224 Commits (8cfc23ee22c2c6d54f2e0f6273f821aa31f40071)

Author	SHA1	Message	Date
Victor Julien	8cfc23ee22	Add a new hash datatype to do speedy lookups of read only uniform data, like md5's.	14 years ago
Anoop Saldanha	69ed12fd28	Introduce new buffer API that lets you create and manage a buffer. Update http log to use this as well	15 years ago
Victor Julien	06d7fb5428	Fix CUDA build from a release tarball.	15 years ago
Victor Julien	20c08ca47b	hash: add lookup3.c by Bob Jenkins ... Found here: http://burtleburtle.net/bob/hash/doobs.html http://burtleburtle.net/bob/c/lookup3.c From the file header: lookup3.c, by Bob Jenkins, May 2006, Public Domain. These are functions for producing 32-bit hashes for hash table lookup. hashword(), hashlittle(), hashlittle2(), hashbig(), mix(), and final() are externally useful functions. Routines to test the hash are included if SELF_TEST is defined. You can use this free for any purpose. It's in the public domain. It has no warranty.	15 years ago
Pierre Chifflier	4be65fd016	TLS handshake: decode the SERVER_CERTIFICATE message ... Add a decoder for the SERVER_CERTIFICATE during a TLS handshake, extracts the certificates and keep the subject name. Add the tls.subject keyword for substring match in rules (TLS layer). Signed-off-by: Pierre Chifflier <pierre.chifflier@ssi.gouv.fr>	15 years ago
Pierre Chifflier	f77fcdb3e8	Add ASN.1 parser for X509 certificates (in DER format) ... Signed-off-by: Pierre Chifflier <pierre.chifflier@ssi.gouv.fr>	15 years ago
Victor Julien	d908e707d7	profiling: add per lock location profiling ... Add profiling per lock location in the code. Accounts how often a lock is requested, how often it was contended, the max number of ticks spent waiting for it, avg number of ticks waiting for it and the total ticks for that location. Added a new configure flag --enable-profiling-locks to enable this feature.	15 years ago
Victor Julien	a05df345de	Introduce host table, make tag use it ... Add a host table similar to the flow table. A hash using fine grained locking. Flow manager for now takes care of book keeping / garbage collecting. Tag subsystem now uses this for host based tagging instead of the global tag hash table. Because the latter used a global lock and the new code uses very fine grained locking this patch should improve scalability.	15 years ago
Victor Julien	db24258acf	Undo changes from 88b8f15663. Atomic stack implementation had a-b-a problem.	15 years ago
Victor Julien	88b8f15663	Add atomic stack implementation. Convert flow spare queue to use this stack. Remove now unused flow-queue code.	15 years ago
Victor Julien	2197f1a625	file-inspection: split 'file' output module into file-store and file-log. Store stores files. Log logs json records.	15 years ago
Anoop Saldanha	2f7717a1a7	delete detect-recursive.[ch]	15 years ago
Anoop Saldanha	35f1f7e8d9	unify payload detection engines + fix other bugs in pcre init	15 years ago
Anoop Saldanha	09313cf9bd	Support http stat code detection engine, fast pattern(mpm engine included). Fix http stat code setup function. Fix pcre option for stat msg keyword. With this the pcre options for server_body is Q, for stat_msg is Y and for stat_code is S	15 years ago
Anoop Saldanha	2007c2711c	Support http stat msg detection engine, fast pattern(mpm engine included). Fix http stat msg setup function. Fix pcre option for stat msg keyword	15 years ago
Victor Julien	1d9f6ff8f2	Initial Napatech support by Randy Caldejon / nPulse.	15 years ago
Anoop Saldanha	199288309d	Support for new MPM ac-bs added	15 years ago
Anoop Saldanha	eea5ab4a7a	Support for app layer decoder events added + app_layer_event keyword added	15 years ago
Mike Pomraning	914b10a8e6	Touch up Makefile for SCConfLogOpenGeneric.	15 years ago
Victor Julien	4cbaeb408c	Add functions to determine whether a path is absolute or relative.	15 years ago
Victor Julien	7adac3048d	file-data: create initial keyword registration.	15 years ago
Victor Julien	89f83e714c	Introduce http_server_body keyword. ... The http_server_body content modifier modifies the previous content to inspect the normalized (dechunked, unzipped) http_server_body. The workings are similar to http_client_body. Additionally, a new pcre flag was introduced "/S". To facilitate this change the signature flags field was changed to be 64 bit.	15 years ago
Anoop Saldanha	e0c13434ef	bug 333 - support new Size Parsing API. Update various conf params inside the engine to use this API to parse sizes in the format xxx <-just the no represents bytes, xxxkb <- kilobytes, xxxmb <- megabytes, xxxgb <- gigabytes, where xxx is a \d+	15 years ago
Eileen Donlon	dbdf2d888f	Enable/disable core dump in config (feature 319)	15 years ago
Victor Julien	e1022ee5ae	file-extraction: Disconnect file handling from flow and move into the app layer state.	15 years ago
Victor Julien	27645f64c6	Remove unused util-filetype.[ch] from Makefile.am.	15 years ago
Victor Julien	5945e652d6	Initial implementation of filemagic keyword.	15 years ago
Victor Julien	f4a6f4b293	Add libmagic detection, linking and a basic API.	15 years ago
Victor Julien	23e01d23d3	Implement filestore keyword, including a way for the stateful detection engine to conclude that a file will never have to be stored.	15 years ago
Victor Julien	1eef36b011	Initial checkin of a log-file module, that can write files extracted from flows to disk.	15 years ago
Victor Julien	a0ee6ade3e	Improve HTTP multipart parsing, add streaming parsing for files.	15 years ago
Pablo Rincon	6d60b3a747	filename and fileext keywords	15 years ago
Anoop Saldanha	2b356dadff	Support for tos keyword added	15 years ago
Eric Leblond	391d813c82	Remove unified1 output module.	15 years ago
Eric Leblond	27f1d88374	Add pcap-info alert format. ... This patch adds a new alert format called pcap-info. It aims at providing an easy to parse one-line per-alert format containing the packet id in the parsed pcap for each alert. This permit to add information inside the pcap parser. This format is made to be used with suriwire which is a plugin for wireshark. Its target is to enable the display of suricata results inside wireshark. This format doesn't use append mode per default because a clean file is needed to operate with wireshark. The format is a list of values separated by ':': Packet number:GID of matching signature:SID of signature:REV of signature:Flow:To Server:To Client:0:0:Message of signature The two zero are not yet used values. Candidate for usage is the part of the packet that matched the signature.	15 years ago
Eric Leblond	8bf0897b3c	Add factorisation function for runmode. ... This patch adds a function which will be used to factorise the Auto runmode between the different IDS mode.	15 years ago
Eric Leblond	de59c9f4b1	Add and use utility functions for checksum computing.	15 years ago
Eric Leblond	a85dc9b0e2	Add support for replace keyword. ... This patch adds support for the replace keyword. It is used with content to change selected part of the payload. The major point with this patch is that having a replace keyword made necessary to avoid all stream level check because we need to access to the could-be-modified packet payload. One of the main difficulty is to handle complex signature. If there is other content check, we must do the substitution when we're sure all match are valid. The patch adds an attribute to the thread context variable to be able to deal with recursivity of the match function. Replace is only activated in IPS mode and apply only to raw match.	15 years ago
Anoop Saldanha	b6ba944e6d	Rearrange flow manager functions into flow-manager.[ch]. Some other minor changes/updates	15 years ago
Anoop Saldanha	7c729d2d53	some more code cleanup + comments added	15 years ago
Eric Leblond	2ac8755382	Rename detect-decode-event to detect-engine-event ... This patch does a simple renaming of detect-decode-event file to the more global detect-engine-event name.	15 years ago
Eric Leblond	871b21892a	factorize pcap live device function ... They are not specific to pcap and could thus be used in other module.	15 years ago
Eric Leblond	c45d898572	af-packet: basic support for AF_PACKET socket ... This patch provides basic support for AF_PACKET socket. It is completed by a subsequent patches prodiding extended features and bugfixes.	15 years ago
Victor Julien	fca541f40e	Add per app layer parser profiling ... Per packet per app layer parser profiling. Example summary output: Per App layer parser stats: App Layer IP ver Proto cnt min max avg -------------------- ------ ----- ------ ------ ---------- ------- ALPROTO_HTTP IPv4 6 163394 126 38560320 42814 ALPROTO_FTP IPv4 6 644 117 26100 2566 ALPROTO_TLS IPv4 6 670 117 7137 799 ALPROTO_SMB IPv4 6 114794 126 225270 957 ALPROTO_DCERPC IPv4 6 5207 126 25596 1266 Also added to the csv out. In the csv out there is a new column "stream (no app)" that removes the app layer parsers from the stream tracking. So raw stream engine performance becomes visible.	15 years ago
Victor Julien	820b0ded82	Add per packet profiling. ... Per packet profiling uses tick based accounting. It has 2 outputs, a summary and a csv file that contains per packet stats. Stats per packet include: 1) total ticks spent 2) ticks spent per individual thread module 3) "threading overhead" which is simply calculated by subtracting (2) of (1). A number of changes were made to integrate the new code in a clean way: a number of generic enums are now placed in tm-threads-common.h so we can include them from any part of the engine. Code depends on --enable-profiling just like the rule profiling code. New yaml parameters: profiling: # packet profiling packets: # Profiling can be disabled here, but it will still have a # performance impact if compiled in. enabled: yes filename: packet_stats.log append: yes # per packet csv output csv: # Output can be disabled here, but it will still have a # performance impact if compiled in. enabled: no filename: packet_stats.csv Example output of summary stats: IP ver Proto cnt min max avg ------ ----- ------ ------ ---------- ------- IPv4 6 19436 11448 5404365 32993 IPv4 256 4 11511 49968 30575 Per Thread module stats: Thread Module IP ver Proto cnt min max avg ------------------------ ------ ----- ------ ------ ---------- ------- TMM_DECODEPCAPFILE IPv4 6 19434 1242 47889 1770 TMM_DETECT IPv4 6 19436 1107 137241 1504 TMM_ALERTFASTLOG IPv4 6 19436 90 1323 155 TMM_ALERTUNIFIED2ALERT IPv4 6 19436 108 1359 138 TMM_ALERTDEBUGLOG IPv4 6 19436 90 1134 154 TMM_LOGHTTPLOG IPv4 6 19436 414 5392089 7944 TMM_STREAMTCP IPv4 6 19434 828 1299159 19438 The proto 256 is a counter for handling of pseudo/tunnel packets. Example output of csv: pcap_cnt,ipver,ipproto,total,TMM_DECODENFQ,TMM_VERDICTNFQ,TMM_RECEIVENFQ,TMM_RECEIVEPCAP,TMM_RECEIVEPCAPFILE,TMM_DECODEPCAP,TMM_DECODEPCAPFILE,TMM_RECEIVEPFRING,TMM_DECODEPFRING,TMM_DETECT,TMM_ALERTFASTLOG,TMM_ALERTFASTLOG4,TMM_ALERTFASTLOG6,TMM_ALERTUNIFIEDLOG,TMM_ALERTUNIFIEDALERT,TMM_ALERTUNIFIED2ALERT,TMM_ALERTPRELUDE,TMM_ALERTDEBUGLOG,TMM_ALERTSYSLOG,TMM_LOGDROPLOG,TMM_ALERTSYSLOG4,TMM_ALERTSYSLOG6,TMM_RESPONDREJECT,TMM_LOGHTTPLOG,TMM_LOGHTTPLOG4,TMM_LOGHTTPLOG6,TMM_PCAPLOG,TMM_STREAMTCP,TMM_DECODEIPFW,TMM_VERDICTIPFW,TMM_RECEIVEIPFW,TMM_RECEIVEERFFILE,TMM_DECODEERFFILE,TMM_RECEIVEERFDAG,TMM_DECODEERFDAG,threading 1,4,6,172008,0,0,0,0,0,0,47889,0,0,48582,1323,0,0,0,0,1359,0,1134,0,0,0,0,0,8028,0,0,0,49356,0,0,0,0,0,0,0,14337 First line of the file contains labels. 2 example gnuplot scripts added to plot the data.	15 years ago
Eric Leblond	a0b4068041	autotools: fix duplicate check command in Makefile. ... It seems that check target can not be used in Makefile.am. Using check-am fix a make failure.	15 years ago
Anoop Saldanha	576ec7da66	smtp parser support	15 years ago
Martin Beyer	2f1262b446	fixed cuda build: portability issues and nvcc version check	15 years ago
Martin Beyer	49d66430bc	build cuda modules with make	15 years ago
Anoop Saldanha	35f3eafa5e	byte extract added to the engine. Detection support added for packet payload, uri and dce detection engines	15 years ago