Victor Julien
b8cf50678f
Fix many address unittests using explicit byte order and thus failing on big-endian systems.
14 years ago
Victor Julien
c865ee2217
Fix compilation for nfq_set_mark code when NFQ is not enabled.
14 years ago
Eric Leblond
ee6552f25e
nfq_set_mark: handle feature in NFQ.
...
This patch implements the nfq_set_mark related modification of verdict
handling.
14 years ago
Eric Leblond
9beebf621a
Add support for 'nfq_set_mark' keyword
...
This patch introduces 'nfq_set_mark' which is new rules option. If a packet
matches a rule using nfq_set_mark in NFQ mode, it is marked with the mark/mask
specified in the option during the verdict.
It is thus possible to trigger different behaviour on the packet inside
Linux/Netfilter.
14 years ago
Victor Julien
f90a5cfffd
Misc pcap logging cleanups.
14 years ago
William Metcalf
023a0f94a2
first stab at pcap logging no rotating buff etc
14 years ago
Anoop Saldanha
1f7e4bada1
add tls.no_reassemble use for sslv2 which we missed previously. Also some cleanup
14 years ago
Victor Julien
71d0eabdec
Add a few extra safety checks in new SSL code.
14 years ago
Anoop Saldanha
c105a739e9
support for ssl_state keyword added
14 years ago
Anoop Saldanha
013d3aea1c
update ssl parser test. Some minor indentation changes
14 years ago
Anoop Saldanha
7a2046328c
some naming changes in ssl parser and ssl related keywords
14 years ago
Anoop Saldanha
4c570777c4
delete files app-layer-tls.[ch]
14 years ago
Anoop Saldanha
b639718787
replace the contents of app-layer-ssl.[ch] with the contents from app-layer-tls.[ch]
14 years ago
Anoop Saldanha
cacf0a9017
disabled sslv23 proto detection which we enabled previously. Although this is right, need to test a couple of things
14 years ago
Anoop Saldanha
4e8de99dcd
tls/ssl parser modifications/fixes. We now have just one file doing all the ssl parsing stuff, i.e. app-layer-tls.[ch], instead of app-layer-ssl.[ch] and app-layer-tls.[ch]
14 years ago
Anoop Saldanha
8b17275451
dcerpc parser todo update
14 years ago
Anoop Saldanha
8c6d4531ee
sslv23 support with ssl2 record format with version set to 3.0
14 years ago
Victor Julien
07a85427dd
Add --build-info command line option to output some basic build settings.
14 years ago
Victor Julien
174db08567
Force reassembly of unack'd data on receiving a valid RST packet.
14 years ago
Victor Julien
b9429ecec1
Fix invalid RST considered valid due to wrong returns codes. Only validate ACK from a RST packet if an ACK value was set.
14 years ago
Victor Julien
cb67d61ab5
Fix broken setup of end of stream pseudo packet.
14 years ago
Victor Julien
99fca03810
Move unittest code into UNITTESTS ifdefs in the HTP parser. Fixes a compiler warning.
14 years ago
Victor Julien
0dc6333d22
Fix compiler warnings about unused IPv6 Address code.
14 years ago
Victor Julien
b9fd978253
Fix compiler warnings in two unittests.
14 years ago
Victor Julien
a3be22cd5a
Fix compiler warning in isdataat keyword setup code.
14 years ago
Victor Julien
bbe071252b
Make sure PID is logged as well in alert-syslog output.
14 years ago
Victor Julien
da423a59d5
Allow users of the alert-syslog to set the identity.
14 years ago
Victor Julien
07776c113b
Fix valgrind error on pfring_recv, rename threads from RecvPfring to RxPfring so the name still looks right for 100+ threads. Add --pfring commandline option that just enables pfring, then takes interface from config.
14 years ago
Victor Julien
3aeb86d836
Fix header_len in GRE decoder getting out of control in some cases.
14 years ago
Victor Julien
1c9e48ae98
Fix compilation error on non-pfring systems.
14 years ago
Victor Julien
91f28afef4
Add option to PF_RING to have multiple reader threads. Improve general performance of the PF_RING module.
14 years ago
Victor Julien
edeec290f6
Fix missing rename for request-body-limit to request_body_limit.
14 years ago
Eric Leblond
3b3a8ffb94
detect-gid: suppress unused type
...
The DetectGidData type is not used in the code. This patch removes
the type definition from code.
14 years ago
Eric Leblond
ad44f1cfc1
fix possible typo in strtoul error handling.
14 years ago
Eric Leblond
04f2afa81b
nfq: fix exit function
...
Exit function was trying to close the nfq handler even if it was
null. This was causing a crash.
14 years ago
Eric Leblond
277a384af7
Use already defined macro instead of integer
...
Code was using a integer instead of the already defined macro.
14 years ago
Pablo Rincon
ce3b76a102
Fix compilation on Mac OS X (it was missing IPPROTO_SCTP definition)
14 years ago
Victor Julien
153f9298e7
Fix priority handling during the signature parsing stage. Fixes #275 .
14 years ago
Gurvinder Singh
27f67c97de
log error on duplicate sig and also for dup sig with newer revision
14 years ago
Victor Julien
8a390971e7
Print [drop] as well for syslog output.
14 years ago
Victor Julien
0377ae0817
Reduce SCTP_HEADER_LEN to reflect actual pkt header size.
14 years ago
Eric Leblond
005dc599a6
detect.c: Fix usage of integer standing for protocol
...
This patch fixes direct usage of integer to code protocol value.
14 years ago
Eric Leblond
2c80f18dc9
detect: Add sctp detection and parsing.
...
This patch adds the support of SCTP in signature subsystem.
14 years ago
Eric Leblond
674b0bfae7
flow: Add basic SCTP support
...
This patch adds a basic flow support to SCTP. SCTP specificities
like the verification tag are not taken into account.
14 years ago
Eric Leblond
01e955bc27
Add SCTP to packet validation
...
Validation util was missing a test on sctph which can not be null
for SCTP packets.
14 years ago
Eric Leblond
a823160384
detect: Add support for sctp option in rule
...
'sctp' can now be used as a keyword in signature. It is at the same
level as the 'tcp' or 'udp' keywords.
14 years ago
Eric Leblond
482991ad6d
decode: add support for SCTP protocol
...
This patch adds a new counter for SCTP and defines some
macros needed for SCTP support.
14 years ago
Eric Leblond
8be92fdd99
SCTP support: add parsing of sctp
...
This patch adds support of SCTP in all part of the code in charge
of decoding packets.
14 years ago
Eric Leblond
e1d966eaf6
Makefile: add sctp files to build
...
This patch simply adds decode-sctp files to the compilation.
14 years ago
Eric Leblond
b69fd02284
decode sctp: basic SCTP decoding.
...
This files are basically a dummy conversion of UDP one. It
provides basic decoding (source port and destination port).
There is no chunk hanldling which means that suricata regexp
will match on all packet content except initial header and not
only on userspace data.
14 years ago