aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
2,105 Commits
8 Branches
173 Tags
254 MiB
main
main-7.0.x
main-8.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '3d22713b09'
${ noResults }
Commit Graph

1990 Commits (3d22713b09f850b7be97dc0f24aa325b297819e7)

Author SHA1 Message Date
Victor Julien 778b92ef40 Make sure to only alloc a new pseudo packet once during ip defrag. 15 years ago
Victor Julien 5f2a0653b4 If engine shutdown (processing in-engine packets) times out, exit Suricata with EXIT_FAILURE. 15 years ago
Victor Julien 9ca0658a6e Clear pcap_cnt variable on packet recycle. 15 years ago
Victor Julien 03ea563e93 Don't set ip{4,6} header on reassembled ip packet until we know for sure what buffer the packet is stored in. 15 years ago
Victor Julien f5674eff74 Fix a copy issue in PacketCopyDataOffset. 15 years ago
Victor Julien 8978266a91 If shutdown doesn't complete processing all packets that are already in the engine within 30 seconds, force quit. 15 years ago
Victor Julien 5d2f633c48 Properly initialize pfring runmode before using it. Fix malformed conf api calls. 15 years ago
Anoop Saldanha 966119b6aa support for http_raw_uri keyword + mpm engine 15 years ago
Victor Julien 169104a803 Slightly clean up --list-runmodes output. 16 years ago
Anoop Saldanha e4d890e186 modify runmode api to accept conf runmode paramter as a char string, instead of an interger id 16 years ago
Anoop Saldanha fb4ffc9aef fixed runmode name changes that was missed in the previous changes to the runmode api 16 years ago
Anoop Saldanha 229f7281ea list runmodes. Allow specification of runmode id from cof file. Also allow for command line override 16 years ago
Anoop Saldanha 05686e70a5 fix coding indentation + neaten runmode code 16 years ago
Anoop Saldanha d7c707e656 modify runmodes to take all arguments from the conf API 16 years ago
Anoop Saldanha a165d45da9 naming changes for runmodes 16 years ago
Anoop Saldanha 6fceeda8c5 move erf dag runmode into its own file runmode-erf-dag.[ch] 16 years ago
Anoop Saldanha f51cf34210 move erf file runmode into its own file runmode-erf-file.[ch] 16 years ago
Anoop Saldanha 86eabbc2f5 move ipfw runmode into its own file runmode-ipfw.[ch] 16 years ago
Anoop Saldanha 036015d6b9 move nfq runmode into its own file runmode-nfq.[ch] 16 years ago
Anoop Saldanha 9affa39b29 move pfring runmode into its own file runmode-pfring.[ch] 16 years ago
Anoop Saldanha e7ac1d7c4c move pcap file runmode into its own file runmode-pcap-file.[ch] 16 years ago
Anoop Saldanha f6af567ce0 move pcap live runmode into its own file runmode-pcap.[ch] 16 years ago
Victor Julien 892a8a4985 Make stream inline use the chunk size settings. 16 years ago
Victor Julien 2dc057d1b1 Set datalink on stream pseudo packets to prevent unified2 from writing a malformed record. 16 years ago
Victor Julien 5dcaaebf21 Enable logging of stream chunk in IPV6/TCP. Make sure IPV6 events have a ethernet header to work around Barnyard2 not liking DLT_RAW+IPV6. 16 years ago
Victor Julien 93815a1585 Support logging of reassembled stream data in IPv4 unified2. 16 years ago
Victor Julien 6cb9bbd1e3 Make sure TAG alerts don't work with an uninitialized alert_msg pointer. 16 years ago
Victor Julien 4f5aad1476 Enforce configurable minimum chunk size in raw stream reassembly. Minor stream cleanups, unittest updates. 16 years ago
Victor Julien 5d2a341096 Disable unused code, fix compiler warning. 16 years ago
Victor Julien 936b34ddf6 Remove minimum init chunk length code, set a default limit of 2560 to the minimum chunk size, allow toclient raw reassembly to start even if toserver hasn't started yet. 16 years ago
Victor Julien 864c8718e1 Store matching stream msg (ptr) in packets alert structure so it's available to the output plugins. 16 years ago
Victor Julien 8faacb727d Account for seg list not always being empty when stream closes. 16 years ago
Victor Julien ecfa2d0176 Only remove segments from segment list if they are completely before ra_base_seq. 16 years ago
Victor Julien 5bdf16380d Make sure we actually remove no longer required segments. 16 years ago
Victor Julien 7f45a4fd58 Fix missing segment flag, fix 2 unittests broken after previous stream changes. 16 years ago
Victor Julien 4a7f6079d5 Change segment removal in stream engine to not discard segments right away. Now they are only removed if they are fully before ra_base_seq. 16 years ago
Victor Julien 6d766f91ef Fix compiler warnings in defrag unittests. 16 years ago
Anoop Saldanha 5c880b04c9 fix ipv4 defrag + fix recursion level in defrag pseudo packet 16 years ago
Victor Julien 8654469133 Fixing libpcap 0.x.x specific code, take 2. 16 years ago
Victor Julien 140eb4fde8 Fix decode-event keyword parsing. Fix code that indicates a signature is decode-event only. Add 'pkthdr' protocol as an alias for any/ip to be used by decode-event signatures. 16 years ago
Victor Julien c72e5f0ebb Fix compilation of pcap reopen code for older libpcap code. 16 years ago
Victor Julien 076d77cd80 Add strncpy and strncat to banned function list as we have better replacements: strlcpy and strlcat. 16 years ago
Victor Julien 0814e41e50 Ignore tunnel/defrag packets in log-pcap module. 16 years ago
Victor Julien 7ef00aaf19 Fix defrag4 setting the packet length on the wrong packet. 16 years ago
Victor Julien acda69865a Fix potential segv in pcap logging deinit code. 16 years ago
Victor Julien bc7e21aee6 Add special sguil mode to log-pcap to support logging into date based directory structure and rotate when the day passes. Also do not log packets beyond stream reassembly depth and encrypted traffic. 16 years ago
Victor Julien 77505f8873 Allow pcap-log to log outside of default-log-dir by passing a absolute path as filename. 16 years ago
Victor Julien 92ea1f68d4 Exit on thread restart limit reached. 16 years ago
Eric Leblond 8f4229b429 Use snprintf instead of sprintf. 16 years ago
Eric Leblond 9be1f1a31c Use GET_PKT macros. 16 years ago
Eric Leblond fb36c0af12 pcap: do not leave if interface goes down 
This patch changes suricata behaviour to support interface like
ppp. Prior to this patch, a suricata listening to an interface
was leaving when the interface goes down. This patch modifies
the behaviour to automatically reconnect. Suricata retries to
open the interface every 0,5s until it succeeds.
 16 years ago
Eric Leblond 56bf931959 pfring: use macro for direct access 
Existing code was correct but it was using a direct access to
pkt field. This patch uses the newly defined macro to have a
clean access on the pkt data.
 16 years ago
Eric Leblond 4495efcb62 Add macro for direct access 
In some case, this is needed to have a direct access to the pkt
field. This patch adds macro for this usage.
 16 years ago
Victor Julien 5da8bd7c1e Fix unified2 overwriting tag alerts. 16 years ago
Victor Julien cee615315f Fix [drop] not being printed for IPv6 fast.log alerts. 16 years ago
Victor Julien e19f6ebaf4 Various fixes for issues reported by clang. 16 years ago
Victor Julien 38e7d944c5 Fix icmpv4 unittest on big endian, extract embedded sport and dport even if a full tcph doesn't fit. 16 years ago
Victor Julien 92536c4952 Fix address test on big-endian. 16 years ago
Victor Julien e0afe96920 Fix broken ICMPv4 unittests on big endian, fix broken ID macro on ICMPv6. 16 years ago
Victor Julien f5a2017f3c Fix counter unittest on big endian. 16 years ago
Victor Julien 6817824c92 Fix bloomfilter issue on big endian. 16 years ago
Victor Julien e197f50727 Fix IP-Only unittests failing on Big Endian. 16 years ago
Victor Julien b8cf50678f Fix many address unittests using explicit byte order and thus failing on big-endian systems. 16 years ago
Victor Julien c865ee2217 Fix compilation for nfq_set_mark code when NFQ is not enabled. 16 years ago
Eric Leblond ee6552f25e nfq_set_mark: handle feature in NFQ. 
This patch implements the nfq_set_mark related modification of verdict
handling.
 16 years ago
Eric Leblond 9beebf621a Add support for 'nfq_set_mark' keyword 
This patch introduces 'nfq_set_mark' which is new rules option. If a packet
matches a rule using nfq_set_mark in NFQ mode, it is marked with the mark/mask
specified in the option during the verdict.
It is thus possible to trigger different behaviour on the packet inside
Linux/Netfilter.
 16 years ago
Victor Julien f90a5cfffd Misc pcap logging cleanups. 16 years ago
William Metcalf 023a0f94a2 first stab at pcap logging no rotating buff etc 16 years ago
Anoop Saldanha 1f7e4bada1 add tls.no_reassemble use for sslv2 which we missed previously. Also some cleanup 16 years ago
Victor Julien 71d0eabdec Add a few extra safety checks in new SSL code. 16 years ago
Anoop Saldanha c105a739e9 support for ssl_state keyword added 16 years ago
Anoop Saldanha 013d3aea1c update ssl parser test. Some minor indentation changes 16 years ago
Anoop Saldanha 7a2046328c some naming changes in ssl parser and ssl related keywords 16 years ago
Anoop Saldanha 4c570777c4 delete files app-layer-tls.[ch] 16 years ago
Anoop Saldanha b639718787 replace the contents of app-layer-ssl.[ch] with the contents from app-layer-tls.[ch] 16 years ago
Anoop Saldanha cacf0a9017 disabled sslv23 proto detection which we enabled previously. Although this is right, need to test a couple of things 16 years ago
Anoop Saldanha 4e8de99dcd tls/ssl parser modifications/fixes. We now have just one file doing all the ssl parsing stuff, i.e. app-layer-tls.[ch], instead of app-layer-ssl.[ch] and app-layer-tls.[ch] 16 years ago
Anoop Saldanha 8b17275451 dcerpc parser todo update 16 years ago
Anoop Saldanha 8c6d4531ee sslv23 support with ssl2 record format with version set to 3.0 16 years ago
Victor Julien 07a85427dd Add --build-info command line option to output some basic build settings. 16 years ago
Victor Julien 174db08567 Force reassembly of unack'd data on receiving a valid RST packet. 16 years ago
Victor Julien b9429ecec1 Fix invalid RST considered valid due to wrong returns codes. Only validate ACK from a RST packet if an ACK value was set. 16 years ago
Victor Julien cb67d61ab5 Fix broken setup of end of stream pseudo packet. 16 years ago
Victor Julien 99fca03810 Move unittest code into UNITTESTS ifdefs in the HTP parser. Fixes a compiler warning. 16 years ago
Victor Julien 0dc6333d22 Fix compiler warnings about unused IPv6 Address code. 16 years ago
Victor Julien b9fd978253 Fix compiler warnings in two unittests. 16 years ago
Victor Julien a3be22cd5a Fix compiler warning in isdataat keyword setup code. 16 years ago
Victor Julien bbe071252b Make sure PID is logged as well in alert-syslog output. 16 years ago
Victor Julien da423a59d5 Allow users of the alert-syslog to set the identity. 16 years ago
Victor Julien 07776c113b Fix valgrind error on pfring_recv, rename threads from RecvPfring to RxPfring so the name still looks right for 100+ threads. Add --pfring commandline option that just enables pfring, then takes interface from config. 16 years ago
Victor Julien 3aeb86d836 Fix header_len in GRE decoder getting out of control in some cases. 16 years ago
Victor Julien 1c9e48ae98 Fix compilation error on non-pfring systems. 16 years ago
Victor Julien 91f28afef4 Add option to PF_RING to have multiple reader threads. Improve general performance of the PF_RING module. 16 years ago
Victor Julien edeec290f6 Fix missing rename for request-body-limit to request_body_limit. 16 years ago
Eric Leblond 3b3a8ffb94 detect-gid: suppress unused type 
The DetectGidData type is not used in the code. This patch removes
the type definition from code.
 16 years ago
Eric Leblond ad44f1cfc1 fix possible typo in strtoul error handling. 16 years ago
Eric Leblond 04f2afa81b nfq: fix exit function 
Exit function was trying to close the nfq handler even if it was
null. This was causing a crash.
 16 years ago
Eric Leblond 277a384af7 Use already defined macro instead of integer 
Code was using a integer instead of the already defined macro.
 16 years ago
Pablo Rincon ce3b76a102 Fix compilation on Mac OS X (it was missing IPPROTO_SCTP definition) 16 years ago
Victor Julien 153f9298e7 Fix priority handling during the signature parsing stage. Fixes #275. 16 years ago