181 Commits (fca541f40ecf08b83e1ac4ed5ae198150be29618)

Author	SHA1	Message	Date
Jason MacLulich	835630efbd	Add initial support for reading packets from a DAG card, we only support reading from a single stream at this time. ... Use the --dag <dagname> cmd line option to specify from which DAG card to read pkts from. Issue at the moment with pkts being ejected during shutdown -- at the moment we ignore any packets that are not of link type Ethernet.	16 years ago
Ondrej Slanina	6bf7d76005	added possibility to run suricata as WIN32 service	16 years ago
Victor Julien	0140a14a15	Introduce atomic operations API that supports GCC's atomic operations and a fallback using (spin)locks. Convert ringbuffer api to use the new atomic api.	16 years ago
Gerardo Iglesias Galvan	55dfa36963	Add support for http_uri keyword	16 years ago
Victor Julien	a48a767efc	Lockfree ringbuffer wip.	16 years ago
Jason Ish	a93b2e6b84	Support for reading ERF files.	16 years ago
Gurvinder Singh	5fe1dc1d24	support for sslv2/sslv3 their unit tests and better stream no reassembly flag handling	16 years ago
Victor Julien	b8641f300d	Rename asn1 files, fix an invalid free, fix improper init of vars in one unittest.	16 years ago
Pablo Rincon	3fa3229e01	ASN1 decoder and keyword implementation	16 years ago
Victor Julien	70b32f7380	First stab at creating a stateful detection engine. ... Stateful detection for app layer detection keywords, except uricontent. Stores it's partial results in the flow structure. Other modifications: - Generalize transaction tracking, logging and inspection. - Adapt http and dcerpc to use the new transaction handling. - Stream engine now always notifies app layer of a stream eof. This commit fixes bug #124.	16 years ago
Jason Ish	18e5ac8cde	Basic rule profiling even though the results may be skewed by a bad rule in a grouping of rules.	16 years ago
Pablo Rincon	e18e2ec998	Changing threshold logic	16 years ago
Pablo Rincon	1238668961	Adding actions order and suport for rule action "pass"	16 years ago
Victor Julien	070ed778b8	Libcap-ng support by Gurvinder Singh and myself. Basic support for per thread caps is added, but not activated as it doesn't seem to work yet. Work around for incompatibility between libnet 1.1 and libcap-ng added.	16 years ago
Pablo Rincon	ab02ab9ead	adding http_header keyword support	16 years ago
Victor Julien	54aa1790f3	Remove Makefile.am reference to non-existing file.	16 years ago
Pablo Rincon	9803def006	Adding pidfile support (thanks to Steve Grubb for the patch)	16 years ago
Anoop Saldanha	97d49d8f5e	support for http_client_body keyword	16 years ago
Breno Silva	67f2026279	Global Threshold config	16 years ago
Victor Julien	08600df6b1	Small uri cleanups.	16 years ago
Pablo Rincon	b708d7f65d	Adding Uricontent inspection with spm. Modifiers for uricontent are now supported	16 years ago
Gerardo Iglesias Galvan	ef2ae76c42	Add support for detection_filter keyword	16 years ago
Victor Julien	bef70a04ce	First stage of detect engine redesign: equal patterns share id's, search phase no longer used, new match verification phase.	16 years ago
Pablo Rincon	25a3a5c6d8	Adding mem wrapper to debug runtime alloc()/free() functions. Fixing some memory leaks.	16 years ago
William Metcalf	260d0d7673	Steve Grub fixes... Thanx Steve!	16 years ago
William Metcalf	0fe4373b67	Rolled back to 0.2.x branch renamed htp to libhtp	16 years ago
William Metcalf	f7111f3847	import of integrated htp lib and small libnet fixes	16 years ago
Jan Jezek	fe6a72befc	Code is now compilable on the Win32 platform	16 years ago
Anoop Saldanha	41e6735b92	mpm b2g cuda support added	16 years ago
Anoop Saldanha	84df26d3fd	cuda interface	16 years ago
Breno Silva	b02bb6b6b4	VLAN Support	16 years ago
Breno Silva	7e299834d2	FragOffset Rule Keyword	16 years ago
Pierre Chifflier	4515ae13e4	Add Prelude output plugin ... Add support for reporting alerts to the Prelude SIEM system, using libprelude to send IDMEF (RFC4765) messages. Each message contains the alert description and reference (using the SID/GID), and a normalized description (assessment, impact, sources etc.) libprelude handles the connection with the manager (collecting component), spooling and sending the event asynchronously. It also offers transport security (using TLS and trusted certificates) and reliability (events are retransmitted if not sent successfully). This modules requires a Prelude profile to work (see man prelude-admin and the Prelude Handbook for help). Signed-off-by: Pierre Chifflier <chifflier@edenwall.com>	16 years ago
Nick Rogness	2b7b78f1bf	Intial IPFW support FreeBSD and OSX	16 years ago
Pablo Rincon	260e581929	First version of the reputation API	16 years ago
Pablo Rincon	17cd010b0c	Detect the number of CPUs configured and online. Printing a small summary at the startup	16 years ago
Victor Julien	d446b85237	Remove obsolete files.	16 years ago
Steve Grubb	f853da7940	Get make distcheck working ... Hello, Below is a patch that gets "make distcheck" working. Its against the current code in git. The project version was set to 0.1 in configure, I changed that to 0.8.1 just so its actually relevant. You might want to set that to something else. After checking this patch, I find that there are several source code files in src/ that are not getting compiled: -app-layer-detect.c -app-layer-detect.h -app-layer-http.c -reputation.h Are these new or abandoned? Anyways...here's the patch. -Steve	16 years ago
Victor Julien	0d34990d7f	Add OpenBSD's strlcpy and strlcat and replace all strcat/strcpy/strncat/strncpy by those calls.	16 years ago
Gurvinder Singh	f6b0c481b0	urilen support for engine	16 years ago
Pablo Rincon	705471e4ee	Adding single pattern matcher algorithms. If you cannot store a context for the patterns, use SpmSearch() macro. Adding unittests and stats	16 years ago
Pablo Rincon	673afeb4d3	fmemopen wrapper added (fix compilation problems on macosx and freebsd)	16 years ago
Breno Silva	1d055b0e09	ICMP Seq Rule Keyword	16 years ago
Eric Leblond	6cf00d6204	Fix typo in Makefile.am ... This patch fixes a typo in Makefile.am which was preventing 'make tags' from working.	16 years ago
William Metcalf	8a64321340	raw pcap support additionl ipv4/6 validation	16 years ago
Pablo Rincon	b6a3395c08	Adding unittest helper functions for building generic packets, checking arrays of expected match results, perform generic tests, etc. Look at util-unittest-helper.c and detect-ipproto.c for references	16 years ago
Jason Ish	e204d07717	Have output modules register themselves so run mode configurator becomes aware of them for purposes of being configured from the config file.	16 years ago
Brian Rectanus	c22d42693a	Added http_method rule keyword.	16 years ago
Anoop Saldanha	f684989f98	dce_iface, dce_opnum, dce_stub_data keyword support	16 years ago
Anoop Saldanha	bc4df59414	Support for Classtype keyword and Classification Config file	16 years ago
Victor Julien	f0be69dcd0	Fixup smb/smb2/dcerpc wrt loops, debug printing, style.	16 years ago
Victor Julien	d5c732f1f9	Add tag keyword stub	16 years ago
Victor Julien	6beee776ca	Move rand seed code into util-random	16 years ago
Pablo Rincon	f2f9b83280	Adding FTP app layer parser and ftpbounce detection at L7	16 years ago
Gerardo Iglesias Galvan	7e87f373b9	Add icmp_id keyword support	16 years ago
Victor Julien	493715c0d2	Implement alert sid storage in the flow so we can check previous alerts in the flow.	16 years ago
Gerardo Iglesias Galvan	e917065e26	Add support for daemon, checking for valid combination of modes	16 years ago
Breno Silva	69eb869cc9	Threshold Rule	16 years ago
Victor Julien	ecf86f9c23	Rename to Suricata.	16 years ago
Gurvinder Singh	a0f184866c	http_cookie keywork support	16 years ago
Gurvinder Singh	fc2f7f29fa	app layer htp error handling and fixes for memory leaks and segv	16 years ago
Pablo Rincon	1ad6d75dfe	Added rpc keyword support at packet level	16 years ago
Pablo Rincon	a8d7b71490	First version of flowints	16 years ago
Gerardo Iglesias	991d421394	Changed printf's to logging API functions	16 years ago
Gurvinder Singh	07f7ba55b8	initial support for HTP module init	16 years ago
Victor Julien	2cfa284999	Fix app layer detect to actually work.	16 years ago
Victor Julien	f1f7df0766	First iteration of doing app layer detection.	16 years ago
Anoop Saldanha	6ca5dbc9e9	Support fast_pattern modifier keyword for content	16 years ago
Anoop Saldanha	dc44700ce5	Support vars lookup from conf file. Current patch support address and port group vars lookup	16 years ago
Anoop Saldanha	7dbc117b37	Host OS Table API. Modifications also make to the radix tree to handle netblocks	16 years ago
Gurvinder Singh	cacbf31aad	support for ttl keyword	16 years ago
Kirby Kuehl	ecaa701bdf	smb and dcerpc work	16 years ago
Brian Rectanus	ed30067bd7	Ack/Seq Keywords	16 years ago
Jason Ish	e0b9e85230	Break out checksum fixup code to make the license separation more clear.	16 years ago
Brian Rectanus	ec6c5258b6	Sameip Keyword	16 years ago
Breno Silva	15a8f34d36	Gid Keyword ... Signed-off-by: Brian Rectanus <brectanu@gmail.com>	16 years ago
Breno Silva	6100a7f610	FragBits Keyword ... Signed-off-by: Brian Rectanus <brectanu@gmail.com>	16 years ago
Pablo Rincon	1a983fd316	Adding id keyword and unittests	16 years ago
Breno Silva	7dc985aa4e	Signature Flags Keyword ... Signed-off-by: Brian Rectanus <brectanu@gmail.com>	16 years ago
Brian Rectanus	e28647032d	Add ip_proto support.	16 years ago
Anoop Saldanha	3c21df69d2	Radix Tree structure for the engine	16 years ago
Anoop Saldanha	157d5e8113	Implementation of the logging module	16 years ago
Anoop Saldanha	f658ffbc9c	Order the signatures based on certain rule parameters like actions, flowbits, flowvar, pktvar, priority etc	16 years ago
William Metcalf	04b0f177fc	native PF_RING support with fixes	16 years ago
Breno Silva	27c61ac148	IpOpts Rule Keyword ... Signed-off-by: Brian Rectanus <brectanu@gmail.com>	16 years ago
Pablo Rincon	bdf119ade3	Adding window and isdataat keyword and some unittests	16 years ago
Breno Silva	a5e386ce52	Unified2 ... Signed-off-by: Breno Silva <breno.silva@gmail.com>	16 years ago
Brian Rectanus	02a8b583c9	Added byte_test and byte_jump support.	16 years ago
Brian Rectanus	af06e6a288	Added byte extraction util.	16 years ago
Victor Julien	cfb605aa8a	Put the precooked runmodes in a separate file.	16 years ago
Jason Ish	c91a4baad5	- Autoconf goo for libyaml. ... - Mock YAML configuration file. - YAML loader for basic YAML files - not all YAML elements support yet.. todo. - Add --dump-config command line parameter to dump the state of the configuration db after loading the config file.	16 years ago
Gurvinder Singh	ac53ca5b27	Stream Size rule option	16 years ago
Victor Julien	3636ca9703	Adding a "flow" queue handler. This queue handler passes packets of the same flow to the same queue. Changed the default IDS mode to use this. ... Some output cleanups, shutdown should be cleaner now.	16 years ago
Anoop Saldanha	22c0ec2bc5	Added support for the csum-<protocol> rules keyword to the detection engine. Keywords added are ipv4-csum, tcpv4-csum, tcpv6-csum, udpv4-csum, udpv6-csum, icmpv4-csum and icmpv6-csum	16 years ago
Victor Julien	086ba5f49b	Add 'BySize' field parser. Add stub tls parser.	16 years ago
Breno Silva	9528e02e46	GRE support	16 years ago
Jason Ish	e3b538c7d7	Simple configuration API. ... Allow the log directory to be changed.	16 years ago
Jamie	8817364ef6	initial PPPoE decoder commit	17 years ago
Victor Julien	8e10844f95	Initial code of Application Layer parsing framework. Rename of L7* to AppLayer*.	17 years ago
Breno Silva	c90b4e6fcd	Decode event rule	17 years ago