7368 Commits (aaf0fe4d29e5c9d0319732c07c17bd3c1df381ea)

 

All Branches   

Search

Author	SHA1	Message	Date
Victor Julien	aaf0fe4d29	doc: eve update	8 years ago
Victor Julien	a35bea28f3	doc: rules-meta typo	8 years ago
Victor Julien	879c3d8ad7	detect: fix scan-build 0-size alloc warnings	8 years ago
Victor Julien	76b55214f0	doc: rules-meta small cleanup	8 years ago
Victor Julien	3cf1b12061	doc: http sticky vs modifier	8 years ago
Victor Julien	0d15593258	doc: move urilen to other uri keywords	8 years ago
Victor Julien	34bfacdee0	doc: add minimal http request/response line sections	8 years ago
Victor Julien	adb6c75e2e	doc: only make sphinx warnings fatal on html/pdf	8 years ago
Jason Ish	82a6bfd599	doc: manpage: add bugs and notes section	8 years ago
Jason Ish	a4450b768e	doc: manpage: add signals section	8 years ago
Jason Ish	5c78fdbc9c	doc: break out command line options into a common doc ... The command line options can now be consumed by the man page and the user guide. Some attempt was made to order the options from common/basic progressing to advanced with some notion of options grouped together.	8 years ago
Jason Ish	cd4c9e73f8	doc: fix sphinx warnings ... This involved removing documents that were intentionally not referenced as they are not good candidates for the user guide.	8 years ago
Jason Ish	3df7f97a33	doc: fail on sphinx warnings	8 years ago
Jason Ish	79d21e9eee	docs: include userguide.pdf in dist	8 years ago
Victor Julien	790ac8d417	changelog: update for 3.2beta1	8 years ago
Victor Julien	d4c7c2c2c7	cygwin: leave magic-file commented out in yaml	8 years ago
Jason Ish	09c3e1dd8a	pcap-log: cleanup allocations at exit ... Particularly in multi-mode, allocations made for each thread were not being cleaned. ASAN reports no leaks now on exit.	8 years ago
Jason Ish	a6854147be	pcap-log config: sguil-base-dir -> dir and update comment ... The code already looks for "dir" first instead of "squil-base-dir", and already respects this configuration parameter in other modes than the "sguil" mode. Coda will still access "sguil-base-dir".	8 years ago
Jason Ish	214e97814c	doc: bring in unix socket interaction from wiki	8 years ago
Jason Ish	bec128bbf9	doc: attempt to parse version if not in environment ... Should fix the version displayed on readthedocs.	8 years ago
Victor Julien	f80ce51ddf	unix-socket: don't try to change permissions on BSD ... On BSD using fchmod on a socket is not supported and will result in EINVAL.	8 years ago
Victor Julien	96c28b2995	bug 1353: don't cut off last char of unix path	8 years ago
Victor Julien	4a190e07a6	pcre: disable JIT if RWX pages not supported	8 years ago
Victor Julien	46f5f4cff8	util: add facility to check for RWX page support ... Some code won't work well when the OS doesn't allow RWX pages. This page introduces a check for runtime evaluation of the OS' policy on this. Thanks to Shawn Webb from HardenedBSD for suggesting this solution.	8 years ago
Victor Julien	a3a1757472	flow-mgr: fix bypass counter registration	8 years ago
Victor Julien	595c20ddf4	der: fix asan/valgrind errors in time parsing	8 years ago
Victor Julien	7e4df3a1d1	tls-validity: fix memory handling	8 years ago
Mats Klepsland	10d827639e	detect-tls-cert-validity: clean up unit tests ... Remove locks, unnecessary function calls and conditional statements.	8 years ago
Mats Klepsland	1fea52dd8a	detect: add keyword tls_cert_valid ... Add keyword to check if TLS certificate is valid.	8 years ago
Mats Klepsland	f7e0083269	detect-cert-validity: fix typos	8 years ago
Mats Klepsland	f22c9d9781	detect: add keyword tls_cert_expired ... Add keyword to check if TLS certificate is expired.	8 years ago
Mats Klepsland	07d2312d96	detect-tls-validity: use flags for modes ... Use flags for modes to support using multiple modes at the same time.	8 years ago
Victor Julien	e6cf7ae8fa	yaml: improve stream-depth comments	8 years ago
Giuseppe Longo	3f214b506a	file-store: add depth setting ... When a rules match and fired filestore we may want to increase the stream reassembly depth for this specific. This add the 'depth' setting in file-store config, which permits to specify how much data we want to reassemble into a stream.	8 years ago
Giuseppe Longo	4751677e24	app-layer: use StreamTcpSetReassemblyDepth ... This calls StreamTcpSetReassemblyDepth to set the stream depth specified for the protocol.	8 years ago
Giuseppe Longo	9ab1194f68	modbus: set stream depth ... Some protocol like modbus requires a infinite stream depth because session are kept open and we want to analyze everything. Since we have a stream reassembly depth per stream, we can also set a stream reassembly depth per proto.	8 years ago
Giuseppe Longo	b160c49e9e	app-layer-parser: add stream depth ... This permits to set a stream depth value for each app-layer. By default, the stream depth specified for tcp is set, then it's possible to specify a own value into the app-layer module with a proper API.	8 years ago
Eric Leblond	a63c6b320e	stream: per TcpStream reassembly depth	8 years ago
Victor Julien	960ebb2822	enip: fix scan-build warnings ... detect-cipservice.c:161:29: warning: Assigned value is garbage or undefined cipserviced->cipservice = input[0]; ^ ~~~~~~~~ detect-cipservice.c:162:27: warning: Assigned value is garbage or undefined cipserviced->cipclass = input[1]; ^ ~~~~~~~~ detect-cipservice.c:163:31: warning: Assigned value is garbage or undefined cipserviced->cipattribute = input[2]; ^ ~~~~~~~~ 3 warnings generated.	8 years ago
Victor Julien	80c3aedbfc	enip: parsing and tests cleanup	8 years ago
Victor Julien	72b5da4313	enip/cip: improve output & style ... Remove printf, remove \n from SCLogDebug. Add SCLogError for rule parsing issues. Fix various style issues	8 years ago
Victor Julien	92b393ee9a	doc: include enip page	8 years ago
Victor Julien	a2d8cfb5d3	doc: reorder rule docs	8 years ago
Victor Julien	050f36eaa5	enip: improve yaml	8 years ago
Victor Julien	6b1c21b115	enip/cip: register inspect engines	8 years ago
kwong	a3ffebd835	Adding SCADA EtherNet/IP and CIP protocol support ... Add support for the ENIP/CIP Industrial protocol This is an app layer implementation which uses the "enip" protocol and "cip_service" and "enip_command" keywords Implements AFL entry points	8 years ago
Victor Julien	5bd906ae9f	doc: prefilter keyword and config	8 years ago
Victor Julien	d9811e58b6	http_header: don't separately inspect trailer yet ... Currently the regular 'Header' inspection code will run each time after the HTTP progress moved beyond 'headers'. This will include the trailers if there are any. Leave the code in place as this model will change in the not too distant future.	8 years ago
Victor Julien	358eacf14f	http_header: only run trailer mpm if we have trailers	8 years ago
Victor Julien	44022743f2	http: track if request/response have trailers	8 years ago