2371 Commits (818656524003c4501401709aecffb19c28ca588c)

Author	SHA1	Message	Date
Victor Julien	bfff14aa78	Improve error detection in the port and address parsing in signatures. Bug #295.	14 years ago
Anoop Saldanha	ba6bada155	change rev field in Signature to u32 and use strotoul to extract the value. Cleanup some dead code/comments	14 years ago
Anoop Saldanha	ed3b44b3b5	fix parsing content keywords. We are more strict now. All content keywords need to be enclosed in double quotes. Better validation for sid, priority and rev keywords	14 years ago
Victor Julien	18da4a8b73	Add missing cuda header file causing 'make distcheck' to fail.	14 years ago
Victor Julien	c0bc83458c	Bump version to 1.1beta3.	14 years ago
Eric Leblond	89c38b0ced	prelude: fix compilation ... PrintInet was used without inclusion of 'util-print.h'. This was causing a compilation failure.	14 years ago
Victor Julien	39edb23ac4	Support stream.inline mode in unified2 tcp segments logging.	14 years ago
Victor Julien	2e2e80b812	Add packet alert flag to indicate a match happened (partly) in the app layer state. Make unified2 use this flag.	14 years ago
Eric Leblond	128261cb97	unified2: Fix event_id computation ... This patch fixes event_id computation which was not incremented for each alert.	14 years ago
Eric Leblond	b3023643ec	unified2: fix multiple alerts case	14 years ago
Eric Leblond	7fd1e9cacc	unified2: synchronize IPv4 and IPv6 code ... IPv6 code was missing some points.	14 years ago
Eric Leblond	839b0d9bfe	unified2: switch to event->packet->packet mode. ... Attach multiple packets to an event instead of using one event data per packet. This is currrently unsupported by reporting frontend but at least we don't have multiple alerts.	14 years ago
Eric Leblond	316f2d7289	unified2: segment callback log raw packet. ... As we don't have any trustable information about the ethernet header, we can simply log RAW packet to avoid to confuse the analyst.	14 years ago
Eric Leblond	a03a402b83	unified2: set datalink to correct value. ... The value of datalink could have been modified if the logging of segment was attempted. This patch restore it to a correct value.	14 years ago
Eric Leblond	50ddd2df43	Restore old barnyard2 support. ... Some old version of barnyard2 were needing a workaround in the packet header building. THis patch introduces a enable-old-barnyard2 configure flag which can be used to restore this behaviour.	14 years ago
Eric Leblond	2f24987f15	unified2: improve packet logging logic. ... This patch improves packet logging logic and fix some place regarding alert generation (event_id, ethernet header).	14 years ago
Eric Leblond	628bfcc1b9	stream: Change return of StreamSegmentForEach ... The function now returns the number of segment where the callback has ben runned successfully.	14 years ago
Victor Julien	c672bdd863	Improve atomic operation support detection. Fixes #342.	14 years ago
Anoop Saldanha	0edf053f31	if app layer inspection is disabled, immediately set the eof flag	14 years ago
Anoop Saldanha	fe11e02f58	fix inspect id update bug. This should prevent unnecessary FPs for pipelined requests	14 years ago
Anoop Saldanha	4e44073c79	http logging module should log all txs in the list and not just the last complete tx available on EOF	14 years ago
Anoop Saldanha	c13ad8c28a	Provide a function to set the app layer tx eof flag. Use this in FFR code instead of diretly setting the flag. This cleans up the API as well	14 years ago
Anoop Saldanha	b406af451b	updates to http tx id vars. FFR now flags the app layer session for EOF when creating a pseudo packet for a flow	14 years ago
Anoop Saldanha	67be07bf15	fix threading issue in debug log. locked mutex isn't freed before returning. fixed	14 years ago
Anoop Saldanha	d23e775ae2	fix threading bug. Main thread's restart TV code waiting on a failed TV. Now main thread sets the de_init flag before waiting on the failed thread. Thanks to Eric Leblond for reporting it	14 years ago
Anoop Saldanha	737122663c	IPProto now doesn't accept sigs, which has both < and >, with < value being less than > value. Update affected unittests to reflect the change	14 years ago
Anoop Saldanha	dae099893b	more unittests for ipproto with multiple nots + some fixes	14 years ago
Anoop Saldanha	9887084370	support multiple ipprotos in the same sig + unittest	14 years ago
Anoop Saldanha	a781fb9884	rewrite all ipproto keyword tests	14 years ago
Anoop Saldanha	8033a262a7	cleanup ipproto code	14 years ago
Anoop Saldanha	caf450d325	fix ipproto keyword negation case - bug #340	14 years ago
Eric Leblond	79c329f81b	alert-unified2: logging of stream segments. ... This patch adds the logging of stream segments. Among other modifications, it uses a wrapper to fwrite to permit to update file statistics in an automated manner. Some memcpy have also been avoided by using pointer to the data.	14 years ago
Eric Leblond	2fa837bcec	alert-debuglog: Add logging of stream segments. ... This patch introduces logging of the stream segments in case of a signature match on application layer.	14 years ago
Eric Leblond	4f0cdf28a3	Introduce StreamSegmentForEach function ... This patch introduces a function called StreamMsgForEach which can be used to run a callback on all segments of a stream. This is currently only supported for TCP as this is the only streaming aware protocol.	14 years ago
Anoop Saldanha	d68775d47d	introduce bitmasks instead of alproto_masks for use by the probing parser. Remove all alproto_masks we had previouslys for PP	14 years ago
Victor Julien	f5ef842752	Implement a counter for TCP packets with invalid checksums: tcp.invalid_checksum. Bug #311.	14 years ago
Anoop Saldanha	d3989e7cee	probing parser updated to always accept u32 buflens. Update all probing parser functions to accomodate this change	14 years ago
Anoop Saldanha	80d80000bb	fix probing parser flag usage during protocol detection	14 years ago
Anoop Saldanha	432c3317d2	app layer probing parser updates	14 years ago
Anoop Saldanha	d68f182ebd	introduce SCPerfSyncCounters/SCPerfSyncCounters macro to synchronize counters	14 years ago
Anoop Saldanha	f7b1972263	update broken stats.log. Use pktacqloop funcs in pcap-file, pfring, pcap-live, af-pkt to sync counters - bug #343	14 years ago
Victor Julien	a1f68bf411	Fix detection engine informational message misrepresenting decoder only signatures.	14 years ago
Eric Leblond	abddbe1c91	unitest helper: Fix copy of packet data. ... The copy of packet data was causing a memory corruption causing weird crash.	14 years ago
Victor Julien	7beb5cdf58	Add util-optimize.h to suricata-common.h so all code can use it.	14 years ago
Eric Leblond	db42981a3d	Fix suricata start when no interface is given. ... When no interface was specified on command line, the workers and single mode where not able to start due to the fact there was no registered interfaces.	14 years ago
Eric Leblond	9aabf94c9f	Suppress useless parameter in function ... ConfigParser is called in the parent function and it is thus not necessary to send it to the per device function.	14 years ago
Eric Leblond	58d7cb20eb	pcap-info: fix compilation warning.	14 years ago
Eric Leblond	27f1d88374	Add pcap-info alert format. ... This patch adds a new alert format called pcap-info. It aims at providing an easy to parse one-line per-alert format containing the packet id in the parsed pcap for each alert. This permit to add information inside the pcap parser. This format is made to be used with suriwire which is a plugin for wireshark. Its target is to enable the display of suricata results inside wireshark. This format doesn't use append mode per default because a clean file is needed to operate with wireshark. The format is a list of values separated by ':': Packet number:GID of matching signature:SID of signature:REV of signature:Flow:To Server:To Client:0:0:Message of signature The two zero are not yet used values. Candidate for usage is the part of the packet that matched the signature.	14 years ago
Eric Leblond	1d1e7667ae	util-runmode: rename mod_threads_conf to ModThreadsCount.	14 years ago
Eric Leblond	625a1e070f	runmode: suppress printf ... This patch replaces printf by called to SCLogErroc.	14 years ago
Eric Leblond	2596d3bcdd	runmode: treat SCStrdup error.	14 years ago
Eric Leblond	beaa909eb8	Add "workers" runmode. ... Previous commits have considerabily empowered the "single" mode which could contain multiple threads. This behaviour was not a target for this runmode and the following patch remedies to the situation by introducing the "workers" mode where each thread do all the tasks from acquisition to logging. This runmode is currently implemented for af-packet and pf-ring.	14 years ago
Eric Leblond	788fa1e5a1	pfring: Fix typo in help.	14 years ago
Eric Leblond	730a86e6b8	pfring: fix warning ... When PF_RING is disable this function is unused and thus trigger a warning at compilation.	14 years ago
Eric Leblond	3f75b10f79	Suppress useless code. ... This code was making a warning for some time now. This patch kills it.	14 years ago
Eric Leblond	45d5c3ca59	runmode: introduce configuration dereferencing. ... A devide configuration can be used by multiple threads. It is thus necessary to wait that all threads stop using the configuration before freeing it. This patch introduces an atomic counter and a free function which has to be called by each thread when it will not use anymore the structure. If the configuration is not used anymore, it is freed by the free function.	14 years ago
Eric Leblond	3261b814db	Make SC_ATOMIC_[SUB|ADD] return result value ... This patch modifies the SC_ATOMIC_[SUB|ADD] to have them return the value of the result. This permit to write test based on return of the macro.	14 years ago
Eric Leblond	d3d99ffa13	Fix coding style and use SC* function. ... This patch fixes the coding style and uses Suricata function instead of plain lic version.	14 years ago
Eric Leblond	f998fda4dd	pfring: factorize iface and parser initialisation.	14 years ago
Eric Leblond	cc7b80437a	pfring: should not call free	14 years ago
Eric Leblond	93cf2b1690	pfring: add single mode.	14 years ago
Eric Leblond	77869a2df8	single runmode: add support for multiple capture threads	14 years ago
Eric Leblond	c75fffe92d	Improve help message ... Usage of command line has evolved with the introduction of long option. This patch updates the description of the related options.	14 years ago
Eric Leblond	dc075a74a2	pcap: add --pcap option ... This patch adds a --pcap option which can be used to select or an interface if an argument is provided or the interfaces defined in the configuration file.	14 years ago
Eric Leblond	b2c281920f	af-packet: should not call free	14 years ago
Eric Leblond	1aab2470db	af-packet: factorise single mode.	14 years ago
Eric Leblond	63d614162c	pcap: should not call free	14 years ago
Eric Leblond	491686c33e	pcap: factorise single mode.	14 years ago
Eric Leblond	abe99ee5f6	runmode: add factorisation function for single mode.	14 years ago
Eric Leblond	c3ba992652	pfring: restore precedence of command line options.	14 years ago
Eric Leblond	b2598f97e7	pcap: restore backward compatibility	14 years ago
Eric Leblond	21663acd3b	pcap: use good var name for live-interface	14 years ago
Eric Leblond	d3d8beb337	pcap: factorize runmode ... This patch factorizes auto and autofp runmodes for pcap.	14 years ago
Eric Leblond	d9d8286671	pfring: restore compatibility with v1.0 config ... Compatibility of pfring module with previous version was broken. This patch restores backward compatibility.	14 years ago
Eric Leblond	a64dcfeba2	pfring: use factorisation function ... This patch convert pfring to pktacqloop and use the new factorisation function. This also fixes commmand line parsing of pfring which is now able to work like af-packet: - 'suricata -c s.yaml --pfring' start suricata with all interfaces in conf - 'suricata -c s.yaml --pfring=eth2' start suricata on eth2	14 years ago
Eric Leblond	cbb36b5182	af-packet: remove unused function	14 years ago
Eric Leblond	75c875b1ac	af-packet: use factorisation function for Auto mode.	14 years ago
Eric Leblond	8bf0897b3c	Add factorisation function for runmode. ... This patch adds a function which will be used to factorise the Auto runmode between the different IDS mode.	14 years ago
Eric Leblond	d4d62f3099	http-uri: Remove useless function declaration.	14 years ago
Victor Julien	3401defbbb	tag: fixes and cleanups ... Major fixes for the tag subsystem: - Removed TimeGet call from tag packet runtime to safe a gettimeofday - Removed unused lock from data type - Fixed broken first packet skip logic - Fix broken reference counter logic - Fix memory leak on tag expiration - Cleaned up code	14 years ago
Anoop Saldanha	b7b58074de	fix ac unittest	14 years ago
Anoop Saldanha	d6f9e06bbb	update ac to behave the same way irrespective of the state count. Should improve performance. Also fix unittests to accomodate these changes	14 years ago
Anoop Saldanha	dcaef183e8	fix compiler warning for printf format	14 years ago
Victor Julien	bc5c9f4a52	Fix too many SMTP commands causing an integer overflow in the cmds_cnt variable, in turn causing an out of bounds memory write.	14 years ago
Victor Julien	9baa16af63	Convert flow memcap to u64. Bug #332.	14 years ago
Victor Julien	8208eacd79	Convert stream memcaps to u64. Bug #332.	14 years ago
Victor Julien	4c641f0deb	Fix compilation with profiling enabled.	14 years ago
Anoop Saldanha	3ec7b75194	fix timestamps for pseudo packets created during FFR - bug 337	14 years ago
Anoop Saldanha	9d94bb38d5	refactor flow timeout code. fix ipv6 address assignment for pseudo pkt.	14 years ago
Anoop Saldanha	246a4e9fff	for shutdown reassembly properly init the reassembly packet using PACKET_RECYCLE	14 years ago
Victor Julien	1a5931e878	pcap-log: fall back to sguil_base_dir option if 'dir' isn't set. Minor cleanups.	14 years ago
William Metcalf	3b3f5816bf	You spin me right round baby, right round like a rotating packet capture right round. Oh, also log file size counters are now uint64_t	14 years ago
Victor Julien	6bad2dbd79	Don't match on IP only rules that use ports if packet is not (proper) TCP, UDP or SCTP. Rules out frags matching as well.	14 years ago
Anoop Saldanha	63ed36a892	Replace all reallocs with SCReallocs	14 years ago
Anoop Saldanha	4307ea2348	Replace all frees with SCFrees	14 years ago
Anoop Saldanha	797b1a44c7	Replace all strdup with SCStrdup	14 years ago
Anoop Saldanha	13ea299ee0	Replace all mallocs with SCMallocs	14 years ago
Eric Leblond	de59c9f4b1	Add and use utility functions for checksum computing.	14 years ago
Eric Leblond	a85dc9b0e2	Add support for replace keyword. ... This patch adds support for the replace keyword. It is used with content to change selected part of the payload. The major point with this patch is that having a replace keyword made necessary to avoid all stream level check because we need to access to the could-be-modified packet payload. One of the main difficulty is to handle complex signature. If there is other content check, we must do the substitution when we're sure all match are valid. The patch adds an attribute to the thread context variable to be able to deal with recursivity of the match function. Replace is only activated in IPS mode and apply only to raw match.	14 years ago
Eric Leblond	0c34a1c5e7	rewrite constants and add flag for replace ... This patch make use of bit shift to rewrite some of the mask constants. It also delete an unused flag value and suppress the associated dead code. The numeric value of the flag is now used by the flag needed for replace code.	14 years ago