10331 Commits (3fd4e7bd05cfbd4171b239a46ec3eda6b6f23b46)

 

All Branches   

Search

Author	SHA1	Message	Date
Victor Julien	3fd4e7bd05	detect/priority: minor cleanups	7 years ago
Victor Julien	bfee28db5e	detect/classtype: clean up error handling	7 years ago
Victor Julien	5e5761a29c	detect/classtype: warn on duplicate classtype ... Issue warning instead of erroring and invalidating the rule. It's not a very serious issue, so don't error out.	7 years ago
Victor Julien	282e1c2520	detect/classtype: fix parsing error checking	7 years ago
Jason Ish	2d0b3d7320	detect/test: update test for file prune changes ... As the file prune is now moved to the flow worker, the file prune is run later, meaning the first file has not yet been pruned from the file container list. Adjust test to look for a second file, and check the flags on that file. For commit addressing bug 2490.	7 years ago
Jason Ish	ebcc4db84a	file extraction: always prune files after detect ... If a keyword like filemd5 was being used without a filestore, or a file output enabled, it would be pruned before detection had a chance to match. Consolidate file pruning to the end of the flow worker so files are available for detection even when a file output is not enabled. Redmine issue: https://redmine.openinfosecfoundation.org/issues/2490	7 years ago
Victor Julien	c7e4433fe9	afl/decode: fix stats related memleak reports	7 years ago
Shivani Bhardwaj	8940a9d326	afp: nicer error message in case of fanout failure ... Use clearer message in case fanout is not supported or cluster_id is already in use. Closes redmine ticket #1940.	7 years ago
Shivani Bhardwaj	ac55b21184	suricata: Check if default log dir is writable ... At the startup, if the default log dir provided either by command line options or suricat.yaml is not writable, the error comes quite later. This patch makes suricata exit if there is such an error in the beginning itself. Closes redmine ticket #2386.	7 years ago
Shivani Bhardwaj	5fbb7cef0a	Makefile: Make libhtp available at install-rules stage ... So far when "make install-rules" stage was executed, libhtp path was not recognized as ldconfig does not run by this stage. Set "LD_LIBRARY_PATH" since we already know the path where libhtp would be. Closes redmine ticket #2669.	7 years ago
Victor Julien	4061bf5ceb	doc/datasets: update example config to map	7 years ago
Victor Julien	6dca50a322	runmode: consider test mode a user mode	7 years ago
Victor Julien	914c5b7975	datasets: fix error handling	7 years ago
Victor Julien	1021465f23	datasets: improve and doc return codes	7 years ago
Jason Ish	a2fcc304e7	dataset: fix return value check on isnotset ... The dataset api returns -1 for not found.	7 years ago
Victor Julien	c6cda99bcd	thash: fix prealloc config setting	7 years ago
Victor Julien	e264a0cee8	datasets: fix hash table config ... Example: datasets: ua-seen: type: string state: ua-seen.lst hash: hash-size: 100000 prealloc: 1000 memcap: 256mb	7 years ago
Victor Julien	9b64b6794b	datasets: change config to map ... Example: datasets: ua-seen: type: string state: ua-seen.lst dns-sha256-seen: type: sha256 state: dns-sha256-seen.lst	7 years ago
Victor Julien	1e50b2e404	lua: fix lua int size detection ... Failed to work with non-bundled htp and with some stricter compile flags.	7 years ago
Jason Ish	f9c9548b74	configure: detect lua integer size ... Lua 5.1 and 5.3 use a different integer size. Run a test program to set the integer size used in the Rust FFI layer to Rust.	7 years ago
Jason Ish	342fa8ee26	magic/test: remove NULL as format string ... Remove passing NULL as a format string parameter in test. Convert to FAIL_IF_NULL.	7 years ago
Jason Ish	5f1c851716	configure: remove unused LUA_PC_NAME. ... This variable is no longer used. Instead multiple lua pkg-config names are checked.	7 years ago
jason taylor	e4156b2f89	config: update lzma size notes to match others ... Signed-off-by: jason taylor <jtfas90@gmail.com>	7 years ago
Victor Julien	029683cbac	doc: reformat linux ips guide	7 years ago
Eric Leblond	6d9416148b	doc: add nftables IPS configuration	7 years ago
Eric Leblond	82eb669205	doc: information about scaling AF_PACKET IPS mode	7 years ago
Eric Leblond	ffe81dc9f2	doc: add info about AF_PACKET IPS ... Based on https://home.regit.org/2012/09/new-af_packet-ips-mode-in-suricata/ Also fix some typo in Netfilter setup.	7 years ago
Jason Ish	0cd5452194	doc: mark independent json loggers as deprecated ... This is the loggers such as alert-json-log, dns-json-log, etc. They are not even referenced in the default configuration file, and are easily replaced with multiple eve instances.	7 years ago
Jason Ish	0b02539ea9	drop.log: log deprecation warning if used	7 years ago
Jason Ish	6c2e9ac27c	suricata.yaml: mark drop.log as deprecated	7 years ago
Jason Ish	212252faf2	doc/drop.log: mark as deprecated and scheduled to be removed ... Also make sure options are in sync with those in suricata.yaml.	7 years ago
Jason Ish	4e12984ac8	suricata.yaml: mark unified2 as deprecated	7 years ago
Jason Ish	5345379d14	doc/unified2: add deprecation/removal notice	7 years ago
Jason Ish	bfacedfad1	unified2: log deprecation warning when used	7 years ago
Jason Ish	d891a8cb79	config: remove all but a stub of file-store v1. ... Remove most of the file-store v1 configuration section and mark it as deprecated. Provide a link where to find the available options.	7 years ago
Jason Ish	57b4259640	filestore(v1): deprecation log warning when enabled ... Notify the user with a warning log that this feature is deprecated and will be remove in v6 of Suricata.	7 years ago
Jason Ish	873bc290bc	doc/filestore(v1) - make deprecation text a note ... Highlights that is is deprecated in the HTML output.	7 years ago
Jason Ish	7f32822843	doc/filestore(v1) - document force-filestore field	7 years ago
Jeff Lucovsky	44a59b78c7	doc/anomaly Remove event_no	7 years ago
Jeff Lucovsky	04ee27bcd2	log/anomaly: Remove event_no from alert	7 years ago
Victor Julien	be6cdd37f8	stream: remove fix stream.depth references	7 years ago
Peter Manev	10819ed892	doc: Update tuning considerations doc	7 years ago
Peter Manev	6df1001957	doc: Update high performance config doc	7 years ago
Victor Julien	9340769ad2	enip: fix compile warnings in gcc-8 ... In file included from suricata-common.h:471, from app-layer-enip-common.c:27: app-layer-enip-common.c: In function ‘DecodeCIPRequestPathPDU’: util-debug.h:222:31: warning: ‘req_path_class8’ may be used uninitialized in this function [-Wmaybe-uninitialized] int _sc_log_ret = snprintf(_sc_log_msg, SC_LOG_MAX_LOG_MSG_LEN, __VA_ARGS__); \ ^~~~~~~~ app-layer-enip-common.c:589:13: note: ‘req_path_class8’ was declared here uint8_t req_path_class8; ^~~~~~~~~~~~~~~ app-layer-enip-common.c:607:9: warning: ‘segment’ may be used uninitialized in this function [-Wmaybe-uninitialized] switch (segment) ^~~~~~ app-layer-enip-common.c: In function ‘DecodeCIPResponsePDU’: app-layer-enip-common.c:773:13: warning: ‘service’ may be used uninitialized in this function [-Wmaybe-uninitialized] service &= 0x7f; //strip off top bit to get service code. Responses have first bit as 1 ^~ app-layer-enip-common.c: In function ‘DecodeCIPRequestPDU’: app-layer-enip-common.c:503:25: warning: ‘path_size’ may be used uninitialized in this function [-Wmaybe-uninitialized] offset += path_size * sizeof(uint16_t); //move offset past pathsize ~~~~~~~~~~^~~~~~~~~~~~~~~~~~ app-layer-enip-common.c:506:5: warning: ‘service’ may be used uninitialized in this function [-Wmaybe-uninitialized] switch (service) ^~~~~~ Bug #3139.	7 years ago
Victor Julien	c769909dad	eve/stats: update warning for new default behavior	7 years ago
Victor Julien	bd2f1e15fd	doc/stats: minor clarrifications on 5.0 defaults	7 years ago
Victor Julien	76e1836aed	counters: improve handling missing global config ... Improve warnings when eve.stats can't work because of the global config missing or disabled. Issue warning if global config is missing but stats are still enabled due to the legacy stats.log. Issue clearer warning when stats are disabled and unix socket dump-counters command is issued. Warnings include links to docs. Bug #2465.	7 years ago
Victor Julien	2d381f93f3	stats: add global way to check if API is enabled	7 years ago
Eric Leblond	9ccecdecb6	ebpf: make sure 'make dist' include eBPF files	7 years ago
Victor Julien	5bfedf78fc	posix: replace bzero with memset ... bzero(3): The bzero() function is deprecated (marked as LEGACY in POSIX.1-2001); use memset(3) in new programs. POSIX.1-2008 removes the specification of bzero(). Use memset instead.	7 years ago