7072 Commits (c961da2dceefd6a82168eadabdcfc624ea8d799a)

Author	SHA1	Message	Date
Victor Julien	c961da2dce	detect: clean up test	10 years ago
Victor Julien	3626ecb474	bytejump: don't print errors when matching ... When bytejump was told to convert some payload data to int from a string it would print an error to the screen if the conversion failed. This is unwanted as the payload is controlled by an attacker and printing is expensive.	10 years ago
Victor Julien	15d26f14e1	file-store: fix force store	10 years ago
Victor Julien	dbbf185173	app-layer: fix gap handling in protocol detection ... A GAP during protocol detection would lead to all reassembly getting disabled, so also the raw reassembly. In addition, it could prevent the opposing side from doing protocol detection. This patch remove the 'disable reassembly' logic. Stream engine will take the stream with GAP and app-layer will make the proto detection as complete.	10 years ago
Victor Julien	f1e19b5dd4	file store: store multiple files if available	10 years ago
Victor Julien	7c0a3b5582	app-layer: fix memleak on bad traffic ... If state was alloc'd after protocol detection, but then the direction turned out to be wrong, the state would not be freed.	10 years ago
Victor Julien	132e0e21f0	ippair: fix xbits unset memleak	10 years ago
Victor Julien	4c597bb9e1	ippair: use both addresses in hash	10 years ago
Victor Julien	1de1413863	stream: validate SACK right edge to be in window	10 years ago
Victor Julien	daf39b422b	stream: remove unused stream config member	10 years ago
Victor Julien	7512949670	stream: make data pointer in StreamSegmentCallback const	10 years ago
Victor Julien	2a5b9eb5fa	stream: remove unused variable	10 years ago
Victor Julien	a86b7b7042	app-layer: minor debug improvement	10 years ago
Jason Ish	6585ac4a9f	logging: remove unused print stats callbacks ... Remove the ThreadExitPrintStats callback from logging modules that weren't doing anything with it.	10 years ago
Jason Ish	0c3f1e2974	logging: move lock into write function ... All loggers were wrapping just the write in a lock with some updating a counter. This moves the lock into the write function. The log_ctx alerts counter was also removed as many modules have stopped using this and the alert count is available elsewhere. Should satisfy Coverity CID 1400798: CID 1400798 (#1 of 1): Data race condition (MISSING_LOCK) 2. missing_lock: Accessing log_ctx->rotation_flag without holding lock LogFileCtx_.fp_mutex. Elsewhere, "LogFileCtx_.rotation_flag" is accessed with LogFileCtx_.fp_mutex held 4 out of 5 times. Which appears to be a false positive as all calls to SCLogFileWrite were done under lock, but this will make it more explicit.	10 years ago
Jason Ish	ddf1bf6518	unified2: unlock using same dereference as lock ... Addresses Coverity CIDs: 1400797 1400796 Note that the mutex was actually being unlocked, but from a different variable pointing to the same mutex.	10 years ago
Mats Klepsland	d6508e640a	detect: add (mpm) keyword tls_cert_serial ... Match on TLS certificate serial number using tls_cert_serial keyword, e.g.: alert tls any any -> any any (msg:"TLS cert serial test"; tls_cert_serial; content:"5C:19:B7:B1:32:3B:1C:A1"; sid:12345;)	10 years ago
Mats Klepsland	95864375f2	lua: add function to print certificate serial number ... Add function LuaGetCertSerial to print serial number from TLS certificate. Example: function log (args) serial = TlsGetCertSerial() if serial then file:write(serial .. "\n"); file:flush() end end	10 years ago
Mats Klepsland	2e339aa791	tls-log: log certificate serial number	10 years ago
Mats Klepsland	2b460b8d06	output-json-lua: log certificate serial number	10 years ago
Mats Klepsland	2c1a36dd6e	app-layer-tls: decode certificate serial number	10 years ago
Alexander Gozman	310b27a196	af-packet: fix parsing packet in TPACKET_V3 mode ... AFPParsePacketV3() saved tpacket_block_desc structure instead of tpacket3_hdr. As a result, reconstructed packets were wrong. Bug #2044.	10 years ago
Alexander Gozman	e41a9d637b	af-packet: get VLAN info for packets in TPACKET_V3 mode	10 years ago
Alexander Gozman	ee7e689b54	af-packet: write VLAN info for both TPACKET_V2 and V3	10 years ago
Jason Ish	92db12c349	pidfile: fail if the pid file exists ... Changes the pidfile check function to fail just on the existence of the file to address issue https://redmine.openinfosecfoundation.org/issues/1335 but log a message if the pid file appears to be stale.	10 years ago
Mats Klepsland	bbd32c1419	output-json-tls: code cleanup	10 years ago
Mats Klepsland	115b3138cc	output-json-tls: log certificate and chain ... Log entire certificate and certificate chain Base64 encoded.	10 years ago
Mats Klepsland	0716199acb	output-json-tls: custom tls logging	10 years ago
Jason Ish	82f6103149	unified2: nostamp and file rotation ... Give unified2 a nostamp option which will create the file without the timestamp suffix (like Snort's nostamp option). Also register for rotation notification on SIGHUP so the file will be recreated if it is removed by an external rotation program (only when nostamp is used).	10 years ago
Jason Ish	2c01985e73	autoconf - look for stdbool.h	10 years ago
Jason Ish	d8e9e1fd77	unified2: minor cleanups ... - remove unused arguments and make static	10 years ago
Mats Klepsland	234a3a890b	output-json-alert: print 'tunnel' JSON object if tunnel ... Log src_ip, dst_ip and proto for root packet (p->root) if the packet that triggered is inside a tunnel, as JSON object 'tunnel'. Also log recursion depth to indicate the depth of the tunnel.	10 years ago
Mats Klepsland	7293286f2f	output-json: move code to get 5-tuple to own function ... Move code to get 5-tuple in JSON object to own function 'JsonFiveTuple'. This enables this code to be reused when printing 'parent' JSON object in output-json-alert.	10 years ago
Mats Klepsland	8c8db1cf0f	output-json-alert: fix wrongful comments	10 years ago
Mats Klepsland	65317ba865	output-json: make JSON flags in eve-log user configurable	10 years ago
Victor Julien	d445b4b5fa	dce: remove commented out code	10 years ago
Victor Julien	9da7be81f0	flow-worker: clean up thread init	10 years ago
Victor Julien	c859d39f4f	coverity: suppress CID 1400648	10 years ago
Victor Julien	955c227127	detect-ssh: cleanup duplicate code	10 years ago
Victor Julien	2f30adb08a	detect-lua: setup cleanup, fixing a potential int issue	10 years ago
Victor Julien	511e804915	detect: fix missing unlock in error path	10 years ago
Victor Julien	f74eff9eac	threads: address sleep under lock issue	10 years ago
Victor Julien	f380871057	threads: don't sleep under lock	10 years ago
Victor Julien	cc4010343d	detect: add and use util func for alproto sets	10 years ago
Victor Julien	4a49260897	flowvar: shrink flowvar type by using padded space	10 years ago
Victor Julien	99517cbd53	lua: support key/value flowvars in lua	10 years ago
Victor Julien	f0af133c5f	flowvar: remove unused DETECT_VAR_TYPE_ALWAYS	10 years ago
Victor Julien	88888c3d8b	unix-socket: add/list/remove hostbit commands ... add-hostbit adds a named hostbit with an expire time in seconds. remove-hostbit removes hostbit by name. add-hostbit, remove-hostbit return success or failure. list-hostbit returns a json array of hostbits with their name and expire time: { "message": { "count": 1, "hostbits": [{ "expire": 3222, "name": "firefox-users" }] }, "return": "OK" }	10 years ago
Victor Julien	b6e4276792	hostbits: add list API	10 years ago
Victor Julien	996112edf5	pktvars: same name pktvars, key-value vars	10 years ago