8778 Commits (798d8746620187eb1a825f3d5233fcea3a30cd0d)

Author	SHA1	Message	Date
Travis Green	08423282aa	doc: add to sigmatch_table	7 years ago
Travis Green	4612d4b50a	detect: syntax regex logic update ... Updated regex logic to include more spaces. Fixed spelling.	7 years ago
Mats Klepsland	e976d8cf74	output-lua: register app-layer parser logger for SSH ... Bug #3162	7 years ago
Mats Klepsland	1e9f767deb	output-lua: register app-layer parser logger for TLS ... Bug #3162	7 years ago
Jason Ish	61a6eaf330	htp/lzma: set limit from configuration ... Also use a default defined in Suricata, not libhtp.	7 years ago
Victor Julien	c9c23d5cda	htp: set lzma memlimit from config	7 years ago
Jeff Lucovsky	7808b946e3	detect/transform: add dotprefix keyword	7 years ago
Jeff Lucovsky	9df44afa30	logging/anomaly: Add warning code for anomaly log	7 years ago
Jeff Lucovsky	aaacbf28c2	logging/anomaly: Support configuration filter types	7 years ago
Jason Ish	664605b5f1	rdp: disable rdp by default for 5.0	7 years ago
Jason Ish	0f10298990	rdp: address comments in pull request ... Pull request: https://github.com/OISF/suricata/pull/4174 - fix commit: range -> set - OUTPUT_BUFFER_SIZE -> JSON_OUTPUT_BUFFER_SIZE - output: check for initdata first	7 years ago
Zach Kelly	caef8b5b38	protocol parser: rdp ... Initial implementation of feature 2314: 1. Add protocol parser for RDP 2. Add transactions for RDP negotiation 3. Add eve logging of transactions	7 years ago
Shivani Bhardwaj	59da7ae302	counters: Add new default for decoder events ... Set the new default for decoder events to `decoder.event` instead of the previously used `decoder`. Remove the corresponding warning for 5.0.	7 years ago
Victor Julien	7cabb025ea	ips: fix wrong thread for bridge ips modes	7 years ago
Phil Young	8aeff8f973	stream: fix bypass callback for stream.depth ... Fix bug with bypass callback when called with stream depth threshold. bug report: https://redmine.openinfosecfoundation.org/issues/2986	7 years ago
Jason Ish	52187d8548	ftp: removing uninitialized variable warning ... output-json-ftp.c: In function ‘JsonFTPLogger’: output-json-ftp.c:129:9: warning: ‘js_respcode_list’ may be used uninitialized in this function [-Wmaybe-uninitialized] 129 | json_object_set_new(cjs, "completion_code", js_respcode_list); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ output-json-ftp.c:74:13: note: ‘js_respcode_list’ was declared here 74 | json_t *js_respcode_list; | ^~~~~~~~~~~~~~~~ output-json-ftp.c:128:9: warning: ‘js_resplist’ may be used uninitialized in this function [-Wmaybe-uninitialized] 128 | json_object_set_new(cjs, "reply", js_resplist); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ output-json-ftp.c:73:13: note: ‘js_resplist’ was declared here 73 | json_t *js_resplist; | ^~~~~~~~~~~	7 years ago
Victor Julien	a272e433a8	pd: don't reverse flow if TCP session not midstream	7 years ago
Jason Ish	5f1d21f247	dns: handle mid stream pickup on response packet ... Related Redmine issue: https://redmine.openinfosecfoundation.org/issues/2146	7 years ago
Travis Green	9f8dcad287	doc: update of ssh-kewords documentation ... Modifies ssh-keywords.rst to fix syntax error in example rule as well as update descriptions to indicate older keywords have been deprecated.	7 years ago
Jeff Lucovsky	79d308db73	detect/analyzer: Add missing http_accept_enc handling	7 years ago
Victor Julien	a3e5b91668	detect/dataset: fix 'state' path handling	7 years ago
Victor Julien	7ae86a0ae9	datarep: remove notice messages	7 years ago
Victor Julien	8045746bd1	datasets: remove notice messages and improve errors	7 years ago
Victor Julien	1d6a358d8a	datasets: unix socket dataset-add command	7 years ago
Victor Julien	317376f59d	datasets: match on lists of data ... Datasets are sets/lists of data that can be accessed or added from the rule language. This patch implements 3 data types: 1. string (or buffer) 2. md5 3. sha256 The patch also implements 2 new rule keywords: 1. dataset 2. datarep The dataset keyword allows matching against a list of values to see if it exists or not. It can also add the value to the set. The set can optionally be stored to disk on exit. The datarep support matching/lookups only. With each item in the set a reputation value is stored and this value can be matched against. The reputation value is unsigned 16 bit, so values can be between 0 and 65535. Datasets can be registered in 2 ways: 1. through the yaml 2. through the rules The goal of this rules based approach is that rule writers can start using this without the need for config changes. A dataset is implemented using a thash hash table. Each dataset is its own separate thash.	7 years ago
Victor Julien	b286c14324	thash: generalize hash table as used in flow ... Thread safe hash table implementation based on the Flow hash, IP Pair hash and others. Hash is array of buckets with per bucket locking. Each bucket has a list of elements which also individually use locking.	7 years ago
Victor Julien	0b120bbe34	suricata: expose system as global	7 years ago
Victor Julien	5d5612f98e	suricata: --data-dir option	7 years ago
Victor Julien	dbbdfedb98	lzma: make mandatory ... Libhtp is starting to use it as well, so its safe to make it mandatory here. Remove guards for flash file decompression code.	7 years ago
Philippe Antoine	8d4cbb3f7b	http: fixes stream flags for http tests	7 years ago
Philippe Antoine	9665ab0409	http: wait for response line for filename ... See http evader case 481	7 years ago
Victor Julien	579cc9f02b	const: constify decoder, app-layer, detect funcs	7 years ago
Victor Julien	399ab35aa1	afl: fix compile warnings for decoder fuzz funcs	7 years ago
Philippe Antoine	aa73d834b5	boyermoore: avoid one tolower call ... Fixes #1218	7 years ago
Jeff Lucovsky	86deaefe66	ftp: Ensure non-zero command length with MPM init	7 years ago
Shivani Bhardwaj	85b56b633e	detect: Improve rule keyword alproto registration ... 1. Set WARN_UNUSED macro on DetectSignatureSetAppProto. 2. Replace all direct 'sets' of Signature::alproto from keyword registration. Closes redmine ticket #3006.	7 years ago
Nick Price	d0a85b7550	ja3: Mention LibNSS dependency for JA3	7 years ago
Fabrice Fontaine	9b05db7db0	fix build on m68k with uclibc ... uclibc on m68k defines _POSIX_SPIN_LOCKS but does not define pthread_spin_unlock so check for this function before using pthread_spin_xxx functions Fixes: - http://autobuild.buildroot.org/results/ed923bcc1454ce90444b8dac7c064b5f4ea4a0a5 Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>	7 years ago
Jeff Lucovsky	86fabef093	ftp: address review comments	7 years ago
Jeff Lucovsky	f79316d71a	ftp: remove RUST guards	7 years ago
Jeff Lucovsky	cc5e9ca179	eve/ftp: Modifications for MPM-enabled command descriptor table	7 years ago
Jeff Lucovsky	bc68ef4657	app-layer: Invoke FTP parser cleanup function	7 years ago
Jeff Lucovsky	09ab032a8d	ftp: Use MPM for command lookup	7 years ago
Jeff Lucovsky	4f2a485c55	ftp: Remove LIBJANSSON guards	7 years ago
Jeff Lucovsky	3df2b3437c	eve/ftp: Move "get next line" into app-layer-ftp.c	7 years ago
Victor Julien	f43584661c	stream: support debug notice message in tfo	7 years ago
Eric Leblond	5366f80941	bypass: fix build on Windows ... For the sake of unittests, we need to build capture bypass so we end up with a Windows build of flow bypass.	7 years ago
Eric Leblond	53a62953e9	bypass: introduce CAPTURE_OFFLOAD ... This define is used to remove reference to capture bypass in case no capture method implementing this is active. This patch also introduces CAPTURE_OFFLOAD_MANAGER that is defined if we need the flow bypass manager code.	7 years ago
Eric Leblond	094d28d40e	flow-hash: generalize function ... THis patch generalizes the function to get a flow by its flowkey by removing the call setting it to capture bypassed state.	7 years ago
Victor Julien	7384744c3e	detect: fix FP on ICMP unreachable errors ... ICMP unreachable errors are linked to the flow they send an error for. This would lead to the detection engine calling the TX inspection engines on them. The stream inspect engine would default to a match for non-UDP and non-TCP as for ICMP we're not expected to use a TX inspect engine for stream data. This all would lead to a false positive match. This patch fixes this by making sure the TX engines are not called if the packet protocol and flow protocol are not the same. Bug #2769.	7 years ago