aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
7,286 Commits
7 Branches
161 Tags
179 MiB
main-7.0.x
master
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'bac37fc9ae'
${ noResults }
Commit Graph

6627 Commits (bac37fc9ae5e3469652fda2ef268de617de485dd)

Author SHA1 Message Date
Victor Julien aee1f0bb99 flow: simplify timeout logic 
Instead of a single big FlowProto array containing timeouts separately
for normal and emergency cases, plus the 'Free' pointer for the
protoctx, split up these arrays.

An array made of FlowProtoTimeout for just the normal timeouts and an
mirror of that for emergency timeouts are used through a pointer that
will be set at init and by swapped by the emergency logic. It's swapped
back when the emergency is over.

The free funcs are moved to their own array.

This simplifies the timeout lookup code and shrinks the data that is
commonly used.
 9 years ago
Victor Julien 96427cf371 flow: remove dead code 9 years ago
Victor Julien da8f3c987b offloading: make disabling offloading configurable 
Add a generic 'capture' section to the YAML:

  # general settings affecting packet capture
  capture:
    # disable NIC offloading. It's restored when Suricata exists.
    # Enabled by default
    #disable-offloading: false
    #
    # disable checksum validation. Same as setting '-k none' on the
    # commandline
    #checksum-validation: none
 9 years ago
Victor Julien 5e3b61cc65 offloading: reduce verbosity to 'perf' 9 years ago
Victor Julien 2b2984dae9 offloading: implement restoring settings for BSD 9 years ago
Victor Julien 499e27de14 offloading: restore settings on exit 9 years ago
Victor Julien 9d48720f9a af-packet: optionally disable offloading 9 years ago
Victor Julien 98092f63b5 offloading: Linux ethtool offloading support 9 years ago
Victor Julien bc370606fc pcap: optionally disable offloading 9 years ago
Victor Julien 723a14c0fe netmap: optionally disable offloading 9 years ago
Victor Julien 2780fba1d1 device: add global flag for disabling offloading 
Add global flag to disable offloading or just warn on it.
 9 years ago
Victor Julien 7004987670 offloading: preparation for disabling offload on BSD 
Add functions for setting IFCAP flags.
 9 years ago
Jason Ish 30c853a304 detect-ssl-state: use new unit test macros 9 years ago
Jason Ish 487cdda93d ssl: issue 1231 - support ssl state negation 
Snort compatible SSL state negation. Adds "," as a state
separator, but keeps "|" for compatibility with existing
Suricata rules.
 9 years ago
Jason Ish afc796a099 ssl: store current state separately from cumulative state 
The ssl_state keyword needs the current state, not the cumulative state
in order be compatible with Snort's implementation.
 9 years ago
Jason Ish 7ce196e3bf detect-pcre: use new unit test macros 9 years ago
Jason Ish 4cdcada397 pcre: fix missing quote in pcre unit test 9 years ago
Victor Julien f7481c4078 file-hashing: restore 'force-md5' 
We don't want to break existing setups.

Do issue a warning that a new option is available.
 9 years ago
Victor Julien 4426f3ff55 file: introduce common flags handling function 9 years ago
Victor Julien 2f5663dfe9 common: introduce BIT_U16 9 years ago
Duarte Silva 53ebe4c538 file-hashing: added configuration options and common parsing code 9 years ago
Duarte Silva 89eb935f73 file-hashing: added support for SHA-256 file hashing 9 years ago
Duarte Silva a6d928e269 file-hashing: added support for SHA-1 file hashing 9 years ago
Duarte Silva 188b382c46 file-hashing: common code added 
Moved and adapted code from detect-filemd5 to util-detect-file-hash,
generalised code to work with SHA-1 and SHA-256 and added necessary
flags and other constants.
 9 years ago
Mats Klepsland f1b550d973 tls: add unit tests for tls_cert_issuer 9 years ago
Mats Klepsland 20b41567d9 tls: add unit tests for tls_cert_subject 9 years ago
Mats Klepsland 4172c4c8ac tls: add (mpm) keyword tls_cert_subject 
This keyword is a replacement for tls.subject.
 9 years ago
Mats Klepsland 9b2717799c tls: add (mpm) keyword tls_cert_issuer 
This keyword is a replacement for tls.issuerdn.
 9 years ago
Victor Julien f1117ba2dc iponly: fix unittests 9 years ago
Victor Julien 215d0d54c7 detect: optimize rule address parsing 
Many rules have the same address vars, so instead of parsing them
each time use a hash to store the string and the parsed result.

Rules now reference the stored result in the hash table.
 9 years ago
Tom DeCanio 04faf1a93a util-decode-mime: remove quote from boundary= string. 
remove quote from the end of the boundary= string.  This was throwing off
the mime parser so that it wouldn't always catch mime boundaries causing
things like missed attachments.
 9 years ago
Eric Leblond f2d1e93e65 unix-socket: add auto mode 
When running in live mode, the new default 'auto' value of
unix-command.enabled causes unix-command to be activated. This
will allow users of live capture to benefit from the feature and
result in no side effect for user running in offline capture.
 9 years ago
Eric Leblond f6c3845397 util-time: new function to know if live or offline 9 years ago
Andreas Herz 7d54d8c590 rule-reload: remember pending USR2 signals 
We did ignore additional USR2 signals while a rule-reload was running.
This changes the counter to be incremented with every additional USR2
signal so we don't ignore them anymore but it's still limited to prevent
huge overload or even overflow.
 9 years ago
Jason Ish b454aa46c6 defrag: use frag_pkt_too_large instead of frag_too_large 
The rules were using the wrong decoder event type, which was
only set in the unlikely event of a complete overlap, which
really had nothing to do with being too large.

Remove FRAG_TOO_LARGE as its no longer being used, an overlap
event is already set in the case where this event would be set.
 9 years ago
Victor Julien 00313b2140 decoder-event: BUG_ON on table mismatches 
Abort when the event enum and the name<>event table are not matching.
 9 years ago
Jason Ish 108d37a52d logging: proper failure on memory allocation error 
unwinds all previous logger allocations
 9 years ago
Jason Ish a1de7e6dae flow-vars: remove flow locks 
Code is now entered under flow lock.
 9 years ago
Jason Ish 5a783e6854 flow-bits: remove flow locks 
Code is now entered under flow lock.
 9 years ago
Jason Ish 8865009fca lua: remove flow locking from the lua layer 9 years ago
Jason Ish 688e8dbe7f stream: remove lock from StreamTcpSegmentForEach 
This is only entered from logging functions which are already
called with a locked flow.
 9 years ago
Jason Ish 55f2704a25 logging: remove the packetqueue's from the logging path 
They are not referenced by any loggers, and they probably
shouldn't be either.
 9 years ago
Jason Ish 00b6e628d1 logging: hook into flow worker thread 9 years ago
Jason Ish f8c2c3653b output-streaming: free thread store on deinit 9 years ago
Jason Ish 1b4ba4496c logging: rename registration functions to not have tmm 
As the logging modules are no longer threading modules, rename
them so they don't look like they are being registered as
threading modules.

Also, move the registration to the output.c which will handle
registration of the loggers.
 9 years ago
Jason Ish 04a44a077d logging: convert pcap log to non-thread module 9 years ago
Jason Ish a093580527 logging: just return if no tx loggers 9 years ago
Jason Ish fc35a78ba1 logging: use a single entry point for all loggers 
Introduces a new thread module, TMM_LOGGER, which is the
root most logger.

Only handles loggers in the packet path, stats and flow
logging are not included.

The loggers are made up of a hierarchy of loggers. At the top we
have the root logger which is the main entry point to
logging. Under the root there exists parent loggers that are the
entry point for specific types of loggers such as packet logger,
transaction loggers, etc. Each parent logger may have 0 or more
loggers that actual handle the job of producing output to something
like a file.
 9 years ago
Jason Ish d2c17ce9a0 logging: remove output priorities: not used 9 years ago
Jason Ish 9489d5b9e3 logging: remove dead code from output-json 
The "parent" json logger was setup like a real logger, but
some of that code was never being called.
 9 years ago
Jason Ish 8b38b9d728 output.[ch]: consistent style 
- Clean up function declaration.
- Consistenly use typedefs for function points.

No functional changes.
 9 years ago
Jason Ish fa27a76462 logging: add profiling back for non-tmm loggers 
The loggers moved away from a TMM required a new
profiling support.
 9 years ago
Jason Ish 42b8f30272 logging: convert lua output to non-thread module 9 years ago
Jason Ish 7a0737b9a9 logging: convert tls log to non-thread module 9 years ago
Jason Ish 7cb16bc90d logging: convert alert debug log to non-thread module 9 years ago
Jason Ish 7a8e8343e5 logging: convert tcp data logging to non-thread module 9 years ago
Jason Ish 4d8b8ca046 logging: convert tls store logging to non-thread module 9 years ago
Jason Ish 60b6ccc3c4 logging: convert file data logging to non-thread module 9 years ago
Jason Ish f9bb9029c5 logging: convert file logging to non-thread module 9 years ago
Jason Ish 669827ae16 logging: convert unified2 to non-thread module 9 years ago
Jason Ish b580016c80 logging: convert stats loggers to non-thread module 9 years ago
Jason Ish 9475c83713 logging: convert http log to non-thread module 9 years ago
Jason Ish e00dcd52a0 logging: convert alert syslog to non-thread module 9 years ago
Jason Ish 869d2eb701 logging: convert drop output to non-thread module 9 years ago
Jason Ish 5bbb4fd134 logging: convert json template output to non-thread module 9 years ago
Jason Ish b605984f34 tests: setup unit test framework earlier 
Allows tests to be registered early, in support of moving
outputs away from thread modules.
 9 years ago
Jason Ish bac65f09e8 logging: convert json drop output to non-thread module 9 years ago
Jason Ish 38354479b7 logging: convert json smtp output to non-thread module 9 years ago
Jason Ish 3fea12d7b3 logging: convert json ssh output to non-thread module 9 years ago
Jason Ish 01cc508257 logging: convert json netflow output to non-thread module 9 years ago
Jason Ish 983a619ff0 logging: convert json flow output to non-thread module 9 years ago
Jason Ish ad15ac8297 logging: convert json alert output to non-thread module 9 years ago
Jason Ish aaa65f3d16 logging: convert json tls output to non-thread module 9 years ago
Jason Ish 31663f1627 logging: convert prelude output to non-thread module 9 years ago
Jason Ish dedda33f01 logging: convert eve http to non-thread module 9 years ago
Jason Ish 687602c0ca logging: convert eve dns logging to non-thread module 9 years ago
Jason Ish b1200dba54 logging: convert fast log to a non-thread module 9 years ago
Jason Ish 637aa34610 logging: convert dns log to a non-thread module 9 years ago
Victor Julien 99dce740ef detect: mark alproto in keyword reg deprecated 
No existing code uses it, and it had been useless for some time.
 9 years ago
Victor Julien 9030e89c94 detect: don't set alproto while registering keyword 
The field is not used except for some printing, and is wrong for
many keywords.
 9 years ago
Victor Julien c957c62824 detect file: enable HTTP inspection from validate func 9 years ago
Victor Julien 621860f5b2 detect file: enforce protocol in single place 
Instead of trying to enforce the app layer protocol in each file
function, enforce it in the generic validation function.
 9 years ago
Victor Julien bcfa484bce app-layer: add function to check if app-layer supports files 9 years ago
Victor Julien 85db260eed threads: remove EngineKill & SURICATA_KILL 
EngineStop and EngineKill were effectively doing the same, so
removed the kill variant.
 9 years ago
Victor Julien 045c10db43 threads: failed thread is a fatal error now 9 years ago
Victor Julien fb655d5f15 threading: remove thread restart logic 
Thread restarts never worked well and the rest of the engine was
never really expecting errors to lead to thread restarts. Either
and error is recoverable in the thread, or not at all.

So this patch removes the functionality completely.
 9 years ago
Victor Julien 54503ef310 Open Suricata 3.2 development branch 9 years ago
Victor Julien 471b61a0e1 magic: fix broken tests after CentOS6 update 9 years ago
Victor Julien 82282a9e68 mpls: add missing event type + rule 9 years ago
Victor Julien 71c8d1f46c bpf: fix file parsing memory handling 
Fix improper fread string handling. Improve error handling.

Skip trailing spaces for slightly more pretty printing.

Coverity CID 400763.

Thanks to Steve Grubb for helping address this issue.
 9 years ago
Victor Julien 519b2970ec detect: don't print (null) in --list-keywords=all 9 years ago
Eric Leblond ed90a16e89 detect: fix setup for some keywords 
Fix problems found by siginit.cocci.
 9 years ago
Jason Ish 17e70483c5 detect-flowbits: more unittest macro usage 
Also cleanup some tests by removing extra code after a test was
determined to fail.
 9 years ago
Jason Ish 3c5d8e65d4 hostbits: use new unittest macros 9 years ago
Jason Ish c4945607e3 hostbits: fail parse on unexpected trailing data 
Address issue https://redmine.openinfosecfoundation.org/issues/1889
for hostbits. This involves updating the regular expresssion
to capture any trailing data as the regex already keeps
spaces out of the name.

A unit test was converted to new macros to find out which
line it was failing at after updating regex.
 9 years ago
Jason Ish 24f2387b23 flowbits: validate that there are no spaces in the name 
Fixes issue: https://redmine.openinfosecfoundation.org/issues/1889

To catch the issue where the ';' is missing we have to expand the
regex to capture the whole name string, not just the leading
valid stuff. Then verify that there are no spaces in the name
(Snort has the same restriction) and fail if there is.
 9 years ago
Eric Leblond 1cdd062dc6 unix-manager: fix output of version command 
Make it consistent with the output of version command line flag.
 9 years ago
Andreas Herz 65fd09a399 rule-parsing: reject unescaped double quote within content section 9 years ago
Victor Julien 2997d086be eve-drop: allow logging all drops 
- drop:
    alerts: yes      # log alerts that caused drops
    flows: all       # start or all: 'start' logs only a single drop
                     # per flow direction. All logs each dropped pkt.
 9 years ago
Victor Julien 1cc5f9825d dns: use nonnull attr for log functions 9 years ago
Victor Julien bbcc22d2ad dns: fix coverity warning 
** CID 1372324:  Null pointer dereferences  (FORWARD_NULL)
/src/output-json-dns.c: 532 in OutputAnswer()

________________________________________________________________________________________________________
*** CID 1372324:  Null pointer dereferences  (FORWARD_NULL)
/src/output-json-dns.c: 532 in OutputAnswer()
526             }
527         }
528
529         /* reset */
530         MemBufferReset(aft->buffer);
531         json_object_set_new(djs, "dns", js);
>>>     CID 1372324:  Null pointer dereferences  (FORWARD_NULL)
>>>     Dereferencing null pointer "entry".
532         if (likely(DNSRRTypeEnabled(entry->type, aft->dnslog_ctx->flags))) {
533             OutputJSONBuffer(djs, aft->dnslog_ctx->file_ctx, &aft->buffer);
534         }
535         json_object_del(djs, "dns");
536
537         return;

Move checks to the top of the functions. Should be more efficient too.
 9 years ago
Victor Julien b4565004c7 detect-template: modernize 9 years ago
Jason Ish e878dd2231 app-layer templates: cleanups 
- cleanup file headers
- add todo section
- convert unit tests to new macros
- add markers to remove disabled by default behaviour
 9 years ago
Jason Ish 3cf8b4629f decode-icmpv6: use FAIL macros in tests 9 years ago
Jason Ish 2a42e8be03 unittest: FAIL macro to unconditionally fail a test 9 years ago
Jason Ish af4085b77b icmpv6: fix checksum verification if fcs present 
Calculate the length of the ICMPv6 packet from decoded information
instead of off the wire length. This will provide the correct
length if trailing data like an FCS is present.

Fixes issue:
https://redmine.openinfosecfoundation.org/issues/1849
 9 years ago
Victor Julien 120f59386b affinity: fix compilation on SunOS 9 years ago
Victor Julien a2c9b86cdf byteswap: fix compilation on SunOS 9 years ago
Victor Julien ef1acdfaee threads: provide SCGetThreadIdLong for SunOS 9 years ago
Victor Julien 4271d57157 decode: declare IPPROTO_IPIP if OS doesn't have it 9 years ago
Victor Julien 6956c1c749 decode: fix int types 9 years ago
Victor Julien ec87123339 configure: check for strings.h: used by SunOS 9 years ago
Victor Julien 8600872e02 logfile: resolve name clash on SunOS 9 years ago
Victor Julien b81ea0d7db eve: reduce flow_id to 51 bits 
Evebox & ELK couldn't handle the large integers. It looks like (partly)
a javascript limitation that doesn't treat 64bit ints as real ints.
 9 years ago
Victor Julien 9ca34fa5c9 eve: output more unique flow_id 9 years ago
Victor Julien 78b4db8a95 flow: introduce function to generate flow id 
The flow id itself is not stored in the flow, but generated based on
properties that do not change during the lifetime of the flow.

As it's meant for use with the json output, it is limited to a signed
64 bit integer (int64_t) because that is the time json_integer_t uses.
 9 years ago
Victor Julien 666bba8121 detect: implement continue detect for dcepayload 
Also fix a corner case in start detection.

Bug 1853.
 9 years ago
Victor Julien ecf4a2862c detect: cleanup 9 years ago
Victor Julien 6b078e4f51 detect: fix ICMP error handling issue 
The first packet in both directions of a flow looks up the rule group
(sgh) and stores it in the flow. This makes sure the lookup doesn't
have to be performed for each packet.

ICMPv4 error messages are connected to the TCP or UDP flow they apply
to. In the case of such an ICMP error being the first packet in a
flow's direction, this would lead to an issue.

The packet would look up the rule group based on the ICMP protocol,
not based on the embedded TCP/UDP. This makes sense, as the ICMP
packet is inspected as ICMP packet. The consequence however, was that
this rule group pointer (sgh) would be stored in the flow. This is
wrong, as TCP/UDP packets that follow the ICMP packet would have no sgh
or the wrong sgh.

In normal traffic this shouldn't normally happen, but it could be
used to evade Suricata's inspection.
 9 years ago
Victor Julien 2eb941f9d9 output dns: fix bit declarations 9 years ago
Victor Julien 5c6ffe5653 common: introduce macro for bit declarations 9 years ago
Tom DeCanio 0f6c8806a0 output-json-dns: dns output filtering. 9 years ago
Jason Ish 1691c10681 eve: make logging of tagged packets optional 
But it is enabled in the default configuration.
 9 years ago
Jason Ish 040660556e eve: log tag packets as packet events 
Create a new eve event type, "packet" for logging packets that
are tagged as part of an event. The packet is still at the top
level to keep it consistent with alert event types.

In addition to the packet being logged, a packet_info object
is created to hold the linktype and any future meta data
we may want to add about the packet.
 9 years ago
Victor Julien 305b1b90fd detect: minor cleanup 9 years ago
Victor Julien ec0217f52c detect: minor style fixes 9 years ago
Victor Julien 7d11af16ef detect: minor debug output cleanup 9 years ago
Victor Julien 0e2ea4e63b detect: remove unused debug code 9 years ago
Victor Julien b79d9cda3a detect: minor cleanups 9 years ago
Victor Julien 199bb3bae3 stream-tcp: fix ssn returning to wrong thread pool 9 years ago
Jason Ish cf61472619 app-layer-dcerpc-udp: style cleanups 
- consistent 4 space indent
- cleanup file header
 9 years ago
Jason Ish e55334fb37 detect-flowbits: fix misleading indentation 
detect-flowbits.c: In function ‘FlowBitsTestSig02’:
detect-flowbits.c:475:4: warning: this ‘if’ clause does not guard... [-Wmisleading-indentation]
    if(error_count == 5)
    ^~
detect-flowbits.c:478:5: note: ...this statement, but the latter is misleadingly indented as if it is guarded by the ‘if’
     SigGroupBuild(de_ctx);
     ^~~~~~~~~~~~~
 9 years ago
Jason Ish a975fdcfeb app-layer-dcerpc-udp: fix missleading indentation 
app-layer-dcerpc-udp.c: In function ‘DCERPCUDPParserTest01’:
app-layer-dcerpc-udp.c:1105:5: warning: this ‘if’ clause does not guard... [-Wmisleading-indentation]
     if (alp_tctx != NULL)
     ^~
app-layer-dcerpc-udp.c:1107:2: note: ...this statement, but the latter is misleadingly indented as if it is guarded by the ‘if’
  StreamTcpFreeConfig(TRUE);
  ^~~~~~~~~~~~~~~~~~~
 9 years ago
Jason Ish 95015a3f6d decode: support Cisco Fabric Path / DCE 
Cisco Fabric Path is ethernet wrapped in an ethernet like header
with 2 extra bytes.  The ethernet type is in the same location
so the ethernet decoder can be used with some validation
for the extra length.
 9 years ago
Victor Julien a8da6bbd71 output: use safer logic for fingerprint printing 9 years ago
Jason Ish d3c0135eec app-layer-tls: accomodate trailing \0 in hash output 9 years ago
Jason Ish 73a0451070 output-json-dns: allocate correct size hexstring buffer 
The buffer allocated for the hexstring was not large enough
for a ':' separated hex string.
 9 years ago
Victor Julien b3b78d4326 detect: log earlier that rule reload is happening 9 years ago
Victor Julien 731d4a7049 dns: fix OOB read on malformed TXT record 9 years ago
Jason Ish 7e6ce01600 unified2: fix logging of tagged packets 
The structure for create the alert preceding each tagged packet
was not being initialized, preventing tagged packets from being
logged.

Note: Snort unified2 does not precede tagged packets with an
alert like is done here, so this just fixes what the code
intended to do, it does not make it Snort unified2
compatible.

Address issue:
https://redmine.openinfosecfoundation.org/issues/1854
 9 years ago
Victor Julien 26e67400ba dns: fix name parsing issue leading to events 9 years ago
Victor Julien 884fddf035 packet: remove empty and unused UDPVars struct 9 years ago
Victor Julien c9756caeef packet: make tcp/udp/icmp vars union non-anonymous 
Clean the whole thing after use.
 9 years ago
Victor Julien 79388df887 commandline: fix strlcpy usage 9 years ago
Jason Ish 2403af5177 pcap: don't fail with --pcap with no device present 
Issue: 1856.

A device with the name of "" (empty string) was being added
with LiveRegisterDevice which failed to initialize causing
Suricata to fail.
 9 years ago
Victor Julien 2856dfd119 output lua: improve debugging output 9 years ago
Victor Julien a26e59cb6d output lua: set proper logging progress values 9 years ago
Victor Julien 7188c2630f outputs: small code cleanup 9 years ago
Jason Ish f397e7bfc2 dns: directional logging 
Register loggers for to server and to client so requests
and responses can be logged independently of each other.

This results in the request log having the actual timestamp of
the request instead of the reply.
 9 years ago
Jason Ish fcad270d96 logging: setup all registered loggers for a name 
When setting up a configured logger, do so for all registered
loggers of that name instead of just the first registered one.

This allows a logger to register itself more than once, which
can allow for independent logging of requests and replies without
touching the core transaction handling logic.

We do this so just having "dns" in the eve-log can configured
multiple "dns" loggers instead of having something like "dns-tc"
and "dns-ts" in the configuration file.
 9 years ago
Victor Julien 9d01ef58fc lua smtp: fix SMTPGetMimeField arg checking 
Properly check argument before passing it on: CID 1363385: (NULL_RETURNS)
 9 years ago
Victor Julien 2b10b8374c cmdline: fix --list-keywords and --list-app-layer-protos 
Ticket #1840
 9 years ago
Victor Julien ed483b4e13 output: don't register loggers for disabled protocols 9 years ago
Victor Julien 01913f6a56 app-layer: add AppLayerParserIsTxAware 
This function globally checks if the protocol is registered and
enabled by testing for the per alproto callback:
StateGetProgressCompletionStatus

This check is to be used before enabling Tx-aware code, like loggers.
 9 years ago
Victor Julien f302a6cf86 output: fix debug messages 9 years ago
Victor Julien b73098e990 smb: style fix in log message 9 years ago
Victor Julien 3bb408940f af-packet: improve threads selection logic 
Only use RSS queue count when cluster_qm is used. Only use core count
when cluster_flow is used.

Use a local variable to simplify the check so that we don't have to deal
with the extra flags.
 9 years ago
Victor Julien da8f9c1896 lua: add smtp for detection 9 years ago
Victor Julien 928cb1eba9 lua output: expose smtp functions to output scripts 9 years ago
Victor Julien 7501bf744f lua: SMTPGetRcptList use position as key, not value 9 years ago
tobiass1 7581f5129f Lua: SMTP support; Addresses feature ticket #1775; v5 9 years ago
Victor Julien ff3baeee90 lua: support smtp tx logging 9 years ago
Victor Julien 5e4d071b76 lua-output: don't crash on script setup error 9 years ago
Victor Julien 3c59d60049 cuda: make sure we don't use cuda in proto detect 9 years ago
Victor Julien 4111331ab0 af-packet: minor cleanups 9 years ago
Victor Julien 402bdf9b2b af-packet: test if fanout is supported before use 
Older system may pretend they can support FANOUT but then fail to
work at runtime. CentOS6 is an example of this. It would fail to
start up with the default configuration with errors like:

[15770] 21/6/2016 -- 16:00:13 - (tm-threads.c:2168) <Notice> (TmThreadWaitOnThreadInit) -- all 4 packet processing threads, 4 management threads initialized, engine started.
[15785] 21/6/2016 -- 16:00:13 - (source-af-packet.c:1907) <Error> (AFPCreateSocket) -- [ERRCODE: SC_ERR_AFP_CREATE(190)] - Coudn't set fanout mode, error Protocol not available
[15785] 21/6/2016 -- 16:00:13 - (source-af-packet.c:1337) <Error> (ReceiveAFPLoop) -- [ERRCODE: SC_ERR_AFP_CREATE(190)] - Couldn't init AF_PACKET socket, fatal error
[15770] 21/6/2016 -- 16:00:13 - (suricata.c:2664) <Notice> (main) -- Signal Received.  Stopping engine.
[15787] 21/6/2016 -- 16:00:13 - (source-af-packet.c:1907) <Error> (AFPCreateSocket) -- [ERRCODE: SC_ERR_AFP_CREATE(190)] - Coudn't set fanout mode, error Protocol not available
[15788] 21/6/2016 -- 16:00:13 - (source-af-packet.c:1907) <Error> (AFPCreateSocket) -- [ERRCODE: SC_ERR_AFP_CREATE(190)] - Coudn't set fanout mode, error Protocol not available
[15786] 21/6/2016 -- 16:00:13 - (source-af-packet.c:1907) <Error> (AFPCreateSocket) -- [ERRCODE: SC_ERR_AFP_CREATE(190)] - Coudn't set fanout mode, error Protocol not available
[15789] 21/6/2016 -- 16:00:13 - (flow-manager.c:693) <Perf> (FlowManager) -- 0 new flows, 0 established flows were timed out, 0 flows in closed state
[15787] 21/6/2016 -- 16:00:13 - (source-af-packet.c:1337) <Error> (ReceiveAFPLoop) -- [ERRCODE: SC_ERR_AFP_CREATE(190)] - Couldn't init AF_PACKET socket, fatal error
[15788] 21/6/2016 -- 16:00:13 - (source-af-packet.c:1337) <Error> (ReceiveAFPLoop) -- [ERRCODE: SC_ERR_AFP_CREATE(190)] - Couldn't init AF_PACKET socket, fatal error
[15786] 21/6/2016 -- 16:00:13 - (source-af-packet.c:1337) <Error> (ReceiveAFPLoop) -- [ERRCODE: SC_ERR_AFP_CREATE(190)] - Couldn't init AF_PACKET socket, fatal error

This patch adds a test that if run before the number of threads
is determined. If the test fails, only 1 thread is created.
 9 years ago
Victor Julien ab65b6f83b netmap: fix coverity warning 1362789 
** CID 1362789:  Null pointer dereferences  (FORWARD_NULL)
/src/runmode-netmap.c: 247 in ParseNetmapConfig()

________________________________________________________________________________________________________
*** CID 1362789:  Null pointer dereferences  (FORWARD_NULL)
/src/runmode-netmap.c: 247 in ParseNetmapConfig()
241         strlcpy(aconf->iface_name, iface_name, sizeof(aconf->iface_name));
242         SC_ATOMIC_INIT(aconf->ref);
243         (void) SC_ATOMIC_ADD(aconf->ref, 1);
244
245         /* Find initial node */
246         netmap_node = ConfGetNode("netmap");
>>>     CID 1362789:  Null pointer dereferences  (FORWARD_NULL)
>>>     Comparing "netmap_node" to null implies that "netmap_node" might be null.
247         if (netmap_node == NULL) {
248             SCLogInfo("Unable to find netmap config using default value");
249         } else {
250             if_root = ConfFindDeviceConfig(netmap_node, aconf->iface_name);
251             if_default = ConfFindDeviceConfig(netmap_node, "default");
252         }
 9 years ago
Andreas Herz e9a2a341ce util-threshold-config: parse suppress rules with spaces in ip list 
This modified regex allows spaces witihn the ip list for supress rules
like [10.0.0.1, 10.0.0.2]
 9 years ago
Jason Ish f0e22c91cb privs: add capability CAP_SYS_NICE. 
Allows the setting of thread priorities after dropping privileges.
 9 years ago
Victor Julien 6045420812 detect: reduce verbosity, don't warn on empty files 9 years ago
Victor Julien 46ac5ed7b7 pfring: move output to 'Perf' level 9 years ago
Victor Julien 18de4c9654 offloading: work around missing TOE support 9 years ago
Victor Julien 9b80c21d78 offloading: distinguish between csum and the rest 
As AF_PACKET handles csum offloading don't check for this type of
offloading. Other methods like pcap and netmap do require it to be
turned off.

Improve disable command suggestion wording.
 9 years ago
Victor Julien 03d46f1369 offloading: reduce verbosity 9 years ago
Victor Julien 507027845d afpacket: update offloading warning 9 years ago
Victor Julien 45fa25eb0c offloading: improve checks on FreeBSD 
Move FreeBSD specific (but not netmap specific) checks from the netmap
code to the general ioctl wrapper code.

Warn from the check functions now, so callers no longer need to.
 9 years ago
Victor Julien 33f8769001 offloading: move linux specific into their own func 9 years ago
Victor Julien 54bc471810 offloading: check for more offloading on Linux 9 years ago
Victor Julien b1d191b478 netmap: fix enabling promisc mode on FreeBSD 
In FreeBSD setting the IFF_PROMISC flag has no effect. Instead we
need to set the IFF_PPROMISC flag.
 9 years ago
Victor Julien 6c7bf006b7 netmap: redo config parsing 
Normally we parse the config per interface only. But to properly
setup the bridge, netmap also needs the config of it's peering
interface. Instead of using a complicated peering scheme like in
afpacket, simply parse the peers config too.
 9 years ago
Andreas Herz d0baa83d2b util-runmode: pass initdata to runmode workers for nfqueue 
The VerdictNFQ was missing the initdata which results in a segfault
within CaptureStatsSetup. This commit adds the passing of the initdata.
 9 years ago
Victor Julien f7124b1149 afpacket: disable tpacket-v3 by default 
It's still considered experimental at this point.
 9 years ago
Victor Julien 66346e4632 libnet: work around older libnet type difference 
Older libnet 1.1.x have a non-const type for libnet_init's dev
argument.
 9 years ago
Victor Julien a88359dcf0 detect: get proper legacy custom values. Issue #1804 9 years ago
Victor Julien 5c974f92a8 livedev: shorten devname at registration 9 years ago
Victor Julien b673e14411 afl: fix various --afl-* options 9 years ago
Victor Julien e76b334f8d http body: fix compression tests 9 years ago
Victor Julien 5ec885e451 http: set of response body decompress limit 
This is a per personality setting.
 9 years ago
Victor Julien ed7dc0c6b3 unittest: minor cleanup 9 years ago
Victor Julien b313f8ca7b http: update compression mismatch test 9 years ago
Andreas Herz 36e4126227 detect-filemagic: fix heap-use-after-free 
This fixes the heap-use-after-free issue with sm being freed without
being removed from the signature (s) list. Move the protocol check for
rules with filemagic before the alloc and make the error log more
precise.
 9 years ago
Victor Julien a309598721 netmap: work around mtu error on iface+ settings 9 years ago
Victor Julien 648a69759b netmap: don't set more than 1 thread on sw ring 9 years ago
Victor Julien 86d44cea96 netmap: code cleanup 9 years ago
Victor Julien b5633b9bfd affinity: small cleanups to output & code 9 years ago
Victor Julien 5f9de1e734 affinity: rename detect -> worker set internall 9 years ago
Victor Julien 723e90a174 affinity: rename detect-cpu-set to worker-cpu-set 
Add fallback for existing configs.
 9 years ago
Victor Julien 570b9d06e0 affinity: remove unused settings 
These were never referenced to in the code so they can be removed.

Add bypass to config parser in case the settings are still in old
yamls.
 9 years ago
Victor Julien bdc2c6e9ce affinity: type cleanup 9 years ago
Victor Julien 2aac437927 output: reduce verbosity on info level 9 years ago