Jason Ish
60b6ccc3c4
logging: convert file data logging to non-thread module
9 years ago
Jason Ish
f9bb9029c5
logging: convert file logging to non-thread module
9 years ago
Jason Ish
669827ae16
logging: convert unified2 to non-thread module
9 years ago
Jason Ish
b580016c80
logging: convert stats loggers to non-thread module
9 years ago
Jason Ish
9475c83713
logging: convert http log to non-thread module
9 years ago
Jason Ish
e00dcd52a0
logging: convert alert syslog to non-thread module
9 years ago
Jason Ish
869d2eb701
logging: convert drop output to non-thread module
9 years ago
Jason Ish
5bbb4fd134
logging: convert json template output to non-thread module
9 years ago
Jason Ish
b605984f34
tests: setup unit test framework earlier
...
Allows tests to be registered early, in support of moving
outputs away from thread modules.
9 years ago
Jason Ish
bac65f09e8
logging: convert json drop output to non-thread module
9 years ago
Jason Ish
38354479b7
logging: convert json smtp output to non-thread module
9 years ago
Jason Ish
3fea12d7b3
logging: convert json ssh output to non-thread module
9 years ago
Jason Ish
01cc508257
logging: convert json netflow output to non-thread module
9 years ago
Jason Ish
983a619ff0
logging: convert json flow output to non-thread module
9 years ago
Jason Ish
ad15ac8297
logging: convert json alert output to non-thread module
9 years ago
Jason Ish
aaa65f3d16
logging: convert json tls output to non-thread module
9 years ago
Jason Ish
31663f1627
logging: convert prelude output to non-thread module
9 years ago
Jason Ish
dedda33f01
logging: convert eve http to non-thread module
9 years ago
Jason Ish
687602c0ca
logging: convert eve dns logging to non-thread module
9 years ago
Jason Ish
b1200dba54
logging: convert fast log to a non-thread module
9 years ago
Jason Ish
637aa34610
logging: convert dns log to a non-thread module
9 years ago
Victor Julien
99dce740ef
detect: mark alproto in keyword reg deprecated
...
No existing code uses it, and it had been useless for some time.
9 years ago
Victor Julien
e173016ded
gitignore: update to hide more local files
9 years ago
Victor Julien
9030e89c94
detect: don't set alproto while registering keyword
...
The field is not used except for some printing, and is wrong for
many keywords.
9 years ago
Victor Julien
c957c62824
detect file: enable HTTP inspection from validate func
9 years ago
Victor Julien
621860f5b2
detect file: enforce protocol in single place
...
Instead of trying to enforce the app layer protocol in each file
function, enforce it in the generic validation function.
9 years ago
Victor Julien
bcfa484bce
app-layer: add function to check if app-layer supports files
9 years ago
Victor Julien
85db260eed
threads: remove EngineKill & SURICATA_KILL
...
EngineStop and EngineKill were effectively doing the same, so
removed the kill variant.
9 years ago
Victor Julien
045c10db43
threads: failed thread is a fatal error now
9 years ago
Victor Julien
fb655d5f15
threading: remove thread restart logic
...
Thread restarts never worked well and the rest of the engine was
never really expecting errors to lead to thread restarts. Either
and error is recoverable in the thread, or not at all.
So this patch removes the functionality completely.
9 years ago
Victor Julien
54503ef310
Open Suricata 3.2 development branch
9 years ago
Victor Julien
471b61a0e1
magic: fix broken tests after CentOS6 update
9 years ago
Victor Julien
82282a9e68
mpls: add missing event type + rule
9 years ago
Victor Julien
71c8d1f46c
bpf: fix file parsing memory handling
...
Fix improper fread string handling. Improve error handling.
Skip trailing spaces for slightly more pretty printing.
Coverity CID 400763.
Thanks to Steve Grubb for helping address this issue.
9 years ago
Victor Julien
519b2970ec
detect: don't print (null) in --list-keywords=all
9 years ago
Eric Leblond
ed90a16e89
detect: fix setup for some keywords
...
Fix problems found by siginit.cocci.
9 years ago
Eric Leblond
4324805478
coccinelle: add siginit test
...
Add a test that check an inversion during keyword setup where
we add a sigmatch to a signature and then do error handling on it.
This was causing a double free of some elements and ultimately a
segfault.
Proposed-by: Victor Julien <victor@inliniac.net>
9 years ago
Jason Ish
17e70483c5
detect-flowbits: more unittest macro usage
...
Also cleanup some tests by removing extra code after a test was
determined to fail.
9 years ago
Jason Ish
3c5d8e65d4
hostbits: use new unittest macros
9 years ago
Jason Ish
c4945607e3
hostbits: fail parse on unexpected trailing data
...
Address issue https://redmine.openinfosecfoundation.org/issues/1889
for hostbits. This involves updating the regular expresssion
to capture any trailing data as the regex already keeps
spaces out of the name.
A unit test was converted to new macros to find out which
line it was failing at after updating regex.
9 years ago
Jason Ish
24f2387b23
flowbits: validate that there are no spaces in the name
...
Fixes issue: https://redmine.openinfosecfoundation.org/issues/1889
To catch the issue where the ';' is missing we have to expand the
regex to capture the whole name string, not just the leading
valid stuff. Then verify that there are no spaces in the name
(Snort has the same restriction) and fail if there is.
9 years ago
Eric Leblond
1cdd062dc6
unix-manager: fix output of version command
...
Make it consistent with the output of version command line flag.
9 years ago
Andreas Herz
65fd09a399
rule-parsing: reject unescaped double quote within content section
9 years ago
Victor Julien
ae116871ad
Update Changelog for 3.1.2
9 years ago
Victor Julien
2997d086be
eve-drop: allow logging all drops
...
- drop:
alerts: yes # log alerts that caused drops
flows: all # start or all: 'start' logs only a single drop
# per flow direction. All logs each dropped pkt.
9 years ago
Victor Julien
1cc5f9825d
dns: use nonnull attr for log functions
9 years ago
Victor Julien
bbcc22d2ad
dns: fix coverity warning
...
** CID 1372324: Null pointer dereferences (FORWARD_NULL)
/src/output-json-dns.c: 532 in OutputAnswer()
________________________________________________________________________________________________________
*** CID 1372324: Null pointer dereferences (FORWARD_NULL)
/src/output-json-dns.c: 532 in OutputAnswer()
526 }
527 }
528
529 /* reset */
530 MemBufferReset(aft->buffer);
531 json_object_set_new(djs, "dns", js);
>>> CID 1372324: Null pointer dereferences (FORWARD_NULL)
>>> Dereferencing null pointer "entry".
532 if (likely(DNSRRTypeEnabled(entry->type, aft->dnslog_ctx->flags))) {
533 OutputJSONBuffer(djs, aft->dnslog_ctx->file_ctx, &aft->buffer);
534 }
535 json_object_del(djs, "dns");
536
537 return;
Move checks to the top of the functions. Should be more efficient too.
9 years ago
Victor Julien
b4565004c7
detect-template: modernize
9 years ago
Jason Ish
e878dd2231
app-layer templates: cleanups
...
- cleanup file headers
- add todo section
- convert unit tests to new macros
- add markers to remove disabled by default behaviour
9 years ago
Jason Ish
3cf8b4629f
decode-icmpv6: use FAIL macros in tests
9 years ago