7493 Commits (a67c31d4e164b04c1ec5766b692bf984790cdad5)

 

All Branches   

Search

Author	SHA1	Message	Date
Victor Julien	595c20ddf4	der: fix asan/valgrind errors in time parsing	8 years ago
Victor Julien	7e4df3a1d1	tls-validity: fix memory handling	8 years ago
Mats Klepsland	10d827639e	detect-tls-cert-validity: clean up unit tests ... Remove locks, unnecessary function calls and conditional statements.	8 years ago
Mats Klepsland	1fea52dd8a	detect: add keyword tls_cert_valid ... Add keyword to check if TLS certificate is valid.	8 years ago
Mats Klepsland	f7e0083269	detect-cert-validity: fix typos	8 years ago
Mats Klepsland	f22c9d9781	detect: add keyword tls_cert_expired ... Add keyword to check if TLS certificate is expired.	8 years ago
Mats Klepsland	07d2312d96	detect-tls-validity: use flags for modes ... Use flags for modes to support using multiple modes at the same time.	8 years ago
Victor Julien	e6cf7ae8fa	yaml: improve stream-depth comments	8 years ago
Giuseppe Longo	3f214b506a	file-store: add depth setting ... When a rules match and fired filestore we may want to increase the stream reassembly depth for this specific. This add the 'depth' setting in file-store config, which permits to specify how much data we want to reassemble into a stream.	8 years ago
Giuseppe Longo	4751677e24	app-layer: use StreamTcpSetReassemblyDepth ... This calls StreamTcpSetReassemblyDepth to set the stream depth specified for the protocol.	8 years ago
Giuseppe Longo	9ab1194f68	modbus: set stream depth ... Some protocol like modbus requires a infinite stream depth because session are kept open and we want to analyze everything. Since we have a stream reassembly depth per stream, we can also set a stream reassembly depth per proto.	8 years ago
Giuseppe Longo	b160c49e9e	app-layer-parser: add stream depth ... This permits to set a stream depth value for each app-layer. By default, the stream depth specified for tcp is set, then it's possible to specify a own value into the app-layer module with a proper API.	8 years ago
Eric Leblond	a63c6b320e	stream: per TcpStream reassembly depth	8 years ago
Victor Julien	960ebb2822	enip: fix scan-build warnings ... detect-cipservice.c:161:29: warning: Assigned value is garbage or undefined cipserviced->cipservice = input[0]; ^ ~~~~~~~~ detect-cipservice.c:162:27: warning: Assigned value is garbage or undefined cipserviced->cipclass = input[1]; ^ ~~~~~~~~ detect-cipservice.c:163:31: warning: Assigned value is garbage or undefined cipserviced->cipattribute = input[2]; ^ ~~~~~~~~ 3 warnings generated.	8 years ago
Victor Julien	80c3aedbfc	enip: parsing and tests cleanup	8 years ago
Victor Julien	72b5da4313	enip/cip: improve output & style ... Remove printf, remove \n from SCLogDebug. Add SCLogError for rule parsing issues. Fix various style issues	8 years ago
Victor Julien	92b393ee9a	doc: include enip page	8 years ago
Victor Julien	a2d8cfb5d3	doc: reorder rule docs	8 years ago
Victor Julien	050f36eaa5	enip: improve yaml	8 years ago
Victor Julien	6b1c21b115	enip/cip: register inspect engines	8 years ago
kwong	a3ffebd835	Adding SCADA EtherNet/IP and CIP protocol support ... Add support for the ENIP/CIP Industrial protocol This is an app layer implementation which uses the "enip" protocol and "cip_service" and "enip_command" keywords Implements AFL entry points	8 years ago
Victor Julien	5bd906ae9f	doc: prefilter keyword and config	8 years ago
Victor Julien	d9811e58b6	http_header: don't separately inspect trailer yet ... Currently the regular 'Header' inspection code will run each time after the HTTP progress moved beyond 'headers'. This will include the trailers if there are any. Leave the code in place as this model will change in the not too distant future.	8 years ago
Victor Julien	358eacf14f	http_header: only run trailer mpm if we have trailers	8 years ago
Victor Julien	44022743f2	http: track if request/response have trailers	8 years ago
Victor Julien	798ba010ca	prefilter: use array of engines per sgh ... Instead of the linked list of engines setup an array with the engines. This should provide better locality. Also shrink the engine structure so that we can fit 2 on a cacheline. Remove the FreeFunc from the runtime engines. Engines now have a 'gid' (global id) that can be used to look up the registered Free function.	8 years ago
Victor Julien	8321f04ef3	prefilter: clean up setup code	8 years ago
Victor Julien	d36c0c15ea	detect: reshuffle keyword registration order ... The order of keyword registration currently affects inspect engine registration order and ultimately the order of inspect engines per rule. Which in turn affects state keeping. This patch makes sure the ordering is the same as with older releases.	8 years ago
Victor Julien	58ac4027ef	detect: clean up inspect engine registration	8 years ago
Victor Julien	a24870f29f	detect app-layer-event: clean up registration ... Move engine and registration into the keyword file. Register as 'ALPROTO_UNKNOWN' instead of per alproto. The registration will only apply it to those rules that have events set.	8 years ago
Victor Julien	9e35fa7f41	detect: remove empty app registration table	8 years ago
Victor Julien	8a0bea872c	template_buffer: register inspect engine from keyword	8 years ago
Victor Julien	6f253e1ea7	file detect: register inspect engines from keyword	8 years ago
Victor Julien	08d0fe0916	modbus detect: register inspect engine from keyword	8 years ago
Victor Julien	2db094ab7a	dns detect: register inspect engine from keyword	8 years ago
Victor Julien	c9bb762f64	tls_cert_issuer: register inspect engine from keyword	8 years ago
Victor Julien	e28e98bcaa	tls_cert_subject: register inspect engine from keyword	8 years ago
Victor Julien	a87c196b60	tls_sni: register inspect engine from keyword	8 years ago
Victor Julien	200a4c1593	http_stat_code: register inspect engine from keyword	8 years ago
Victor Julien	cd705752db	http_stat_msg: register inspect engine from keyword	8 years ago
Victor Julien	20e93ba419	file_data: register inspect engine from keyword	8 years ago
Victor Julien	0496b3f6a5	http_raw_host: register inspect engine from keyword	8 years ago
Victor Julien	a00629ab55	http_host: register inspect engine from keyword	8 years ago
Victor Julien	edb2936998	http_user_agent: register inspect engine from keyword	8 years ago
Victor Julien	fc857c5455	http_raw_uri: register inspect engine from keyword	8 years ago
Victor Julien	b1adea6eee	http_cookie: register inspect engine from keyword	8 years ago
Victor Julien	cd8b1b0b4c	http_method: register inspect engine from keyword	8 years ago
Victor Julien	b314829614	http_raw_header: register inspect engine from keyword	8 years ago
Victor Julien	eb19eb3fe4	http_header: register inspect engine from keyword	8 years ago
Victor Julien	4096f76b1b	http_client_body: register inspect engine from keyword	8 years ago