aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
890 Commits
8 Branches
174 Tags
255 MiB
main
main-8.0.x
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.7
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '583c686170'
${ noResults }
Commit Graph

840 Commits (583c6861706a29b3d87d844ddbc79dd631d477e1)

Author SHA1 Message Date
Gurvinder Singh 8f00718b0d bug 57 17 years ago
Eric Leblond 51be576a30 nfq: modify queue length computation logic 
This patch modifies  max queue length computation logic. The max queue
length was set to MAX_PENDING which is the total number of packet
processed simultaneously in suricata.

This value is correct but this will not permit to take all burst
effects into account (read sudden quantity of packet that arrives
faster than suricata is enable to parse). Furthermore there is a
delaying system when suricata gets overloaded which make necessary
to have packet storable into kernel for some time.

To improve this situation the patch increases the maximum queue
length to NFQ_BURST_FACTOR (4) time the MAX_PENDING packet and
it also increase the nfnetlink buffer size to be able to store
all packets waiting for suricata in the netlink receive buffer.
 17 years ago
Eric Leblond 775ac9ad9d fix code file permission 
detect-http-method.c was executable.
 17 years ago
Eric Leblond 84dfc0172a gcc warning fixes. 
This patch fixes gcc warning:
    warning: suggest braces around empty body in an ‘if’ statement
This was the case in  when the macro SCLogDebug was used:
    if (ssn != NULL)
        SCLogDebug("ssn->alproto %"PRIu16"", ssn->alproto);

It also fixes a signed-unsigned comparison.
 17 years ago
Eric Leblond 72d48f6658 nfq: add sanity checking 
This patch adds sanity checking to payload handling. It set length
of packet to zero if an error occurs.
 17 years ago
Eric Leblond 56cccdfa62 nfq: use switch instead of 'else if' 
This patch convert a 'else if' serie to a switch to increase
the readability of the decision related code.

 Please enter the commit message for your changes. Lines starting
 17 years ago
Eric Leblond c96586446b ethernet: use switch instead of 'else if' 
This patch uses a switch instead of a 'else if' series. It also
adds a debug message for unsupported ethernet type.
 17 years ago
Eric Leblond 6cf00d6204 Fix typo in Makefile.am 
This patch fixes a typo in Makefile.am which was preventing
'make tags' from working.
 17 years ago
Victor Julien 9295193968 Fixup unittest error output for RAW decoder. 17 years ago
William Metcalf c5d0b492d3 small unittest fixes to decode-raw.c 17 years ago
William Metcalf 8a64321340 raw pcap support additionl ipv4/6 validation 17 years ago
Pablo Rincon 0c9f51498a Small fixes at unittest helper functions and TestBidirec03 17 years ago
Pablo Rincon c80160b96d More examples of unittest helper functions usage reference 17 years ago
Pablo Rincon b6a3395c08 Adding unittest helper functions for building generic packets, checking arrays of expected match results, perform generic tests, etc. Look at util-unittest-helper.c and detect-ipproto.c for references 17 years ago
Jason Ish 095f2cf6ef Consistency fix.. Xxxlog -> XxxLog. 17 years ago
Jason Ish e204d07717 Have output modules register themselves so run mode configurator becomes aware of them for purposes of being configured from the config file. 17 years ago
Victor Julien 9b90c553b5 Clean ip fields from packet as well when the packet is reused. Prevents issues with malformed packets that are rejected by the decoders before ipaddresses are set. 17 years ago
Victor Julien 27a138d862 Suppress some flow messages. 17 years ago
Gurvinder Singh b0dcd02c1b bug 56 patch 17 years ago
Victor Julien eb67bb442e Fixup unittests that use buffers that simulate configuration files. They now include the YAML header. 17 years ago
Jason Ish 4e1acf5fd2 Require that the configuration file begins with a valid YAML version. At this time this means the configuration file must begin with 
%YAML 1.1
 17 years ago
Jason Ish 5e318aa342 Fix issue 55. 
Don't process any key/value pairs until we've hitting a mapping.
 17 years ago
Jason Ish c4f178f3d7 Do not seen_last unless the packet with more_frags=0 was actually inserted into the frag tracker. Fixes issue 53. 
Add unit test for this failure case.
 17 years ago
Jason Ish fc5df7d064 don't create a new tracker when frags are received in reverse order. 17 years ago
Gerardo Iglesias Galvan 40c514f295 Fix bug in logging msg when using --init-errors-fatal 17 years ago
Gerardo Iglesias Galvan 5eb819b0f4 Add signature line no. to error message when parsing fails 17 years ago
Gerardo Iglesias Galvan fae92f8d7b Fix bug#30. Fix logging call from prev patch 17 years ago
Gerardo Iglesias Galvan 988dc5520b Improve output when loading rules 17 years ago
Victor Julien 56556eb550 Set payload no inspect flag for packets with encapsulated packets as these are inspected separately 17 years ago
Victor Julien 9ececacda3 Fix packet timestamp handling for encapsulated packets. 17 years ago
Jason Ish 4c83652ad3 initialize vars 17 years ago
Victor Julien c1283a6628 Fix app layer proto detection code not being thread safe. 17 years ago
Gurvinder Singh fde948f488 bug 41 patch 17 years ago
Victor Julien fcabd1b2ba Fix typo. 17 years ago
Jason Ish cf95fa7c74 configurable outputs for nfq and pcap file. 17 years ago
Jason Ish a05436af8c Configurable alert outputs for PF_RING modes. 17 years ago
Jason Ish 844c444af1 Use the configuration file to setup alert logging (and http logging). 
Only setup for the live pcap modes at the moment.
 17 years ago
Victor Julien 13e10ccd86 Enable bytes per sec and mbit per sec for nfq as well 17 years ago
Anoop Saldanha e45b626b24 refactoring, tests for address engine ipv4 17 years ago
Jason Ish 1aabe6f7c1 in the unit tests make sure memory allocated from the pool was returned. 17 years ago
Jason Ish 6547725b39 consolidate more common code between ipv4 and ipv6. 17 years ago
Jason Ish 176c6e5668 use a common insert method for ipv4 and ipv6 17 years ago
Jason Ish ccbf8bcae5 Use the V6 insert and re-assembly logic for IPv4 as well. Its a little simpler to track and update. 17 years ago
root 9b74a2765e 64 bit portability 17 years ago
Victor Julien d7958f7983 fix wrong keyword name 17 years ago
Victor Julien 9ee6d6906f Add some safety checks. 17 years ago
Anoop Saldanha 06a640e794 fix for bug #47 17 years ago
Anoop Saldanha a83f7abcc1 logging module bug 6 fix 17 years ago
Victor Julien 6b36e23e45 Fix not decreasing the flow use_cnt reference counter in some cases from the app layer detection code. This caused some streams to never fully time out and thus clutter up the flow table and session pool. 17 years ago
Victor Julien c3269dbcb4 Fix compiler warning in http method code 17 years ago
Brian Rectanus c22d42693a Added http_method rule keyword. 17 years ago
Gurvinder Singh 6814ea1a0f some more stream fixes 17 years ago
Victor Julien 94ae001dec Fixup month displaying for the stats log. 17 years ago
Victor Julien 5e8413aeea Don't scan more of a stream for proto detection than necessary. 17 years ago
Gurvinder Singh a66c6752d5 stream os_policy support 17 years ago
Anoop Saldanha eea0e2a807 Radix Tree fixes/updates 17 years ago
Victor Julien 8f7cff1d53 Fix compilation with -Wextra 17 years ago
Victor Julien b7bac14040 Fixup code to compile with -Wall -Werror -Wextra -Wno-unused-parameter compiler options. 17 years ago
Gurvinder Singh 4e1dc0bd83 bug 41 patch 17 years ago
Gurvinder Singh 567bbf604b stream reassembling fixes 17 years ago
Jason Ish 6520d42b4c Allow nested sequences. 17 years ago
Jason Ish d86282af9c pretty up ConfDump output for when there is no valid prefix 17 years ago
Jason Ish 668b86cba4 Fix issue 36. Give each unit test a fresh configuration context - helps tests pass when a config file is passed in, which can 
mess up the "expected" output, as this is testing loading
values into the configuration system.
 17 years ago
Jason Ish 749647a69d use const 17 years ago
root 5113636744 bind and bind_ack tracking 17 years ago
Victor Julien 1f09a88c93 Improve default-log-dir error checking and reporting. 17 years ago
Anoop Saldanha 750600ab17 check for the existance of default logging directory 17 years ago
Anoop Saldanha 8189f4d88e Change error log messags to debug ones in the log modules 17 years ago
Victor Julien f5ef0cc3b8 Exit if no classification.config has been found. 17 years ago
Victor Julien 9e5f7459c2 Actually use classification msg 17 years ago
Victor Julien 2b66667a76 Make sure we can't overflow our packet alert storage 17 years ago
Jason Ish 527d735500 Suppress these debug lines. 17 years ago
Victor Julien 9b422c443e Fix up initialization and hopefully make the SEQ macro's fix up an 64bit issue we're seeing... 17 years ago
Victor Julien 18aa59b391 Fix compilation and a small memory error. 17 years ago
Anoop Saldanha f684989f98 dce_iface, dce_opnum, dce_stub_data keyword support 17 years ago
Victor Julien d284f0d333 Set default classification file location in the config file. 17 years ago
Victor Julien ecab1fae36 Remove contents of VRT classification.config. 17 years ago
Anoop Saldanha 011b74df63 Modify the classification config tests to use the buffer than a temp file and also fix an invalid free 17 years ago
Anoop Saldanha bc4df59414 Support for Classtype keyword and Classification Config file 17 years ago
Victor Julien f0be69dcd0 Fixup smb/smb2/dcerpc wrt loops, debug printing, style. 17 years ago
Victor Julien 4c2782e971 Improve depth and offset setup error reporting 17 years ago
Victor Julien f6f0ad94ce silence a debug statement in the msg handling 17 years ago
Victor Julien d5c732f1f9 Add tag keyword stub 17 years ago
Victor Julien b2adf31595 online abort() in stream reassembly if were in debug mode 17 years ago
Victor Julien ef6ab4efa0 Add pcre negate support. 17 years ago
William Metcalf 1d553c940b failing unit test showing negated pcre treated as nonnegated match 17 years ago
Victor Julien 040e62f3ec Fixup noisy debug statement 17 years ago
Victor Julien 7b2610ba1f Fix extra spaces confusing content and uricontent. 17 years ago
Gurvinder Singh a19fbf22e2 bug 29 patch 17 years ago
Victor Julien ae94b102cb Improve distance/within/nocase handling, sig parsing error reporting. 17 years ago
Victor Julien 4862488dac add version output, -V option 17 years ago
Victor Julien 6beee776ca Move rand seed code into util-random 17 years ago
Pablo Rincon 6224c30548 Adding preseending to rands 17 years ago
Jason Ish b2ee780788 "last" policy for ipv6 17 years ago
Jason Ish ecc50b8b2f add first policy for ipv6 frag re-assembly 17 years ago
Jason Ish d9380a8cb5 solaris policy for ipv6 17 years ago
Jason Ish ce20c33634 multiline rule support. 17 years ago
Will Metcalf 23aa6cf642 more fixes for exit on sig init failure 17 years ago
Will Metcalf f2b1e66a6a fixes for init failure stuff 17 years ago
Victor Julien 778228d1c5 Flags keyword fix. Fatal init fix. 17 years ago
Victor Julien 35e884f303 Make sure offset modifies depth. 17 years ago
William Metcalf c63b1e0f67 failing unit test depth doesn't take into account offset 17 years ago
Will Metcalf cc3c1779cd more project name updates 17 years ago
Victor Julien 9bbe43c019 Fixup calculation of the minimum scan pattern lenght in some cases. 17 years ago
Victor Julien aa736b01d6 Fix thresholding coding changing unlocked and supposed to be static memory areas. 17 years ago
Victor Julien c969294fef Make sure icmp rules also apply to icmpv6 17 years ago
Gurvinder Singh 8cfdf6c666 bug 18 patch update 17 years ago
Gurvinder Singh b92886a79a bug#18 and some minor changes 17 years ago
Gurvinder Singh 542a43437e bug19 patch 17 years ago
Pablo Rincon 0e83759ed4 Small fix 17 years ago
Victor Julien 1d12de9500 DetectContentChunkMatchTest11 is no longer expected to fail. 17 years ago
Victor Julien 18441c2be7 Fix broken pattern len compilation causing certain patterns to no match when they should. 17 years ago
Victor Julien 0ab9adabd4 Test PortTestMatchDoubleNegation is no longer expected to fail. 17 years ago
Victor Julien 0a699857d6 Fix negation for addresses as well. 17 years ago
Victor Julien 50c07f9901 Fix wrong negation of ports. 17 years ago
Victor Julien 10cc9d5b6a Add icmp flow handling. 17 years ago
Victor Julien 71ed2d38f5 Fix scan patterns sometimes not being added to the scan ctx. Should fix bug #9. 17 years ago
William Metcalf c40e81d42b failing unittest rules with same content match fail 17 years ago
Victor Julien a8116f65c8 Fix packet flags field not being cleared properly when the packet is being reused. Add some debug statements and cleanup some. 17 years ago
Victor Julien e2376948dd Clean up smb/dcerpc code 17 years ago
root 48cdc8e0fd DCERPC BIND work 17 years ago
Jason Ish 9d55a41e49 Windows and Linux policies for IPV6 frag reassembly. 17 years ago
Victor Julien 4824868766 Application layer detection improvements 
- improve locking of application layer handling, making sure that the flow cannot be freed/cleared when the detection engine is still working with it.
- add a check to the app layer detection to make sure that a match function will only inspect an app layer state if it's of the right type.
 17 years ago
Victor Julien 310a182217 Fix signatures not being initialized properly 17 years ago
Victor Julien 6fe5509617 Fix compiler warning when using HTP rev 68. 17 years ago
Victor Julien 79b15bd1cc fix typo 17 years ago
Victor Julien 53041eeb67 Small cleanups. 17 years ago
Victor Julien 8cc792a3c7 Fix potential deadlock in http cookie match. 17 years ago
Pablo Rincon f729d6f7b3 Changing some more printfs with logging api 17 years ago
Pablo Rincon f2f9b83280 Adding FTP app layer parser and ftpbounce detection at L7 17 years ago
Victor Julien d35dd1c4ea Improve http cookie htp state checking before using it. 17 years ago
Pablo Rincon 6f76ed6804 Match content fail when two contents are specified in the same rule and the last of them has length = 1 17 years ago
Anoop Saldanha f8edb74439 double port/address negation is parsed incorrectly 17 years ago
Victor Julien 6ab64706b0 Improve threshold hash table handling. 17 years ago
Gurvinder Singh 8c8b8596c8 fixed bug 18 17 years ago
Gurvinder Singh 8287ebe12c bug 21 fixing patch 17 years ago
Anoop Saldanha 4d430060d2 fix for unclear error messages bug 15 17 years ago
Anoop Saldanha 47ad1e5b2e detect-engine-address.[ch] refactoring 17 years ago
Anoop Saldanha 2c0345f55e Fix for Unified Alert Test Bug #14 17 years ago
Gerardo Iglesias Galvan 7e87f373b9 Add icmp_id keyword support 17 years ago
Victor Julien 01976a0b74 Support for sigs with both pkt and applayer detect 
Sets a flowbit with the sig id if the packet matches match. Checks
on that if the app layer matches match. Currently misuses the
flowbits api for this in a way that needs fixing.
 17 years ago
Victor Julien 493715c0d2 Implement alert sid storage in the flow so we can check previous alerts in the flow. 17 years ago
Victor Julien 9fd46e9425 Support for sigs with both pkt and applayer detect 
Sets a flowbit with the sig id if the packet matches match. Checks
on that if the app layer matches match. Currently misuses the
flowbits api for this in a way that needs fixing.
 17 years ago
Gurvinder Singh 0419ad7c9a fixed 23 bug 17 years ago
Victor Julien 4f843ff8e9 Improve matching of packet and app layer sigs. 17 years ago
Pablo Rincon 992aaa3d79 Small fix on SigMatchSignaturesAppLayer() and SigMatchSignatures() 17 years ago
Pablo Rincon 459a823a09 Reutilize the filename buffer and avoid malloc's 17 years ago
Pablo Rincon 5f59def86a Force reset size_current to 0 after rotate 17 years ago
Jason Ish fdb1c9c4f2 cleanup warnings. 17 years ago
Jason Ish 6cc0771d6f - Fix memory leak error when freeing node. 
- Cleanup ConfDump output a little.
 17 years ago