1665 Commits (6af30e5b2ed0bd1709d84f870eaee0b5b7396080)

Author	SHA1	Message	Date
Victor Julien	bac621760e	Fix a potential invalid memory read in the protocol name code used by alert-fastlog.	16 years ago
Gurvinder Singh	f92ba23331	add the support for >= and <= operator for byte_test	16 years ago
Victor Julien	412498f4e4	Converts port vars in http logger from uint32_t to Port and update output.	16 years ago
Gurvinder Singh	b7ff6537d2	fixed the incorrect port issue in http.log	16 years ago
Victor Julien	275bd3b7d7	Switch back to defaulting to full for detect-engine.sgh-mpm-context as it broke many tests.	16 years ago
Victor Julien	dec4218d62	Layout updates to NFQ runmode.	16 years ago
Victor Julien	7e49aa7f76	Simplify NFQ runmode reducing the number of threads and thus queues.	16 years ago
Victor Julien	7e6f01765f	Change default of detect-engine.sgh-mpm-context to auto.	16 years ago
Victor Julien	001f91056e	Add http_raw_header as an alias to the http_header keyword as that actually inspects the raw headers (see issue #243). Closes issue #242.	16 years ago
Victor Julien	4598274d07	Fix depth error messages referring to distance instead of depth, fix their layout.	16 years ago
Victor Julien	afdb39e5f6	Print an error if the protocol field of a signature contains a unknown/invalid value.	16 years ago
Victor Julien	8d0bc27fc4	Fix a case where alerting in inline mode would lead dropping on alert sigs.	16 years ago
Victor Julien	5a10eac5bd	Cleanup http_stat_code unittests, shrink data structure.	16 years ago
Victor Julien	1636152e32	Fix negated http_method not working properly, causing false positives.	16 years ago
Gurvinder Singh	b7da115e6d	support for http_stat_code keyword has been added to detection module	16 years ago
Gurvinder Singh	1deae70cf7	added http_stat_msg keyword support for detection module	16 years ago
Jason Ish	a4d19e4130	Add new profiling sort option, maxticks.	16 years ago
Anoop Saldanha	59923316bc	change the default recursion limit in the code to 3000, the value which we currently have in the conf file. Also change print modifier for printing timeval	16 years ago
Anoop Saldanha	5d9a453e0d	find an optimal value for detect-engine:inspection-recursion_limit + unittest	16 years ago
Anoop Saldanha	bc99328ec8	define a new conf paramter detect-engine:inspection-recursion-limit; Defines a recursion limit for content inspection code	16 years ago
William Metcalf	efeab331ea	compilation fix missing UT ifdef wrapper in reference code	16 years ago
Victor Julien	746ef0d2f8	Remove stray newline char from profiling output.	16 years ago
Victor Julien	3062b19068	Clean up output of signature ordering module.	16 years ago
Victor Julien	001dcaae84	Minor reference.config support changes: improve error handling, reduce hash table size.	16 years ago
Anoop Saldanha	88d94b136d	Support for reference.config file	16 years ago
Anoop Saldanha	f5a02833dd	code cleanup in detect-reference.c	16 years ago
Victor Julien	344ea14695	Change mpm hash_size config setting highest to higher as highest wasn't the... highest. Max was higher. Leaving highest as an alias to higher for backwards compatibility.	16 years ago
Victor Julien	41fd7e51c6	Really add secunia reference support.	16 years ago
Victor Julien	33170fd181	Add secunia reference pending our reference.config support.	16 years ago
Anoop Saldanha	067e53403c	add missing sig_app_layer flags for dce sigs	16 years ago
Victor Julien	26fd2a0afd	Add telus and bid references for etpro.	16 years ago
Victor Julien	2b187a2721	Remove a BUG_ON statement from the payload inspection code.	16 years ago
Victor Julien	f2e6ec7374	Fix http_method not inspecting all http transactions all the time. Fix proper nocase setting. Switch to pattern scanning only, no more numeric compares as it turned to be incompatible with how the keyword is used (nocase, etc).	16 years ago
Anoop Saldanha	2cdb5be391	Print out file name for fast_pattern engine_analysis. Also add some info logs	16 years ago
Anoop Saldanha	0c5b82d891	provide separate ids for content, uricontent, http_(client_body_data|cookie|header|method|uri), when they share the same pattern	16 years ago
Victor Julien	3bd7441ea5	Default to 'single' ctx for ac-gfbs as well.	16 years ago
Anoop Saldanha	e072841e93	hash fix in staging to differentiate nocase duplicate patterns from case-senstive ones	16 years ago
Anoop Saldanha	de5db1a730	support cases for ac, where we have a single pattern in 2 different sigs, but one that is case-senstive and the other not. Also remove duplicate pids from the output_table	16 years ago
Anoop Saldanha	8628c572df	update todos for ac. Cleanup some memory as well.	16 years ago
Anoop Saldanha	a2d04a94b5	selecting auto for detect-engine.sgh_mpm_context now uses single if the mpm is ac, full otherwise	16 years ago
Anoop Saldanha	5cc7f90f45	fix hash bug in ac-gfbs. Should reduce the no of patterns added for single context ac-gfbs from a million to a couple of thousands. Also support no case handling. \todo support insertion of final state presence into goto_table and failure table state transitions	16 years ago
Anoop Saldanha	ded1f63323	fix ac nocase handling	16 years ago
Anoop Saldanha	174048544d	fix hash generation in b2g and ac addpattern. Brings down the no of patterns added from close to a million to a couple of thousands	16 years ago
Anoop Saldanha	29b5cb9abd	respect content flags in hash compare function during staging. For example, we would end up ignoring a nocase version of a duplicate content from another sig in the same sgh	16 years ago
Anoop Saldanha	0ef684705c	support single mpm context distribution across sghs in staging. Also see to it that ac works fine with this setup	16 years ago
Anoop Saldanha	b367c37ae6	suricata.yaml conf update to support single mpm context distribution over multiple sghs + code to parse this conf	16 years ago
Anoop Saldanha	4b2cf7e125	fix ac, ac-gfbs to support new changes to util-mpm.h + remove some junk code	16 years ago
Anoop Saldanha	b9a770740a	add comments and todos for ac and ac-gfbs	16 years ago
Anoop Saldanha	658ff5753d	aho-corasick for the cpu. We have 2 versions of ac. The first MPM_AC uses the delta table and the secone one MPM_AC_GFBS uses the goto-failure table	16 years ago
Victor Julien	bfb6aac495	Sleep after checking for a thread flag in TmThreadWaitOnThreadInit now that the check is so much cheaper.	16 years ago
Victor Julien	9634389b9e	Fix TmThreadsUnsetFlag not unsetting flag if __sync_fetch_and_nand was used.	16 years ago
Pablo Rincon	fcff1ce7f4	Converting threadvar flags to atomic vars to avoid using the old spinlock	16 years ago
Anoop Saldanha	b8f5a6a4fc	throw out contents/uricnotents with invalid hex assembly	16 years ago
Anoop Saldanha	850f44022f	invalidate sigs with content/uricontent strings ", "boo, boo" + fix parsing content strings of the format content: !\"boom\";"	16 years ago
Victor Julien	5a7efe5f97	Add comment and layout update to new fast_pattern code.	16 years ago
Anoop Saldanha	a85fa6b792	support for fast_pattern only and fast_pattern:offset,length. Also support the new option for engine-analysis	16 years ago
Anoop Saldanha	0d741b9a55	fix for bug 227. For negated contents that have been added to mpm we might have pmq.pattern_id_array_cnt as 0. We can't ignore inspecting sigs if this is 0, in case the content added is negated	16 years ago
Jason Ish	9ad1924dba	Track the max ticks for each rule. ... This is the highest tick count this rule used to evaluate in a single sample.	16 years ago
Pablo Rincon	b3a8f0a90f	Fix asn1 decoder frame oob mem. Adding max stack frames to suricata.yaml	16 years ago
Victor Julien	25d1b6fec1	Adapt malloc macro's to only display errors during init, not during runtime. At runtime it could make us crawl if the system runs out of memory.	16 years ago
Victor Julien	22f770f3bf	Better handle low memory conditions.	16 years ago
Victor Julien	21c8d27300	Disable expensive unittests that don't really test anything.	16 years ago
Anoop Saldanha	7abf3a2123	fix csum handling for tcp/dup	16 years ago
Victor Julien	f1ea68e316	Store the first frag flag in the uuid as the pfc_flags field is overwritten. Part of fixing #206.	16 years ago
Pablo Rincon	14a12f5fb7	Adding atomic bitwise operations api and rwlocks support	16 years ago
Victor Julien	b8a709cbe7	Fix setting hash size in the config for b3g. Part of fix for bug #222.	16 years ago
Anoop Saldanha	e47a9b59e9	accept tcp packets with syn+urg+push	16 years ago
Gurvinder Singh	f2f0b54d25	removed xref from the alert-fastlog	16 years ago
Victor Julien	aa2c3118e3	Remove unused code from b2gm.	16 years ago
Gurvinder Singh	3eab715153	support for printing protocol names for known protocol	16 years ago
Victor Julien	b81280524c	change dcerpc warnings into debugs.	16 years ago
Victor Julien	4208bdf0f9	Fix unittest.	16 years ago
Victor Julien	cbd4c298ed	Initial version of a new bitmask based signature pre-filtering method.	16 years ago
Victor Julien	7e47d87e1a	Small layout update	16 years ago
Victor Julien	66340be072	Fix pcre compilation with debug enabled.	16 years ago
Victor Julien	091f53ce4e	Fix retval of SCMemcmp for non-SIMD implementation.	16 years ago
Victor Julien	a75556dfe5	Add memcmp functions for SSE4.1 and SSE4.2.	16 years ago
Victor Julien	1859ed54c7	Add memcmp api with a plain memcmp function and a SSE3 accelerated memcmp.	16 years ago
Victor Julien	94898a91cc	Reorganize SigMatchSignatures.	16 years ago
Victor Julien	fc248ca7a1	Many small performance updates.	16 years ago
Victor Julien	b4454b6846	Switch to b2gc as default pattern matcher as it uses less memory and is a little faster.	16 years ago
Victor Julien	57b098e98c	Add padding to commonly used data structures.	16 years ago
Victor Julien	87f88867f4	Further improve B2gc. Add B2gm. Improve memory layout.	16 years ago
Victor Julien	4329261faa	Fix setting hash size in the config for b2g pattern matcher.	16 years ago
Victor Julien	697167319e	Change BloomFilter structure layout to reflect order of access.	16 years ago
Victor Julien	3971bcc83a	Switch to faster tolower function for u8_tolower.	16 years ago
Victor Julien	9dfbab42f8	WIP B2gc	16 years ago
Victor Julien	fc1687d875	Make sure the DetectHttpMethodData structure is properly initialized before using it.	16 years ago
William Metcalf	7b13ba9f9e	Fixed broken nocase for http_method and http_header	16 years ago
Anoop Saldanha	ea902cc7d7	fix bytejump segv from bug 237	16 years ago
Anoop Saldanha	38898d9b30	fix bytetest segv from bug 237	16 years ago
Anoop Saldanha	6e5a48c92c	temporary fix, in case we still have any corner cases remaining in dce parser	16 years ago
Anoop Saldanha	24a88a689a	fix opnum parsing for fragmented request dce pdus	16 years ago
Anoop Saldanha	1097de0d9d	changed the endianness comparison to & for dcerpc pdus	16 years ago
Anoop Saldanha	a3280c1a20	throw out malformed pdus, that result the parser having parsed the required data, but we still havne't thit the frag length limit for the parser	16 years ago
Anoop Saldanha	1aea3e56be	for now ignore pdus with auth verifier. We will get back to this in the coming iteration	16 years ago
Anoop Saldanha	fc37e9d6ee	add internal ids to uuids. Use these internal ids to match uuids from bind and bind_ack. Create a new uuid list to hold all accepted uuids. Modifications to dce-iface to accomodate these changes as well + unittests	16 years ago
Anoop Saldanha	816d2ef0c0	if malformed pdus push the bytesprocessed beyond frag_length, that's a sure endless loop. Avoid it, by reseting the dce state on seeing this	16 years ago
Anoop Saldanha	5c5d8f8a5d	indentation fix in DCERPCParseBINDCTXItem, following changes from the previous patch	16 years ago
Anoop Saldanha	38e26e5186	modify the dce parser to accept context ids that start with a non-zero value	16 years ago
Anoop Saldanha	d57428471c	fix endianness handling for bindacksecondaryaddrlen	16 years ago
Anoop Saldanha	ba9355d688	Flag if we see a fragged pdu. Do not reset dce stub buffer, if we are dealing with fragmented pdus(holds good only for first frag request pdus). Also reset the dce state vars on seeing an invalid PDU. Some minor fixes with respect to endianess as well.	16 years ago
Anoop Saldanha	00f21252fa	support fragmented pdus in dce + unittest	16 years ago
Anoop Saldanha	ebc1f62050	some additional indentation changes in DCERPCParser	16 years ago
Anoop Saldanha	c2bc8ca252	fix mem leak in tailq that holds dce uuids	16 years ago
Anoop Saldanha	1c443677b2	fix indentation in DCERPCParser	16 years ago
Anoop Saldanha	fe700737a3	fix null dereference in detect parse test - clang fix	16 years ago
Gurvinder Singh	892dea31e4	added the counter for tcp.segment_memcap_drop to show the dropped segments count due to memory limit	16 years ago
Victor Julien	1c1c8cef89	Print engine uptime on the same line as date and time.	16 years ago
Gurvinder Singh	1d0492e2e7	added support to print the engine uptime in stats.log	16 years ago
Victor Julien	e7cb7c6b97	Make outputs part of the flowpinned threads in the AutoFp runmode.	16 years ago
Victor Julien	99ad338e91	Bump version to 1.0.2	16 years ago
Victor Julien	0eb0d48f35	Disable broken unittests and fix one.	16 years ago
Victor Julien	f1e6e80a1e	Properly set tmp_ra_base_seq in streams. By Gurvinder.	16 years ago
Gurvinder Singh	6a5bc52461	support for several tcp evasion attacks. Thanks to Judy Novak and G2 Inc for reporting them	16 years ago
Victor Julien	bc55fb27dc	Compiler warning fix for memory macro's. Small layout changes.	16 years ago
Pablo Rincon	06a65cb460	moving http_client_body logic to use it per transactions. Adding unittests	16 years ago
Pablo Rincon	ee34c70ad8	Reference atomic vars with SC_ATOMIC_EXTERN properly (considering if we support atomic operations or not)	16 years ago
Pablo Rincon	5c43db85ce	Drop streams on inline mode when a drop rule match from a reassembled stream and/or app layer inspection	16 years ago
Pablo Rincon	76af1b049b	Make malloc errors on initialization stage a fatal error, resulting on a exit() call	16 years ago
Anoop Saldanha	eb9adf8129	fix NULL indirection while parsing dce sigs - clang fix	16 years ago
Anoop Saldanha	f094523eb1	clang fix - some minor fixes for unittests	16 years ago
Pablo Rincon	bbab0f9987	Set default gid to 1 on Sig init	16 years ago
Pablo Rincon	8f3322ef73	Fix segv condition on DetectHttpMethodMatch (if the applayer unset the connp)	16 years ago
Pablo Rincon	f225bd1428	Adding modifiers /C /H and /M to pcre (http cookie, header and method)	16 years ago
Victor Julien	1d73e1fb7e	Small update to the ssh module: fix a valgrind warning and a couple of compiler warnings. Do a few small style updates.	16 years ago
Pablo Rincon	9d7baa7a9f	Adding ssh app layer module with two new keywords: ssh.protoversion and ssh.softwareversion	16 years ago
Gurvinder Singh	0dab0e3935	fix the reassembly depth test (bug 216)	16 years ago
Victor Julien	610b7702ba	Bump version to 1.0.1	16 years ago
Victor Julien	04d3832d8f	Remove ports check and fix small typo.	16 years ago
Victor Julien	a492518e7a	Properly detect detect-event-only sigs.	16 years ago
Pablo Rincon	21d79b05ad	Fix for bug221 (avoid considering sig as "decoder event only" if ports are specified). Now the sig gets grouped to get a sgh at SigMatchSignatures	16 years ago
Victor Julien	f081577fe4	Revert yesterday's dcerpc commits as there were to many corner cases for it to go into 1.0.1.	16 years ago
Victor Julien	6299fbfb0f	Fix stream msg content inspection not inspecting the correct id.	16 years ago
Anoop Saldanha	526a782002	temporary fix for dcerpc so that we don't loop endlessly, till we cover all cases with fragged pdus	16 years ago
Anoop Saldanha	361cf14f50	fix endless loop. Change dce parser to accept ctx ids that always start with a ctx with a 0 ctx id	16 years ago
Anoop Saldanha	8c774a1e2a	fix 206. Keep a count of uuids that don't belong to the first frag. Change dce_iface to match against uuids based on any_frag setting	17 years ago
Anoop Saldanha	52bb4c0670	fix endless loop in dce parser. fix parsing error of secondaryaddrlen for bindack	17 years ago
Anoop Saldanha	cda1efff29	fix mem leak in tailq that holds dce uuids	17 years ago
Anoop Saldanha	154a48fada	parse fragmented dce rpc headers correctly. Also some other minor fixes	17 years ago
Anoop Saldanha	c7fdc5ebda	do not reset dce stub buffer, if we are dealing with fragmented pdus(holds good only for first frag request pdus)	17 years ago
Anoop Saldanha	73241fc86c	support fragmented puds in dce + unittest	17 years ago
Anoop Saldanha	3ae45e5bbc	fix indentation in DCERPCParser	17 years ago
Victor Julien	c62a3d995e	Fix signatures with trailing spaces being rejected by the regex. Add test.	17 years ago
Anoop Saldanha	60c770c434	make pcre respect discontinue_matching flag in content matching functions	17 years ago
Kirby Kuehl	e8ecc94d6a	fix multiple dcerpc fragments in one packet	17 years ago
Anoop Saldanha	ce4bc5a63b	some minor modifications to the b2g cuda tests	17 years ago
Victor Julien	c25921edf0	Add config output for new stream settings.	17 years ago
Anoop Saldanha	3a0dadc0f3	Fix seg fault while running cuda tests. Don't set the alarm while running unittests, inside cuda-packet-batcher.c. Will result in a seg while the sig handler for ALRM in invoked	17 years ago
Anoop Saldanha	3536ba7348	fix seg fault due to premature cleanup/double cleanup for byte(jump|test), isdataat, on seeing no previous relative keywords	17 years ago