166 Commits (3d22713b09f850b7be97dc0f24aa325b297819e7)

Author	SHA1	Message	Date
William	d74fe520e5	Experimental support for PCRE-sljit enable via --enable-pcre-sljit	15 years ago
William	85643fe780	Convert to logging perf stats to file by default. Add a few columns to output avg ticks per match, avg ticks non match, allow sorting on based on them.	15 years ago
Victor Julien	36917c7d66	Fix not using new htp callback when using the bundled htp. Add indication to --build-info. Fix valgrind warning in test and further improve test.	15 years ago
Anoop Saldanha	000ce98cd1	push all proto detection code into their respective app parser register functions for every alproto	15 years ago
Victor Julien	a0799f0ff9	Wait longer at shutdown before concluding it's taking too long. Hopefully enables our slow QA boxes to complete in time.	15 years ago
Victor Julien	cd75201dc7	Fix pfring commandline handling.	15 years ago
Victor Julien	5f2a0653b4	If engine shutdown (processing in-engine packets) times out, exit Suricata with EXIT_FAILURE.	15 years ago
Victor Julien	8978266a91	If shutdown doesn't complete processing all packets that are already in the engine within 30 seconds, force quit.	15 years ago
Victor Julien	5d2f633c48	Properly initialize pfring runmode before using it. Fix malformed conf api calls.	15 years ago
Anoop Saldanha	966119b6aa	support for http_raw_uri keyword + mpm engine	15 years ago
Anoop Saldanha	e4d890e186	modify runmode api to accept conf runmode paramter as a char string, instead of an interger id	15 years ago
Anoop Saldanha	229f7281ea	list runmodes. Allow specification of runmode id from cof file. Also allow for command line override	15 years ago
Anoop Saldanha	d7c707e656	modify runmodes to take all arguments from the conf API	15 years ago
Anoop Saldanha	a165d45da9	naming changes for runmodes	15 years ago
Anoop Saldanha	5c880b04c9	fix ipv4 defrag + fix recursion level in defrag pseudo packet	15 years ago
William Metcalf	023a0f94a2	first stab at pcap logging no rotating buff etc	15 years ago
Anoop Saldanha	013d3aea1c	update ssl parser test. Some minor indentation changes	15 years ago
Anoop Saldanha	4e8de99dcd	tls/ssl parser modifications/fixes. We now have just one file doing all the ssl parsing stuff, i.e. app-layer-tls.[ch], instead of app-layer-ssl.[ch] and app-layer-tls.[ch]	15 years ago
Victor Julien	07a85427dd	Add --build-info command line option to output some basic build settings.	15 years ago
Victor Julien	07776c113b	Fix valgrind error on pfring_recv, rename threads from RecvPfring to RxPfring so the name still looks right for 100+ threads. Add --pfring commandline option that just enables pfring, then takes interface from config.	15 years ago
Victor Julien	1c9e48ae98	Fix compilation error on non-pfring systems.	15 years ago
Victor Julien	91f28afef4	Add option to PF_RING to have multiple reader threads. Improve general performance of the PF_RING module.	15 years ago
Gurvinder Singh	7d0781b349	added support to log dropped packet as netfilter logs while in inline mode	15 years ago
Gurvinder Singh	8f8b1212af	support for ssl_version keyword	15 years ago
Gurvinder Singh	e5edc6e8e3	add the support to log the fast.log alerts type to syslog	15 years ago
Eric Leblond	1e600c1054	source-nfq: add simulated non-terminal NFQUEUE verdict ... This patch adds a new mode for NFQ inline mode. The idea is to simulate a non final NFQUEUE rules. This permit to do send all needed packets to suricata via a simple FORWARD rule: iptables -I FORWARD -m mark ! --mark $MARK/$MASK -j NFQUEUE And below, we have a standard filtering ruleset. To do so, suricata issues a NF_REPEAT instead of a NF_ACCEPT verdict and put a mark ($MARK) with respect to a mask ($MASK) on the handled packet. NF_REPEAT verdict has for effect to have the packet reinjected at start of the hook after the verdict. As it has been marked by suricata during the verdict it will not rematch the initial rules and make his way to the following classical ruleset. Mode, mark and mask can be configured via suricata.yaml file with the following syntax: nfq: repeat_mode: (false|true) mark: $MARK mask: $MASK Default is false to preserve backward compatibility. Signed-off-by: Eric Leblond <eric@regit.org>	15 years ago
Eric Leblond	8330747234	Add multi queue support to NFQ run mode ... This patch adds support for multiple Netfilter queue in the NFQ run mode. Suricata can now be started on multiple queue by using a comma separated list of queue identifier on the command line. The following syntax: suricata -q 0 -q 1 -c /opt/suricata/etc/suricata.yaml will start a suricata listening to Netfilter queue 0 and 1. Signed-off-by: Eric Leblond <eric@regit.org>	15 years ago
Victor Julien	6fca55e068	Add some debug output to app-layer-htp.	15 years ago
Anoop Saldanha	c9897a44a4	fast pattern support for http_cookie. Also support relative modifiers	15 years ago
Anoop Saldanha	bbbedaf963	fast pattern support for http_method. Also support relative modifiers	15 years ago
Eric Leblond	9c2bdc6d0c	Main loop: increase timer. ... Timer in the main loop was of 100 usec. This patch increases it to 10 ms which should be a reasonnable delay to declare some threads dead. Signed-off-by: Eric Leblond <eric@regit.org>	15 years ago
Eric Leblond	67b95c8c4d	Auto discovery of default packet size ... If default-packet-size is not set, it is possible in some case to guess a correct value. If PCAP or PF_RING are used we are linked to a "physical" interface. Thus, it is possible to get information about the link MTU and hardware header size. This give us the ability to auto discover a decent default-packet-size. If suricata is running under a different running-mode, it will default to 1514.	15 years ago
Eric Leblond	dd038c1906	Modify files to avoid direct pckt payload access ... This patch implements the needed modification of payload access in a Packet structure to support the abstraction introduced by the extended data system.	15 years ago
Eric Leblond	e802e1ed16	Modify Packet structure and prepare accessor. ... This patch modifies decode.c and decode.h to avoid the usage by default of a bigger than 65535 bytes array in Packet structure. The idea is that the packet are mainly under 1514 bytes size and a bigger size must be supported but should not be the default. If the packet length is bigger than DFLT_PACKET_SIZE then the data are stored in a dynamically allocated part of the memory. To ease the modification of the rest of the code, functions to access and set the payload/length in a Packet have been introduced. The default packet size can be set at runtime via the default-packet-size configuration variable.	15 years ago
Victor Julien	878d3d87db	Add (experimental) support for using multiple pcap devices to acquire packets from. Just passing multiple -i <dev> options on the commandline will activate this. Windows not yet supported.	15 years ago
Victor Julien	e3bde3e95d	Add a simple revision based on the git rev to the version number, like a build number.	15 years ago
Victor Julien	ffcd512167	Clean up packet pool handler on shutdown.	15 years ago
Victor Julien	3710296057	Cleanup defrag engine on shutdown.	15 years ago
Anoop Saldanha	d241e51b32	adapt fast pattern engine analysis to reflect the new changes made to your mpm design	15 years ago
Anoop Saldanha	42c1287028	renintroduce g_u8_lowercase_table for b2g cuda	15 years ago
Anoop Saldanha	c734cd1bdd	make cuda mpm parameters configurable	15 years ago
Anoop Saldanha	7ec0382774	support fast pattern for http raw header. Also support relative modifiers for http raw header	15 years ago
Anoop Saldanha	c61c68fd36	mpm and fast pattern support for http_header. Also support relative modifiers for http_header	15 years ago
Anoop Saldanha	5c6a65dc58	support relative modifiers for http_client_body. Introduce body processing engine in detect-engine-hcbd.[ch]	15 years ago
Anoop Saldanha	eade60f0fd	make some name changes. break PopulateMpm(). Set the avoid mpm double check flags	15 years ago
Anoop Saldanha	46b4806d8e	use a single populatempm() function to add the right content for mpm	15 years ago
Anoop Saldanha	bc99328ec8	define a new conf paramter detect-engine:inspection-recursion-limit; Defines a recursion limit for content inspection code	15 years ago
Victor Julien	001dcaae84	Minor reference.config support changes: improve error handling, reduce hash table size.	15 years ago
Anoop Saldanha	88d94b136d	Support for reference.config file	15 years ago
Anoop Saldanha	2cdb5be391	Print out file name for fast_pattern engine_analysis. Also add some info logs	15 years ago