aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
10,338 Commits
8 Branches
171 Tags
237 MiB
main
main-7.0.x
main-8.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '323a747f39'
${ noResults }
Commit Graph

10338 Commits (323a747f391ed65171659bdbd50fe7cdc711bebe)
 

Author SHA1 Message Date
Victor Julien 323a747f39 classtype: increase id size 
Switch from u8 to u16 to allow for more classtypes.

Rename Signature::class to Signature::class_id to make it clear
it is an id.
 7 years ago
Victor Julien ccf6c5a6ef classtype: small memory reduction 
Reduce memory use by making sure SCClassConfClasstype
has a more optimal memory layout.
 7 years ago
Victor Julien 26e2370f99 classtype: put UNITTESTS guards where appropriate 7 years ago
Victor Julien e104c3d913 classtype: reduce scope of functions 7 years ago
Victor Julien a37e09cbe0 detect/classtype: change duplicate classtype behavior 
Detect duplicate instances and use the one with the highest
priority.

Use new priority flag to make the logic around explicit priority
sets easier to follow.

Minor code cleanups. Also clean up unittests.
 7 years ago
Victor Julien c471d81f04 detect/priority: change duplicate priority behavior 
Introduce Signature init_flag to indicate priority has been set.
This will be needed in a follow-up classtype update.

Detect duplicate priority instances in a keyword, and use the
highest priority in the rule. Do issue a warning in this case.
 7 years ago
Victor Julien 828d2572f8 detect: use BIT_U32 macros for INIT flags 7 years ago
Victor Julien 3fd4e7bd05 detect/priority: minor cleanups 7 years ago
Victor Julien bfee28db5e detect/classtype: clean up error handling 7 years ago
Victor Julien 5e5761a29c detect/classtype: warn on duplicate classtype 
Issue warning instead of erroring and invalidating the rule.

It's not a very serious issue, so don't error out.
 7 years ago
Victor Julien 282e1c2520 detect/classtype: fix parsing error checking 7 years ago
Jason Ish 2d0b3d7320 detect/test: update test for file prune changes 
As the file prune is now moved to the flow worker, the file
prune is run later, meaning the first file has not yet
been pruned from the file container list.

Adjust test to look for a second file, and check the
flags on that file.

For commit addressing bug 2490.
 7 years ago
Jason Ish ebcc4db84a file extraction: always prune files after detect 
If a keyword like filemd5 was being used without a filestore,
or a file output enabled, it would be pruned before detection
had a chance to match.

Consolidate file pruning to the end of the flow worker so files
are available for detection even when a file output is not
enabled.

Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2490
 7 years ago
Victor Julien c7e4433fe9 afl/decode: fix stats related memleak reports 7 years ago
Shivani Bhardwaj 8940a9d326 afp: nicer error message in case of fanout failure 
Use clearer message in case fanout is not supported or cluster_id is
already in use.

Closes redmine ticket #1940.
 7 years ago
Shivani Bhardwaj ac55b21184 suricata: Check if default log dir is writable 
At the startup, if the default log dir provided either by command line
options or suricat.yaml is not writable, the error comes quite later.
This patch makes suricata exit if there is such an error in the
beginning itself.

Closes redmine ticket #2386.
 7 years ago
Shivani Bhardwaj 5fbb7cef0a Makefile: Make libhtp available at install-rules stage 
So far when "make install-rules" stage was executed, libhtp path was not
recognized as ldconfig does not run by this stage.
Set "LD_LIBRARY_PATH" since we already know the path where libhtp would
be.

Closes redmine ticket #2669.
 7 years ago
Victor Julien 4061bf5ceb doc/datasets: update example config to map 7 years ago
Victor Julien 6dca50a322 runmode: consider test mode a user mode 7 years ago
Victor Julien 914c5b7975 datasets: fix error handling 7 years ago
Victor Julien 1021465f23 datasets: improve and doc return codes 7 years ago
Jason Ish a2fcc304e7 dataset: fix return value check on isnotset 
The dataset api returns -1 for not found.
 7 years ago
Victor Julien c6cda99bcd thash: fix prealloc config setting 7 years ago
Victor Julien e264a0cee8 datasets: fix hash table config 
Example:

datasets:
  ua-seen:
    type: string
    state: ua-seen.lst
    hash:
      hash-size: 100000
      prealloc: 1000
      memcap: 256mb
 7 years ago
Victor Julien 9b64b6794b datasets: change config to map 
Example:

datasets:
  ua-seen:
    type: string
    state: ua-seen.lst
  dns-sha256-seen:
    type: sha256
    state: dns-sha256-seen.lst
 7 years ago
Victor Julien 1e50b2e404 lua: fix lua int size detection 
Failed to work with non-bundled htp and with some stricter
compile flags.
 7 years ago
Jason Ish f9c9548b74 configure: detect lua integer size 
Lua 5.1 and 5.3 use a different integer size. Run a test program
to set the integer size used in the Rust FFI layer to Rust.
 7 years ago
Jason Ish 342fa8ee26 magic/test: remove NULL as format string 
Remove passing NULL as a format string parameter
in test. Convert to FAIL_IF_NULL.
 7 years ago
Jason Ish 5f1c851716 configure: remove unused LUA_PC_NAME. 
This variable is no longer used. Instead multiple
lua pkg-config names are checked.
 7 years ago
jason taylor e4156b2f89 config: update lzma size notes to match others 
Signed-off-by: jason taylor <jtfas90@gmail.com>
 7 years ago
Victor Julien 029683cbac doc: reformat linux ips guide 7 years ago
Eric Leblond 6d9416148b doc: add nftables IPS configuration 7 years ago
Eric Leblond 82eb669205 doc: information about scaling AF_PACKET IPS mode 7 years ago
Eric Leblond ffe81dc9f2 doc: add info about AF_PACKET IPS 
Based on https://home.regit.org/2012/09/new-af_packet-ips-mode-in-suricata/

Also fix some typo in Netfilter setup.
 7 years ago
Jason Ish 0cd5452194 doc: mark independent json loggers as deprecated 
This is the loggers such as alert-json-log, dns-json-log, etc.
They are not even referenced in the default configuration file,
and are easily replaced with multiple eve instances.
 7 years ago
Jason Ish 0b02539ea9 drop.log: log deprecation warning if used 7 years ago
Jason Ish 6c2e9ac27c suricata.yaml: mark drop.log as deprecated 7 years ago
Jason Ish 212252faf2 doc/drop.log: mark as deprecated and scheduled to be removed 
Also make sure options are in sync with those in
suricata.yaml.
 7 years ago
Jason Ish 4e12984ac8 suricata.yaml: mark unified2 as deprecated 7 years ago
Jason Ish 5345379d14 doc/unified2: add deprecation/removal notice 7 years ago
Jason Ish bfacedfad1 unified2: log deprecation warning when used 7 years ago
Jason Ish d891a8cb79 config: remove all but a stub of file-store v1. 
Remove most of the file-store v1 configuration section and mark
it as deprecated. Provide a link where to find the available
options.
 7 years ago
Jason Ish 57b4259640 filestore(v1): deprecation log warning when enabled 
Notify the user with a warning log that this feature is
deprecated and will be remove in v6 of Suricata.
 7 years ago
Jason Ish 873bc290bc doc/filestore(v1) - make deprecation text a note 
Highlights that is is deprecated in the HTML output.
 7 years ago
Jason Ish 7f32822843 doc/filestore(v1) - document force-filestore field 7 years ago
Jeff Lucovsky 44a59b78c7 doc/anomaly Remove event_no 7 years ago
Jeff Lucovsky 04ee27bcd2 log/anomaly: Remove event_no from alert 7 years ago
Victor Julien be6cdd37f8 stream: remove fix stream.depth references 7 years ago
Peter Manev 10819ed892 doc: Update tuning considerations doc 7 years ago
Peter Manev 6df1001957 doc: Update high performance config doc 7 years ago