105 Commits (71ffed5128dbbf493be89b71eca85d319b0b20f7)

Author	SHA1	Message	Date
Eric Leblond	b7e78d33b1	af-packet: warn about BPF filter consequence in IPS mode ... This patch add a message to warn user about the impact of using a BPF filter in IPS mode.	12 years ago
Anoop Saldanha	8bf034e8c4	Live rule swap logs added to report SigLoadSignatures() failure. Also set ... thread_closed flag on exit for live swap thread.	13 years ago
Victor Julien	b66af2c2ed	nfq: add missing error string	13 years ago
Ignacio Sanchez	d771e08156	Adds support for the geoip keyword ... Adds support for match-on conditions (src, dst, any, both) Uses GEOIP_MEMORY_CACHE for performance reasons Adds support for negation and multiple countries in the same rule Bug fixes Changed to take flow direction from rule, if present Comments addressed. Unit tests added.	13 years ago
Nikolay Denev	9480559c65	preserve the existing error code order ... restore SC_WARN_IPFW_SETSOCKOPT move SC_ERR_IPFW_SETSOCKOPT at the end of the enum	13 years ago
Nikolay Denev	894ad21be5	setsockopt() failures are already fatal, ... so treat them as such and print error instead of warning.	13 years ago
Anoop Saldanha	34d5aadcb8	warn users that we don't support content strings whose length's > 255.	13 years ago
Victor Julien	e30b1bfe64	Simple IP reputation implementation	13 years ago
Matt Keeler	37e3de8425	Refactor Napatech 3GD to just Napatech as Suricata is only going to support 3GD. ... Signed-off-by: Matt Keeler <mk@npulsetech.com>	13 years ago
Matt Keeler	5786a32d0f	Remove Napatech 2GD support ... Removed the Napatech 2GD support runmode-napatech-3gd.c had an include from runmode-napatech.h which was erroneous and has been removed as well. Signed-off-by: Matt Keeler <mk@npulsetech.com>	13 years ago
Matt Keeler	844e4dba11	Napatech 3GD Support ... For use with Network Cards from Napatech utilizing the 3GD driver/api. - Implemented new run modes in runmode-napatech-3gd.* - Implemented capture/decode threads in source-napatech-3gd.* - Integrated the new run modes and source into the build infrastructure. New configure switches --enabled-napatech-3gd : Turns on the NT 3GD support --with-napatech-3gd-includes : The directory containing the NT 3GD header files --with-napatech-3gd-libraries : The directory containing the NT 3GD libraries to link against. New CLI switch --napatech-3gd : Uses the Napatech 3GD run mode Runmodes Supported: - auto - autofp - workers Notes: - tested with 1 Gbps sustained traffic (no drops) Signed-off-by: Matt Keeler <mk@npulsetech.com>	13 years ago
Anoop Saldanha	b0e20a486c	update client/server/http_header to use a different form of ... buffering/buffer_retrieval. Now it happens per tx, based on tx id. Also notice a perf improvement with this.	13 years ago
Victor Julien	7a044a99ee	Defrag engine ... Big rewrite of defrag engine to make it more scalable and fix some locking logic flaws. Now uses a hash of trackers similar to Flow and Host hashes.	13 years ago
Victor Julien	42646579a8	luajit: clean up initialization	13 years ago
Victor Julien	f58e828c5e	luajit: stub detection keyword	13 years ago
Anoop Saldanha	cde31abe96	bug #455 - Warn users on signature event vars having precedence over threshold.conf ones	13 years ago
Victor Julien	fa121a1dd4	filemd5: handle case where no md5 support is compiled it.	13 years ago
Victor Julien	9f7588a756	Add filemd5 keyword that loads a list of md5's to match a file's md5 against.	13 years ago
Anoop Saldanha	4689783342	bug #454 - rebase fix. Also use better error code to indicate invalid address var yaml entry	13 years ago
Anoop Saldanha	678763c3f4	bug #454 - global check to see if address and port vars are properly configured	13 years ago
Anoop Saldanha	d39b7b72bd	Add a nice error message when we exceeded address buffer limit for a rule	13 years ago
Anoop Saldanha	69ed12fd28	Introduce new buffer API that lets you create and manage a buffer. Update http log to use this as well	13 years ago
Victor Julien	4157d9408d	Various small flow and host table fixes.	14 years ago
Victor Julien	d908e707d7	profiling: add per lock location profiling ... Add profiling per lock location in the code. Accounts how often a lock is requested, how often it was contended, the max number of ticks spent waiting for it, avg number of ticks waiting for it and the total ticks for that location. Added a new configure flag --enable-profiling-locks to enable this feature.	14 years ago
Nikolay Denev	32e898f2e3	Convert config entries using underscores to dashes and emit deprecation warnings.	14 years ago
Victor Julien	1d9f6ff8f2	Initial Napatech support by Randy Caldejon / nPulse.	14 years ago
Victor Julien	87e6be610a	Issue warning if libhtp version used is not up to date.	14 years ago
Victor Julien	e526525f83	Fix pcap -i <ip>.	14 years ago
Mike Pomraning	dec34afa40	SCConfLogOpenGeneric() abstraction for regular and AF_UNIX logs. ... util-logopenfile.[ch] implements the abstraction; util-error.[ch] modified to include a socket-specific error code; output.h adds a default filetype for logs ("regular").	14 years ago
Victor Julien	07e560b137	file-data: initial file_data support ... Support file_data for: content, pcre (relative), byte_test, byte_jump, byte_extract, isdataat. File_data support is handled at signature parsing time, all matches occurring after the file_data in the rule are converted to http_server_body matches. Content matches relative to the file_data are converted. Within to depth, distance to offset. Relative to the start of the body buffer.	14 years ago
Anoop Saldanha	420befb180	Changed my email address to anoopsaldanha at gmail dot com from my current one	14 years ago
Anoop Saldanha	e0c13434ef	bug 333 - support new Size Parsing API. Update various conf params inside the engine to use this API to parse sizes in the format xxx <-just the no represents bytes, xxxkb <- kilobytes, xxxmb <- megabytes, xxxgb <- gigabytes, where xxx is a \d+	14 years ago
Victor Julien	8cc82c7241	Add -S commandline option that loads a rule file exclusively. Issue #338.	14 years ago
Eric Leblond	e80b30c082	af-packet: finalize code ... This patch handles the end of AF_PACKET socket support work. It provides conditional compilation, autofp and single runmode. It also adds a 'defrag' option which is used to activate defrag support in kernel to avoid rx_hash computation in flow mode to fail due to fragmentation. This patch contains some fixes by Anoop Saldanha, and incorporate change following review by Anoop Saldanha and Victor Julien. AF_PACKET support is only build if the --enable-af-packet flag is given to the configure command line. Detection of code availability is also done: a check of the existence of AF_PACKET in standard header is done. It seems this variable is Linux specific and it should be enough to avoid compilation of AF_PACKET support on other OSes. Compilation does not depend on up-to-date headers on the system. If none are present, wemake our own declaration of FANOUT variables. This will permit compilation of the feature for system where only the kernel has been updated to a version superior to 3.1.	14 years ago
Victor Julien	681f8329a6	Make error on <- direction operation use more explicit.	14 years ago
Victor Julien	8978266a91	If shutdown doesn't complete processing all packets that are already in the engine within 30 seconds, force quit.	14 years ago
Anoop Saldanha	d7c707e656	modify runmodes to take all arguments from the conf API	14 years ago
Victor Julien	140eb4fde8	Fix decode-event keyword parsing. Fix code that indicates a signature is decode-event only. Add 'pkthdr' protocol as an alias for any/ip to be used by decode-event signatures.	15 years ago
Victor Julien	bc7e21aee6	Add special sguil mode to log-pcap to support logging into date based directory structure and rotate when the day passes. Also do not log packets beyond stream reassembly depth and encrypted traffic.	15 years ago
Gurvinder Singh	27f67c97de	log error on duplicate sig and also for dup sig with newer revision	15 years ago
Victor Julien	24f071cabb	Make sure http_cookie inspects all HTTP transactions. Clean up error messages. Get rid of unused code and dead comments.	15 years ago
Victor Julien	878d3d87db	Add (experimental) support for using multiple pcap devices to acquire packets from. Just passing multiple -i <dev> options on the commandline will activate this. Windows not yet supported.	15 years ago
Anoop Saldanha	88d94b136d	Support for reference.config file	15 years ago
Anoop Saldanha	658ff5753d	aho-corasick for the cpu. We have 2 versions of ac. The first MPM_AC uses the delta table and the secone one MPM_AC_GFBS uses the goto-failure table	15 years ago
Pablo Rincon	76af1b049b	Make malloc errors on initialization stage a fatal error, resulting on a exit() call	15 years ago
Pablo Rincon	693d4f54eb	Load signatures with incompatible fast_pattern option (due to design differences for optimization)	15 years ago
Anoop Saldanha	98433f407c	dce rpc stub data held in separate buffers for request and response pdus	15 years ago
Jason MacLulich	835630efbd	Add initial support for reading packets from a DAG card, we only support reading from a single stream at this time. ... Use the --dag <dagname> cmd line option to specify from which DAG card to read pkts from. Issue at the moment with pkts being ejected during shutdown -- at the moment we ignore any packets that are not of link type Ethernet.	15 years ago
Ondrej Slanina	6bf7d76005	added possibility to run suricata as WIN32 service	15 years ago
Pablo Rincon	29a6fc2f03	Adding some flow improvements and recovery on emergency mode	15 years ago