Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.

cybersecurityidsintrusion-detection-systemintrusion-prevention-systemipsnetwork-monitornetwork-monitoringnsmsecuritysuricatathreat-hunting

You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Victor Julien 0b68da0b31 libhtp: don't use internal iterator ... It violates thread safety. #601. Suricata assures thread safety on the flow level for HTTP tracking. Part of the flow is (in case of HTTP) libhtp's htp_connp_t state. At startup the libhtp glue layer, app-layer-htp initializes as many htp_cfg_t instances as there are libhtp server configurations in the yaml. At HTTP session start, we look up the proper htp_cfg_t based on the server ip and pass it to htp_connp_create. A ptr to the relevant htp_cfg_t is part of the htp_connp_t. The htp_cfg_t contains "hooks". The are registered based on yaml config at init time. The hooks have lists of type list_t. The list is run with a built in iterator. The iterator is reset at the start of each "hook_run_all". Since multiple flows share the same htp_cfg_t flow A can reset the iterator while flow B is using it. The flow lock has no effect as flows share the htp_cfg_t. This has been observed in real traffic. hook_response_body_data was run on the same data multiple times, leading to corrupt extracted files.		14 years ago
benches	Initial add of the files.	17 years ago
contrib/file_processor	Included Action::Syslog by default in config	15 years ago
doc	Clean up and update bundled docs	14 years ago
libhtp	libhtp: don't use internal iterator	14 years ago
m4	Prelude plugin: add detection in configure script	17 years ago
qa	coccinelle: add test on malloc error check.	14 years ago
rules	decode: decode IPv6-in-IPv6	14 years ago
src	Fix/suppress a couple of harmless compiler warnings.	14 years ago
.gitignore	Import .gitignore file.	16 years ago
COPYING	Initial add of the files.	17 years ago
ChangeLog	Update changelog to reflect 1.4beta2 changes	14 years ago
LICENSE	import of gplv2 LICENSE	17 years ago
Makefile.am	Add threshold.config example to EXTRA_DIST as well.	14 years ago
Makefile.cvs	Initial add of the files.	17 years ago
acsite.m4	Added C99 defs/macros to acsite.m4 for CentOS	17 years ago
autogen.sh	autotools: error on autoreconf is an error	14 years ago
classification.config	Import of classification.config	17 years ago
configure.ac	nfq: fix detection of type nfq_get_payload function.	14 years ago
doxygen.cfg	doxygen: generate doc for acquisition modules	14 years ago
mkinstalldirs	Update autojunk.sh + build update.	17 years ago
reference.config	Add md5 to reference.config.	15 years ago
suricata.yaml.in	yaml: default to cluster_flow type for AF_PACKET and PF_RING	14 years ago
threshold.config	threshold: improve comments of shipped threshold.config, add links to wiki.	14 years ago