8196 Commits (e62c75335ee760dcaadd496e95284b5f954d0727)

Author	SHA1	Message	Date
Victor Julien	e62c75335e	detect/http-ua: test cleanups	7 years ago
Victor Julien	33b81f7439	detect: add verbosity of --list-keywords ... Add indicators of content modifier or sticky buffer, and also allow registering an alternative to a keyword.	7 years ago
Victor Julien	d3e953e5f2	detect: switch keyword flags u16	7 years ago
Victor Julien	eb73008ccf	detect/transform: add to_sha1 keyword	7 years ago
Victor Julien	75f9c1ae9f	detect/transform: add to_md5 keyword	7 years ago
Victor Julien	42d22ddb2a	unittests: add signature parse test helper	7 years ago
Victor Julien	705d3b6130	Open 5.0.0-dev branch	7 years ago
Victor Julien	7f38ffc8bc	log/stats: fix formatting of long decoder events	7 years ago
Jingyu Yang	bb26e6216e	source-pcap:set PktAcqBreakLoop as pcap_breakloop	7 years ago
Victor Julien	d8634daf74	stream: fix false negative on bad RST ... If a bad RST was received the stream inspection would not happen for that packet, but it would still move the 'raw progress' tracker forward. Following good packets would then fail to detect anything before the 'raw progress' position. Bug #2770 Reported-by: Alexey Vishnyakov	7 years ago
Victor Julien	fb18a1655c	eve.stats: warn that output might miss decoder-events	7 years ago
Victor Julien	0d86263efd	eve.stats: make decoder event prefix configurable	7 years ago
Victor Julien	932c2a7ec5	eve: fix missing decoder-events in stats ... In the eve log the decoder events are added as optional counters. This behaviour is enabled by default. However, lots of the counters are missing, as the names colide with other counters. E.g. decoder.ipv6 counts ipv6 packets decoder.ipv6.unknown_next_header counts how often an unknown next header is encountered. In this example 'ipv6' would be both a json integer and a json object. It appears that jansson favours the first that is generated, so the event counters are mostly missing. This patch registers them as 'decoder.events.<event>' instead. As these names are generated on the fly, a hash table to contain the allocated strings was added as well.	7 years ago
Victor Julien	0f1fc1f0c8	hash: move string hash funcs into util files	7 years ago
Victor Julien	c140505bec	decoder: add gre over ipv6 support	7 years ago
Victor Julien	8709a20d94	af-packet: minor code cleanups	7 years ago
Victor Julien	c99dc5a7bf	af-packet: re-enable sync for tpacket v2 ... Synchronize start was disabled for v2 when v3 was introduced, without a reason being given. Re-enable as v2 will otherwise also start reading packets before the other threads are set up. This will lead to hashing issues. Part of bug #2788.	7 years ago
Victor Julien	cebbe06f70	af-packet: fix sync start for tpacket v3 ... The tpacket-v3 implementation of the synchonize start logic would not correctly consider the timestamp parameter, leading to threads starting before synchronization between threads was complete. Bug #2788	7 years ago
Alexander Gozman	03af3e1ed8	nfqueue: inject fake packet on timeout ... Fixes nfqueue and delayed-detect. On systems with small amount of traffic (or with no traffic at all) nfqueue with 'delayed-detect' enabled hanged in 'workers' mode. Bug #2362.	7 years ago
Eric Leblond	0e3b1eba86	util-binsearch: remove the files	7 years ago
Travis Green	6f5eb487a1	doc: add missing and fix 404 for --list-keywords	7 years ago
Travis Green	c2adb9e669	doc: added tos keyword ... Redmine issue: https://redmine.openinfosecfoundation.org/issues/2583	7 years ago
Philippe Antoine	7fca771ef4	Fixes other affected tests for smtp pipelining ... Either checking state has pipelining Or removing pipelining from input	7 years ago
Philippe Antoine	447c1042f4	smtp: improve pipelining support ... Fixes #1863	7 years ago
Victor Julien	8357ef3f8f	proto/detect: workaround dns misdetected as dcerpc ... The DCERPC UDP detection would misfire on DNS with transaction ID 0x0400. This would happen as the protocol detection engine gives preference to pattern based detection over probing parsers for performance reasons. This hack/workaround fixes this specific case by still running the probing parser if DCERPC has been detected on UDP. The probing parser result will take precedence. Bug #2736.	7 years ago
Victor Julien	11f3659f64	teredo: be stricter on what to consider valid teredo ... Invalid Teredo can lead to valid DNS traffic (or other UDP traffic) being misdetected as Teredo. This leads to false negatives in the UDP payload inspection. Make the teredo code only consider a packet teredo if the encapsulated data was decoded without any 'invalid' events being set. Bug #2736.	7 years ago
Victor Julien	e30212c5d8	detect: fix crash during startup with malformed yaml ... detect-engine: custom-values: toclient-groups: 200 toserver-groups: 200 Bug #2745	7 years ago
Victor Julien	4c8f6b2246	offloading: on bsd, disable rxcsum and v6 variants	7 years ago
Victor Julien	fa6b73d1c9	offloading: don't set multiple times per interface ... This could happen with netmap igb0->igb0^ IPS mode.	7 years ago
Victor Julien	ad1945aae4	detect: fix content inspection flags ... Fix generic inspect function content inspection flags so that streaming buffers work correctly.	7 years ago
Victor Julien	394e115036	detect/rawbytes: improve error message plus do minor cleanups	7 years ago
Victor Julien	f336ba3217	detect/file-data: fix enabling http body tracking	7 years ago
Victor Julien	3eec088d31	detect/parse: error out on unused sticky buffers	7 years ago
Victor Julien	b36e921cf9	detect/prefilter: add closing debug return statement	7 years ago
Victor Julien	3a057c5f54	capture: fix mtu plus sign names for non-netmap ... Bug #2502.	7 years ago
Victor Julien	31f81429c2	stats: more accurate interval handling ... In the stats loop sleep for a time period more closely matching the stats.interval setting. Fix an off by one that would make the loop wake up ~1 second early. Bug #2716	7 years ago
Jason Ish	d03a5be118	dns json v2 (C) - log rrtype in response ... Redmine issue: https://redmine.openinfosecfoundation.org/issues/2723	7 years ago
Jason Ish	87250da0fc	rust/dns: add v1 dns logging ... Redmine issue: https://redmine.openinfosecfoundation.org/issues/2704	7 years ago
Victor Julien	9d36182b74	unix: fix deadlock in unix runmode on many cores ... Same issue as in 7f8795c756, with the solution now also applied to the unix socket runmode. Bug #2734	7 years ago
Victor Julien	8d2883f3fa	output/tx: fix multi-instance logger output ... Fix transactions not being logged after the first tx logger had logged.	7 years ago
Victor Julien	0e40231189	app-layer: improve transaction cleanup handling ... The app layers with a custom iterator would skip a tx if during the ..Cleanup() pass a transaction was removed. Address this by storing the current index instead of the next index. Also pass in the next "min_tx_id" to be incremented from the last TX. Update loops to do this increment. Also make sure that the min_id is properly updated if the last TX is removed when out of order. Finally add a SMB unittest to test this. Reported by: Ilya Bakhtin	7 years ago
Victor Julien	d34e41068f	app-layer: fix tx tracking updates in tx cleanup ... Fix min_id not getting updated in all cases. Reported by: Ilya Bakhtin	7 years ago
Victor Julien	e62e4bdc49	app-layer: add debug statements to tx cleanup logic	7 years ago
Victor Julien	37203c98a1	unittests/app-layer: add helper to get app tx trackers	7 years ago
Eric Leblond	f3be8eaaf4	detect-depth: remove semi coma from desc ... It was breaking the CSV export.	7 years ago
Eric Leblond	8c1b16e22d	doc: fix some links in list-keywords command	7 years ago
Eric Leblond	64df672cf7	util-bpf: workaround OpenBSD old libpcap ... OpenBSD is not using a pcap_compile_* function so we can just comment the code for OpenBSD users.	7 years ago
Eric Leblond	6853683085	af-packet: remove unused field in AFPThreadVars	7 years ago
Eric Leblond	6bfecd6906	af-packet: remove years old todos	7 years ago
Eric Leblond	017acaa465	netmap: use custom BPF compile function	7 years ago