9619 Commits (bde65467a91accf637a60c2f71b5c93ba7f8a56c)

 

All Branches   

Search

Author	SHA1	Message	Date
Pascal Delalande	bde65467a9	doc: add ssh protocol in eve log section	6 years ago
Alexander Bluhm	0ea3fa92a8	Avoid use-after-free during pid file cleanup. ... In case the pid file is given in the config file, the file name is stored in volatile memory. Removal of the pid file happens after cleanup of config memory. Create a copy of the name which will be freed after the pid file has been removed.	6 years ago
jason taylor	b98c28a60d	configure.ac: update lzma check and misc doc ... * the lzma check during configure wasn't properly displaying the additional information on how to install if --enable-lzma was passed but lzma devel files were not present * updated additional information blocks to include distribution package names * minor formatting updates to add quotes around variables Signed-off-by: jason taylor <jtfas90@gmail.com>	6 years ago
Giuseppe Longo	c63fea8d0a	reputation: remove dead code ... This removes some code commented long time ago.	6 years ago
Giuseppe Longo	6b2a5ef21e	reputation: declare max value as constant	6 years ago
Victor Julien	f7a41412d6	smb1: fix NT create andx records filename parsing ... Use file name parsing routines that take unicode into account and consider padding bytes as well.	6 years ago
Wesley van der Ree	cc50908f8d	smb: fix NT create filename parsing ... parse_smb_create_andx_request_record skipped 1 byte too much before the filename. Fixes: #2894	6 years ago
Victor Julien	2622006faa	stream: minor test cleanups	6 years ago
Victor Julien	636fb8d387	mpm: track maxdepth ... Track max depth setting per MpmCtx. To make sure the data structure doesn't increase in size change global bool to use a flags field.	6 years ago
Victor Julien	55e5d50496	detect/flow: optimize flow check ... Flow direction doesn't need explicit checking as the rule groups (sgh) are already per direction. So if a rule sets only flow:to_server or flow:to_client, we can avoid adding a sigmatch to the signature.	6 years ago
Victor Julien	119db92c99	detect/tag: minor code cleanup	6 years ago
Victor Julien	6bf35a42f1	detect/mark: use postmatch instead of tag list ... Keep the tag list for just tags. Post match list is better so the keyword also works with pass and noalert rules.	6 years ago
Victor Julien	4dbf600d64	detect/mark: minor code cleanups	6 years ago
Victor Julien	bd31e4e332	detect: packet match micro optimization	6 years ago
Victor Julien	7497c633c4	detect/filestore: use postmatch callback	6 years ago
Victor Julien	065c3379ed	detect/replace: implement post-match ... Implement replace executor as a post match callback so that it is only considered if there actually is a replace keyword in use.	6 years ago
Victor Julien	00beeef031	eve/flow/netflow: log correct tulpe on reversed flows	6 years ago
Victor Julien	9c241fa32c	stream: use flow/packet swap logic for SYN/ACK midstream	6 years ago
Victor Julien	2f1ace64c6	flow: on timeout, consider reverse flows for pseudo packets	6 years ago
Victor Julien	4d6e6b8270	flow: introduce flow swap support	6 years ago
Victor Julien	0225ab3828	common: introduce flags and var swapping macros	6 years ago
Victor Julien	d307cfad05	packet: add 'swap' function to reverse direction	6 years ago
Victor Julien	d5baac3f85	detect/flow: don't require flow for direction options ... Flow isn't directly used for direction checks, so don't require a flow to be present.	6 years ago
Victor Julien	c1dcc26965	detect/parse: improve direction setting on sigs ... Only set both directions if no direction has been explicitly set before.	6 years ago
Victor Julien	9a14cb252d	detect/bytetest: debug cleanup	6 years ago
Victor Julien	cb9b27ab89	app-layer/pd: free memory	6 years ago
Victor Julien	39725907d6	detect: remove BUG_ON from packet path	6 years ago
Victor Julien	042f806362	detect: fix match array reset ... Fix match array reset depending on prefilter matches for the current run. If there were none, the match array of the previous packet was used. This could lead to inspection of rules from the wrong rule group.	6 years ago
Victor Julien	05d9527d01	app-layer/profile: fix udp protocol detection profiling	6 years ago
Victor Julien	f44bbd71f5	app-layer/udp: micro optimization	6 years ago
Jeff Lucovsky	6123d77527	Fix memory leak with TOS handling ... Use `pcre_copy_substring` to avoid memory allocations when parsing TOS values.	6 years ago
jason taylor	1f3dd85216	pfring: update bpf error handling to be consistent ... * updated bpf error handling to be consistent with af-packet * minor internal doc updates Signed-off-by: jason taylor <jtfas90@gmail.com>	6 years ago
Giuseppe Longo	d0e2420faf	reputation: move unit tests ... UTs are moved inside "test/" directory, and reworked to improve readability and reduce lines of code.	6 years ago
Giuseppe Longo	389227d899	detect-iprep: fix memory leaks ... Loading rules with iprep keyword cause memory leaks due to missing frees. Direct leak of 8 byte(s) in 4 object(s) allocated from: #0 0x7f81c862bd28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28) #1 0x7f81c6afea69 in pcre_get_substring (/lib/x86_64-linux-gnu/libpcre.so.3+0x27a69) #2 0x43206f7420676e68 (<unknown module>) SUMMARY: AddressSanitizer: 8 byte(s) leaked in 4 allocation(s).	6 years ago
Eric Leblond	58b804f7d2	flow-bypass: set thread name to FB	6 years ago
Eric Leblond	abe2836caf	suricata.yaml: fix name of encryption-handling var	6 years ago
Jason Ish	a69afd5cf9	autoconf/python: check for distutils ... Require distutils to install the Python tools. Update the logic to only install suricatactl (and suricatasc) if Python and distutils are found. Suricata-Update will only be installed if bundled, and python-distutils and python-yaml are found.	6 years ago
Jason Ish	a228986caa	autoconf: prefer python 3 over python 2 ... When looking for Python, prefer "python3" over "python2" and "python". Also add information about the Python path and version to the ./configure summary. Redmine issue: https://redmine.openinfosecfoundation.org/issues/2808	6 years ago
Victor Julien	69d0d484eb	af-packet: don't use anonymous unions	6 years ago
Victor Julien	acd9e1c2e7	af-packet: fix v3 code using v2 union member	6 years ago
Victor Julien	96c6cf98d5	doc/userguide: add 3rd-party-integration to dist	6 years ago
Pierre Chifflier	f90733fe3f	rust/ikev2: fix events not being raised in first message ... The `set_event` function requires that the transaction is already inserted, or the event set is silently lost. When parsing first IKEv2 message, first insert transaction, prepare values, and borrow back inserted transaction to update it.	6 years ago
Pierre Chifflier	27b0775d27	rules: fix event names for ikev2 (weak authentication and DH parameters)	6 years ago
Jason Ish	db2ceb46dc	travis: call make check in qa/coccinelle ... Was being skipped due to the way the tests are called on travis to prevent Travis from failing on too much output.	6 years ago
Jason Ish	fff927fa4a	travis/macos: use xcode 8.3 build image ... Travis retired the xcode 8.1 image and has already been routing this build to the xcode 8.3 image.	6 years ago
Jason Ish	08fb4d790e	travis-ci/macos: install PyYAML and jq for verify	6 years ago
Jason Ish	9d86e9c54a	travis: cache rust toolchain	6 years ago
Jason Ish	e9d1e37f3d	travis-ci: run suricata-verify on each build	6 years ago
Victor Julien	f1c83c3308	doc/userguide: new 3rd party section, add bluecoat ... Add Symantec SSLV (bluecoat) doc to new 3rd party section for documenting integrating Suricata with 3rd party tools.	6 years ago
Bryant Smith	398133b6ce	doc: add byte_* documentation to the userguide ... Added byte_test, byte_jump and byte_extract description and example rules	6 years ago