168 Commits (d0ebe04c8b376b1c6ff537023a480a4ea2619ef6)

Author	SHA1	Message	Date
Travis Green	72c9debbd6	yaml: disable rules by default ... Change to "disable by default" rulefiles	9 years ago
Tom DeCanio	559747e325	file-store: add force-filestore configuration option to enable writing all ... extracted files to filesystem.	9 years ago
Andreas Herz	5cee70f9ae	Fix the comment and explanation for random-chunk-size	9 years ago
Andreas Herz	15c98c6085	file-magic: improve libmagic handling on *nix systems	9 years ago
Victor Julien	fae2836039	http: more sane body inspection/tracking defaults	9 years ago
Victor Julien	b4dad91e26	unified2: disable by default	9 years ago
Victor Julien	36fde7df42	stats log: suppress 0 counters by default	9 years ago
Jason Ish	d87a60f3cc	modbus: disable by default	9 years ago
Victor Julien	c1bf0e1b07	rule profiling: json output	9 years ago
Eric Leblond	affb399cd9	config: don't use hardcoded path ... It is better to use a transformation to define the default directory of output message instead of using an hardcoded value. Same apply to the directory for the pid file.	9 years ago
Eric Leblond	b834e2d19a	util-logopenfile: implement redis pipelining ... This patch implements redis pipelining. This consist in contacting the redis server every N events to minimize the number of TCP exchange. This is optional and setup via the configuration file.	10 years ago
Eric Leblond	60ea49c777	output-json: add sensor-name config variable ... When using redis output, we are loosing the host key (added by logstash or logstash-forwarder) and we can't find anymore what Suricata did cause the alert. This patch is adding this key during message generation using the 'sensor-name' variable or the hostname is 'sensor-name' is not defined.	10 years ago
Eric Leblond	eef5678e5e	output-json: add redis support ... This patch adds redis support to JSON output.	10 years ago
Alessandro Guido	dcbbda505f	Describe new unified2-alert "payload" option	10 years ago
Eric Leblond	f03a7a032f	json-alert: add smtp elements in alert	10 years ago
Eric Leblond	946f2a6acc	email-json: add bcc to extended fields	10 years ago
Eric Leblond	8fd88f543d	yaml: add comment describing smtp extended	10 years ago
Eric Leblond	f81f353d1f	email-json: add 'date' field extraction	10 years ago
Eric Leblond	d1b0a5aa6d	yaml: document new MIME features	10 years ago
Victor Julien	7281ae6e80	yaml: add missing ippair section	10 years ago
Eric Leblond	3054af7900	af-packet: don't activate rollover by default ... Rollover option is causing issue with TCP streaming code because packets from the same flow to be treated out of order. As long as the situation is not fixed in the streaming engine, it is a bad idea to enable it by default.	10 years ago
gureedo	a7a902a071	netmap: extended comments for options in configuration file. ... Added extended description of the use of OS endpoint with copy mode.	10 years ago
Eric Leblond	8fde842f97	af-packet: implement rollover option ... This patch implements the rollover option in af_packet capture. This should heavily minimize the packet drops as well as the maximum bandwidth treated for a single flow. The option has been deactivated by default but it is activated in the af_packet default section. This ensure there is no change for old users using an existing YAML. And new users will benefit from the change. This option is available since Linux 3.10. An analysis of af_packet kernel code shows that setting the flag in all cases should not cause any trouble for older kernel.	10 years ago
Eric Leblond	dc306f3bad	af-packet: implement new load balancing modes ... This patch implements the fanout load balancing modes available in kernel 4.0. The more interesting is cluster_qm that does the load balancing based on the RSS queues. So if the network card is doing a flow based load balancing then a given socket will receive all packets of a flow indepently of the CPU affinity.	10 years ago
Aleksey Katargin	caa2438b98	netmap: support SW rings ... Netmap uses SW rings to send and receive packets from OS.	10 years ago
Eric Leblond	4db0a35f25	tls-store: now a separate module ... An design error was made when doing the TLS storage module which has been made dependant of the TLS logging. At the time there was only one TLS logging module but there is now two different ones. By putting the TLS store module in a separate module, we can now use EVE output and TLS store at the same time.	10 years ago
Victor Julien	f43767ba44	config: update yaml to show json logging option	10 years ago
Giuseppe Longo	a459376d2e	app-layer-htp: add http_body_inline setting	10 years ago
Jason Ish	e3ce29f694	json-stats: log deltas ... If "deltas" is yes, log delta values as the name of the value suffixed with _delta.	10 years ago
Zachary Rasmor	0edf28a4f8	Add Feature #1454. Generic eve-log prefix support.	10 years ago
Victor Julien	3fab736539	log-stats: make global/threads logging configurable	10 years ago
Victor Julien	2c9a2c8327	stats: support per thread stats in json output ... Default is only to output totals. Optionally per thread can be added. Both can be enabled together.	10 years ago
Tom DeCanio	117eed0385	eve-log: add JSON stats logging ... Support for counters in stats.log in eve output JSON stream.	10 years ago
Eric Leblond	7d73db9b80	suricata.yaml: fix the name of EVE module ... It is netflow and not newflow.	10 years ago
Giuseppe Longo	26ba647d58	filedata: read inspected tracker settings from suricata.yaml	10 years ago
Eric Leblond	bd0041470f	rules: add app layer events rules ... Some application layer events are defined but the corresponding rules were not available in the rules directory.	10 years ago
Eric Leblond	9fb82390ab	suricata.yaml: add missing mpm-algo	10 years ago
Victor Julien	0704ece4d7	detect-reload: enable unconditionally ... Reloading is available unconditionally now.	10 years ago
Victor Julien	2e754ca6fa	drop json: make alerts logging optional ... Make logging out alerts that caused the drop optional.	10 years ago
Eric Leblond	881f32cc02	json-alert: add SSH fields in alert logging	10 years ago
Eric Leblond	180faece7c	json-alert: log tls info in alert ... This patch adds the capabilities to log the TLS information the same way it is currently possible to do with HTTP. As it is quite hard to read ASN.1 directly in the stream, this will help people to understand why suricata is firing on alert relative to TLS.	10 years ago
gureedo	10104066e1	netmap support	10 years ago
Victor Julien	9327b08ab1	tcp: add stream.reassembly.zero-copy-size option ... The option sets in bytes the value at which segment data is passed to the app layer API directly. Data sizes equal to and higher than the value set are passed on directly. Default is 128.	10 years ago
Ken Steele	5008d0a58b	Remove the b2gm and b2gc MPMs ... These MPMs have code that looks like it won't work and updating them to for the new MPM optimization wasn't working.	10 years ago
Duarte Silva	496200dd08	Prepared everything for the proxy deployment configuration ... - Added the suricata.yaml configurations and updated the comments - Renamed the field in the configuration structure to something generic - Added two new constants and the warning codes	10 years ago
Duarte Silva	4e04cd2d1b	Adding XFF support to EVE alert output ... - Created app-layer-htp-xff.c and app-layer-htp-xff.h - Added entries in the Makefile.am - Added the necessary configuration options to EVE alert section - Updated Unified2 XFF configuration comments and removed unnecessary whitespace - Created a generic function to parse the configuration - Release the flow locks sooner and remove debug logging - Added XFF support to EVE alert output	10 years ago
DIALLO David	bacbe113d0	Add a warning in Modbus section of YAML file to remind user to modify stream depth (unlimited)	10 years ago
Victor Julien	c174c9d779	af-packet: threads: auto, default to workers ... Add a new default value for the 'threads:' setting in af-packet: "auto". This will create as many capture threads as there are cores. Default runmode of af-packet to workers.	10 years ago
Victor Julien	a95c95f74c	stats: introduce global config ... As the stats api calls the loggers at a global interval, the global interval should be configured globally. # global stats configuration stats: enabled: yes # The interval field (in seconds) controls at what interval # the loggers are invoked. interval: 8 If this config isn't found, the old config will be supported.	10 years ago
DIALLO David	5a0409959f	App-layer: Add Modbus protocol parser ... Decode Modbus request and response messages, and extracts MODBUS Application Protocol header and the code function. In case of read/write function, extracts message contents (read/write address, quantity, count, data to write). Links request and response messages in a transaction according to Transaction Identifier (transaction management based on DNS source code). MODBUS Messaging on TCP/IP Implementation Guide V1.0b (http://www.modbus.org/docs/Modbus_Messaging_Implementation_Guide_V1_0b.pdf) MODBUS Application Protocol Specification V1.1b3 (http://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b3.pdf) Based on DNS source code. Signed-off-by: David DIALLO <diallo@et.esia.fr>	10 years ago