aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
4,688 Commits
8 Branches
173 Tags
258 MiB
main
main-7.0.x
main-8.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '3474c36b54'
${ noResults }
Commit Graph

391 Commits (3474c36b5433e12cf57b2753e4e3708d6dac6c28)

Author SHA1 Message Date
Victor Julien f4872a2f08 Add --disable-detection configure option 
Add --disable-detection configure option to compile Suricata with
detection disabled.
 13 years ago
Victor Julien 6a3621f2fe Error out if -s/-S are used with disable detect 
When Suricata is started with --disabled-detection, the -s and -S
options make no sense. So error out.
 13 years ago
Victor Julien 3e2205d08f detect-less: disable raw reassembly 
When using --disable-detection automatically disable raw stream
reassembly by forcing stream.reassembly.raw to be false.
 13 years ago
Victor Julien 5cc880c5c1 detect-less: add log only TX handling function 
When running w/o detect, TX cleanup handling needs to ignore the
inspect_id as it's only updated by detect.

This patch introduces a new ActiveTx handler for logging only:
AppLayerTransactionGetActiveLogOnly

If --disable-detection is passed on the commandline, this function
is registered.
 13 years ago
Victor Julien 50f5b246db Update main loop to handle detect-less 
Update main startup and shutdown loops to work will when detect
is disabled. In this case de_ctx remains NULL.
 13 years ago
Victor Julien 258778cde4 Introduce g_detect_disabled global 
This global will be set to TRUE if detect is disabled. The reason for
adding a global is that there currently is no clean way to pass
configuration options to management threads.
 13 years ago
Victor Julien b44ec80590 Add --disable-detection commandline option 
Flags the SuriInstance that the detection engine should be disabled.
Actual disabling is not yet implemented.
 13 years ago
Jason Ish 5850607fea Remove the old include support. 13 years ago
Eric Leblond a8c787a265 device list: clean and display stat at exit 
This patch adds a cleaning function to device list. This also
permits to display per-interface statistics during the exit.
 13 years ago
Anoop Saldanha 429c6388f6 App layer API rewritten. The main files in question are: 
app-layer.[ch], app-layer-detect-proto.[ch] and app-layer-parser.[ch].

Things addressed in this commit:
- Brings out a proper separation between protocol detection phase and the
  parser phase.
- The dns app layer now is registered such that we don't use "dnstcp" and
  "dnsudp" in the rules.  A user who previously wrote a rule like this -

  "alert dnstcp....." or
  "alert dnsudp....."

  would now have to use,

  alert dns (ipproto:tcp;) or
  alert udp (app-layer-protocol:dns;) or
  alert ip (ipproto:udp; app-layer-protocol:dns;)

  The same rules extend to other another such protocol, dcerpc.
- The app layer parser api now takes in the ipproto while registering
  callbacks.
- The app inspection/detection engine also takes an ipproto.
- All app layer parser functions now take direction as STREAM_TOSERVER or
  STREAM_TOCLIENT, as opposed to 0 or 1, which was taken by some of the
  functions.
- FlowInitialize() and FlowRecycle() now resets proto to 0.  This is
  needed by unittests, which would try to clean the flow, and that would
  call the api, AppLayerParserCleanupParserState(), which would try to
  clean the app state, but the app layer now needs an ipproto to figure
  out which api to internally call to clean the state, and if the ipproto
  is 0, it would return without trying to clean the state.
- A lot of unittests are now updated where if they are using a flow and
  they need to use the app layer, we would set a flow ipproto.
- The "app-layer" section in the yaml conf has also been updated as well.
 13 years ago
Eric Leblond 58eb6428d1 suricata: ignore SIGHUP signal 
This patch ignores the SIGHUP signal instead of having the default
behavior.
 13 years ago
Jason Ish e9a4871077 Fix alignment in usage. 13 years ago
Victor Julien 0a24ac0855 Fix Conf api usage after rebase 13 years ago
Jason Ish b8e13d4bd6 More concise API for setting config values that 
can be overrided or not (final values).
 13 years ago
Eric Leblond 1bdc39fe9b cmdline: add -k to specify checksum validation 
This patch adds a '-k' option to suricata to be able to specify
the checksum validation to use. If '-k all' is used, checksum
validation is forced. If '-k none' is used, no checksum validation
is made.

Message output in case of detection of a pcap file with a probable
cheksum issue has been updated to indicate that '-k' is a solution.
 13 years ago
Victor Julien 480fddd189 build-info: add a nicer way of printing atomics support 13 years ago
Eric Leblond 3dceca70ee suricata: move some code into PostConfLoadedSetup 
All functions before daemonization are initialisation functions and thus the
call can be moved in PostConfLoadedSetup.
 13 years ago
Victor Julien a84c502e50 Add SSE support to --build-info 13 years ago
Victor Julien 25636597af Fix live rule reload confusing delayed detect 
Fixes bug 1023 and the previous attempt to fix it.
 13 years ago
Victor Julien 5906eeb8c8 detect: don't do rule reload during delayed detect 
When both rule reloads and delayed detect are enabled, make sure we don't
trigger a reload during delayed detect initialization.

Bug #1023.
 13 years ago
Victor Julien 97bfcac444 profiling: introduce per keyword profiling 
Initial version of per keyword profiling. Prints stats about
how ofter a keyword was checked and what the costs were.
 13 years ago
Victor Julien 7ebd1e6433 Counters: fix delayed-detect counter registration 
Make sure we register the detect.alerts counter before packet runtime starts
even in delayed detect mode. The registration of new counters at packet
runtime is not supported by the counters api and might lead to crashes as there
is no proper locking to allow for this operation.

This changes how delayed detect works a bit. Now we call the ThreadInit
callback twice. The first call will only register the counter. The 2nd call
will do all the other setup. This way the counter is registered before the
counters api starts operating in the packet runtime.

Fixes the segv reported in ticket #1018.
 13 years ago
Anoop Saldanha 619414c59e Add a /* fall through */ comment for all switch case fall throughs. 
This should server as a message to coverity that the fall through is
intentional.
 13 years ago
Victor Julien 37669bfdd2 threshold: register threshold host storage. Related to bug #991 13 years ago
Victor Julien 74d8d95f83 Don't initialize threshold before rules on delayed detect. Bug #999. 13 years ago
Eric Leblond 2be194d03f suricata: add -v[v] option to increase verbosity 
This patch adds a -v option to suricata. It increases the log level
defined in the YAML.
 13 years ago
Eric Leblond 4a4600539d suricata: info message after log init 
This patch moves version display after log init so we can have an
homogeneous display.
 13 years ago
Eric Leblond fdc1757e34 suricata: reorder start 
Initalizing output just after configuration file parsing allow to
log almost all messages accordingly to configuration.
 13 years ago
Eric Leblond 7bcacc712a log: change default log level to notice 
This patch updates the log level of meaningful start messages to
notice. It also sets the default log level to notice.
 13 years ago
Victor Julien 8d6bca72f7 Improve 'host-mode' info message 13 years ago
Eric Leblond 6cf7da30e2 Introduce host-mode. 
This variable can be used to indicate to suricata that the host
running is running as a router or is in sniffing only mode.
This will used at least to determine which interfaces are used to
send reject message.
 13 years ago
Victor Julien 468a8e1ca3 Properly cleanup NSS ctx 13 years ago
Victor Julien eedd4329da Change ParseSize api to not leak memory and only setup pcre once. 13 years ago
Victor Julien 397a55457d Add sanity checks for command line argument handling 
Coverity 1075221.

Normally getopt_long should cover this case, but can't hurt to
add in some extra checks.
 13 years ago
Victor Julien 38aaae1fd7 IsRuleReloadSet() shouldn't return an uninitialized value 13 years ago
Victor Julien ff668c2030 Fix Tile compile 13 years ago
Eric Leblond 20ca270dc3 fix pf_ring build 13 years ago
Eric Leblond 2a46f0dae4 suricata: rename SuriInstance to SCInstance. 13 years ago
Eric Leblond 9b422f3a8c suricata: suppress Suri prefix 
Suppress Suri prefix in internal function name.
 13 years ago
Eric Leblond 18ced653c3 Use a typedef for SuriInstance. 13 years ago
Eric Leblond 2d77e53f2c Add offline flag to SuriInstance and some refactoring 13 years ago
Eric Leblond 34abd818dd Prefix util-conf function with Config 13 years ago
Eric Leblond 7242cb30e7 Move CreateLowercaseTable to GLobalInits 13 years ago
Eric Leblond 02e9851315 Generic code don't need ifdef 13 years ago
Eric Leblond 8c00a963aa Use function for delayed detect setup. 13 years ago
Eric Leblond 4296e5f29e Add functions for elapsed time computation. 13 years ago
Eric Leblond 9d1d08c7a4 Factorize Signature loading 13 years ago
Eric Leblond 20c5683b60 Use function for daemonification and signal handler 13 years ago
Eric Leblond 90aaf55201 set rule_reload as part of SuriInstance 13 years ago
Eric Leblond bb19ce1847 SetBPfString is part of command line parsing 13 years ago