9010 Commits (1b0b74dc1610bf27a035acb878e416fc61fdf81f)

 

All Branches   

Search

Author	SHA1	Message	Date
Mats Klepsland	48a5ea9df0	detect-tls-cert-serial: add content validation callback ... Validate that the content that follows the 'tls_cert_serial' keyword is on the correct form. If it's longer than two bytes it should be separated by colons.	7 years ago
Max Fillinger	ce270a8f6a	Add info about pcap log compression to user guide	7 years ago
Max Fillinger	58e92392ea	configure: Show installation info for liblz4 if not found	7 years ago
Max Fillinger	b85a0b188b	Add an option for compressing pcap-log files ... Introduces the option 'outputs.pcap-log.compression' which can be set to 'none' or 'lz4', plus options to set the compression level and to enable checksums. SCFmemopen is used to make pcap_dump() write to a buffer which is then compressed using liblz4.	7 years ago
Eric Leblond	6062c27eb7	af-packet: kill some white spaces	7 years ago
Eric Leblond	75b6972cfd	util-ioctl: fix a typo in setter message	7 years ago
Eric Leblond	f53e687bb8	af-packet: dump counters when timeout occurs ... When traffic is becoming null (mainly seen in tests) we reach the situation where there is timeouts in the poll on the socket and only that. Existing code is then just looping on the poll and the result is that the packet iface counters are not updated. This patch calls the dump counter function to be sure to get the counter right faster (and not only right at exit).	7 years ago
Jason Ish	e048a74ecd	rules: set default rule dir to suricata-update if bundled ... If suricata-update is bundled, set the default-rule-dir to lib/suricata/rules under the $localstatedir For now use 2 rule-files section that are renamed depending on if suricata-update is bundled or not.	7 years ago
Jason Ish	732ce3f123	install-rules: use suricata-update if available ... If Suricata update was bundled, use it for "install-rules" instead of curl or wget.	7 years ago
Jason Ish	b9e083a703	python: put some defaults on suricata.config.defaults ... This is a module that can contain installation default. For now it includes the sysconfdir, and rules data directory for use by suricata-update.	7 years ago
Jason Ish	7bf490062c	rules: install to $datadir/suricata/rules ... Common /usr/share/suricata/rules or /usr/local/share/suricata/rules. The rules provided by the distribution are installed here as part of the Suricata install process so will always be installed, even without the use of install-rules.	7 years ago
Victor Julien	de6fcb7c92	wirefuzz: add 'quiet' mode ... Adds -q commandline option to force quiet operation.	7 years ago
Victor Julien	8a5710307d	hyperscan: don't abort on payloads > 64k ... SPM API was recently updated to accept 32 bit length fields instead of 16 bits. This could trigger a BUG_ON in the hyperscan implementation.	7 years ago
Victor Julien	a5de9968dd	gcc8: fix format truncation warnings	7 years ago
Eric Leblond	f79f64097e	configure: fix error hw timestamp check ... This fixes #2469	7 years ago
Victor Julien	5faaa5dceb	file_data/http: inspect cleanup	7 years ago
Eric Leblond	1d0727d85f	stream-tcp: fix stream depth computation ... The stream depth computation was partly done with the stream_config depth instead of using the value in the TCP session. As a result, some configuration were resulting in abnormal behavior. In particular, when stream depth was 0 and the file store depth was not 0, Suricata was stopping the streaming on the flow as soon as the filestore was started. Reported-by: Pascal Delalande <pdl35@free.fr>	7 years ago
Eric Leblond	1012fc4466	file: update logger API to log direction ... By adding the flow direction to the logger we can have an accurate logging of fileinfo events that has source and destination IP correctly set.	7 years ago
Eric Leblond	2515c8927b	app-layer-ftp: fill direction of transfer ... This is required to return the file when asked with one direction.	7 years ago
Maurizio Abba	d2bf7a3ba9	detect: fix buffer length to uint32 ... There is a difference in the size of the buffer length as passed from the content buffers (cfr HttpReassembledBody.buffer_len) and the buflen variable passed to mpm primitives. This can cause a misdetection whenever the bufferlen is multiple of 65536 (as uint16(X*65536) == 0). Increasing the buflen variable type to uint32 solves the issue (this does not cause any issue with primitives, they all accept uint32).	7 years ago
Victor Julien	2e8fd612a6	files: properly close files on flow timeout ... If a file transfer stops on flow timeout, it won't be closed or truncated. This patch makes sure that in such cases the files are indeed truncated. This fixes the filestore-v2 output module, as that requires a sha256 for storing the partial file correctly.	7 years ago
Victor Julien	73d94fff73	nfs4: support records wrapped in GSSAPI integrity	7 years ago
Victor Julien	53fa2af07c	nfs4: fix attr parsing corner case	7 years ago
Victor Julien	39489bc5fd	nfs4: implement COMMIT parsing and handling	7 years ago
Victor Julien	c7cb01b636	nfs4: parse GSSAPI init	7 years ago
Victor Julien	bfa60753f9	nfs4: create link support	7 years ago
Victor Julien	06f6c15954	nfs4: initial implementation ... Implements record parsing and file extraction for READs and WRITEs. Defines all types from RFC 7530.	7 years ago
Victor Julien	75c5722b7e	nfs/rpc: add parser for GSSAPI Integrity records	7 years ago
Victor Julien	81c0b53d3f	flow: track flow for ip proto 41	7 years ago
Victor Julien	8c75a022ea	eve/netflow: only log response record if we've seen response pkts	7 years ago
Victor Julien	c662383b53	flow: track flow for ICMP ... Change packet layout to allow for expected counterpart type.	7 years ago
Victor Julien	708aad3f4a	unified2: address strict aliasing issue	7 years ago
Victor Julien	7ce77f9351	decode/ipv6: expose addr as 'struct in6_addr' as well	7 years ago
Victor Julien	49b02f8f1b	mingw: minor compile warning fixes	7 years ago
Giuseppe Longo	28849509b2	tests/detect-engine-hsbd: deinit det_ctx threads	7 years ago
Giuseppe Longo	c620fc3dc4	detect-engine: free events ... Events are stored in a detection engine but actually they are not freed.	7 years ago
Victor Julien	f461be75c5	smb: use inspect API v2 for smb keywords ... Simplies code and supports transforms.	7 years ago
Victor Julien	3854c304d8	mpm/hs: fix minor coverity warning ... CID 1428797 (#1 of 1): Unchecked return value (CHECKED_RETURN) check_return: Calling HashTableAdd without checking return value (as is done elsewhere 5 out of 6 times).	7 years ago
Victor Julien	7ea80b5c57	configure: fix small issue with libevent check	7 years ago
Eric Leblond	e249ce29bb	doc: add lua directory to Makefile	7 years ago
Victor Julien	4a90dced8e	doc/lua: small update to the usage intro	7 years ago
Eric Leblond	2546e86a16	doc: document lua function about flow var	7 years ago
Eric Leblond	0c4bf2d332	doc: add a lua support top level section ... Both output and signature are using lua. So lua functions should be displayed in a single section.	7 years ago
Eric Leblond	293b00798e	doc: document lua TLS functions	7 years ago
Pascal Delalande	e3c5784dd5	doc: minor updates (tls custom, TODO removal, ftp/smb file rules)	7 years ago
Victor Julien	e834d94fd2	detect/pktvar: clean up keyword parsing	7 years ago
Victor Julien	83bf60d897	doc: add ntlmssp, kerberos and other setup fields	7 years ago
Richard Sailer	5de77e3102	lua output: Update example script to match style of user doc examples	7 years ago
Richard Sailer	dc07c1fe13	lua output doc: Use more descriptive variable names in the examples ... This also removes the "args" parameter of the hooking functions in the examples, since this parameter is unused in all functions. It would not be very helpful anyways since 3 of the 4 functions don't get passed any parameters. The only exception is init() which gets a table containing: script_api_ver = 1	7 years ago
Richard Sailer	3307f7a94e	lua output doc: Add explaining introduction text	7 years ago