aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
7,173 Commits
7 Branches
155 Tags
195 MiB
master
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '68d9677eea'
${ noResults }
Commit Graph

7173 Commits (68d9677eea1fce8553223c49e7d808d0deee200c)
 

Author SHA1 Message Date
Justin Viiret c9d0d6f698 mpm: add "auto" default for mpm-algo 
Setting mpm-algo to "auto" will use "hs" if Suricata was built against
Hyperscan, and "ac" otherwise (or "ac-tile" on Tilera platforms).
 9 years ago
Justin Viiret 8c6deecc55 app-layer-detect-proto: use mpm-algo 
Use the matcher configured by the user rather than hard-coding MPM_AC.
 9 years ago
Justin Viiret 88b50d2c34 app-layer-detect-proto: pass mpm_ctx to DestroyCtx 
The MPM DestroyCtx function accepts the MpmCtx, not the ctx pointer
inside it.
 9 years ago
Justin Viiret 31d8d4b0a1 detect-engine: adjust unit tests for hs mpm 
The Hyperscan MPM does match deduplication internally (using
HS_FLAG_SINGLEMATCH) and only returns the number of unique matches,
unlike AC.
 9 years ago
Justin Viiret 68ddcdccde app-layer-smtp: init mpm thread ctx after prepare 
This allows the Hyperscan MPM to correctly allocate scratch.
 9 years ago
Justin Viiret 24a1488591 mpm-hs: make errors from hs_scan() fatal 
Hyperscan will only return an error at scan time if the database or
scratch region are corrupted, which should provoke a fatal error.
 9 years ago
Justin Viiret a765cfde19 mpm-hs,spm-hs: don't call hs_scan() for zero bytes 9 years ago
Aleksey Katargin 2a5f487a16 netmap: close sw ring before hw rings 
Fix issue #1714
 9 years ago
Jason Ish b23d74ac88 tls-json-log: register module as tls-json-log, not dns-json-log 
Fixes issue:
https://redmine.openinfosecfoundation.org/issues/1792
where dns-json-log would not log any data.
 9 years ago
Eric Leblond bfa90a64d5 prscript: fix error handling 
Last result was used as global result.
 9 years ago
Victor Julien 5e7f617b7b isdataat: remove unused code 9 years ago
Arturo Borrero Gonzalez 221cb93024 src/: fix typo: receieved vs received 
Reported by Debian's lintian tool.

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
 9 years ago
Victor Julien ea23b85776 flow worker: set up decoder thread vars 9 years ago
Victor Julien 6286e70555 ac: allow use of 31bits of pid space instead of 16 9 years ago
Victor Julien 1334859379 dns: add support for sshfp records 
Update parser to process the records.

Update json output to log it.
 9 years ago
Victor Julien 1df5acb001 coverity: CID 1362011: Control flow issues (DEADCODE) 9 years ago
Victor Julien 213f041c97 coverity: CID 1362012: Incorrect expression (EVALUATION_ORDER) 9 years ago
Victor Julien 3ffd19bdf5 coverity CID 1362013: Control flow issues (NESTING_INDENT_MISMATCH) 9 years ago
Victor Julien f947539d79 af-packet: CentOS6 build fixes 9 years ago
Eric Leblond 49612128f3 af-packet: use time() instead of GetTime() 
As we only use the second we don't need GetTime() which is slower
and get us milliseconds.
 9 years ago
Eric Leblond 88f5d7d166 af-packet: print errno on mmap error 9 years ago
Eric Leblond ff05fb760b af-packet: fix some typos in yaml 9 years ago
Eric Leblond a40f08a213 af-packet: ask for hardware timestamp 9 years ago
Eric Leblond 8035d83467 af-packet: make mmap options parsing conditional 
Only parse them if mmap is activated.
 9 years ago
Eric Leblond 7fea0ec6f9 af-packet: reset stats at start of capture 
We can loose packets during setup because we are reading nothing.
So it is logical to discard the counter at start of capture to
start from a clean state. This means we don't need to account the
drop at start. But the stats call that will reset the drop counts
will also return and reset the packets count. So we need to know
how many packets we really have. This is in fact the number of
packets coming from the stats call minus the number of discarded
packets and the drop count. All the other packets will have to be
read.
 9 years ago
Eric Leblond 876b356bbe af-packet: use mmap capture by default 
Update the code to use mmap capture by default even in unset in
configuration file. mmap capture is now be turned off by using
explicitely 'use-mmap: no' in configuration.
 9 years ago
Eric Leblond c2d0d93806 af-packet: detect availability of tpacket_v3 
If TPACKET_V3 is not defined then it is not available and we should
not build anything related to tpacket_v3. This will allow us to
activate it dy default and fallback to v2 if not available.
 9 years ago
Eric Leblond f5c2019167 af-packet: add option to use memory locked mmap 9 years ago
Eric Leblond 234aefdff9 af-packet: configurable tpacket_v3 block timeout 
Block timeout defines the maximum filling duration of a block.
 9 years ago
Eric Leblond fa902abedf af-packet: configurable tpacket_v3 block size 
It is used to set the block size in tpacket_v3. It will allow user
to tune the capture depending on his bandwidth.

Default block size value has been updated to a bigger value to
allow more efficient wlak on block.
 9 years ago
Eric Leblond c7bde9dff6 af-packet: put ring setup in a separate function 9 years ago
Eric Leblond 7fa963718f af-packet: pack AFPPeer structure 9 years ago
Eric Leblond 5f84b55d98 af-packet: AFPWalkBlock error handling 
Error handling was not done. The implementation is making the
choice to consider we must detroy the socket in case of parsing
error. The same was done for tpacket_v2.
 9 years ago
Eric Leblond b797fd926c af-packet: continuing cleaning and hole hunting 
Suppress useless fields in AFPThreadVars. This patch also get rid
of bytes counter as it was only used to display a message at exit.
Information on livedev and on packet counters are enough.
 9 years ago
Eric Leblond 9500d12c9f af-packet: cleaning and hole hunting 
Reorder fields in AFPThreadVars and suppress some that were not
used elsewhere than in the initialization.
 9 years ago
Eric Leblond bae1b03cf5 af-packet: tpacket_v3 implementation 
This patch adds a basic implementation of AF_PACKET tpacket v3. It
is basic in the way it is only working for 'workers' runnning mode.
If not in 'workers' mode there is a fallback to tpacket_v2. Feature
is activated via tpacket-v3 option in the af-packet section of
Suricata YAML.
 9 years ago
Eric Leblond d094039600 af-packet: remove useless code 
No need for cooked header in the case of mmap capture.
 9 years ago
Eric Leblond 27adbfa868 af-packet: micro optimization 9 years ago
Eric Leblond 5f400785c8 af-packet: avoid test for each packet 9 years ago
Justin Viiret f77bc5195c spm: handle null ptrs in destroy funcs gracefully 
This will handle minimal DetectEngineCtx structures (used in delayed
detect mode) safely, since they don't get SPM global contexts allocated.

Also added BUG_ON checks for valid spm_table entries.
 9 years ago
Victor Julien e43ce0a9ec file: switch to streaming buffer API 
Make the file storage use the streaming buffer API.

As the individual file chunks were not needed by themselves, this
approach uses a chunkless implementation.
 9 years ago
Victor Julien e836a750c8 http: improve body inspection 
Enforce inspect window also in IDS mode. Try always to get at least
'inspect win' worth of data. In case there is more new data, take
some of the old data as well to make sure there is always some overlap.

This unifies IDS and IPS modes, the only difference left is the start
of inspection. IDS waits until min_size is available, IPS starts right
away.
 9 years ago
Victor Julien feafc838db http: make htpstate cfg ptr const 9 years ago
Victor Julien 24a2f51569 http: move body settings into per dir struct 9 years ago
Victor Julien 6fb808fc1a http: add per direction config for body parsing 
The HTPCfgDir structure is meant to contain config for per direction
body parsing parameters.

This patch stores the streaming API config.
 9 years ago
Victor Julien 46e55f1e34 http body handling: use streaming buffer API 
Convert HTTP body handling to use the Streaming Buffer API. This means
the HtpBodyChunks no longer maintain their own data segments, but
instead add their data to the StreamingBuffer instance in the HtpBody
structure.

In case the HtpBodyChunk needs to access it's data it can do so still
through the Streaming Buffer API.

Updates & simplifies the various users of the reassembled bodies:
multipart parsing and the detection engine.
 9 years ago
Victor Julien 81b2984c4e streaming: buffer API 
Add a new API to store data from streaming sources, like HTTP body
processing or TCP data.

Currently most of the code uses a pattern of list of data chunks
(e.g. TcpSegment) that is reassembled into a large buffer on-demand.

The Streaming Buffer API changes the logic to store the data in
reassembled form from the start, with the segments/chunks pointing
to the reassembled data.

The main buffer storing the data slides forward, automatically or
manually. The *NoTrack calls allows for a segmentless mode of
operation.

This approach has two main advantages:

1. accessing the reassembled data is virtually cost-free
2. reduction of allocations and memory management
 9 years ago
Victor Julien 78ecfe8780 autofp: update queue handlers 
Now that the flow lookup is done in the worker threads the flow
queue handlers running after the capture thread(s) no longer have
access to the flow. This limits the options of how flow balancing
can be done.

This patch removes all code that is now useless. The only 2 methods
that still make sense are 'hash' and 'ippair'.
 9 years ago
Victor Julien 61ce05e7ed flow: remove dead code 9 years ago
Victor Julien 52d500c670 flowworker: initial support 
Initial version of the 'FlowWorker' thread module. This module
combines Flow handling, TCP handling, App layer handling and
Detection in a single module. It does all flow related processing
under a single flow lock.
 9 years ago