in the YAML we have to use the value defined in 'tls-log'.	10 years ago
Eric Leblond	4db0a35f25	tls-store: now a separate module ... An design error was made when doing the TLS storage module which has been made dependant of the TLS logging. At the time there was only one TLS logging module but there is now two different ones. By putting the TLS store module in a separate module, we can now use EVE output and TLS store at the same time.	10 years ago
Jeff Barber	893fc9660d	Support for reconnecting unix domain socket log files ... Issue #1423	10 years ago
Jason Ish	b512580bbe	logging: integrate rotation into SCConfLogOpenGeneric. ... Addresses issue 1492, and will make it harder to omit rotation on new outputs.	10 years ago
Jason Ish	14981cb2a8	rule vars: strip leading white space before looking up var.	10 years ago
Victor Julien	f43767ba44	config: update yaml to show json logging option	10 years ago
sfd	e58cfb6a05	Fix compile bad dereferences ... The src/source-erf-dag.c code was not compiling. It looks like some stats counters were added but not tested as the dereferences are incorrect.	10 years ago
Alexander Gozman	e028917955	In non interactive mode, print errors to stderr	10 years ago
Alexander Gozman	a9176cf126	suricatasc: remove "u" prefix when printing JSON output. ... If we want to parse suricatasc's output, python's unicode prefix should be removed to make JSON parsers happy.	10 years ago
Zopieux	cd038419fd	stream_size operator comparison (fix issue #1488) ... `DetectStreamSizeParse` was first checking if mode[0] is '<', which is true for both '<' and '<=', thus '<=' (and resp. '>=') is never matched. This patch does the `strcmp` to '<=' (resp. '>=') within the if block of '<' (resp. '>') to fix #1488.	10 years ago
Victor Julien	45fc619f79	logging: json output ... Make JSON output optional. Cleanups.	10 years ago
Victor Julien	126ecb3ebf	logging: fix per output log formats	10 years ago
Victor Julien	b51c4e608f	logging: optional colors output ... Construct message per output method.	10 years ago
Victor Julien	b13de5bf08	logging: change newline handling	10 years ago
Victor Julien	1927b3000c	output: cleanup	10 years ago
Victor Julien	b30bdc21b5	logging: cleanup output API ... Make SCLogMessage master of the logging. Reduces complexity of the SCLog macro's.	10 years ago
Victor Julien	d6fc6e874f	log: reorganize SCLogOPIfaceCtx to make it more efficient	10 years ago
Victor Julien	c2f4031a8c	detect: fix settings override for reloads	10 years ago
Helmut Schaa	91efdadf8e	Disable pcap-config use during cross compilation ... This allows cross compilation where the host system has pcap-config installed and would create an invalid entry in the cross-CFLAGS.	10 years ago
Alexander Gozman	cd9cc2559e	Issue 1491: fix capabilities for pf_ring mode when running under non-root account	10 years ago
Alexander Gozman	d36eba4e5e	Fix issues #1493 and #1494	10 years ago
Giuseppe Longo	d592d57039	file_data: check for signature alproto and flow ... Currently the following rule can't be loaded: alert tcp any any -> any 25 (msg:"SMTP file_data test"; flow:to_server,established; file_data; content:"abc";sid:1;) and produces the error output: "Can't use file_data with flow:to_server or from_client with http or smtp." This checks if the alproto is not http in a signature, so permits to use flow keyword also. Issue reported by rmkml.	10 years ago
Victor Julien	e583de0582	Minor unittest cleanups	10 years ago
Victor Julien	f4f53924bb	app-layer: fix coverity warnings	10 years ago
Victor Julien	6c792cb4cc	erspan: respect vlan.use-for-tracking setting	10 years ago
Victor Julien	b8211e8c04	htp: hide BUG_ON's behind DEBUG_VALIDATION	10 years ago
Victor Julien	bd73553027	smtp json: fix potential crash on malloc failure ... ** CID 1298888: (FORWARD_NULL) /src/output-json-email-common.c: 117 in JsonEmailLogJson() /src/output-json-email-common.c: 140 in JsonEmailLogJson()	10 years ago
Victor Julien	1ed8d7b538	detect analizer: fix minor coverity warning ... ** CID 1298889: Integer handling issues (NEGATIVE_RETURNS) /src/detect-engine-analyzer.c: 102 in EngineAnalysisFP()	10 years ago
Victor Julien	dd2afd51f7	file_data smtp: fix minor coverity warning ... CID 1298891: Null pointer dereferences (REVERSE_INULL) Null-checking "curr_file" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.	10 years ago
Victor Julien	bcff35fd9f	smb: fix coverity warning ... ** CID 1298892: Incorrect expression (UNUSED_VALUE) /src/app-layer-smb.c: 1486 in SMBProbingParser()	10 years ago
Victor Julien	aa095864d3	pfring runmode: remove set that is never read	10 years ago