You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
suricata/src
Eric Leblond 20a8b9dbe5 unix-manager: add unix command socket and associated script
This patch introduces a unix command socket. JSON formatted messages
can be exchanged between suricata and a program connecting to a
dedicated socket.
The protocol is the following:
 * Client connects to the socket
 * It sends a version message: { "version": "$VERSION_ID" }
 * Server answers with { "return": "OK|NOK" }
If server returns OK, the client is now allowed to send command.

The format of command is the following:
 {
   "command": "pcap-file",
   "arguments": { "filename": "smtp-clean.pcap", "output-dir": "/tmp/out" }
 }
The server will try to execute the "command" specified with the
(optional) provided "arguments".
The answer by server is the following:
 {
   "return": "OK|NOK",
   "message": JSON_OBJECT or information string
 }

A simple script is provided and is available under scripts/suricatasc. It
is not intended to be enterprise-grade tool but it is more a proof of
concept/example code.  The first command line argument of suricatasc is
used to specify the socket to connect to.

Configuration of the feature is made in the YAML under the 'unix-command'
section:
  unix-command:
    enabled: yes
    filename: custom.socket
The path specified in 'filename' is not absolute and is relative to the
state directory.

A new running mode called 'unix-socket' is also added.
When starting in this mode, only a unix socket manager
is started. When it receives a 'pcap-file' command, the manager
start a 'pcap-file' running mode which does not really leave at
the end of file but simply exit. The manager is then able to start
a new running mode with a new file.

To start this mode, Suricata must be started with the --unix-socket
 option which has an optional argument which fix the file name of the
socket. The path is not absolute and is relative to the state directory.

THe 'pcap-file' command adds a file to the list of files to treat.
For each pcap file, a pcap file running mode is started and the output
directory is changed to what specified in the command. The running
mode specified in the 'runmode' YAML setting is used to select which
running mode must be use for the pcap file treatment.

This requires modification in suricata.c file where initialisation code
is now conditional to the fact 'unix-socket' mode is not used.

Two other commands exists to get info on the remaining tasks:
 * pcap-file-number: return the number of files in the waiting queue
 * pcap-file-list: return the list of waiting files
'pcap-file-list' returns a structured object as message. The
structure is the following:
 {
  'count': 2,
  'files': ['file1.pcap', 'file2.pcap']
 }
13 years ago
..
Makefile.am unix-manager: add unix command socket and associated script 13 years ago
action-globals.h
alert-debuglog.c Added parentheses to fix Eclipse static code analysis 13 years ago
alert-debuglog.h
alert-fastlog.c Added parentheses to fix Eclipse static code analysis 13 years ago
alert-fastlog.h Add per packet profiling. 14 years ago
alert-pcapinfo.c Use unlikely for error treatment. 13 years ago
alert-pcapinfo.h Add pcap-info alert format. 14 years ago
alert-prelude.c Use unlikely for error treatment. 13 years ago
alert-prelude.h
alert-syslog.c Added parentheses to fix Eclipse static code analysis 13 years ago
alert-syslog.h
alert-unified2-alert.c Use unlikely for error treatment. 13 years ago
alert-unified2-alert.h
app-layer-dcerpc-common.h
app-layer-dcerpc-udp.c Fix use of byte swap function 13 years ago
app-layer-dcerpc-udp.h
app-layer-dcerpc.c Added parentheses to fix Eclipse static code analysis 13 years ago
app-layer-dcerpc.h
app-layer-detect-proto.c Added parentheses to fix Eclipse static code analysis 13 years ago
app-layer-detect-proto.h Add new command line option --list-app-layer-protocols to list supported app layer protocols in sigs 14 years ago
app-layer-ftp.c Use unlikely for error treatment. 13 years ago
app-layer-ftp.h
app-layer-htp-body.c build: more checking for includes 13 years ago
app-layer-htp-body.h File carving -- enable reponse file extraction 14 years ago
app-layer-htp-file.c Added parentheses to fix Eclipse static code analysis 13 years ago
app-layer-htp-file.h file extract: split toserver and toclient tracking 14 years ago
app-layer-htp.c Added parentheses to fix Eclipse static code analysis 13 years ago
app-layer-htp.h http: now that htp_state has a cfg reference, use it for body limits 13 years ago
app-layer-nbss.h
app-layer-parser.c Added parentheses to fix Eclipse static code analysis 13 years ago
app-layer-parser.h Add documentation url in list-keyword output. 13 years ago
app-layer-protos.c Add per app layer parser profiling 14 years ago
app-layer-protos.h New app inspection engine introduced. Moved existing inspecting engines to use it. 13 years ago
app-layer-smb.c Use unlikely for error treatment. 13 years ago
app-layer-smb.h
app-layer-smb2.c Use unlikely for error treatment. 13 years ago
app-layer-smb2.h
app-layer-smtp.c Use unlikely for error treatment. 13 years ago
app-layer-smtp.h Support for smtp decoder events 14 years ago
app-layer-ssh.c Use unlikely for error treatment. 13 years ago
app-layer-ssh.h
app-layer-ssl.c Added parentheses to fix Eclipse static code analysis 13 years ago
app-layer-ssl.h tls: keep pointers to all certificates in chain 13 years ago
app-layer-tls-handshake.c tls: keep pointers to all certificates in chain 13 years ago
app-layer-tls-handshake.h ssl parser fix/updates 13 years ago
app-layer.c Added parentheses to fix Eclipse static code analysis 13 years ago
app-layer.h
conf-yaml-loader.c Add line number to warning about mangled yaml parameters. Limit number of warnings to 10. 14 years ago
conf-yaml-loader.h
conf.c build: more checking for includes 13 years ago
conf.h Allow other yaml files to be included in the main yaml. 14 years ago
counters.c counters: management cpu set was set twice 13 years ago
counters.h Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
cuda-packet-batcher.c Use unlikely for error treatment. 13 years ago
cuda-packet-batcher.h Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
cuda-ptxdump.h Add missing cuda header file causing 'make distcheck' to fail. 14 years ago
data-queue.c Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
data-queue.h Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
debug.h
decode-ethernet.c Use unlikely for error treatment. 13 years ago
decode-ethernet.h
decode-events.c Use unlikely for error treatment. 13 years ago
decode-events.h stream: change how retransmissions are handled and detected. 13 years ago
decode-gre.c Add a packet src for every packet generated inside suricata. 13 years ago
decode-gre.h
decode-icmpv4.c Use unlikely for error treatment. 13 years ago
decode-icmpv4.h csum function fixes. Improves alert accuracy. FPs on invalid-csums decoder rules fixed 13 years ago
decode-icmpv6.c Use unlikely for error treatment. 13 years ago
decode-icmpv6.h icmpv6: for ICMPv6 info messages set payload ptr and length to right after 4 byte hdr. 13 years ago
decode-ipv4.c Simple IP reputation implementation 13 years ago
decode-ipv4.h csum function fixes. Improves alert accuracy. FPs on invalid-csums decoder rules fixed 13 years ago
decode-ipv6.c Add a packet src for every packet generated inside suricata. 13 years ago
decode-ipv6.h ipv6: improve handling of packets with duplicate (or more) ipv6 extension headers. 13 years ago
decode-ppp.c Use unlikely for error treatment. 13 years ago
decode-ppp.h
decode-pppoe.c Use unlikely for error treatment. 13 years ago
decode-pppoe.h
decode-raw.c Use unlikely for error treatment. 13 years ago
decode-raw.h
decode-sctp.c doc: add decode group and related documentation. 14 years ago
decode-sctp.h
decode-sll.c doc: add decode group and related documentation. 14 years ago
decode-sll.h
decode-tcp.c Use unlikely for error treatment. 13 years ago
decode-tcp.h csum function fixes. Improves alert accuracy. FPs on invalid-csums decoder rules fixed 13 years ago
decode-teredo.c Add a packet src for every packet generated inside suricata. 13 years ago
decode-teredo.h Teredo tunnel supports 13 years ago
decode-udp.c Teredo tunnel supports 13 years ago
decode-udp.h coverity fixes 13 years ago
decode-vlan.c Use unlikely for error treatment. 13 years ago
decode-vlan.h
decode.c Use unlikely for error treatment. 13 years ago
decode.h Simple IP reputation implementation 13 years ago
defrag-hash.c Fix GetUsed functions for Host, Flow and Defrag. 13 years ago
defrag-hash.h Defrag engine 13 years ago
defrag-queue.c Defrag engine 13 years ago
defrag-queue.h Defrag engine 13 years ago
defrag-timeout.c Fix defrag compilation warning. 13 years ago
defrag-timeout.h Defrag engine 13 years ago
defrag.c Add a packet src for every packet generated inside suricata. 13 years ago
defrag.h Defrag engine 13 years ago
detect-ack.c Add documentation url in list-keyword output. 13 years ago
detect-ack.h
detect-app-layer-event.c clang warning squashing 13 years ago
detect-app-layer-event.h Support for app layer decoder events added + app_layer_event keyword added 14 years ago
detect-asn1.c Use unlikely for error treatment. 13 years ago
detect-asn1.h
detect-byte-extract.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-byte-extract.h byte_extract_id var now a non-global de_ctx specific var 13 years ago
detect-bytejump.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-bytejump.h byte extract added to the engine. Detection support added for packet payload, uri and dce detection engines 14 years ago
detect-bytetest.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-bytetest.h byte extract added to the engine. Detection support added for packet payload, uri and dce detection engines 14 years ago
detect-classtype.c Add documentation url in list-keyword output. 13 years ago
detect-classtype.h Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
detect-content.c Add documentation url in list-keyword output. 13 years ago
detect-content.h Added parentheses to fix Eclipse static code analysis 13 years ago
detect-csum.c Use unlikely for error treatment. 13 years ago
detect-csum.h Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
detect-dce-iface.c Minor unittest fixes to make Coverity happy. 14 years ago
detect-dce-iface.h Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
detect-dce-opnum.c code cleanup - replace SigMatchAppendAppLayer with SigMatchAppendSMToList 14 years ago
detect-dce-opnum.h Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
detect-dce-stub-data.c code cleanup - replace SigMatchAppendAppLayer with SigMatchAppendSMToList 14 years ago
detect-dce-stub-data.h Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
detect-depth.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-depth.h
detect-detection-filter.c Add documentation url in list-keyword output. 13 years ago
detect-detection-filter.h
detect-distance.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-distance.h
detect-dsize.c Add documentation url in list-keyword output. 13 years ago
detect-dsize.h
detect-engine-address-ipv4.c Fix broken tests. 14 years ago
detect-engine-address-ipv4.h
detect-engine-address-ipv6.c Fix compilation with profiling enabled. Minor unittest fixes. 14 years ago
detect-engine-address-ipv6.h
detect-engine-address.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-engine-address.h bug #454 - global check to see if address and port vars are properly configured 13 years ago
detect-engine-alert.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-engine-alert.h No longer pass StreamMsg to output for alert logging, instead use the same callback code as is used for state alerts. 13 years ago
detect-engine-analyzer.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-engine-analyzer.h rule analyser: display message for invalid signatures 13 years ago
detect-engine-content-inspection.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-engine-content-inspection.h http user agent keyword + mpm + inspection + fast pattern support added 13 years ago
detect-engine-dcepayload.c Disable dce unittests that tick off clamav. #458. 13 years ago
detect-engine-dcepayload.h
detect-engine-event.c stream: add option to match on overlapping data 13 years ago
detect-engine-event.h stream: change how retransmissions are handled and detected. 13 years ago
detect-engine-file.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-engine-file.h Change all inspect callbacks to accept TV and a tx_id param. 13 years ago
detect-engine-hcbd.c http: fix client and server body sometimes being inspected in wrong order 13 years ago
detect-engine-hcbd.h New app inspection engine introduced. Moved existing inspecting engines to use it. 13 years ago
detect-engine-hcd.c New app inspection engine introduced. Moved existing inspecting engines to use it. 13 years ago
detect-engine-hcd.h Change all inspect callbacks to accept TV and a tx_id param. 13 years ago
detect-engine-hhd.c fix uninit var usage in hhd 13 years ago
detect-engine-hhd.h New app inspection engine introduced. Moved existing inspecting engines to use it. 13 years ago
detect-engine-hmd.c New app inspection engine introduced. Moved existing inspecting engines to use it. 13 years ago
detect-engine-hmd.h Change all inspect callbacks to accept TV and a tx_id param. 13 years ago
detect-engine-hrhd.c New app inspection engine introduced. Moved existing inspecting engines to use it. 13 years ago
detect-engine-hrhd.h Change all inspect callbacks to accept TV and a tx_id param. 13 years ago
detect-engine-hrud.c New app inspection engine introduced. Moved existing inspecting engines to use it. 13 years ago
detect-engine-hrud.h Change all inspect callbacks to accept TV and a tx_id param. 13 years ago
detect-engine-hsbd.c http: fix client and server body sometimes being inspected in wrong order 13 years ago
detect-engine-hsbd.h New app inspection engine introduced. Moved existing inspecting engines to use it. 13 years ago
detect-engine-hscd.c New app inspection engine introduced. Moved existing inspecting engines to use it. 13 years ago
detect-engine-hscd.h Change all inspect callbacks to accept TV and a tx_id param. 13 years ago
detect-engine-hsmd.c New app inspection engine introduced. Moved existing inspecting engines to use it. 13 years ago
detect-engine-hsmd.h Change all inspect callbacks to accept TV and a tx_id param. 13 years ago
detect-engine-hua.c New app inspection engine introduced. Moved existing inspecting engines to use it. 13 years ago
detect-engine-hua.h Change all inspect callbacks to accept TV and a tx_id param. 13 years ago
detect-engine-iponly.c Simple IP reputation implementation 13 years ago
detect-engine-iponly.h IP Only cleanup: make most functions static. Add error message on address parsing issues. 14 years ago
detect-engine-mpm.c feature #558. 13 years ago
detect-engine-mpm.h feature #558. 13 years ago
detect-engine-payload.c build: more checking for includes 13 years ago
detect-engine-payload.h
detect-engine-port.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-engine-port.h bug #454 - global check to see if address and port vars are properly configured 13 years ago
detect-engine-proto.c Use unlikely for error treatment. 13 years ago
detect-engine-proto.h sig: Add ipv6 and ipv4 to list of protocols 13 years ago
detect-engine-siggroup.c Use unlikely for error treatment. 13 years ago
detect-engine-siggroup.h file: implement filesize keyword. #489. 13 years ago
detect-engine-sigorder.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-engine-sigorder.h Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
detect-engine-state.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-engine-state.h Simplify flow resetting on de_ctx update. Detect ctx id starts at 1. So in a flow 0 means uninitialized (thus set) and if we detect flow is not equal to detect id, we reset the sgh storage and de_state. 13 years ago
detect-engine-tag.c Use unlikely for error treatment. 13 years ago
detect-engine-tag.h Introduce host table, make tag use it 14 years ago
detect-engine-threshold.c Fix drop (and other actions) not being applied to thresholded packets. Bug #613. 13 years ago
detect-engine-threshold.h Move over src and dst thresholding to use host table. Fix a bug in threshold 'both' handling. 14 years ago
detect-engine-uri.c New app inspection engine introduced. Moved existing inspecting engines to use it. 13 years ago
detect-engine-uri.h Change all inspect callbacks to accept TV and a tx_id param. 13 years ago
detect-engine.c Simple IP reputation implementation 13 years ago
detect-engine.h New app inspection engine introduced. Moved existing inspecting engines to use it. 13 years ago
detect-fast-pattern.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-fast-pattern.h fast pattern cleanup - Remove FastPatternSupportEnabledForSigMatchList() and all it's associated structures 13 years ago
detect-file-data.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-file-data.h file-data: create initial keyword registration. 14 years ago
detect-fileext.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-fileext.h Add negation to filename and fileext, use same syntax as with content. 14 years ago
detect-filemagic.c Add documentation url in list-keyword output. 13 years ago
detect-filemagic.h Bug 585: use per detect thread libmagic ctx 13 years ago
detect-filemd5.c list-keyword: detect non built keyword 13 years ago
detect-filemd5.h filemd5: implement negated matching. 13 years ago
detect-filename.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-filename.h Add negation to filename and fileext, use same syntax as with content. 14 years ago
detect-filesize.c Add documentation url in list-keyword output. 13 years ago
detect-filesize.h file: implement filesize keyword. #489. 13 years ago
detect-filestore.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-filestore.h filestore: fix logic flag in continued stateful detection 13 years ago
detect-flags.c Use unlikely for error treatment. 13 years ago
detect-flags.h
detect-flow.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-flow.h
detect-flowbits.c Add documentation url in list-keyword output. 13 years ago
detect-flowbits.h
detect-flowint.c Add documentation url in list-keyword output. 13 years ago
detect-flowint.h
detect-flowvar.c Silence compiler warnings found by clang 13 years ago
detect-flowvar.h
detect-fragbits.c Add documentation url in list-keyword output. 13 years ago
detect-fragbits.h
detect-fragoffset.c Add documentation url in list-keyword output. 13 years ago
detect-fragoffset.h
detect-ftpbounce.c Silence compiler warnings found by clang 13 years ago
detect-ftpbounce.h
detect-gid.c Add documentation url in list-keyword output. 13 years ago
detect-gid.h
detect-http-client-body.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-http-client-body.h Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
detect-http-cookie.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-http-cookie.h
detect-http-header.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-http-header.h
detect-http-method.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-http-method.h
detect-http-raw-header.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-http-raw-header.h
detect-http-raw-uri.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-http-raw-uri.h Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
detect-http-server-body.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-http-server-body.h Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
detect-http-stat-code.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-http-stat-code.h All http_http_stat_code modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_STAT_CODE. Also remove dummy match/free functions for stat code and stat msg 14 years ago
detect-http-stat-msg.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-http-stat-msg.h
detect-http-ua.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-http-ua.h http user agent keyword + mpm + inspection + fast pattern support added 13 years ago
detect-http-uri.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-http-uri.h
detect-icmp-id.c Use unlikely for error treatment. 13 years ago
detect-icmp-id.h
detect-icmp-seq.c Add documentation url in list-keyword output. 13 years ago
detect-icmp-seq.h
detect-icode.c Add documentation url in list-keyword output. 13 years ago
detect-icode.h
detect-id.c Add documentation url in list-keyword output. 13 years ago
detect-id.h
detect-ipopts.c Add documentation url in list-keyword output. 13 years ago
detect-ipopts.h
detect-ipproto.c Add documentation url in list-keyword output. 13 years ago
detect-ipproto.h support multiple ipprotos in the same sig + unittest 14 years ago
detect-iprep.c Simple IP reputation implementation 13 years ago
detect-iprep.h Simple IP reputation implementation 13 years ago
detect-isdataat.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-isdataat.h byte_extract support for isdataat added 14 years ago
detect-itype.c Add documentation url in list-keyword output. 13 years ago
detect-itype.h
detect-l3proto.c Use unlikely for error treatment. 13 years ago
detect-l3proto.h sig: add l3_proto keyword 13 years ago
detect-luajit.c list-keyword: detect non built keyword 13 years ago
detect-luajit.h luajit: prealloc lua states to increases chances of alloc success. Luajit requires them to be in memory <2GB. 13 years ago
detect-mark.c Use unlikely for error treatment. 13 years ago
detect-mark.h
detect-metadata.c Add documentation url in list-keyword output. 13 years ago
detect-metadata.h
detect-msg.c Add documentation url in list-keyword output. 13 years ago
detect-msg.h
detect-noalert.c
detect-noalert.h
detect-nocase.c Add documentation url in list-keyword output. 13 years ago
detect-nocase.h
detect-offset.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-offset.h
detect-parse.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-parse.h code cleanup. Remove unused functions 14 years ago
detect-pcre.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-pcre.h http user agent keyword + mpm + inspection + fast pattern support added 13 years ago
detect-pkt-data.c pkt-data: don't compile unittest unless unittests are enabled 13 years ago
detect-pkt-data.h Keyword pkt_data 13 years ago
detect-pktvar.c Silence compiler warnings found by clang 13 years ago
detect-pktvar.h
detect-priority.c Add documentation url in list-keyword output. 13 years ago
detect-priority.h Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
detect-rawbytes.c spelling corrections documented in redmine bug#533 13 years ago
detect-rawbytes.h
detect-reference.c Add documentation url in list-keyword output. 13 years ago
detect-reference.h
detect-replace.c Use unlikely for error treatment. 13 years ago
detect-replace.h Add support for replace keyword. 14 years ago
detect-rev.c Add documentation url in list-keyword output. 13 years ago
detect-rev.h
detect-rpc.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-rpc.h
detect-sameip.c Add documentation url in list-keyword output. 13 years ago
detect-sameip.h
detect-seq.c Add documentation url in list-keyword output. 13 years ago
detect-seq.h
detect-sid.c Add documentation url in list-keyword output. 13 years ago
detect-sid.h
detect-ssh-proto-version.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-ssh-proto-version.h
detect-ssh-software-version.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-ssh-software-version.h
detect-ssl-state.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-ssl-state.h Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
detect-ssl-version.c Use unlikely for error treatment. 13 years ago
detect-ssl-version.h Various fixes and improvements based on feedback by Coverity analyzer. 14 years ago
detect-stream_size.c Add documentation url in list-keyword output. 13 years ago
detect-stream_size.h
detect-tag.c Use unlikely for error treatment. 13 years ago
detect-tag.h Introduce host table, make tag use it 14 years ago
detect-threshold.c Add documentation url in list-keyword output. 13 years ago
detect-threshold.h considering the tenths of a seconds in a packet, when calculating thresholds 13 years ago
detect-tls-version.c Add documentation url in list-keyword output. 13 years ago
detect-tls-version.h
detect-tls.c Add documentation url in list-keyword output. 13 years ago
detect-tls.h tls: adding support for fingerprint rule matching. 13 years ago
detect-tos.c Silence compiler warnings found by clang 13 years ago
detect-tos.h Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
detect-ttl.c Add documentation url in list-keyword output. 13 years ago
detect-ttl.h
detect-uricontent.c Use unlikely for error treatment. 13 years ago
detect-uricontent.h code cleanup - remove DetectUricontentGetLastPattern 14 years ago
detect-urilen.c Add documentation url in list-keyword output. 13 years ago
detect-urilen.h bug #341 - support for urilen check on both norm and raw buffers 14 years ago
detect-window.c Add documentation url in list-keyword output. 13 years ago
detect-window.h
detect-within.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect-within.h
detect.c Added parentheses to fix Eclipse static code analysis 13 years ago
detect.h list-keyword: detect non built keyword 13 years ago
flow-alert-sid.c Use unlikely for error treatment. 13 years ago
flow-alert-sid.h
flow-bit.c Use unlikely for error treatment. 13 years ago
flow-bit.h
flow-hash.c Fix GetUsed functions for Host, Flow and Defrag. 13 years ago
flow-hash.h flow engine: improve scalability 14 years ago
flow-manager.c Added parentheses to fix Eclipse static code analysis 13 years ago
flow-manager.h flow engine: improve scalability 14 years ago
flow-private.h Undo changes from 88b8f15663. Atomic stack implementation had a-b-a problem. 14 years ago
flow-queue.c Undo changes from 88b8f15663. Atomic stack implementation had a-b-a problem. 14 years ago
flow-queue.h Undo changes from 88b8f15663. Atomic stack implementation had a-b-a problem. 14 years ago
flow-timeout.c Added parentheses to fix Eclipse static code analysis 13 years ago
flow-timeout.h flow engine: improve scalability 14 years ago
flow-util.c Use unlikely for error treatment. 13 years ago
flow-util.h Move Flow Reference/Dereferene api from flow-util.h to flow.h. 13 years ago
flow-var.c Use unlikely for error treatment. 13 years ago
flow-var.h
flow.c Added parentheses to fix Eclipse static code analysis 13 years ago
flow.h Remove dead comment about flow reference api duplicate 13 years ago
host-queue.c Introduce host table, make tag use it 14 years ago
host-queue.h Introduce host table, make tag use it 14 years ago
host-timeout.c Simple IP reputation implementation 13 years ago
host-timeout.h Introduce host table, make tag use it 14 years ago
host.c Host: ignore usecnt add/sub result. Expose HostPrintStats. 13 years ago
host.h Host: ignore usecnt add/sub result. Expose HostPrintStats. 13 years ago
log-droplog.c Use unlikely for error treatment. 13 years ago
log-droplog.h
log-file.c Bug 585: use per detect thread libmagic ctx 13 years ago
log-file.h file extraction: add waldo option to file log module. This will store the last used file_id so extracted files won't get overwritten is Suricata is restarted. 14 years ago
log-filestore.c filestore: create file store directory if needed 13 years ago
log-filestore.h file-inspection: split 'file' output module into file-store and file-log. Store stores files. Log logs json records. 14 years ago
log-httplog.c build: more checking for includes 13 years ago
log-httplog.h
log-pcap.c Added parentheses to fix Eclipse static code analysis 13 years ago
log-pcap.h
log-tlslog.c Use unlikely for error treatment. 13 years ago
log-tlslog.h tls: adding TLS Log support 13 years ago
output.c Use unlikely for error treatment. 13 years ago
output.h SCConfLogOpenGeneric() abstraction for regular and AF_UNIX logs. 14 years ago
packet-queue.c
packet-queue.h
pkt-var.c Use unlikely for error treatment. 13 years ago
pkt-var.h
ptxdump.py fixed cuda build: portability issues and nvcc version check 14 years ago
queue.h Safer macro parenthesization and do/while use 14 years ago
reputation.c reputation: report error if host table memcap reached. Work around compilation failure with atomic fallback code. 13 years ago
reputation.h Simple IP reputation implementation 13 years ago
respond-reject-libnet11.c Add per packet profiling. 14 years ago
respond-reject-libnet11.h
respond-reject.c Add per packet profiling. 14 years ago
respond-reject.h Add per packet profiling. 14 years ago
runmode-af-packet.c Use unlikely for error treatment. 13 years ago
runmode-af-packet.h Add "workers" runmode. 14 years ago
runmode-erf-dag.c Implement single, autofp and workers run modes for DAG interfaces. Includes multiple interface support. 14 years ago
runmode-erf-dag.h Implement single, autofp and workers run modes for DAG interfaces. Includes multiple interface support. 14 years ago
runmode-erf-file.c Use unlikely for error treatment. 13 years ago
runmode-erf-file.h Update the ERF file runmodes to support autofp and single. 14 years ago
runmode-ipfw.c Rename 'worker' running mode to 'workers' 13 years ago
runmode-ipfw.h ipfw: Add support for autofp and worker runmode 14 years ago
runmode-napatech.c napatech: treat malloc error 13 years ago
runmode-napatech.h Refactor Napatech 3GD to just Napatech as Suricata is only going to support 3GD. 13 years ago
runmode-nfq.c Rename 'worker' running mode to 'workers' 13 years ago
runmode-nfq.h nfq: add worker runmode support. 14 years ago
runmode-pcap-file.c Use unlikely for error treatment. 13 years ago
runmode-pcap-file.h Implement a pkt acq loop infra with support for pcap-file. 14 years ago
runmode-pcap.c pcap: ref config according to threads count 13 years ago
runmode-pcap.h pcap: add "autofp" runmode 14 years ago
runmode-pfring.c Use unlikely for error treatment. 13 years ago
runmode-pfring.h Add "workers" runmode. 14 years ago
runmode-unix-socket.c unix-manager: add unix command socket and associated script 13 years ago
runmode-unix-socket.h unix-manager: add unix command socket and associated script 13 years ago
runmodes.c unix-manager: add unix command socket and associated script 13 years ago
runmodes.h unix-manager: add unix command socket and associated script 13 years ago
source-af-packet.c build: more checking for includes 13 years ago
source-af-packet.h af-packet: clean APFPacketVar before release. 13 years ago
source-erf-dag.c Add a packet src for every packet generated inside suricata. 13 years ago
source-erf-dag.h
source-erf-file.c Added return value to non-void function with "forever"-loop to fit 13 years ago
source-erf-file.h
source-ipfw.c ipfw: suppress non loop receive function 13 years ago
source-ipfw.h build cleanups 13 years ago
source-napatech.c Refactor Napatech 3GD to just Napatech as Suricata is only going to support 3GD. 13 years ago
source-napatech.h Refactor Napatech 3GD to just Napatech as Suricata is only going to support 3GD. 13 years ago
source-nfq-prototypes.h
source-nfq.c build: more checking for includes 13 years ago
source-nfq.h nfq: do not use mutex in 'worker' mode 14 years ago
source-pcap-file.c unix-manager: add unix command socket and associated script 13 years ago
source-pcap-file.h
source-pcap.c pcap: add capture counters in stats.log. 13 years ago
source-pcap.h Add pcap workers mode. 13 years ago
source-pfring.c pf-ring: fix build 13 years ago
source-pfring.h pf-ring: add support for checksum verif mode 14 years ago
stream-tcp-inline.c Use unlikely for error treatment. 13 years ago
stream-tcp-inline.h Add and use utility functions for checksum computing. 14 years ago
stream-tcp-private.h stream: handle case where Suricata sees 3whs-ACK but server doesn't. Bug #523. 13 years ago
stream-tcp-reassemble.c stream-tcp: fix double call to debug print function 13 years ago
stream-tcp-reassemble.h file inspection: improve logging when stream.depth limit is reached. #493. 13 years ago
stream-tcp-sack.c Use unlikely for error treatment. 13 years ago
stream-tcp-sack.h
stream-tcp-util.c
stream-tcp-util.h
stream-tcp.c Added parentheses to fix Eclipse static code analysis 13 years ago
stream-tcp.h stream: add option to match on overlapping data 13 years ago
stream.c Update suricata to use FlowReference/FlowDeReference for the ones left out 13 years ago
stream.h stream/app layer: add Truncate app layer callback that is called if stream depth is reached. Use it to trunc open files in HTTP. 13 years ago
suricata-common.h build: more cygwin cleanups 13 years ago
suricata.c unix-manager: add unix command socket and associated script 13 years ago
suricata.h unix-manager: add unix command socket and associated script 13 years ago
threads.c OpenBSD 5.2 build fixes, Unit test fix. 13 years ago
threads.h freebsd: fix warning 13 years ago
threadvars.h restructure disabling receive threads. Introduce new flag to indicate that threads have finised running 14 years ago
tm-modules.c Refactor Napatech 3GD to just Napatech as Suricata is only going to support 3GD. 13 years ago
tm-modules.h check if all packets are processed before disabling detect threads + kill all threads <= detect after FFR + other minor fixes 13 years ago
tm-queuehandlers.c Clean up packet pool at shut down. 13 years ago
tm-queuehandlers.h Clean up packet pool at shut down. 13 years ago
tm-queues.c Use unlikely for error treatment. 13 years ago
tm-queues.h
tm-threads-common.h unix-manager: add unix command socket and associated script 13 years ago
tm-threads.c unix-manager: add unix command socket and associated script 13 years ago
tm-threads.h unix-manager: add unix command socket and associated script 13 years ago
tmqh-flow.c Use unlikely for error treatment. 13 years ago
tmqh-flow.h Adapt flow tmqh counters to be atomic vars. Remove support for active flows q handler. Introduce SC_ATOMIC_SET 14 years ago
tmqh-nfq.c
tmqh-nfq.h
tmqh-packetpool.c Simple IP reputation implementation 13 years ago
tmqh-packetpool.h Clean up packet pool at shut down. 13 years ago
tmqh-ringbuffer.c Clean up packet pool at shut down. 13 years ago
tmqh-ringbuffer.h Clean up packet pool at shut down. 13 years ago
tmqh-simple.c Minor flowq updates. 14 years ago
tmqh-simple.h
unix-manager.c unix-manager: add unix command socket and associated script 13 years ago
unix-manager.h unix-manager: add unix command socket and associated script 13 years ago
util-action.c Added parentheses to fix Eclipse static code analysis 13 years ago
util-action.h util action api returns error code if it encounters wrong values parsing wrong action conf 13 years ago
util-affinity.c Convert underscores to dashes in thread affinity type names. 14 years ago
util-affinity.h Fixes for building in Cygwin. 14 years ago
util-atomic.c Fix warning about unused return of SC_ATOMIC func. 13 years ago
util-atomic.h add unittest for atomic operation with void * 13 years ago
util-binsearch.c
util-binsearch.h
util-bloomfilter-counting.c Use unlikely for error treatment. 13 years ago
util-bloomfilter-counting.h
util-bloomfilter.c Use unlikely for error treatment. 13 years ago
util-bloomfilter.h
util-buffer.c Use unlikely for error treatment. 13 years ago
util-buffer.h Fix/suppress a couple of harmless compiler warnings. 13 years ago
util-byte.c
util-byte.h Win32 compile fixes. 14 years ago
util-checksum.c Various fixes and improvements based on feedback by Coverity analyzer. 14 years ago
util-checksum.h Assume offloading in use if 1/10th of the packets has a bad checksum. 14 years ago
util-cidr.c
util-cidr.h
util-classification-config.c Silence compiler warnings found by clang 13 years ago
util-classification-config.h clean classification config API 13 years ago
util-clock.h
util-coredump-config.c Do not use underscored config vars internally. 14 years ago
util-coredump-config.h Enable/disable core dump in config (feature 319) 14 years ago
util-cpu.c build: more checking for includes 13 years ago
util-cpu.h
util-crypt.c tls: add NSS version for SHA1 computing function. 13 years ago
util-crypt.h freebsd: fix warning about redeclaration. 13 years ago
util-cuda-handlers.c Use unlikely for error treatment. 13 years ago
util-cuda-handlers.h Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
util-cuda.c Use unlikely for error treatment. 13 years ago
util-cuda.h Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
util-daemon.c suricata: add daemon-directory config variable 13 years ago
util-daemon.h
util-debug-filters.c build: more checking for includes 13 years ago
util-debug-filters.h Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
util-debug.c logging: add warning if no output module is selected 13 years ago
util-debug.h logging: add warning if no output module is selected 13 years ago
util-decode-asn1.c Use unlikely for error treatment. 13 years ago
util-decode-asn1.h
util-decode-der-get.c build: more checking for includes 13 years ago
util-decode-der-get.h TLS: add variable to store the error code in the decoder 14 years ago
util-decode-der.c build: more checking for includes 13 years ago
util-decode-der.h TLS: add variable to store the error code in the decoder 14 years ago
util-device.c Use unlikely for error treatment. 13 years ago
util-device.h Clean up csum detection output, misc fixes. 14 years ago
util-enum.c Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
util-enum.h Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
util-error.c Simple IP reputation implementation 13 years ago
util-error.h Simple IP reputation implementation 13 years ago
util-file.c Use unlikely for error treatment. 13 years ago
util-file.h stream/app layer: add Truncate app layer callback that is called if stream depth is reached. Use it to trunc open files in HTTP. 13 years ago
util-fix_checksum.c
util-fix_checksum.h
util-fmemopen.c
util-fmemopen.h
util-hash-lookup3.c fix compiler warnings 14 years ago
util-hash-lookup3.h Add a new hash datatype to do speedy lookups of read only uniform data, like md5's. 13 years ago
util-hash.c Use unlikely for error treatment. 13 years ago
util-hash.h Various fixes and improvements based on feedback by Coverity analyzer. 14 years ago
util-hashlist.c Use unlikely for error treatment. 13 years ago
util-hashlist.h Various fixes and improvements based on feedback by Coverity analyzer. 14 years ago
util-host-os-info.c Silence compiler warnings found by clang 13 years ago
util-host-os-info.h Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
util-ioctl.c Clean up & better check includes to allow Windows to build. 14 years ago
util-ioctl.h
util-logopenfile.c Fix OpenBSD compilation. 13 years ago
util-logopenfile.h SCConfLogOpenGeneric() abstraction for regular and AF_UNIX logs. 14 years ago
util-magic.c Bug 585: use per detect thread libmagic ctx 13 years ago
util-magic.h Bug 585: use per detect thread libmagic ctx 13 years ago
util-mem.h fix cppcheck analyzer warnings - bug 439 14 years ago
util-memcmp.c Fix SSE memcmp functions reading beyond the buffer. Add tests to bench them. 14 years ago
util-memcmp.h Fix memcmp checks that prevent reading past buffer boundary. 14 years ago
util-misc.c Introduce util-signal.[ch]. Move our signal setup functions here 13 years ago
util-misc.h Introduce util-signal.[ch]. Move our signal setup functions here 13 years ago
util-mpm-ac-bs.c Use unlikely for error treatment. 13 years ago
util-mpm-ac-bs.h Support for new MPM ac-bs added 14 years ago
util-mpm-ac-gfbs.c Use unlikely for error treatment. 13 years ago
util-mpm-ac-gfbs.h Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
util-mpm-ac.c Use unlikely for error treatment. 13 years ago
util-mpm-ac.h Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
util-mpm-b2g-cuda-kernel.cu Changed my email address to anoopsaldanha@gmail.com from my current one - Should have been an amend over my previous commit, but that commit's pushed out 14 years ago
util-mpm-b2g-cuda.c Use unlikely for error treatment. 13 years ago
util-mpm-b2g-cuda.h b2g cuda up, compiling and running 14 years ago
util-mpm-b2g.c Use unlikely for error treatment. 13 years ago
util-mpm-b2g.h
util-mpm-b2gc.c Use unlikely for error treatment. 13 years ago
util-mpm-b2gc.h
util-mpm-b2gm.c Use unlikely for error treatment. 13 years ago
util-mpm-b2gm.h
util-mpm-b3g.c Use unlikely for error treatment. 13 years ago
util-mpm-b3g.h
util-mpm-wumanber.c Use unlikely for error treatment. 13 years ago
util-mpm-wumanber.h
util-mpm.c Use unlikely for error treatment. 13 years ago
util-mpm.h make mpm ctx container de_ctx specific. Also introduce global variable in mpm_ctx. this is a workaround for cleaning non global mpm_ctx's since we now don't supply the de_ctx around the detection engine API 13 years ago
util-optimize.h pf-ring: protect definition of (un)likely 13 years ago
util-path.c Silence compiler warnings found by clang 13 years ago
util-path.h Add functions to determine whether a path is absolute or relative. 14 years ago
util-pidfile.c suricata: display PID file name in case of error. 13 years ago
util-pidfile.h suricata: avoid concurrent run in daemon mode 13 years ago
util-pool.c Use unlikely for error treatment. 13 years ago
util-pool.h reintroduce pool free func for cases where block alloc is not used. 13 years ago
util-print.c debuglog now uses the new mem buffer API. Improve file ctx locking to just the file write 13 years ago
util-print.h debuglog now uses the new mem buffer API. Improve file ctx locking to just the file write 13 years ago
util-privs.c Silence compiler warnings found by clang 13 years ago
util-privs.h
util-profiling-locks.c profiling: fix memory error in case of rule reload. 13 years ago
util-profiling-locks.h profiling: add per lock location profiling 14 years ago
util-profiling-rules.c profiling: fix rule profiling output sometimes missing sid,rev,gid. Bug #576. 13 years ago
util-profiling.c Use unlikely for error treatment. 13 years ago
util-profiling.h profiling: fix build on older systems 13 years ago
util-proto-name.c Win32 compile fixes. 14 years ago
util-proto-name.h Win32 compile fixes. 14 years ago
util-radix-tree.c Use unlikely for error treatment. 13 years ago
util-radix-tree.h Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
util-random.c
util-random.h
util-reference-config.c Silence compiler warnings found by clang 13 years ago
util-reference-config.h clean reference config API 13 years ago
util-ringbuffer.c Use unlikely for error treatment. 13 years ago
util-ringbuffer.h
util-rohash.c Use unlikely for error treatment. 13 years ago
util-rohash.h Add filemd5 keyword that loads a list of md5's to match a file's md5 against. 13 years ago
util-rule-vars.c Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
util-rule-vars.h Changed my email address to anoopsaldanha at gmail dot com from my current one 14 years ago
util-runmodes.c Use unlikely for error treatment. 13 years ago
util-runmodes.h runmode: Add support for IPS running mode 14 years ago
util-signal.c update clean up of old detection engine contexts for live rule swap 13 years ago
util-signal.h code cleanup for live swap 13 years ago
util-spm-bm.c Use unlikely for error treatment. 13 years ago
util-spm-bm.h Fix typo in spm prototype declaration. 14 years ago
util-spm-bs.c update all spm algos to use 16 bit pattern lengths. Should compress a lot of tables 14 years ago
util-spm-bs.h update all spm algos to use 16 bit pattern lengths. Should compress a lot of tables 14 years ago
util-spm-bs2bm.c update all spm algos to use 16 bit pattern lengths. Should compress a lot of tables 14 years ago
util-spm-bs2bm.h update all spm algos to use 16 bit pattern lengths. Should compress a lot of tables 14 years ago
util-spm.c Use unlikely for error treatment. 13 years ago
util-spm.h update all spm algos to use 16 bit pattern lengths. Should compress a lot of tables 14 years ago
util-strlcatu.c
util-strlcpyu.c
util-syslog.c
util-syslog.h
util-threshold-config.c Silence compiler warnings found by clang 13 years ago
util-threshold-config.h
util-time.c OpenBSD: introduce SCLocalTime function. 13 years ago
util-time.h OpenBSD: introduce SCLocalTime function. 13 years ago
util-unittest-helper.c Use unlikely for error treatment. 13 years ago
util-unittest-helper.h Clean up for unittests code: only compile unittest api code when unittests are enabled. Fix unittest code that wasn't wrapped in the proper UNITTESTS ifdefs. 14 years ago
util-unittest.c Use unlikely for error treatment. 13 years ago
util-unittest.h Clean up for unittests code: only compile unittest api code when unittests are enabled. Fix unittest code that wasn't wrapped in the proper UNITTESTS ifdefs. 14 years ago
util-validate.h Fix locking error in filestore handling. Add debug validate check for asserting a flow is locked. 14 years ago
util-var-name.c Use unlikely for error treatment. 13 years ago
util-var-name.h variable names global vars, global no more. Moved to detection engine ctx, a place it belongs 13 years ago
util-var.c
util-var.h
util-vector.h Use pmmintrin.h as older gcc's don't have immintrin.h it seems. 14 years ago
win32-misc.c Fix indentation of win32 files. 13 years ago
win32-misc.h Win32 compile fixes. 14 years ago
win32-service.c Fix indentation of win32 files. 13 years ago
win32-service.h
win32-syslog.h