3511 Commits (680e941a8f9cd62245eabecf7968601a51c5bffb)

 

All Branches   

Search

Author	SHA1	Message	Date
Victor Julien	5d27518bbd	Make sure we never underflow len in DetectLoadSigFile	14 years ago
Eric Leblond	e6e339aacf	Add counters for IPv4 in IPv6 and IPv6 in IPv6	14 years ago
Victor Julien	250c4e9310	file: convert filesize to new FileMatch api.	14 years ago
Victor Julien	f93c54136c	stream/app layer: call new Truncate callback for data gap case as well.	14 years ago
Victor Julien	869109a6a0	stream/app layer: add Truncate app layer callback that is called if stream depth is reached. Use it to trunc open files in HTTP.	14 years ago
Victor Julien	8f71333e12	file: implement filesize keyword. #489.	14 years ago
Anoop Saldanha	970fdee204	detection engine port api unittests cleanup	14 years ago
Victor Julien	3849588c61	Create separate detect API call (FileMatch) for file detection keywords. #531.	14 years ago
Eric Leblond	12743ca5d7	tls-log: add protocol version to log message.	14 years ago
pi-rho	af20eaf2e5	fix regression (clobbered register; redmine #534)	14 years ago
pi-rho	0df4c5838d	spelling corrections documented in redmine bug#533	14 years ago
Victor Julien	408548c2c4	rule reloads: don't lock up main thread so clean shutdown is impossible	14 years ago
Victor Julien	cbeb8a86b7	pcap: fix compilation on old libpcap	14 years ago
Eric Leblond	16bdcbeb0e	tm-thread: suppress rarely used variable.	14 years ago
Eric Leblond	92679442ca	Convert to atomic and disable check on HTP config change. ... This patch converts the series of variable to an atomic. Furthermore, as the callbacks are now always run, it is not necessary anymore to refuse a ruleswap if HTP parameters are changing.	14 years ago
Eric Leblond	66a083dafa	Get rid of AppLayerHtpRegisterExtraCallbacks ... This patch add a early exit condition to the body handling callback. This permits to avoid to avoid a complex system to handle htp object change.	14 years ago
Eric Leblond	7e09cdc265	Delay Detect threads initialization ... This patch modifies the init of Detect threads. They are now started with a dummy function and their initialisation is done after the signatures are loaded. Just after this, the dummy function is switched to normal one. In IPS mode, this permit to route packets without waiting for the signature to start and should fix #488. Offline mode such as pcap file don't use this mode to be sure to analyse all packets in the file. The patch introduces a "delayed-detect" configuration variable under detect-engine. It can be used to activate the feature (set to "yes" to have signature loaded after capture is started).	14 years ago
Eric Leblond	eaea832a4e	pcap: handle failure of packet treatment ... If the loop is breaked, this means we've got a treatment error. We don't need to reconnect but we must exit with correct status.	14 years ago
Eric Leblond	f82573be12	tls: suppress always true condition.	14 years ago
Eric Leblond	a3b2cee0d5	detect-tls: various indent fixes. ... And delete a useless FIXME.	14 years ago
Eric Leblond	b253d1a499	tls: store all the certificates chain in the written PEM file. ... When using the tls.store command, a dump of all certificates in the chain is now done on the disk.	14 years ago
Eric Leblond	152b4eaf56	tls: keep pointers to all certificates in chain ... When multiple certificates forming a chain are sent. A pointer to the start of each certificate is kept. This will allow treatment on certificates chains.	14 years ago
Jean-Paul Roliers	c4df7a45ae	tls: adding store option for TLS ... This patch adds a TLS store option to save certificate in PEM format. Each time the store action is met, a file and a metafile are created. Reworked-by: Eric Leblond <eric@regit.org>	14 years ago
Jean-Paul Roliers	00d4357362	tls: adding support for fingerprint rule matching. ... Add the support for tls.fingerprint keyword in rules.	14 years ago
Jean-Paul Roliers	bf386a396d	tls: adding fingerprint to TLS Log information. ... Improve TLS logging by adding the certificate fingerprint to TLS Log file. Add the extending option to the tls-log entry in suricata.yaml.	14 years ago
Jean-Paul Roliers	644c1b3cad	tls: adding fingerprint calculation. ... Adding a pointer in ssl_state struct and compute fingerprint during certificate decoding.	14 years ago
Eric Leblond	3df20d0544	tls: add NSS version for SHA1 computing function.	14 years ago
Jean-Paul Roliers	9071bcf983	tls: adding cryptographic functions. ... Adding util-crypt containing cryptographic functions as SHA1 and Base64.	14 years ago
Jean-Paul Roliers	efdf96ccba	tls: adding TLS Log support ... Creation of the log-tlslog file in order to log tls message. Need to add some information into suricata.yaml to work. - tls-log: enabled: yes # Log TLS connections. filename: tls.log # File to store TLS logs.	14 years ago
Anoop Saldanha	3eb0fd878d	Don't wait for packetpool to be back to full state before continuing with the shutdown process, on received shutdown signal	14 years ago
Anoop Saldanha	5f198e3a1d	Suricata shutdown updates + minor cleanup	14 years ago
Anoop Saldanha	34581ce902	rx TMs shouldn't return TM_ECODE_FAILED if engine is in shutdown mode + minor cleanup	14 years ago
Ignacio Sanchez	b057a20f10	Custom logging feature for log-httplog	14 years ago
Eric Leblond	def0270de7	decode: decode IPv6-in-IPv6 ... This patch adds decoding of IPv6-in-IPv6. It also adds some events for invalid packets. This patch should fix #514.	14 years ago
Victor Julien	438dd61948	Update version number to reflect we're working towards 1.4 now.	14 years ago
Eric Leblond	f9046d8284	Add teredo counter.	14 years ago
Eric Leblond	09d893127e	defrag: prealloc more frags.	14 years ago
Eric Leblond	6475f99bea	defrag: Fix description of params ... The max-frags params is not what it is.	14 years ago
Eric Leblond	fd32159464	defrag: add some events relative to defragmentation	14 years ago
Eric Leblond	d2aa0407c4	defrag: Fix unittest logic. ... We've linked the size of hash with trackers. Thus calling DefragInit() after setting the configuration variable is more logic.	14 years ago
Eric Leblond	0fd2c93c96	defrag: link hash size with number of frags. ... We set defrag_hash_size by using the number of trackers. This is effective to avoid collision.	14 years ago
Eric Leblond	f328e18d59	defrag: fix some integer type warning.	14 years ago
Eric Leblond	b1b4cd2729	defrag: really use 'max-frags' variable. ... The 'max-frags' variable was not used and the 'trackers' variable was not documented. This patch fixes the two issues.	14 years ago
Eric Leblond	6480cd1b9c	Teredo tunnel supports ... This patch should fix #480 by adding the support of Teredo tunnel. The IPv6 content of the tunnel will be parsed in a similar way as what is done the GRE tunnel. Signatures will then be matched on the IPv6 content.	14 years ago
Eric Leblond	09fa0b9542	Add support for IPv4-in-IPv6 ... This patch adds support for IPv4-in-IPv6 and should fix #462.	14 years ago
Eric Leblond	2c57275921	nfq: implement "fail-open" support. ... On linux >= 3.6, you can use the fail-open option on a NFQ queue to have the kernel accept the packet if userspace is not able to keep pace. Please note that the kernel will not trigger an error if the feature is activated in userspace libraries but not available in kernel. This patch implements the option for suricata by adding a nfq.fail-open configuration variable which is desactivated by default.	14 years ago
Eric Leblond	9e54819121	yaml: suppress old variable in pfring section.	14 years ago
Eric Leblond	d492683aa4	autotools: error on autoreconf is an error	14 years ago
Eric Leblond	adbf85c4a9	autotools: fix detection with clang ... This patch improve detection of type of nfq_get_payload() by only converting to error the warning we have when using the wrong type.	14 years ago
Eric Leblond	e0ddcdd194	autotools: rename configure.in to configure.ac ... configure.in is deprecated since long and will be replaced by configure.ac. For more information, see: http://lists.gnu.org/archive/html/automake/2012-08/msg00023.html	14 years ago