1246 Commits (6b49a903534e27d7c76693f670c2c4070ff30da7)

 

All Branches   

Search

Author	SHA1	Message	Date
Gurvinder Singh	6b49a90353	added support for setting up bytejump relative when previous keyword is byte_jump (bug 165)	15 years ago
Victor Julien	70b32f7380	First stab at creating a stateful detection engine. ... Stateful detection for app layer detection keywords, except uricontent. Stores it's partial results in the flow structure. Other modifications: - Generalize transaction tracking, logging and inspection. - Adapt http and dcerpc to use the new transaction handling. - Stream engine now always notifies app layer of a stream eof. This commit fixes bug #124.	15 years ago
Jason Ish	18e5ac8cde	Basic rule profiling even though the results may be skewed by a bad rule in a grouping of rules.	15 years ago
William Metcalf	b629b7c5c1	only show cli opts via help that we have support for	15 years ago
Victor Julien	42eeb84c9a	Properly lock flow before setting IP only action flags. Small alert api cleanups.	15 years ago
Pablo Rincon	9bae6a8628	Moving alert logic to detect-engine-alert.c	15 years ago
Victor Julien	692eb935ea	Fix updated memory api using debug mode by default. Small cleanups.	15 years ago
Gerardo Iglesias Galvan	9f4fae5b1a	Fix inconsistent use of dynamic memory allocation	15 years ago
William Metcalf	c6bf08eec8	Updates to the fuzzer script. Some clean up but you can now also: 1. Keep log files. 2. Exclude files based on user supplied regex.	15 years ago
William Metcalf	c69c9c3f86	Added an install doc for PF_RING to doc/INSTALL.PF_RING	15 years ago
Victor Julien	a8dd484aba	Fix small potential bug in debug mode found by clang.	15 years ago
William Metcalf	8d66323f62	clang fixes for null derefrences	15 years ago
Gurvinder Singh	32a2658233	support setting up byte_test/relative when byte_jumo is previous keyword	15 years ago
Gurvinder Singh	9378bdbad4	set the byte_jum/byte_test with relative keyword when pcre is previous keyword (bug 142)	15 years ago
Gurvinder Singh	ea3165b198	support setting up within keyword when previous keyword is pcre (bug 145) and added unit test for the same	15 years ago
Gurvinder Singh	07e10681d6	fixed a typo in the detect-content.h	15 years ago
Gurvinder Singh	2ea8205063	fixed the flags checking and make it more strict in default case (bug 153)	15 years ago
Victor Julien	bb685751d9	Fix NFQ receive/verdict race condition in cases where the packetpool is empty.	15 years ago
Victor Julien	647b1c0eba	Fix NFQ compilation.	15 years ago
Victor Julien	f4812586de	Fix broken ICMPv4 unittests. Fixes #161.	15 years ago
Victor Julien	ecf5a8fbcc	Fix broken stream unittest.	15 years ago
Victor Julien	76d62778c3	Use bigger stream msg.	15 years ago
Victor Julien	61099cd725	Fix compilation if debug is disabled.	15 years ago
Victor Julien	e741bd0202	Cleanup packet recycling code. Fix issues in the packet tunnel/pseudo code.	15 years ago
Victor Julien	e1a8c8f76c	Switch time api from mutex to spinlock.	15 years ago
Victor Julien	19584d0416	Fix tunneled and defrag reassembled packets with the new pending limits.	15 years ago
Victor Julien	ccf22cf563	Move to different way of enforcing max_pending. Should require less locks.	15 years ago
Victor Julien	42c4b5d53c	Use one less thread in pcap file mode. Reduces locking overhead.	15 years ago
Victor Julien	53b388b669	Improve flow hash debugging, switch to csv output.	15 years ago
Victor Julien	548a3b2c93	Improve flow hash debugging functions. Make sure ICMP errors don't create flows. Handle ICMP DEST UNREACH errors in the flow they are sending the error about.	15 years ago
Victor Julien	2dc5405d3a	Add debug code for tracking flow hash distribution. Only add ICMP DEST_UNREACH packets to the flow engine.	15 years ago
Gurvinder Singh	a4625bd333	fixed setting up byte_test relative when byte_jump is previous keyword (bug 146)	15 years ago
Gurvinder Singh	b05762a575	added unit test for the bug 144 to test isdataat setup	15 years ago
Gurvinder Singh	fdc3f728af	set the isdataat keyword when previous sigmatch is either content or pcre (bug 144)	15 years ago
Victor Julien	8dceb2784e	Small ICMPV6PayloadTest01 unittest cleanup.	15 years ago
Gurvinder Singh	9a2bcb6a3c	added unittest to check the payload setup, which causes the segv in detection module	15 years ago
Gurvinder Singh	21a89e22de	fixed the segv caused by null payload due to incorrect icmpv6 decoding	15 years ago
Victor Julien	0ebf7cbc5e	Convert flow bucket lock from mutex to spinlock. Locks should be very short, so spinlocks should be faster.	15 years ago
Victor Julien	e27cefa6f7	Complete conversion of pattern id mpm storage vs sig id storage.	15 years ago
Victor Julien	46831e0f8f	Fix signature grouping bug for protocols without ports. Add debugging code.	15 years ago
Victor Julien	7a427ec7f4	Switch to pattern id based results checking in the mpm. Move app layer proto detection towards a more signature based approach.	15 years ago
William Metcalf	41172f0024	increment packet count before assigning value, tshark/wireshark starts with pkt no 1 so should we	15 years ago
Pablo Rincon	46187bfe73	Fix action logic after last pass changes	15 years ago
Gurvinder Singh	2db6756048	added unit test for the icmp dsize (bug 151)	15 years ago
Gurvinder Singh	ad9ec4dbe9	fixed the payload_len for icmpv6 (bug 151)	15 years ago
Gurvinder Singh	3721037de5	unittests for bug 134&139 and some typo correction	15 years ago
Victor Julien	52cdfb332e	Fix a compiler warning, add some comments, cleanup layout of smb parser.	15 years ago
root	73c6fb16ba	Return 0 instead of -1 when SMB and DCERPC encounter non fatal errors to clean up errors emitted in AppLayerParse.	15 years ago
William Metcalf	7d63fbdaea	small CentOS 4 workarounds	15 years ago
William Metcalf	5fb405335e	Small wrapper fixes to allow for windows compilation	15 years ago