539 Commits (fc35a78ba14c04c528adf198f8f10b97521e8012)

Author	SHA1	Message	Date
Victor Julien	3e2205d08f	detect-less: disable raw reassembly ... When using --disable-detection automatically disable raw stream reassembly by forcing stream.reassembly.raw to be false.	12 years ago
Victor Julien	5cc880c5c1	detect-less: add log only TX handling function ... When running w/o detect, TX cleanup handling needs to ignore the inspect_id as it's only updated by detect. This patch introduces a new ActiveTx handler for logging only: AppLayerTransactionGetActiveLogOnly If --disable-detection is passed on the commandline, this function is registered.	12 years ago
Victor Julien	50f5b246db	Update main loop to handle detect-less ... Update main startup and shutdown loops to work will when detect is disabled. In this case de_ctx remains NULL.	12 years ago
Victor Julien	258778cde4	Introduce g_detect_disabled global ... This global will be set to TRUE if detect is disabled. The reason for adding a global is that there currently is no clean way to pass configuration options to management threads.	12 years ago
Victor Julien	b44ec80590	Add --disable-detection commandline option ... Flags the SuriInstance that the detection engine should be disabled. Actual disabling is not yet implemented.	12 years ago
Jason Ish	5850607fea	Remove the old include support.	12 years ago
Eric Leblond	a8c787a265	device list: clean and display stat at exit ... This patch adds a cleaning function to device list. This also permits to display per-interface statistics during the exit.	12 years ago
Anoop Saldanha	429c6388f6	App layer API rewritten. The main files in question are: ... app-layer.[ch], app-layer-detect-proto.[ch] and app-layer-parser.[ch]. Things addressed in this commit: - Brings out a proper separation between protocol detection phase and the parser phase. - The dns app layer now is registered such that we don't use "dnstcp" and "dnsudp" in the rules. A user who previously wrote a rule like this - "alert dnstcp....." or "alert dnsudp....." would now have to use, alert dns (ipproto:tcp;) or alert udp (app-layer-protocol:dns;) or alert ip (ipproto:udp; app-layer-protocol:dns;) The same rules extend to other another such protocol, dcerpc. - The app layer parser api now takes in the ipproto while registering callbacks. - The app inspection/detection engine also takes an ipproto. - All app layer parser functions now take direction as STREAM_TOSERVER or STREAM_TOCLIENT, as opposed to 0 or 1, which was taken by some of the functions. - FlowInitialize() and FlowRecycle() now resets proto to 0. This is needed by unittests, which would try to clean the flow, and that would call the api, AppLayerParserCleanupParserState(), which would try to clean the app state, but the app layer now needs an ipproto to figure out which api to internally call to clean the state, and if the ipproto is 0, it would return without trying to clean the state. - A lot of unittests are now updated where if they are using a flow and they need to use the app layer, we would set a flow ipproto. - The "app-layer" section in the yaml conf has also been updated as well.	12 years ago
Eric Leblond	58eb6428d1	suricata: ignore SIGHUP signal ... This patch ignores the SIGHUP signal instead of having the default behavior.	12 years ago
Jason Ish	e9a4871077	Fix alignment in usage.	12 years ago
Victor Julien	0a24ac0855	Fix Conf api usage after rebase	12 years ago
Jason Ish	b8e13d4bd6	More concise API for setting config values that ... can be overrided or not (final values).	12 years ago
Eric Leblond	1bdc39fe9b	cmdline: add -k to specify checksum validation ... This patch adds a '-k' option to suricata to be able to specify the checksum validation to use. If '-k all' is used, checksum validation is forced. If '-k none' is used, no checksum validation is made. Message output in case of detection of a pcap file with a probable cheksum issue has been updated to indicate that '-k' is a solution.	12 years ago
Victor Julien	480fddd189	build-info: add a nicer way of printing atomics support	12 years ago
Eric Leblond	3dceca70ee	suricata: move some code into PostConfLoadedSetup ... All functions before daemonization are initialisation functions and thus the call can be moved in PostConfLoadedSetup.	12 years ago
Victor Julien	a84c502e50	Add SSE support to --build-info	12 years ago
Victor Julien	25636597af	Fix live rule reload confusing delayed detect ... Fixes bug 1023 and the previous attempt to fix it.	12 years ago
Victor Julien	5906eeb8c8	detect: don't do rule reload during delayed detect ... When both rule reloads and delayed detect are enabled, make sure we don't trigger a reload during delayed detect initialization. Bug #1023.	12 years ago
Victor Julien	97bfcac444	profiling: introduce per keyword profiling ... Initial version of per keyword profiling. Prints stats about how ofter a keyword was checked and what the costs were.	12 years ago
Victor Julien	7ebd1e6433	Counters: fix delayed-detect counter registration ... Make sure we register the detect.alerts counter before packet runtime starts even in delayed detect mode. The registration of new counters at packet runtime is not supported by the counters api and might lead to crashes as there is no proper locking to allow for this operation. This changes how delayed detect works a bit. Now we call the ThreadInit callback twice. The first call will only register the counter. The 2nd call will do all the other setup. This way the counter is registered before the counters api starts operating in the packet runtime. Fixes the segv reported in ticket #1018.	12 years ago
Anoop Saldanha	619414c59e	Add a /* fall through */ comment for all switch case fall throughs. ... This should server as a message to coverity that the fall through is intentional.	12 years ago
Victor Julien	37669bfdd2	threshold: register threshold host storage. Related to bug #991	12 years ago
Victor Julien	74d8d95f83	Don't initialize threshold before rules on delayed detect. Bug #999.	12 years ago
Eric Leblond	2be194d03f	suricata: add -v[v] option to increase verbosity ... This patch adds a -v option to suricata. It increases the log level defined in the YAML.	12 years ago
Eric Leblond	4a4600539d	suricata: info message after log init ... This patch moves version display after log init so we can have an homogeneous display.	12 years ago
Eric Leblond	fdc1757e34	suricata: reorder start ... Initalizing output just after configuration file parsing allow to log almost all messages accordingly to configuration.	12 years ago
Eric Leblond	7bcacc712a	log: change default log level to notice ... This patch updates the log level of meaningful start messages to notice. It also sets the default log level to notice.	12 years ago
Victor Julien	8d6bca72f7	Improve 'host-mode' info message	12 years ago
Eric Leblond	6cf7da30e2	Introduce host-mode. ... This variable can be used to indicate to suricata that the host running is running as a router or is in sniffing only mode. This will used at least to determine which interfaces are used to send reject message.	12 years ago
Victor Julien	468a8e1ca3	Properly cleanup NSS ctx	12 years ago
Victor Julien	eedd4329da	Change ParseSize api to not leak memory and only setup pcre once.	12 years ago
Victor Julien	397a55457d	Add sanity checks for command line argument handling ... Coverity 1075221. Normally getopt_long should cover this case, but can't hurt to add in some extra checks.	12 years ago
Victor Julien	38aaae1fd7	IsRuleReloadSet() shouldn't return an uninitialized value	12 years ago
Victor Julien	ff668c2030	Fix Tile compile	12 years ago
Eric Leblond	20ca270dc3	fix pf_ring build	12 years ago
Eric Leblond	2a46f0dae4	suricata: rename SuriInstance to SCInstance.	12 years ago
Eric Leblond	9b422f3a8c	suricata: suppress Suri prefix ... Suppress Suri prefix in internal function name.	12 years ago
Eric Leblond	18ced653c3	Use a typedef for SuriInstance.	12 years ago
Eric Leblond	2d77e53f2c	Add offline flag to SuriInstance and some refactoring	12 years ago
Eric Leblond	34abd818dd	Prefix util-conf function with Config	12 years ago
Eric Leblond	7242cb30e7	Move CreateLowercaseTable to GLobalInits	12 years ago
Eric Leblond	02e9851315	Generic code don't need ifdef	12 years ago
Eric Leblond	8c00a963aa	Use function for delayed detect setup.	12 years ago
Eric Leblond	4296e5f29e	Add functions for elapsed time computation.	12 years ago
Eric Leblond	9d1d08c7a4	Factorize Signature loading	12 years ago
Eric Leblond	20c5683b60	Use function for daemonification and signal handler	12 years ago
Eric Leblond	90aaf55201	set rule_reload as part of SuriInstance	12 years ago
Eric Leblond	bb19ce1847	SetBPfString is part of command line parsing	12 years ago
Eric Leblond	1a6983ee19	suricata: use function to print version	12 years ago
Eric Leblond	4f789dbe84	Add function for internal running mode	12 years ago
Eric Leblond	d3cb043001	suricata: windows specific in one function	12 years ago
Eric Leblond	4401c048ba	Running mode is set earlier so out earlier	12 years ago
Eric Leblond	40a25112a0	kill remaining run_mode usage	12 years ago
Eric Leblond	75fa1e20d7	engine analysis is a running mode	12 years ago
Eric Leblond	c0d5ee77f9	get (almost) rid of run_mode variable.	12 years ago
Eric Leblond	80542816cd	add internal running mode	12 years ago
Eric Leblond	e07fdb20a8	Add SuriInstance structure ... To be able to split code in functions in main, we need to pass information about the current running Suricata to functions. For that we create a structure to store suricata run parameters. In this patch it allows to separate command line parsing and to treat internal running mode in a switch just after command line parsing.	12 years ago
Eric Leblond	325462d396	Export IsRuleReloadSet and use it.	12 years ago
Eric Leblond	8e68b357c7	Suppress Suri prefix.	12 years ago
Eric Leblond	42011e2d32	suricata: function for lowercase table creation	12 years ago
Eric Leblond	132bebb2b2	Simplify code by removing comment	12 years ago
Eric Leblond	07ef1f9837	suricata: add wrapper for interface listing	12 years ago
Eric Leblond	2be7c8aea8	Add util-conf for config util	12 years ago
Eric Leblond	27752818c2	suricata: add some wrapper for config file handling	12 years ago
Eric Leblond	b2fa4edd36	move unittest out of suricata.c	12 years ago
Eric Leblond	9a0bf0956b	suricata: list cuda cards in separate function	12 years ago
Eric Leblond	bed48e3a54	suricata: separate keyword and app layer listing code ... The list-keyword and app-layer listing code was spread over all the init code. This patch introduces a separate file to store non standard running mode like these ones.	12 years ago
Victor Julien	c08b395c2c	Init storage api at start up	12 years ago
Victor Julien	0d2a6e515e	Add Host specific wrapper to StorageRegister()	12 years ago
Victor Julien	022c0e466e	Initial storage api work	12 years ago
Ken Steele	316190c6b9	Add TILE-Gx mPIPE packet processing support. ... The TILE-Gx processor includes a packet processing engine, called mPIPE, that can deliver packets directly into user space memory. It handles buffer allocation and load balancing (either static 5-tuple hashing, or dynamic flow affinity hashing are used here). The new packet source code is in source-mpipe.c and source-mpipe.h A new Tile runmode is added that configures the Suricata pipelines in worker mode, where each thread does the entire packet processing pipeline. It scales across all the Gx chips sizes of 9, 16, 36 or 72 cores. The new runmode is in runmode-tile.c and runmode-tile.h The configure script detects the TILE-Gx architecture and defines HAVE_MPIPE, which is then used to conditionally enable the code to support mPIPE packet processing. Suricata runs on TILE-Gx even without mPIPE support enabled. The Suricata Packet structures are allocated by the mPIPE hardware by allocating the Suricata Packet structure immediatley before the mPIPE packet buffer and then pushing the mPIPE packet buffer pointer onto the mPIPE buffer stack. This way, mPIPE writes the packet data into the buffer, returns the mPIPE packet buffer pointer, which is then converted into a Suricata Packet pointer for processing inside Suricata. When the Packet is freed, the buffer is returned to mPIPE's buffer stack, by setting ReleasePacket to an mPIPE release specific function. The code checks for the largest Huge page available in Linux when Suricata is started. TILE-Gx supports Huge pages sizes of 16MB, 64MB, 256MB, 1GB and 4GB. Suricata then divides one of those page into packet buffers for mPIPE. The code is not yet optimized for high performance. Performance improvements will follow shortly. The code was originally written by Tom Decanio and then further modified by Tilera. This code has been tested with Tilera's Multicore Developement Environment (MDE) version 4.1.5. The TILEncore-Gx36 (PCIe card) and TILEmpower-Gx (1U Rack mount).	12 years ago
Victor Julien	055b422c28	Remove obsolete code: flow alert sid storage	12 years ago
Victor Julien	9faa4b740d	Add --unittests-coverage option to list how many code modules have tests	12 years ago
Victor Julien	fc7879322e	Rename GetIfaceMaxPayloadSize to GetIfaceMaxPacketSize to reflect the actual function.	12 years ago
Anoop Saldanha	cdaa13012a	fix for #882. ... Refactor the code that initializes the cuda mpm environment.	12 years ago
Anoop Saldanha	f85a2dc84b	fix for #875. ... Update configure.ac to check for either 0.5.5 and 0.5.x version of libhtp.	12 years ago
Anoop Saldanha	48cf0585fb	Suricata upgrade to libhtp 0.5.x. ... Remove the support for now unsupported personalities from libhtp - TOMCAT_6_0, APACHE and APACHE_2_2. We instead use the APACHE_2 personality.	12 years ago
Victor Julien	33818c0272	DNS: fix CUDA build	13 years ago
Victor Julien	8e01cba85d	DNS TCP and UDP parser and DNS response logger	13 years ago
Anoop Saldanha	602c91ed41	Minor cosmetic changes to the cuda code. ... Moved a couple of functions to more cuda relevant files; Re-structured some data types.	13 years ago
Anoop Saldanha	17c763f855	Version 1 of AC Cuda.	13 years ago
Anoop Saldanha	b787da5643	Remove all cuda related code in the engine except for the cuda api wrappers	13 years ago
Victor Julien	724ad9e8e7	Detect L1 cache line size at build time. Fall back to 64 bytes if detection failed.	13 years ago
Eric Leblond	539de3f5ea	bpf filter: use SCLogError instead of fprintf	13 years ago
Eric Leblond	dfbb31df8a	Exit if bpf is used in IPS mode	13 years ago
Eric Leblond	74a9fc4b66	Add function to display current capture mode ... This patch adds a function to display the capture mode.	13 years ago
Anoop Saldanha	3511f91bba	Add support for the new keyword - http_raw_host header. ... The corresponding pcre modifier would be 'Z'.	13 years ago
Anoop Saldanha	c4ce19a1be	Add support for a new keyword to inspect http_host header. ... The corresponding content keyword would now be - http_host. The corresponding pcre modifier would be W.	13 years ago
Eric Leblond	84f50ba49f	build-info: use printf instead of SCLogInfo ... This change results in a more readable and reusable output.	13 years ago
Eric Leblond	668113af77	add configure summary to build-info output	13 years ago
Eric Leblond	f5ba8eb6db	suricata: add information to build-info ... This patch adds information about luajit and jansson to the output of --build-info command. This should fix #696.	13 years ago
Eric Leblond	12fd60b545	unix-socket: cleanup host table instead of destroying it ... This patch should fix the bug #637. Between pcap files, it uses a new function HostCleanup() to clear tag and threshold on host with an IP regputation. An other consequence of this modification is that Host init and shutdown are now init and shutdown unconditionaly.	13 years ago
Victor Julien	3ab1458abf	pcap: fix windows commandline mangling win device string	13 years ago
Eric Leblond	af16c418b7	unix-socket: fix build when jansson not present	13 years ago
Eric Leblond	cc71c993f4	unix-command: add iface information command. ... This patch adds two commands to unix-command. 'iface-list' displays the list of interface which are sniffed by Suricata and 'iface-stat' display the available statistics for a single interface. For now, this is the number of packets and the number of invalid checksums.	13 years ago
Eric Leblond	20a8b9dbe5	unix-manager: add unix command socket and associated script ... This patch introduces a unix command socket. JSON formatted messages can be exchanged between suricata and a program connecting to a dedicated socket. The protocol is the following: * Client connects to the socket * It sends a version message: { "version": "$VERSION_ID" } * Server answers with { "return": "OK|NOK" } If server returns OK, the client is now allowed to send command. The format of command is the following: { "command": "pcap-file", "arguments": { "filename": "smtp-clean.pcap", "output-dir": "/tmp/out" } } The server will try to execute the "command" specified with the (optional) provided "arguments". The answer by server is the following: { "return": "OK|NOK", "message": JSON_OBJECT or information string } A simple script is provided and is available under scripts/suricatasc. It is not intended to be enterprise-grade tool but it is more a proof of concept/example code. The first command line argument of suricatasc is used to specify the socket to connect to. Configuration of the feature is made in the YAML under the 'unix-command' section: unix-command: enabled: yes filename: custom.socket The path specified in 'filename' is not absolute and is relative to the state directory. A new running mode called 'unix-socket' is also added. When starting in this mode, only a unix socket manager is started. When it receives a 'pcap-file' command, the manager start a 'pcap-file' running mode which does not really leave at the end of file but simply exit. The manager is then able to start a new running mode with a new file. To start this mode, Suricata must be started with the --unix-socket option which has an optional argument which fix the file name of the socket. The path is not absolute and is relative to the state directory. THe 'pcap-file' command adds a file to the list of files to treat. For each pcap file, a pcap file running mode is started and the output directory is changed to what specified in the command. The running mode specified in the 'runmode' YAML setting is used to select which running mode must be use for the pcap file treatment. This requires modification in suricata.c file where initialisation code is now conditional to the fact 'unix-socket' mode is not used. Two other commands exists to get info on the remaining tasks: * pcap-file-number: return the number of files in the waiting queue * pcap-file-list: return the list of waiting files 'pcap-file-list' returns a structured object as message. The structure is the following: { 'count': 2, 'files': ['file1.pcap', 'file2.pcap'] }	13 years ago
Eric Leblond	6842545331	Add documentation url in list-keyword output. ... The output of the list-keyword is modified to include the url to the keyword documentation when this is available. All documented keywords should have their link set. list-keyword can be used with an optional value: no option or short: display list of keywords csv: display a csv output on info an all keywords all: display a human readable output of keywords info $KWD: display the info about one keyword.	13 years ago
Eric Leblond	fa900a9f6b	suricata: add information about BPF filter usage	13 years ago
Eric Leblond	7e14fe62f5	suricata: add '-V' info to usage message.	13 years ago
Eric Leblond	fd3a1346e4	suricata: add build-info command to usage message.	13 years ago
Eric Leblond	4e0f5b7f02	suricata: don't display msg in list-keyword mode. ... In list-keywords and list-app-layer mode, suricata now only displays the messages linked with the feature. This allow users to redirect the output and easily work on it. For exemple, the csv output will be easily imported into a spreadsheet.	13 years ago
Eric Leblond	5e4552fdcd	suricata: update list-keyword command ... This patch update the list-keyword command. Without any option, the previous behavior is conserved. If 'all' is used as option, suricata print a csv formatted output of keyword information: name;features;description If a keyword name is used as argument, suricata print a readable message: tls.subject Features: state inspecting Description: Match TLS/SSL certificate Subject field	13 years ago
Eric Leblond	cd42e6a3ef	Listing of app layers does not depend on unittests	13 years ago
Eric Leblond	42ace54137	list-keywords: fix when not using default install ... As we don't parse the YAML file when listing of keywords is asked, suricata make a test on existence of the build-default directory. So with a non standard (working) install (even a single configure without option lead to a failure), the keyword listing fails because the default logging directory does not exist.	13 years ago
Victor Julien	84bad6db77	Silence compiler warnings found by clang	13 years ago
Eric Leblond	4726e02afb	logging: add warning if no output module is selected ... If no daemon compatible logging module is selected, a message is displayed to avoid the user to look like mad for messages.	13 years ago
Eric Leblond	9f4da93a4b	suricata: don't exit if pidfile can't be created	13 years ago
Victor Julien	472e061c6d	build: more checking for includes	13 years ago
Victor Julien	5a6c8c0f01	minor misc changes: update htp ver, add htp ver to --build-info, clean up	13 years ago
Eric Leblond	3061452c5e	suricata: avoid concurrent run in daemon mode ... This patch creates a pid file per default and use it to avoid to be able to run two Suricata. Separate pid file have to be provided to be able to do it.	13 years ago
Matt Keeler	37e3de8425	Refactor Napatech 3GD to just Napatech as Suricata is only going to support 3GD. ... Signed-off-by: Matt Keeler <mk@npulsetech.com>	13 years ago
Matt Keeler	5786a32d0f	Remove Napatech 2GD support ... Removed the Napatech 2GD support runmode-napatech-3gd.c had an include from runmode-napatech.h which was erroneous and has been removed as well. Signed-off-by: Matt Keeler <mk@npulsetech.com>	13 years ago
Eric Leblond	fc9e0df33b	suricata: add run-as.user and run-as.group yaml var ... This patch update the YAML to be able to specify the user or the group to run Suricata as: run-as: user: suri group: suri	13 years ago
Matt Keeler	844e4dba11	Napatech 3GD Support ... For use with Network Cards from Napatech utilizing the 3GD driver/api. - Implemented new run modes in runmode-napatech-3gd.* - Implemented capture/decode threads in source-napatech-3gd.* - Integrated the new run modes and source into the build infrastructure. New configure switches --enabled-napatech-3gd : Turns on the NT 3GD support --with-napatech-3gd-includes : The directory containing the NT 3GD header files --with-napatech-3gd-libraries : The directory containing the NT 3GD libraries to link against. New CLI switch --napatech-3gd : Uses the Napatech 3GD run mode Runmodes Supported: - auto - autofp - workers Notes: - tested with 1 Gbps sustained traffic (no drops) Signed-off-by: Matt Keeler <mk@npulsetech.com>	13 years ago
Eric Leblond	00b95c69c0	suricata: list-keywords does not depend on unittest	13 years ago
Anoop Saldanha	b99f9fe890	New app inspection engine introduced. Moved existing inspecting engines to use it.	13 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	13 years ago
Victor Julien	98484ffdcc	luajit: prealloc lua states to increases chances of alloc success. Luajit requires them to be in memory <2GB.	13 years ago
Victor Julien	ec7e79c748	Rule profiling update ... - Remove usage of counters api. - Store stats in detect engine thread ctx to remove locking - Support rule reloads	13 years ago
Eric Leblond	b0a2aefc78	af-packet: fix build on systems without AF_PACKET	13 years ago
Eric Leblond	662dccd8a5	af-packet: IPS and TAP feature ... This patch adds a new feature to AF_PACKET capture mode. It is now possible to use AF_PACKET in IPS and TAP mode: all traffic received on a interface will be forwarded (at the Ethernet level) to an other interface. To do so, Suricata create a raw socket and sends the receive packets to a interface designed in the configuration file. This patch adds two variables to the configuration of af-packet interface: copy-mode: ips or tap copy-iface: eth1 #the interface where packet are copied If copy-mode is set to ips then the packet wth action DROP are not copied to the destination interface. If copy-mode is set to tap, all packets are copied to the destination interface. Any other value of copy-mode results in the feature to be unused. There is no default interface for copy-iface and the variable has to be set for the ids or tap mode to work. For now, this feature depends of the release data system. This implies you need to activate the ring mode and zero copy. Basically use-mmap has to be set to yes. This patch adds a peering of AF_PACKET sockets from the thread on one interface to the threads on another interface. Peering is necessary as if we use an other socket the capture socket receives all emitted packets. This is made using a new AFPPeer structure to avoid direct interaction between AFPTreadVars. There is currently a bug in Linux kernel (prior to 3.6) and it is not possible to use multiple threads. You need to setup two interfaces with equality on the threads variable. copy-mode variable must be set on the two interfaces and use-mmap must be set to activated. A valid configuration for an IPS using eth0 and vboxnet1 interfaces will look like: af-packet: - interface: eth0 threads: 1 defrag: yes cluster-type: cluster_flow cluster-id: 98 copy-mode: ips copy-iface: vboxnet1 buffer-size: 64535 use-mmap: yes - interface: vboxnet1 threads: 1 cluster-id: 97 defrag: yes cluster-type: cluster_flow copy-mode: ips copy-iface: eth0 buffer-size: 64535 use-mmap: yes	13 years ago
Eric Leblond	66a083dafa	Get rid of AppLayerHtpRegisterExtraCallbacks ... This patch add a early exit condition to the body handling callback. This permits to avoid to avoid a complex system to handle htp object change.	13 years ago
Eric Leblond	7e09cdc265	Delay Detect threads initialization ... This patch modifies the init of Detect threads. They are now started with a dummy function and their initialisation is done after the signatures are loaded. Just after this, the dummy function is switched to normal one. In IPS mode, this permit to route packets without waiting for the signature to start and should fix #488. Offline mode such as pcap file don't use this mode to be sure to analyse all packets in the file. The patch introduces a "delayed-detect" configuration variable under detect-engine. It can be used to activate the feature (set to "yes" to have signature loaded after capture is started).	13 years ago
Jean-Paul Roliers	efdf96ccba	tls: adding TLS Log support ... Creation of the log-tlslog file in order to log tls message. Need to add some information into suricata.yaml to work. - tls-log: enabled: yes # Log TLS connections. filename: tls.log # File to store TLS logs.	13 years ago
Anoop Saldanha	3eb0fd878d	Don't wait for packetpool to be back to full state before continuing with the shutdown process, on received shutdown signal	13 years ago
Anoop Saldanha	5f198e3a1d	Suricata shutdown updates + minor cleanup	13 years ago
Victor Julien	4c6fd7ad4c	Bug #510. Produce error if max-pending-packets is higher than 65534.	13 years ago
Anoop Saldanha	b2f589527a	Set thread name Suricata-Main for main thread and LiveRuleSwap for live swap thread	13 years ago
Anoop Saldanha	34f0897163	check if all packets are processed before disabling detect threads + kill all threads <= detect after FFR + other minor fixes	14 years ago
Victor Julien	9f3e079bcf	Make live reloads optional and disabled by default.	14 years ago
Victor Julien	728c4f9ea0	Clean up packet pool at shut down.	14 years ago
Eric Leblond	0227a87fcb	cleaning: fix warning when building with clang. ... clang was issuing some warnings related to unused return in function. This patch adds some needed error treatment and ignore the rest of the warnings by adding a cast to void.	14 years ago
Anoop Saldanha	2bc7d0792d	update clean up of old detection engine contexts for live rule swap	14 years ago
Anoop Saldanha	eee33866df	DetectEngineCtxFree() cleanup, also in main	14 years ago
Anoop Saldanha	8fb2040eee	disable live rule swap when -s or -S option's used at startup	14 years ago
Anoop Saldanha	31eb5fa2f6	Introduce util-signal.[ch]. Move our signal setup functions here	14 years ago
Anoop Saldanha	e5edcfaca8	add unittest for atomic operation with void *	14 years ago
Anoop Saldanha	ecad4a24fa	live rule support added ... To reload ruleset during engine runtime, send the USR2 signal to the engine, and the ruleset would be reloaded from the same yaml file supplied at engine startup	14 years ago
Anoop Saldanha	f4ce9011d2	make mpm ctx container de_ctx specific. Also introduce global variable in mpm_ctx. this is a workaround for cleaning non global mpm_ctx's since we now don't supply the de_ctx around the detection engine API	14 years ago
Anoop Saldanha	f5af4c9ceb	util action api returns error code if it encounters wrong values parsing wrong action conf	14 years ago
Anoop Saldanha	988c92f71c	http user agent keyword + mpm + inspection + fast pattern support added	14 years ago
Victor Julien	b210bf1290	Fix commandline supplied yaml path being ignored.	14 years ago
Eric Leblond	2d22f667c2	config: use config file in sysconfdir by default.	14 years ago
marcos	8dfddd0a0f	Added -T switch to suricata output. ... Simply added the -T to be printed out when suricata is run without any arguments. The capability to test a configuration file has been in suricata for some time, just doesn't show up as an option right now.	14 years ago
Victor Julien	5e95524122	Improve error reporting in case of syntax errors in the address and port vars.	14 years ago
Victor Julien	086a934ca9	#449: fix md5 calculation in daemon mode.	14 years ago
Anoop Saldanha	678763c3f4	bug #454 - global check to see if address and port vars are properly configured	14 years ago
Jason Ish	105173939b	Implement single, autofp and workers run modes for DAG interfaces. Includes multiple interface support. ... Remove auto mode due to bad performance.	14 years ago
Xavier Lange	fea5e68a7b	Include conf_test in special cases for unset RUNMODE	14 years ago
Xavier Lange	1d774dae61	Make conf_test local. Simplify if/else to if.	14 years ago
Xavier Lange	1ae10b9a42	Do not spawn threads for conf test	14 years ago
Xavier Lange	eaacc5d0fe	Added conf_test flag and behavior	14 years ago
Anoop Saldanha	4d192a6881	update all spm algos to use 16 bit pattern lengths. Should compress a lot of tables	14 years ago
Victor Julien	8d1fe9f2fa	Make 'autofp' the default runmode. Increase default max-pending-packets to 1024. Move some advanced and uncommonly changed settings down in the stock suricata.yaml. Closes #433.	14 years ago
Anoop Saldanha	5ffb050ada	Adapt flow tmqh counters to be atomic vars. Remove support for active flows q handler. Introduce SC_ATOMIC_SET	14 years ago
Anoop Saldanha	4e417b72b5	support flow q handler schedulers active_flows and active_packets. Support new yaml option autofp_scheduler. Support for printing q handler stats as well	14 years ago
Victor Julien	0b3f6c464a	Make list-app-layer-protos option name match the help explanation. Make sure it works w/o passing a config.	14 years ago
Anoop Saldanha	109662450d	Add new command line option --list-app-layer-protocols to list supported app layer protocols in sigs	14 years ago
Victor Julien	feff6f7705	Clean up error message.	14 years ago
Eileen Donlon	85c364da09	disallow-use-of-configuration-file-with-unittests	14 years ago
Victor Julien	d908e707d7	profiling: add per lock location profiling ... Add profiling per lock location in the code. Accounts how often a lock is requested, how often it was contended, the max number of ticks spent waiting for it, avg number of ticks waiting for it and the total ticks for that location. Added a new configure flag --enable-profiling-locks to enable this feature.	14 years ago
Victor Julien	a05df345de	Introduce host table, make tag use it ... Add a host table similar to the flow table. A hash using fine grained locking. Flow manager for now takes care of book keeping / garbage collecting. Tag subsystem now uses this for host based tagging instead of the global tag hash table. Because the latter used a global lock and the new code uses very fine grained locking this patch should improve scalability.	14 years ago
Victor Julien	0150e66ede	flow engine: improve scalability ... Major redesign of the flow engine. Remove the flow queues that turned out to be major choke points when using many threads. Flow manager now walks the hash table directly. Simplify the way we get a new flow in case of emergency.	14 years ago
Victor Julien	cdba2f50d1	Various fixes and improvements based on feedback by Coverity analyzer.	14 years ago
Nikolay Denev	139768dd58	Do not use underscored config vars internally.	14 years ago
Victor Julien	2197f1a625	file-inspection: split 'file' output module into file-store and file-log. Store stores files. Log logs json records.	14 years ago
Victor Julien	860971eca0	Misc afpacket changes.	14 years ago
Victor Julien	337f7861a4	Make sure that if not built against libnss, we still compile. Only no md5 for you then\!	14 years ago
Victor Julien	69b3df96fb	Initial on the fly MD5 calculation for extracted files using libnss.	14 years ago
Anoop Saldanha	e682796d03	feature #414 - support listing supported keywords. Remove support for dummy keywords __address__, __proto__, __port__. Remove support for recursive keyword and all references to it	14 years ago
Anoop Saldanha	09313cf9bd	Support http stat code detection engine, fast pattern(mpm engine included). Fix http stat code setup function. Fix pcre option for stat msg keyword. With this the pcre options for server_body is Q, for stat_msg is Y and for stat_code is S	14 years ago
Anoop Saldanha	2007c2711c	Support http stat msg detection engine, fast pattern(mpm engine included). Fix http stat msg setup function. Fix pcre option for stat msg keyword	14 years ago
Victor Julien	489b8b8bcc	Allow other yaml files to be included in the main yaml.	14 years ago
Victor Julien	1d9f6ff8f2	Initial Napatech support by Randy Caldejon / nPulse.	14 years ago
Victor Julien	87e6be610a	Issue warning if libhtp version used is not up to date.	14 years ago
Victor Julien	39ef24ccc4	Fix pcap -i mode.	14 years ago
Victor Julien	e526525f83	Fix pcap -i <ip>.	14 years ago
Victor Julien	35467db151	Indicate that the Suricata version used is a release or a git checkout.	14 years ago
Victor Julien	28e15be526	Clean up default output. Use simpler output format for releases.	14 years ago
Victor Julien	515d070554	Print elapsed time with millisecond precision.	14 years ago
Victor Julien	1ac6054c23	Clean up configure check for htp_tx_get_response_headers_raw. Misc changes.	14 years ago
Victor Julien	effe01ae7b	Add Init and DeInit calls to the thread module API.	14 years ago
Victor Julien	08f3ef7685	Reshuffle version printing so -V prints it only once.	14 years ago
deltay	37dc83d411	ignore signal SIGPIPE and SIGSYS	14 years ago
Victor Julien	89f83e714c	Introduce http_server_body keyword. ... The http_server_body content modifier modifies the previous content to inspect the normalized (dechunked, unzipped) http_server_body. The workings are similar to http_client_body. Additionally, a new pcre flag was introduced "/S". To facilitate this change the signature flags field was changed to be 64 bit.	14 years ago
Eric Leblond	6e7a8f38bf	ipfw: Add support for autofp and worker runmode ... This patch convert ipfw code to the PcktAcqLoop API and rework the running mode to use the running mode wrapper already used by NFQ.	14 years ago
Eric Leblond	5cfdd7594f	util-device: Modify function name. ... This patch modifies LiveBuildQueueList name to LiveBuildDeviceList to have a consistent naming accross function. It also adds a doxygen comment to add author and description of util-device.c file.	14 years ago
Victor Julien	678213c9f4	Fix ParseSizeString return code and a compiler warning.	14 years ago
Anoop Saldanha	7c9d1b80fd	Update size parsing API with new calls for returing u8, u16, u32 and u64 values. Make updates in the codebase to use these new calls	14 years ago
Anoop Saldanha	e0c13434ef	bug 333 - support new Size Parsing API. Update various conf params inside the engine to use this API to parse sizes in the format xxx <-just the no represents bytes, xxxkb <- kilobytes, xxxmb <- megabytes, xxxgb <- gigabytes, where xxx is a \d+	14 years ago
Eileen Donlon	dbdf2d888f	Enable/disable core dump in config (feature 319)	14 years ago
Victor Julien	34450b9b57	Don't parse layers / ext headers above ipv6 frag header. This is taken care of by defrag.	14 years ago
Victor Julien	63c9a3ab85	Remove duplicate include.	14 years ago
Victor Julien	f4a6f4b293	Add libmagic detection, linking and a basic API.	14 years ago
Victor Julien	1eef36b011	Initial checkin of a log-file module, that can write files extracted from flows to disk.	14 years ago
Pablo Rincon	6d60b3a747	filename and fileext keywords	14 years ago
deltay	211193b0af	Get pidfile from config file if not available in command options	14 years ago
Victor Julien	8cc82c7241	Add -S commandline option that loads a rule file exclusively. Issue #338.	14 years ago
Victor Julien	55da9787a4	Win32 compile fixes.	14 years ago
Eric Leblond	391d813c82	Remove unified1 output module.	14 years ago