8068 Commits (d6460392c51b2f6cbbfc6316eb96e0926ddc1d25)

Author	SHA1	Message	Date
Victor Julien	d6460392c5	detect/transforms: fix doc urls	7 years ago
Victor Julien	57921d95d6	eve: improve error handling for Rust loggers ... Give useful warning message if Rust is not compiled in.	7 years ago
Victor Julien	24b18e47bd	pfring: minor cleanups	7 years ago
Victor Julien	4f84672d7c	stats: decoder/stream events as stats	7 years ago
Victor Julien	014056f686	detect/analyzer: add detection for sigs that could use http keywords	7 years ago
Victor Julien	127937b2dd	detect/analyzer: add debug statements	7 years ago
Victor Julien	c05459ce89	detect/analyzer: fix json analyzer being called on incomplete rules	7 years ago
Victor Julien	6c97909a92	stream/events: log as stats	7 years ago
Victor Julien	fa06879563	detect/events: cleanup keyword	7 years ago
Victor Julien	2ae8d1a208	cocci/detect: add flags check to SigTableElmt	7 years ago
Victor Julien	ecb5d6419b	rules/transform: add to list-keywords	7 years ago
Mats Klepsland	81cdcd315b	detect-ssh-software: fix url for keyword	7 years ago
Mats Klepsland	08efbdc632	detect-ssh-software-version: add description and url to keyword	7 years ago
Mats Klepsland	f4da3050f2	detect-ssh-proto-version: add description and url to keyword	7 years ago
Mats Klepsland	c58252bb3b	detect-ssh-proto: fix url for keyword	7 years ago
Victor Julien	daaa90d515	rust/smb: suppress noisy messages	7 years ago
Victor Julien	c4d8508f51	eve/json: introduce community flow id ... Add support for community flow id, meant to give a records a predictable flow id that can be used to match records to output of other tools. Takes a 'seed' that needs to be same across sensors and tools to make the id less predictable.	7 years ago
Victor Julien	e956b484c5	eve/json: handle common options in central function	7 years ago
Victor Julien	df1ec82b55	eve/json: move common settings into it's own struct	7 years ago
Victor Julien	116c03cf17	nfs: use common json output structures	7 years ago
Victor Julien	04edc7cb6c	smb: use common json output structures	7 years ago
Victor Julien	8b8270e732	eve/json: add common helper funcs ... Add simple helper funcs for option-less loggers	7 years ago
Victor Julien	f357ad1df2	eve/flow: minor cleanups	7 years ago
Victor Julien	7bf71805b8	hash/sha1: optimize by avoiding mem alloc ... Don't allocate an output buffer for each call. These buffers would have the exact same size every time.	7 years ago
Victor Julien	efbb5ce0fe	afpacket: fix formatting of errors	7 years ago
Victor Julien	8d5da9e00f	dns: shrink per flow state by improving layout	7 years ago
Victor Julien	275cf9b029	detect/ttl: major clean up of ttl code ... Redo unittests using FAIL/PASS macros Switch parsing to pcre_copy_substring. Misc cleanups.	7 years ago
Victor Julien	13ea30ef23	spelling: fixing minor spelling mistakes	7 years ago
Danny Browning	a307e637c6	suricata: file existence check (bug #2615) ... Files and directories passed via command line option -r should be checked for existence during command line parsing and not start additional suricata functionality.	7 years ago
Mats Klepsland	8c3f1aa7a5	tlslog: don't log as "resumed" without ServerHello ... Don't log a session as "resumed" if a ServerHello record has not been seen. This makes sure that incomplete TLS sessions where the ClientHello contains a session ticket, is not logged as a session resumption.	7 years ago
Mats Klepsland	814e1624c2	output-json-tls: don't log as "resumed" without ServerHello ... Don't log a session as "resumed" if a ServerHello record has not been seen. This makes sure that incomplete TLS sessions where the ClientHello contains a session ticket, is not logged as a session resumption.	7 years ago
Mats Klepsland	4470b05ae4	app-layer-ssl: remove unnecessary length check ... We already check that empty extensions are not decoded, so this length check is not needed.	7 years ago
Jason Ish	35fd10bc2e	rust: app-layer detect template for rust parsers	7 years ago
Jason Ish	c3f1a35e28	rust: app-layer template parser and logger ... The protocol is a simple request/reply based protocol that can be hand driven with netcat. Request -> 12:Hello World! Response -> 3:Byte Its of the format <length>:<message> where length is the length of the message, not including the length or the delimiter.	7 years ago
Jason Ish	ee3aba9008	templates: C stub output for Rust logger	7 years ago
Jason Ish	96dc20abb1	templates: C stub template for Rust parser	7 years ago
Victor Julien	486054595a	detect/template2: template with prefilter (copy of ttl)	7 years ago
Victor Julien	4d0fc67560	decode/template: minor updates	7 years ago
Victor Julien	a013cece69	app-layer/template: code cleanups	7 years ago
Victor Julien	33914c2f2f	detect/template: clean up packet keyword	7 years ago
Victor Julien	d3e5c15995	detect/template: move test to own file in src/tests/	7 years ago
Victor Julien	1bb8fcecec	detect/template: switch to v2 API, add MPM	7 years ago
Victor Julien	234d113838	detect/template: clean up unittest	7 years ago
Jacob Masen-Smith	b1b45a54c5	detect/analyzer: disable automatic json output ... EngineAnalysisRules2 was in a strange location where it did not respect the --engine-analysis flag. It has been moved to the same call location as EngineAnalysisRules.	7 years ago
Victor Julien	64d75496b8	detect/analyzer: add notes (and warnings)	7 years ago
Victor Julien	e02b74dee7	http: implement min size stream logic ... Update HTTP parser to set the min inspect depth per transaction. This allows for signatures to have their fast_pattern in the HTTP body, while still being able to inspect the raw stream reliably with it. The inspect depth is set per transaction as it: - depends on the per personality config for min inspect size - is set to the size of the actual body if it is smaller After the initial inspection is done, it is set to 0 which disables the feature for the rest of the transaction. This removes the rescanning flush logic in commit 7e004f52c6 and provides an alternative fix for bug #2522. The old approach caused too much rescanning of HTTP body data leading to a performance degradation. Bug #2522	7 years ago
Victor Julien	7186ce7b99	stream: introduce min inspect depth logic ... Some rules need to inspect both raw stream data and higher level buffers together. When this higher level buffer is a streaming buffer itself, the risk of mismatch exists. This patch allows an app-layer parser to set a 'min inspect depth'. The value is used by the stream engine to keep at least this depth worth of data, so that the detection engine can request all of it for inspection. For rules that have the SIG_FLAG_FLUSH flag set, data is inspected not from offset raw_progress, but from raw_progress minus min_inspect_depth. At this time this is only used for sigs that have their fast_pattern in a HTTP body and have raw stream match as well.	7 years ago
Jason Ish	9b86c7c5c0	defrag: break out of loop in linux profile when able to	7 years ago
Jason Ish	aa98678662	defrag: remove fragments that have complete overlap ... Instead of just marking fragments that have been completely overlapped and won't be part of the assembled packet, remove them from the fragment tree when detected.	7 years ago
Jason Ish	fe6e96a8c1	defrag: use rb tree to store fragments	7 years ago