6939 Commits (b4565004c7f7585e69e29d5e11b5d28bb66125fa)

 

All Branches   

Search

Author	SHA1	Message	Date
Victor Julien	b4565004c7	detect-template: modernize	9 years ago
Jason Ish	e878dd2231	app-layer templates: cleanups ... - cleanup file headers - add todo section - convert unit tests to new macros - add markers to remove disabled by default behaviour	9 years ago
Jason Ish	3cf8b4629f	decode-icmpv6: use FAIL macros in tests	9 years ago
Jason Ish	2a42e8be03	unittest: FAIL macro to unconditionally fail a test	9 years ago
Jason Ish	af4085b77b	icmpv6: fix checksum verification if fcs present ... Calculate the length of the ICMPv6 packet from decoded information instead of off the wire length. This will provide the correct length if trailing data like an FCS is present. Fixes issue: https://redmine.openinfosecfoundation.org/issues/1849	9 years ago
Victor Julien	120f59386b	affinity: fix compilation on SunOS	9 years ago
Victor Julien	a2c9b86cdf	byteswap: fix compilation on SunOS	9 years ago
Victor Julien	7847c4f8ee	configure: detect SunOS and link against required libs	9 years ago
Victor Julien	ef1acdfaee	threads: provide SCGetThreadIdLong for SunOS	9 years ago
Victor Julien	4271d57157	decode: declare IPPROTO_IPIP if OS doesn't have it	9 years ago
Victor Julien	6956c1c749	decode: fix int types	9 years ago
Victor Julien	ec87123339	configure: check for strings.h: used by SunOS	9 years ago
Victor Julien	8600872e02	logfile: resolve name clash on SunOS	9 years ago
Victor Julien	b81ea0d7db	eve: reduce flow_id to 51 bits ... Evebox & ELK couldn't handle the large integers. It looks like (partly) a javascript limitation that doesn't treat 64bit ints as real ints.	9 years ago
Victor Julien	5db322045e	configure: fix Ubuntu lua pkg suggestion	9 years ago
Victor Julien	9ca34fa5c9	eve: output more unique flow_id	9 years ago
Victor Julien	78b4db8a95	flow: introduce function to generate flow id ... The flow id itself is not stored in the flow, but generated based on properties that do not change during the lifetime of the flow. As it's meant for use with the json output, it is limited to a signed 64 bit integer (int64_t) because that is the time json_integer_t uses.	9 years ago
Victor Julien	666bba8121	detect: implement continue detect for dcepayload ... Also fix a corner case in start detection. Bug 1853.	9 years ago
Victor Julien	ecf4a2862c	detect: cleanup	9 years ago
Victor Julien	6b078e4f51	detect: fix ICMP error handling issue ... The first packet in both directions of a flow looks up the rule group (sgh) and stores it in the flow. This makes sure the lookup doesn't have to be performed for each packet. ICMPv4 error messages are connected to the TCP or UDP flow they apply to. In the case of such an ICMP error being the first packet in a flow's direction, this would lead to an issue. The packet would look up the rule group based on the ICMP protocol, not based on the embedded TCP/UDP. This makes sense, as the ICMP packet is inspected as ICMP packet. The consequence however, was that this rule group pointer (sgh) would be stored in the flow. This is wrong, as TCP/UDP packets that follow the ICMP packet would have no sgh or the wrong sgh. In normal traffic this shouldn't normally happen, but it could be used to evade Suricata's inspection.	9 years ago
Victor Julien	2eb941f9d9	output dns: fix bit declarations	9 years ago
Victor Julien	5c6ffe5653	common: introduce macro for bit declarations	9 years ago
Tom DeCanio	0f6c8806a0	output-json-dns: dns output filtering.	9 years ago
Jason Ish	1691c10681	eve: make logging of tagged packets optional ... But it is enabled in the default configuration.	9 years ago
Jason Ish	040660556e	eve: log tag packets as packet events ... Create a new eve event type, "packet" for logging packets that are tagged as part of an event. The packet is still at the top level to keep it consistent with alert event types. In addition to the packet being logged, a packet_info object is created to hold the linktype and any future meta data we may want to add about the packet.	9 years ago
Victor Julien	305b1b90fd	detect: minor cleanup	9 years ago
Victor Julien	ec0217f52c	detect: minor style fixes	9 years ago
Victor Julien	7d11af16ef	detect: minor debug output cleanup	9 years ago
Victor Julien	0e2ea4e63b	detect: remove unused debug code	9 years ago
Victor Julien	b79d9cda3a	detect: minor cleanups	9 years ago
Victor Julien	199bb3bae3	stream-tcp: fix ssn returning to wrong thread pool	9 years ago
Jason Ish	cf61472619	app-layer-dcerpc-udp: style cleanups ... - consistent 4 space indent - cleanup file header	9 years ago
Jason Ish	e55334fb37	detect-flowbits: fix misleading indentation ... detect-flowbits.c: In function ‘FlowBitsTestSig02’: detect-flowbits.c:475:4: warning: this ‘if’ clause does not guard... [-Wmisleading-indentation] if(error_count == 5) ^~ detect-flowbits.c:478:5: note: ...this statement, but the latter is misleadingly indented as if it is guarded by the ‘if’ SigGroupBuild(de_ctx); ^~~~~~~~~~~~~	9 years ago
Jason Ish	a975fdcfeb	app-layer-dcerpc-udp: fix missleading indentation ... app-layer-dcerpc-udp.c: In function ‘DCERPCUDPParserTest01’: app-layer-dcerpc-udp.c:1105:5: warning: this ‘if’ clause does not guard... [-Wmisleading-indentation] if (alp_tctx != NULL) ^~ app-layer-dcerpc-udp.c:1107:2: note: ...this statement, but the latter is misleadingly indented as if it is guarded by the ‘if’ StreamTcpFreeConfig(TRUE); ^~~~~~~~~~~~~~~~~~~	9 years ago
Jason Ish	95015a3f6d	decode: support Cisco Fabric Path / DCE ... Cisco Fabric Path is ethernet wrapped in an ethernet like header with 2 extra bytes. The ethernet type is in the same location so the ethernet decoder can be used with some validation for the extra length.	9 years ago
Victor Julien	a8da6bbd71	output: use safer logic for fingerprint printing	9 years ago
Jason Ish	d3c0135eec	app-layer-tls: accomodate trailing \0 in hash output	9 years ago
Jason Ish	73a0451070	output-json-dns: allocate correct size hexstring buffer ... The buffer allocated for the hexstring was not large enough for a ':' separated hex string.	9 years ago
Victor Julien	b3b78d4326	detect: log earlier that rule reload is happening	9 years ago
Victor Julien	731d4a7049	dns: fix OOB read on malformed TXT record	9 years ago
Jason Ish	7e6ce01600	unified2: fix logging of tagged packets ... The structure for create the alert preceding each tagged packet was not being initialized, preventing tagged packets from being logged. Note: Snort unified2 does not precede tagged packets with an alert like is done here, so this just fixes what the code intended to do, it does not make it Snort unified2 compatible. Address issue: https://redmine.openinfosecfoundation.org/issues/1854	9 years ago
Victor Julien	26e67400ba	dns: fix name parsing issue leading to events	9 years ago
Victor Julien	884fddf035	packet: remove empty and unused UDPVars struct	9 years ago
Victor Julien	c9756caeef	packet: make tcp/udp/icmp vars union non-anonymous ... Clean the whole thing after use.	9 years ago
Victor Julien	79388df887	commandline: fix strlcpy usage	9 years ago
Jason Ish	2403af5177	pcap: don't fail with --pcap with no device present ... Issue: 1856. A device with the name of "" (empty string) was being added with LiveRegisterDevice which failed to initialize causing Suricata to fail.	9 years ago
Victor Julien	ec602089a0	Update Changelog for 3.1.1	9 years ago
Victor Julien	2856dfd119	output lua: improve debugging output	9 years ago
Victor Julien	a26e59cb6d	output lua: set proper logging progress values	9 years ago
Victor Julien	7188c2630f	outputs: small code cleanup	9 years ago