Eric Leblond
6b9d1012ff
Transform inet_ntop call into PrintInet one.
14 years ago
Victor Julien
75439863ed
Shrink PacketAlerts structure so that Packet structure is a lot smaller. Reduce max events per packet from 256 to 15.
14 years ago
Victor Julien
a5d9c86dd3
Shrink Flow structure with 20 bytes (on 32 bit) and reorder it. Clean up init, recycle, destroy macro's.
14 years ago
Anoop Saldanha
fe6e41e3ef
Removed FLOW_AL_NO_APPLAYER_INSPECTION. Moved it as FLOW_NO_APPLAYER_INSPECTION in Flow->flags. Turned Flow->flags into uint32_t and removed Flow->alflags
14 years ago
Anoop Saldanha
ac5584a863
Removed FLOW_AL_PROTO_DETECT_DONE. Replaced it with FLOW_ALPROTO_DETECT_DONE, stored it in Flow->flags
14 years ago
Victor Julien
864c8718e1
Store matching stream msg (ptr) in packets alert structure so it's available to the output plugins.
15 years ago
Victor Julien
6f58ef13c4
Improve error cleanup in output function. Thanks to iswalker.
15 years ago
Eric Leblond
dd038c1906
Modify files to avoid direct pckt payload access
...
This patch implements the needed modification of payload access
in a Packet structure to support the abstraction introduced by
the extended data system.
15 years ago
Victor Julien
d48ff8f6aa
Extend 'append' option to stats.log as well. Small cleanups.
15 years ago
Gurvinder Singh
f4392e1dcc
added support for appending the log files
15 years ago
Gurvinder Singh
ba18110abd
support for stats.log configurable and fixed timezone issue in faslog and debuglog
15 years ago
Victor Julien
39cb1bdbda
Fix app layer sigs being recognized as decoder event only or ip only.
15 years ago
Victor Julien
d41b5645ef
Make sure decoder event rules are inspected even if the packet is invalid and has no addesses or proto. Update fast log and alert debug log to display the alerts. Fixes #179 .
15 years ago
Gurvinder Singh
8852b83fa7
flowbits, flowvars, pktvars, flow flags and app layer info added to alert-debug.log
15 years ago
Victor Julien
4e7df60b2f
Make pcap file mode read multiple packets per 'read'. Update threading model to deal with this.
15 years ago
William Metcalf
2eef905c07
GPL and Copyright header updates.
15 years ago
Gerardo Iglesias Galvan
9f4fae5b1a
Fix inconsistent use of dynamic memory allocation
15 years ago
Victor Julien
6dd5446893
Use proper tcp/udp macro's in alert-debuglog
15 years ago
Victor Julien
cc5c78dae9
Add tcp seq info and pcap file packet number to the alert-debuglog.
15 years ago
William Metcalf
ce01927515
Import of GPLv2 Header 050410
15 years ago
Victor Julien
070ed778b8
Libcap-ng support by Gurvinder Singh and myself. Basic support for per thread caps is added, but not activated as it doesn't seem to work yet. Work around for incompatibility between libnet 1.1 and libcap-ng added.
15 years ago
Victor Julien
2dd28ea7fd
Use threadsafe time functions.
15 years ago
Victor Julien
eeb98c6900
Move SCSetThreadName to proper functions.
15 years ago
Gerardo Iglesias Galvan
9f35a24a1f
Set threads name. Fix bug #83
15 years ago
Jason Ish
40f9653c06
Have output plugs use an OutputCtx which is a little more generic than LogFileCtx. The OutputCtx provides a place for module private data to avoi overriding the LogFileCtx.
16 years ago
Victor Julien
dd846c9b0e
Remove all search code from the pattern matchers, cleanup mpm api, remove unused http code, more cleanups.
16 years ago
Pablo Rincon
25a3a5c6d8
Adding mem wrapper to debug runtime alloc()/free() functions. Fixing some memory leaks.
16 years ago
Pablo Rincon
cef12d30b5
Unified output fixes: alert count per module (not per thread), fix timestamps on pcap mode, write *all* the alerts of a packet, write the log header once also on unified alert
16 years ago
Steve Grubb
f6653752c5
memory leak cleanup in alerts
...
Hello,
I ran the code through an analysis program and found several memory leaks
in the alert code.
*In src/alert-fastlog.c at line 178, aft was not being freed
*In src/alert-debuglog.c at line 205, aftwas not being freed
*In src/alert-unified-log.c at lines 234 and 243, aun was not being freed
*In src/alert-unified-alert.c at lines 219 and 230, aun was not being freed
*In src/alert-unified2-alert.c at line 505, aun was not being freed
The patch below fixes this.
-Steve
16 years ago
Jason Ish
095f2cf6ef
Consistency fix.. Xxxlog -> XxxLog.
16 years ago
Jason Ish
e204d07717
Have output modules register themselves so run mode configurator becomes aware of them for purposes of being configured from the config file.
16 years ago
Jason Ish
844c444af1
Use the configuration file to setup alert logging (and http logging).
...
Only setup for the live pcap modes at the moment.
16 years ago
Anoop Saldanha
8189f4d88e
Change error log messags to debug ones in the log modules
16 years ago
Victor Julien
9e5f7459c2
Actually use classification msg
16 years ago
Anoop Saldanha
4d430060d2
fix for unclear error messages bug 15
16 years ago
Victor Julien
ecf86f9c23
Rename to Suricata.
16 years ago
Pablo Rincon
e26833be3f
Changing mutex/spinlocks/conditions naming types
16 years ago
Pablo Rincon
769022f4be
Adding support for Mac OS X, FreeBSD, centrailizing mutex/spins/conditions in a macro API, and some unittests
16 years ago
Pablo Rincon
15855e11f3
Fixing alert unified log file rotation. Adding unittests
16 years ago
Gurvinder Singh
40b8afdd56
support for thread exit constants
16 years ago
Pablo Rincon Crespo
a84cc38bc9
Preparing multithreading support for alert modules and logfilectx
16 years ago
Victor Julien
968d8df12b
More logging API usage. Changed logging macro's slightly so the vars inside them won't conflict with vars used by the calling function.
16 years ago
Victor Julien
0d0ffb9963
Reorganize header inclusions.
16 years ago
Victor Julien
a39108843e
Small tm module API rename to reflect that Init/Deinit/ExitPrintStats are per thread calls.
16 years ago
Jason Ish
e3b538c7d7
Simple configuration API.
...
Allow the log directory to be changed.
16 years ago
Brian Rectanus
fa5939ca91
64 bit cleanup part2
16 years ago
Victor Julien
7c36b315fd
Kill the engine if one of the threads fails to initialize.
16 years ago
Victor Julien
689bbfdc45
Rename all structure definitions in the "typedef struct _SomeStruct" format to "typedef struct SomeStruct_" to make the Doxygen output more useful.
...
Remove the Trie multi pattern matcher code. It wasn't used anymore.
16 years ago
Victor Julien
51a9e36e10
Remove vips references. Rename to eidps.
16 years ago
Victor Julien
8397413942
Comment updates.
16 years ago