7164 Commits (1f2f1d70634221c637685b43fe50541ca7d52267)

 

All Branches   

Search

Author	SHA1	Message	Date
Jason Ish	f97c045bf1	doc: runmodes	9 years ago
Jason Ish	38bf0df6f0	doc: rule profiling	9 years ago
Jason Ish	fc9d621921	doc: packet profiling	9 years ago
Jason Ish	7b8aa62463	doc: statistics	9 years ago
Jason Ish	2574415a2d	doc: tuning considerations	9 years ago
Jason Ish	2354987171	doc: high performance config	9 years ago
Jason Ish	ab69c93a28	doc: making sense of alerts	9 years ago
Jason Ish	6136ec583f	doc: oinkmaster	9 years ago
Jason Ish	5e0c39be57	doc: snort compatibility	9 years ago
Jason Ish	4f9f9c09ec	doc: command line options	9 years ago
Jason Ish	80e6830dec	doc: restructure directory layout	9 years ago
Jason Ish	b0c2d6c8ee	doc: restructure the rules section a little	9 years ago
Jason Ish	7c9475e94d	doc: add fixme to broken images	9 years ago
Jason Ish	b1bc0038ae	doc: finish off the rules section	9 years ago
Jason Ish	98f56f9916	doc: dnp3 keywords	9 years ago
Jason Ish	9dea001c7d	doc: modbus keyword	9 years ago
Jason Ish	082758deae	doc: rule profiling	9 years ago
Jason Ish	30f3ecf223	doc: normalized buffers	9 years ago
Jason Ish	75662a16da	doc: tls keywords	9 years ago
Jason Ish	58691fbb48	doc: live rule swap	9 years ago
Jason Ish	107c12afd6	doc: adding your own rules	9 years ago
Jason Ish	3366571eeb	doc: rule lua scripting	9 years ago
Jason Ish	1e6df87ecb	doc: rule lua scripting	9 years ago
Jason Ish	62e0f6a3e3	doc: thresholding	9 years ago
Jason Ish	b3b5e333e4	doc: file-keywords	9 years ago
Jason Ish	5537c0f63c	doc: flowint	9 years ago
Jason Ish	5f9d265fdf	doc: flow-keywords	9 years ago
Jason Ish	0c602c5f19	doc: pcre	9 years ago
Jason Ish	7c36361aac	doc: helper tool to convert from wiki to sphinx	9 years ago
Jason Ish	3f2b1277d1	doc: header-keywords	9 years ago
Jason Ish	33e96c5087	doc: fast-pattern	9 years ago
Jason Ish	a464573230	doc: payload-keywords	9 years ago
Jason Ish	6d7c0e8274	docs: sample of sphinx docs	9 years ago
Jason Ish	1f4725fcab	detect-tls: make check on fingerprint directional	9 years ago
Jason Ish	44c846f2f8	tls-json: make tls events direction sensitive ... Previously the src/dest ips in TLS events would differ between IDS and IPS modes. Make the header creation direction sensitive so they are identical in both modes.	9 years ago
Mats Klepsland	c0f93503b7	util-decode-der-get: fix coverity warning ... *** CID 1373380: Control flow issues (DEADCODE) /src/util-decode-der-get.c: 126 in UtctimeToTime() 120 year = strtol(yy, NULL, 10); 121 if (year >= 50) 122 snprintf(buf, sizeof(buf), "%i%s", 19, utctime); 123 else if (year < 50) 124 snprintf(buf, sizeof(buf), "%i%s", 20, utctime); 125 else >>> CID 1373380: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "goto error;". 126 goto error; 127 128 time = GentimeToTime(buf); 129 if (time == -1) 130 goto error; 131	9 years ago
Victor Julien	d6f051cdf9	http: removed unused flags	9 years ago
Eric Leblond	a194dfbd5b	app-layer: tx counter implementation ... This patch adds a transaction counter for application layers supporting it. Analysis is done after the parsing by the different application layers. This result in new data in the stats output, that looks like: ``` "app-layer": { "tx": { "dns_udp": 21433, "http": 12766, "smtp": 0, "dns_tcp": 0 } }, ```	9 years ago
Giuseppe Longo	675fa56497	app-layer: add ThreadVars to AppLayerParserParse ... To be able to add a transaction counter we will need a ThreadVars in the AppLayerParserParse function. This function is massively used in unittests and this result in an long commit.	9 years ago
Giuseppe Longo	5908dd0804	app-layer: add flow counters ... This adds per flow counters for all supported protocols. This results in new data in stats output that looks like: ``` "app-layer": { "flow": { "http": 9310, "ftp": 0, "smtp": 0, "tls": 71, "ssh": 0, "imap": 0, "msn": 0, "smb": 170, "dcerpc_udp": 0, "dns_udp": 870, "dcerpc_tcp": 2, "dns_tcp": 0 }, }, ```	9 years ago
Eric Leblond	398489e6df	stream: fix depth reached detection ... When a segment only partially fit in streaming depth, the stream depth reached flag was not set resulting in a continuous inspection of the rest of the session. By setting the stream depth reached flag when the segment partially fit we avoid to reenter the code and we don't take anymore a code path resulting in the flag not to be set.	9 years ago
Mats Klepsland	dc8e0b3cf2	detect: add detect engine for tls validity keywords ... Add detect engine for tls validity keywords (tls_cert_notbefore and tls_cert_notafter).	9 years ago
Mats Klepsland	d91664d67a	detect-dns: move DetectEngineInspectGenericList to detect-engine.c ... Move DetectEngineInspectGenericList from detect-engine-dns.c to detect-engine.c to enable it to be used other places as well.	9 years ago
Mats Klepsland	cad638697d	lua: add lua functions for certificate validity dates ... Add functions TlsGetCertNotBefore and TLSGetCertNotAfter to get notBefore and notAfter fields from TLS certificate in lua scripts.	9 years ago
Mats Klepsland	67ea821521	util-lua: add (wrapper) function to push integer to lua scripts	9 years ago
Mats Klepsland	ee24949065	log-tls: add notBefore and notAfter fields to extended output ... Add notBefore and NotAfter fields from TLS certificate to extended tls log output.	9 years ago
Mats Klepsland	5b230bbce5	output-json-tls: add notBefore and notAfter fields to extended output ... Add notBefore and notAfter fields from TLS certificate to extended JSON output.	9 years ago
Mats Klepsland	ac4e308140	util-time: add function to create a UTC time string ... Add function CreateUtcIsoTimeString to create a UTC time string.	9 years ago
Mats Klepsland	ea5696812f	detect: add tls_cert_notbefore and tls_cert_notafter keywords ... Detection plugin for TLS certificate fields notBefore and notAfter. Supports equal to, less than, greater than, and range operations for both keywords. Dates can be represented as either ISO 8601 or epoch (Unix time). Examples: alert tls [...] tls_cert_notafter:1445852105; [...] alert tls [...] tls_cert_notbefore:<2015-10-22T23:59:59; [...] alert tls [...] tls_cert_notbefore:>2015-10-22; [...] alert tls [...] tls_cert_notafter:2000-10-22<>2020-05-15; [...]	9 years ago
Mats Klepsland	c49cb05399	util-time: add function to parse a date string based on patterns ... Add function SCStringPatternToTime to parse a date string based on an array of pattern strings.	9 years ago