5800 Commits (e2c557cfdb48ac13ed535ee672d49d58b5a772c5)

 

All Branches   

Search

Author	SHA1	Message	Date
Eric Leblond	e2c557cfdb	suri-graphite: fix port option ... If port is specified on command line we need to convert it as an integer before using it as argument to connect.	10 years ago
Victor Julien	1e8142c699	logfile: rename ALERT_ types to LOGFILE_TYPE_	10 years ago
Eric Leblond	4c6a7bea30	output-json: suppress global variable ... It uses the new type field in the LogFileCtx instead. This fixes the problem of not being able to use two eve-json instance with different logging methods.	10 years ago
Eric Leblond	636e3d93c0	log file: add type flag ... It will be used to store if the file is syslog or a real file.	10 years ago
Eric Leblond	7d73db9b80	suricata.yaml: fix the name of EVE module ... It is netflow and not newflow.	10 years ago
Eric Leblond	39d667ff56	output-json: fix type of data parameter ... The cast of data to AlertJsonThread was not correct as the real type of the void pointer is a OutputJsonCtx. This was working by luck because they both have a file_ctx as first element.	10 years ago
Alexander Gozman	f11e237d77	Feature #1440: support wildcards in rule filenames	10 years ago
David Cannings	4f8f53d080	Fix rcode parsing, as noticed by Coverity. ... Without support for OPT RR from RFC6891 (Extension mechanisms for DNS) values of RCODE above 15 are not possible. Remove dead code which will never match.	10 years ago
Jason Ish	9fdae82815	conf - process includes even if not at root node.	10 years ago
Jason Ish	56f6e37304	radix-tree - prevent out of bounds array access ... An IPv6 entry specified before an IPv4 entry on the host-os-policy table can cause the stream byte array to be access one byte after the end of the allocated memory at util-radix-tree.c:578.	10 years ago
Jason Ish	3e5b8f48b1	Bug 1281 - Add tests for rule content of lengths > 255.	10 years ago
Jason Ish	e2b04635a7	Bug 1281 - Accept rule content with lengths greater than 255.	10 years ago
Victor Julien	0e22e95e47	alert-json: fix stream logging for IPS mode ... Switch direction in IPS mode.	10 years ago
Victor Julien	5037ea93f3	threads: add untimed control cond call ... The control conditions so far could only do timed waits, not normal waits.	10 years ago
Victor Julien	c7bc9ae6a8	detect: minor cleanups	10 years ago
Victor Julien	bc2b53f10b	parsing: s/strtok/strtok_r/g ... Remove all strtok uses and replace them by strtok_r. Do the same for Windows builds. Cygwin builds fine with strtok_r. Add strtok to banned function list.	10 years ago
Victor Julien	fb479902e4	threading: explain purpose of threadvars mucond	10 years ago
Victor Julien	478719ee9d	flow: don't hold tv_root_lock longer than needed ... Don't hold it longer than needed in shutting down.	10 years ago
Victor Julien	c96805e839	threading: remove unused cmd thread create func	10 years ago
Victor Julien	df5e9d44ca	unix-manager: convert to thread module ... Sync command thread for unix manager with other managers and make it a full thread module.	10 years ago
Victor Julien	cc01b5f6b6	reference/classification: call global init for unittests	10 years ago
Victor Julien	34f2ff067b	reference: update pcre globals use ... Don't update globals each time we parse, but instead do it once at startup.	10 years ago
Victor Julien	46d401e3bb	classification: update pcre globals use ... Don't update globals each time we parse, but instead do it once at startup.	10 years ago
Victor Julien	b2da57c827	reference: remove global	10 years ago
Victor Julien	393689ce44	classification: remove global from parsing ... Parsing code used a 'fd' global. Remove this.	10 years ago
Victor Julien	9764a35604	stream: fix --disable-detection reassembly issue ... Due to an error at initialization, the stream engine would not disable 'raw' reassembly automatically when --disable-detection was used. This lead to segments not getting cleared from the segment lists.	10 years ago
Victor Julien	c1558f5ac4	stream: remove FLOW_NO_APPLAYER_INSPECTION flag ... Instead, intruduce StreamTcpDisableAppLayer to disable app layer tracking and reassembly. StreamTcpAppLayerIsDisabled can be used to check it. Replace all uses of FlowSetSessionNoApplayerInspectionFlag and the FLOW_NO_APPLAYER_INSPECTION.	10 years ago
Victor Julien	b6798495c5	stream: remove FLOW_NO_APPLAYER_INSPECTION use from tests	10 years ago
Victor Julien	b2e1854e2a	stream: improve 'no app layer' handling ... When the session/flow was flagged as 'no applayer inspect', which could happen as a result various reasons, packets would still be considered by the app layer reassembly. When ACK'd, they would be removed again. Depending also on the raw reassembly. In very long sessions however, this meganism could fail leading to virtually endlessly growing segment lists. This patch makes sure that segments that come in on a 'no app layer' session are tagged properly or even not added at all. Use a new ssn flag instead of flow flag for no app tracking.	10 years ago
Victor Julien	22a810813c	app-layer: add DisableAppLayer ... Move various app layer related flag setting calls into a utility function "DisableAppLayer"	10 years ago
Victor Julien	f536099a67	app-layer: de_state optimization ... Add API to bypass expensive TX list walks. This API call is optional. Implement it for HTTP and DNS.	10 years ago
Victor Julien	5f0678120d	detect-state: update test to check state storing	10 years ago
Victor Julien	37f0bd57b6	detect-state: handle duplicate inspect/match ... If for a packet we have a TX N that has detect state and a TX N+1 that has no detect state, but does have 'progress', we have a corner case in stateful detection. ContinueDetection inspects TX N, but cannot flag the rule in the de_state_sig_array as the next (TX N+1) has already started and needs to be inspected. 'StartDetection' however, is then unaware of the fact that ContinueDetection already inspected the rule. It uses the per session 'inspect_id' that is only moved forward at the end of the detection run. This patch adds a workaround. It uses the DetectEngineThreadCtx:: de_state_sig_array to store an offset between the 'base' inspect_id and the inspect_id that StartDetection should use. The data type is limited, so if the offset would be too big, a search based fall back is implemented as well.	10 years ago
Victor Julien	bc6e4140be	detect: add de_state duplication check ... Add test to check if no duplicate destate is created. Only enabled with DEBUG_VALIDATION.	10 years ago
Victor Julien	9d198e6662	detect-state: fix state storing ... Fix storing state and bypassing detection. Previously we'd store on a match only, meaning that StartDetection would rerun often. Make sure StartDetection only stores if there is something to store.	10 years ago
Victor Julien	359e2d68f5	detect-http-header: improve buffer handling ... Previously we could never be calling DetectEngineHHDGetBufferForTX for TX N and then afterwards for TX N - 1. Due to changes in the stateful detection code this is now possible. This patch changes the buffer logic to take the 'inspect_id' as it's base, instead of the first transaction that we are called with.	10 years ago
Victor Julien	62e937672d	detect-events: set SIG_MASK_REQUIRE_*_STATE for events ... Set SIG_MASK_REQUIRE_*_STATE for event rules to earlier discard them.	10 years ago
Victor Julien	8d0b090150	engine-analysis: print fast_pattern summary ... When using engine analysis for print fast_pattern stats, print a short summary at the end containing per buffer: - smallest fp - biggest fp - number of patterns - avg fp len	10 years ago
Victor Julien	21f9328989	lua: fix error handling	10 years ago
Victor Julien	52195a4192	http: add event for leading spaces on request line ... Libhtp will issue a warning in this case, so we can match on this. This patch adds event, rule and unittest.	10 years ago
Victor Julien	2f85308afe	threads: fix missing unlock in error handling ... If TmThreadsUnregisterThread was called with out of range 'id', a lock would not be cleared after returning from the function. ** CID 1264421: Missing unlock (LOCK) /src/tm-threads.c: 2186 in TmThreadsUnregisterThread()	10 years ago
Victor Julien	0e2a4c01ba	Update changelog for 2.1beta4 release	10 years ago
Eric Leblond	0303245761	af-packet: use max packet size as snaplen ... If default_packet_size is set to 0, then we use the maximum packet size as snaplen.	10 years ago
Eric Leblond	43f691fef8	util-device: fix LiveBuildDeviceListCustom ... The code was assuming that the dictionnary containing the parameter of a interface was ordered. But for YAML, the order is not assumed so in case the configuration is generated we may not be able to parse correctly the configuration file. By iterating on child on main node and then iterating on subchild and doing a match on the name, we are able to find the interface list. In term of code, this algorithm was obtained by simply removing the test on the name of the first child.	10 years ago
Eric Leblond	268285c49f	output-json-http: output status as an integer ... HTTP status is an integer and it should be written as such in the JSON events. This will allow to have improved matching in log analysis tools.	10 years ago
Eric Leblond	da98b0b84f	coccinelle: update struct flags test	10 years ago
Eric Leblond	58582df1c6	decode-der: decode DC keyword ... 'DC' is used by some certificates and it was not currently translated to a string.	10 years ago
Giuseppe Longo	26ba647d58	filedata: read inspected tracker settings from suricata.yaml	10 years ago
Giuseppe Longo	4b5848616f	filedata: implement inspected tracker	10 years ago
Giuseppe Longo	1f52410d0f	UT: implement tests for inspection code	10 years ago