323 Commits (cfdd934aba2ccda93afa95345b97a9aeb0dd29f2)

Author	SHA1	Message	Date
Victor Julien	08d0fe0916	modbus detect: register inspect engine from keyword	9 years ago
Victor Julien	2db094ab7a	dns detect: register inspect engine from keyword	9 years ago
Victor Julien	c9bb762f64	tls_cert_issuer: register inspect engine from keyword	9 years ago
Victor Julien	e28e98bcaa	tls_cert_subject: register inspect engine from keyword	9 years ago
Victor Julien	a87c196b60	tls_sni: register inspect engine from keyword	9 years ago
Victor Julien	200a4c1593	http_stat_code: register inspect engine from keyword	9 years ago
Victor Julien	cd705752db	http_stat_msg: register inspect engine from keyword	9 years ago
Victor Julien	20e93ba419	file_data: register inspect engine from keyword	9 years ago
Victor Julien	0496b3f6a5	http_raw_host: register inspect engine from keyword	9 years ago
Victor Julien	a00629ab55	http_host: register inspect engine from keyword	9 years ago
Victor Julien	edb2936998	http_user_agent: register inspect engine from keyword	9 years ago
Victor Julien	fc857c5455	http_raw_uri: register inspect engine from keyword	9 years ago
Victor Julien	b1adea6eee	http_cookie: register inspect engine from keyword	9 years ago
Victor Julien	cd8b1b0b4c	http_method: register inspect engine from keyword	9 years ago
Victor Julien	b314829614	http_raw_header: register inspect engine from keyword	9 years ago
Victor Julien	eb19eb3fe4	http_header: register inspect engine from keyword	9 years ago
Victor Julien	4096f76b1b	http_client_body: register inspect engine from keyword	9 years ago
Victor Julien	b96c2c5db5	http_uri: register inspect engine from keyword	9 years ago
Victor Julien	cc96fedb90	http_response_line: register inspect engine from keyword	9 years ago
Victor Julien	0feeb8d538	http_request_line: register inspect engine from keyword	9 years ago
Victor Julien	5bde86b0e8	detect-engine: new registration call ... Make it more in line with MPM registration.	9 years ago
Victor Julien	5f994756e6	detect-engine: improved inspect engines ... Inspect engines are called per signature per sigmatch list. Most wrap around DetectEngineContentInspection, but it's more generic. Until now, the inspect engines were setup in a large per ipproto, per alproto, per direction table. For stateful inspection each engine needed a global flag. This approach had a number of issues: 1. inefficient: each inspection round walked the table and then checked if the inspect engine was even needed for the current rule. 2. clumsy registration with global flag registration. 3. global flag space was approaching the need for 64 bits 4. duplicate registration for alprotos supporting both TCP and TCP (DNS). This patch introduces a new approach. First, it does away with the per ipproto engines. This wasn't used. Second, it adds a per signature list of inspect engine containing only those engines that actually apply to the rule. Third, it gets rid of the global flags and replaces it with flags assigned per rule per engine.	9 years ago
Victor Julien	f1e3840516	http_response_body: implement keyword with mpm ... Implemented as 'stickybuffer'.	9 years ago
Victor Julien	4c98b6cef3	http_request_line: implement keyword and mpm ... Implemented as 'stickybuffer'. Move all logic into the keyword file and remove bad tests that tested URI instead of request line.	9 years ago
Victor Julien	5b2e36a1b0	mpm: add App Layer MPM registery ... Register keywords globally at start up. Create a map of the registery per detection engine. This we need because the sgh_mpm_context value is set per detect engine. Remove APP_MPMS_MAX.	9 years ago
Victor Julien	125603871b	detect: config opt to enable keyword prefilters	9 years ago
Victor Julien	17bc0299fe	detect: rename non_mpm lists/vars to non_pf ... Rename to non_pf: non prefilter.	9 years ago
Mats Klepsland	dc8e0b3cf2	detect: add detect engine for tls validity keywords ... Add detect engine for tls validity keywords (tls_cert_notbefore and tls_cert_notafter).	9 years ago
Mats Klepsland	d91664d67a	detect-dns: move DetectEngineInspectGenericList to detect-engine.c ... Move DetectEngineInspectGenericList from detect-engine-dns.c to detect-engine.c to enable it to be used other places as well.	9 years ago
Mats Klepsland	4172c4c8ac	tls: add (mpm) keyword tls_cert_subject ... This keyword is a replacement for tls.subject.	9 years ago
Mats Klepsland	9b2717799c	tls: add (mpm) keyword tls_cert_issuer ... This keyword is a replacement for tls.issuerdn.	9 years ago
Victor Julien	215d0d54c7	detect: optimize rule address parsing ... Many rules have the same address vars, so instead of parsing them each time use a hash to store the string and the parsed result. Rules now reference the stored result in the hash table.	9 years ago
Eric Leblond	f2d1e93e65	unix-socket: add auto mode ... When running in live mode, the new default 'auto' value of unix-command.enabled causes unix-command to be activated. This will allow users of live capture to benefit from the feature and result in no side effect for user running in offline capture.	9 years ago
Victor Julien	b3b78d4326	detect: log earlier that rule reload is happening	9 years ago
Victor Julien	a88359dcf0	detect: get proper legacy custom values. Issue #1804	9 years ago
Victor Julien	b3bf7a5729	output: introduce config and perf output levels ... Goal is to reduce info output	9 years ago
Victor Julien	72d3ea6552	detect: make pattern matcher messages less verbose	9 years ago
Victor Julien	36535cbc61	yaml: remove conf_filename global ... conf_filename was a global pointer to the filename of the yaml. Move into SCInstance. This reduces it's scope and cleans up the code.	9 years ago
Justin Viiret	d807bf4e8a	detect-engine: log MPM/SPM matchers being used	9 years ago
Justin Viiret	c9d0d6f698	mpm: add "auto" default for mpm-algo ... Setting mpm-algo to "auto" will use "hs" if Suricata was built against Hyperscan, and "ac" otherwise (or "ac-tile" on Tilera platforms).	9 years ago
Victor Julien	e43ce0a9ec	file: switch to streaming buffer API ... Make the file storage use the streaming buffer API. As the individual file chunks were not needed by themselves, this approach uses a chunkless implementation.	9 years ago
Victor Julien	46e55f1e34	http body handling: use streaming buffer API ... Convert HTTP body handling to use the Streaming Buffer API. This means the HtpBodyChunks no longer maintain their own data segments, but instead add their data to the StreamingBuffer instance in the HtpBody structure. In case the HtpBodyChunk needs to access it's data it can do so still through the Streaming Buffer API. Updates & simplifies the various users of the reassembled bodies: multipart parsing and the detection engine.	9 years ago
Victor Julien	52d500c670	flowworker: initial support ... Initial version of the 'FlowWorker' thread module. This module combines Flow handling, TCP handling, App layer handling and Detection in a single module. It does all flow related processing under a single flow lock.	9 years ago
Mats Klepsland	a13df67864	detect: add (mpm) keyword for tls_sni ... Match on server name indication (SNI) extension in TLS using tls_sni keyword, e.g: alert tls any any -> any any (msg:"SNI test"; tls_sni; content:"example.com"; sid:12345;)	9 years ago
Justin Viiret	cce2d114e8	spm: add and use new SPM API ... This new API allows for different SPM implementations, using a function pointer table like that used for MPM. This change also switches over the paths that make use of DetectContentData (which previously used BoyerMoore directly) to the new API.	9 years ago
Justin Viiret	ce408c4d10	spm: add SinglePatternMatchDefaultMatcher ... Allows selecting SPM algorithm with the 'spm-algo' value in the YAML config file.	9 years ago
maxtors	9d3fd82849	Removed duplicate include statements.	9 years ago
Jason Ish	796dd5223b	tests: no longer necessary to provide successful return code ... 1 pass, 0 is fail.	9 years ago
Victor Julien	d6ba01b1b7	detect: make port whitelisting configurable ... Make the port grouping whitelisting configurable. A whitelisted port ends up in it's own port group. detect: grouping: tcp-whitelist: 80, 443 udp-whitelist: 53, 5060 No portranges are allowed at this point.	10 years ago
Victor Julien	725d6c3739	yaml: convert detect-engine to just detect ... Instead of detect-engine which used a list for no good reason, use a simple map now. detect: profile: medium custom-values: toclient-groups: 3 toserver-groups: 25 sgh-mpm-context: auto inspection-recursion-limit: 3000 # If set to yes, the loading of signatures will be made after the capture # is started. This will limit the downtime in IPS mode. #delayed-detect: yes	10 years ago
Victor Julien	1dd135d512	mpm: always cleanup factory	10 years ago
Victor Julien	caea596ce5	profiling: output post-prefilter matches ... Dump a json record containing all sigs that need to be inspected after prefilter. Part of profiling. Only dump if threshold is met, which is currently set by: --set detect.profiling.inspect-logging-threshold=200 A file called packet_inspected_rules.json is created in the default log dir.	10 years ago
Victor Julien	722e2dbf7c	profiling: initial rulegroup tracking ... Per rule group tracking of checks, use of lists, mpm matches, post filter counts. Logs SGH id so it can be compared with the rule_group.json output. Implemented both in a human readable text format and a JSON format.	10 years ago
Victor Julien	c1ad08d11e	detect: remove stream pmq array	10 years ago
Victor Julien	a96fa0fc2f	detect: remove unused dport sgh hash	10 years ago
Victor Julien	fa885e1d85	mpm: remove pattern id logic	10 years ago
Victor Julien	fac2cc0560	detect: mpm deduplication ... Create hash for mpm's that we can reuse. Have packet/stream mpms use this.	10 years ago
Victor Julien	f0ba00e51d	detect: remove old unused code	10 years ago
Victor Julien	10b049304f	detect: set new defaults for grouping	10 years ago
Victor Julien	2ee9bf2aef	detect: rename groupings vars	10 years ago
Victor Julien	1f70ccfc23	detect: remove unused grouping settings	10 years ago
Victor Julien	14d9ce7b2e	detect/mpm: remove unused max_id param from API	10 years ago
Victor Julien	4f8e1f59a6	mpm: remove obsolete mpm algos ... Remove: ac-gfbs, wumanber, b2g, b3g.	10 years ago
Victor Julien	58e533858b	detect mpm: ac-tile/ac-ks default to single ... Use sgh-mpm-context single is it is set to 'auto' when ac-ks is used.	10 years ago
Victor Julien	ffb5498228	detect: fix potential deadlock during reload ... If interrupted during the BreakLoop stage during reload, a deadlock could happen.	10 years ago
Justin Viiret	13b87f5aff	mpm: add Hyperscan integration ... This adds an MPM implementation that uses the Hyperscan regex engine library from Intel, accessible as the "hs" mpm-algo.	10 years ago
Victor Julien	11099cfa42	detect reload: generic packet injection for capture ... Capture methods that are non blocking will still not generate packets that go through the system if there is no traffic. Some maintenance tasks, like rule reloads rely on packets to complete. This patch introduces a new thread flag, THV_CAPTURE_INJECT_PKT, that instructs the capture thread to create a fake packet. The capture implementations can call the TmThreadsCaptureInjectPacket utility function either with the packet they already got from the pool or without a packet. In this case the util func will get it's own packet. Implementations for pcap, AF_PACKET and PF_RING.	10 years ago
Victor Julien	eafd212661	detect reload: call 'breakloop' on capture method ... Split wait loop into three steps: - first insert pseudo packets - 2nd nudge all capture threads to break out of their loop - third, wait for the detection thread contexts to be used Interupt capture more than once if needed Move packet injection into util func	10 years ago
Victor Julien	8394b38941	cppcheck: work around snprintf warning ... Cppcheck 1.72 gives a warning on the following code pattern: char blah[32] = ""; snprintf(blah, sizeof(blah), "something"); The warning is: (error) Buffer is accessed out of bounds. While this appears to be a FP, in most cases the initialization to "" was unnecessary as the snprintf statement immediately follows the variable declaration.	10 years ago
Victor Julien	c91546022d	smtp: clean up thread local memory	10 years ago
Victor Julien	b9ee86fdb4	detect-engine: free memory in error conditions (CID 1351210)	10 years ago
Victor Julien	0dd81b85d4	multi-tenants: improve error handling (CID 1312702)	10 years ago
Victor Julien	4dfbc0effa	multi-detect: fix and simplify config ... instead mappings: - vlan: vlan-id: 1 tenant-id: 2 we'll now use: mappings: - vlan-id: 1 tenant-id: 2 For YAML it pretty much means the same thing. Ticket: 1517	10 years ago
Victor Julien	07d8617b3e	multi-detect: improve error handling	10 years ago
Victor Julien	906b95eed3	multi-detect: handle missing mappings ... Notify/warn user about missing mappings depending on other settings like unix socket and init errors fatal.	10 years ago
Victor Julien	27783f4c66	multi-detect: consider vlan tracking ... Refuse to use vlan selector if vlan tracking is disabled.	10 years ago
Victor Julien	04889f154d	multi-detect: validate vlan_id	10 years ago
Victor Julien	d7d76e7b27	multi-detect: use default tenant ... The default detect engine can be used as 'default tenant'.	10 years ago
Victor Julien	dc3c1ef01e	multi-detect: clean up output	10 years ago
Jason Ish	6b15686fd1	base64_decode, base64_data: decode and match base64	10 years ago
Eric Leblond	a4089873c7	rules-reload: fix reload with -s or -S ... When using the -S or -s option, the reload was causing the specified rules file to be forgotten and the default rules to be loaded at reload time.	10 years ago
Jason Ish	06beca62f5	app-layer: template for application layer content inspection	10 years ago
Victor Julien	979bd35277	detect loader: move to own file	10 years ago
Victor Julien	cfeaf42cab	detect-loaders: configurable amount of loaders	10 years ago
Victor Julien	99c0a7ad72	multi-detect: improve memory handling of setup code	10 years ago
Victor Julien	b7b27684c2	multi-detect: detect loader for unix socket ... Move the tenant load and reload commands to be executed by the detect loader thread(s). Limitation: no yaml parsing in parallel. The Conf API is currently not thread safe, so don't load the tenant config (yaml) in parallel.	10 years ago
Victor Julien	eb09118d64	detect: create loader threads ... To speed up startup with many tenants, tenant loading will be parallelized. As no tempary threads should be used for these memory allocation heavy tasks, this patch adds new type of 'command' thread that can be used to load and reload tenants. This patch hardcodes the number of loaders to 4. Future work will make it dynamic. The loader thread essentially sleeps constantly. When a tasks is sent to it, it will wake up and execute it.	10 years ago
Victor Julien	e19c41a807	multi-detect: hash lookup for tenants ... Use hash for storing and looking up det_ctxs.	10 years ago
Victor Julien	722c56dbf3	detect: clean up thread free code ... Introduce DetectEngineThreadCtxFree that doesn't need a 'ThreadVars' pointer.	10 years ago
Victor Julien	642c267dc4	multi-detect: refuse to add duplicate tenant ... Generate error if tentant to be added is already loaded.	10 years ago
Victor Julien	646eb4c2a8	multi-detect: load tenants from yaml file ... Load tenants and mappings from the suricata.yaml when available.	10 years ago
Victor Julien	216638c342	multi-detect: implement unregister-tenant-handler ... Remove a tenant handler from the list and apply it.	10 years ago
Victor Julien	b6f290fac7	multi-detect: set selector from yaml ... Yaml setting is: multi-detect.selector Implement 'vlan' and 'direct'.	10 years ago
Victor Julien	c72b7f83b8	multi-detect: error on start if no selector registered ... Force user to select the method at startup.	10 years ago
Victor Julien	1127ad66b4	multi-detect: register counters on 'master' det_ctx ... Otherwise counters are only registered after the stats api is already fixed.	10 years ago
Victor Julien	7c581c0ffc	multi-detect: allow start up with 0 tenants	10 years ago
Victor Julien	6d92e8d220	unix-socket: implement register-tenant-handler ... Register tenant handlers/selectors based on what the unix command "register-tenant-handler" tells. Check traffic id before adding it. No duplicated registrations for a traffic id are allowed.	10 years ago
Victor Julien	1893c5edb1	multi-detect: initial selectors for tenants ... The Detection Thread has the TenantGetId pointer which allows it to select a tenant id based on the packet.	10 years ago
Victor Julien	0ff6d3dcfd	detect: select detect engine at Detect entry ... Limited to Pcap only currently.	10 years ago
Victor Julien	98d265f40b	detect: use multi tenant thread init if MT enabled	10 years ago