154 Commits (413082afc0bedecc0bc0b6e49e12ee3571d59503)

Author	SHA1	Message	Date
Eric Leblond	f03a7a032f	json-alert: add smtp elements in alert	10 years ago
Eric Leblond	946f2a6acc	email-json: add bcc to extended fields	10 years ago
Eric Leblond	8fd88f543d	yaml: add comment describing smtp extended	10 years ago
Eric Leblond	f81f353d1f	email-json: add 'date' field extraction	10 years ago
Eric Leblond	d1b0a5aa6d	yaml: document new MIME features	10 years ago
Victor Julien	7281ae6e80	yaml: add missing ippair section	10 years ago
Eric Leblond	3054af7900	af-packet: don't activate rollover by default ... Rollover option is causing issue with TCP streaming code because packets from the same flow to be treated out of order. As long as the situation is not fixed in the streaming engine, it is a bad idea to enable it by default.	10 years ago
gureedo	a7a902a071	netmap: extended comments for options in configuration file. ... Added extended description of the use of OS endpoint with copy mode.	10 years ago
Eric Leblond	8fde842f97	af-packet: implement rollover option ... This patch implements the rollover option in af_packet capture. This should heavily minimize the packet drops as well as the maximum bandwidth treated for a single flow. The option has been deactivated by default but it is activated in the af_packet default section. This ensure there is no change for old users using an existing YAML. And new users will benefit from the change. This option is available since Linux 3.10. An analysis of af_packet kernel code shows that setting the flag in all cases should not cause any trouble for older kernel.	10 years ago
Eric Leblond	dc306f3bad	af-packet: implement new load balancing modes ... This patch implements the fanout load balancing modes available in kernel 4.0. The more interesting is cluster_qm that does the load balancing based on the RSS queues. So if the network card is doing a flow based load balancing then a given socket will receive all packets of a flow indepently of the CPU affinity.	10 years ago
Aleksey Katargin	caa2438b98	netmap: support SW rings ... Netmap uses SW rings to send and receive packets from OS.	10 years ago
Eric Leblond	4db0a35f25	tls-store: now a separate module ... An design error was made when doing the TLS storage module which has been made dependant of the TLS logging. At the time there was only one TLS logging module but there is now two different ones. By putting the TLS store module in a separate module, we can now use EVE output and TLS store at the same time.	10 years ago
Victor Julien	f43767ba44	config: update yaml to show json logging option	10 years ago
Giuseppe Longo	a459376d2e	app-layer-htp: add http_body_inline setting	10 years ago
Jason Ish	e3ce29f694	json-stats: log deltas ... If "deltas" is yes, log delta values as the name of the value suffixed with _delta.	10 years ago
Zachary Rasmor	0edf28a4f8	Add Feature #1454. Generic eve-log prefix support.	10 years ago
Victor Julien	3fab736539	log-stats: make global/threads logging configurable	10 years ago
Victor Julien	2c9a2c8327	stats: support per thread stats in json output ... Default is only to output totals. Optionally per thread can be added. Both can be enabled together.	10 years ago
Tom DeCanio	117eed0385	eve-log: add JSON stats logging ... Support for counters in stats.log in eve output JSON stream.	10 years ago
Eric Leblond	7d73db9b80	suricata.yaml: fix the name of EVE module ... It is netflow and not newflow.	10 years ago
Giuseppe Longo	26ba647d58	filedata: read inspected tracker settings from suricata.yaml	10 years ago
Eric Leblond	bd0041470f	rules: add app layer events rules ... Some application layer events are defined but the corresponding rules were not available in the rules directory.	10 years ago
Eric Leblond	9fb82390ab	suricata.yaml: add missing mpm-algo	10 years ago
Victor Julien	0704ece4d7	detect-reload: enable unconditionally ... Reloading is available unconditionally now.	10 years ago
Victor Julien	2e754ca6fa	drop json: make alerts logging optional ... Make logging out alerts that caused the drop optional.	10 years ago
Eric Leblond	881f32cc02	json-alert: add SSH fields in alert logging	10 years ago
Eric Leblond	180faece7c	json-alert: log tls info in alert ... This patch adds the capabilities to log the TLS information the same way it is currently possible to do with HTTP. As it is quite hard to read ASN.1 directly in the stream, this will help people to understand why suricata is firing on alert relative to TLS.	10 years ago
gureedo	10104066e1	netmap support	10 years ago
Victor Julien	9327b08ab1	tcp: add stream.reassembly.zero-copy-size option ... The option sets in bytes the value at which segment data is passed to the app layer API directly. Data sizes equal to and higher than the value set are passed on directly. Default is 128.	10 years ago
Ken Steele	5008d0a58b	Remove the b2gm and b2gc MPMs ... These MPMs have code that looks like it won't work and updating them to for the new MPM optimization wasn't working.	10 years ago
Duarte Silva	496200dd08	Prepared everything for the proxy deployment configuration ... - Added the suricata.yaml configurations and updated the comments - Renamed the field in the configuration structure to something generic - Added two new constants and the warning codes	10 years ago
Duarte Silva	4e04cd2d1b	Adding XFF support to EVE alert output ... - Created app-layer-htp-xff.c and app-layer-htp-xff.h - Added entries in the Makefile.am - Added the necessary configuration options to EVE alert section - Updated Unified2 XFF configuration comments and removed unnecessary whitespace - Created a generic function to parse the configuration - Release the flow locks sooner and remove debug logging - Added XFF support to EVE alert output	10 years ago
DIALLO David	bacbe113d0	Add a warning in Modbus section of YAML file to remind user to modify stream depth (unlimited)	10 years ago
Victor Julien	c174c9d779	af-packet: threads: auto, default to workers ... Add a new default value for the 'threads:' setting in af-packet: "auto". This will create as many capture threads as there are cores. Default runmode of af-packet to workers.	10 years ago
Victor Julien	a95c95f74c	stats: introduce global config ... As the stats api calls the loggers at a global interval, the global interval should be configured globally. # global stats configuration stats: enabled: yes # The interval field (in seconds) controls at what interval # the loggers are invoked. interval: 8 If this config isn't found, the old config will be supported.	10 years ago
DIALLO David	5a0409959f	App-layer: Add Modbus protocol parser ... Decode Modbus request and response messages, and extracts MODBUS Application Protocol header and the code function. In case of read/write function, extracts message contents (read/write address, quantity, count, data to write). Links request and response messages in a transaction according to Transaction Identifier (transaction management based on DNS source code). MODBUS Messaging on TCP/IP Implementation Guide V1.0b (http://www.modbus.org/docs/Modbus_Messaging_Implementation_Guide_V1_0b.pdf) MODBUS Application Protocol Specification V1.1b3 (http://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b3.pdf) Based on DNS source code. Signed-off-by: David DIALLO <diallo@et.esia.fr>	10 years ago
Tom DeCanio	e5c36952d6	app-layer-smtp: move old smtp-mime section in suricata.yaml into ... app-layer-protocols.smtp.mine section and update code to accomodate.	10 years ago
Tom DeCanio	f1c160ed22	smtp: turn on smtp mime decoding and enable smtp eve logging.	10 years ago
David Abarbanel	c2dc686742	SMTP MIME Email Message decoder	10 years ago
Giuseppe Longo	07fffa6a7d	Fixes comments for pfring section in suricata.yaml ... Bug #1301	10 years ago
Victor Julien	d44cb3f6fe	pcap-log: add option to honor pass rules ... Add option (disabled by default) to honor pass rules. This means that when a pass rule matches in a flow, it's packets are no longer stored by the pcap-log module.	11 years ago
Jason Ish	5b9c6d4774	Comment out in the action-order section, as its not needed if ... the default configuration is used.	11 years ago
Victor Julien	936db9c02a	output-lua: add config to yaml ... Disabled by default.	11 years ago
Victor Julien	47cd497447	yaml: add eve flow and netflow entries ... Added, commented out by default. Bug #1257.	11 years ago
Victor Julien	cd78705e3a	streaming-loggers: add configuration ... Add a (disabled by default) config to the yaml	11 years ago
Giuseppe Longo	b188d93630	json-alert: include HTTP info on the alerts ... Extends the JSON alert output to include the HTTP data at the time of the alert.	11 years ago
Victor Julien	2bcd48bc12	pcap-log: yaml comment update	11 years ago
Victor Julien	0ac94ef777	flow-recycler: support multiple instances ... Use new management API to run the flow recycler. Make number of threads configurable: flow: memcap: 64mb hash-size: 65536 prealloc: 10000 emergency-recovery: 30 managers: 2 recyclers: 2 This sets up 2 flow recyclers.	11 years ago
Victor Julien	e0841218f0	flow-manager: support multiple instances ... Use new management API to run the flow manager. Support multiple flow managers, where each of them works with it's own part of the flow hash. Make number of threads configurable: flow: memcap: 64mb hash-size: 65536 prealloc: 10000 emergency-recovery: 30 managers: 2 This sets up 2 flow managers. Handle misc tasks only in instance 1: Handle defrag hash timeout handing, host hash timeout handling and flow spare queue updating only from the first instance.	11 years ago
Victor Julien	fdd407751e	Fix eve 'filetype' parsing ... Now that we use 'filetype' instead of 'type', we should also use 'regular' instead of 'file'. Added fallback to make sure we stay compatible to old configs.	11 years ago