aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
7,115 Commits
8 Branches
173 Tags
211 MiB
main-8.0.x
main
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'f27e85e346'
${ noResults }
Commit Graph

60 Commits (f27e85e346dfa2c8a2c7b46f872827b282672bb7)

Author SHA1 Message Date
Jason Ish 00b6e628d1 logging: hook into flow worker thread 10 years ago
Jason Ish 1b4ba4496c logging: rename registration functions to not have tmm 
As the logging modules are no longer threading modules, rename
them so they don't look like they are being registered as
threading modules.

Also, move the registration to the output.c which will handle
registration of the loggers.
 10 years ago
Jason Ish fa27a76462 logging: add profiling back for non-tmm loggers 
The loggers moved away from a TMM required a new
profiling support.
 10 years ago
Jason Ish ad15ac8297 logging: convert json alert output to non-thread module 10 years ago
Jason Ish b1200dba54 logging: convert fast log to a non-thread module 10 years ago
Jason Ish 1691c10681 eve: make logging of tagged packets optional 
But it is enabled in the default configuration.
 10 years ago
Jason Ish 040660556e eve: log tag packets as packet events 
Create a new eve event type, "packet" for logging packets that
are tagged as part of an event. The packet is still at the top
level to keep it consistent with alert event types.

In addition to the packet being logged, a packet_info object
is created to hold the linktype and any future meta data
we may want to add about the packet.
 10 years ago
maxtors 9d3fd82849 Removed duplicate include statements. 11 years ago
maxtors 69863f7b1c Corrected and unified debugmessages for init data errors in *ThreadInit. 11 years ago
maxtors 7f2f7cc48d Added parsing and utilization of yaml defined payload buffer value. 11 years ago
Tom DeCanio 4db3a0f0b4 output-json-alert: fix segfault when alerts separated out from eve-log. 11 years ago
Victor Julien c446abeb47 jansson: include in suricata-common.h 11 years ago
Victor Julien 8bb1cf08ef eve: fix mishandling of big messages 
When the string representation of a JSON message grew bigger than
64k, the JSON record would just be truncated. This lead to errors
in the parser(s) of the JSON stream.

This patch changes the buffer logic to grow the buffer on demand.
 11 years ago
Victor Julien 6152d1abca eve: fix stream payload logging wrong direction 
In the EVE stream payload logging the IPS path logged the wrong dir.
Both IDS and IPS can take the same path as the detection engine
inspects in the same direction in both cases, so the alert is also
generated in the same direction.

Bug #1684
 11 years ago
Andreas Herz 8bd9f3d072 json: fix missing includes in disable unix socket case 11 years ago
Eric Leblond 6f04988ba1 output-json: add tx_id to events 
This patch updates alert, stmp and http JSON logging to have a
tx_id in the root of the JSON log message.
 11 years ago
Eric Leblond 96412e8921 json-email: JsonEmailAddMetadata update 
Add tx_id to the list of params to be in sync with recent changes.
 11 years ago
Eric Leblond bf6b0145e2 json-http: gen metadata function with tx_id param 11 years ago
Eric Leblond d9b602fc0f json-smtp: add tx_id param to metadata generation 
In all metadata generation contexts we know the tx_id so we better
used it to log the correct transaction and not an other one.
 11 years ago
Eric Leblond f03a7a032f json-alert: add smtp elements in alert 11 years ago
Eric Leblond 4ef12dcf5d alert-json: use new JsonHttpAddMetadata function 
This patch uses the newly introduced function to handle the logging
of HTTP data.
 11 years ago
Victor Julien 8673801ea3 multi-detect: add tenant id to alert json output 
Add a integer field "tenant_id" to the JSON alert output.
 11 years ago
Victor Julien 3aa58f25ad eve alert: fix stream payload printing 11 years ago
Jason Ish b512580bbe logging: integrate rotation into SCConfLogOpenGeneric. 
Addresses issue 1492, and will make it harder to omit
rotation on new outputs.
 11 years ago
Eric Leblond 39d667ff56 output-json: fix type of data parameter 
The cast of data to AlertJsonThread was not correct as the real
type of the void pointer is a OutputJsonCtx. This was working by
luck because they both have a file_ctx as first element.
 11 years ago
Victor Julien 0e22e95e47 alert-json: fix stream logging for IPS mode 
Switch direction in IPS mode.
 11 years ago
Alexander Gozman d44eab82c1 Fix bug #1435 (data loss when dumping payloads to JSON) 12 years ago
Victor Julien 8a97bb0d04 alert json: move alert info into function 
Move adding the alert info (sid,rev,gid,etc) into it's own function,
so it can be called from other outputs as well.
 12 years ago
Eric Leblond 47d9c7b211 json-alert: use getter for appstate 12 years ago
Eric Leblond 881f32cc02 json-alert: add SSH fields in alert logging 12 years ago
Eric Leblond 180faece7c json-alert: log tls info in alert 
This patch adds the capabilities to log the TLS information the
same way it is currently possible to do with HTTP. As it is
quite hard to read ASN.1 directly in the stream, this will help
people to understand why suricata is firing on alert relative
to TLS.
 12 years ago
Eric Leblond 969abc2ccd output-json: fix duplicate logging 
This patches is fixing a issue in the OutputJSONBuffer function. It
was writing to file the content of the buffer starting from the start
to the final offset. But as the writing is done for each JSON string
we are duplicating the previous events if we are reusing the same
buffer.

Duplication was for example triggered when we have multiple alerts
attached to a packet. In the case of two alerts, the first one was
logged twice more as the second one.
 12 years ago
Duarte Silva 68f43ffffb Implemented the diferent behaviour depending on the proxy deployment 
- In forward deployment mode the first IP will be returned
- In reverse deployment mode the last IP will be retuned
 12 years ago
Duarte Silva 496200dd08 Prepared everything for the proxy deployment configuration 
- Added the suricata.yaml configurations and updated the comments
- Renamed the field in the configuration structure to something generic
- Added two new constants and the warning codes
 12 years ago
Duarte Silva 4e04cd2d1b Adding XFF support to EVE alert output 
- Created app-layer-htp-xff.c and app-layer-htp-xff.h
- Added entries in the Makefile.am
- Added the necessary configuration options to EVE alert section
- Updated Unified2 XFF configuration comments and removed unnecessary whitespace
- Created a generic function to parse the configuration
- Release the flow locks sooner and remove debug logging
- Added XFF support to EVE alert output
 12 years ago
Duarte Silva 3a18db13dc Simple code fixes 
- Removed unnecessary assignment of the data field
- Removed else condition (same function called for IPv4 and IPV6)
- Fixed constants to be a power of two (used in bitwise operations)
 12 years ago
Victor Julien f453fb810f alert-json: clean up flags 
Make payload/packet logging code also use the flags field in
AlertJsonOutputCtx, instead of in the LogFileCtx.
 12 years ago
Giuseppe Longo b188d93630 json-alert: include HTTP info on the alerts 
Extends the JSON alert output to include the HTTP data
at the time of the alert.
 12 years ago
Duarte Silva db9588a2ce Use extra data structure in json alert output 
to store local configuration
 12 years ago
Ken Steele 8f1d75039a Enforce function coding standard 
Functions should be defined as:

int foo(void)
{
}

Rather than:
int food(void) {
}

All functions where changed by a script to match this standard.
 12 years ago
Victor Julien de4e2221d8 eve: add tx_id to output for alerts and events 
Add tx_id field for correlating alerts and events per tx.
 12 years ago
Alexander Gozman bfb6175bf6 Fixed memory leak 12 years ago
Alexander Gozman 54193e89d5 Fixed variables names in suricata.yaml.in Changed logging logic - now it's possible to enable different payload dumping modes separately Fixed bug in dumping packet without stream segments Fixed indents 12 years ago
Alexander Gozman 6d569013c6 Changed attribute name for printable payload 12 years ago
Alexander Gozman c770ade9c2 Changed variable name when dumping single packet 12 years ago
Alexander Gozman 2a4c7ee5dc Add ability to encode payload in Base64 12 years ago
Alexander Gozman ffac6b71e2 Fixed stream handling Fixed some coding style issues 12 years ago
Matt Carothers ab58ee2676 Add packet and payload logging to JSON alert output 12 years ago
Victor Julien 96adcf6829 refactor IDS/IPS engine mode logic 
Instead of error phrone externs with macro's, use functions with a local
static enum var instead.

- EngineModeIsIPS(): in IPS mode
- EngineModeIsIDS(): in IDS mode

To set the modes:

- EngineModeSetIDS(): IDS mode (default)
- EngineModeSetIPS(): IPS mode

Bug #1177.
 13 years ago
Victor Julien 1f2310bb34 alert-json: fix cleanup 
Call specialized clean up function when running as a sub-module.
 13 years ago