8524 Commits (90ab0b0ec2e8fe6f5746ee397bddf67e2bdac7a7)

Author	SHA1	Message	Date
Philippe Antoine	90ab0b0ec2	http: fix overflow in HTPParseContentRange	6 years ago
Victor Julien	39cf5b0c8b	snmp: fix 'defined but not used' warning ... Remove HAVE_RUST guards as well.	6 years ago
Pierre Chifflier	8c61cfdca5	snmp.version: move unittests to tests/	6 years ago
Pierre Chifflier	58d85b1460	snmp.pdu_type: move unittests to tests/	6 years ago
Pierre Chifflier	ff0ff6344f	snmp.community: move unittests to tests/	6 years ago
Pierre Chifflier	509a54281f	detect/snmp: convert snmp.community keyword to v2, and MPM	6 years ago
Pierre Chifflier	c67a53773b	detect/snmp: rename keywords to snmp.<name>, and make rust mandatory	6 years ago
Pierre Chifflier	9dfec7e734	SNMP: add the "snmp.pdu_type" detection keyword	6 years ago
Pierre Chifflier	e1dd19a0eb	SNMP: add the "snmp.community" detection keyword	6 years ago
Pierre Chifflier	aa608e0ca2	SNMP: add the "snmp.version" detection keyword	6 years ago
Pierre Chifflier	ed4823bbe8	SNMP: add missing case for profiling enum	6 years ago
Pierre Chifflier	6fc7fc74cb	SNMP: add logger	6 years ago
Pierre Chifflier	2df840a8b8	Add SNMP (v1/v2c/v3) application layer	6 years ago
Victor Julien	cdd061ba37	ikev2: clean up c glue code	6 years ago
Victor Julien	3f36a6ce59	tftp: c glue code cleanup	6 years ago
Victor Julien	ade2b1e6cf	output: get rid of BUG_ONs	6 years ago
Victor Julien	9ea6db3889	pool: don't call Cleanup after failed Init ... Stream reassembly memcap is regulated by the Init and Cleanup callbacks. If Init fails due to memcap reached, Cleanup had no way of knowing and it would decrease the memcap even if it hadn't been increased by Init. This could lead to too much memory use and memcap counter underflow. This patch fixes the issue by not calling Cleanup in this case. It's fair to see a failed Init the responsibility of Init.	6 years ago
Victor Julien	597ff3c8e3	pool/thread: clean up tests	6 years ago
Victor Julien	025cc64f55	pool/thread: remove old grow function	6 years ago
Victor Julien	67ba132c10	stream: simplify segment and ssn pool inits	6 years ago
Victor Julien	0b02efdf01	pool/thread: introduce simpler way to grow thread pool	6 years ago
Victor Julien	6e6c1bad7d	pool/thread: minor code cleanups	6 years ago
Victor Julien	924982e792	app-layer: minor cleanups	6 years ago
Victor Julien	ce71bf1fff	capture: check for flow packets on capture timeout ... The capture threads can receive packets from the flow manager in their Threadvars::stream_pq packet queue. This mechanism makes sure the packets the flow manager injects into the engine are processed by the correct worker thread. If the capture thread(s) would not receive packets for a long time, the Threadvars::stream_pq would not be checked and processed. This could lead to packet pool depletion in the flow manager. It would also lead to flows not being timed out/logged until either packets started flowing again or until the engine was shut down. The scenario is more likely to happen in a test (e.g. replay) but could also delay logging on low traffic sensors.	6 years ago
Victor Julien	952cbb563c	app-layer: mandatory tx registration checks ... All protocols now implement the TX API, so the runtime checks for whether or not a protocol supports the TX API can be removed.	6 years ago
Victor Julien	8bc1e120ea	app-layer: make tests tx aware ... Make tests minimally TX-aware so we can asume all parsers use the tx API.	6 years ago
Victor Julien	3526569b25	ssh: test cleanup ... Remove explicit locks. Set ALPROTO_SSH in all tests.	6 years ago
Victor Julien	480f497d05	packetpool: move return stack to pool earlier ... If waiting for N packets move the return stack to the main stack every time we take the return stack lock. Make sure we consider enough packets when setting the pending pool flush logic. This should at least make sure to have the 9 packets the flow manager requires per run.	6 years ago
jason taylor	fa0008dbbe	detect/content: clean up logging output ... Signed-off-by: jason taylor <jtfas90@gmail.com>	6 years ago
Jeff Lucovsky	0960ca0d00	detect/analyzer Add missing HTTP values ... This changeset adds recognition of missing HTTP values - Raw host - Header names - Server body - User agent	6 years ago
Philippe Antoine	a370d2a91d	signature: fix memory leak in DetectBytejumpSetup	6 years ago
Philippe Antoine	8a339e73d3	http: adds an event for double encoded uri	6 years ago
Philippe Antoine	e5879650bb	http: fixes double-encode configuration keywords	6 years ago
Mats Klepsland	f634da61c9	ja3s-string: move unittests to tests/	6 years ago
Mats Klepsland	736d35f36e	ja3s-hash: move unittests to tests/	6 years ago
Mats Klepsland	0b489f329c	detect: add (mpm) keyword ja3s.string ... Match on JA3S string using ja3s.string keyword, e.g: alert tls any any -> any any (msg:"ja3s.string test"; ja3s.string; content:"10-11-12"; sid:1;)	6 years ago
Mats Klepsland	80cee50916	detect: add (mpm) keyword ja3s.hash ... Match on JA3S hash using ja3s.hash keyword, e.g: alert tls any any -> any any (msg:"ja3s.hash test"; ja3s.hash; content:"b26c652e0a402a24b5ca2a660e84f9d5"; sid:1;)	6 years ago
Mats Klepsland	03e8e658d7	lua: add Ja3SGetString function ... Add Ja3SGetString() to return the content of the JA3S string buffer from the TLS session. Example: function init (args) local needs = {} needs["protocol"] = "tls" return needs end function setup (args) filename = SCLogPath() .. "/ja3s_string.log" file = assert(io.open(filename, "a")) end function log (args) ja3s_string = Ja3SGetString() if ja3s_string == nil then return end file:write(ja3s_string .. "\n") file:flush() end function deinit (args) file:close() end	6 years ago
Mats Klepsland	b1d5fe9657	lua: add Ja3SGetHash function ... Add Ja3SGetHash() to return the content of the JA3S hash buffer from the TLS session. Example: function init (args) local needs = {} needs["protocol"] = "tls" return needs end function setup (args) filename = SCLogPath() .. "/ja3s_hash.log" file = assert(io.open(filename, "a")) end function log (args) ja3s_hash = Ja3SGetHash() if ja3s_hash == nil then return end file:write(ja3s_hash .. "\n") file:flush() end function deinit (args) file:close() end In the example above, each JA3S hash is logged to a log file.	6 years ago
Mats Klepsland	a4eaef25d6	eve: add JA3S field to TLS JSON logger ... Add JA3S object to TLS JSON logger (extended log).	6 years ago
Mats Klepsland	a4471987ba	app-layer-ssl: generate JA3S fingerprints ... Generate JA3S fingerprints based on fields in the ServerHello record.	6 years ago
Alexander Gozman	3a16009966	Bug #2965: fix NFQ arguments parsing	6 years ago
Andreas Herz	8baf64f5e9	af-packet: fix setting block_timeout value through afpconfig	6 years ago
Jeff Lucovsky	462a4e2b5b	detect/analyzer: Improve warning message ... This changeset modifies the warning printed when a rule is determined to detect in both directions.	6 years ago
Eric Leblond	5d76f0897c	af-packet: remove rollover reference ... This patch removes reference to rollover in the configuration file and add warnings when it is used.	6 years ago
Philippe Antoine	037d50ef06	signature: fix overflow in parsing	6 years ago
Philippe Antoine	3e12066819	http: adds events for each libhtp log ... Fixes #997	6 years ago
Mats Klepsland	3c57ac144c	detect-ssl-version: move unittests to tests/	6 years ago
Mats Klepsland	238797cc66	detect-ssl-state: move unittests to tests/	6 years ago
Mats Klepsland	479e73b98e	detect-tls-version: move unittests to tests/	6 years ago