Commit Graph

7493 Commits (a67c31d4e164b04c1ec5766b692bf984790cdad5)
 

Author SHA1 Message Date
Victor Julien a67c31d4e1 qa: appveyor support 8 years ago
Victor Julien e6ed0d815c qa: update url in libhtp script 8 years ago
Jason Ish bbb93e487e pcap-log: seed ring buffer on start up
On start, look for existing pcap log files and add them to
the ring buffer. This makes pcap-log self maintaining over
restarts removing the need for external tools to clear
orphaned files.
8 years ago
Eric Leblond a2e2f50fb9 documentation: fix list keywords URLs
Update URLs in keyword definition to point to sphinx documentation.
8 years ago
Jason Ish fffdc6e3fd logging: hook the application log file into rotation 8 years ago
Jason Ish 73a1d04779 logging: open application log file in append mode
It was being open in read/write mode, which was likely
a mistake with append mode being the intention.
8 years ago
Jason Ish 666fecc579 dns: accept a data length of 0 without marking as malformed
Addresses issue:
https://redmine.openinfosecfoundation.org/issues/1924
8 years ago
Jason Ish b9ba792279 dns-events: fix direction of malformed events + typo 8 years ago
Jason Ish d5eca41a71 ipfw: disable more code to suppress compiler warnings
Disabled code lead to unused variable warnings, so disable the
variable code as well.
8 years ago
Jason Ish 2b874abada compiler warnings: fix compiler warnings in format strings 8 years ago
Victor Julien 3f8ee2afd3 detect-lua: unify on using 'lua' name vs 'luajit' 8 years ago
Victor Julien 0366d47608 luajit: remove unused instance counter 8 years ago
Victor Julien 3012edae1c luajit: update default yaml and doc for 'states' 8 years ago
Victor Julien 3da7dad514 lua: luajit improvements
Luajit has a strange memory requirement, it's 'states' need to be in the
first 2G of the process' memory.

This patch improves the pool approach by moving it to the front of the
start up.

A new config option 'luajit.states' is added to control how many states
are preallocated. It defaults to 128.

Add a warning when more states are used then preallocated. This may fail
if flow/stream/detect engines use a lot of memory. Add hint at exit that
gives the max states in use if it's higher than the default.
8 years ago
Jason Ish 0792f80909 doc: only build pdf on dist if pdflatex is installed 8 years ago
Jason Ish ee16b86900 doc: fix build pdf on non gnu make platforms
The Makefile generated by sphinx-build is GNU Make specific
causing the PDF phase to fail. Instead call pdflatex directly
based on how the generated Makefile was doing it.
8 years ago
Victor Julien 064c070db7 pcap-file: minor cleanup 8 years ago
Victor Julien f9f5e8a348 changelog: update for 3.2RC1 release 8 years ago
Victor Julien 3973363164 yaml: group ICS protocols together 8 years ago
Victor Julien b231558957 ENIP: add default ports to yaml 8 years ago
Victor Julien 238163bc8d ENIP: disable parser if no config found 8 years ago
Victor Julien 080a2f0cfb DNP3: disable in case of no dnp3 config 8 years ago
Priit Laes 12849fa927 readme: Fix markdown header levels 8 years ago
Priit Laes 6d9733a72b readme: reformat some key points about possible security issues 8 years ago
Priit Laes d709bf49e8 readme: Add link to up-to-date user guide and mark wiki as deprecated. 8 years ago
Jason Ish 65bf06975c dnp3: fix coverity checks; return value not checked 8 years ago
Victor Julien 1f670837ac detect: add missing break (CID 1374301) 8 years ago
Victor Julien c0f25bddaf eve: make payload printing in alerts more robust 8 years ago
Victor Julien 39a23d8d1b flowint: allow / in name 8 years ago
Victor Julien 56ff853e73 hostbits: test fixes 8 years ago
Victor Julien 8831e5b375 pkt-var: const name 8 years ago
Victor Julien 5dc9c1b874 DNP3: minor cleanup 8 years ago
Victor Julien 7cf231c7ec DNP3: don't leak memory on dnp3_obj parsing 8 years ago
Jason Ish f0de1d04a9 DNP3: Use directional logging.
Instead of waiting for a transaction complete, log the
request as soon as it is completes which will give it a
more accurate timestamp.
8 years ago
Jason Ish f70badeb0e DNP3: --afl-dnp3 entry point 8 years ago
Jason Ish a59f31a99f DNP3: Lua detect support.
Adds support for access the DNP3 transaction in Lua rules.
8 years ago
Jason Ish 44a69f6355 DNP3: Log DNP3 info with DNP3 alert. 8 years ago
Jason Ish 1c3f373543 DNP3: Log DNP3 transactions. 8 years ago
Jason Ish 1a31bded4a DNP3: dnp3_data, dnp3_func, dnp3_ind, dnp3_obj rule keywords 8 years ago
Jason Ish bbaa79b80e DNP3: Application layer decoder.
Decodes TCP DNP3 and raises some DNP3 decoder alerts.
8 years ago
Jason Ish 240d789c40 DNP3: dnp3-gen: code generator for repetitive DNP3 code 8 years ago
Jason Ish da40714cb1 common: define json_boolean when not defined
Older versions of jansson in current use don't have this
macro defined.
8 years ago
fooinha f6c0abaae7 eve: check redis reply in non pipeline mode
We may lose the reply if disconnection happens.
Reconnection is needed.
8 years ago
Victor Julien 2758f82515 flowvar: cleanups 8 years ago
Jason Ish 9d271e9a71 fast-pattern: fix tls_sni
Use all 38 arguments in call to SigMatchGetLastSMFromLists

Was preventing fast_pattern from being applied to tls_sni:
https://redmine.openinfosecfoundation.org/issues/1936
8 years ago
Jason Ish 7d734edca8 dns: use new unittest macros 8 years ago
Jason Ish a8f6fb0f78 dns: support back to back requests without a response
Address the issue where a DNS response would not be logged when
the traffic is like:
- Request 1
- Request 2
- Response 1
- Response 2
which can happen on dual stack machines where the request for A
and AAAA are sent out at the same time on the same UDP "session".

A "window" is used to set the maximum number of outstanding
responses before considering the olders lost.
8 years ago
Jason Ish 64cc91a569 tcp dns: unit test for multi-request buffer 8 years ago
Jason Ish 2d4df19401 tcp dns: fix advancement to next request in buffer
The advancement through the buffer was not taking into account
the size of the length field resulting in the second request
being detected as bad data.
8 years ago
Victor Julien db1c47cb6e multi-tenant: make less verbose 8 years ago