10189 Commits (8bebea5d4c885194f72d2c86db5c9f50a4c66682)

 

All Branches   

Search

Author	SHA1	Message	Date
Shivani Bhardwaj	8bebea5d4c	rust: Get rid of unneeded macros, fix warnings	6 years ago
Victor Julien	a3e5b91668	detect/dataset: fix 'state' path handling	6 years ago
Victor Julien	e36a963196	datasets/doc: minor fixes and clarifications	6 years ago
Victor Julien	7ae86a0ae9	datarep: remove notice messages	6 years ago
Victor Julien	8045746bd1	datasets: remove notice messages and improve errors	6 years ago
Victor Julien	0107b9a057	doc/dataset: initial documentation	6 years ago
Victor Julien	d5ceafa2e5	suricatasc: add dataset-add command	6 years ago
Victor Julien	1d6a358d8a	datasets: unix socket dataset-add command	6 years ago
Victor Julien	317376f59d	datasets: match on lists of data ... Datasets are sets/lists of data that can be accessed or added from the rule language. This patch implements 3 data types: 1. string (or buffer) 2. md5 3. sha256 The patch also implements 2 new rule keywords: 1. dataset 2. datarep The dataset keyword allows matching against a list of values to see if it exists or not. It can also add the value to the set. The set can optionally be stored to disk on exit. The datarep support matching/lookups only. With each item in the set a reputation value is stored and this value can be matched against. The reputation value is unsigned 16 bit, so values can be between 0 and 65535. Datasets can be registered in 2 ways: 1. through the yaml 2. through the rules The goal of this rules based approach is that rule writers can start using this without the need for config changes. A dataset is implemented using a thash hash table. Each dataset is its own separate thash.	6 years ago
Victor Julien	b286c14324	thash: generalize hash table as used in flow ... Thread safe hash table implementation based on the Flow hash, IP Pair hash and others. Hash is array of buckets with per bucket locking. Each bucket has a list of elements which also individually use locking.	6 years ago
Victor Julien	0b120bbe34	suricata: expose system as global	6 years ago
Victor Julien	5d5612f98e	suricata: --data-dir option	6 years ago
Victor Julien	f24067f5e5	travis: add liblzma (xz) for osx	6 years ago
Victor Julien	6f80821ff0	configure: bump minimum htp to 0.5.30	6 years ago
Victor Julien	dbbdfedb98	lzma: make mandatory ... Libhtp is starting to use it as well, so its safe to make it mandatory here. Remove guards for flash file decompression code.	6 years ago
Philippe Antoine	8d4cbb3f7b	http: fixes stream flags for http tests	6 years ago
Philippe Antoine	9665ab0409	http: wait for response line for filename ... See http evader case 481	6 years ago
Victor Julien	579cc9f02b	const: constify decoder, app-layer, detect funcs	6 years ago
Victor Julien	399ab35aa1	afl: fix compile warnings for decoder fuzz funcs	6 years ago
Jason Ish	a472dec865	travis-ci: update for minimum Rust version of 1.33. ... Plus: - Set latest known working stable Rust to 1.37.0. - Remove test for --disable-rust, as that as option is not respected anymore. - Add test for old/unsupported version of Rust to make sure ./configure fails. - Other minor cleanups.	6 years ago
Jason Ish	8f66f39b29	rustfmt: use default rustfmt configuration ... Remove our config that limited line length to 80 columns.	6 years ago
Jason Ish	c9d569f410	rust: check for minimum Rust version of 1.33.0. ... Related Redmine ticket: https://redmine.openinfosecfoundation.org/issues/2629	6 years ago
Philippe Antoine	ecb9e85d69	install: install all files for events rules ... Fixes #2786	6 years ago
Philippe Antoine	aa73d834b5	boyermoore: avoid one tolower call ... Fixes #1218	6 years ago
Jeff Lucovsky	86deaefe66	ftp: Ensure non-zero command length with MPM init	6 years ago
Jason Ish	d14fe372b4	configure.ac: prevent empty if block (llc check) ... As AC_SUBST doesn't expand to anything in the shell script, this will generate a bad script on older versions of autoconf. Change the logic to eliminate the possibility of an empty if or else block. Redmine issue: https://redmine.openinfosecfoundation.org/issues/3124	6 years ago
Shivani Bhardwaj	f750e4ca40	configure: Remove enable-rust-debug ... Get rid of enable-rust-debug flag and use enable-debug for acheiving the desired functionality. From now, adding `--enable-debug` to `configure` shall create an [unoptimitized + debuginfo] target. Rest behavior stays the same. Closes redmine ticket #3054	6 years ago
Shivani Bhardwaj	85b56b633e	detect: Improve rule keyword alproto registration ... 1. Set WARN_UNUSED macro on DetectSignatureSetAppProto. 2. Replace all direct 'sets' of Signature::alproto from keyword registration. Closes redmine ticket #3006.	6 years ago
Victor Julien	1bc738fbe4	doc: typo fixes ... By @espritlibre and @Zeal0us	6 years ago
Nick Price	d0a85b7550	ja3: Mention LibNSS dependency for JA3	6 years ago
Fabrice Fontaine	9b05db7db0	fix build on m68k with uclibc ... uclibc on m68k defines _POSIX_SPIN_LOCKS but does not define pthread_spin_unlock so check for this function before using pthread_spin_xxx functions Fixes: - http://autobuild.buildroot.org/results/ed923bcc1454ce90444b8dac7c064b5f4ea4a0a5 Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>	6 years ago
Jeff Lucovsky	86fabef093	ftp: address review comments	6 years ago
Jeff Lucovsky	f79316d71a	ftp: remove RUST guards	6 years ago
Jeff Lucovsky	cc5e9ca179	eve/ftp: Modifications for MPM-enabled command descriptor table	6 years ago
Jeff Lucovsky	bc68ef4657	app-layer: Invoke FTP parser cleanup function	6 years ago
Jeff Lucovsky	09ab032a8d	ftp: Use MPM for command lookup	6 years ago
Jeff Lucovsky	4f2a485c55	ftp: Remove LIBJANSSON guards	6 years ago
Jeff Lucovsky	3df2b3437c	eve/ftp: Move "get next line" into app-layer-ftp.c	6 years ago
Victor Julien	f43584661c	stream: support debug notice message in tfo	6 years ago
Eric Leblond	cc28d24e9a	doc: install eBPF files in share directory ... Following proposal by Sascha Steinbiss, let's use /usr/share/suricata to store the eBPF files.	6 years ago
Eric Leblond	5366f80941	bypass: fix build on Windows ... For the sake of unittests, we need to build capture bypass so we end up with a Windows build of flow bypass.	6 years ago
Eric Leblond	3cf49ae868	doc: fix English and some typos	6 years ago
Eric Leblond	4be6701836	doc: pointer to bpfctrl ... As bpfctrl is currently the easiest way to manage pinned maps, let's point to it. We will switch doc to suricatacl once support has been added.	6 years ago
Eric Leblond	8f1a7de791	doc: improve doc on compiling with eBPF support	6 years ago
Eric Leblond	f1ab27b7cb	doc: improve XDP cpu redirect documentation	6 years ago
Eric Leblond	e0e3cc7cc2	ebpf: add tunnel aware load balancing ... This patch decapsulates GRE tunnel in xdp_lb	6 years ago
Eric Leblond	a536852526	ebpf: add XDP load balancing code ... This patch uses CPU redirect map to do load balancing. This is a simplified version of xdp_filter that includes code for bypass.	6 years ago
Eric Leblond	6d9ac64f7b	doc: only balance by ip pair ... As there is some issue with defrag, let's recommend to only do IP pair load-balacing for RSS	6 years ago
Eric Leblond	a1d3835b86	doc: document filter.bpf changes ... Also adds some info to explain maps.	6 years ago
Eric Leblond	53a62953e9	bypass: introduce CAPTURE_OFFLOAD ... This define is used to remove reference to capture bypass in case no capture method implementing this is active. This patch also introduces CAPTURE_OFFLOAD_MANAGER that is defined if we need the flow bypass manager code.	6 years ago