3187 Commits (f204b52e10e01a0ed0a8edabb82ffdc3aa835b14)

 

All Branches   

Search

Author	SHA1	Message	Date
Xavier Lange	fea5e68a7b	Include conf_test in special cases for unset RUNMODE	13 years ago
Xavier Lange	1d774dae61	Make conf_test local. Simplify if/else to if.	13 years ago
Xavier Lange	1ae10b9a42	Do not spawn threads for conf test	13 years ago
Xavier Lange	eaacc5d0fe	Added conf_test flag and behavior	13 years ago
Victor Julien	22349f863b	file magic: don't disable inspecting magic for both directions if files in only one direction don't need magic.	13 years ago
Victor Julien	ba4613aef1	Add host section to stock yaml.	13 years ago
Victor Julien	f4b542d703	Enforce memcap limit before allocating hash table in host and flow engines.	13 years ago
Victor Julien	bd66a4bba9	Fix typo in spm prototype declaration.	13 years ago
Anoop Saldanha	4d192a6881	update all spm algos to use 16 bit pattern lengths. Should compress a lot of tables	13 years ago
Victor Julien	8d1fe9f2fa	Make 'autofp' the default runmode. Increase default max-pending-packets to 1024. Move some advanced and uncommonly changed settings down in the stock suricata.yaml. Closes #433.	13 years ago
Eileen Donlon	da633d490b	fix misleading comment	13 years ago
Eileen Donlon	793478a832	reject rules with invalid hex digits in content	13 years ago
Eileen Donlon	f2e85ab9ee	reject rules with an invalid ttl range	13 years ago
Victor Julien	4157d9408d	Various small flow and host table fixes.	13 years ago
Victor Julien	aded3c5578	http: 'HTTP Host header ambiguous' after libhtp update. It now fires if hostname is present both in URL and Host header and the 2 are not equal.	13 years ago
Victor Julien	ef52ba8f57	libhtp: update to sync with upstream 0.2.x ... Patches applied are: commit 85f5bbc39dda2eaf03ccb6111cbf5daf1c7b75f9 Author: Craig Forbes <cforbes@qualys.com> Date: Wed Mar 21 16:45:04 2012 +0000 Backport of STREAM_STATE_TUNNEL fix to 0.2.x. Return STREAM_STATE_TUNNEL after entering a tunnel. commit cfbe28cd4ddde6d77c5b0d5935c8717834971441 Author: Craig Forbes <cforbes@qualys.com> Date: Wed Feb 29 16:52:44 2012 +0000 Backport of the fix for HTP_AMBIGUOUS_HOST flag. The flag is only set when the URI host on the request line is different than the value in the Host: request header. Resolves https://github.com/ironbee/libhtp/issues/20 commit 196dfb1c8b7a5996389c719e2c912163c5607916 Author: Brian Rectanus <brectanus@qualys.com> Date: Wed Feb 8 08:35:46 2012 -0600 Add missing function declaration in header. commit 7878fec818167fcdf7c8c4852ac0dafa1ae445f1 Author: Brian Rectanus <brectanus@qualys.com> Date: Wed Feb 8 08:35:07 2012 -0600 Revert part of previous patch, which was invalid. commit bafef3d4cbfc307960677c6bd682ae195fe986cd Author: Brian Rectanus <brectanus@qualys.com> Date: Wed Feb 8 08:36:06 2012 -0600 Update version to next dev release. commit 62cfdb41ba84f2666c7526e2e5d9e10ab8e220f1 Author: William Metcalf <wmetcalf@qualys.com> Date: Wed Feb 1 13:19:48 2012 -0600 Many thanks to Will, Brian and Craig.	13 years ago
Victor Julien	18e81b7ba9	Bail out early if we're in http tunnel mode.	13 years ago
Victor Julien	0788656ef7	Silence ac-gfbs debug message.	13 years ago
Victor Julien	da3c5bf84d	Minor error message cleanups	13 years ago
Victor Julien	fa22a26366	profiling: fix lock profiling int print issue.	13 years ago
Victor Julien	3b79dac2b7	flow: fix atomic var not being initialized and destroyed.	13 years ago
Victor Julien	60dbd34f93	Fix bug in app layer event handling causing http event rules to fail loading.	13 years ago
Victor Julien	40ed10ab38	Minor flowq updates.	13 years ago
Anoop Saldanha	7115fa3e72	Introduce the address hash based flow q handler	13 years ago
Anoop Saldanha	5ffb050ada	Adapt flow tmqh counters to be atomic vars. Remove support for active flows q handler. Introduce SC_ATOMIC_SET	13 years ago
Anoop Saldanha	3faed5fe79	Support freeing flow q handler out ctx. Adapt unittests to use the same	13 years ago
Anoop Saldanha	d01589c9d8	neaten flow q handler code	13 years ago
Anoop Saldanha	0fa14292c0	Enable unittests for flow q handler	13 years ago
Anoop Saldanha	4e417b72b5	support flow q handler schedulers active_flows and active_packets. Support new yaml option autofp_scheduler. Support for printing q handler stats as well	13 years ago
Anoop Saldanha	e252048900	support for custom flow qhandlers - round robin support added	13 years ago
Pierre Chifflier	d866f38982	TLS: add variable to store the error code in the decoder ... Use a variable to store the decoding error code if required, and remove the calls to SCLogInfo and SCLogDebug.	13 years ago
Pierre Chifflier	218b5d3ba0	TLS app layer: misc fixes, reorder some fields to same memory	13 years ago
Pierre Chifflier	3df341dbeb	Add TLS decode events	13 years ago
Pierre Chifflier	71fa4a5285	TLS: replace SigMatchAppendAppLayer with SigMatchAppendSMToList	13 years ago
Eric Leblond	a9bb17e097	tls-handshake: add sanity checks.	13 years ago
Eric Leblond	01c7e5bde6	tls-handshake: Add some missing free in error handling. ... When DecodeAsn1BuildValue function fails, it may be necessary to do some clean-up in the calling functions.	13 years ago
Eric Leblond	480db00fd7	tls-handshake: DecodeAsn1BuildValue should return -1 for error ... This patch modifies DecodeAsn1BuildValue to have it return -1 when there is a too big number of bytes announced in the ASN.1 message.	13 years ago
Eric Leblond	8f885ce810	TLS parser: add sanity checks on loop ... It was possible in some loop to read data placed after the buffer resulting in invalid/unpredictable value. This patch fixes two of this issues.	13 years ago
Eric Leblond	d1c56e810b	TLS parser: add sanity check	13 years ago
Eric Leblond	cb1a75fc9e	TLS parser: modify OCTETSTRING ... This patch does on over allocation of 1 for the OCTETSTRING to be able to add a 0 at the end. This will then allow us to use the string in printf.	13 years ago
Pierre Chifflier	5a65a17f00	TLS parser: add handing of UTF8STRING ... Some certificate contains UTF8STRING which is a subset of OCTETSTRING. This patch adds support for this type of string.	13 years ago
Pierre Chifflier	6c2c6cffac	TLS keywords: fix match regex (remove extra space)	13 years ago
Pierre Chifflier	8457ce3b11	TLS app layer: rewrite decoder to handle multiple messages in records ... Since we now parse the content of the TLS messages, we need to handle the case multiple messages are shipped in a single TLS record, and taking care of the multiple levels of fragmentation (message, record, and TCP). Additionally, fix a bug where the parser state was not reset after an empty record.	13 years ago
Pierre Chifflier	4bb5e2a79d	TLS app layer: fix number of bytes processed on SERVER_CERTIFICATE message. ... Change the function to return the number of bytes processed, and fix a bug where the input buffer was wrong. Signed-off-by: Pierre Chifflier <pierre.chifflier@ssi.gouv.fr>	13 years ago
Eric Leblond	38c213cb84	tls app layer: add missing free ... issuerdn was not freed at exit.	13 years ago
Eric Leblond	fce2437dc2	tls app layer: handle negation on subject and issuerdn. ... This patch adds negation support for tls.subject and tls.issuerdn matches.	13 years ago
Eric Leblond	ad0e05a112	TLS app layer: Add tls.issuerdn keyword.	13 years ago
Eric Leblond	afba81bb27	decode ASN.1: Factorize value reading ... This patch factorizes the reading of integer value and fix some indentation. By convention, a value of 0xffffffff is returned if the size of the integer is too big. In this case, the hexadecimal value (which is also read) must be used.	13 years ago
Pierre Chifflier	53e5421a24	TLS handshake: get TLS ciphersuite and compression ... Decode the SERVER_HELLO message to extract the ciphersuite and compression chosen by the server. Signed-off-by: Pierre Chifflier <pierre.chifflier@ssi.gouv.fr>	13 years ago
Pierre Chifflier	4be65fd016	TLS handshake: decode the SERVER_CERTIFICATE message ... Add a decoder for the SERVER_CERTIFICATE during a TLS handshake, extracts the certificates and keep the subject name. Add the tls.subject keyword for substring match in rules (TLS layer). Signed-off-by: Pierre Chifflier <pierre.chifflier@ssi.gouv.fr>	13 years ago