aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
5,906 Commits
8 Branches
174 Tags
225 MiB
main
main-8.0.x
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.7
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '21db5ee691'
${ noResults }
Commit Graph

5447 Commits (21db5ee691b349d3da1925b703ea5200d736e40a)

Author SHA1 Message Date
Victor Julien b99e10236c Fix a endless loop condition in the smb parser and make dcerpc parser more quiet. 17 years ago
Victor Julien 16aebe5add Fixup smb tests. 17 years ago
Kirby Kuehl 957b43b3d6 signed unsigned comparision cleanup 17 years ago
Kirby Kuehl 40a0fd5e97 fix warning 17 years ago
Kirby Kuehl 4b05bc281d fix padding bug 17 years ago
Kirby Kuehl 6aac8d55a6 reset smb bytesprocessed when complete 17 years ago
Kirby Kuehl 4dd2f621ac smb writeandx dcerpc over smb 17 years ago
Pablo Rincon 583c686170 Allowing no case options for flow keyword. Adding unittests for this 17 years ago
Victor Julien 194015c6cf Fix reject code to not send resets for all alerts. 17 years ago
William Metcalf f925ac9351 printf to logging subsys conversion for src/detect-bytejump.c 17 years ago
Gurvinder Singh 999a200bc9 pattern matcher options support 17 years ago
Pablo Rincon d0404d8447 Renaming errors with naming conventions 17 years ago
Pablo Rincon ad2c136e8f Renaming errors (naming conventions) 17 years ago
Jason Ish 8f618b2121 - actually re-inject ipv6 re-assembled packets. - set the next header. 17 years ago
Jason Ish 8570976ee0 Fix for lists that are children of another list. Fix memory leak by only setting the sequence index value to the first item found. 17 years ago
Victor Julien 501c8814b6 fix crash in urilen 17 years ago
Victor Julien ed7762e843 Disable unused jabber proto detection as it made the proto detection code look way more into the stream than without it. 17 years ago
Jason Ish 6f73aca1e8 I know Snort defaults to syslog in daemon mode, but should we? 
Stick to the logging configuration defined in the config file
in daemon mode.
 17 years ago
Jason Ish c72d6be58b Making logging configurable. If no logging outputs are defined the default will be used. - Currently per output log formatting is not available. 17 years ago
Breno Silva a857fa7170 FragOffset Rule Keyword 17 years ago
Breno Silva 7e299834d2 FragOffset Rule Keyword 17 years ago
Victor Julien f96511a8b1 Check reassembly limits against correct stream direction. Set proper direction flag in stream msgs. 17 years ago
Gurvinder Singh ed99e73622 bug 78 17 years ago
Kirby Kuehl 58c8103a4b fix unittest 17 years ago
Victor Julien 53c9276d51 Cleanup pcap output. 17 years ago
Victor Julien e0aacac4c6 Move bpf string retrieval to it's own function. Clean up pcap sourcres a bit. 17 years ago
William Metcalf ba46c16aac bpf support for pcap modes 17 years ago
Pierre Chifflier 4515ae13e4 Add Prelude output plugin 
Add support for reporting alerts to the Prelude SIEM system, using
libprelude to send IDMEF (RFC4765) messages.

Each message contains the alert description and reference (using
the SID/GID), and a normalized description (assessment, impact,
sources etc.)

libprelude handles the connection with the manager (collecting component),
spooling and sending the event asynchronously. It also offers transport
security (using TLS and trusted certificates) and reliability (events
are retransmitted if not sent successfully).

This modules requires a Prelude profile to work (see man prelude-admin
and the Prelude Handbook for help).

Signed-off-by: Pierre Chifflier <chifflier@edenwall.com>
 17 years ago
Gurvinder Singh cf5266094d bug 66 patch 17 years ago
Victor Julien 148883cedf Work around for unsupported CONNECT support handling. 17 years ago
Victor Julien 7deb4e9f09 Cleanup AppLayerDetectGetProto a bit. 17 years ago
Victor Julien fd409049cb First step for proper HTTP CONNECT handling. 17 years ago
Victor Julien 9f3f9e9ba1 Fix ipfw verdict. 17 years ago
Gurvinder Singh 3cad20946d bug 64 patch 17 years ago
Victor Julien 53977fded6 Small compilation fixes when debugging is disabled. 17 years ago
Victor Julien 6a53ab9c5a Stream engine memory handling update 
The stream engine memory handling needed updating as it didn't scale. Changes:

- pools can now be initialized to size 0, meaning unlimited
- stream engine uses a memcap setting. Sessions, segments and aldata is part
  of this, app layer state isn't.
- memory is accounted using a global int that is spinlocked.
- a counter for sessions that have not been picked up because of memcap was
  added.
- all reassembly errors are converted to debug msgs.
 17 years ago
Victor Julien df4c642c70 Fix weird compile error 17 years ago
Victor Julien b1531f7244 Manually merge Pablo's IPFW action patch. 17 years ago
Pablo Rincon 51dc773eec Changing the veredict actions to flags to allow simultaneous veredict 17 years ago
Nick Rogness 2b7b78f1bf Intial IPFW support FreeBSD and OSX 17 years ago
Jason Ish fbf03a927d Fix issue 71. The insert and re-assemble need to be done under the same tracker lock. 17 years ago
Victor Julien f7f33ec889 Fix the flow manager sleeping for way too long in some situations. 17 years ago
Kirby Kuehl 298bf4cc88 dcerpc over smb for transact 17 years ago
Victor Julien bbfe1d293e Fix merge artifact. 17 years ago
Victor Julien f08d01a8e8 Set sensible tcp timeout defaults and no longer set the timeouts from the stream engine. 17 years ago
Pablo Rincon 7f250a814a Fixing redeclaration of run_mode 17 years ago
Pablo Rincon 5592189c04 Loading flow settings from config 17 years ago
Kirby Kuehl 8efbe491a1 dcerpc refactoring 17 years ago
Kirby Kuehl 008de4321b refactor dcerpc in prep for dcerpc over smb 17 years ago
Anoop Saldanha 546e9b5f28 AddressCutNot fix for address engine ipv6 17 years ago
Anoop Saldanha e25696afce engine address ipv6 refactored 17 years ago
Gurvinder Singh d9677c7e2a bug 76 patch 17 years ago
Jason Ish 0a5bc2d600 Fix issue 74. separate initialization of run modes from adding them to a thread. - fixes issues with multiple output threads. 17 years ago
Pablo Rincon 260e581929 First version of the reputation API 17 years ago
Kirby Kuehl f15ca04889 fix padding calculation and stubdata parser for dcerpc 17 years ago
William Metcalf 811f2f605d small fix for ! inside of content match 17 years ago
Pablo Rincon 9ec2057a21 Small fix, renaming 17 years ago
Victor Julien 2481f2102b Add missing return value evaluation in port parsing and fix broken unittest. 17 years ago
Victor Julien b3bcba077f Only inspect http flows against uri sigs, clean up uri scanning code. 17 years ago
Gurvinder Singh 0cb43d27e9 uricontent new design 17 years ago
Gurvinder Singh 356a8bf385 applayer uri match and modified http handling 17 years ago
Victor Julien fcb03099a3 Fix reassembly updating the wrong stream on ACK 
The stream reassembly updated the wrong stream on received ACK packets. Instead
of the opposing stream it updated the stream in packet direction. This caused
issues in the app layer handling.

Updated the unittests as well.
 17 years ago
Pablo Rincon 256d745b39 Including header file for cpu detection 17 years ago
Pablo Rincon 17cd010b0c Detect the number of CPUs configured and online. Printing a small summary at the startup 17 years ago
Victor Julien 0d3da34f64 remove unused variables 17 years ago
Victor Julien c352bff6fb Remove unused conditional locking code from the app layer parsing code. 17 years ago
Breno Silva 5461c60ada Allow threshold options in any order 17 years ago
Victor Julien d446b85237 Remove obsolete files. 17 years ago
Steve Grubb f853da7940 Get make distcheck working 
Hello,

Below is a patch that gets "make distcheck" working. Its against the
current code in git. The project version was set to 0.1 in configure,
I changed that to 0.8.1 just so its actually relevant. You might want
to set that to something else.

After checking this patch, I find that there are several source code
files in src/ that are not getting compiled:

-app-layer-detect.c
-app-layer-detect.h
-app-layer-http.c
-reputation.h

Are these new or abandoned? Anyways...here's the patch.

-Steve
 17 years ago
root b5529f7131 add stubdata pointer 17 years ago
Kirby Kuehl 08915649f3 fix double free 17 years ago
Victor Julien f4a23f2325 Fixup noisy debug statement. 17 years ago
Victor Julien 0d34990d7f Add OpenBSD's strlcpy and strlcat and replace all strcat/strcpy/strncat/strncpy by those calls. 17 years ago
Jason Ish 7d920a1254 Fix issue 65. 
- Update unit test to trigger the failure found in the issue 65 pcap.
- Increase pkt buffer to account for the IPv6 header, as a maximum
  size IPv6 datagram is 40 + 0xffff.
- Account for IPv4 header when checking where end of fragment lies.
- Second sanity check during re-assembly to check for writing past
  the end of the pkt buffer.
 17 years ago
Victor Julien 1b8f391607 Fixup flowbits signature keyword parsing memory handling. 17 years ago
Steve Grubb c95cd2e80a memory leak cleanups in misc places 
Hello,

This is all the rest of the memory leaks I found.

*In src/source-pcap-file.c at line 152, ptv is not being freed.
*In src/util-unittest-helper.c at line 152, p was not being freed.
*In src/log-httplog.c at line 195, aft was not being freed
*In src/counters.c at line 51, log_filename was not being freed. At line 1188
pctx is being tested to see if its NULL. However, at 1173 it exits the
function if it were NULL. This test is not needed and should be deleted.
*In src/defrag.c at line 351, tracker was not being freed. At line 390, dc is
being checked for NULL but this was already done at line 384. Probably what
was meant was checking the value of dc->frag_table which was just assigned.

The patch below makes the above described changes.

-Steve
 17 years ago
Steve Grubb 60ad9d29c5 Memory leak cleanup in detectors 
Hello,

I ran the code through an analysis program and found several leaks that
should be cleaned up.

*In src/detect-engine-address-ipv4.c at line 472, the test for ag == NULL
will never be true since that is the loop entry test.
*In src/detect-engine-port.c at line 1133, the test for p == NULL will
never be true since that is the loop entry test.
*In src/detect-engine-mpm.c at line 263 is a return without freeing
fast_pattern
*In src/detect-ack.c at line 80 and 85, data catches the return from malloc.
One of them should be deleted.
*In src/detect-seq.c at line 81 and 86, data catches the return from malloc.
One of them should be deleted.
*In src/detect-content.c at line 749, many of the paths that lead to the error
exit still has temp pointing to allocated memory. To clean this up, temp
should be set to NULL if not immediately assigning and new value.
*In src/detect-uricontent.c at line 319, both cd and str needto be freed. At
lines 344, str needs to be freed. And at line 347 str and temp need to be
freed.
*In src/detect-flowbits.c at line 231 and 235, str was not being freed. cd was
not being freed at line 235.
*In src/detect-flowvar.c at line 127, str was not being freed. At line 194, cd
and str were not being freed.
*In src/detect-flowint.c at line 277, sfd was not being freed. At line 315, str
was not being freed.
*In src/detect-pktvar.c at line 121, str was not being freed. At line 188, str
and cd was not being freed.
*In src/detect-pcre.c at line 389, there is an extra free of "re" that should
be deleted.
*In src/detect-depth.c at line 42 & 48, str has not been freed.
*In src/detect-distance.c at line 49 and 55, str has not been freed
*In src/detect-offset.c at line 45, str has not been freed.

The patch below fixes these issues.

-Steve
 17 years ago
Steve Grubb f6653752c5 memory leak cleanup in alerts 
Hello,

I ran the code through an analysis program and found several memory leaks
in the alert code.

*In src/alert-fastlog.c at line 178, aft was not being freed
*In src/alert-debuglog.c at line 205, aftwas not being freed
*In src/alert-unified-log.c at lines 234 and 243, aun was not being freed
*In src/alert-unified-alert.c at lines 219 and 230, aun was not being freed
*In src/alert-unified2-alert.c at line 505, aun was not being freed

The patch below fixes this.

-Steve
 17 years ago
Victor Julien 5f5a44b365 PPPoE fixes. 17 years ago
William Metcalf 82978f9f27 new pfring runmode for quad core, other small pfring fixes 17 years ago
Victor Julien 434da6b965 Set no reassembly flags on sessions we don't recognize the protocol for. 17 years ago
Gurvinder Singh f6b0c481b0 urilen support for engine 17 years ago
Victor Julien 9b4f3f918b Fix broken debug code in stream reassembly 17 years ago
Pablo Rincon c1e6aabb0a Small fix 17 years ago
Pablo Rincon 705471e4ee Adding single pattern matcher algorithms. If you cannot store a context for the patterns, use SpmSearch() macro. Adding unittests and stats 17 years ago
Victor Julien cae8e06cb9 Properly lock app layer result pool and add some debugging code for memory tracking. 17 years ago
Victor Julien 4284276b11 Merge applayer detect function into normal match function. Should speed up detection. 17 years ago
Victor Julien bcd0682150 Make engine startup a little less verbose. 17 years ago
Jason Ish 5076452707 Potential fix for issue 60. 
- Increase the packet buffer so it can hold the link header when we
  have maximum size IP datagrams.
- Fix ip header length and pkt length calculation for re-assembled
  packets.
 17 years ago
Victor Julien 9d3a9273dd Rename fmem_t to SCFmem and make sure it's not exported. 17 years ago
Pablo Rincon 673afeb4d3 fmemopen wrapper added (fix compilation problems on macosx and freebsd) 17 years ago
Victor Julien 42e8a01221 Make sure pcre PCRE_EXTRA_MATCH_LIMIT_RECURSION check works with strict compiler settings. 17 years ago
William Metcalf 5bde121754 --enable-gccprofile sets -pg flag detect presence of pcre recursion 17 years ago
Eric Leblond db2d483d11 convert action_type to enum 
This patch converts packet action type to an enum. This will
provide some facilities and ease bad value detection by gcc.
 17 years ago
Gerardo Iglesias Galvan f5743afed5 Fix logging messages related to icmp_id parsing 17 years ago
Gerardo Iglesias Galvan 4b39ddaf95 Fix logging messages related to icmp_id parsing 17 years ago
Breno Silva 1d055b0e09 ICMP Seq Rule Keyword 17 years ago
Victor Julien 34e11e4784 Fixup unused variable compiler warning in the dce code. 17 years ago
root ddf5995049 endianness handling update 17 years ago
Kirby Kuehl 3d59f40640 style patch 17 years ago
root 706bb95209 fix bug 61 17 years ago
Jason Ish 7aac64f262 unit test for issue 59. 17 years ago
Jason Ish a7b37afc4e Fix issue 59. Drop a fragment that extends past the maximum IP packet size. 17 years ago
Gurvinder Singh fea277b2aa memory leak fixes 17 years ago
Gurvinder Singh 5c8d90afc8 memory leak fixes 17 years ago
Gurvinder Singh 66cc392177 init b46 17 years ago
Kirby Kuehl 90b42232fa dcerpc request smb transact and fix for dcerpc bindack 17 years ago
Gurvinder Singh 8f00718b0d bug 57 17 years ago
Eric Leblond 51be576a30 nfq: modify queue length computation logic 
This patch modifies  max queue length computation logic. The max queue
length was set to MAX_PENDING which is the total number of packet
processed simultaneously in suricata.

This value is correct but this will not permit to take all burst
effects into account (read sudden quantity of packet that arrives
faster than suricata is enable to parse). Furthermore there is a
delaying system when suricata gets overloaded which make necessary
to have packet storable into kernel for some time.

To improve this situation the patch increases the maximum queue
length to NFQ_BURST_FACTOR (4) time the MAX_PENDING packet and
it also increase the nfnetlink buffer size to be able to store
all packets waiting for suricata in the netlink receive buffer.
 17 years ago
Eric Leblond 775ac9ad9d fix code file permission 
detect-http-method.c was executable.
 17 years ago
Eric Leblond 84dfc0172a gcc warning fixes. 
This patch fixes gcc warning:
    warning: suggest braces around empty body in an ‘if’ statement
This was the case in  when the macro SCLogDebug was used:
    if (ssn != NULL)
        SCLogDebug("ssn->alproto %"PRIu16"", ssn->alproto);

It also fixes a signed-unsigned comparison.
 17 years ago
Eric Leblond 72d48f6658 nfq: add sanity checking 
This patch adds sanity checking to payload handling. It set length
of packet to zero if an error occurs.
 17 years ago
Eric Leblond 56cccdfa62 nfq: use switch instead of 'else if' 
This patch convert a 'else if' serie to a switch to increase
the readability of the decision related code.

 Please enter the commit message for your changes. Lines starting
 17 years ago
Eric Leblond c96586446b ethernet: use switch instead of 'else if' 
This patch uses a switch instead of a 'else if' series. It also
adds a debug message for unsupported ethernet type.
 17 years ago
Eric Leblond 6cf00d6204 Fix typo in Makefile.am 
This patch fixes a typo in Makefile.am which was preventing
'make tags' from working.
 17 years ago
Victor Julien 9295193968 Fixup unittest error output for RAW decoder. 17 years ago
William Metcalf c5d0b492d3 small unittest fixes to decode-raw.c 17 years ago
William Metcalf 8a64321340 raw pcap support additionl ipv4/6 validation 17 years ago
Pablo Rincon 0c9f51498a Small fixes at unittest helper functions and TestBidirec03 17 years ago
Pablo Rincon c80160b96d More examples of unittest helper functions usage reference 17 years ago
Pablo Rincon b6a3395c08 Adding unittest helper functions for building generic packets, checking arrays of expected match results, perform generic tests, etc. Look at util-unittest-helper.c and detect-ipproto.c for references 17 years ago
Jason Ish 095f2cf6ef Consistency fix.. Xxxlog -> XxxLog. 17 years ago
Jason Ish e204d07717 Have output modules register themselves so run mode configurator becomes aware of them for purposes of being configured from the config file. 17 years ago
Victor Julien 9b90c553b5 Clean ip fields from packet as well when the packet is reused. Prevents issues with malformed packets that are rejected by the decoders before ipaddresses are set. 17 years ago
Victor Julien 27a138d862 Suppress some flow messages. 17 years ago
Gurvinder Singh b0dcd02c1b bug 56 patch 17 years ago
Victor Julien eb67bb442e Fixup unittests that use buffers that simulate configuration files. They now include the YAML header. 17 years ago
Jason Ish 4e1acf5fd2 Require that the configuration file begins with a valid YAML version. At this time this means the configuration file must begin with 
%YAML 1.1
 17 years ago
Jason Ish 5e318aa342 Fix issue 55. 
Don't process any key/value pairs until we've hitting a mapping.
 17 years ago
Jason Ish c4f178f3d7 Do not seen_last unless the packet with more_frags=0 was actually inserted into the frag tracker. Fixes issue 53. 
Add unit test for this failure case.
 17 years ago
Jason Ish fc5df7d064 don't create a new tracker when frags are received in reverse order. 17 years ago
Gerardo Iglesias Galvan 40c514f295 Fix bug in logging msg when using --init-errors-fatal 17 years ago
Gerardo Iglesias Galvan 5eb819b0f4 Add signature line no. to error message when parsing fails 17 years ago
Gerardo Iglesias Galvan fae92f8d7b Fix bug#30. Fix logging call from prev patch 17 years ago
Gerardo Iglesias Galvan 988dc5520b Improve output when loading rules 17 years ago
Victor Julien 56556eb550 Set payload no inspect flag for packets with encapsulated packets as these are inspected separately 17 years ago
Victor Julien 9ececacda3 Fix packet timestamp handling for encapsulated packets. 17 years ago
Jason Ish 4c83652ad3 initialize vars 17 years ago
Victor Julien c1283a6628 Fix app layer proto detection code not being thread safe. 17 years ago
Gurvinder Singh fde948f488 bug 41 patch 17 years ago
Victor Julien fcabd1b2ba Fix typo. 17 years ago
Jason Ish cf95fa7c74 configurable outputs for nfq and pcap file. 17 years ago
Jason Ish a05436af8c Configurable alert outputs for PF_RING modes. 17 years ago
Jason Ish 844c444af1 Use the configuration file to setup alert logging (and http logging). 
Only setup for the live pcap modes at the moment.
 17 years ago
Victor Julien 13e10ccd86 Enable bytes per sec and mbit per sec for nfq as well 17 years ago
Anoop Saldanha e45b626b24 refactoring, tests for address engine ipv4 17 years ago
Jason Ish 1aabe6f7c1 in the unit tests make sure memory allocated from the pool was returned. 17 years ago
Jason Ish 6547725b39 consolidate more common code between ipv4 and ipv6. 17 years ago
Jason Ish 176c6e5668 use a common insert method for ipv4 and ipv6 17 years ago
Jason Ish ccbf8bcae5 Use the V6 insert and re-assembly logic for IPv4 as well. Its a little simpler to track and update. 17 years ago
root 9b74a2765e 64 bit portability 17 years ago
Victor Julien d7958f7983 fix wrong keyword name 17 years ago
Victor Julien 9ee6d6906f Add some safety checks. 17 years ago
Anoop Saldanha 06a640e794 fix for bug #47 17 years ago
Anoop Saldanha a83f7abcc1 logging module bug 6 fix 17 years ago
Victor Julien 6b36e23e45 Fix not decreasing the flow use_cnt reference counter in some cases from the app layer detection code. This caused some streams to never fully time out and thus clutter up the flow table and session pool. 17 years ago
Victor Julien c3269dbcb4 Fix compiler warning in http method code 17 years ago
Brian Rectanus c22d42693a Added http_method rule keyword. 17 years ago
Gurvinder Singh 6814ea1a0f some more stream fixes 17 years ago
Victor Julien 94ae001dec Fixup month displaying for the stats log. 17 years ago
Victor Julien 5e8413aeea Don't scan more of a stream for proto detection than necessary. 17 years ago
Gurvinder Singh a66c6752d5 stream os_policy support 17 years ago
Anoop Saldanha eea0e2a807 Radix Tree fixes/updates 17 years ago
Victor Julien 8f7cff1d53 Fix compilation with -Wextra 17 years ago
Victor Julien b7bac14040 Fixup code to compile with -Wall -Werror -Wextra -Wno-unused-parameter compiler options. 17 years ago
Gurvinder Singh 4e1dc0bd83 bug 41 patch 17 years ago
Gurvinder Singh 567bbf604b stream reassembling fixes 17 years ago
Jason Ish 6520d42b4c Allow nested sequences. 17 years ago
Jason Ish d86282af9c pretty up ConfDump output for when there is no valid prefix 17 years ago
Jason Ish 668b86cba4 Fix issue 36. Give each unit test a fresh configuration context - helps tests pass when a config file is passed in, which can 
mess up the "expected" output, as this is testing loading
values into the configuration system.
 17 years ago
Jason Ish 749647a69d use const 17 years ago
root 5113636744 bind and bind_ack tracking 17 years ago
Victor Julien 1f09a88c93 Improve default-log-dir error checking and reporting. 17 years ago
Anoop Saldanha 750600ab17 check for the existance of default logging directory 17 years ago
Anoop Saldanha 8189f4d88e Change error log messags to debug ones in the log modules 17 years ago
Victor Julien f5ef0cc3b8 Exit if no classification.config has been found. 17 years ago
Victor Julien 9e5f7459c2 Actually use classification msg 17 years ago
Victor Julien 2b66667a76 Make sure we can't overflow our packet alert storage 17 years ago
Jason Ish 527d735500 Suppress these debug lines. 17 years ago
Victor Julien 9b422c443e Fix up initialization and hopefully make the SEQ macro's fix up an 64bit issue we're seeing... 17 years ago
Victor Julien 18aa59b391 Fix compilation and a small memory error. 17 years ago
Anoop Saldanha f684989f98 dce_iface, dce_opnum, dce_stub_data keyword support 17 years ago
Victor Julien d284f0d333 Set default classification file location in the config file. 17 years ago
Victor Julien ecab1fae36 Remove contents of VRT classification.config. 17 years ago
Anoop Saldanha 011b74df63 Modify the classification config tests to use the buffer than a temp file and also fix an invalid free 17 years ago
Anoop Saldanha bc4df59414 Support for Classtype keyword and Classification Config file 17 years ago
Victor Julien f0be69dcd0 Fixup smb/smb2/dcerpc wrt loops, debug printing, style. 17 years ago
Victor Julien 4c2782e971 Improve depth and offset setup error reporting 17 years ago
Victor Julien f6f0ad94ce silence a debug statement in the msg handling 17 years ago
Victor Julien d5c732f1f9 Add tag keyword stub 17 years ago
Victor Julien b2adf31595 online abort() in stream reassembly if were in debug mode 17 years ago
Victor Julien ef6ab4efa0 Add pcre negate support. 17 years ago
William Metcalf 1d553c940b failing unit test showing negated pcre treated as nonnegated match 17 years ago
Victor Julien 040e62f3ec Fixup noisy debug statement 17 years ago
Victor Julien 7b2610ba1f Fix extra spaces confusing content and uricontent. 17 years ago
Gurvinder Singh a19fbf22e2 bug 29 patch 17 years ago
Victor Julien ae94b102cb Improve distance/within/nocase handling, sig parsing error reporting. 17 years ago
Victor Julien 4862488dac add version output, -V option 17 years ago
Victor Julien 6beee776ca Move rand seed code into util-random 17 years ago
Pablo Rincon 6224c30548 Adding preseending to rands 17 years ago
Jason Ish b2ee780788 "last" policy for ipv6 17 years ago
Jason Ish ecc50b8b2f add first policy for ipv6 frag re-assembly 17 years ago
Jason Ish d9380a8cb5 solaris policy for ipv6 17 years ago
Jason Ish ce20c33634 multiline rule support. 17 years ago
Will Metcalf 23aa6cf642 more fixes for exit on sig init failure 17 years ago
Will Metcalf f2b1e66a6a fixes for init failure stuff 17 years ago
Victor Julien 778228d1c5 Flags keyword fix. Fatal init fix. 17 years ago
Victor Julien 35e884f303 Make sure offset modifies depth. 17 years ago
William Metcalf c63b1e0f67 failing unit test depth doesn't take into account offset 17 years ago
Will Metcalf cc3c1779cd more project name updates 17 years ago
Victor Julien 9bbe43c019 Fixup calculation of the minimum scan pattern lenght in some cases. 17 years ago
Victor Julien aa736b01d6 Fix thresholding coding changing unlocked and supposed to be static memory areas. 17 years ago
Victor Julien c969294fef Make sure icmp rules also apply to icmpv6 17 years ago
Gurvinder Singh 8cfdf6c666 bug 18 patch update 17 years ago
Gurvinder Singh b92886a79a bug#18 and some minor changes 17 years ago
Gurvinder Singh 542a43437e bug19 patch 17 years ago
Pablo Rincon 0e83759ed4 Small fix 17 years ago
Victor Julien 1d12de9500 DetectContentChunkMatchTest11 is no longer expected to fail. 17 years ago
Victor Julien 18441c2be7 Fix broken pattern len compilation causing certain patterns to no match when they should. 17 years ago
Victor Julien 0ab9adabd4 Test PortTestMatchDoubleNegation is no longer expected to fail. 17 years ago
Victor Julien 0a699857d6 Fix negation for addresses as well. 17 years ago
Victor Julien 50c07f9901 Fix wrong negation of ports. 17 years ago
Victor Julien 10cc9d5b6a Add icmp flow handling. 17 years ago
Victor Julien 71ed2d38f5 Fix scan patterns sometimes not being added to the scan ctx. Should fix bug #9. 17 years ago
William Metcalf c40e81d42b failing unittest rules with same content match fail 17 years ago
Victor Julien a8116f65c8 Fix packet flags field not being cleared properly when the packet is being reused. Add some debug statements and cleanup some. 17 years ago
Victor Julien e2376948dd Clean up smb/dcerpc code 17 years ago
root 48cdc8e0fd DCERPC BIND work 17 years ago
Jason Ish 9d55a41e49 Windows and Linux policies for IPV6 frag reassembly. 17 years ago
Victor Julien 4824868766 Application layer detection improvements 
- improve locking of application layer handling, making sure that the flow cannot be freed/cleared when the detection engine is still working with it.
- add a check to the app layer detection to make sure that a match function will only inspect an app layer state if it's of the right type.
 17 years ago
Victor Julien 310a182217 Fix signatures not being initialized properly 17 years ago
Victor Julien 6fe5509617 Fix compiler warning when using HTP rev 68. 17 years ago
Victor Julien 79b15bd1cc fix typo 17 years ago
Victor Julien 53041eeb67 Small cleanups. 17 years ago
Victor Julien 8cc792a3c7 Fix potential deadlock in http cookie match. 17 years ago
Pablo Rincon f729d6f7b3 Changing some more printfs with logging api 17 years ago
Pablo Rincon f2f9b83280 Adding FTP app layer parser and ftpbounce detection at L7 17 years ago
Victor Julien d35dd1c4ea Improve http cookie htp state checking before using it. 17 years ago
Pablo Rincon 6f76ed6804 Match content fail when two contents are specified in the same rule and the last of them has length = 1 17 years ago
Anoop Saldanha f8edb74439 double port/address negation is parsed incorrectly 17 years ago
Victor Julien 6ab64706b0 Improve threshold hash table handling. 17 years ago
Gurvinder Singh 8c8b8596c8 fixed bug 18 17 years ago
Gurvinder Singh 8287ebe12c bug 21 fixing patch 17 years ago
Anoop Saldanha 4d430060d2 fix for unclear error messages bug 15 17 years ago
Anoop Saldanha 47ad1e5b2e detect-engine-address.[ch] refactoring 17 years ago
Anoop Saldanha 2c0345f55e Fix for Unified Alert Test Bug #14 17 years ago
Gerardo Iglesias Galvan 7e87f373b9 Add icmp_id keyword support 17 years ago
Victor Julien 01976a0b74 Support for sigs with both pkt and applayer detect 
Sets a flowbit with the sig id if the packet matches match. Checks
on that if the app layer matches match. Currently misuses the
flowbits api for this in a way that needs fixing.
 17 years ago
Victor Julien 493715c0d2 Implement alert sid storage in the flow so we can check previous alerts in the flow. 17 years ago
Victor Julien 9fd46e9425 Support for sigs with both pkt and applayer detect 
Sets a flowbit with the sig id if the packet matches match. Checks
on that if the app layer matches match. Currently misuses the
flowbits api for this in a way that needs fixing.
 17 years ago
Gurvinder Singh 0419ad7c9a fixed 23 bug 17 years ago
Victor Julien 4f843ff8e9 Improve matching of packet and app layer sigs. 17 years ago
Pablo Rincon 992aaa3d79 Small fix on SigMatchSignaturesAppLayer() and SigMatchSignatures() 17 years ago
Pablo Rincon 459a823a09 Reutilize the filename buffer and avoid malloc's 17 years ago
Pablo Rincon 5f59def86a Force reset size_current to 0 after rotate 17 years ago
Jason Ish fdb1c9c4f2 cleanup warnings. 17 years ago
Jason Ish 6cc0771d6f - Fix memory leak error when freeing node. 
- Cleanup ConfDump output a little.
 17 years ago
Victor Julien 4c79e6d5b6 compile fixes 17 years ago
Jason Ish 28cad3429c An example of how logging could be configured from the log file. 17 years ago
Jason Ish 90c46ee2c9 Add the ability to lookup a child ConfNode, or just the value of a child ConfNode. 17 years ago
Jason Ish 59ec05645f Index sequence items - allows us to store sequences of mappings in the configuration database. 17 years ago
Gurvinder Singh 0a85fd6787 htp error fixed 17 years ago
Gurvinder Singh d8433c7255 fixed-pool-error-and-tcp-state-transition 17 years ago
Victor Julien 53e3e6dee8 Fix compilation after suricata rename. 17 years ago
Pablo Rincon 7473f716bd Improving error report on runmodes and daemon compatibility 17 years ago
Gerardo Iglesias Galvan 5471baf8f4 Change case values to their corresponding enum values 17 years ago
Gerardo Iglesias Galvan e917065e26 Add support for daemon, checking for valid combination of modes 17 years ago
Victor Julien 8490208ba1 Fix bug fix 17 years ago
Victor Julien fa5dbaeb1d Fix segv when testing for sid 2002181 17 years ago
Breno Silva 69eb869cc9 Threshold Rule 17 years ago
Victor Julien ecf86f9c23 Rename to Suricata. 17 years ago
Gurvinder Singh 71a77bf8d6 removeh http_cookie flag 17 years ago
Gurvinder Singh 85f054cac2 changed to DetectHttpCookieData 17 years ago
Gurvinder Singh a0f184866c http_cookie keywork support 17 years ago
Victor Julien 18fe3818dc Remove need_lock from app layer parsers. 17 years ago
William Metcalf 7e2408d273 FreeBSD correct arch specific gettid defs 17 years ago
Gurvinder Singh 7ce586bc77 updated htp error info 17 years ago
Victor Julien ba7e8012af Add some debugging and simplify locking for app layer slightly. 17 years ago
Gurvinder Singh fc2f7f29fa app layer htp error handling and fixes for memory leaks and segv 17 years ago
Victor Julien aa653157bf Convert stats printing in nfq to logging api. 17 years ago
Victor Julien e5301effe6 Make nfq module use logging api. 17 years ago
Pablo Rincon a67bd2457b Loading rules from config support 17 years ago
Victor Julien 3233888c65 Disable noisy debugging statements 17 years ago
Kirby Kuehl 73bdc8a5c3 fix unittests 17 years ago
Kirby Kuehl c20bc68367 readandx and writeandx parsing for smb 17 years ago
Kirby Kuehl 57331ea2a2 add smb2 proto and smb, smb2, dcerpc unit tests 17 years ago
Jason Ish 0d92f0018b First cut at IPv6 re-assembly. Only BSD policy for now, packets don't actually get passed to it yet though. 17 years ago
Pablo Rincon c816af822e Adding support to load rule files from config 17 years ago
Gerardo Iglesias Galvan 7642e53f06 Fix warnings from previous patch. Add info to usage output. 17 years ago
Gerardo Iglesias Galvan b254719ffc Add fatal failures on unittest and siginit failure (using Conf API) 17 years ago
Pablo Rincon 658eac2825 Adding max pattern length for bidirectional operator. Please, use DetectEngineAppendSig() at the unittests. Look at the bidirectional operator unittests for a usage reference. 17 years ago
Pablo Rincon 1ad6d75dfe Added rpc keyword support at packet level 17 years ago
Victor Julien d388444ac3 Use updated mutex calls. 17 years ago
Gurvinder Singh ad3e463974 updated error info ouput 17 years ago
Anoop Saldanha cd0de89bd4 Fix for handling negated content "\!CONTENT" 17 years ago
William Metcalf 16d2bf6b8e unit test showing flags:0 alerting when it shouldn't 17 years ago
Breno Silva 0acf472392 Flags Issue 17 years ago
William Metcalf ec1cb9c0db more invalid netmask fixes and unittest 17 years ago
Victor Julien d5c11f7abd Make engine initialization a bit more quiet. 17 years ago
Victor Julien eaaf0bd61c Use correct mutex call in flow-vars code. 17 years ago
Pablo Rincon 43a1ae9a4b Changing some printf to SCLogDebug at flow vars 17 years ago
Pablo Rincon c6c7742464 Added support at Flowints for keywords isset and notset 17 years ago
Pablo Rincon a8d7b71490 First version of flowints 17 years ago
Gurvinder Singh 1b39e602d0 fixed port info 17 years ago
Gerardo Iglesias 991d421394 Changed printf's to logging API functions 17 years ago
Pablo Rincon e26833be3f Changing mutex/spinlocks/conditions naming types 17 years ago
Victor Julien 406ee2ce70 Use new threading calls in htp code. 17 years ago
Pablo Rincon 769022f4be Adding support for Mac OS X, FreeBSD, centrailizing mutex/spins/conditions in a macro API, and some unittests 17 years ago
Victor Julien 4cae27522d Fix http module warnings. 17 years ago
Gurvinder Singh 2d6cf71d37 added htp unit test 17 years ago
Gurvinder Singh 07f7ba55b8 initial support for HTP module init 17 years ago
Victor Julien 6e9b582be6 Fixup rebase typo. 17 years ago
Gurvinder Singh c1e485cc44 app layer error handling 17 years ago
root 43fb771268 smb2 work 17 years ago
root 0f5f82efee smb2 work 17 years ago
root 74667e697a better smb parsing 17 years ago
Victor Julien 2213ff933f Compile fix. 17 years ago
Brian Rectanus 44083b6505 Fixed warning in detect-content. 17 years ago
Gurvinder Singh 91407e0938 fixed DetectByteTest bug 17 years ago
Pablo Rincon 6206ffb530 Adding bidirectional operator support and unittests 17 years ago
Breno Silva c552ccbd93 PCRE O Modifier 17 years ago
Victor Julien 574bcea09d initial version of better error checking/handling in the app layer code 17 years ago
Victor Julien 09dd7889a1 TLS: small updates to the tls parser 
- small updates to the TLS parser after merging Gurvinders TLS work with my work.
 17 years ago
Victor Julien 2cfa284999 Fix app layer detect to actually work. 17 years ago
Victor Julien a1d33e2d0b Compilation fixes after merge. 17 years ago
Victor Julien 7cda445c49 Add unitttest. 17 years ago
Victor Julien f1f7df0766 First iteration of doing app layer detection. 17 years ago
Victor Julien f31d8e0444 TLS no inspect: fixes and cleanups 
- use byte extraction functions for getting the msg length
 - cleanup the parsing routines for multiple msgs
 - add unittests for multimsg payloads
 17 years ago
Gurvinder Singh a16e7b7455 tls no reassembly support 17 years ago
Victor Julien 54b9663cd1 TCP streams: support falling back to 3WHS when we were led to believe we were in 4WHS mode. Add unittests. 17 years ago
Victor Julien 2af6ed0c8c Support newly reported 4WHS TCP setup. 17 years ago
William Metcalf af13665684 failing unit test where fast_pattern rule and non-fast_pattern rule inspect same payload 17 years ago
Anoop Saldanha 45acb64a61 Bug fix for fast_pattern - bug #8 17 years ago
Victor Julien 5c3bbb8d61 Time handling: improve time handling in unittests 
- make sure before each unittest is run the time is reset
- add functions to set the time to current time and increment the time
- convert alert-unified* Rotate tests to use them
- convert time based counters to use them
- use GetTime instead of gettimeofday for creating the unified* filenames
 17 years ago
Pablo Rincon a64af4adca Forgot to add this file 17 years ago
Pablo Rincon 15855e11f3 Fixing alert unified log file rotation. Adding unittests 17 years ago
Victor Julien 746d12071e Fix merge artifacts. 17 years ago
William Metcalf 0db1d01b0c port space negation notification 17 years ago
Gurvinder Singh 3f23f52c52 Fixed FlowTest01 and StreamReassemblyTest30 17 years ago
Gurvinder Singh d2765511ce async stream handling support 17 years ago
William Metcalf 88497ec539 detect-dsize regex doxygen logging subsys changes 17 years ago
Anoop Saldanha bb8a84d967 todo comment update for address and port parsing 17 years ago
Victor Julien 621c8dd921 Make sure we don't sleep to test time lapses, we can modify the engine's time internally for that. 17 years ago
Anoop Saldanha 30a7ea2141 adapted counters to use util-time.[ch] 17 years ago
Anoop Saldanha c8b423578a Updates for counters time based patch 17 years ago
Anoop Saldanha 8beef4a9fc stats upgrade. Added interval counters to the decoder module 17 years ago
Anoop Saldanha ceb7e495ae refactoring perf stats code 17 years ago
Victor Julien fdf8943dfb Remove a few commented out code lines. 17 years ago
Anoop Saldanha 8c9df4cd6b modifications to PatternMatchPreprarePopulateMpm to fasten fast_pattern processing 17 years ago
Anoop Saldanha bb5bd91045 Support to get the last sigmatch of a particular type. To be used for content and its modifiers 17 years ago
Anoop Saldanha 7a10ddc07b Fixes for the fast-pattern tests and a couple of other minor changes 17 years ago
Anoop Saldanha 6ca5dbc9e9 Support fast_pattern modifier keyword for content 17 years ago
Victor Julien 07bcc8cc9a Fix signatures with ports and/or addresses but without sigmatches. 17 years ago
Victor Julien 50b2e381e0 Set the DETECT_CONTENT_WITHIN_NEXT and DETECT_CONTENT_DISTANCE_NEXT flags on content chunks if appropriate. 17 years ago
Victor Julien a004724aea Add some debugging code 17 years ago
Victor Julien dd232fcd6e Fix debug compilation 17 years ago
Anoop Saldanha 1c7ac13c25 Support for negated content 17 years ago
Victor Julien 6346d1ddcf Add function name printing to the default output while we're still in development. 17 years ago
Victor Julien 0aaf603317 Fix another case where distance/within checks didn't fully work as expected. 17 years ago
Pablo Rincon ce3abca399 Adding some unittests (one of them dodoesn't work but should) 17 years ago
Pablo Rincon 84411f73c3 Commeting out a unittest. 17 years ago
Pablo Rincon 9a3c21fbf3 Updating real unittests. Small fix on TestWithinDistanceOffsetDepth to skip to the next DETECT_CONTENT SigMatch. Adding some checks on within/distance setups. 17 years ago
Victor Julien 241db64dd7 Fix a few memory issues. 17 years ago
Pablo Rincon 7e4377224a Small fix at detect-parse.c, need to continue with MatchTest05 17 years ago
Pablo Rincon f233f9fa31 Adding detect_content chunks handling for max_pattern_length and unittests. Updating modifiers to use it. 17 years ago
Victor Julien 981ca859cb Fixes for distance and within content modifiers. 17 years ago
William Metcalf 884b1034b4 failed unittest for within distance 17 years ago
Victor Julien 171edda02a Fix compilation of address and port error messages in debug mode. 17 years ago
Anoop Saldanha dc44700ce5 Support vars lookup from conf file. Current patch support address and port group vars lookup 17 years ago
Victor Julien 951b4d5cf4 Fix within in some corner cases and add some more tests. 17 years ago
Anoop Saldanha 204aca4431 Support host os flavour retrieval functions with raw network addresses 17 years ago
Anoop Saldanha 96614c60f2 change the netmask to uint8_t for the ip handling part of the radix tree and also use 255 instead of -1 to indicate the absence of a netblock 17 years ago
Anoop Saldanha 3f91af89a2 Added comments to the the Host OS API test 17 years ago
Anoop Saldanha 22771d5f52 Updated doxygen comment for host os function 17 years ago
Anoop Saldanha 7dbc117b37 Host OS Table API. Modifications also make to the radix tree to handle netblocks 17 years ago
Victor Julien 4f2164677a - Fix pattern matchers b2g and b3g not being able to deal with a single pattern of the max pattern length (32 bytes by default). 
- Fix the setting of the correct pattern matcher when it was set in the detection ctx.
- Add tests for the fixes.
 17 years ago
Victor Julien f2a388ac8d Cleanup comments. 17 years ago
Victor Julien 34d44266fd Create reputation.h 17 years ago
William Metcalf 258cac889a silence pfring compiler warning 17 years ago
Victor Julien d6be6ceb19 Fixup artifact from automatic renames: rename DetectAddresssHead to DetectAddressHead. 17 years ago
Victor Julien e5b990a8ab Fixup siggroup merge artifacts. 17 years ago
Anoop Saldanha 78db80ea15 Unittests and style fix for detect-engine-siggroup.[ch] 17 years ago
Victor Julien 83d1e283bb Improve message on test expected to fail at this point. 17 years ago
Pablo Rincon 0df58406ee Adding Unittests, doxygen comments, coding style, logging support 17 years ago
Victor Julien cc442f1772 Fixup flow bits sig tests to work with the changes to the pattern matchers. 17 years ago
Breno Silva 6d1eb3e728 FlowBits Unit Tests 17 years ago
Breno Silva 2dee4cec13 FlowBits Unit Tests 17 years ago
Victor Julien c5dd31868d Small detect engine proto cleanups. 17 years ago
Gurvinder Singh 34e526d853 TTL macros suppport 17 years ago
Gurvinder Singh 90fea03af5 added comments and some minor changes 17 years ago
Gurvinder Singh cacbf31aad support for ttl keyword 17 years ago
Victor Julien deb511f51a Fix a compiler warning on Ubuntu 9.10 gcc 4.4.1 in the pattern matchers where the size of the thread ctx can be optimized to 0. 17 years ago
Victor Julien 8b8e2fef2d Fix msg parsing. 17 years ago
William Metcalf e458b2a26e detct-msg changes and unittests 17 years ago
William Metcalf f217370ac7 fixed for invalid netmask being set to 0 17 years ago
Victor Julien de8caa7964 Rename DetectAddressGroup* to DetectAddress* 17 years ago
Victor Julien 13dca5e8ce Cleanup of address functions. 17 years ago
Victor Julien 3c7a038477 Further memory cleanups. Split out init only vars out of the sig group head. 17 years ago
Victor Julien 32e51e5e5a Replace sgh refcnt by a flag. 17 years ago
Victor Julien 91d14964b6 Fixup formatting on the smb code. 17 years ago
William Metcalf 5fc3005103 added check for full al_parser_table 17 years ago
root f3e3d3873f fix smb and dcerpc unit tests 17 years ago
Kirby Kuehl ecaa701bdf smb and dcerpc work 17 years ago
Victor Julien bf72331849 Fix compilation warning in conf test. 17 years ago
Jason Ish ec9fa7b0a7 Files missed in last commit. 
Update Conf API to allow direct access to nodes.

    A configuration node is now a tailq head and a tailq entry.  This allows us to build
    n-ary type trees to build something DOM like.

    Properly process lists so a list of rule files (for example) can be loaded.
 17 years ago
Jason Ish d39a291427 Refactor yaml loader so we can load strings or files. 17 years ago
William Metcalf 4175206417 unittest regex changes and fixes 17 years ago
Victor Julien 2d0e9658f8 Speed up per sgh content maxlen calc. Remove mpm ptrs from mpm ctx. Add unittests testing the detection engine internals. 17 years ago
Victor Julien e4c98c562c Merge DetectAddressData and DetectAddressGroup 17 years ago
Victor Julien 15ab5d7003 More engine init memleaks fixed. HashListTable remove function fixed. 17 years ago
Victor Julien 7a7bb7a390 Get rid of global mpm_ctx. 17 years ago
Victor Julien fbe87a3ad5 Bunch of mostly unittest related memleak fixes. 17 years ago
Victor Julien 227cc082a1 Fix small memleak at engine init. 17 years ago
Gurvinder Singh 02fb39b913 detect-engine-proto unit tests and comments 17 years ago
Gurvinder Singh f2213b066f fast track stream handling and its unitests 17 years ago
Brian Rectanus b796541e57 Ack/Seq Keywords part 2 17 years ago
Brian Rectanus ed30067bd7 Ack/Seq Keywords 17 years ago
Victor Julien 56e45e0c16 Fix warning free compilation of defrag. Fix a missing variable initialization that cause a segv in the unittests. 17 years ago
Jason Ish e0b9e85230 Break out checksum fixup code to make the license separation more clear. 17 years ago
Victor Julien 97c991f75b Remove unused var and fix compilation with DEBUG enabled. 17 years ago
Jamie 0dc471db9c looking inside ICMP packets 17 years ago
Brian Rectanus ec6c5258b6 Sameip Keyword 17 years ago
Breno Silva f9b422bba7 FlagBits fix 
Signed-off-by: Brian Rectanus <brectanu@gmail.com>
 17 years ago
Victor Julien 4fb4dd59e4 Detect errors in the spin locks which somehow seems to fix some deadlocking withing valgrind. 17 years ago
Victor Julien 32830ff43d Small layout fix. 17 years ago
Pablo Rincon 06c382a44d Addapting to SCLogDebug 17 years ago
Pablo Rincon 292a7e47ef ICMPv6 Decoder and unittests 17 years ago
William Metcalf 7fb28ce5b6 fixes to mimic snort escape behavior in msg 17 years ago
Breno Silva a48ddc46b7 Flags janitor 17 years ago
Breno Silva 8f8de0e56f Unit test 60c fix 17 years ago
Anoop Saldanha bfc8200768 Fix for the broken test from logging module 17 years ago
William Metcalf 24b27136cc various unittest fixes for detect-engine-sigorder 17 years ago
Jason Ish 097a77e9fd Bug 6 
Add a new command line option, --list-unittests to list all registered unit tests then exit.  If -U is supplied, the regex will be respected.
 17 years ago
Victor Julien f76a740fe2 Small layout fix. 17 years ago
Victor Julien b470e7b40f Fixup merge artifact. 17 years ago
Breno Silva 15a8f34d36 Gid Keyword 
Signed-off-by: Brian Rectanus <brectanu@gmail.com>
 17 years ago
Breno Silva 6100a7f610 FragBits Keyword 
Signed-off-by: Brian Rectanus <brectanu@gmail.com>
 17 years ago
Anoop Saldanha 6858192660 Added a NULL check inside ConfGet() 17 years ago
Anoop Saldanha a767a28c70 fix for the test bug in the logging module 17 years ago
William Metcalf 0d13505f0e change debug code around to use global log dir 17 years ago
Victor Julien 43a50c538b Change default log settings to be more development friendly. Breaks one test. 17 years ago
Victor Julien d4733e3a76 Move pcre test out of detect.c 17 years ago
William Metcalf 86380b9d45 split out pcre parsing fixed some errors 17 years ago
Victor Julien 4dbcf5fbac Add support for moving detection tests outside of detect.c and move the 'id' tests to it's own file. 17 years ago
Pablo Rincon 1a983fd316 Adding id keyword and unittests 17 years ago
Victor Julien 085b7a3c0e Move unittests away from detect.c 17 years ago
Breno Silva 97a8778aa4 Signature Flags Keyword 
Signed-off-by: Brian Rectanus <brectanu@gmail.com>
 17 years ago
Breno Silva 7dc985aa4e Signature Flags Keyword 
Signed-off-by: Brian Rectanus <brectanu@gmail.com>
 17 years ago
Victor Julien 4e848796d8 Use correct free function in DetectPortParseInsertString. 17 years ago
Anoop Saldanha 0815ed7c9e Some refactoring of the code, error handling done 17 years ago
Brian Rectanus e2fc2545f2 ip_proto cleanup and fix mem leak. 17 years ago
Victor Julien 8c747380ae Fixup ip_proto keyword. 17 years ago
Victor Julien f58f437997 re-add unittests that were removed to prevent a git merge mess. 17 years ago
Brian Rectanus e28647032d Add ip_proto support. 17 years ago
Victor Julien f70c026340 Prepare for merging ipproto patch. 17 years ago
Anoop Saldanha fbc4d11ed4 Some code refactoring 17 years ago
Gurvinder Singh 4edcc530ec fixed unified alert2 ecode and removed printfs 17 years ago
Gurvinder Singh e7952b1331 some changes in threading constants 17 years ago
Gurvinder Singh ec75946e21 one more change 17 years ago
Gurvinder Singh 7ff38a7081 fixed thread issue 17 years ago
Gurvinder Singh 40b8afdd56 support for thread exit constants 17 years ago
Gurvinder Singh 48c94bbf03 initial thread code support 17 years ago
Gurvinder Singh 47eb168713 added a small comment 17 years ago
Gurvinder Singh 7b56b4314b unittest packet payload inspection 17 years ago
Gurvinder Singh 70b53a0293 fixed the ispayload inspecting func 17 years ago
Gurvinder Singh 78697ce502 avoid pm invocation 17 years ago
Gurvinder Singh a991ab0a19 added sigmatch payload flag 17 years ago
Gurvinder Singh 88fbfb3e65 fix an issue 17 years ago
Gurvinder Singh 892ace6b37 stream flag function made public 17 years ago
Gurvinder Singh 7895748606 add unit test for no stream reassembly 17 years ago
Gurvinder Singh 71da019734 some minor changes 17 years ago
Gurvinder Singh 94674c58f3 unit tests for no packet & payload inspection 17 years ago
Gurvinder Singh bbb385422d function to set packet flags 17 years ago
Gurvinder Singh cc0b4f7181 initial version to support detection byepass 17 years ago
Jamie a914c4e2bf check that the encapsulated packet is correctly parsed 17 years ago
Victor Julien 804da19a36 Fix flowbits match being unable to deal with a packet without a flow. 17 years ago
William Metcalf 67e6cf21ae verify valid port range 17 years ago
Victor Julien 5ffb7a7bd7 Add a few more tests for portrange validation. 17 years ago
Victor Julien 927685928c Fix segv in unified2 unittests. 17 years ago
Victor Julien fce06d2800 Fix unified2 tests relying on each other. 17 years ago
Breno Silva c43319c337 Regular expression for UnitTests 
Signed-off-by: Brian Rectanus <brectanu@gmail.com>
 17 years ago
Anoop Saldanha 590adbb3e8 Radix Tree modifications 17 years ago
Anoop Saldanha 3c21df69d2 Radix Tree structure for the engine 17 years ago
Anoop Saldanha bc42aebdd5 Logging module optimization changes 17 years ago
Victor Julien ff018d4b43 Strange fix for issue where signals seemed to be ignored in some cases. 17 years ago
Victor Julien 4914d8d903 Small stream fixes. 17 years ago
Victor Julien 970db6fdd8 Fix merge artifact and add new logging init code to pfring runmodes as well. 17 years ago
Pablo Rincon Crespo 93077a0fee Updating tests fo unified2 with LogFileCtx 17 years ago
Pablo Rincon Crespo a84cc38bc9 Preparing multithreading support for alert modules and logfilectx 17 years ago
William Metcalf 69e57e5e23 remove invalid dir from pcre + unit test 17 years ago
Victor Julien 968d8df12b More logging API usage. Changed logging macro's slightly so the vars inside them won't conflict with vars used by the calling function. 17 years ago
Victor Julien bcc5bbef93 Yet more logging api usage changes. 17 years ago
Victor Julien 91bc83e5c6 More logging API usage changes. 17 years ago
Anoop Saldanha b3a7f4c015 Update for the logging module and symbol renaming 17 years ago
Victor Julien 3a28171fbd Another round of logging api usage updates. 17 years ago
Victor Julien f4acd5a27e First batch of fixes for new debug and logging API usage. 17 years ago
Anoop Saldanha 157d5e8113 Implementation of the logging module 17 years ago
Anoop Saldanha f658ffbc9c Order the signatures based on certain rule parameters like actions, flowbits, flowvar, pktvar, priority etc 17 years ago
Victor Julien 4cc24fe463 Improve the handling of addresses and ports. Properly detect !any, other full negation. Fix [80:!80] syntax errors being undetected. 17 years ago
Victor Julien ea1fe0cf61 Set signal handlers after the unittests so we can kill the test runs with ctrl-c. 17 years ago
William Metcalf 3cf1be8710 invalid negation unittests added 17 years ago
Victor Julien be3bbe0a85 Fix segv in reassembly. Fix sequence gap handling tests. 17 years ago
Victor Julien db9e693054 Small fixes to pfring patch. 17 years ago
William Metcalf 04b0f177fc native PF_RING support with fixes 17 years ago
Brian Rectanus 7f1b0efab3 IpOpts Rule Keyword 
Signed-off-by: Brian Rectanus <brectanu@gmail.com>
 17 years ago
Breno Silva 27c61ac148 IpOpts Rule Keyword 
Signed-off-by: Brian Rectanus <brectanu@gmail.com>
 17 years ago
Victor Julien b3cb29b758 Fix engine lockup due to mutex locking error. 17 years ago
William Metcalf cf473bf0ce added support for escapes inside of msg keyword 17 years ago
Victor Julien 97a2f4e747 Improve error checking in detect, add comments. 17 years ago
Victor Julien ae3d4b6d7f Silence clang warn. 17 years ago
Victor Julien 8a68520f55 Fix clang warnings. 17 years ago
William Metcalf ace371665d changed sigs for http logging to use established keyword 17 years ago
Victor Julien 4170ec8955 Make locking of the flow optional in the app layer subsys so we can also pass locked flows to it. 17 years ago
Victor Julien 5ecd187b6f Tie app layer parsing to the stream engine. 17 years ago
Victor Julien f0d556b9e3 Suppress nfq debug output. 17 years ago
Gurvinder Singh c06b2849fb fixed unit tests and add the comments 17 years ago
Gurvinder Singh e88249ee24 small performance enhancement 17 years ago
Gurvinder Singh 37b4682407 target based paws handling 17 years ago
Gurvinder Singh 573027a1ec PAWS support and one unittest 17 years ago
Gurvinder Singh 45cb8f5f0c changed flag name 17 years ago
Gurvinder Singh 3350245f75 timestamp support 17 years ago
Breno Silva 7aaad91f39 Comments fix 17 years ago
Brian Rectanus 3e9223c22c Cleanup bytetest and bytejump. 17 years ago
Victor Julien a4fe971897 Fix datalink retrieval for pcap file mode and nfq mode for use in unified2. 17 years ago
Breno Silva c8308222c1 Unified2rev2 
Signed-off-by: Breno Silva <breno.silva@gmail.com>
 17 years ago
Victor Julien bff8ae299f Fix pcap file mode 17 years ago
Victor Julien 597d0e9a20 Fix detection of failed thread startup. Cleanup startup output a bit. 17 years ago
Victor Julien ab09e80205 Remove unnecessary header. 17 years ago
Victor Julien 0d0ffb9963 Reorganize header inclusions. 17 years ago
Victor Julien 1727d191a4 Add pktvar and flowvar tests to ip only unittest. Make output cleaner. 17 years ago
Pablo Rincon 3458c07f46 Changed SignatureIsIPOnly and added some unittests 17 years ago
Jason Ish f508d1e0fd Add getters for integer and boolean values. 17 years ago
root 2c796339f7 Small fixes 17 years ago
Pablo Rincon bdf119ade3 Adding window and isdataat keyword and some unittests 17 years ago
Victor Julien 0941c152fd Minor layout fixes. 17 years ago
Breno Silva f6b36b7241 Unified2rev2 
Signed-off-by: Breno Silva <breno.silva@gmail.com>
 17 years ago
Breno Silva ee8fef2e68 Unified2rev2 
Signed-off-by: Breno Silva <breno.silva@gmail.com>
 17 years ago
Breno Silva 8c797927cd Unified2rev2 
Signed-off-by: Breno Silva <breno.silva@gmail.com>
 17 years ago
Breno Silva 145d89ba01 Unified2rev1 
Signed-off-by: Breno Silva <breno.silva@gmail.com>
 17 years ago
Breno Silva a5e386ce52 Unified2 
Signed-off-by: Breno Silva <breno.silva@gmail.com>
 17 years ago
William Metcalf c313444991 comment out printf for unittest format 17 years ago
Jason Ish beef3c6c24 Fix access to ttl. 17 years ago
Victor Julien daf3078279 Fix compilation on 32bit 17 years ago
Brian Rectanus ed3fee2bac Fixed detect-byte src to use new util-byte return codes. 17 years ago
Brian Rectanus ba4c2e599d Add byte test to detection engine. 17 years ago
Brian Rectanus 11d068740a Byte utils return num bytes extracted on success instead of zero. 17 years ago
Brian Rectanus 02a8b583c9 Added byte_test and byte_jump support. 17 years ago
Brian Rectanus af06e6a288 Added byte extraction util. 17 years ago
Victor Julien cfb605aa8a Put the precooked runmodes in a separate file. 17 years ago
William Metcalf e95e5cb36a missing memsets in pppoe unit tests 17 years ago
Victor Julien 301522f316 Add TCP_GET_WSCALE macro for easy access to wscale. Update StreamTcp to use it. Default to wscale 14 (max) in case of midstream as there seems to be no reliable way to predict wscale if we missed it. 17 years ago
Victor Julien f92ac1fbdb Merge branch 'tcpopt' into next 17 years ago
Victor Julien a6fe5a7331 Add TCP_GET_TS1 and TCP_GET_TS2 marco's to efficiently retrieve the TCP timestamps in host order. 17 years ago
Jamie a297225157 victor must be getting sick of PPPoE and ICMP 17 years ago
Victor Julien b6deadd2b4 Fixed a few missing places for tv->flags access. Changed mutex init for packets slightly. 17 years ago
Victor Julien 968dc45d27 Merge branch 'threading' into t 17 years ago
Victor Julien 1858be7a2f Lock threadvars flags using spinlocks. 17 years ago
Victor Julien edfddcb282 Clean up stream tests memory handling. Remove counters in the address handling that were thread unsafe. 17 years ago
William Metcalf 6095b8f2a1 fix for older libc's missing def for IPPROTO_DCCP 17 years ago
Victor Julien f03d540d2f Suppress debug output in yaml loader. 17 years ago
Jason Ish c91a4baad5 - Autoconf goo for libyaml. 
- Mock YAML configuration file.

- YAML loader for basic YAML files - not all YAML elements support yet..
  todo.

- Add --dump-config command line parameter to dump the state of the
  configuration db after loading the config file.
 17 years ago
Victor Julien 733c3bcb8c Fix "ip" rules not ending up in the tcp and udp sig group heads correctly. 17 years ago
Victor Julien d883a993f7 Make sure stream_size works on IPv6 as well, only checks TCP packets, validates input better. 17 years ago
Gurvinder Singh 0675b7d7cf fixed unittests against protoctx 17 years ago
Gurvinder Singh d82d83eba2 fixed regex to handle space 17 years ago
Gurvinder Singh df74597a1f use next_seq for stream size and comments 17 years ago
Gurvinder Singh 7e5f5e68e8 regex intial version 17 years ago
Gurvinder Singh aa87f70470 stream size match function and unittests 17 years ago
Gurvinder Singh ac53ca5b27 Stream Size rule option 17 years ago
Anoop Saldanha 3a45b2711c Fixed the Perf API startup issue 17 years ago
William Metcalf 07bb501aca compile fix for source-nfq.c 17 years ago
Victor Julien 15b75d727a Fix reassembly unittests. 17 years ago
Victor Julien a39108843e Small tm module API rename to reflect that Init/Deinit/ExitPrintStats are per thread calls. 17 years ago
Victor Julien b102ea2123 Big update: 
- Implement "closing" state in flow.
- Add protocol specific timeouts.
- Lots of stream tracking updates, fixing a lot of out of window issues.
- Stream reassembly fixes.
- Implement a new IDS runmode with 4 stream and detect threads.
- Added a BUG_ON macro that aborts the engine if the expression is true.
- Better balance the flow queue handler for traffic that doesn't have flow (like icmp currently).
- Simplify application level protocol in the Tcp Session.
- Add some debugging memory counters.
 17 years ago
Victor Julien b4f0e82463 Small flow updates. 17 years ago
Gurvinder Singh 2e3d7fcb9d Fixed seg fault 17 years ago
Gurvinder Singh 9dcf6e2de2 handle the FLOW_STATE_CLOSED 17 years ago
Gurvinder Singh ced5157dc9 Flow get state protocol specific 17 years ago
Gurvinder Singh ec4fee215c registering unit tests 17 years ago
Gurvinder Singh ab76253ec6 registering stream timeouts and flow prunning unit tests 17 years ago
Gurvinder Singh a4ad7939d2 proto specific free function 17 years ago
Gurvinder Singh 55cdf8947e some modification in protocol specifc timeouts and free funtion 17 years ago
Gurvinder Singh efcde9f52e Some fixes for timeouts 17 years ago
Gurvinder Singh e3b76dcaad efficient protocol specific timeouts 17 years ago
Gurvinder Singh b46d9dc2b4 part2 and part3.1 of timout task 17 years ago
Gurvinder Singh 59e2232211 setting timeout on first packet in the flow 17 years ago
Gurvinder Singh a31a261737 Another and right way i guess for timeouts 17 years ago
Gurvinder Singh 0e64fa78b4 Protocol Specific Timeouts 17 years ago
Gurvinder Singh a65d558d2f Changed the debug message 17 years ago
Victor Julien 7c5f95db01 Small threading update. 17 years ago
Anoop Saldanha f35d9f0437 threading improvements. Replaced the use of slot(2/3) with varslot. Improve error handling in slot functions. Additional helper functions for thread creation 17 years ago
Victor Julien 03d084858c Add macro's for access to ICMPv(4|6) type & code. 17 years ago
Jason Ish 00821489d7 Unit test will now fail if allow_override bug is reintroduced. 17 years ago
Jason Ish 3f51fc2ce7 - Add a configuration dumper. 
- Fix a bug where you could override a configuration value that did not
  set allow_override to true.
 17 years ago
Victor Julien aad8aaf3cb Actually add the new queue handler. 17 years ago
Victor Julien 3636ca9703 Adding a "flow" queue handler. This queue handler passes packets of the same flow to the same queue. Changed the default IDS mode to use this. 
Some output cleanups, shutdown should be cleaner now.
 17 years ago
Victor Julien e7206623bb GRE struct naming fix, comment adds. 17 years ago
Anoop Saldanha 22c0ec2bc5 Added support for the csum-<protocol> rules keyword to the detection engine. Keywords added are ipv4-csum, tcpv4-csum, tcpv6-csum, udpv4-csum, udpv6-csum, icmpv4-csum and icmpv6-csum 17 years ago
Victor Julien 39724df664 2nd try of fixing some bugs reported by static code analysis tool. 17 years ago
Victor Julien 6eaff4be12 Fixes for issues found by static code analyzer. 17 years ago
Victor Julien 85b1fd7dfc Add TLS 1.1 and 1.2 detection. 17 years ago
Anoop Saldanha 401a0313d4 checksum calculation functions for icmpv6, udp over ipv6 and tcp over ipv6 17 years ago
Victor Julien 1f782bb912 Fix pointer issue in sig loading. 17 years ago
Victor Julien 086ba5f49b Add 'BySize' field parser. Add stub tls parser. 17 years ago
Victor Julien b26b5aa462 More cleanups. 17 years ago
Jamie 9adfe54620 more unit tests for pppoe - part I 17 years ago
Victor Julien 44b6042cf9 Fix wrong data type used in a reassembly error checking. 17 years ago
Anoop Saldanha 41dd0f8e62 checksum calculation functions for ipv4, tcp, udpv4, icmpv4 17 years ago
Victor Julien 18f556ade1 Fix a number of broken overlap calculations. Add comments exmplaining them all. 17 years ago
Victor Julien 85abc3ef62 Complete removal of global de_ctx. UtRuntests now returns the number of failed tests or 0 on none. Program exits with code 1 on failed tests, code 0 otherwise. Removal of broken http uri test. 17 years ago
Victor Julien 1132ab635a Rename all pmt->det_ctx. 17 years ago
Victor Julien b9972a9d2c Cleanups 17 years ago
Victor Julien 855dc62e30 Git merge artifact. 17 years ago
Brian Rectanus 63d970eb0b Fix compiler warning and add better ipv4 options debugging output. 17 years ago
Victor Julien 84da1e9dc4 Add seg_list integrity testing to reassemly. Remove all debug output but some. Better deal with packets before the point that we already reassembled. 17 years ago
Gurvinder Singh 65ebb5611d Task 4 handling of missed packets by IDS only and both IDs and end host 17 years ago
Gurvinder Singh feecb7406a Fixed some issues in gap handling 17 years ago
Gurvinder Singh 0a32b6491f Handling of IDS missed packets and its unitests 17 years ago
Gurvinder Singh b267d4072a test the bug in freeing memory 17 years ago
Gurvinder Singh bcebbebdfd Handling IDS missed packets 17 years ago
Victor Julien 7715e8f0fc Work around some Tcp session free issues in the app layer parsers. 17 years ago
Victor Julien 391e69e699 Fix tunnel packet handling. 17 years ago
Victor Julien e7f8a02484 Improve GRE counting. Actually use the GRE decoder. Register the GRE counter. 17 years ago
Breno Silva 9528e02e46 GRE support 17 years ago
Victor Julien f5fe190b45 Fix a ipv4 compiler warning. Improve TCP opt decoding error handling logic. 17 years ago
Brian Rectanus 74cb73fc1d Decode IPv4 options. 17 years ago
Victor Julien d7de22d0f0 Removing GPLv2 license info as our bylaws aren't final yet and we will redist code non-GPL as well. Rename struct conf_node to ConfNode to comply with engine coding style. 17 years ago
Victor Julien efdd952eb5 Remove noisy debugging output. 17 years ago
Victor Julien 6a1acba1ab Fix missing conf include. 17 years ago
Jason Ish e3b538c7d7 Simple configuration API. 
Allow the log directory to be changed.
 17 years ago
Victor Julien c73f4334d0 Fix compiler warning. 17 years ago
Victor Julien 4369816cdd Improvements to content keyword memory handling. 
First version of a simple pattern based L7 proto detection engine. Currently just works by matching a single pattern in the initial data. Implemented HTTP, SSL, MSN, JABBER, SMTP and a few more.

Couple of pattern matcher cleanups.
 17 years ago
Victor Julien 0242fad770 Fix error in freeing the ctx of a SigMatch. 17 years ago
Victor Julien 97854cf4bb Fixup some rule parser memleaks 17 years ago
Victor Julien 25aa05fdb2 use C99 int's. 17 years ago
Gurvinder Singh 6393b6778c unittests for gap handling 17 years ago
Victor Julien 57f71f7e4b Pass the DecodeThreadVars to all Decoder functions properly. Improve the error handling. 17 years ago
Victor Julien 63bc68ee90 Unify all counter registration code on uint16_t counter id's. 17 years ago
Anoop Saldanha 244f5d547a new registration functions for the stats api, with local thread storage for counter ids 17 years ago
Victor Julien d67eec918f Adapted flow comments to doxygen style. 17 years ago
Victor Julien 0a9fca7e57 Fix compilation without unittests enabled. 17 years ago
Victor Julien 451adaff34 Small name support code update for flowbits, flowvars and pktvars. 17 years ago
Victor Julien 522efdcf03 Small reshuffle of the free funcs in the Stream code. 17 years ago
Gurvinder Singh 6824eddb0f New function for task3 17 years ago
Victor Julien 5b946443d8 Use finer grained locking for app layer parsing. 17 years ago
Victor Julien 2d406555a8 Fix compiler warning about 'mode'. 17 years ago
Jamie 698e9c0699 fix incorrect offset in decode-ethernet for PPPoE, more debug statements 17 years ago
Victor Julien 4ec31e0445 Fix short IPv4 packets not getting detected in the decoder. Set decode event on short ipv6 packets. 17 years ago
Victor Julien 265038a75a Fix a memory read error in the BDNM search algorithms. Also (hopefully) fix a 64bit error. 17 years ago
Victor Julien f6a8454232 Layout fixes. 17 years ago
Jamie fdbd09db6c add perfcounter to pppoe 17 years ago
Jamie afa8a6766e test cases for PPPoE, ICMPv4 17 years ago
Victor Julien e31563f61c Fix nfq compilation. 17 years ago
Victor Julien 720ac9efe8 Improve unittest error message if unittests are not compiled in. 17 years ago
Victor Julien 5501212e62 Fix sizeof printf related compiler warnings. 17 years ago
Brian Rectanus fa5939ca91 64 bit cleanup part2 17 years ago
Brian Rectanus 9a9b506c34 64 bit cleanup 17 years ago
Victor Julien 2a6aa00cd8 Use double for the avg counter. 17 years ago
Victor Julien 2e4cc2ad3d Convert tabs to spaces in PPPoE code. 17 years ago
Jamie 8817364ef6 initial PPPoE decoder commit 17 years ago
Victor Julien 3cf7e2e94e Add two counters: avg_pkt_size and max_pkt_size. 17 years ago
Victor Julien 1c3c13c7eb Fix missing limits.h include. 17 years ago
Anoop Saldanha 8af9f902e8 additional support for type qualifier for the stats api 17 years ago
Victor Julien 630a58b719 Fix unittests -u commandline option. 17 years ago
William Metcalf dd86b51dbc added optional option to specify signature file to load 17 years ago
Victor Julien 73217d60b9 Fix compiler warning in binsearch fix. 17 years ago
Victor Julien 9f78d47c2a Further work on the stream L7 parser, it's api and the http stub implementation. 17 years ago
Victor Julien 08ae4482a2 Fix 1 byte searching in BinSearch function. 17 years ago
Victor Julien 9b7ee312e3 Small update. 17 years ago
Victor Julien 5a9a23f9bb Update to the parsers. 17 years ago
Victor Julien 8e10844f95 Initial code of Application Layer parsing framework. Rename of L7* to AppLayer*. 17 years ago
Victor Julien 95f4706549 Merge branch 'victor_local' 17 years ago
Victor Julien 4f358c5a07 Fix list handling in reassembly 17 years ago
William Metcalf 413efe8668 fix regression in detect-parse.c 17 years ago
Jason Ish fed12be6c0 Add some usage. 17 years ago
Jason Ish f28ffebf0e Basic command line support for pcap (file, network), nfq and unit test modes. 
Just some basic command line support I had in my tree for setting the
run-mode, including unit tests.  Seems fine for simple setups, but I
think we'll want to make things setup in the config file.  Anyways, I
like to switch from file to real device without a recompile :)

Also want to check with you if the patch is formatted correctly.. I
use git format-patch then used it as a template into mutt, which seems
easier than the git send-email command.

Thanks
-- Jason
 17 years ago
Victor Julien e147b87d5f Fix small error in thread creation. 17 years ago
Victor Julien 8c0a5269c0 Fix pcap returning out of it's loop every time. 17 years ago
Anoop Saldanha 53c21410b6 improve the threading api for the ids 17 years ago
Anoop Saldanha d0e70309c0 Implements counters for the decode module 17 years ago
Victor Julien fb68d1c658 Merge branch 'de' 17 years ago
Victor Julien 63d32f723f Fix decode event compiler warning. 17 years ago
Victor Julien b7ad199c97 Fix broken test. Fix content keyword parsing not escaping properly. 17 years ago
William Metcalf ebd569ca4a Added unit tests to detect-content.c to show problems with escaped chars ; " \ : in snort rule lang 17 years ago
Victor Julien b6d55f84ac Revert default runmode change. Fix running decode event unittests twice. 17 years ago
Breno Silva c90b4e6fcd Decode event rule 17 years ago
Victor Julien 54ae12b1f9 Fixes for the stream reassembly. It turned out that using both a prev_seg pointer and a list_seg->prev pointer at the same time was not the best of ideas. So removed the prev_seg ptr. Cleaned up some copy functions too. Added some more debug statements. Made sure the L7 stuff doesn't kick in when running the unittests for reassembly. 17 years ago
Victor Julien e40495e31d Fix git merge artifact. 17 years ago
Victor Julien 387472185d Small reshuffling of the unittests, fix of a buffer overflow, hide some dbg output in the stream reassembly. 17 years ago
Victor Julien 1f995361dd Switch to pthread_cond_timedwait in streammsg queue. 17 years ago
Victor Julien b7c42d55f5 Fix setting l7 thread name. 17 years ago
Victor Julien 4dc8ebac0c Fix locking error causing deadlocks. 17 years ago
Gurvinder Singh 994473cea0 Target Based Stream Reassembly with comments 17 years ago
Victor Julien 25f696106c valgrind memcheck: fix a b3g mem leak at shutdown. 17 years ago
Victor Julien c5b2b8c082 valgrind memcheck: fix small pool memory leaks in the unittests. 17 years ago
Victor Julien dbe2a86ffe valgrind drd: fix flow mutex reinitialization in the flow subsystem when called by unittests. 17 years ago
Victor Julien f5eeea5b0b Make sure flow isn't freed while stream msgs are still in use. 17 years ago
Victor Julien ad093e3021 Add doxygen syntaxed comments to the threadvars structure. 17 years ago
Victor Julien f9227969b0 Add some dbg output to the counters. 17 years ago
Victor Julien 28ad13c7f4 Small output fix for counters. 17 years ago
Anoop Saldanha 7dcd0252ca perf task bugs fixed v3 17 years ago
Victor Julien ae2535c960 Small counter output fixes. 17 years ago
Anoop Saldanha ed820e22cf perf task bugs fixed v2 17 years ago
Anoop Saldanha fc8bb6c934 perf_task_bugs_fixex_v1 17 years ago
Anoop Saldanha a5fb240a4a Changes added for the Performance Counter API 17 years ago
Victor Julien 175eaeca93 Slightly moved around the NFQ define a bit. 17 years ago
Victor Julien e6400bf456 --enable-unittests now controls compilation of unittest code. Added crude commandline support for running unittests: ./eidps runtests 17 years ago
Victor Julien 462a346bf6 Fix printf formatting error in a pool unittest. 17 years ago
William Metcalf a3510f2025 Made NFQ optional via --enable-nfqueue, --enable-logsigs will now load local.rules in the path other fixes 17 years ago
Victor Julien 646262a755 Small cleanups. 17 years ago
William Metcalf 3046cf391d Small printf fixes to detect-flow 17 years ago
William Metcalf 9b4c0d057f Updated flow parsing code for validation, added unit tests, fixed statless check 17 years ago
Victor Julien 1dc2916c3a Add debug output to SetupPkt. 17 years ago
Victor Julien 7c36b315fd Kill the engine if one of the threads fails to initialize. 17 years ago
Victor Julien 051f21e797 Output more info about sequence gaps. 17 years ago
Victor Julien 9854c19a88 Adapt Flow subsys init function to be able to initialize quietly for us in unit tests. Add flow to PPP unit tests. Fixes a floating point exception error. 17 years ago
Victor Julien 416bdd543a Add unit test to pool for the bug from yesterday. 17 years ago
Victor Julien c42fa78287 Fix wrong segment ordering, fix stream messages not being queue'd right. 17 years ago
Victor Julien 77b19f6d82 Fix pool bug. 17 years ago
Victor Julien c53dfea379 Improve the threading code to enable a single pcap file processing thread. 17 years ago
William Metcalf d79b85d251 Small regex fix for portlists in detect-parse.c 17 years ago
William Metcalf d4e9ca8417 source-pcap.c comments modified for doxygen formatting 17 years ago
Victor Julien 689bbfdc45 Rename all structure definitions in the "typedef struct _SomeStruct" format to "typedef struct SomeStruct_" to make the Doxygen output more useful. 
Remove the Trie multi pattern matcher code. It wasn't used anymore.
 17 years ago
Victor Julien ffa013b2d8 Implement flow:established and flow:stateless 17 years ago
William Metcalf 1ae490e6c8 Small debug fix in decode-udp.c 17 years ago
Victor Julien 516ca7ead5 Fix IPv4 and IPv6 decoders not being able to deal with ethernet packets with trailing bytes. 17 years ago
Victor Julien 72b430d0bb Small pcap cleanups. 17 years ago
William Metcalf 1d1f080733 Remove Libpcap GlobalVars from source-pcap.c 17 years ago
William Metcalf 2ab8291ea8 Multi-Threading capable libpcap 17 years ago
Victor Julien 8c3d0c054b Pcap fixes. 17 years ago
William Metcalf b5c19be29c libpcap fixes for error handling and defines 17 years ago
Victor Julien 4715c2f596 Small pcap layout fixes, also made it a little bit more quiet. 17 years ago
Will Metcalf af992242a8 libpcap stuff v2 17 years ago
Victor Julien c957dc7775 Updates & cleanups to stream & l7 stuff 17 years ago
Victor Julien 76581ef967 Small layout fixes to the ppp code. 17 years ago
Breno Silva dec11038c6 PPP Support 17 years ago
Victor Julien 1c2240cfeb Stream reassembly update and WIP code for L7 modules. 17 years ago
Victor Julien 2c8df73d24 Add decoder events to ethernet and sll decoding. 17 years ago
Victor Julien eb0a5d8762 Add Address copy macro. 17 years ago
Victor Julien de1639e263 Enforce max pool size. 17 years ago
Victor Julien 51a9e36e10 Remove vips references. Rename to eidps. 17 years ago
Victor Julien 8bc0a2e465 Add tests for pool. 17 years ago
Victor Julien 668e9514d7 Pool update. Stream reassembly start. 17 years ago
Victor Julien 8397413942 Comment updates. 17 years ago
Victor Julien 9c7f5afa79 Large update: pcap support, threading fixes, initial stream tracking, time handling, pool support, runmodes, decoders added, autojunk update. 17 years ago
Victor Julien a0b390c541 Fix pktvar and http uri memory leaks. 17 years ago
Victor Julien 930aa4e038 Fix ip-only again: flowbit sigs were not handled correctly and tcp/udp sigs with ports set also were not. 17 years ago
Victor Julien a93d51fcde IP only rule loading optimization and counting fix. 17 years ago
Victor Julien 84aa365a3b Fix iponly matching. 17 years ago
Victor Julien 766ebed4d4 Fix Flowvar idx retrieval. 17 years ago
Victor Julien 2ecc7f2b4b Use different rule grouping settings for toclient and toserver. Fix flowbits accounting. 17 years ago
Victor Julien ff4b5a5db7 Add support for flowbits. 17 years ago
Victor Julien 657be002d1 Big detection engine update: scan improvements, b2g/b3g updates, bloom fixes, iponly detection implementation, dsize/flow grouping. 17 years ago
Victor Julien e877d69a2d Add compare func to hash table, fix remove in hashlist table. 17 years ago
Victor Julien 5df5b35e90 Put all globals in the detection engine ctx. Add HashList type, a hash that also stores the items ina list to it can be traversed. Many cleanups. 17 years ago
Victor Julien b2eb954099 Add b3g 3gram BNDM pattern matcher. Fix multi queue nfq initialization. Improve speed of b2g and wumanber. 17 years ago
Victor Julien ec39f5446c Fix rule tree update. Fix bloomfilter error in b2g. 17 years ago
Victor Julien 1c0ad1d415 Add implementation of the Simple BNDM 2gram pattern matcher algorithm. 17 years ago
Victor Julien efb10fc0d6 big update 17 years ago
Victor Julien 21364b34dc Fix uricontent scan for copied siggroupheads. 17 years ago
Victor Julien 69e056e33f Add the scanning to uricontent as well. 17 years ago
William Metcalf 85675ba066 added fix for compiler warning in reject code 17 years ago
Victor Julien fedcc397de Detection engine improvement: don't run pattern matcher on packets with payload sizes less that the biggest content we need to match. Add some extra stats. 17 years ago
Victor Julien 0250642cc0 Fix negated variables, add tests. 17 years ago
Victor Julien dce2c12915 Add Scan before Search to the detection engine. 17 years ago
Victor Julien 4c4862d838 Improve logging, add alert-output module, at module exit stats, add HTTP POST uri capture. 17 years ago
Victor Julien 724d942688 Fix port check. 17 years ago
Victor Julien 43571f21a4 default to all.rules 17 years ago
Victor Julien e0ed51d049 Small fixes and dbg additions. 17 years ago
Victor Julien b064d0f435 Fix sig unittests 17 years ago
Victor Julien 9b07710389 Add hashing and bloomfilter api's: now include buildsys update 17 years ago
Victor Julien 49117f5e64 Add hashing and bloomfilter api's 17 years ago
Victor Julien 27f236778a make output more quiet 17 years ago
Victor Julien 298d4be7bb Threading update for tunneling and high load 17 years ago
Victor Julien 4b6a8715fd Fix packets getting stuck in NFQ under high load. 17 years ago
Victor Julien c4f2fe4bd7 Implement per packet variables and switch the http stuff to it. 17 years ago
Victor Julien edf8650a7e Tunnel update. 17 years ago
Victor Julien 835d609fc5 Small format fix. 17 years ago
Victor Julien 8cda70668c Tunnel fixes. 17 years ago
Victor Julien 28d9415e37 New approach to tunnel decoding. 17 years ago
Victor Julien 982542cde6 New approach for the empty packet queue issue. Now we just wait until it's no longer empty. 17 years ago
Victor Julien 2f6a186078 Alloc a new packet if the queue is empty. Fix this. 17 years ago
Victor Julien a454fe4fb7 Small fixes 17 years ago
Victor Julien 274d92478e Alloc a new packet if the queue is empty. 17 years ago
Victor Julien da3125e888 Fix a Floating point exception error. 17 years ago
William Metcalf 817d0e0855 added macros for ICMP defines 17 years ago
William Metcalf 7006085195 udp decoding added icmp unreachables added to reject 17 years ago
Victor Julien 3f7195454b Big detection engine update. 17 years ago
Victor Julien ea5bb1c8d5 Small update and new tests for wu-manber. 17 years ago
Victor Julien ebf41c3b1e Remove obsolete decode-http files. 17 years ago
Victor Julien 1cb274a39a Update build sys 17 years ago
Victor Julien aecda426bf Update the wu-manber pattern matcher: it supports dynamic hash sizes and improves init times. 17 years ago
Victor Julien 54ffe2053e Large detection engine update. 17 years ago
Victor Julien 8b3d06fd92 Rename some detection engine related files. 17 years ago
Victor Julien f3a94413db Properly support 'alert ip' rules. Add support for handling ip only rules differently. 17 years ago
Victor Julien dee5ab1aa3 Fix uricontent mpm ctx comparison. 17 years ago
Victor Julien fed6926809 Small cleanups 17 years ago
Victor Julien dc48c58473 Switch to using a detection engine ctx. 17 years ago
Victor Julien 171c8c777d Group signatures by protocol. 17 years ago
Victor Julien 3446566e44 Style cleanups for resets. 17 years ago
Victor Julien 45f83f7636 branching test 17 years ago
William Metcalf 0ffa1c2465 updates for configure.in, added reject code, some decode stuff for tcp 17 years ago
Victor Julien 9e5049cddc Improve memory handling and parsing of the msg rule keyword. 17 years ago
Victor Julien eb1c4e4987 Large update to the detection engine. Greatly improve initialization speed and memory usage. 17 years ago
Victor Julien b1a13c89bd Improve memory handling of the pcre rule keyword. 17 years ago
Victor Julien a603577132 Small update to the pcre used for signature parsing. 17 years ago
Victor Julien 0489370f5b Big speedup of the initialization code for signatures. Contains WIP code as well. 17 years ago
Victor Julien ac60f32197 Make nocase keyword initilization failure fatal and slightly improve the error message it prints. 17 years ago
Victor Julien 84087e7077 Fix a memory error in the addresslist parsing code. Add a functions aimed at speeding up the signature initialization code. 17 years ago
Victor Julien b50fc8aecd Speed up appending of sigs to a sig group head by using a tail ptr. 17 years ago
Victor Julien 0726efead9 Support address lists. 17 years ago
Victor Julien f2fbf395b8 Fix mixed up CI and CS searching in WuManber. Add better tests. 17 years ago
Victor Julien 69162f9cd0 Fix issue with log-httplog where it logged uri's of previous packets because of a broken uri check. 17 years ago
Victor Julien 05fd319f6c Add log-httplog module that logs http request uri's, hosts and useragents to a per line text format. 17 years ago
Victor Julien eaaeb30cd6 Add noalert keyword for use with sigs that are used for capturing only. 17 years ago
Victor Julien 63bb777100 Use a default prio of 3. 17 years ago
Victor Julien f0ed41fb0a Support priority keyword, add priority to alert-fastlog. 17 years ago
Victor Julien 867d493d7f Source NFQ update... less hackish, but still needs work as soon as we know how to do configuration. 17 years ago
Victor Julien dc224cb2d2 Large update containing the first step to making the detection engine use rule groups. Address based rule groups are now implemented. 17 years ago
Victor Julien 9afa171d71 cosmetic update of alert-fastlog Will 17 years ago
Victor Julien a7ee4c5b1b Update todo of alert-fastlog 17 years ago
Victor Julien 3df4b7da2b Set p->proto and add TCP, UDP, etc macros. 17 years ago
Victor Julien b7bc35e8b2 support for 'negation' in addresses and the 'any' special case. 17 years ago
Victor Julien 876f0c95c7 Signature rule keywords are case insensitive. Support that. 17 years ago
Victor Julien d036264f80 Cleanup signature parsing and other detect.c parts. 17 years ago
Victor Julien f1db87276c Start on addr and proto parsing in rules. 17 years ago
Victor Julien 6c1f2071be Add unittest registration to the threading modules api. 17 years ago
Victor Julien cd19ee8bf2 Fix crash when to_client traffic was scanned for uricontent when there was no uri available... 17 years ago
Victor Julien f77c654d13 Further develop the address api. Added dynamic group head support. 17 years ago
Victor Julien 3ec5f66729 Fix some address code related compiler warnings. 17 years ago
Victor Julien d2b089f359 Fix including the header for htonl breaking the code. 17 years ago
Victor Julien bbbb644dea Add error checking to CIDRGet and make it quiet. 17 years ago
Victor Julien a798f84bf5 Add simple test report to unittesting. 17 years ago
Victor Julien 151512a45c Split up address code in ipv4 and ipv6 specific files. Cleanups. 17 years ago
Victor Julien 41647a5430 small fixes for Wills patch 17 years ago
William Metcalf 559edc01e3 NFQUE drop support added with ident of 4 :-( 17 years ago
Victor Julien 37e31e0240 Implement the address code for IPv6 as well. 17 years ago
Victor Julien b8ad4adf81 complete rename of address2 to address 17 years ago
Victor Julien 9c321af65e Rename address2 to address 17 years ago
Victor Julien e746a40d2e No longer track Makefile.in files in Git. 17 years ago
Victor Julien 28b0d82169 Remove partial and broken address handling implementation now address2 is working. 17 years ago
Victor Julien fad31a43c2 WIP addressing handling. Big progress. Address groups for ipv4 more or less getting shape. 17 years ago
William Metcalf 3488cf1a93 fixed sig written with ?<http_uri 17 years ago
William Metcalf 87411594e2 groups fixed for pcre < 7 17 years ago
Victor Julien 7aada782a4 WIP address matching stuff 17 years ago
Victor Julien ec37171d36 Add copyright msg (test commit). 17 years ago
Victor Julien bab4b62376 Initial add of the files. 17 years ago