1925 Commits (6fceeda8c5d978aa5cad695ef37c2d1b1c93cfc7)

Author	SHA1	Message	Date
Eric Leblond	9beebf621a	Add support for 'nfq_set_mark' keyword ... This patch introduces 'nfq_set_mark' which is new rules option. If a packet matches a rule using nfq_set_mark in NFQ mode, it is marked with the mark/mask specified in the option during the verdict. It is thus possible to trigger different behaviour on the packet inside Linux/Netfilter.	16 years ago
Victor Julien	f90a5cfffd	Misc pcap logging cleanups.	16 years ago
William Metcalf	023a0f94a2	first stab at pcap logging no rotating buff etc	16 years ago
Anoop Saldanha	1f7e4bada1	add tls.no_reassemble use for sslv2 which we missed previously. Also some cleanup	16 years ago
Victor Julien	71d0eabdec	Add a few extra safety checks in new SSL code.	16 years ago
Anoop Saldanha	c105a739e9	support for ssl_state keyword added	16 years ago
Anoop Saldanha	013d3aea1c	update ssl parser test. Some minor indentation changes	16 years ago
Anoop Saldanha	7a2046328c	some naming changes in ssl parser and ssl related keywords	16 years ago
Anoop Saldanha	4c570777c4	delete files app-layer-tls.[ch]	16 years ago
Anoop Saldanha	b639718787	replace the contents of app-layer-ssl.[ch] with the contents from app-layer-tls.[ch]	16 years ago
Anoop Saldanha	cacf0a9017	disabled sslv23 proto detection which we enabled previously. Although this is right, need to test a couple of things	16 years ago
Anoop Saldanha	4e8de99dcd	tls/ssl parser modifications/fixes. We now have just one file doing all the ssl parsing stuff, i.e. app-layer-tls.[ch], instead of app-layer-ssl.[ch] and app-layer-tls.[ch]	16 years ago
Anoop Saldanha	8b17275451	dcerpc parser todo update	16 years ago
Anoop Saldanha	8c6d4531ee	sslv23 support with ssl2 record format with version set to 3.0	16 years ago
Victor Julien	07a85427dd	Add --build-info command line option to output some basic build settings.	16 years ago
Victor Julien	174db08567	Force reassembly of unack'd data on receiving a valid RST packet.	16 years ago
Victor Julien	b9429ecec1	Fix invalid RST considered valid due to wrong returns codes. Only validate ACK from a RST packet if an ACK value was set.	16 years ago
Victor Julien	cb67d61ab5	Fix broken setup of end of stream pseudo packet.	16 years ago
Victor Julien	99fca03810	Move unittest code into UNITTESTS ifdefs in the HTP parser. Fixes a compiler warning.	16 years ago
Victor Julien	0dc6333d22	Fix compiler warnings about unused IPv6 Address code.	16 years ago
Victor Julien	b9fd978253	Fix compiler warnings in two unittests.	16 years ago
Victor Julien	a3be22cd5a	Fix compiler warning in isdataat keyword setup code.	16 years ago
Victor Julien	bbe071252b	Make sure PID is logged as well in alert-syslog output.	16 years ago
Victor Julien	da423a59d5	Allow users of the alert-syslog to set the identity.	16 years ago
Victor Julien	07776c113b	Fix valgrind error on pfring_recv, rename threads from RecvPfring to RxPfring so the name still looks right for 100+ threads. Add --pfring commandline option that just enables pfring, then takes interface from config.	16 years ago
Victor Julien	3aeb86d836	Fix header_len in GRE decoder getting out of control in some cases.	16 years ago
Victor Julien	1c9e48ae98	Fix compilation error on non-pfring systems.	16 years ago
Victor Julien	91f28afef4	Add option to PF_RING to have multiple reader threads. Improve general performance of the PF_RING module.	16 years ago
Victor Julien	edeec290f6	Fix missing rename for request-body-limit to request_body_limit.	16 years ago
Eric Leblond	3b3a8ffb94	detect-gid: suppress unused type ... The DetectGidData type is not used in the code. This patch removes the type definition from code.	16 years ago
Eric Leblond	ad44f1cfc1	fix possible typo in strtoul error handling.	16 years ago
Eric Leblond	04f2afa81b	nfq: fix exit function ... Exit function was trying to close the nfq handler even if it was null. This was causing a crash.	16 years ago
Eric Leblond	277a384af7	Use already defined macro instead of integer ... Code was using a integer instead of the already defined macro.	16 years ago
Pablo Rincon	ce3b76a102	Fix compilation on Mac OS X (it was missing IPPROTO_SCTP definition)	16 years ago
Victor Julien	153f9298e7	Fix priority handling during the signature parsing stage. Fixes #275.	16 years ago
Gurvinder Singh	27f67c97de	log error on duplicate sig and also for dup sig with newer revision	16 years ago
Victor Julien	8a390971e7	Print [drop] as well for syslog output.	16 years ago
Victor Julien	0377ae0817	Reduce SCTP_HEADER_LEN to reflect actual pkt header size.	16 years ago
Eric Leblond	005dc599a6	detect.c: Fix usage of integer standing for protocol ... This patch fixes direct usage of integer to code protocol value.	16 years ago
Eric Leblond	2c80f18dc9	detect: Add sctp detection and parsing. ... This patch adds the support of SCTP in signature subsystem.	16 years ago
Eric Leblond	674b0bfae7	flow: Add basic SCTP support ... This patch adds a basic flow support to SCTP. SCTP specificities like the verification tag are not taken into account.	16 years ago
Eric Leblond	01e955bc27	Add SCTP to packet validation ... Validation util was missing a test on sctph which can not be null for SCTP packets.	16 years ago
Eric Leblond	a823160384	detect: Add support for sctp option in rule ... 'sctp' can now be used as a keyword in signature. It is at the same level as the 'tcp' or 'udp' keywords.	16 years ago
Eric Leblond	482991ad6d	decode: add support for SCTP protocol ... This patch adds a new counter for SCTP and defines some macros needed for SCTP support.	16 years ago
Eric Leblond	8be92fdd99	SCTP support: add parsing of sctp ... This patch adds support of SCTP in all part of the code in charge of decoding packets.	16 years ago
Eric Leblond	e1d966eaf6	Makefile: add sctp files to build ... This patch simply adds decode-sctp files to the compilation.	16 years ago
Eric Leblond	b69fd02284	decode sctp: basic SCTP decoding. ... This files are basically a dummy conversion of UDP one. It provides basic decoding (source port and destination port). There is no chunk hanldling which means that suricata regexp will match on all packet content except initial header and not only on userspace data.	16 years ago
Eric Leblond	17af1ca123	decode-event: Add SCTP event ... Almost empty now, because the only definition is packet too small.	16 years ago
Victor Julien	987ce57a02	Wrap a number of BUG_ON's in the detection engine in DEBUG ifdefs as the conditions they check for are not serious enough to abort the engine.	16 years ago
Victor Julien	a3303fcf9d	Rename request-body-limit to request_body_limit to remain consistant with other options. Keep old notation around for compatibility.	16 years ago
Victor Julien	0d6d0ae371	Increase logline max length.	16 years ago
Victor Julien	6047a9b562	Improve byte to numeric value error reporting and testing.	16 years ago
Victor Julien	b233105cc2	Fix a issue in stream reassembly causing the segment list getting into a inconsistent state.	16 years ago
Eric Leblond	4e9231266a	Compilation fix for OpenBSD and win32. ... This patch fixes compilation on OpenBSD platform. It is running fine on a pcap file. The patch should also fix compilation on WIN32 platform but this is not tested.	16 years ago
Victor Julien	a8db8b334b	Remove debug stream testing code from non-debug builds.	16 years ago
Victor Julien	477bc1d050	Set DROP flag on a packet in addition to the REJECT flags. This makes sure we not only send a reject, but also drop the offending packet. Closes #248.	16 years ago
Pablo Rincon	fb5fb3ab3f	IPOnly module fix for building stage. Radix Tree fix inserting diferent netmask user datas	16 years ago
Pablo Rincon	35c168ab03	Fix CPU_* macros for Mac OS X	16 years ago
Eric Leblond	0cf05856d0	Fix Packet usage. ... This patch suppresses remaining direct access to pkt and pktlen in the Packet structure.	16 years ago
Victor Julien	cec7ece697	Don't print drop log on pseudo packet.	16 years ago
Victor Julien	1ace091bd4	Minor drop log cleanups.	16 years ago
Gurvinder Singh	7d0781b349	added support to log dropped packet as netfilter logs while in inline mode	16 years ago
Victor Julien	1681705e62	Don't print errors/warnings based on malformed traffic.	16 years ago
Anoop Saldanha	9845718138	fix detect-ssl-version.c unittests to accomodate new changes	16 years ago
Anoop Saldanha	95f9f2c28d	minor indentation changes	16 years ago
Gurvinder Singh	8f8b1212af	support for ssl_version keyword	16 years ago
Eric Leblond	a8417377e7	Don't use direct pkt access ... pkt field in Packet needs to be accessed via macro. This patch supress some direct access.	16 years ago
Victor Julien	addab7b5ee	Don't test the several packet detection checks against pseudo packets as the matches would not be meaningful anyway. Prevents a segv in the csum detection.	16 years ago
Victor Julien	a2465ffc1c	Fix FreeBSD's compilation of the new affinity code.	16 years ago
Victor Julien	b963890de1	Reenable SSE3 memcmp and switch AC memcmp to use the SCMemcmp wrapper.	16 years ago
Victor Julien	6f58ef13c4	Improve error cleanup in output function. Thanks to iswalker.	16 years ago
Eric Leblond	183af9ada5	Replace malloc by SCMalloc in util-mpm-ac	16 years ago
Eric Leblond	c732351077	Replace free and malloc by SC functions.	16 years ago
Victor Julien	35b938a8db	Don't pass config to unittests run in make check.	16 years ago
Eric Leblond	0044bb221b	Add suricata unittests to 'make check' ... This patch adds a run of suricata's unittests to 'make check'	16 years ago
Eric Leblond	66a15e2d6d	Fix some Packet initialisation. ... This patch fixes Packet initialisation. In some place the pkt field was not set after a memset used to zero the structure and this could lead to some problems.	16 years ago
Anoop Saldanha	8e95884333	Use normal memcmp in ac. Improves perf	16 years ago
Martin Beyer	66d496c255	Added case sensitive unit test to util-mpm-ac	16 years ago
Anoop Saldanha	79b9eba0f0	fix case sensitive bug in ac	16 years ago
Victor Julien	1c7b7a01a6	Add option to set the syslog level for the alerts. Minor cleanups.	16 years ago
Gurvinder Singh	e5edc6e8e3	add the support to log the fast.log alerts type to syslog	16 years ago
Victor Julien	d424ac7c61	Fix nfq lockup due to improper handling of PKT_PSEUDO_STREAM_END packets.	16 years ago
Victor Julien	c9f9e3f9a4	Add configure check for signed or unsigned nfq_get_payload, adapt code.	16 years ago
Eric Leblond	aedb61b7d2	affinity: lock get next cpu function ... The function getting next CPU to use need to be locked as init of the threads are done concurrently.	16 years ago
Eric Leblond	0b5e5b8772	affinity: change config format and misc fixes ... This patch fixes some problem with affinity work and modify the configuration file format. For example, the detect cup set can be formatted as follow: - detect_cpu_set: cpu: [ "all" ] mode: "exclusive" # run detect threads in these cpus prio: low: [ 0 ] # threads on CPU 0 have low prio medium: [ "1-2" ] # threads on CPU 1 and 2 have medium prio high: [ 3 ] # threads on CPU 3 have high prio default: "medium" #default priority is "medium"	16 years ago
Eric Leblond	c74116949c	source-nfq: improve nfq option system ... This patch modifies the NFQ option system to avoid implicit choice. 'nfq.mode' is now a string which can take a value in the 'accept', 'repeat' and 'route' set. Signed-off-by: Eric Leblond <eric@regit.org>	16 years ago
Eric Leblond	94596ff282	source-nfq: add queue redirect support ... This patch adds the support of queue redirect. If 'next_queue' variable is set, the verdict sent to kernel is modified to contain the indication of a queue number (equal to 'next_queue') which will receive the packet after the verdict. This feature can be used to chain easily tools using NFQUEUE. Signed-off-by: Eric Leblond <eric@regit.org>	16 years ago
Eric Leblond	aded7b4fae	source-nfq: add detection of already treated packet. ... This patch adds detection of already treated packet. If a packet is coming with an already set mark, it will be accepted and the processing of the packet is aborted. The patch display a message when the problem occurs but the number of message is limited to a fix counter in a way to avoid flooding the log. Signed-off-by: Eric Leblond <eric@regit.org>	16 years ago
Eric Leblond	e399e74fc1	source-nfq: Factorize buffer usage ... A big sized buffer was allocated at each packet parsing. This patch uses a per-thread variable to have a persistent memory usage. Signed-off-by: Eric Leblond <eric@regit.org>	16 years ago
Eric Leblond	1e600c1054	source-nfq: add simulated non-terminal NFQUEUE verdict ... This patch adds a new mode for NFQ inline mode. The idea is to simulate a non final NFQUEUE rules. This permit to do send all needed packets to suricata via a simple FORWARD rule: iptables -I FORWARD -m mark ! --mark $MARK/$MASK -j NFQUEUE And below, we have a standard filtering ruleset. To do so, suricata issues a NF_REPEAT instead of a NF_ACCEPT verdict and put a mark ($MARK) with respect to a mask ($MASK) on the handled packet. NF_REPEAT verdict has for effect to have the packet reinjected at start of the hook after the verdict. As it has been marked by suricata during the verdict it will not rematch the initial rules and make his way to the following classical ruleset. Mode, mark and mask can be configured via suricata.yaml file with the following syntax: nfq: repeat_mode: (false|true) mark: $MARK mask: $MASK Default is false to preserve backward compatibility. Signed-off-by: Eric Leblond <eric@regit.org>	16 years ago
Eric Leblond	72ec56ab23	source-nfq: autodetection of queue max length function ... Signed-off-by: Eric Leblond <eric@regit.org>	16 years ago
Eric Leblond	8330747234	Add multi queue support to NFQ run mode ... This patch adds support for multiple Netfilter queue in the NFQ run mode. Suricata can now be started on multiple queue by using a comma separated list of queue identifier on the command line. The following syntax: suricata -q 0 -q 1 -c /opt/suricata/etc/suricata.yaml will start a suricata listening to Netfilter queue 0 and 1. Signed-off-by: Eric Leblond <eric@regit.org>	16 years ago
Eric Leblond	1375e90030	Prepare multi queue support in NFQ ... This patch prepare support for multiqueue in the source file. The NFQ vars contained in Packet structure has a new member. It is a reference to the NFQ thread var it comes from. The behaviour is modified as a single verdict thread treat packet for all Netfilter queues. Locking is done in the verdict function to ensure that simultaneous modifications of counters can not occur. Signed-off-by: Eric Leblond <eric@regit.org>	16 years ago
Eric Leblond	d0faa6c96e	Fix some spacing. ... This trivial patch fixes some indentation problems. Signed-off-by: Eric Leblond <eric@regit.org>	16 years ago
Eric Leblond	88fb3a641e	Delete some commented code in runmodes ... This patch simply suppress some commented code in runmodes.c. Signed-off-by: Eric Leblond <eric@regit.org>	16 years ago
Eric Leblond	f9e453e14c	affinity: Use configured 'threads' value if set ... This patch modifies runmodes to make them use the new 'threads' variable. Signed-off-by: Eric Leblond <eric@regit.org>	16 years ago
Eric Leblond	fb3641982f	affinity: 'threads' param to configure threads number ... This patch adds a new parameter the affinity. The 'threads' keyword is used to set the number of threads to start for a family. It can only be used on family where multiple thread are laucnh in the running mode. This is mainly the case of the detect threads. Signed-off-by: Eric Leblond <eric@regit.org>	16 years ago
Eric Leblond	789d46cc3c	Add per-cpu prio handling ... This patch updates affinity setting to add a support for per cpu priority setting. In exclusive mode a thread is dedicated to a CPU. This patch adds the ability to set the thread prio for all threads of a family running on a given CPU. With this patch we can write - detect_cpu_set: cpu: [ "all" ] mode: "exclusive" # run detect threads in these cpus low_prio: [ 0 ] medium_prio: [ "1-2" ] high_prio: [ 3 ] With this configuration, detect threads assigned to cpu 0 will have a low priority. Detect threads on cpus 1 and 2 will have prio medium... The previous configuration is equivalent to: - detect_cpu_set: cpu: [ "all" ] mode: "exclusive" # run detect threads in these cpus low_prio: [ 0 ] high_prio: [ 3 ] prio: "medium" because the prio value is used a default. Signed-off-by: Eric Leblond <eric@regit.org>	16 years ago
Eric Leblond	a11e40dedf	Pcapfile mode: support for cpu affinity settings ... This patch adds support for cpu affinity setting in the pcapfile runmode. Signed-off-by: Eric Leblond <eric@regit.org>	16 years ago
Eric Leblond	9d5f08e0d9	Pcap mode: use CPU affinity setting ... This patch adds support for CPU affinity settings in pcap mode. Signed-off-by: Eric Leblond <eric@regit.org>	16 years ago