2973 Commits (8e48a2edfd054c07ad237fb7ed48f399ae406ab7)

 

All Branches   

Search

Author	SHA1	Message	Date
William	7d07b5375e	Add simple socket to gzip file PoC.	13 years ago
Victor Julien	64f717c880	Set 'livedev' in pcap acquisition module for older libpcap version as well. Fixes a segv.	13 years ago
Victor Julien	5a1a443701	Add example smtp decoding events rules file.	13 years ago
Victor Julien	026a4efc57	Make sure that continued stateful detection only inspects sigs in the proper direction.	13 years ago
Victor Julien	21ee59e6f3	Add signature direction (flow:toserver/flow:toclient) as a signature flag.	13 years ago
Victor Julien	d5402d33d4	Simplify detection loop. Inspect packet keywords before the state.	13 years ago
Victor Julien	7fa22e8453	Rename app_layer_events to app-layer-events. Misc fixes/changes.	13 years ago
Victor Julien	ecd457db7b	Allow flowint names to have dots in them.	13 years ago
Anoop Saldanha	5311cd4866	Support for smtp decoder events	13 years ago
Anoop Saldanha	eea5ab4a7a	Support for app layer decoder events added + app_layer_event keyword added	13 years ago
Victor Julien	4c1e417d49	Allow non-existing flowints to be incremented. A 'set' to 0 is implied in this case.	13 years ago
Victor Julien	d24b3a0e50	Clean up csum detection output, misc fixes.	13 years ago
Eric Leblond	279b8b4027	config: Add explanation for checksum-checks options	13 years ago
Eric Leblond	9a2a4802f4	pf-ring: add support for checksum verif mode ... This patch adds support for checksum verification mode. Supported mode are yes, no, auto and rx-only.	13 years ago
Eric Leblond	0399a06f4f	pcap: fix typo	13 years ago
Eric Leblond	db5ca0f3a4	pcap: add auto mode support	13 years ago
Eric Leblond	a565148fb1	af-packet: fallback if 'kernel' mode is not supported ... This patch adds a fallback to full checksum validation if 'kernel' mode is not supported by the running kernel.	13 years ago
Eric Leblond	51eb96053c	af-packet: auto mode support	13 years ago
Eric Leblond	c3eaa6cc60	Add per-interface counter for invalid checksum. ... This patch adds a per-device counter for invalid checksum as well as a simple packet counter.	13 years ago
Eric Leblond	745b61171a	Introduce LiveGetDevice function	13 years ago
Eric Leblond	e893e860d4	Rename LiveGetDevice to LiveGetDeviceName ... The function LiveGetDevice is returning a point to the name of the interface. This patch renames it to LiveGetDeviceName which is more appropriate.	13 years ago
Eric Leblond	1d1271fd38	pcap: add support for checksum verif mode ... This patch adds support for checksum verification mode. Auto mode is not yet supported.	13 years ago
Eric Leblond	6062e00c2b	af-packet: add support for checksum verif mode ... This patch adds support for checksum verification mode. Auto mode is not yet supported.	13 years ago
Eric Leblond	551cb3e4c2	decode: introduce checksum mode enum.	13 years ago
Eric Leblond	623bb38d1c	af-packet: Fix typo in error message.	13 years ago
Eric Leblond	8d635ddfc2	detect-csum: incomplete checksum is a valid checksum ... This patch modify checksum match to not alert on packet with incomplete checksum. They will be checksummed later and thus can be considered as valid one.	13 years ago
Eric Leblond	67f791e891	af-packet: add variable to disable offloading detection ... This flag adds variable to disable offloading detection. The effect of the flag is to avoid to transmit auxiliary data at each packet. This could result in a potential performance gain.	13 years ago
Eric Leblond	f6ddaf3341	af-packet: parse message to find lack of checksum ... Emitted packet can have checksum offloading. This patch reads af-packet message parameter to see if the kernel has sent a non checksummed packet.	13 years ago
Eric Leblond	5dc46ae7c7	pf-ring: Mark emitted traffic as non checksummed ... The traffic sent by an interface is potentially offloaded. This patch adds detection of TX packets and set the corresponding flag.	13 years ago
Eric Leblond	81bc6f5518	Treat incomplete checksum. ... Checksum of local traffic is often offloaded to the network device. This causes some problems on parsing of this traffic. This patch introduces a PKT_INCOMPLETE_CHECKSUM flag which can be used to indicate that the checksum is not computed/correct for good reason.	13 years ago
Victor Julien	9324ed7b90	Fix icmpv6 ip-only rule not firing. #363.	13 years ago
Anoop Saldanha	517040c4af	indentation fix	13 years ago
Anoop Saldanha	37b223645a	fix detection engine for alert stability. Fix cases where we have multiple rules having same pattern. We should see good perf increase(~5%) with this change, now that we avoid unnecessary inspection"	13 years ago
Anoop Saldanha	42bc22cfa5	indendation fix	13 years ago
Anoop Saldanha	ecc7a769a7	reclaim mpm contexts if no patterns are added to it, even in non-full mode	13 years ago
Anoop Saldanha	1389cf6913	update cuda mpm to support per proto mpm contexts. Fix faulty stream mpm usage of cuda	13 years ago
Anoop Saldanha	92643f6110	introduce separate mpm ctxs for tcp/udp/other_protos	13 years ago
Anoop Saldanha	a5dec3cb2e	refactor all http mpm engine code	13 years ago
Anoop Saldanha	34cf557abf	fix indentation	13 years ago
Anoop Saldanha	5b91cec4ae	remove unnecessary if/else checks	13 years ago
Victor Julien	ada4066238	Add counters for SYN, SYN/ACK and RST TCP packets. Issue #251.	13 years ago
Victor Julien	298289f43f	Let flow:only_stream and flow:no_stream set the require packet and require stream flags. Toss out sigs with conflicting settings. Rename flow:stream_only to flow:only_stream. Fixes #261.	13 years ago
Victor Julien	c04f45ccb9	Add tcp-pkt and tcp-stream 'protocols' to force a signature to inspect only packet or stream data.	13 years ago
Victor Julien	2c62b50ed5	Fix 2 compiler warnings.	13 years ago
Mike Pomraning	cfced01641	Use strlcpy	13 years ago
Mike Pomraning	b5c11bd9fa	Document new "filetype" argument for 'fast', 'http-log', etc.	13 years ago
Mike Pomraning	914b10a8e6	Touch up Makefile for SCConfLogOpenGeneric.	13 years ago
Mike Pomraning	dfec9c0f6a	Switch 'fast', 'http-log', 'drop' and 'alert-debug' to SCConfLogOpenGeneric.	13 years ago
Mike Pomraning	dec34afa40	SCConfLogOpenGeneric() abstraction for regular and AF_UNIX logs. ... util-logopenfile.[ch] implements the abstraction; util-error.[ch] modified to include a socket-specific error code; output.h adds a default filetype for logs ("regular").	13 years ago
Victor Julien	a1cb769205	Switch log-file module to use new absolute path detection code.	13 years ago