3536 Commits (aa9f795800a10c47a5aed38914a46e2c3fb7df95)

Author	SHA1	Message	Date
Victor Julien	ba367dad3c	icmpv6: fix payload handling	14 years ago
Victor Julien	538a941486	decoder events: fix bug causing some rules not to be inspected if the decoder completed with warnings	14 years ago
Victor Julien	f5cd7c6a92	decode events: add debug statement	14 years ago
Victor Julien	82769a1b37	profiling: fix missing profile names	14 years ago
Victor Julien	72443a0d62	unified2: append open instead of trucate open so that in case we rotate within a second we don't overwrite files. Instead we violate the limit.	14 years ago
Victor Julien	298d21372b	flow: only BUG_ON use_cnt in flows when compiled with debug-validation	14 years ago
Anoop Saldanha	b22a0cffbb	cleanup flowtimeout threadvars retrieval + ... throw back pseudo pkt back to packetpool inside flow timeout.	14 years ago
Victor Julien	abecef5d82	stream: send eof to app layer from stream end pkt if necessary	14 years ago
Ludovico Cavedon	ac8b087717	Wait until both sides close the TCP connection before initiating cleanup	14 years ago
Eric Leblond	2accda78a1	unix runmode: fix error handling. ... If 'output-dir' argument was not given it was possible to reach a possibly problematic condition.	14 years ago
Eric Leblond	1fd47cfb96	Remove useless code.	14 years ago
Eric Leblond	b3d4285982	fix logic error in sanity check	14 years ago
Eric Leblond	9c47ada771	Add removal safe TAILQ iterator. ... TAILQ_FOREACH macro was not safe for element removal as it was accessing the next element in case of a free. This patch is inspired by Linux list handling and provide a new macro TAILQ_FOREACH_SAFE. This macro is removal safe and only differs by a last argument being a temporaty pointer to an element.	14 years ago
Eric Leblond	06751ecd75	prelude: don't build string objet for NULL string ... prelude_string_set_ref don't like when it is called with a NULL parameter. This patch adds check for NULL value. This is formally good as there is no use of a NULL description.	14 years ago
Jason Ish	005f7a2399	Feature 638: Display DAG drop counts on exit; add DAG packet and drop stats to live stats.	14 years ago
Ludovico Cavedon	b617c9c3f2	Fix length check on user-agent header	14 years ago
Ludovico Cavedon	5dd0a1d917	Add User-Agent header content to file metadata	14 years ago
Anoop Saldanha	34d5aadcb8	warn users that we don't support content strings whose length's > 255.	14 years ago
Ludovico Cavedon	2f4c9198a6	Initialize flow_manager_mutex	14 years ago
Anoop Saldanha	464ed95f71	fix for bug #526. ... Insert pseudo packet under low load conditions to complete rule swap. This is necessary when we use autofp active packets where most packets would be sent to the first queue under low load conditions.	14 years ago
Victor Julien	389c48f222	Fix detection of spin locks supported. Clean up how we handle falling back to mutex if spinlocks aren't supported.	14 years ago
Eric Leblond	df3d10865a	host: suppress double memory clear ... HostFree() is calling HostClearMemory() so calling HostClearMemory() before HostFree() is useless.	14 years ago
Eric Leblond	12fd60b545	unix-socket: cleanup host table instead of destroying it ... This patch should fix the bug #637. Between pcap files, it uses a new function HostCleanup() to clear tag and threshold on host with an IP regputation. An other consequence of this modification is that Host init and shutdown are now init and shutdown unconditionaly.	14 years ago
Eric Leblond	d9eaa0d340	host: don't destroy reference counter ... The reference counter should not be destroyed in HostClearMemory() as the host can be reused directly (without going through Init function).	14 years ago
Eric Leblond	ca1a70a04b	pfring: fix build failure	14 years ago
Anoop Saldanha	b1ce94babe	Temporary fix for bug #599. ... Treat sigs with negated addresses as non ip-only. This fix exposes bug #608, which results in 2 failed unittest which have now been disabled by this commit. Would be reenabled when we have #608 fix in.	14 years ago
Anoop Saldanha	fdc666f732	unittest to show failure for bug #599.	14 years ago
Victor Julien	9f519e95a2	http: add event for libhtp detection of request port not matching tcp port.	14 years ago
Victor Julien	3ab1458abf	pcap: fix windows commandline mangling win device string	14 years ago
Victor Julien	a698a7600d	clang: fix warnings when debug is enabled	14 years ago
Victor Julien	40bbf96f22	reputation: don't give error if config is missing/commented out	14 years ago
Victor Julien	0f42f0e890	Minor fixes	14 years ago
Eric Leblond	6b3ebc810d	unix runmode: improve JSON handling ... The jansson function with new in their name take care of ref counting. The this patch fixes a memory leak.	14 years ago
Eric Leblond	195b144daa	unix-manager: fix error and JSON handling	14 years ago
Eric Leblond	a05113a2b1	unix-manager: memory handling fixes. ... This patch adds unlikey() for memory error handling and fixes a few error cases.	14 years ago
Eric Leblond	028a37f6e7	unix runmode: use unlikely for memory error	14 years ago
Eric Leblond	547c55114e	unix runmode: fix FIXME	14 years ago
Eric Leblond	f38b8fe4eb	unix runmode: fix JSON mem handling ... json_decref was not correctly used through the code. This patch fixes it.	14 years ago
Eric Leblond	13237b8af2	unix manager: add static	14 years ago
Eric Leblond	936c36d5f1	Disable 'reload-rules' command.	14 years ago
Eric Leblond	d5457ad70e	unix-manager: doc and whitespace fixes	14 years ago
Eric Leblond	af16c418b7	unix-socket: fix build when jansson not present	14 years ago
Eric Leblond	ef64648cf8	unix-command: add drop counter to iface-stat message	14 years ago
Eric Leblond	8d0260b27e	Add atomic counter for iface drop.	14 years ago
Eric Leblond	cc71c993f4	unix-command: add iface information command. ... This patch adds two commands to unix-command. 'iface-list' displays the list of interface which are sniffed by Suricata and 'iface-stat' display the available statistics for a single interface. For now, this is the number of packets and the number of invalid checksums.	14 years ago
Eric Leblond	c78e112e3e	af-packet: update runmode copyright date.	14 years ago
Eric Leblond	6f0a851087	unix-manager: fix error treatment in accept phase	14 years ago
Eric Leblond	f2a17f47d3	unix-manager: implement multi client support ... This patch implements the support of multiple clients connected at once to the unix socket.	14 years ago
Eric Leblond	a9cb8ce89f	affinity: avoid to init structure twice ... In unix socket mode, suricata was doing multiple init of the structure. This was not needed and caused a memory leak in mutex creation.	14 years ago
Eric Leblond	93f801b3a9	pcap-file: update affinity setting code ... The affinity setting code was using the old API. This patch updates to the new API and also adds a call to RunModeInitiaze() which was missing in Single running mode.	14 years ago
Eric Leblond	cfd80e7063	unix-mode: fix return of pcap-file command	14 years ago
Eric Leblond	f8921d8a28	unix-socket: introduce API to add commands and tasks ... This patch transforms the unix socket into a flexible system to add commands (triggered by user) and taks (run periodically). It introduces two functions UnixManagerRegisterCommand and UnixManagerRegisterBackroundTask to registed commands and tasks. Other part of Suricata can then declare a new command via a simple call of the function. In the case of a command the caller is responsible of building the answer message using Jansson API. The sending of the message is made by unix manager code.	14 years ago
Eric Leblond	20a8b9dbe5	unix-manager: add unix command socket and associated script ... This patch introduces a unix command socket. JSON formatted messages can be exchanged between suricata and a program connecting to a dedicated socket. The protocol is the following: * Client connects to the socket * It sends a version message: { "version": "$VERSION_ID" } * Server answers with { "return": "OK|NOK" } If server returns OK, the client is now allowed to send command. The format of command is the following: { "command": "pcap-file", "arguments": { "filename": "smtp-clean.pcap", "output-dir": "/tmp/out" } } The server will try to execute the "command" specified with the (optional) provided "arguments". The answer by server is the following: { "return": "OK|NOK", "message": JSON_OBJECT or information string } A simple script is provided and is available under scripts/suricatasc. It is not intended to be enterprise-grade tool but it is more a proof of concept/example code. The first command line argument of suricatasc is used to specify the socket to connect to. Configuration of the feature is made in the YAML under the 'unix-command' section: unix-command: enabled: yes filename: custom.socket The path specified in 'filename' is not absolute and is relative to the state directory. A new running mode called 'unix-socket' is also added. When starting in this mode, only a unix socket manager is started. When it receives a 'pcap-file' command, the manager start a 'pcap-file' running mode which does not really leave at the end of file but simply exit. The manager is then able to start a new running mode with a new file. To start this mode, Suricata must be started with the --unix-socket option which has an optional argument which fix the file name of the socket. The path is not absolute and is relative to the state directory. THe 'pcap-file' command adds a file to the list of files to treat. For each pcap file, a pcap file running mode is started and the output directory is changed to what specified in the command. The running mode specified in the 'runmode' YAML setting is used to select which running mode must be use for the pcap file treatment. This requires modification in suricata.c file where initialisation code is now conditional to the fact 'unix-socket' mode is not used. Two other commands exists to get info on the remaining tasks: * pcap-file-number: return the number of files in the waiting queue * pcap-file-list: return the list of waiting files 'pcap-file-list' returns a structured object as message. The structure is the following: { 'count': 2, 'files': ['file1.pcap', 'file2.pcap'] }	14 years ago
Eric Leblond	6be63bdc4f	tm-threads: add TM_ECODE_DONE state ... This patch adds a nex return state which can be used by threads to warn that a task has been done. In this case, suricata does not leave.	14 years ago
Eric Leblond	412482f6b1	filestore: create file store directory if needed ... This patch modifies the file store system to have it create the file store directory if needed. It dos not create the full directory tree as the parent directory must have already been created.	14 years ago
Eric Leblond	7b1d346c22	counters: management cpu set was set twice ... Setting the management CPU set on perf threads is already done in the TmThreadCreateMgmtThread() function used to create the threads.	14 years ago
Eric Leblond	84f2645e3e	pcap-file: free thread var at deinit.	14 years ago
Eric Leblond	28b4bed141	tm-threads: fix potential access to NULL pointer.	14 years ago
Eric Leblond	1b26660ac4	counter: defensive set to NULL in free.	14 years ago
Eric Leblond	09b79cb5bf	stream-tcp: fix double call to debug print function	14 years ago
Last G	8ae11f73b2	Added parentheses to fix Eclipse static code analysis ... Fixed bug in action priority (REJECT_DST had lowest prio)	14 years ago
Last G	e236351c52	Fixed missing "|" in "||" operation	14 years ago
Last G	edcb8fdb87	Added parenthesis for right operation order	14 years ago
Last G	8bb9c3af35	Added return value to non-void function with "forever"-loop to fit ... Eclipse static code analysis	14 years ago
Eric Leblond	40891223e9	list-keyword: detect non built keyword ... This patch update the glafs list to be able to indicate that a flag is not supported. This information is used by list-keyword to display information to the user.	14 years ago
Eric Leblond	8f13694988	luajit: no link with HTTP when not build. ... Even when not built-in, luajit is not linked with HTTP.	14 years ago
Eric Leblond	6842545331	Add documentation url in list-keyword output. ... The output of the list-keyword is modified to include the url to the keyword documentation when this is available. All documented keywords should have their link set. list-keyword can be used with an optional value: no option or short: display list of keywords csv: display a csv output on info an all keywords all: display a human readable output of keywords info $KWD: display the info about one keyword.	14 years ago
Eric Leblond	fa900a9f6b	suricata: add information about BPF filter usage	14 years ago
Eric Leblond	7e14fe62f5	suricata: add '-V' info to usage message.	14 years ago
Eric Leblond	fd3a1346e4	suricata: add build-info command to usage message.	14 years ago
Eric Leblond	4e0f5b7f02	suricata: don't display msg in list-keyword mode. ... In list-keywords and list-app-layer mode, suricata now only displays the messages linked with the feature. This allow users to redirect the output and easily work on it. For exemple, the csv output will be easily imported into a spreadsheet.	14 years ago
Eric Leblond	5e4552fdcd	suricata: update list-keyword command ... This patch update the list-keyword command. Without any option, the previous behavior is conserved. If 'all' is used as option, suricata print a csv formatted output of keyword information: name;features;description If a keyword name is used as argument, suricata print a readable message: tls.subject Features: state inspecting Description: Match TLS/SSL certificate Subject field	14 years ago
Eric Leblond	86709f5e9d	rule analyser: display message for invalid signatures	14 years ago
Eric Leblond	c7cfbb71c9	engine-analyzer: fix typo in message	14 years ago
Eric Leblond	cd42e6a3ef	Listing of app layers does not depend on unittests	14 years ago
Eric Leblond	42ace54137	list-keywords: fix when not using default install ... As we don't parse the YAML file when listing of keywords is asked, suricata make a test on existence of the build-default directory. So with a non standard (working) install (even a single configure without option lead to a failure), the keyword listing fails because the default logging directory does not exist.	14 years ago
Eric Leblond	b0471fb8e4	rule analyser: add msg if rule is ipv4 or ipv6 only	14 years ago
Victor Julien	83bfe3810b	reputation: report error if host table memcap reached. Work around compilation failure with atomic fallback code.	14 years ago
Victor Julien	18535e6ef9	Host: ignore usecnt add/sub result. Expose HostPrintStats.	14 years ago
Victor Julien	e30b1bfe64	Simple IP reputation implementation	14 years ago
Victor Julien	9140aa6ac5	cygwin supports the thread cpu affinity code now	14 years ago
Victor Julien	b20bfa04ef	clang warning squashing	14 years ago
Victor Julien	84bad6db77	Silence compiler warnings found by clang	14 years ago
Victor Julien	b63c2eda6a	build: more cygwin cleanups	14 years ago
Victor Julien	dc465b92e5	Fix use of byte swap function	14 years ago
Victor Julien	506c144c60	build: reshuffle including headers to fix build on cygwin	14 years ago
Anoop Saldanha	e1cabae0f4	fix uninit var usage in hhd	14 years ago
Eric Leblond	4726e02afb	logging: add warning if no output module is selected ... If no daemon compatible logging module is selected, a message is displayed to avoid the user to look like mad for messages.	14 years ago
Eric Leblond	9f4da93a4b	suricata: don't exit if pidfile can't be created	14 years ago
Eric Leblond	e148b2b82a	suricata: display PID file name in case of error.	14 years ago
Victor Julien	93bdaa49d8	byte_jump: when from_beginning option is used, the number of bytes to convert should not be used in the jump. Bug 627.	14 years ago
Eric Leblond	7854c84972	pcap: add capture counters in stats.log. ... This patch adds three counters to stats.log: capture.kernel_packets | RxPcapwlan0 | 4218 capture.kernel_drops | RxPcapwlan0 | 0 capture.kernel_ifdrops | RxPcapwlan0 | 0 This patch meant to fix bug #625.	14 years ago
Victor Julien	bcaec1e963	pkt-data: don't compile unittest unless unittests are enabled	14 years ago
Victor Julien	472e061c6d	build: more checking for includes	14 years ago
Victor Julien	2a42f554b1	build cleanup, build source files in alphabetical order	14 years ago
Victor Julien	042d0c6ee8	build cleanups	14 years ago
Victor Julien	5a6c8c0f01	minor misc changes: update htp ver, add htp ver to --build-info, clean up	14 years ago
Xavier Lange	234922f3c6	Keyword pkt_data	14 years ago
Eric Leblond	b9a2f91a76	napatech: treat malloc error	14 years ago
Eric Leblond	a1d1abfc05	suricata: add daemon-directory config variable ... It is now possible to use the 'daemon-directory' configuration variable to specify the working directory of suricata in daemon mode. This will permit to specify the place for core and other related files.	14 years ago