11961 Commits (fbcdd2ec267d49040ca178f8562767d8fb00aa73)

 

All Branches   

Search

Author	SHA1	Message	Date
Victor Julien	fbcdd2ec26	detect/iponly: don't check & set flow flags twice ... Per flow IP-only flags are checked and set by IP-only engine, so no need to set/check them per alert.	4 years ago
Victor Julien	55a0e29c8e	eve/ike: gracefully handle renamed output config	4 years ago
frank honza	ab59ef0d79	ikev1: add documentation for ikev1	4 years ago
Sascha Steinbiss	37940180a8	ikev1: add metadata to alerts	4 years ago
Sascha Steinbiss	e2dbdd7fd5	ikev1: add ikev1 parser	4 years ago
frank honza	ecdf9f6b0b	ikev1: rename ikev2 to common ike ... Renaming was done with shell commands, git mv for moving the files and content like find -iname '*.c' | xargs sed -i 's/ikev1/ike/g' respecting the different mixes of upper/lower case.	4 years ago
frank honza	ab6171c429	detect: added support for protocol-aliases	4 years ago
frank honza	e9494ddd8f	util: add function converting u8-array into a hex-String	4 years ago
frank honza	b80cdae1df	detect: add comparison-mode LTE/GTE for Detect(U32/u8)Data	4 years ago
Victor Julien	c3075cba42	detect/analyzer: fix mpm display on payload only rules	4 years ago
Victor Julien	9dd1444f44	detect: suppress error message for pcre only rules	4 years ago
Victor Julien	b55b327db1	detect/analyzer: suggest modern keywords	4 years ago
Victor Julien	57f7612ffd	detect/analyzer: fix json output for warnings/notes	4 years ago
Victor Julien	018b9a0a8c	detect/asn1: minor cleanups	4 years ago
Victor Julien	8b8cc697d5	detect/http-server-body: clean up test	4 years ago
Victor Julien	68f8b2f40f	detect/icmp: reject invalid rules for icode/itype	4 years ago
Victor Julien	7d6835958b	detect/prefilter: fix null ptr deref on invalid rule ... A bad rule 'icode:<0; prefilter;' would trigger a null ptr deref in ApplyToU8Hash. Bug #4375.	4 years ago
Victor Julien	e964643088	detect/state: fix reset bug ... Fix issue where after a reset the now empty list elements are not reused and the values may not be valid for the current detect engine anymore. Introduce a 'current' (cur) pointer that points to the store element currently being filled. This way existing stores will be reused. If 'cur' is NULL and 'head' is not NULL it means we need to use 'tail' to append a new store.	4 years ago
Victor Julien	f766139159	detect/state: test to show reset bug	4 years ago
Victor Julien	a808474d38	detect/state: minor code cleanup	4 years ago
Jason Ish	0aed5e188b	filestore: fix global counter init in unix socket mode ... Move initialization of filestore global counter to PreRunInit, so they get registered during program initialization, or as required in unix-socket mode, initialized for each file run. Fixes Redmine issue: https://redmine.openinfosecfoundation.org/issues/4216	4 years ago
Philippe Antoine	8307010255	smb: relax probing parser to handle first NBSS message ... cf dcerpc-udp S-V test : First message is Message Type: Session request (0x81) Second message is SMB	4 years ago
Philippe Antoine	660e9e489b	protodetect: only run ProbingParserTc if STREAM_TOCLIENT	4 years ago
Philippe Antoine	52ea3fc7ac	fuzz: more precise assertion for protocol detection ... Only in the cases of stream start is the assertion valable. Otherwise, it can only be best effort.	4 years ago
Philippe Antoine	1b6e81cd72	smb: probing parser for start and midstream ... The probing parser is more strict at the start of the stream	4 years ago
Philippe Antoine	9dc5258a21	smb: split probing function for code style ... Introduces rs_smb_probe_tcp_midstream	4 years ago
Philippe Antoine	2d765d6c68	detect: fix overflows in SetupU8Hash ... For instance ">255" resulted in overflow	4 years ago
Philippe Antoine	eb460cf78d	ssl: reset state when breaking out of SSLV3_HANDSHAKE_PROTOCOL ... So that we cannot resumt it with corrupted values	4 years ago
Philippe Antoine	89030d3e59	modbus: stop allocating transactions when flooded ... cf #4224	4 years ago
Philippe Antoine	ddb4d289ae	icmpv6: bail out for icmpv6.hdr keyword if not ICMPv6	4 years ago
Jeff Lucovsky	538fc58b37	output/http2: Multi-threaded EVE logging support ... This commit adds multi-threaded EVE logging support to the HTTP/2 logging path.	4 years ago
Philippe Antoine	35f6c80bbf	eve: fix memory leak in metadata ... Fixes #4205	4 years ago
Shivani Bhardwaj	d708744f2b	doc: fix ubuntu pkg name for tcmalloc	4 years ago
Philippe Antoine	7500c29300	decode: limits the number of decoded layers ... so as to avoid overrecursion leading to stack exhaustion	4 years ago
Victor Julien	af13d4de18	detect: set HTTP SWF decompress limits	4 years ago
Victor Julien	4a1482a1cf	detect/http.request_body: fix tracking with xforms ... Fix handling of file progress tracking for regular http.request_body along with transform combinations. This is done by implementing the 'base id' logic. Related tickets: #4361 #4199 #3616	4 years ago
Victor Julien	ea3fb4a465	detect/file.data: fix mixing transforms (http) ... Fix handling of file progress tracking for regular file.data along with transform combinations for the part of the implementation that uses the HTTP inspection logic. This is done by implementing the 'base id' logic. Related tickets: #4361 #4199 #3616	4 years ago
Victor Julien	54ad7de9ce	detect/file.data: fix mixing transforms (file api) ... Fix handling of file progress tracking for regular file.data along with transform combinations for the part of the implementation that uses the File API. This is done by implementing the 'base id' logic. Related tickets: #4361 #4199 #3616	4 years ago
Victor Julien	975062cf40	detect: track base id for xform buffers ... Buffers with transforms are based on the non-transformed "base" buffer, with a new ID assigned and the transform callbacks added. This patch stores the id of the original buffer in the new buffer inspect and prefilter structures. This way the buffers with and without transforms can share some of the logic are progression of file and body inspection trackers. Related tickets: #4361 #4199 #3616	4 years ago
Victor Julien	52692da7cf	detect/analyzer: fix pkt engine display	4 years ago
Victor Julien	f037f6f4ff	classification: sync and update ... Sync to latest ET open and introduce inappropriate as a classification to replace something some find inappropriate.	4 years ago
Shivani Bhardwaj	0ac5c5376a	dcerpc: trigger raw assembly on record completion	4 years ago
Shivani Bhardwaj	c77c8e7005	rust/context: add AppLayerParserTriggerRawStreamReassembly	4 years ago
Philippe Antoine	2d14606224	smb: andx support ... Add AndX support for SMB1. Finishes #3475. [Updated by Victor Julien to split functions]	4 years ago
Ilya Bakhtin	1ecea0f44c	stream/tcp: fix stream side after direction change	4 years ago
Jason Ish	560974b2db	doc/quickstart: use new test url that works ... Replace http://testmyids.org with http://testmynids.org/uid/index.html, as testmyids.org now always redirects to https.	4 years ago
Josh Stroschein	7ece0ac31f	doc: update installation documentation for CentOS and Fedora	4 years ago
Philippe Antoine	a04b5566a6	http: makes decompression time limit configurable	4 years ago
Eric Leblond	6ef28d0a70	util/thash: fix memcap consolidate function ... The function THashConsolidateMemcap is used to allow to load a dataset even when the memcap is not set. But the implementation was in fact resetting the memcap value to the max of memory usaga after loading and default memcap. As a result, the function was resetting memcap to the default memcap even if a huge memcap was set in the dataset definition. In the case of dataset where we add to the set it was leading to memcap limit hitting despite the settings of memcap by the user. This patch udpates the code to set the final memcap value to the max of memory usage after loading and set memcap.	4 years ago
Ilya Bakhtin	b3b64803e5	stream: TcpStreamCnf.midstream type changed to bool	4 years ago