9538 Commits (2ce7d98af136ca5cfe62888eba585bd131a8fe01)

Author	SHA1	Message	Date
Shivani Bhardwaj	9f9670ebdc	logging: Add DCERPC logger	6 years ago
Shivani Bhardwaj	bab497ab2c	dcerpc: Add multi transaction support ... DCERPC parser so far provided support for single transactions only. Extend that to support multiple transactions. In order for multiple transactions to work, there is always a transaction identifier for any protocol in its header that lets a response match the request. In DCERPC, for TCP, that param is call_id in the header which is a 32 bit field. For UDP, however since it uses different version of RPC (4.x), this is defined by serial number field defined in the header. This field however is not contiguous and needs to be assembled by the provided serial_low and serial_hi fields.	6 years ago
Victor Julien	9831839388	detect/mpm: fix hs check	6 years ago
Roland Fischer	9f1efa3c10	pcap: 32bit counters can wrap-around ... Fixes issue 2845. pcap_stats is based on 32bit counters and given a big enough throughput will overflow them. This was reported by people using Myricom cards which should only be a happenstance. The problem exists for all pcap-based interfaces. Let's use internal 64bit counters that drag along the pcap_stats and handle pcap_stats wrap-around as we update the 64bit stats "often enough" before the pcap_stats can wrap around twice.	6 years ago
Shivani Bhardwaj	67e7be633c	krb: convert to jsonbuilder ... Closes redmine ticket 3754.	6 years ago
Shivani Bhardwaj	72dab0a8b7	snmp: convert to jsonbuilder ... Closes redmine ticket 3756.	6 years ago
Jason Ish	53aa967e0b	applayer: add flags to parser registration struct ... This will allow Rust parsers to register for gap handing from Rust (some Rust parsers do handle gaps, but they set the flag from C).	6 years ago
Jason Ish	7476399f43	template: add gap handling	6 years ago
Victor Julien	4726d7027c	detect/mpm: 'mpm-algo' parsing cleanups	6 years ago
Victor Julien	f2a3d6d834	flow: fix unlikely issue with int handling ... Thanks for reporting this magenbluten PR 4575.	6 years ago
Victor Julien	fa2b46cdc3	detect/stream_size: minor code cleanups	6 years ago
Victor Julien	ac3cf6ff75	detect/config: set config for special cases ... Allow app-layer to declare the txs are uni-directional and special care is needed for applying config.	6 years ago
Victor Julien	2145cf99a3	detect/config: initial version	6 years ago
Victor Julien	a2f249cc86	app-layer: handle AppLayerTxData being NULL ... Http parser can have 'NULL' user data in case of memcap limit getting reached.	6 years ago
Victor Julien	5dd4d948d9	app-layer: remove unused detect flags API	6 years ago
Victor Julien	f88657206c	app-layer: GetTxData callback is mandatory	6 years ago
Victor Julien	8fe9faecb2	app-layer: remove DetectFlags API. Replaced by AppLayerTxData	6 years ago
Victor Julien	9664f73f75	app-layer: remove logged API calls	6 years ago
Victor Julien	455eab370e	template: support AppLayerTxData	6 years ago
Victor Julien	e0debed0b4	tftp: support AppLayerTxData	6 years ago
Victor Julien	a1e06247a6	dcerpc/udp: support AppLayerTxData	6 years ago
Victor Julien	3202d29325	dcerpc: support AppLayerTxData	6 years ago
Victor Julien	8cd55124a3	modbus: support AppLayerTxData	6 years ago
Victor Julien	7d663ed5cf	enip: support AppLayerTxData	6 years ago
Victor Julien	fb780c7d92	ssl/tls: support AppLayerTxData	6 years ago
Victor Julien	bc11a1c23e	smtp: support AppLayerTxData	6 years ago
Victor Julien	c98f597831	ftp: support AppLayerTxData	6 years ago
Victor Julien	302cf49486	dnp3: support AppLayerTxData	6 years ago
Victor Julien	77a95eddd9	smb: support AppLayerTxData	6 years ago
Victor Julien	7a7805cde6	nfs: support AppLayerTxData	6 years ago
Victor Julien	910922cdc4	htp: support AppLayerTxData	6 years ago
Victor Julien	5665fc8301	app-layer: add ApplyTxConfig API ... Optional callback a parser can register for applying configuration to the 'transaction'. Most parsers have a bidirectional tx. For those parsers that have different types of transaction handling, this new callback can be used to properly apply the config.	6 years ago
Victor Julien	df27205451	output/tx: implement filtering	6 years ago
Victor Julien	e15995e2d2	detect: store detect flags in AppLayerTxData	6 years ago
Victor Julien	c797c9f09c	app-layer: add logger flags to AppLayerTxData	6 years ago
Victor Julien	411f428a38	app-layer: define AppLayerTxData and AppLayerTxConfig ... AppLayerTxData is a structure each tx should include that will contain the common fields the engine needs for tracking logging, detection and possibly other things. AppLayerTxConfig will be used by the detection engine to configure the transaction.	6 years ago
Victor Julien	274a033d65	htp: alloc user data at tx start ... This way the AppLayerTxData is set up from the start. Any type of processing (logging, detection) will lead to setting up the user data later on anyway. Remove other places where it was added.	6 years ago
Victor Julien	f7ff7dbaed	config: common definitions	6 years ago
Victor Julien	6dcdf394d7	rules: add config action	6 years ago
Jason Ish	8c98fa452f	dnp3/eve: update for regenerated dnp3 object logging code ... Migration from Jansson to JsonBuilder.	6 years ago
Jason Ish	bf8d8c573a	dnp3/eve: regenerator object logging code	6 years ago
Jason Ish	ccc057fdc9	dnp3/eve: convert to jsonbuilder (non generated code) ... First step of converting DNP3 to JsonBuilder by first converting the non-generated code.	6 years ago
Shivani Bhardwaj	6f7d8e50c8	src: use FatalError whenever possible ... Replaces all patterns of SCLogError() followed by exit() with FatalError(). Cocci script to do this: @@ constant C; constant char[] msg; @@ - SCLogError(C, + FatalError(SC_ERR_FATAL, msg); - exit(EXIT_FAILURE); Closes redmine ticket 3188.	6 years ago
Jeff Lucovsky	f6a399f154	general: Correct typos	6 years ago
Jeff Lucovsky	fb409664d2	detect: byte_math support	6 years ago
Jeff Lucovsky	1a726731e4	detect: Use byte-math to byte var handling func	6 years ago
Jeff Lucovsky	0e4ba7b13e	detect: Add byte_math detector	6 years ago
Jeff Lucovsky	ac01adc260	detect: Add utility module for byte var handling	6 years ago
Victor Julien	c1673908ac	eve/alert: minor cleanups	6 years ago
Victor Julien	d2c48d4faf	eve/alert: move files logging into util func	6 years ago