aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
4,472 Commits
8 Branches
173 Tags
194 MiB
main
main-8.0.x
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '4dd605ae3b'
${ noResults }
Commit Graph

4133 Commits (4dd605ae3b1aa66d16ef98e19fed5aca44269bac)

Author SHA1 Message Date
Eric Leblond 6be63bdc4f tm-threads: add TM_ECODE_DONE state 
This patch adds a nex return state which can be used by threads
to warn that a task has been done. In this case, suricata does not
leave.
 14 years ago
Eric Leblond 412482f6b1 filestore: create file store directory if needed 
This patch modifies the file store system to have it create the
file store directory if needed. It dos not create the full
directory tree as the parent directory must have already been
created.
 14 years ago
Eric Leblond 7b1d346c22 counters: management cpu set was set twice 
Setting the management CPU set on perf threads is already done in
the TmThreadCreateMgmtThread() function used to create the threads.
 14 years ago
Eric Leblond 84f2645e3e pcap-file: free thread var at deinit. 14 years ago
Eric Leblond 28b4bed141 tm-threads: fix potential access to NULL pointer. 14 years ago
Eric Leblond 1b26660ac4 counter: defensive set to NULL in free. 14 years ago
Eric Leblond 09b79cb5bf stream-tcp: fix double call to debug print function 14 years ago
Last G 8ae11f73b2 Added parentheses to fix Eclipse static code analysis 
Fixed bug in action priority (REJECT_DST had lowest prio)
 14 years ago
Last G e236351c52 Fixed missing "|" in "||" operation 14 years ago
Last G edcb8fdb87 Added parenthesis for right operation order 14 years ago
Last G 8bb9c3af35 Added return value to non-void function with "forever"-loop to fit 
Eclipse static code analysis
 14 years ago
Eric Leblond 40891223e9 list-keyword: detect non built keyword 
This patch update the glafs list to be able to indicate that a
flag is not supported. This information is used by list-keyword to
display information to the user.
 14 years ago
Eric Leblond 8f13694988 luajit: no link with HTTP when not build. 
Even when not built-in, luajit is not linked with HTTP.
 14 years ago
Eric Leblond 6842545331 Add documentation url in list-keyword output. 
The output of the list-keyword is modified to include the url to
the keyword documentation when this is available. All documented
keywords should have their link set.

list-keyword can be used with an optional value:
 no option or short: display list of keywords
 csv: display a csv output on info an all keywords
 all: display a human readable output of keywords info
 $KWD: display the info about one keyword.
 14 years ago
Eric Leblond fa900a9f6b suricata: add information about BPF filter usage 14 years ago
Eric Leblond 7e14fe62f5 suricata: add '-V' info to usage message. 14 years ago
Eric Leblond fd3a1346e4 suricata: add build-info command to usage message. 14 years ago
Eric Leblond 4e0f5b7f02 suricata: don't display msg in list-keyword mode. 
In list-keywords and list-app-layer mode, suricata now only
displays the messages linked with the feature. This allow users
to redirect the output and easily work on it. For exemple, the
csv output will be easily imported into a spreadsheet.
 14 years ago
Eric Leblond 5e4552fdcd suricata: update list-keyword command 
This patch update the list-keyword command. Without any option,
the previous behavior is conserved. If 'all' is used as option,
suricata print a csv formatted output of keyword information:
	name;features;description
If a keyword name is used as argument, suricata print a readable
message:
tls.subject
Features: state inspecting
Description: Match TLS/SSL certificate Subject field
 14 years ago
Eric Leblond 86709f5e9d rule analyser: display message for invalid signatures 14 years ago
Eric Leblond c7cfbb71c9 engine-analyzer: fix typo in message 14 years ago
Eric Leblond cd42e6a3ef Listing of app layers does not depend on unittests 14 years ago
Eric Leblond 42ace54137 list-keywords: fix when not using default install 
As we don't parse the YAML file when listing of keywords is asked,
suricata make a test on existence of the build-default directory.
So with a non standard (working) install (even a single configure
without option lead to a failure), the keyword listing fails
because the default logging directory does not exist.
 14 years ago
Eric Leblond b0471fb8e4 rule analyser: add msg if rule is ipv4 or ipv6 only 14 years ago
Victor Julien 83bfe3810b reputation: report error if host table memcap reached. Work around compilation failure with atomic fallback code. 14 years ago
Victor Julien 18535e6ef9 Host: ignore usecnt add/sub result. Expose HostPrintStats. 14 years ago
Victor Julien e30b1bfe64 Simple IP reputation implementation 14 years ago
Victor Julien 9140aa6ac5 cygwin supports the thread cpu affinity code now 14 years ago
Victor Julien b20bfa04ef clang warning squashing 14 years ago
Victor Julien 84bad6db77 Silence compiler warnings found by clang 14 years ago
Victor Julien b63c2eda6a build: more cygwin cleanups 14 years ago
Victor Julien dc465b92e5 Fix use of byte swap function 14 years ago
Victor Julien 506c144c60 build: reshuffle including headers to fix build on cygwin 14 years ago
Anoop Saldanha e1cabae0f4 fix uninit var usage in hhd 14 years ago
Eric Leblond 4726e02afb logging: add warning if no output module is selected 
If no daemon compatible logging module is selected, a message is
displayed to avoid the user to look like mad for messages.
 14 years ago
Eric Leblond 9f4da93a4b suricata: don't exit if pidfile can't be created 14 years ago
Eric Leblond e148b2b82a suricata: display PID file name in case of error. 14 years ago
Victor Julien 93bdaa49d8 byte_jump: when from_beginning option is used, the number of bytes to convert should not be used in the jump. Bug 627. 14 years ago
Eric Leblond 7854c84972 pcap: add capture counters in stats.log. 
This patch adds three counters to stats.log:
    capture.kernel_packets    | RxPcapwlan0               | 4218
    capture.kernel_drops      | RxPcapwlan0               | 0
    capture.kernel_ifdrops    | RxPcapwlan0               | 0
This patch meant to fix bug #625.
 14 years ago
Victor Julien bcaec1e963 pkt-data: don't compile unittest unless unittests are enabled 14 years ago
Victor Julien 472e061c6d build: more checking for includes 14 years ago
Victor Julien 2a42f554b1 build cleanup, build source files in alphabetical order 14 years ago
Victor Julien 042d0c6ee8 build cleanups 14 years ago
Victor Julien 5a6c8c0f01 minor misc changes: update htp ver, add htp ver to --build-info, clean up 14 years ago
Xavier Lange 234922f3c6 Keyword pkt_data 14 years ago
Eric Leblond b9a2f91a76 napatech: treat malloc error 14 years ago
Eric Leblond a1d1abfc05 suricata: add daemon-directory config variable 
It is now possible to use the 'daemon-directory' configuration
variable to specify the working directory of suricata in daemon
mode. This will permit to specify the place for core and other
related files.
 14 years ago
Eric Leblond 3061452c5e suricata: avoid concurrent run in daemon mode 
This patch creates a pid file per default and use it to avoid to be
able to run two Suricata. Separate pid file have to be provided to
be able to do it.
 14 years ago
Eric Leblond 24d10de8af suricata: change dir to / in daemon mode. 
By changing directory to /, we will not block the directory where
suricata has been started.
 14 years ago
Matt Keeler 37e3de8425 Refactor Napatech 3GD to just Napatech as Suricata is only going to support 3GD. 
Signed-off-by: Matt Keeler <mk@npulsetech.com>
 14 years ago
Matt Keeler 5786a32d0f Remove Napatech 2GD support 
Removed the Napatech 2GD support

runmode-napatech-3gd.c had an include from runmode-napatech.h which was erroneous and has been removed as well.

Signed-off-by: Matt Keeler <mk@npulsetech.com>
 14 years ago
Victor Julien 57d7783402 Remove unnecessary debug message 14 years ago
Victor Julien 829238e49c OpenBSD 5.2 build fixes, Unit test fix. 14 years ago
Eric Leblond fc9e0df33b suricata: add run-as.user and run-as.group yaml var 
This patch update the YAML to be able to specify the user or the
group to run Suricata as:
 run-as:
   user: suri
   group: suri
 14 years ago
Eric Leblond 961eda2108 pcap: ref config according to threads count 14 years ago
Victor Julien b645425331 Silence compiler warning if napatech3 support is disabled 14 years ago
Matt Keeler 844e4dba11 Napatech 3GD Support 
For use with Network Cards from Napatech utilizing the 3GD driver/api.

    - Implemented new run modes in runmode-napatech-3gd.*
    - Implemented capture/decode threads in source-napatech-3gd.*
    - Integrated the new run modes and source into the build infrastructure.

    New configure switches
    --enabled-napatech-3gd : Turns on the NT 3GD support
    --with-napatech-3gd-includes : The directory containing the NT 3GD header files
    --with-napatech-3gd-libraries : The directory containing the NT 3GD libraries to link against.

    New CLI switch
    --napatech-3gd : Uses the Napatech 3GD run mode

    Runmodes Supported:
    - auto
    - autofp
    - workers

    Notes:
    - tested with 1 Gbps sustained traffic (no drops)

Signed-off-by: Matt Keeler <mk@npulsetech.com>
 14 years ago
Anoop Saldanha b8164b8797 fix wrong record hdr len check in ssl parser 14 years ago
Victor Julien d1573a366d Fix GetUsed functions for Host, Flow and Defrag. 14 years ago
Eric Leblond 4542cd0eec ipfw: suppress non loop receive function 14 years ago
Eric Leblond e3a38810b6 nfq: suppress non loop receive function 14 years ago
Victor Julien 966c731e73 flow: fix crash when flow engine under extreme stress, and unable to force free any existing flow 14 years ago
Victor Julien da7f1d22cc http: don't assume http tx to have header alloc'd. Can happen in OOM conditions. Bug #587. 14 years ago
Victor Julien 18ecd4b287 Don't use SCStrdup in SCLogMessage as we call it on OOM condition, leading to endless recursion. SCStrdup failure calling SCLogMessage... 14 years ago
Victor Julien 70bc9e2494 filestore: fix logic flag in continued stateful detection 14 years ago
Eric Leblond 8957113550 pf-ring: fix build 14 years ago
Victor Julien d386606b80 Remove pcre jit warning. Bug #579. 14 years ago
Eric Leblond d3195b0f70 pf_ring: don't set cluster for DNA interface. 14 years ago
Anoop Saldanha 7a7cd6999e feature #558. 
Print FP info in rule analysis + other cleanup.
 14 years ago
Victor Julien a3f963f630 filestore: fix a case where a matching non-filestore sig could trigger the store of a partially matching filestore sig. 14 years ago
Victor Julien 3156407746 http: fix client and server body sometimes being inspected in wrong order 14 years ago
Eric Leblond b12967534a stream.inline: add 'auto' mode 
stream.inline YAML configuration variable now support the 'auto' value.
In this case, inline mode is activated for IPS running mode (NFQ and
IPFW) and is deactivated for IDS mode. This patch should fix bug #592.
 14 years ago
Eric Leblond b26ec60398 af-packet: fix possible infinite loop. 
If no packet arrives to a capture thread, it is possible that the
AFPReadLoop() function goes into an infinite loop. This could cause
suricata to hang at exit on non busy system.
This patch adds a counter to detect when Suricata start looping in
the ring to stop when it reaches this point.
 14 years ago
Eric Leblond e8a4a4c47c af-packet: dump counter every seconds. 
This patch updates to kernel counters handling to be almost sure to
update at least once per second.
 14 years ago
Eric Leblond 3acdd4da1d pf-ring: add counter for kernel drop and packets 
This patch adds a counter for kernel drop and packets by using the
same strategy as the one used in af-packet.
 14 years ago
Victor Julien 80d62b59ec Fix drop (and other actions) not being applied to thresholded packets. Bug #613. 14 years ago
Anoop Saldanha bca1b7c52a change default mpm to ac. Also default sgh-mpm-context is full. 14 years ago
Victor Julien fd6df00684 Bug 585: use per detect thread libmagic ctx 14 years ago
Victor Julien ea6fcb355b magic: add test showing payload resulting in libmagic invalid read as reported by valgrind. 14 years ago
Anoop Saldanha fdab6f2ab1 fix flow deadlock issue in detection engine state introduced by tx api. 
Issue discovered by coverity.
 14 years ago
Eric Leblond 00b95c69c0 suricata: list-keywords does not depend on unittest 14 years ago
Victor Julien 83ffd1f743 luajit: suppress compiler warning 14 years ago
Anoop Saldanha 2ab62920aa fix segv in hcbd and hsbd buffering. 
Increase bufffers_list_len, only we open up a space for a new tx.
 14 years ago
Anoop Saldanha b359bc03a9 unittest to reveal a bug/segv in our hsbd buffering code. 14 years ago
Victor Julien 4fab8ea6d6 http: fix http header reassembly bug causing some headers to be left out of the inspected buffer 14 years ago
Victor Julien 5cd46433d3 http: now that htp_state has a cfg reference, use it for body limits 14 years ago
Victor Julien 2763a61213 http: allow configuration of request and response body inspection limits. Issue #560. 14 years ago
Anoop Saldanha b99f9fe890 New app inspection engine introduced. Moved existing inspecting engines to use it. 14 years ago
Anoop Saldanha 7b4eac3e8d Change all inspect callbacks to accept TV and a tx_id param. 14 years ago
Anoop Saldanha 10a6e6a3eb Engine cleanup. Remove all old engine inspection and mpm functions. 14 years ago
Anoop Saldanha b0e20a486c update client/server/http_header to use a different form of 
buffering/buffer_retrieval.

Now it happens per tx, based on tx id.  Also notice a perf improvement with
this.
 14 years ago
Victor Julien e1321f9ae6 stream: change how retransmissions are handled and detected. 14 years ago
Victor Julien b621ed8423 stream: fix retransmission on closewait being considered out of window 14 years ago
Victor Julien a25629b250 stream: detect retransmissions on timewait state 14 years ago
Victor Julien 6326390120 stream: accept ack with next_seq + 1 on last_ack state 14 years ago
Victor Julien bc37cb6b8e stream: detect retransmissions on closewait and finwait2 states 14 years ago
Victor Julien 305ed3f23b stream: don't flag zero window probe packets as out of window. Bug #604. 14 years ago
Victor Julien 13e60c0040 stream: detect keep-alive packets so we don't consider those invalid 14 years ago
Victor Julien 9094eb4783 stream: ignore ack value if ack flag is not set. Add stream.pkt_broken_ack event for when ack value is not 0 and ack flag not set. 14 years ago
Victor Julien a5d9442c2d stream: handle retransmission of lost data packet on TIME_WAIT state 14 years ago
Victor Julien 037d67cc66 stream: go from FIN_WAIT_1 to CLOSING on simultaneous close. 14 years ago
Victor Julien 6544475670 stream: don't reject RST as response to SYN because of ACK 14 years ago
Victor Julien 6f76ac176d stream: add option to match on overlapping data 
Set event on overlapping data segments that have different data.

Add stream-events option stream-event:reassembly_overlap_different_data and
add an example rule.

Issue 603.
 14 years ago
Victor Julien d68fd54a76 Fix/suppress a couple of harmless compiler warnings. 14 years ago
Anoop Saldanha 870a98b528 Remove dead comment about flow reference api duplicate 14 years ago
Anoop Saldanha f08497d1e4 Move Flow Reference/Dereferene api from flow-util.h to flow.h. 
Remove duplicate FlowDeReference from decode.h
 14 years ago
Anoop Saldanha 67981d1c5c Update suricata to use FlowReference/FlowDeReference for the ones left out 
from last update.
 14 years ago
Victor Julien 72782e5a6a profiling: fix rule profiling output sometimes missing sid,rev,gid. Bug #576. 14 years ago
Victor Julien 10a11b750d Add dsize check to prefilter stage 
Many sigs with dsize have a weak fast_pattern. Those patterns
are likely to match. By filtering on dsize early, we safe a lot
of cycles later.
 14 years ago
Victor Julien 45cbef0735 For signatures with the dsize option set depth on any content match in that sig. 14 years ago
Victor Julien 4464657ca2 remove reference to non-existing file from Makefile.am 14 years ago
Victor Julien a01130d2ed packet src: move pkt_src field up in the structure to fix in an existing hole (found with pahole -C Packet_ src/.libs/suricata). 14 years ago
Anoop Saldanha b33986c887 Add a packet src for every packet generated inside suricata. 14 years ago
Eric Leblond 19756488ab nfq: close the queue when leaving acquisition. 
This patch adds a call to close the queue when the acquisition
loop is ending. This way the incoming packets will be accepted
during all the shutdown phase (if the queue-bypass option of
NFQUEUE is used). At the same time the currently processed packets
will be dropped but the time scale are different: suricata will
drop 20 ms of packets and the shutdown can take 0.5 seconds.

Patch based on an idea of Victor Julien.
 14 years ago
Victor Julien 75cddabd8a fast_pattern: don't consider http_method, http_stat_code and http_stat_msg when automatically giving preference to a HTTP pattern over a stream pattern. 14 years ago
Eric Leblond 928ade1d04 pf-ring: suppress unused variable. 14 years ago
Eric Leblond c3b9a5e97f pf-ring: add missing header. 14 years ago
Eric Leblond 7731cef782 pf-ring: protect definition of (un)likely 
This patch makes (un)likely declared if and only if they are not
declared before.
 14 years ago
Anoop Saldanha fd977601b6 fix for bug #574. 
More of a temporary solution to prevent any possible FPs.  Disable content
inspection bypass for mpm patterns.
 14 years ago
Anoop Saldanha 51c9955c79 fix for bug #577. 
If a pattern has matched on mpm, don't re-inspect it later, subject to certain
conditions met by the pattern - namely, not negated, right chop, no replacet
attached to it.
 14 years ago
Victor Julien aa4ae98d37 http: fix multipart parsing leading to missing chunks of files in file extraction. 14 years ago
Anoop Saldanha 028c6c1782 Make available custom features of libhtp. 
The power of libhtp customisation now available to users.

Options available -

path-backslash-separators: yes
path-compress-separators: yes
path-control-char-handling: none
path-convert-utf8: yes
path-decode-separators: yes
path-decode-u-encoding: yes
path-invalid-encoding-handling: preserve_percent
path-invalid-utf8-handling: none
path-nul-encoded-handling: none
path-nul-raw-handling: none
set-path-replacement-char: ?
set-path-unicode-mapping: bestfit

You can use this for your libhtp customisation.  Options explained in our
wiki.

https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Advanced_libhtp_customization
 14 years ago
Anoop Saldanha 340542c44e refactor htpconfigure() 14 years ago
Victor Julien 33b0b07107 bug #572: make sure we use profiling fallback for all architectures except x86_64 and i386. 14 years ago
Victor Julien 50da0e80d5 Fix flow keyword compilation failure. 14 years ago
Anoop Saldanha 3d74fa964a Update all flow referencing to use the new FlowReference and FlowDeReference 
macros.
 14 years ago
Anoop Saldanha 6c68f86b8c fix for bug #557. 
In FFRv2, dereference flow from a packet using the new reference/dereference
util macros.  This allows the decr use_cnt for flow and reseting the flow
pointer to NULL for the pseudo pkt to happen simultaneously, in case there we
fail to retrieve a pseudo_packet and have to return the already obtained
pseudo packets, back to the packetpool.
 14 years ago
Anoop Saldanha 88e89d6302 Introduce utility flow macros to help referencing/dereferencing flows. 14 years ago
Anoop Saldanha 4d501778e9 fix for bug #557. 
Reset hhd buffers list len if we exit before allocating the buffer.
 14 years ago
Anoop Saldanha 855726f372 fix for bug #575. 
If sig has no_stream set, don't mask it as requiring flow.  Should get rid of
FNs any.
 14 years ago
Victor Julien 1598425a40 detect: properly store a stateful match if it happens at the start of inspection 14 years ago
Victor Julien c3f4f8d46a Dead code cleanup. Coverity 728047, 728048, 728049. 14 years ago
Victor Julien ee5d6fdb6f profiling: fix some profiling info missing from output 14 years ago
Eric Leblond ffbbff9d6c tm-thread: detect thread death 
When a thread is dead at init the THV_INIT_DONE flag is not set
and the spawn function can freeze (see bug #553 for an example).
In this case THV_RUNNING_DONE is set and we can also check on this
state for leaving the function. This should fix #bug553
 14 years ago
Anoop Saldanha 4e3b206f7b fix http server/client body handling. Update body status based on tx state. 14 years ago
Victor Julien 82fc61770b threshold: allow threshold.config to override rule 
Allow threshold.conf to override rule thresholds in the following
cases:

- threshold.config rule uses threshold or event_filter AND
- threshold.config rule applies to a single signature (so no
  gid 0 or sid 0)

Confirmed to work with both threshold and detection_filter rule
keywords.

Part of bug #425.
 14 years ago
Victor Julien a0c43a8a1c Minor parsing cleanups in detect-engine options. 14 years ago
Eric Leblond 9f13572843 Fix indentation of win32 files. 14 years ago
Eric Leblond 710d237724 Add missing sctrdup test 14 years ago
Eric Leblond e176be6fcc Use unlikely for error treatment. 
When handling error case on SCMallog, SCCalloc or SCStrdup
we are in an unlikely case. This patch adds the unlikely()
expression to indicate this to gcc.

This patch has been obtained via coccinelle. The transformation
is the following:

@istested@
identifier x;
statement S1;
identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)";
@@

x = func(...)
... when != x
- if (x == NULL) S1
+ if (unlikely(x == NULL)) S1
 14 years ago
Eric Leblond d292004880 Add some missing checks of SCStrdup return. 14 years ago
Eric Leblond 655577cbbc Add some missing checks of SCMalloc return. 14 years ago
Victor Julien d8667448c1 threshold: allow suppression for sigs with threshold set. Part of #425. 14 years ago
Anoop Saldanha f9a6c890d4 fix for #529 
Respect pcre's anchor during content inspection.
 14 years ago
Anoop Saldanha 19e8f82f25 Unittest to display #bug 529. pcre anchor not respected 14 years ago
Anoop Saldanha b0b4052860 detect-pcre.c cleanup. Delete old pcre functions that we no longer use. 14 years ago
Eric Leblond 680e941a8f af-packet: clean APFPacketVar before release. 
This patch resets the AFPPacketVar linked to a Packet in the release
function to avoid any side effect when the packet is reused. To do
so a new AFPV_CLEANUP macro has been introduced.
 14 years ago
Eric Leblond 775f379e2b decode: clean release function 14 years ago
Anoop Saldanha 21f92c0a89 Give priority to non stream content over stream content when selecting fast 
pattern.
 14 years ago
Victor Julien a08a0e9161 Minor output cleanup 14 years ago
Victor Julien abc3f903f9 Fix defrag compilation warning. 14 years ago
Victor Julien 525367113a Fix compilation if luajit is disabled. 14 years ago
Victor Julien d1abd552e9 luajit: correct offset passed to script for lua's array idx starting at 1. Add http.response_headers and http.response_headers.raw buffers. 14 years ago
Victor Julien 20d2db085e reintroduce pool free func for cases where block alloc is not used. 14 years ago
Victor Julien 98484ffdcc luajit: prealloc lua states to increases chances of alloc success. Luajit requires them to be in memory <2GB. 14 years ago
Victor Julien f962e3de29 pool: only alloc one large block if it will actually be used. 14 years ago
Victor Julien 6f7e527e92 luajit: fix crash at shutdown / rule reload if lua script didn't properly init. 14 years ago
Eric Leblond 8192f6ce8c Add missing include in flow-manager 
DefragTimeoutHash was not declared before being used.
 14 years ago
Victor Julien 44b7d5551a luajit: fix crash if luaL_newstate fails 14 years ago
Victor Julien b29971bc92 luajit: buffer selection fixes 14 years ago
Victor Julien fcc21ae4cc http: fix multipart parsing bug 14 years ago
Victor Julien 8f337a3904 stream: never resend reassembled data to app layer. 14 years ago
Victor Julien 9a4b612126 app layer events: prefilter sigs that need an event 14 years ago
Victor Julien 575c87aeba engine events: prefilter sigs that need a event 14 years ago
Eric Leblond 5f12b23469 af-packet: little code cleaning 
This patch cleans the code were two almost identical treatment on
the packet we're made. It may be linked by a merge error I've done
or to a simple mistake on my side.
 14 years ago
Eric Leblond 0581a23f3c af-packet: fix IPS mode 
There was an inversion in code resulting as all sockets being seen
as non IPS mode when doing the peering. This resulted in a crash at
first packet because it has no peer.
 14 years ago
Eric Leblond 566674ae4a Fix logic operator. 
Previous patches on the same subject did not fixed this error as it
was undetected because the code was not compiled on my setup.
 14 years ago
Victor Julien 7a044a99ee Defrag engine 
Big rewrite of defrag engine to make it more scalable and fix some
locking logic flaws.

Now uses a hash of trackers similar to Flow and Host hashes.
 14 years ago
Victor Julien c91c359692 profiling: fix build on older systems 14 years ago
Victor Julien 7babb35aeb profiling: remove obsolete unit test 14 years ago
Eric Leblond cdbc9be1c3 pf_ring: set cluster_id even if only one thread is used. 14 years ago
Victor Julien 1f92307517 profiling: minor cleanup 14 years ago
Victor Julien 3da3e3264c profiling: make sure counters are reset after a reload. 14 years ago
Victor Julien 2343ff8950 profiling: fix memory error in case of rule reload. 14 years ago
Victor Julien ec7e79c748 Rule profiling update 
- Remove usage of counters api.
- Store stats in detect engine thread ctx to remove locking
- Support rule reloads
 14 years ago
Victor Julien ba6f564296 luajit: add http.uri.raw, cookie, ua, headers, headers.raw buffers. 14 years ago
Eric Leblond 9c28cd40fd Fix build if luajit is not available. 14 years ago
Eric Leblond 937ba71491 defrag: don't return after a cleaning. 
This patch changes the policy of the timeout function by cleaning
every timeouted trackers.
Previous code was only freeing the first tracker and this was resulting
in calling the timeout function continuously. One of my previous patch
has modified the function to avoid to run it more than twice a second.
But as it was not taken into account the fact only the first tracker was
freed, the result was that a lot of tracker could not be allocated.
 14 years ago
Victor Julien b6834cb6b2 luajit: support http.request_body (http_client_body) and http.response_body (file_data/http_server_body). 14 years ago
Victor Julien 42646579a8 luajit: clean up initialization 14 years ago
Eric Leblond 619014a280 pool: rename Free function to Cleanup 
This patch renames Free functions to Cleanup as the free is made
by the pool system.
 14 years ago
Eric Leblond f241312a36 defrag: don't use message for repetitive error 
When nothing can be fetch from the pool, this can repeat frequently.
Thus displaying a message in the log will not help. This patch
uses a counter instead of a log message. As this is a sort of memcap
this is conformed to what is done for other issues of the same type.
 14 years ago
Eric Leblond 6303b5d987 SC_LOG_ERROR is not an error. 14 years ago
Eric Leblond d51dd6a30e Fix warning about unused return of SC_ATOMIC func. 14 years ago
Eric Leblond c4f9d0e0e1 Fix invalid usage of operator. 14 years ago
Eric Leblond 7af9fd7735 freebsd: fix warning about redeclaration. 14 years ago
Eric Leblond 4d2305c0a8 freebsd: fix warning 14 years ago
Eric Leblond 6d55446655 ipfw: avoid critical error for broadcast 
In some setup, suricata may receive broadcast packets and the call
to sendto may fail if the wrong interface is choosen by kernel.
This patch change the error treatment to avoid to leave when
this problem occurs.
 14 years ago
Eric Leblond 41cb365a39 ipfw: add missing include 14 years ago
Eric Leblond e168824d80 freebsd: fix function usage. 
The unlock function was not correctly used in error treatment.
 14 years ago
Jason Ish ea020e2be6 Do not trim the FCS, pcaps converted to ERF will have have an FCS. 14 years ago
Eric Leblond 4a1a008009 af-packet: fix looping in ring buffer. 
A crash can occurs in the following conditions:
 * Suricata running in other mode than "workers"
 * Kernel fill in the ring buffer
Under this conditions, it is possible that the capture thread reads
a packet that has not yet released by one of the treatment threads
because there is no modification done on the ring buffer entry when
a packet is read. Doing, this it access to memory which can be
released to the kernel and modified. This results in a kind of memory
corruption.

This bug has only been seen recently and this has to be linked with the
read speed improvement recently made in AF_PACKET support.

The patch fixes the issue by modifying the tp_status bitmask in the
ring buffer. It sets the TP_STATUS_USER_BUSY flag when it is confirmed
that the packet will be treated. And at the start of the read, it exits
from the reading loop (returning to poll) when it reaches a packet with
the flag set. As tp_status is set to 0 during packet release the flag
is destroyed when releasing the packet.

Regarding concurrency, we've got a sequence of modification. The
capture thread read the packet and set the flag, then it passes the
queue and the packet get processed by other threads. The change on
tp_status are thus made at different time.

Regarding the value of the flag, the patch uses the last bit of
tp_status to avoid be impacting by a change in kernel. I will
propose a patch to have TP_STATUS_USER_BUSY included in kernel
as this is a generic issue for multithreading application using
AF_PACKET mechanism.
 14 years ago
Victor Julien 0d55950840 luajit: add http.uri and http.request_line buffers. 14 years ago
Victor Julien 597b6db8f2 luajit: fix filtering payload or pkt when not available yet 14 years ago
Victor Julien 69186cda12 luajit: force scripts to have 'init' function that returns a table of 'needs' such as packet or payload. 14 years ago
Eric Leblond cd8d215724 pool: improve error handling 
Error handling during Pool creation was not perfect as a PoolBucket
could leak.
 14 years ago
Victor Julien 829d975d63 Make sure defrag pool sizes are not initialized to 0, see #540. 14 years ago
Eric Leblond 01d3c14449 tls: fix error handling 
Handling of error case was correct as pointed out by Coverity
717439.
 14 years ago
Eric Leblond 41c72a537a tls: avoid double close. 
This should fix issue 717441 reported by Coverity.
 14 years ago
Eric Leblond 4e6a4c65f6 defrag: be sure to output NULL tracker 
Coverity 720337 pointed out a use after free. We can't be dependent
to HashListTableAdd outputting a NULL tracker.
 14 years ago
Eric Leblond a7afa845a6 Fix coverity warnings 718636 and 718635 
The result of the swap was not checked.
 14 years ago
Eric Leblond d3824bd1ab defrag: fix potential use after free. 
Coverity pointed out that PoolReturn is almost like free and detected
a use after free when accessing to tracker->af (issue 720339).
This patch fixes this by storing the value in a local variable.
 14 years ago
Eric Leblond 90052609ee defrag: avoid to run cleaning repetitively 14 years ago
Eric Leblond b2691cbe88 af-packet: handle possible exit of capture loop. 
If a capture loop does exit, the thread needs to start without
synchronization with the other threads. This patch fixes this
by resetting the turn count on the peerslist structure and
adding a test on this condition in the wait function.
 14 years ago
Eric Leblond 4d8f70c613 af-packet: fix kernel offset issue 
It seems that, in some case, there is a read waiting but the
offset in the ring buffer is not correct and Suricata need to
walk the ring to find the correct place and make the read.
 14 years ago
Eric Leblond ee6ba09948 af-packet: fix emergency mode 
This patch fixes emergency mode by setting the variable even if we
have a non kernel checksum check. It also does a call to
AFPDUmpCounters() as it seems to improve thing to do it ASAP.
 14 years ago
Eric Leblond 6040016347 af-packet: implement late open 
This patch implements "late open". On high performance system, it
is needed to create the AF_PACKET just before reading to avoid
overflow. Socket creation has to be done with respect to the order
of thread creation to respect affinity settings.
This patch adds a counter to AFPPeer to be ale to synchronize the
initial socket creation.
 14 years ago
Eric Leblond 3bea3b39df af-packet: improve logged messages. 14 years ago
Eric Leblond 13f13b6d7e af-packet: rework socket transition phase. 
Suricata was not able to start cleanly in AF_PACKET with default
suricata.yaml file if there was no eth1 on the system. This patch
fixes this issue and rework the socket transition phase to fix
some serious issues (file descriptor leak) found when fixing this
problem.
Every 20 seconds it displays a message to the user to warn him about
the interface not being accessible:
  [ERRCODE: SC_ERR_AFP_CREATE(196)] - Can not open iface 'eth1'
 14 years ago
Eric Leblond 0f2b34068c af-packet: ring mode is not optionnal in AFPReadFromRing 14 years ago
Victor Julien 355e981775 Fix 'no effect' check in timestamp print logic. Coverity 717437. 14 years ago
Victor Julien 886a4f2850 Check response headers in custom http logging before using them. Coverity 717436. 14 years ago
Eric Leblond 5ffe7e21c3 decode: use pointer inside packet area as param 
DecodeTeredo, DecodeIPv6InIPv6 and DecodeIPv4inIPv6 were calling
DecodeTunnel with packet being a pseudo packet and data being
data from initial packet:
        DecodeTunnel(tv, dtv, tp, start, blen,
                     pq, IPPROTO_IPV6);
In decoding functions, arithmetic was done on pkt to set some values?
It was resulting in field of packet  pointing outside of the scope of
packet data.
This patch switch to what has been done in DecodeGre(), I mean:
        DecodeTunnel(tv, dtv, tp, GET_PKT_DATA(tp),
                     GET_PKT_LEN(tp), pq, IPPROTO_IP);
Data buffer is then relative to the packet and the arithmetic is
correct.
 14 years ago
Eric Leblond 073b251df7 affinity: drop capability after setting thread prio 
Setting thread priority can require privilege if a low nice value
has to be set up.
 14 years ago
Eric Leblond d1569337a7 affinity: add call to setup function in threads 
Threads created through TMThreadSpawn need to call the affinity
function by themselves.
 14 years ago
Eric Leblond 0eeccb4b17 affinity: tag management threads as such 
The management threads were not tagged for CPU affinity and thus
the setting was not applied.
 14 years ago
Eric Leblond efc3faaa0a affinity: add log message 14 years ago
Eric Leblond a48d6cb207 erf: fix logical operator usage. 14 years ago
Victor Julien 2026a68697 Implement logic of luajit keyword to match on full packet data and/or payload. 14 years ago
Victor Julien ba3260ed38 Thread local ctx for detection keywords 
Some detection keywords need thread local ctx storage. Example is the
filemagic keyword that has a ctx that is modified with each call. That
is not thread safe. This functionality allows registration of thread
local ctxs so that each detect thread works on it's own copy.
 14 years ago
Victor Julien f58e828c5e luajit: stub detection keyword 14 years ago
Eric Leblond b0a2aefc78 af-packet: fix build on systems without AF_PACKET 14 years ago
Eric Leblond bfd6dea38f pool: update doxygen documentation. 14 years ago
Eric Leblond fa079c1da0 pool: realize a block allocation for preallocated item. 
This patch required a evolution of Pool API as it is needed to
proceed to alloc or init separetely. The PoolInit has been changed
with a new Init function parameter.
 14 years ago
Eric Leblond cd76c7e5fb pool: alloc a single area for all PoolBuckets 
As we know the number and the size of PoolBucket, we can simply
allocate a single memory zone.
 14 years ago
Eric Leblond b58ecd833a l3proto: add unit tests 
This patch adds a series of unit tests. First two check test the keyword
by checking packet on signatures using it. Last one adds is here to check
that there is no interaction of l3_proto and ip_proto.
 14 years ago
Eric Leblond 71b4257bc2 sig: add l3_proto keyword 
This patch adds a l3_proto keyword to the signature language. It
can be used to specify if the signature has to match on IPv4, IPv6
or both. For example, one can write:
  alert http any any -> any 22 (msg: "HTTP v6"; l3_proto:ip6; sid:14;)

This should close #494.
 14 years ago
Eric Leblond fd7b6db22d sig: Add ipv6 and ipv4 to list of protocols 
With this patch it is possible to do:
 alert ipv6 any any -> any any
or
 alert ip4 any any -> any any
to match on IPv4 or IPv6 packets.
 14 years ago
Eric Leblond ac56b1bf24 af-packet: detect MTU mismatch and warn user 
If the MTU on the reception interface and the one on the transmission
interface are different, this will result in an error at transmission
when sending packet to the wire.
 14 years ago
Eric Leblond 27b5136bf2 af-packet: add optional emergency mode 
Flush all waiting packets to be in sync with kernel when drop
occurs. This mode can be activated by setting use-emergency-flush
to yes in the interface configuration.
 14 years ago
Eric Leblond ec76742caa af-packet: reorder socket operation. 
This patch moves raw socket binding at the end of init code to
avoid to have a flow of packets reaching the socket before we
start to read them.

The socket creation is now made in the loop function to avoid
any timing issue between init function and the call of the loop.
 14 years ago
Eric Leblond 1ea809520a af-packet: fix runmode name in logging function 14 years ago
Eric Leblond a645726262 af-packet: add doxygen comments 
This patch adds doxygen comments to newly introduced function and adds
module AF_PACKET doxygen module with a dedicated AFP peers module.
 14 years ago
Eric Leblond 662dccd8a5 af-packet: IPS and TAP feature 
This patch adds a new feature to AF_PACKET capture mode. It is now
possible to use AF_PACKET in IPS and TAP mode: all traffic received
on a interface will be forwarded (at the Ethernet level) to an other
interface. To do so, Suricata create a raw socket and sends the receive
packets to a interface designed in the configuration file.

This patch adds two variables to the configuration of af-packet
interface:
 copy-mode: ips or tap
 copy-iface: eth1 #the interface where packet are copied
If copy-mode is set to ips then the packet wth action DROP are not
copied to the destination interface. If copy-mode is set to tap,
all packets are copied to the destination interface.
Any other value of copy-mode results in the feature to be unused.
There is no default interface for copy-iface and the variable has
to be set for the ids or tap mode to work.

For now, this feature depends of the release data system. This
implies you need to activate the ring mode and zero copy. Basically
use-mmap has to be set to yes.

This patch adds a peering of AF_PACKET sockets from the thread on
one interface to the threads on another interface. Peering is
necessary as if we use an other socket the capture socket receives
all emitted packets. This is made using a new AFPPeer structure to
avoid direct interaction between AFPTreadVars.

There is currently a bug in Linux kernel (prior to 3.6) and it is
not possible to use multiple threads.

You need to setup two interfaces with equality on the threads
variable. copy-mode variable must be set on the two interfaces
and use-mmap must be set to activated.

A valid configuration for an IPS using eth0 and vboxnet1 interfaces
will look like:

af-packet:
  - interface: eth0
    threads: 1
    defrag: yes
    cluster-type: cluster_flow
    cluster-id: 98
    copy-mode: ips
    copy-iface: vboxnet1
    buffer-size: 64535
    use-mmap: yes
  - interface: vboxnet1
    threads: 1
    cluster-id: 97
    defrag: yes
    cluster-type: cluster_flow
    copy-mode: ips
    copy-iface: eth0
    buffer-size: 64535
    use-mmap: yes
 14 years ago
Eric Leblond 2011a3f87e capture: add data release mechanism 
This patch adds a data release mechanism. If the capture module
has a call to indicate that userland has finished with the data,
it is possible to use this system. The data will then be released
when the treatment of the packet is finished.

To do so the Packet structure has been modified:
+    TmEcode (*ReleaseData)(ThreadVars *, struct Packet_ *);
If ReleaseData is null, the function is called when the treatment
of the Packet is finished.
Thus it is sufficient for the capture module to code a function
wrapping the data release mechanism and to assign it to ReleaseData
field.

This patch also includes an implementation of this mechanism for
AF_PACKET.
 14 years ago
Eric Leblond 8879df8004 af-packet: improve mmaped running mode. 
The mmaped mode was using a too small ring buffer size which was
not able to handle burst of packets coming from the network. This
may explain the important packet loss rate observed by Edward
Fjellskål.
This patch increases the default value and adds a ring-size
variable which can be used to manually tune the value.
 14 years ago
Eric Leblond 9622704c8c af-packet: delete design comments 14 years ago
Victor Julien 5d27518bbd Make sure we never underflow len in DetectLoadSigFile 14 years ago
Eric Leblond e6e339aacf Add counters for IPv4 in IPv6 and IPv6 in IPv6 14 years ago
Victor Julien 250c4e9310 file: convert filesize to new FileMatch api. 14 years ago
Victor Julien f93c54136c stream/app layer: call new Truncate callback for data gap case as well. 14 years ago
Victor Julien 869109a6a0 stream/app layer: add Truncate app layer callback that is called if stream depth is reached. Use it to trunc open files in HTTP. 14 years ago
Victor Julien 8f71333e12 file: implement filesize keyword. #489. 14 years ago
Anoop Saldanha 970fdee204 detection engine port api unittests cleanup 14 years ago
Victor Julien 3849588c61 Create separate detect API call (FileMatch) for file detection keywords. #531. 14 years ago
Eric Leblond 12743ca5d7 tls-log: add protocol version to log message. 14 years ago
pi-rho af20eaf2e5 fix regression (clobbered register; redmine #534) 14 years ago
pi-rho 0df4c5838d spelling corrections documented in redmine bug#533 14 years ago
Victor Julien 408548c2c4 rule reloads: don't lock up main thread so clean shutdown is impossible 14 years ago
Victor Julien cbeb8a86b7 pcap: fix compilation on old libpcap 14 years ago
Eric Leblond 16bdcbeb0e tm-thread: suppress rarely used variable. 14 years ago
Eric Leblond 92679442ca Convert to atomic and disable check on HTP config change. 
This patch converts the series of variable to an atomic.

Furthermore, as the callbacks are now always run, it is not
necessary anymore to refuse a ruleswap if HTP parameters are
changing.
 14 years ago
Eric Leblond 66a083dafa Get rid of AppLayerHtpRegisterExtraCallbacks 
This patch add a early exit condition to the body handling callback.
This permits to avoid to avoid a complex system to handle htp
object change.
 14 years ago
Eric Leblond 7e09cdc265 Delay Detect threads initialization 
This patch modifies the init of Detect threads. They are now started
with a dummy function and their initialisation is done after the
signatures are loaded. Just after this, the dummy function is switched
to normal one.

In IPS mode, this permit to route packets without waiting for the
signature to start and should fix #488.

Offline mode such as pcap file don't use this mode to be sure to
analyse all packets in the file.

The patch introduces a "delayed-detect" configuration variable
under detect-engine. It can be used to activate the feature
(set to "yes" to have signature loaded after capture is started).
 14 years ago
Eric Leblond eaea832a4e pcap: handle failure of packet treatment 
If the loop is breaked, this means we've got a treatment error. We
don't need to reconnect but we must exit with correct status.
 14 years ago
Eric Leblond f82573be12 tls: suppress always true condition. 14 years ago
Eric Leblond a3b2cee0d5 detect-tls: various indent fixes. 
And delete a useless FIXME.
 14 years ago
Eric Leblond b253d1a499 tls: store all the certificates chain in the written PEM file. 
When using the tls.store command, a dump of all certificates in
the chain is now done on the disk.
 14 years ago
Eric Leblond 152b4eaf56 tls: keep pointers to all certificates in chain 
When multiple certificates forming a chain are sent. A pointer to
the start of each certificate is kept. This will allow treatment
on certificates chains.
 14 years ago
Jean-Paul Roliers c4df7a45ae tls: adding store option for TLS 
This patch adds a TLS store option to save certificate in PEM format.
Each time the store action is met, a file and a metafile are created.

Reworked-by: Eric Leblond <eric@regit.org>
 14 years ago
Jean-Paul Roliers 00d4357362 tls: adding support for fingerprint rule matching. 
Add the support for tls.fingerprint keyword in rules.
 14 years ago
Jean-Paul Roliers bf386a396d tls: adding fingerprint to TLS Log information. 
Improve TLS logging by adding the certificate fingerprint to TLS Log file.
Add the extending option to the tls-log entry in suricata.yaml.
 14 years ago
Jean-Paul Roliers 644c1b3cad tls: adding fingerprint calculation. 
Adding a pointer in ssl_state struct and compute fingerprint during
certificate decoding.
 14 years ago
Eric Leblond 3df20d0544 tls: add NSS version for SHA1 computing function. 14 years ago
Jean-Paul Roliers 9071bcf983 tls: adding cryptographic functions. 
Adding util-crypt containing cryptographic functions as SHA1 and Base64.
 14 years ago
Jean-Paul Roliers efdf96ccba tls: adding TLS Log support 
Creation of the log-tlslog file in order to log tls message.
Need to add some information into suricata.yaml to work.

  - tls-log:
      enabled: yes	# Log TLS connections.
      filename: tls.log # File to store TLS logs.
 14 years ago
Anoop Saldanha 3eb0fd878d Don't wait for packetpool to be back to full state before continuing with the shutdown process, on received shutdown signal 14 years ago
Anoop Saldanha 5f198e3a1d Suricata shutdown updates + minor cleanup 14 years ago
Anoop Saldanha 34581ce902 rx TMs shouldn't return TM_ECODE_FAILED if engine is in shutdown mode + minor cleanup 14 years ago
Ignacio Sanchez b057a20f10 Custom logging feature for log-httplog 14 years ago
Eric Leblond def0270de7 decode: decode IPv6-in-IPv6 
This patch adds decoding of IPv6-in-IPv6. It also adds some events
for invalid packets.

This patch should fix #514.
 14 years ago
Victor Julien 438dd61948 Update version number to reflect we're working towards 1.4 now. 14 years ago
Eric Leblond f9046d8284 Add teredo counter. 14 years ago
Eric Leblond 09d893127e defrag: prealloc more frags. 14 years ago
Eric Leblond fd32159464 defrag: add some events relative to defragmentation 14 years ago
Eric Leblond d2aa0407c4 defrag: Fix unittest logic. 
We've linked the size of hash with trackers. Thus calling DefragInit()
after setting the configuration variable is more logic.
 14 years ago
Eric Leblond 0fd2c93c96 defrag: link hash size with number of frags. 
We set defrag_hash_size by using the number of trackers. This is
effective to avoid collision.
 14 years ago
Eric Leblond f328e18d59 defrag: fix some integer type warning. 14 years ago
Eric Leblond b1b4cd2729 defrag: really use 'max-frags' variable. 
The 'max-frags' variable was not used and the 'trackers' variable was
not documented. This patch fixes the two issues.
 14 years ago
Eric Leblond 6480cd1b9c Teredo tunnel supports 
This patch should fix #480 by adding the support of Teredo tunnel.
The IPv6 content of the tunnel will be parsed in a similar way as
what is done the GRE tunnel. Signatures will then be matched on the
IPv6 content.
 14 years ago
Eric Leblond 09fa0b9542 Add support for IPv4-in-IPv6 
This patch adds support for IPv4-in-IPv6 and should fix #462.
 14 years ago
Eric Leblond 2c57275921 nfq: implement "fail-open" support. 
On linux >= 3.6, you can use the fail-open option on a NFQ queue
to have the kernel accept the packet if userspace is not able to keep
pace.

Please note that the kernel will not trigger an error if the feature is activated
in userspace libraries but not available in kernel.

This patch implements the option for suricata by adding a nfq.fail-open
configuration variable which is desactivated by default.
 14 years ago
Eric Leblond 452d3c4308 tm-thread: exit loop if suri want to quit 14 years ago
Eric Leblond f389a1201f tm-thread: run thread init function sequentially. 
On some setup you want to run each thread init function sequentially.
For example, if I use flow_cpu load balancing on AF_PACKET, my target
is to have CPU 0 (first socket in the group) to be link with the
thread 0 in detect cpu set (first thread to be initialised). A good
way to achieve this is to run only one thread init function at a time
to avoid any possible race condition.
 14 years ago
Victor Julien f1b6f7a9e6 rule analyzer: make analyzer aware of http_user_agent pcre flag /V. 14 years ago
Victor Julien e737e2dc56 http: after path double decoding, also normalize the path again. #504. 14 years ago
Victor Julien e839cea9e5 Http: don't double decode URI path and query by default. Instead add per server options to enable double decoding for both cases. #464 #504. 14 years ago
Victor Julien e0bfcb7dde Only set SIG_FLAG_REQUIRE_STREAM if signature inspects TCP. 14 years ago
Victor Julien bd6b865473 rule analyzer: fix fast pattern analyzer reporting wrong filename (same as rule analyzer). 14 years ago
Eric Leblond 11c3167583 stream-tcp: no checksum alert if validation is off 
This patch disables checksum alert if checksum-validation is set
to no in the configuration file. Without this patch, when parsing
a pcap which checksum offloading, it was not possible to get rid
of event caused by checksum validation.
 14 years ago
Victor Julien c51a3aad17 stream: handle case where Suricata sees 3whs-ACK but server doesn't. Bug #523. 14 years ago
Victor Julien 5cc8a09257 stream: fix unittest broken by new flags handling. 14 years ago
Victor Julien ad827ad030 http: add more decoding unittests. 14 years ago
Victor Julien 4c6fd7ad4c Bug #510. Produce error if max-pending-packets is higher than 65534. 14 years ago
Victor Julien 6841171882 profiling: fix 'match' counter sometimes not incrementing. #460. 14 years ago
Victor Julien f9cde717e7 Use SCFree instead of free in DER decoder. 14 years ago
Victor Julien c44f4c13fc stream: improve TCP flags handling 14 years ago
Eric Leblond 09e709d1c5 af-packet: fix reconnect code 
Reconnect code was in a "work by luck" stage as we did not update
the socket number after reconnect.
 14 years ago
Anoop Saldanha 64fad5b36e Update fast_pattern engine to not use negated content as fast_pattern if we have non-negated content in the sig. 
Noticing a good spike in perf with et_pro ruleset.

Thanks to Will Metcalf for the suggestion.
 14 years ago
Anoop Saldanha fe4c66461f bug #466 - Updated getticks() to serialize execution of rdtsc with cpuid 14 years ago
Anoop Saldanha 41bb3b95f9 bug 508 - List (ack | cwr | ecn) combination to be accepted by our stream engine. 
This isn't a perfect solution.  More like we have patched this for the case we
are in tcp's established state.  The right solution would be to accept states
based on the presence(using operator OR) of certain flags in the tcp header,
rather than list out all possible flag combinations.
 14 years ago
Anoop Saldanha 1c41672f5e invalidate sigs if depth > content_length 14 years ago
Eric Leblond 8ebc625711 tls: fix keyword regular expression 
Space, dash and comma are valid.
 14 years ago
Eric Leblond a369f8c359 af-packet: loop on ring if there is data to read. 
This patch should bring some improvements by looping on the
ring when there is some data available instead of getting back
to the poll. It also fix recovery in case of drops on the ring
because the poll command will not return correctly in this case.
 14 years ago
Eric Leblond 4df509f87a defrag: use IP ID in hash 
This patch fixes the collision issue observed on an intensive network
trafic. When there is fragmentation it is the case for all data
exchanged between two hosts. Thus using a hash func only involving
IP addresses (and protocol) was leading to a collision for all
exchanges between the hosts. At a larger scale, it was resulting in
a packet loss. By using the IP ID instead of the protocol family, we
introduce a real difference between the trackers.
 14 years ago
Victor Julien a5587fec2e flow: remove unused prune-flows option 14 years ago
Anoop Saldanha bf6cd48259 if a sig's set as stream sig only, don't updated it as both stream and pkt sig if offset/depth's present 
bug #495 - update rule analyzer to not warn on offset_depth-tcp_pkt update if sig is stream only

bug #497 - rule_warnings fixed
 14 years ago
Anoop Saldanha b2f589527a Set thread name Suricata-Main for main thread and LiveRuleSwap for live swap thread 14 years ago
Anoop Saldanha a0bce6362e bug 499 - update host os info enum map to use - instead of _ + add new unittests 14 years ago
Anoop Saldanha 7833883a8f bug #496 - don't warn about offset/depth for packet sigs 14 years ago
Victor Julien d8356c5ebd Windows build and other misc fixes. 14 years ago
Eric Leblond a3465fb971 Rename 'worker' running mode to 'workers' 
This patch renamed the 'worker' running mode into 'workers'. Thus,
there is only one name in Suricata for the same thing. Backward
compatibility is ensured by replacing "worker" by "workers" when
the old name is used. A warning is printed in the log when the old
name is used.
 14 years ago
Anoop Saldanha 34f0897163 check if all packets are processed before disabling detect threads + kill all threads <= detect after FFR + other minor fixes 14 years ago
Victor Julien be5fed869d conf api: remove dead code 14 years ago
Victor Julien c2e484ae88 rule analyzer: fix detecting stream match 14 years ago
Anoop Saldanha 946a9ece32 rule analyzer updated for sigs with offset/depth set + alproto set 14 years ago
Anoop Saldanha 960d421f9d Update SigValidate() to allow http keywords to be specified in the right flow direction 14 years ago
Victor Julien 9f3e079bcf Make live reloads optional and disabled by default. 14 years ago
Victor Julien 9d2e17fa98 stream: don't NULL dereference p->flow->protoctx in StreamTcpReassembleDepthReached 14 years ago
Victor Julien 43c7fd7585 file inspection: improve logging when stream.depth limit is reached. #493. 14 years ago
Victor Julien 79d5ef3707 Improve warning if prelude output is selected but support not compiled in. #320. 14 years ago
Victor Julien e7b36051de Improve pktvar keyword parsing and error handling. 14 years ago
Victor Julien 2179ac2595 Minor fixes for coverity issues. 14 years ago
Victor Julien c4e5e1482e Fix detect tag error handling. 14 years ago
Victor Julien d840308ae2 file detect: improve cleanup 14 years ago
Victor Julien 4a9fa35cf2 filemd5: free hash during cleanup 14 years ago
Anoop Saldanha b0b29fb85a ac-bs and ac-gfbs mem cleanup 14 years ago
Anoop Saldanha c1cc9188fd more mpm engine mem cleanup 14 years ago
Anoop Saldanha 0eaf0b0129 mpm engine and ac mem free fixes 14 years ago
Nikolay Denev 50aba06530 Fix SCSetThreadName() macros in threads.h Add FreeBSD thread naming implementation. 14 years ago
Anoop Saldanha cde31abe96 bug #455 - Warn users on signature event vars having precedence over threshold.conf ones 14 years ago
Victor Julien ab421978f0 Free all sig match structs when freeing a signature. 14 years ago
Victor Julien f4c7bd4e5b Fix memleak in tag parsing. 14 years ago
Victor Julien af97c36c08 Properly clean signature's ip only data. 14 years ago
Victor Julien c7af0589bc Fix a reload memleak in thread local detection engine ctx. 14 years ago
Victor Julien 19e3348cae Fix a reload memleak in the duplicate sig detection hash. 14 years ago
Victor Julien 728c4f9ea0 Clean up packet pool at shut down. 14 years ago
Anoop Saldanha ba5f757c47 sc_atomic_cas replaced with sc_atomic_set 14 years ago
Victor Julien 0c98980e21 http: add unittest to test \r in header line. 14 years ago
Victor Julien 3d12b74012 http_raw_header: add some debug code. 14 years ago
Victor Julien a6471cdb9c icmpv6: for ICMPv6 info messages set payload ptr and length to right after 4 byte hdr. 14 years ago
Victor Julien 4cf6bb3f4c afpacket: fix compilation in debug mode. 14 years ago
Eric Leblond 0227a87fcb cleaning: fix warning when building with clang. 
clang was issuing some warnings related to unused return in function.
This patch adds some needed error treatment and ignore the rest of the
warnings by adding a cast to void.
 14 years ago
Eric Leblond 6efd37a388 af-packet: use counter for drop and accept 
This patch adds counters for kernel drops and accepts to af-packet
capture module. This information are periodically displayed in
stats.log:
capture.kernel_packets    | RxAFP1                    | 1792
capture.kernel_drops      | RxAFP1                    | 0
The statistic is fetch via a setsockopt call every 255 packets.
 14 years ago
Eric Leblond f2a6fb8a5a af-packet: add support for BPF filter. 
This patch adds support for BPF in AF_PACKET running
mode. The command line syntax is the same as the one
used of PF_RING.
The method is the same too: The pcap_compile__nopcap()
function is used to build the BPF filter. It is then
injected into the kernel with a setsockopt() call. If
the adding of the BPF fail, suricata exit.
 14 years ago
Eric Leblond c85ee1e3f6 af-packet: get datalink for each socket creation. 
This patch will allow us to use the datalink when computing the filter.
It also fixes a potential issue where an interface data type change
after the interface if going down/up.
 14 years ago
Victor Julien 59ec493f7c http body inspection: force body inspection on stream eof. 14 years ago
Victor Julien 2a4992e7a0 inline: fix unified2 alert direction selection 14 years ago
Victor Julien 87ec969b3d filemd5: fix compilation if libnss isn't available 14 years ago
Victor Julien c9e93ec52c filemd5: add support code for md5 handling for signatures. 14 years ago
Victor Julien 8cd460dde5 Don't display a warning when log-pcap tries to remove an already removed file. 14 years ago
Anoop Saldanha 7109a056a5 http header won't inspect set-cookie headers. Set-cookie part of cookie keyword now. Also update the http header inspection engine 14 years ago
Victor Julien 988f22ee2e Free pcre study structs for classification, threshold and reference parsing. 14 years ago
Anoop Saldanha 0c24bbab0c code cleanup for live swap 14 years ago
Victor Julien 452114a859 Fix compiler warning. 14 years ago
Anoop Saldanha 2bc7d0792d update clean up of old detection engine contexts for live rule swap 14 years ago
Anoop Saldanha eee33866df DetectEngineCtxFree() cleanup, also in main 14 years ago
Anoop Saldanha c3eab5cf4e Replace the old atomic sets using cas with the new sc_atomic_set macro 14 years ago
Anoop Saldanha 32183faa82 free flowvar entries in flow after live rule swap. Sync flowbits entries into packet struct to be used by alert debuglog when alert debuglog is enabled 14 years ago
Anoop Saldanha 8fb2040eee disable live rule swap when -s or -S option's used at startup 14 years ago
Anoop Saldanha 31eb5fa2f6 Introduce util-signal.[ch]. Move our signal setup functions here 14 years ago
Victor Julien 4cde2355bd Simplify flow resetting on de_ctx update. Detect ctx id starts at 1. So in a flow 0 means uninitialized (thus set) and if we detect flow is not equal to detect id, we reset the sgh storage and de_state. 14 years ago
Anoop Saldanha 6fa46d7526 If new ruleset requires any htp callbacks that aren't already set, don't load new ruleset; request user to restart suricata + disable setting fileinsepection flags unconditionally in main 14 years ago
Anoop Saldanha e5edcfaca8 add unittest for atomic operation with void * 14 years ago
Anoop Saldanha ecad4a24fa live rule support added 
To reload ruleset during engine runtime, send the USR2 signal to the engine, and the ruleset would be reloaded from the same yaml file supplied at engine startup
 14 years ago
Anoop Saldanha 83a8f6e03a cleanup threshold config de-init 14 years ago
Anoop Saldanha 5e02cb2365 slot_data updated as an atomic var no 14 years ago
Anoop Saldanha 5878d83174 byte_extract_id var now a non-global de_ctx specific var 14 years ago
Anoop Saldanha f4ce9011d2 make mpm ctx container de_ctx specific. Also introduce global variable in mpm_ctx. this is a workaround for cleaning non global mpm_ctx's since we now don't supply the de_ctx around the detection engine API 14 years ago
Anoop Saldanha 7acf5ad38e clean reference config API 14 years ago
Anoop Saldanha 6003c7cb6b clean classification config API 14 years ago
Anoop Saldanha f5af4c9ceb util action api returns error code if it encounters wrong values parsing wrong action conf 14 years ago
Anoop Saldanha f2dd61868d variable names global vars, global no more. Moved to detection engine ctx, a place it belongs 14 years ago
Anoop Saldanha 946100845f fix replace unittets. Re-set modified global_var to orignial value when the test completes 14 years ago
Anoop Saldanha 55d4e9518e Kill engine during init stage if it fails to load valid value for sgh-mpm-context 14 years ago
Anoop Saldanha d7a93b6fcd clear root node during conf de-init. also create root_backup when the root is restored back using it 14 years ago
Victor Julien ab3fcb01f9 http: decode double decoded path and query string characters. Bug #464. 14 years ago
Victor Julien c6cac1ef48 build: Use expanded sysconfdir to pass as CONFIG_DIR to the code. 14 years ago
Victor Julien 108da566bc http: make client and server body inspection more robust in cases where realloc fails 14 years ago
Victor Julien 60c3af9303 detect: Only run mpm on HTTP buffers in the proper direction. Fixes a file_data FN. 14 years ago
Victor Julien 2055b509a3 dcerpc/smb/smb2: more robust error checking, cosmetic code updates. 14 years ago
Anoop Saldanha fc15cc7de1 some more mpm engine cleanup 14 years ago
Anoop Saldanha f9612f3b83 mpm engine cleanup. Remove unnecessary flags 14 years ago
Anoop Saldanha 5bb347106b cookie header now inspects Set-Cookie headers as well 14 years ago
Anoop Saldanha 593b0cb150 unittests that fail, displaying the issue that we don't inspect set-cookie headers against cookie keywords 
The next patch in the series will fix the issue and let the unittests pass as well.
 14 years ago
Victor Julien c0ac64e58c pcap: make sure thread count is 1 if config is missing for a device. 14 years ago
Anoop Saldanha bc6cf43840 #482 - use decode_flag for all decode TMs. Use the flag as a way to retrieve decode TMs from ThreadVars 14 years ago
Anoop Saldanha 0d602d9cde we now support offset, depth inspection against all packet payloads and stream messages 14 years ago
Anoop Saldanha a34f91358d tests to highlight that 
- suricata treates sigs with offset/depth without any packet keywords as stream sigs
- as a consequence suricata will FN on such sigs

The tests introduced here will fail, displaying the issues.  The
next patch in the series would fix the said issues.
 14 years ago
Anoop Saldanha c5cc9d454d stream raw reassembly fix 14 years ago
Anoop Saldanha db8500bb26 fast pattern cleanup - Remove FastPatternSupportEnabledForSigMatchList() and all it's associated structures 14 years ago
Anoop Saldanha 988c92f71c http user agent keyword + mpm + inspection + fast pattern support added 14 years ago
Victor Julien bd3a655aeb Add pcap workers mode. 
Some cards like Napatech or Myricom support libpcap wrappers that allow for
multiple streams, queues, ringbuffers. The workers mode can be of use in
those cases.
 14 years ago
Anoop Saldanha 34fde4ed75 bug #471 - file_data fast pattern unittests added 14 years ago
Anoop Saldanha 90ccbfd80a bug #471 - http server body fast pattern unittests added 14 years ago
Victor Julien 850379552a rule analyzer: minor cleanups. Fix warning-only setting, allow true/yes/enabled for yaml option. 14 years ago
Victor Julien b210bf1290 Fix commandline supplied yaml path being ignored. 14 years ago
Eileen Donlon c81020e9a3 feature 349 rule analyzer v1 14 years ago
Eric Leblond 2d22f667c2 config: use config file in sysconfdir by default. 14 years ago
marcos 8dfddd0a0f Added -T switch to suricata output. 
Simply added the -T to be printed out when suricata is run without any
arguments.  The capability to test a configuration file has been in
suricata for some time, just doesn't show up as an option right now.
 14 years ago
Victor Julien b744708f28 filemd5: implement negated matching. 14 years ago
Victor Julien dbdab0cb1c Disable dce unittests that tick off clamav. #458. 14 years ago
Anoop Saldanha 1f5469fa5a bug #458 - unittest that uses clamav FPing payload disabled for now. Needs to be rewritten though with new payloads 14 years ago
Victor Julien 3df573219b Fix compilation warning. 14 years ago
Victor Julien e3764b90c3 tls: debug compilation fixes, new tls decoder rule for tls.error_message_encountered event. 14 years ago
Anoop Saldanha f08fc8d7c5 ssl connection error message event added. Remove warning log for the same error alert 14 years ago
Anoop Saldanha 270ea253a2 ssl parser fix/updates 14 years ago
Anoop Saldanha edb48c1557 We have a new probing parser to detect sslv2 records. todos to be covered later 14 years ago
Victor Julien fa121a1dd4 filemd5: handle case where no md5 support is compiled it. 14 years ago
Victor Julien 9f7588a756 Add filemd5 keyword that loads a list of md5's to match a file's md5 against. 14 years ago
Victor Julien 8cfc23ee22 Add a new hash datatype to do speedy lookups of read only uniform data, like md5's. 14 years ago
Victor Julien 1bb0199dd7 pfring: protect pfring_set_bpf_filter with a lock as it's not thread safe. 14 years ago
Victor Julien 1906d317ec unified2: minor cleanups 14 years ago
Victor Julien 5e95524122 Improve error reporting in case of syntax errors in the address and port vars. 14 years ago
Victor Julien 5b457807e2 file: fix file length and md5 tracking when file storing is disabled 14 years ago
Victor Julien 086a934ca9 #449: fix md5 calculation in daemon mode. 14 years ago
Victor Julien 94c312512d pfring: move missing timestamp handling code to PfringProcessPacket. 14 years ago
Chris Wakelin a5f948f436 Fix missing timestamps in some flavours of PF_RING 14 years ago
Victor Julien f2f8dfd8d6 http: add test to make sure a missing space between header name and value is not a problem (ref #474). 14 years ago
Victor Julien 66856831fa unified2: big rewrite to clean up code that deals with tcp segment logging. 14 years ago
Eric Leblond a0e57f58e5 OpenBSD: introduce SCLocalTime function. 
This function is a wrapper to localtime_r. It is needed to avoid
a compilation warning on OpenBSD. I'm forced to type the function
to a non pointer first parameter. If not we will have to use two
differents functions in OpenBSD where tv->tv_sec is a long
(different from time_t).
 14 years ago
Victor Julien 00948c86d5 Add debug messages to HTTP error/warning handling. 14 years ago
Victor Julien ed3599b3d8 stream: improve error checking. 14 years ago
Victor Julien 5933cee2ff replace: add missing malloc return value check. 14 years ago
Eric Leblond dbf5d79e43 pfring: follow API change 
As pointed out in issue #459, pf_ring API has changed. Since
5.4.0 release pf_ring_open has one less argument.
 14 years ago
Victor Julien 48da3bb48b Make sure all fake packets have datalink type DLT_RAW. Make sure stream end packets set pkt size. 14 years ago
Victor Julien 02e19502c7 unified2: minor cleanups. 14 years ago
Eric Leblond 70b795e20a OpenBSD: don't close std* to avoid problem. 14 years ago
Victor Julien 3181b492f4 pcap: lock pcap_compile and pcap_setfilter calls as they are not thread safe. Fixes issues with bpf filters and multiple interfaces. 14 years ago
Victor Julien e3f66c52ec pcap: fix double free issue with bpf filter and multiple interfaces. 14 years ago
Victor Julien a3cbe2e1c2 alert-debuglog: add size info for stream chunks and fix a typo. 14 years ago
Anoop Saldanha 5f939412af debuglog now uses the new mem buffer API. Improve file ctx locking to just the file write 14 years ago
Victor Julien cae46ab5eb pcre: print filename and line number for JIT warning. 14 years ago
Anoop Saldanha 4689783342 bug #454 - rebase fix. Also use better error code to indicate invalid address var yaml entry 14 years ago
Anoop Saldanha b3660dc5db bug #454 - add unittests for the address/port conf var validation function 14 years ago
Anoop Saldanha 678763c3f4 bug #454 - global check to see if address and port vars are properly configured 14 years ago
Victor Julien ea0d172693 No longer pass StreamMsg to output for alert logging, instead use the same callback code as is used for state alerts. 14 years ago
Victor Julien 88a21456e3 stream: keep segments in memory until we are sure the stream/state is inspected. 14 years ago
Anoop Saldanha 64625675ce set stream_eof flag per stream, only when the stream initiates a close. Fix htp parser to close connection per direction based on this 14 years ago
Victor Julien b976ff228a ipv6: fix an AH header parsing issue. Add decoder event for non-null reserved fields. 14 years ago
Victor Julien 52044bb81b Improve error message for malformed urilen value. 14 years ago
Anoop Saldanha d39b7b72bd Add a nice error message when we exceeded address buffer limit for a rule 14 years ago
Anoop Saldanha 7495f59773 bug #451 fix for parsing address. Increase buffer size 14 years ago
Anoop Saldanha f204b52e10 bug #461 - http header shouldn't match on cookie header 14 years ago
Eric Leblond 59057e542e Openbsd: Fix some warning related to inline usage. 
gcc on OpenBSD does not support C99 inline functions. This patch
modify the build system to handle this. It also change the order
of declaration of some functions to avoid to use them before
declaring them as inline.
 14 years ago
Anoop Saldanha 3df3be0efc bug 418 - update http log to escape backslashes 14 years ago
Anoop Saldanha 5d22194299 fix failing rate filter unittest 14 years ago
Anoop Saldanha 7dec21be4c fix rate filters that reset the sig ctx data and handled action timeouts wrongly 14 years ago
Anoop Saldanha 85db868a83 indentation fix 14 years ago
Anoop Saldanha c34713321a fix rate filter alert suppression. Log error if rate filter has count of 0. Other minor fixes as well 14 years ago
Anoop Saldanha bff2866aed more coverity fixes 14 years ago
Anoop Saldanha 6c5b596ada coverity fixes 14 years ago
Eileen Donlon b22529d6f4 disallow pcre /P/I/U with flow:to_client/from_svr 14 years ago
Eileen Donlon c7807a21b6 disallow http_server_body with flow:to_server 
disallow http_server_body with flow:to_server or from_client
 14 years ago
Eileen Donlon 2c24eb9e76 allow only one flow option in a rule 14 years ago
Eileen Donlon f7879f81e8 disallow file_data with flow:to_server/from_client 14 years ago
Victor Julien 36c83f2651 Minor textual update. 14 years ago
Anoop Saldanha 0da93e84ca bug 454 - Provide better error message when the user supplies a NULL address range 14 years ago
Anoop Saldanha 09ec7ec728 bug 456 fix for byte_extract to have array of the right size to update values with 14 years ago
Anoop Saldanha d2738c851f fix failing fast pattern unittests 14 years ago
Eric Leblond 6784ec536d Fix OpenBSD compilation. 14 years ago
Victor Julien e6dea5c406 Use less queues and threads in nfq autofp mode. 
Moved outputs from their own thread to stream/detect threads.
 15 years ago
Anoop Saldanha 8742e51fb0 fix detection filter unittests to reflect recent fixes 15 years ago
Anoop Saldanha 64a04fc721 code cleanup 15 years ago
Anoop Saldanha b48a686d65 considering the tenths of a seconds in a packet, when calculating thresholds 15 years ago
Anoop Saldanha b899146229 fix detection filter. Had one extra alert than normal previously, now fixed 15 years ago
Anoop Saldanha 493c3db413 fix FNs for flow- only_stream and no_stream options 15 years ago
Anoop Saldanha ad36d55771 code cleanup - indentation fix 15 years ago
Anoop Saldanha 046819e1b8 bug 452 - fix detection bug for sigs that don't have a content but need payload inspection 15 years ago
Anoop Saldanha 608f4fe787 bug 452 - enable http extra callbacks for configs other than the default configs 15 years ago
Anoop Saldanha 225b917e93 remove unused stream ssn flag - STREAMTCP_FLAG_TOSERVER_REASSEMBLY_STARTED 15 years ago
Anoop Saldanha 61d5fe33c9 Free membuffer before clearing enclosing parent instance 15 years ago
Victor Julien 98c30be2db ipv6: improve handling of packets with duplicate (or more) ipv6 extension headers. 15 years ago
Victor Julien d378b76c04 http: body inspection improvement 
Improve http_client_body and file_data performance when request and
response body limits are set to high values.
 15 years ago
Victor Julien 4354434522 Add htp error debug printing. 15 years ago
Victor Julien 9f0447cb38 Flag napatech receive tm as well. 15 years ago
Anoop Saldanha cd4705e699 flag recieve acq tms that previously missed the receive_tm flag 15 years ago
Victor Julien f219841795 Misc buffer API update. 15 years ago
Eileen Donlon 4327aaf68a reject pcre modifiers U with B 15 years ago
Eileen Donlon 195eb42d4e allow only one content to use fast_pattern 15 years ago
Victor Julien 1d59324a68 Add missing space to http.log. 15 years ago
Victor Julien b5a3995904 Fix minor memleak in an start up error condition. 15 years ago
Anoop Saldanha 69ed12fd28 Introduce new buffer API that lets you create and manage a buffer. Update http log to use this as well 15 years ago
Anoop Saldanha 98a8234e0a csum function fixes. Improves alert accuracy. FPs on invalid-csums decoder rules fixed 15 years ago
Anoop Saldanha 46e1145cff minor code cleanup 15 years ago
Anoop Saldanha 37f66e5f46 update handling negative offsets in byte_extract. Also improve validation in byte_extract to not extract values out of the buffer range 15 years ago
Victor Julien 18837dce92 http: improve multipart parsing, skip empty records. 15 years ago
Victor Julien 910eb70660 Fix minor compiler warning. 15 years ago
Victor Julien 79691f675a defrag: don't increment recursion level for reassembled packets. Fixes defragged packets not seeing the same flow. 15 years ago
Jason Ish 90548837e3 Update the ERF file runmodes to support autofp and single. 15 years ago
Jason Ish 1f801d316c Apply changes recommended by Stephen Donnely of Endace: - Skip pad records. - Don't log error on EGAIN, just try again. - Skip over extension headers. - Check we have the full packet (skip partial packets) - Remove obsolete rlen check. Also remove max_pending_packets to process more packets per iteration. 15 years ago
Victor Julien 07945f04ce ipv6: make sure we pass the defragged packet from the ipv6 layer to the decoder. 15 years ago
Victor Julien c682c5f1dd Fix error in proto handling for ipv6 in fast.log. 15 years ago
Victor Julien 4df25ef499 Apply http.log formatting fix by Chris Wakelin. 15 years ago
Victor Julien e874a5a3de Fix error in per packet detection engine profiling. 15 years ago
Victor Julien 3f94b12007 Minor stream optimization. 15 years ago
Victor Julien b9e5202f3c Make fast.log use finer grained locking, move protocol lookup outside of the lock. 15 years ago
Victor Julien b8e741de9e Minor optimizations to unified2 and fast.log. 15 years ago
Victor Julien 3d6b51a8c4 Small compile fix. 15 years ago
Anoop Saldanha b6c0d9e926 update util-print.c to use new print macro 15 years ago
Anoop Saldanha 090d098114 provide generic macro to buffer data using snprintf 15 years ago
Anoop Saldanha 95ea105a15 update util-print.c to use snprintf 15 years ago
Anoop Saldanha 23b64c5c08 restructure http logging to use fine grained locking 15 years ago
Victor Julien 40fcae3aa0 Minor unittest fixes to make Coverity happy. 15 years ago
Victor Julien 5c397e3a53 flow: add missing unlocks for rare error condition at flow shut down. 15 years ago
Victor Julien 31b673718c host: convert use_cnt to a atomic var (like in flow). 15 years ago
Victor Julien a39529db5d ipv6: fix routing header parsing leading to rejection of valid packets. 15 years ago
Victor Julien 374947c354 ipv6: properly deal with packets containing a FH header that has offset 0 and no more frags flag set. 15 years ago
Victor Julien 92e7a7d254 ipv6: fix detection engine using the originals IPv6 header's nxt hdr value instead of the upper layer one. 15 years ago
Victor Julien 073ce64786 Fix parsing of tcp-pkt and tcp-stream sigs, add unittest. 15 years ago
Anoop Saldanha c22755fec5 fix cppcheck analyzer warnings - bug 439 15 years ago
Anoop Saldanha 081b0e05a2 restructure disabling receive threads. Introduce new flag to indicate that threads have finised running 15 years ago
Eric Leblond 91f42b6f41 pcap: fix "work by luck" code. 15 years ago
Eric Leblond d8d9b0983f af_packet: misc improvements. 
Improve block count and only copy snaplen length to avoid overflow.
 15 years ago
Victor Julien 0a80e362aa Fix some minor clang scan-build warnings. 15 years ago
Victor Julien 4ebb6b7fae nfq: switch locking code to macro's to lock profiling can track the exact lock locations. 15 years ago
Victor Julien 06d7fb5428 Fix CUDA build from a release tarball. 15 years ago
Anoop Saldanha fea6a426a5 cleanup killing threads. As a consequence fixes invalid read/writes in tmqh flow 15 years ago
Anoop Saldanha f0e4578640 cleanup junk code in flow qh 15 years ago
Victor Julien bf4ab2f7e1 Fix misc issues picked up by coccinelle. 15 years ago
Anoop Saldanha a8095bd8d6 fix compiler warnings 15 years ago
Victor Julien af4e480163 Fix __WORDSIZE redeclaration warning on Windows builds. 15 years ago
Jason Ish 105173939b Implement single, autofp and workers run modes for DAG interfaces. Includes multiple interface support. 
Remove auto mode due to bad performance.
 15 years ago
Victor Julien 8e064001c3 Fix compilation of atomic api spinlocked fallback code. 15 years ago
Anoop Saldanha b2455b6afa cuda pb tm should be in a thread of its own + pkt_acq should be as free as possible 15 years ago
Anoop Saldanha 2995867328 b2g cuda up, compiling and running 15 years ago
Anoop Saldanha f1863370a5 clean log pcap 15 years ago
Anoop Saldanha 6392202872 restructure log pcap to use a different setup, which is resilient to thread failure/restarts 15 years ago
Anoop Saldanha fd21b83f3e don't return TM failure on failing to remove log file 15 years ago
Anoop Saldanha 4bc907414b init every new pf instance in log pcap 15 years ago
Victor Julien cfd4d07dd0 host: convert host hash to use lookup3.c 15 years ago
Victor Julien c10370907a flow: make flow use lookup3.c hashing algorithm. Improves hash table distribution. 15 years ago
Victor Julien 20c08ca47b hash: add lookup3.c by Bob Jenkins 
Found here:
http://burtleburtle.net/bob/hash/doobs.html
http://burtleburtle.net/bob/c/lookup3.c

From the file header:

lookup3.c, by Bob Jenkins, May 2006, Public Domain.

These are functions for producing 32-bit hashes for hash table lookup.
hashword(), hashlittle(), hashlittle2(), hashbig(), mix(), and final()
are externally useful functions.  Routines to test the hash are included
if SELF_TEST is defined.  You can use this free for any purpose.  It's in
the public domain.  It has no warranty.
 15 years ago
Victor Julien 19a7e7f395 flow: create a flow lock macro API, implement it for mutex and rwlocks. Mutex remains the default. 15 years ago
Xavier Lange fea5e68a7b Include conf_test in special cases for unset RUNMODE 15 years ago
Xavier Lange 1d774dae61 Make conf_test local. Simplify if/else to if. 15 years ago
Xavier Lange 1ae10b9a42 Do not spawn threads for conf test 15 years ago
Xavier Lange eaacc5d0fe Added conf_test flag and behavior 15 years ago
Victor Julien 22349f863b file magic: don't disable inspecting magic for both directions if files in only one direction don't need magic. 15 years ago
Victor Julien f4b542d703 Enforce memcap limit before allocating hash table in host and flow engines. 15 years ago
Victor Julien bd66a4bba9 Fix typo in spm prototype declaration. 15 years ago
Anoop Saldanha 4d192a6881 update all spm algos to use 16 bit pattern lengths. Should compress a lot of tables 15 years ago
Victor Julien 8d1fe9f2fa Make 'autofp' the default runmode. Increase default max-pending-packets to 1024. Move some advanced and uncommonly changed settings down in the stock suricata.yaml. Closes #433. 15 years ago
Eileen Donlon da633d490b fix misleading comment 15 years ago
Eileen Donlon 793478a832 reject rules with invalid hex digits in content 15 years ago
Eileen Donlon f2e85ab9ee reject rules with an invalid ttl range 15 years ago
Victor Julien 4157d9408d Various small flow and host table fixes. 15 years ago
Victor Julien 18e81b7ba9 Bail out early if we're in http tunnel mode. 15 years ago
Victor Julien 0788656ef7 Silence ac-gfbs debug message. 15 years ago
Victor Julien da3c5bf84d Minor error message cleanups 15 years ago
Victor Julien fa22a26366 profiling: fix lock profiling int print issue. 15 years ago
Victor Julien 3b79dac2b7 flow: fix atomic var not being initialized and destroyed. 15 years ago
Victor Julien 60dbd34f93 Fix bug in app layer event handling causing http event rules to fail loading. 15 years ago
Victor Julien 40ed10ab38 Minor flowq updates. 15 years ago
Anoop Saldanha 7115fa3e72 Introduce the address hash based flow q handler 15 years ago
Anoop Saldanha 5ffb050ada Adapt flow tmqh counters to be atomic vars. Remove support for active flows q handler. Introduce SC_ATOMIC_SET 15 years ago
Anoop Saldanha 3faed5fe79 Support freeing flow q handler out ctx. Adapt unittests to use the same 15 years ago
Anoop Saldanha d01589c9d8 neaten flow q handler code 15 years ago
Anoop Saldanha 0fa14292c0 Enable unittests for flow q handler 15 years ago
Anoop Saldanha 4e417b72b5 support flow q handler schedulers active_flows and active_packets. Support new yaml option autofp_scheduler. Support for printing q handler stats as well 15 years ago
Anoop Saldanha e252048900 support for custom flow qhandlers - round robin support added 15 years ago
Pierre Chifflier d866f38982 TLS: add variable to store the error code in the decoder 
Use a variable to store the decoding error code if required, and remove
the calls to SCLogInfo and SCLogDebug.
 15 years ago
Pierre Chifflier 218b5d3ba0 TLS app layer: misc fixes, reorder some fields to same memory 15 years ago
Pierre Chifflier 3df341dbeb Add TLS decode events 15 years ago
Pierre Chifflier 71fa4a5285 TLS: replace SigMatchAppendAppLayer with SigMatchAppendSMToList 15 years ago
Eric Leblond a9bb17e097 tls-handshake: add sanity checks. 15 years ago
Eric Leblond 01c7e5bde6 tls-handshake: Add some missing free in error handling. 
When DecodeAsn1BuildValue function fails, it may be necessary to
do some clean-up in the calling functions.
 15 years ago
Eric Leblond 480db00fd7 tls-handshake: DecodeAsn1BuildValue should return -1 for error 
This patch modifies DecodeAsn1BuildValue to have it return -1 when
there is a too big number of bytes announced in the ASN.1 message.
 15 years ago
Eric Leblond 8f885ce810 TLS parser: add sanity checks on loop 
It was possible in some loop to read data placed after the buffer
resulting in invalid/unpredictable value. This patch fixes two of
this issues.
 15 years ago
Eric Leblond d1c56e810b TLS parser: add sanity check 15 years ago
Eric Leblond cb1a75fc9e TLS parser: modify OCTETSTRING 
This patch does on over allocation of 1 for the OCTETSTRING
to be able to add a 0 at the end. This will then
allow us to use the string in printf.
 15 years ago
Pierre Chifflier 5a65a17f00 TLS parser: add handing of UTF8STRING 
Some certificate contains UTF8STRING which is a subset of
OCTETSTRING. This patch adds support for this type of string.
 15 years ago
Pierre Chifflier 6c2c6cffac TLS keywords: fix match regex (remove extra space) 15 years ago
Pierre Chifflier 8457ce3b11 TLS app layer: rewrite decoder to handle multiple messages in records 
Since we now parse the content of the TLS messages, we need to handle
the case multiple messages are shipped in a single TLS record, and
taking care of the multiple levels of fragmentation (message, record,
and TCP).
Additionally, fix a bug where the parser state was not reset after an
empty record.
 15 years ago
Pierre Chifflier 4bb5e2a79d TLS app layer: fix number of bytes processed on SERVER_CERTIFICATE message. 
Change the function to return the number of bytes processed, and fix a bug
where the input buffer was wrong.

Signed-off-by: Pierre Chifflier <pierre.chifflier@ssi.gouv.fr>
 15 years ago
Eric Leblond 38c213cb84 tls app layer: add missing free 
issuerdn was not freed at exit.
 15 years ago
Eric Leblond fce2437dc2 tls app layer: handle negation on subject and issuerdn. 
This patch adds negation support for tls.subject and tls.issuerdn
matches.
 15 years ago
Eric Leblond ad0e05a112 TLS app layer: Add tls.issuerdn keyword. 15 years ago
Eric Leblond afba81bb27 decode ASN.1: Factorize value reading 
This patch factorizes the reading of integer value and fix some
indentation. By convention, a value of 0xffffffff is returned
if the size of the integer is too big. In this case, the hexadecimal
value (which is also read) must be used.
 15 years ago
Pierre Chifflier 53e5421a24 TLS handshake: get TLS ciphersuite and compression 
Decode the SERVER_HELLO message to extract the ciphersuite and compression
chosen by the server.

Signed-off-by: Pierre Chifflier <pierre.chifflier@ssi.gouv.fr>
 15 years ago
Pierre Chifflier 4be65fd016 TLS handshake: decode the SERVER_CERTIFICATE message 
Add a decoder for the SERVER_CERTIFICATE during a TLS handshake, extracts the
certificates and keep the subject name.
Add the tls.subject keyword for substring match in rules (TLS layer).

Signed-off-by: Pierre Chifflier <pierre.chifflier@ssi.gouv.fr>
 15 years ago
Pierre Chifflier f77fcdb3e8 Add ASN.1 parser for X509 certificates (in DER format) 
Signed-off-by: Pierre Chifflier <pierre.chifflier@ssi.gouv.fr>
 15 years ago
Victor Julien 0b3f6c464a Make list-app-layer-protos option name match the help explanation. Make sure it works w/o passing a config. 15 years ago
Anoop Saldanha 109662450d Add new command line option --list-app-layer-protocols to list supported app layer protocols in sigs 15 years ago
Anoop Saldanha 7511fa67cd Add BUG_ON to avoid overruning AppLayerDetectDirection map array 15 years ago
Eileen Donlon 9376967e65 reject rules with duplicate content modifiers 
reject rules that have multiple depths, offsets, distances, fast_patterns, nocases, or rawbytes for the same content.
 15 years ago
Eileen Donlon 0bb4ff34b8 added null checks for init_hash to all ac mpms 15 years ago
Eileen Donlon 617edf469c reject http_client_body with inconsistent flow dir 
reject http_client_body with flow: to_client or from_server
 15 years ago
Victor Julien feff6f7705 Clean up error message. 15 years ago
Eileen Donlon 85c364da09 disallow-use-of-configuration-file-with-unittests 15 years ago
Victor Julien d908e707d7 profiling: add per lock location profiling 
Add profiling per lock location in the code. Accounts how often a
lock is requested, how often it was contended, the max number of
ticks spent waiting for it, avg number of ticks waiting for it and
the total ticks for that location.

Added a new configure flag --enable-profiling-locks to enable this
feature.
 15 years ago
Victor Julien 41e9dba20b Profile pcap file callback. 15 years ago
Victor Julien ff8755af5c Make sure stream debug code is only used in debug mode. 15 years ago
Victor Julien 9696902b68 Small http.log improvement: bail out early if there is nothing to log. Make output locking more fine grained. 15 years ago
Victor Julien e581ec7dff Fix 2 compilation issues. 15 years ago
Victor Julien c0a2cbd478 Move over src and dst thresholding to use host table. Fix a bug in threshold 'both' handling. 15 years ago
Victor Julien a05df345de Introduce host table, make tag use it 
Add a host table similar to the flow table. A hash using fine grained
locking. Flow manager for now takes care of book keeping / garbage
collecting.

Tag subsystem now uses this for host based tagging instead of the
global tag hash table. Because the latter used a global lock and the
new code uses very fine grained locking this patch should improve
scalability.
 15 years ago
Victor Julien db24258acf Undo changes from 88b8f15663. Atomic stack implementation had a-b-a problem. 15 years ago
Victor Julien 88b8f15663 Add atomic stack implementation. Convert flow spare queue to use this stack. Remove now unused flow-queue code. 15 years ago
Victor Julien 979edf0b97 Add way to profile mutex/spin locks per thread module. 15 years ago
Victor Julien fddaca6e8b Implement stream memcap enforcements using atomics instead of spinlocked counters. 15 years ago
Victor Julien d72b82fae0 Misc fixes. 15 years ago
Victor Julien 8448333bdd Remove trailing zero's from some counters output. 15 years ago
Victor Julien 0150e66ede flow engine: improve scalability 
Major redesign of the flow engine. Remove the flow queues that turned
out to be major choke points when using many threads. Flow manager now
walks the hash table directly. Simplify the way we get a new flow in
case of emergency.
 15 years ago
Victor Julien da5087a0c0 Fix broken unittest. 15 years ago
Eileen Donlon aae7ea5e67 add null checks to fix bugs in StreamTcpTest23 15 years ago
Eileen Donlon 1a46d7a53a fix more invalid content unittests 
fix invalid unittests with mixed relative and non-relative content modifiers and other issues; DetectContentParse19 still contains some failing dce_stub tests which are commented out.
 15 years ago
Eileen Donlon 9b2bd9280a fix invalid unittests with mixed content modifiers 
Fixed some unittests that were incorrectly mixing relative and non-relative content modifiers.
 15 years ago
Eileen Donlon 0bcbd23343 reject mixed relative and non-relative keywords 
reject signatures using relative and non-relative positional keywords for the same content (depth or offset with distance or within)
 15 years ago
Eileen Donlon 0b09416a48 reject invalid combinations of pcre modifiers 
don't allow /B with normalized buffers, and don't mix modifiers for normalized and raw buffers
 15 years ago
Victor Julien 8350fdd9be Do not assume the include dir for nss to be nss. On F16 it's nss3. 15 years ago
Victor Julien 705417434b Fix json output typo. 15 years ago
Victor Julien fe9258f0fb Fix issue discovered by Anoop. Passing u32 ptr to a size_t can caused badness. 15 years ago
Victor Julien 6019ae3dcb Fix minor memleak in case af-packet init fails. 15 years ago
Victor Julien 385f1dcd25 Fix UTHBuildFlow setup using wrong address. 15 years ago
Victor Julien e3935a2af2 Improve http filename parsing. 15 years ago
Victor Julien e237841a8e Fix compilation with profiling enabled. Minor unittest fixes. 15 years ago
Victor Julien de5c1d1491 Fix minor fgetc issue. 15 years ago
Victor Julien 0d6f33a15b Move PACKET_RECYCLE outside of flow lock in FlowForceReassemblyForQ as it confuses static code checkers. 15 years ago
Victor Julien e21d8cdf01 file extract: improve multipart parsing and set events on some error conditions. 15 years ago
Victor Julien bfb3f1b7cf flow: Refactor how FlowPrune deals with forced timeouts, improving locking logic. 15 years ago
Victor Julien 372ab9c433 Another batch of minor fixed for issues found by Coverity. 15 years ago
Victor Julien 11bdf4838f Various improvements to error handling found by Coverity. 15 years ago
Anoop Saldanha d6af843860 code cleanup 15 years ago
Victor Julien cdba2f50d1 Various fixes and improvements based on feedback by Coverity analyzer. 15 years ago
Victor Julien 4b2d94a841 Add line number to warning about mangled yaml parameters. Limit number of warnings to 10. 15 years ago
Nikolay Denev fb05edeeee Convert underscores to dashes in thread affinity type names. 15 years ago
Nikolay Denev 7fce226bb8 Fix some warning message still using underscored config vars. 15 years ago
Nikolay Denev 139768dd58 Do not use underscored config vars internally. 15 years ago
Nikolay Denev 6819ec8b54 Remove the underscored "sguil_base_dir" compatibility option. 15 years ago
Nikolay Denev 32e898f2e3 Convert config entries using underscores to dashes and emit deprecation warnings. 15 years ago
Victor Julien 2197f1a625 file-inspection: split 'file' output module into file-store and file-log. Store stores files. Log logs json records. 15 years ago
Victor Julien 8b1333a277 Add more flow lock assertions to the debug validation code. 15 years ago
Victor Julien 5ba41c7890 Fix locking error in filestore handling. Add debug validate check for asserting a flow is locked. 15 years ago
Victor Julien 28d88746e4 Fix compiler warning and silence complaining unittests. 15 years ago
Victor Julien 860971eca0 Misc afpacket changes. 15 years ago
Victor Julien 8e48a2edfd Fix NULL dereference in PacketPatternSearchWithStreamCtx code. 15 years ago
Eric Leblond 34b3f19465 af-packet: Implement zero copy 
This patch adds support for zero copy to AF_PACKET running mode.
This requires to use the 'worker' mode which is the only one where
the threading architecture is simple enough to permit this without
heavy modification.
 15 years ago
Eric Leblond 3593cb051e decode: add PacketSetData funtion 
This patch adds a function which can be used to set the payload
of a packet when a zero copy mode is used.
 15 years ago
Eric Leblond 49b7b00fcf af-packet: mmap support 
This patch adds mmap support for af-packet. Suricata now makes
use of the ring buffer feature of AF_PACKET if 'use-mmap' variable
is set to yes on an interface.
 15 years ago
Victor Julien 3702a33ae9 file-inspection: support POST requests that do not use multipart. 15 years ago
Victor Julien 64827e3864 file-inspection: use filename= value from Content-Disposition where available to determine the filename in GET requests. 15 years ago
Victor Julien 6585cb89d3 Fix UtilMiscParseSizeStringTest01 unittest on 32 bit. 15 years ago
Anoop Saldanha 35435f3284 All http_http_stat_code modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_STAT_CODE. Also remove dummy match/free functions for stat code and stat msg 15 years ago
Anoop Saldanha 507e1b66e0 All http_http_stat_msg modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_STAT_MSG 15 years ago
Anoop Saldanha 059ee217ff All http_http_raw_uri modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_RAW_URI 15 years ago
Anoop Saldanha b1a0d35106 All http_http_cookie modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_COOKIE 15 years ago
Anoop Saldanha 49bdad9345 All http_http_method modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_METHOD 15 years ago
Anoop Saldanha 97d8fc9cba All http_http_raw_header modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_RAW_HEADER 15 years ago
Anoop Saldanha 97308674ee All http_http_header modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_HEADER 15 years ago
Anoop Saldanha 1acb7cdc7d All http_server_body modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_SERVER_BODY 15 years ago
Anoop Saldanha a5b46e727c All http_client_body modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_CLIENT_BODY 15 years ago
Anoop Saldanha 4810ee9c5f All uricontent modified patterns now are DETECT_CONTENT and not DETECT_URICONTENT. Step towards unifying all content based patterns. Makes way for easier management of patterns 15 years ago
Anoop Saldanha 93d7a6e671 code cleanup. Remove unused functions 15 years ago
Anoop Saldanha eb07c345b8 code cleanup - replace SigMatchAppendThreshold with SigMatchAppendSMToList 15 years ago
Anoop Saldanha dd7e710f35 code cleanup - replace SigMatchAppendPostMatch with SigMatchAppendSMToList 15 years ago
Anoop Saldanha a4638fb0ad code cleanup - replace SigMatchAppendPacket with SigMatchAppendSMToList 15 years ago
Anoop Saldanha ff38d42bf1 code cleanup - replace SigMatchAppendTag with SigMatchAppendSMToList 15 years ago
Anoop Saldanha ac68c3f893 code cleanup - replace SigMatchAppendDcePayload with SigMatchAppendSMToList 15 years ago
Anoop Saldanha 6cab663bf0 code cleanup - replace SigMatchAppendPayload with SigMatchAppendSMToList 15 years ago
Anoop Saldanha c4cb37b8da code cleanup - replace SigMatchAppendUricontent with SigMatchAppendSMToList 15 years ago
Anoop Saldanha c9af50ea0c code cleanup - replace SigMatchAppendAppLayer with SigMatchAppendSMToList 15 years ago
Anoop Saldanha bbb9f35f26 code cleanup - replace SigMatchGetLastSM with SigMatchGetLastSMFromLists 15 years ago
Anoop Saldanha ab35b98f76 code cleanup - remove DetectContentGetLastPattern. Replace it with SigMatchGetLastSMFromLists 15 years ago
Anoop Saldanha d85ab5ab1f code cleanup - remove DetectContentFindNextApplicableSM 15 years ago
Anoop Saldanha 802350f65a code cleanup - remove DetectContentHasPrevSMPattern 15 years ago
Anoop Saldanha 9652c3672d code cleanup - remove SigMatchGetLastPattern 15 years ago
Anoop Saldanha e851804c92 code cleanup - remove DetectUricontentGetLastPattern 15 years ago
Anoop Saldanha dcb2afb02f Use sm_list to differentiate between different content types while retrieving pattern ids instead of sm_type 15 years ago
Anoop Saldanha 83d9439877 DetectPatternGetId() cleanup. Remove separate search element creation for uricontent. We don't need this now since we have unified content structures for content and uricontent 15 years ago
Victor Julien 154af56b45 Add a print function specially for json output that escapes all characters json requires to be escaped. 15 years ago
Victor Julien 740ee3e7ab Add referer header to .meta and json file logs. 15 years ago
Victor Julien 337f7861a4 Make sure that if not built against libnss, we still compile. Only no md5 for you then\! 15 years ago
Victor Julien 6752ccae2a Add line based log file to log-file module that logs each stored file's meta data in json records. 15 years ago
Victor Julien 12e8ce6545 In PrintRawUriFp, consider " unprintable. 15 years ago
Victor Julien 69b3df96fb Initial on the fly MD5 calculation for extracted files using libnss. 15 years ago
Anoop Saldanha 2f7717a1a7 delete detect-recursive.[ch] 15 years ago
Anoop Saldanha e682796d03 feature #414 - support listing supported keywords. Remove support for dummy keywords __address__, __proto__, __port__. Remove support for recursive keyword and all references to it 15 years ago
Anoop Saldanha 603d4a719a remove det_ctx->payload_offset and use det_ctx->buffer_offset. Update hscd and hsmd to use the new generic content inspection engine 15 years ago
Anoop Saldanha d1d5507679 remove all old content inspection engines and references to them. We have cleaned the entire content inspection phase and improved alert accuracy 15 years ago
Anoop Saldanha 35f1f7e8d9 unify payload detection engines + fix other bugs in pcre init 15 years ago
Anoop Saldanha 9287cce674 raw urilen inspection moves to raw uri list. Won't make any difference wrt inspection 15 years ago
Anoop Saldanha 0677190960 rebase commit for hscd and hsmd patches 15 years ago
Anoop Saldanha 22b1f5b22b fix seg fault due to wrong sm list access in hscd 15 years ago
Anoop Saldanha 2e2398147c fast pattern unittests added for http server body 15 years ago
Anoop Saldanha 09313cf9bd Support http stat code detection engine, fast pattern(mpm engine included). Fix http stat code setup function. Fix pcre option for stat msg keyword. With this the pcre options for server_body is Q, for stat_msg is Y and for stat_code is S 15 years ago
Anoop Saldanha 2007c2711c Support http stat msg detection engine, fast pattern(mpm engine included). Fix http stat msg setup function. Fix pcre option for stat msg keyword 15 years ago
Victor Julien 9dc153c8f4 Fix path handling for including rule files on win32. 15 years ago
Victor Julien 489b8b8bcc Allow other yaml files to be included in the main yaml. 15 years ago
Victor Julien adb5d05fb5 Fix a FP with negated filemagic inspection. 15 years ago
Victor Julien 0b9038b971 Add atomics to ticks unittests. 15 years ago
Victor Julien f77c475c85 Minor layout fixes. 15 years ago
Victor Julien e1a309a6b2 Napatech code formatting fixes. 15 years ago
Victor Julien 95a5bebb6a Fix compilation without napatech tech support enabled. 15 years ago
Victor Julien 1d9f6ff8f2 Initial Napatech support by Randy Caldejon / nPulse. 15 years ago
Anoop Saldanha 60553f3753 fix compilation error for the new http response header mpm feature 15 years ago
Anoop Saldanha 716afac5a2 fix debug messages that have references to the old mpm contexts 15 years ago
Anoop Saldanha 9a665e035b code cleanup over last 2 commits 15 years ago
Anoop Saldanha 55c4e419fd if a signature is non-tcp, it's always a packet sig 15 years ago
Anoop Saldanha 419cdc8558 support splitting mpm ctxs based on direction v2 15 years ago
Anoop Saldanha 0a91d824bf Fix bug in ac-bs search function 15 years ago
Anoop Saldanha db859cc56e treate ac-bs auto as single context 15 years ago
Anoop Saldanha 199288309d Support for new MPM ac-bs added 15 years ago
Victor Julien e244934566 Disable unittest that fails without libnet support. 15 years ago
Anoop Saldanha c2d47718c1 bug #411 - fix failing unittest 15 years ago
Anoop Saldanha 6556b4c62b bug #411 - don't modify within/distance at setup time 15 years ago
Anoop Saldanha 37329f85d4 bug #412 - rebase commit. Remove the previous references to SigInitReal() with SigInit() 15 years ago
Anoop Saldanha 3b5d95547d bug #412 - Remove the commented out SigInitReal() 15 years ago
Anoop Saldanha 6cbd3a1046 bug #412 - Unify SigInit() and SigInitReal(). Remove any use of SigInitReal() 15 years ago
Anoop Saldanha acccf3a5a5 Add function declaration for SigInitReal 15 years ago
Anoop Saldanha 88ad3691d1 bug #405 - fix bug where raw uri inspection sigs were not treated as stateful sigs 15 years ago
Anoop Saldanha 0b43f2a5fd Use SigInitReal() instead of SigInit() in raw uri tests. This should show that we have unittests failing, thus highlighting bug 411. The next commit is the fix for this bug 15 years ago
Victor Julien 6aa0ad1c5f Remove unused definitions in pcre code. 15 years ago
Victor Julien bb6f93e675 Fix unittest missing a flow direction in the rule. 15 years ago
Eileen Donlon 39b8cc2f8b fixed relative handling for pcre cookie and method 15 years ago
Eileen Donlon d55fef2d75 Cleaned up some error messages for detect distance and offset. 15 years ago
Victor Julien b16a71020d Make 'make check' happy in a ipproto unittest. 15 years ago
Anoop Saldanha 5b3c8566dd bug #403 - add unittests 15 years ago
Anoop Saldanha a19a249230 Set the packet protocol only if it can parsed without error 15 years ago
Anoop Saldanha 2fa55a86fa Fix csum validation functions to not carry out csum calculation if respective headers are not present 15 years ago
Anoop Saldanha b8997b415c bug #403 - fix setting ip proto for ipv6 packets 15 years ago
Anoop Saldanha 87c2dae010 bug #403 - fix setting ip proto for packets 15 years ago
Victor Julien 18d458870f 1.3 branch has opened 15 years ago
Victor Julien 706b046966 Convert missing coredump config to debug. 15 years ago
Victor Julien 2d9449d060 Make code default for pcre match limit match the suricata.yaml default. 15 years ago
Victor Julien c8c4a76dc6 Move threshold to it's own sig match list. 15 years ago
Victor Julien 0983f1d0a6 Only force a pseudo packet inspection cycle for TCP streams in a state >= established. 15 years ago
Victor Julien eba3cecc5d Fix unified2 records generated based on reassembled stream data. 15 years ago
Victor Julien 93d121bf21 Update app layer events for HTTP now that libhtp has fixes for some response errors. 15 years ago
Victor Julien 87e6be610a Issue warning if libhtp version used is not up to date. 15 years ago
Victor Julien 02e1229565 Enforce flow direction for http_raw_header sigs. Fix unittests that missed the flow direction. 15 years ago
Victor Julien 80fb33c651 Fix libhtp htp_tx_get_response_headers_raw 'detection' for bundled libhtp. 15 years ago
Victor Julien 5fa195ffb3 Allow log-pcap to use both absolute and relative sguil-base-dir settings when in 'sguil' mode. 15 years ago
Victor Julien 4cd2938c68 Fix PathIsAbsolute function not dealing with CYGWIN. Handle absolute paths in logfile api. 15 years ago
Victor Julien 7066a79c10 Register HTTP logger at registration, not thread init. 15 years ago
Victor Julien 146ff9d66e Suppress ac-gfbs debug message being printed at info level. 15 years ago
Victor Julien cd987ae7a5 Threading: do not keep a slots post_pq locked while processing the packets. 15 years ago
Victor Julien e81f94cd83 Fix flowbits sigmatch structure added to the match and post-match list, causing corruption of the prev ptr. This lead to an endless loop condition in the thresholding code. Thanks to Chris Wakelin for reporting the issue. 15 years ago
Victor Julien 39ef24ccc4 Fix pcap -i mode. 15 years ago
Victor Julien ae27333458 Make live worker runmode threads adhere to the 'detect' cpu affinity settings. 15 years ago
Victor Julien e526525f83 Fix pcap -i <ip>. 15 years ago
Victor Julien 35467db151 Indicate that the Suricata version used is a release or a git checkout. 15 years ago
Victor Julien 28e15be526 Clean up default output. Use simpler output format for releases. 15 years ago
Victor Julien ff9fb7e1b5 Assume offloading in use if 1/10th of the packets has a bad checksum. 15 years ago
Victor Julien 9bea84918c Fix checksum offloading auto detection typo: it should be 1/5th instead of 1/10th. 15 years ago
Victor Julien c4b34e6ef7 Fix various minor clang/scan-build warnings. 15 years ago
Victor Julien 791fc2f6ea Adapt signature ordering to new flowbits post-match handling. 15 years ago
Victor Julien 8339ca6d4e Implement post match support for ip-only. 15 years ago
Victor Julien e69c584317 Let timing out flow use pseudo packets also if state is not fully closed. 15 years ago
Victor Julien 6eeab37ab3 Add post-match list, move flowbits set, etc functions to it. Move flowint set, etc functions to it as well. 15 years ago