]>
git.ipfire.org Git - thirdparty/suricata.git/log
Victor Julien [Fri, 2 Mar 2012 07:36:44 +0000 (08:36 +0100)]
file extract: improve multipart parsing and set events on some error conditions.
Victor Julien [Fri, 2 Mar 2012 07:39:09 +0000 (08:39 +0100)]
flow: Refactor how FlowPrune deals with forced timeouts, improving locking logic.
Victor Julien [Thu, 1 Mar 2012 09:46:34 +0000 (10:46 +0100)]
Another batch of minor fixed for issues found by Coverity.
Victor Julien [Wed, 29 Feb 2012 13:32:32 +0000 (14:32 +0100)]
Various improvements to error handling found by Coverity.
Anoop Saldanha [Tue, 28 Feb 2012 13:30:27 +0000 (19:00 +0530)]
code cleanup
Victor Julien [Wed, 29 Feb 2012 10:52:59 +0000 (11:52 +0100)]
Various fixes and improvements based on feedback by Coverity analyzer.
Victor Julien [Tue, 28 Feb 2012 09:29:13 +0000 (10:29 +0100)]
Add line number to warning about mangled yaml parameters. Limit number of warnings to 10.
Nikolay Denev [Sun, 26 Feb 2012 19:37:25 +0000 (21:37 +0200)]
Consistently use dashes instead of underscores in the sample config file.
Nikolay Denev [Sun, 26 Feb 2012 19:37:25 +0000 (21:37 +0200)]
Consistently use dashes instead of underscores in the sample config file.
Nikolay Denev [Sun, 26 Feb 2012 19:35:34 +0000 (21:35 +0200)]
Convert underscores to dashes in thread affinity type names.
Nikolay Denev [Fri, 24 Feb 2012 20:36:38 +0000 (22:36 +0200)]
Fix some warning message still using underscored config vars.
Nikolay Denev [Fri, 24 Feb 2012 20:18:12 +0000 (22:18 +0200)]
Do not use underscored config vars internally.
Nikolay Denev [Fri, 24 Feb 2012 19:45:40 +0000 (21:45 +0200)]
Remove the underscored "sguil_base_dir" compatibility option.
Nikolay Denev [Fri, 24 Feb 2012 13:50:43 +0000 (15:50 +0200)]
Convert config entries using underscores to dashes and emit deprecation warnings.
Martin Holste [Mon, 27 Feb 2012 16:54:44 +0000 (10:54 -0600)]
Added Shadowserver plugin.
Victor Julien [Fri, 24 Feb 2012 19:24:54 +0000 (20:24 +0100)]
file-inspection: split 'file' output module into file-store and file-log. Store stores files. Log logs json records.
Victor Julien [Fri, 24 Feb 2012 15:07:08 +0000 (16:07 +0100)]
Add more flow lock assertions to the debug validation code.
Victor Julien [Thu, 23 Feb 2012 17:40:47 +0000 (18:40 +0100)]
Fix locking error in filestore handling. Add debug validate check for asserting a flow is locked.
Martin Holste [Thu, 23 Feb 2012 15:24:18 +0000 (09:24 -0600)]
Added license.
Martin Holste [Wed, 22 Feb 2012 20:29:39 +0000 (14:29 -0600)]
Added some installation instructions to file_processor REAMDE.
Martin Holste [Wed, 22 Feb 2012 18:17:46 +0000 (12:17 -0600)]
Added contrib folder with file_processor utility which is a plugin framework for reading the files-json.log and processing and taking action based on the files observed.
Victor Julien [Thu, 23 Feb 2012 16:43:53 +0000 (17:43 +0100)]
Fix compiler warning and silence complaining unittests.
Victor Julien [Thu, 23 Feb 2012 15:29:41 +0000 (16:29 +0100)]
Misc afpacket changes.
Victor Julien [Thu, 23 Feb 2012 15:27:39 +0000 (16:27 +0100)]
Fix NULL dereference in PacketPatternSearchWithStreamCtx code.
Eric Leblond [Thu, 16 Feb 2012 16:08:54 +0000 (17:08 +0100)]
af-packet: Implement zero copy
This patch adds support for zero copy to AF_PACKET running mode.
This requires to use the 'worker' mode which is the only one where
the threading architecture is simple enough to permit this without
heavy modification.
Eric Leblond [Thu, 16 Feb 2012 16:46:53 +0000 (17:46 +0100)]
decode: add PacketSetData funtion
This patch adds a function which can be used to set the payload
of a packet when a zero copy mode is used.
Eric Leblond [Mon, 2 Jan 2012 13:47:17 +0000 (14:47 +0100)]
af-packet: mmap support
This patch adds mmap support for af-packet. Suricata now makes
use of the ring buffer feature of AF_PACKET if 'use-mmap' variable
is set to yes on an interface.
Victor Julien [Thu, 23 Feb 2012 10:23:52 +0000 (11:23 +0100)]
Config should be set up in sysconfdir/suricata. Add reference to oinkmaster guide.
Victor Julien [Thu, 16 Feb 2012 08:34:07 +0000 (09:34 +0100)]
Improve config details overview at the end of configure.
Eric Leblond [Wed, 8 Feb 2012 16:10:23 +0000 (17:10 +0100)]
build: enable af-packet by default
Eric Leblond [Wed, 8 Feb 2012 15:56:54 +0000 (16:56 +0100)]
Add sexy information messages to configure output.
Eric Leblond [Wed, 8 Feb 2012 15:56:37 +0000 (16:56 +0100)]
Fix PCRE-JIT message
Eric Leblond [Wed, 8 Feb 2012 14:14:59 +0000 (15:14 +0100)]
Remove autogen.sh generated files.
Eric Leblond [Wed, 8 Feb 2012 17:13:07 +0000 (18:13 +0100)]
Improve output
Eric Leblond [Wed, 8 Feb 2012 17:04:22 +0000 (18:04 +0100)]
del rules file deleted
Eric Leblond [Wed, 21 Sep 2011 17:55:03 +0000 (19:55 +0200)]
Add install-conf command to build system.
This patch adds support for customisation of suricata.yaml and
automatic download of emerging threat GPL rules. By running
'make install-full' after 'make install', files necessary to run
suricata are copied in the configuration directory and the latest
ruleset is downloaded and installed. Suricata can then be run
without files edition.
This patch has a special treatment for the windows build which
requires some different paths.
suricata.yaml is also updated to load all rules files provided by
emergingthreat ruleset.
Victor Julien [Wed, 22 Feb 2012 16:55:24 +0000 (17:55 +0100)]
file-inspection: support POST requests that do not use multipart.
Victor Julien [Wed, 22 Feb 2012 16:17:01 +0000 (17:17 +0100)]
file-inspection: use filename= value from Content-Disposition where available to determine the filename in GET requests.
Victor Julien [Wed, 22 Feb 2012 10:29:42 +0000 (11:29 +0100)]
Fix UtilMiscParseSizeStringTest01 unittest on 32 bit.
Anoop Saldanha [Mon, 20 Feb 2012 06:29:40 +0000 (11:59 +0530)]
All http_http_stat_code modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_STAT_CODE. Also remove dummy match/free functions for stat code and stat msg
Anoop Saldanha [Mon, 20 Feb 2012 06:13:47 +0000 (11:43 +0530)]
All http_http_stat_msg modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_STAT_MSG
Anoop Saldanha [Mon, 20 Feb 2012 06:02:42 +0000 (11:32 +0530)]
All http_http_raw_uri modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_RAW_URI
Anoop Saldanha [Mon, 20 Feb 2012 05:47:51 +0000 (11:17 +0530)]
All http_http_cookie modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_COOKIE
Anoop Saldanha [Sun, 19 Feb 2012 18:08:09 +0000 (23:38 +0530)]
All http_http_method modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_METHOD
Anoop Saldanha [Sun, 19 Feb 2012 17:49:52 +0000 (23:19 +0530)]
All http_http_raw_header modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_RAW_HEADER
Anoop Saldanha [Sun, 19 Feb 2012 11:02:28 +0000 (16:32 +0530)]
All http_http_header modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_HEADER
Anoop Saldanha [Sun, 19 Feb 2012 10:05:49 +0000 (15:35 +0530)]
All http_server_body modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_SERVER_BODY
Anoop Saldanha [Sun, 19 Feb 2012 09:08:41 +0000 (14:38 +0530)]
All http_client_body modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_CLIENT_BODY
Anoop Saldanha [Sun, 19 Feb 2012 05:22:27 +0000 (10:52 +0530)]
All uricontent modified patterns now are DETECT_CONTENT and not DETECT_URICONTENT. Step towards unifying all content based patterns. Makes way for easier management of patterns
Anoop Saldanha [Sat, 18 Feb 2012 12:33:24 +0000 (18:03 +0530)]
code cleanup. Remove unused functions
Anoop Saldanha [Sat, 18 Feb 2012 12:15:04 +0000 (17:45 +0530)]
code cleanup - replace SigMatchAppendThreshold with SigMatchAppendSMToList
Anoop Saldanha [Sat, 18 Feb 2012 12:09:01 +0000 (17:39 +0530)]
code cleanup - replace SigMatchAppendPostMatch with SigMatchAppendSMToList
Anoop Saldanha [Sat, 18 Feb 2012 12:02:08 +0000 (17:32 +0530)]
code cleanup - replace SigMatchAppendPacket with SigMatchAppendSMToList
Anoop Saldanha [Sat, 18 Feb 2012 09:31:48 +0000 (15:01 +0530)]
code cleanup - replace SigMatchAppendTag with SigMatchAppendSMToList
Anoop Saldanha [Sat, 18 Feb 2012 09:29:35 +0000 (14:59 +0530)]
code cleanup - replace SigMatchAppendDcePayload with SigMatchAppendSMToList
Anoop Saldanha [Sat, 18 Feb 2012 09:21:17 +0000 (14:51 +0530)]
code cleanup - replace SigMatchAppendPayload with SigMatchAppendSMToList
Anoop Saldanha [Sat, 18 Feb 2012 09:15:21 +0000 (14:45 +0530)]
code cleanup - replace SigMatchAppendUricontent with SigMatchAppendSMToList
Anoop Saldanha [Sat, 18 Feb 2012 08:30:39 +0000 (14:00 +0530)]
code cleanup - replace SigMatchAppendAppLayer with SigMatchAppendSMToList
Anoop Saldanha [Sat, 18 Feb 2012 07:46:40 +0000 (13:16 +0530)]
code cleanup - replace SigMatchGetLastSM with SigMatchGetLastSMFromLists
Anoop Saldanha [Sat, 18 Feb 2012 07:17:35 +0000 (12:47 +0530)]
code cleanup - remove DetectContentGetLastPattern. Replace it with SigMatchGetLastSMFromLists
Anoop Saldanha [Sat, 18 Feb 2012 06:42:47 +0000 (12:12 +0530)]
code cleanup - remove DetectContentFindNextApplicableSM
Anoop Saldanha [Sat, 18 Feb 2012 06:40:42 +0000 (12:10 +0530)]
code cleanup - remove DetectContentHasPrevSMPattern
Anoop Saldanha [Sat, 18 Feb 2012 06:39:05 +0000 (12:09 +0530)]
code cleanup - remove SigMatchGetLastPattern
Anoop Saldanha [Sat, 18 Feb 2012 06:13:05 +0000 (11:43 +0530)]
code cleanup - remove DetectUricontentGetLastPattern
Anoop Saldanha [Sat, 18 Feb 2012 05:20:54 +0000 (10:50 +0530)]
Use sm_list to differentiate between different content types while retrieving pattern ids instead of sm_type
Anoop Saldanha [Fri, 17 Feb 2012 15:18:29 +0000 (20:48 +0530)]
DetectPatternGetId() cleanup. Remove separate search element creation for uricontent. We don't need this now since we have unified content structures for content and uricontent
Victor Julien [Sat, 18 Feb 2012 16:56:38 +0000 (17:56 +0100)]
Add a print function specially for json output that escapes all characters json requires to be escaped.
Victor Julien [Thu, 16 Feb 2012 21:32:37 +0000 (22:32 +0100)]
Add referer header to .meta and json file logs.
Victor Julien [Thu, 16 Feb 2012 21:17:15 +0000 (22:17 +0100)]
Make sure that if not built against libnss, we still compile. Only no md5 for you then\!
Victor Julien [Thu, 16 Feb 2012 20:40:34 +0000 (21:40 +0100)]
Add line based log file to log-file module that logs each stored file's meta data in json records.
Victor Julien [Thu, 16 Feb 2012 20:39:37 +0000 (21:39 +0100)]
In PrintRawUriFp, consider " unprintable.
Victor Julien [Thu, 16 Feb 2012 18:27:05 +0000 (19:27 +0100)]
Initial on the fly MD5 calculation for extracted files using libnss.
Anoop Saldanha [Wed, 15 Feb 2012 17:27:34 +0000 (22:57 +0530)]
delete detect-recursive.[ch]
Anoop Saldanha [Wed, 15 Feb 2012 13:46:34 +0000 (19:16 +0530)]
feature #414 - support listing supported keywords. Remove support for dummy keywords __address__, __proto__, __port__. Remove support for recursive keyword and all references to it
Anoop Saldanha [Wed, 15 Feb 2012 15:18:07 +0000 (20:48 +0530)]
remove det_ctx->payload_offset and use det_ctx->buffer_offset. Update hscd and hsmd to use the new generic content inspection engine
Anoop Saldanha [Wed, 8 Feb 2012 07:59:39 +0000 (13:29 +0530)]
remove all old content inspection engines and references to them. We have cleaned the entire content inspection phase and improved alert accuracy
Anoop Saldanha [Tue, 7 Feb 2012 19:03:19 +0000 (00:33 +0530)]
unify payload detection engines + fix other bugs in pcre init
Anoop Saldanha [Tue, 7 Feb 2012 08:13:30 +0000 (13:43 +0530)]
raw urilen inspection moves to raw uri list. Won't make any difference wrt inspection
Anoop Saldanha [Wed, 15 Feb 2012 10:11:24 +0000 (15:41 +0530)]
rebase commit for hscd and hsmd patches
Anoop Saldanha [Fri, 3 Feb 2012 14:27:11 +0000 (19:57 +0530)]
fix seg fault due to wrong sm list access in hscd
Anoop Saldanha [Thu, 26 Jan 2012 11:37:09 +0000 (17:07 +0530)]
fast pattern unittests added for http server body
Anoop Saldanha [Thu, 26 Jan 2012 11:26:11 +0000 (16:56 +0530)]
Support http stat code detection engine, fast pattern(mpm engine included). Fix http stat code setup function. Fix pcre option for stat msg keyword. With this the pcre options for server_body is Q, for stat_msg is Y and for stat_code is S
Anoop Saldanha [Wed, 25 Jan 2012 18:50:24 +0000 (00:20 +0530)]
Support http stat msg detection engine, fast pattern(mpm engine included). Fix http stat msg setup function. Fix pcre option for stat msg keyword
Victor Julien [Sun, 12 Feb 2012 18:30:43 +0000 (19:30 +0100)]
Fix path handling for including rule files on win32.
Victor Julien [Sat, 11 Feb 2012 14:43:09 +0000 (15:43 +0100)]
Allow other yaml files to be included in the main yaml.
Victor Julien [Fri, 10 Feb 2012 13:49:03 +0000 (14:49 +0100)]
Fix a FP with negated filemagic inspection.
Victor Julien [Thu, 9 Feb 2012 05:58:48 +0000 (06:58 +0100)]
Add atomics to ticks unittests.
Victor Julien [Wed, 8 Feb 2012 14:33:03 +0000 (09:33 -0500)]
Minor layout fixes.
Victor Julien [Wed, 8 Feb 2012 11:44:53 +0000 (06:44 -0500)]
Napatech code formatting fixes.
Victor Julien [Wed, 8 Feb 2012 11:36:05 +0000 (06:36 -0500)]
Fix compilation without napatech tech support enabled.
Victor Julien [Wed, 8 Feb 2012 10:45:28 +0000 (05:45 -0500)]
Initial Napatech support by Randy Caldejon / nPulse.
Anoop Saldanha [Mon, 6 Feb 2012 15:04:01 +0000 (20:34 +0530)]
fix compilation error for the new http response header mpm feature
Anoop Saldanha [Mon, 6 Feb 2012 14:59:46 +0000 (20:29 +0530)]
fix debug messages that have references to the old mpm contexts
Anoop Saldanha [Wed, 18 Jan 2012 07:51:54 +0000 (13:21 +0530)]
code cleanup over last 2 commits
Anoop Saldanha [Wed, 18 Jan 2012 05:44:09 +0000 (11:14 +0530)]
if a signature is non-tcp, it's always a packet sig
Anoop Saldanha [Sun, 15 Jan 2012 16:38:58 +0000 (22:08 +0530)]
support splitting mpm ctxs based on direction v2
Anoop Saldanha [Mon, 6 Feb 2012 19:22:45 +0000 (00:52 +0530)]
Fix bug in ac-bs search function
Anoop Saldanha [Mon, 6 Feb 2012 14:39:21 +0000 (20:09 +0530)]
treate ac-bs auto as single context
Anoop Saldanha [Tue, 31 Jan 2012 11:47:35 +0000 (17:17 +0530)]
Support for new MPM ac-bs added
Victor Julien [Mon, 6 Feb 2012 16:31:06 +0000 (17:31 +0100)]
Disable unittest that fails without libnet support.