Bug #533 » 01-suricata-spelling.patch
| src/runmode-af-packet.c | ||
|---|---|---|
|
aconf->iface);
|
||
|
ConfGetChildValueBool(if_root, "defrag", (int *)&defrag);
|
||
|
if (defrag) {
|
||
|
SCLogInfo("Using defrag kernel functionnality for AF_PACKET (iface %s)",
|
||
|
SCLogInfo("Using defrag kernel functionality for AF_PACKET (iface %s)",
|
||
|
aconf->iface);
|
||
|
defrag = PACKET_FANOUT_FLAG_DEFRAG;
|
||
|
}
|
||
|
-- a/src/detect-dsize.c
|
||
|
++ b/src/detect-dsize.c
|
||
| ... | ... | |
|
}
|
||
|
}
|
||
|
SCLogDebug("dsize parsed succesfully dsize: %"PRIu16" dsize2: %"PRIu16"",dd->dsize,dd->dsize2);
|
||
|
SCLogDebug("dsize parsed successfully dsize: %"PRIu16" dsize2: %"PRIu16"",dd->dsize,dd->dsize2);
|
||
|
SCFree(value1);
|
||
|
SCFree(mode);
|
||
|
-- a/src/detect.c
|
||
|
++ b/src/detect.c
|
||
| ... | ... | |
|
}
|
||
|
} else {
|
||
|
/* we report the total of files and rules successfully loaded and failed */
|
||
|
SCLogInfo("%" PRId32 " rule files processed. %" PRId32 " rules succesfully loaded, %" PRId32 " rules failed", cntf, cnt, sigtotal-cnt);
|
||
|
SCLogInfo("%" PRId32 " rule files processed. %" PRId32 " rules successfully loaded, %" PRId32 " rules failed", cntf, cnt, sigtotal-cnt);
|
||
|
}
|
||
|
if (ret < 0 && de_ctx->failure_fatal) {
|
||
|
-- a/src/detect-engine-siggroup.c
|
||
|
++ b/src/detect-engine-siggroup.c
|
||
| ... | ... | |
|
* \param sgh Pointer to the SigGroupHead.
|
||
|
*
|
||
|
* \retval 0 On success, i.e. on either the detection engine context being NULL
|
||
|
* or on succesfully allocating memory and updating it with relevant
|
||
|
* or on successfully allocating memory and updating it with relevant
|
||
|
* data.
|
||
|
* \retval -1 On failure.
|
||
|
*/
|
||
| ... | ... | |
|
* \param sgh Pointer to the SigGroupHead.
|
||
|
*
|
||
|
* \retval 0 On success, i.e. on either the detection engine context being NULL
|
||
|
* or on succesfully allocating memory and updating it with relevant
|
||
|
* or on successfully allocating memory and updating it with relevant
|
||
|
* data.
|
||
|
* \retval -1 On failure.
|
||
|
*/
|
||
| ... | ... | |
|
* \param sgh Pointer to the SigGroupHead.
|
||
|
*
|
||
|
* \retval 0 On success, i.e. on either the detection engine context being NULL
|
||
|
* or on succesfully allocating memory and updating it with relevant
|
||
|
* or on successfully allocating memory and updating it with relevant
|
||
|
* data.
|
||
|
* \retval -1 On failure.
|
||
|
*/
|
||
|
-- a/src/util-debug.c
|
||
|
++ b/src/util-debug.c
|
||
| ... | ... | |
|
if (log_level < SC_LOG_NONE || log_level > SC_LOG_DEBUG) {
|
||
|
#ifndef UNITTESTS
|
||
|
printf("Warning: Supplied log_level_override for op_interface \"%s\" "
|
||
|
"is invalid. Defaulting to not specifing an override\n",
|
||
|
"is invalid. Defaulting to not specifying an override\n",
|
||
|
iface_name);
|
||
|
#endif
|
||
|
log_level = SC_LOG_NOTSET;
|
||
|
-- a/src/alert-pcapinfo.c
|
||
|
++ b/src/alert-pcapinfo.c
|
||
| ... | ... | |
|
* \author Eric Leblond <eric@regit.org>
|
||
|
*
|
||
|
* Logs alerts in a line based text format suitable for interaction
|
||
|
* with wireshark or an other pcap file analysis tools.
|
||
|
* with wireshark or another pcap file analysis tools.
|
||
|
*
|
||
|
* The format of the logging is:
|
||
|
* Packet number:GID of matching signature:SID of signature:REV of signature:Flow:To Server:To Client:0:0:Signature Message
|
||
|
-- a/src/util-runmodes.c
|
||
|
++ b/src/util-runmodes.c
|
||
| ... | ... | |
|
if (ModThreadsCount(aconf) > 1) {
|
||
|
SCLogWarning(SC_ERR_UNIMPLEMENTED, "'Auto' running mode does not honor 'threads'"
|
||
|
" variable (set on '%s'). Please use an other mode as"
|
||
|
" variable (set on '%s'). Please use another mode as"
|
||
|
" 'autofp' or 'worker'",
|
||
|
live_dev);
|
||
|
}
|
||
| ... | ... | |
|
if (ModThreadsCount(aconf) > 1) {
|
||
|
SCLogWarning(SC_ERR_UNIMPLEMENTED, "'Auto' running mode does not honor 'threads'"
|
||
|
" variable (set on '%s'). Please use an other mode as"
|
||
|
" variable (set on '%s'). Please use another mode as"
|
||
|
" 'autofp' or 'worker'",
|
||
|
live_dev);
|
||
|
}
|
||
|
-- a/suricata.yaml.in
|
||
|
++ b/suricata.yaml.in
|
||
| ... | ... | |
|
# a line based log to used with pcap file study.
|
||
|
# this module is dedicated to offline pcap parsing (empty output
|
||
|
# if used with an other kind of input). It can interoperate with
|
||
|
# if used with another kind of input). It can interoperate with
|
||
|
# pcap parser like wireshark via the suriwire plugin.
|
||
|
- pcap-info:
|
||
|
enabled: no
|
||
|
-- a/src/detect-depth.c
|
||
|
++ b/src/detect-depth.c
|
||
| ... | ... | |
|
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
|
||
|
if (pm == NULL) {
|
||
|
SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "depth needs "
|
||
|
"preceeding content option for dcerpc sig");
|
||
|
"preceding content option for dcerpc sig");
|
||
|
if (dubbed)
|
||
|
SCFree(str);
|
||
|
return -1;
|
||
| ... | ... | |
|
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]);
|
||
|
if (pm == NULL) {
|
||
|
SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "depth needs "
|
||
|
"preceeding content, uricontent option, http_client_body, "
|
||
|
"preceding content, uricontent option, http_client_body, "
|
||
|
"http_server_body, http_header option, http_raw_header option, "
|
||
|
"http_method option, http_cookie, http_raw_uri, "
|
||
|
"http_stat_msg, http_stat_code or http_user_agent option");
|
||
| ... | ... | |
|
break;
|
||
|
default:
|
||
|
SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "depth needs a preceeding "
|
||
|
SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "depth needs a preceding "
|
||
|
"content (or uricontent) option");
|
||
|
goto error;
|
||
|
}
|
||
|
-- a/src/detect-distance.c
|
||
|
++ b/src/detect-distance.c
|
||
| ... | ... | |
|
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]);
|
||
|
if (pm == NULL) {
|
||
|
SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs "
|
||
|
"preceeding content, uricontent option, http_client_body, "
|
||
|
"preceding content, uricontent option, http_client_body, "
|
||
|
"http_server_body, http_header, http_raw_header, http_method, "
|
||
|
"http_cookie, http_raw_uri, http_stat_msg, http_stat_code "
|
||
|
"or http_user_agent option");
|
||
| ... | ... | |
|
cd = (DetectContentData *)pm->ctx;
|
||
|
if (cd == NULL) {
|
||
|
SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "distance needs two "
|
||
|
"preceeding content or uricontent options");
|
||
|
"preceding content or uricontent options");
|
||
|
goto error;
|
||
|
}
|
||
| ... | ... | |
|
default:
|
||
|
SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "distance needs two "
|
||
|
"preceeding content or uricontent options");
|
||
|
"preceding content or uricontent options");
|
||
|
goto error;
|
||
|
}
|
||
|
-- a/src/detect-http-cookie.c
|
||
|
++ b/src/detect-http-cookie.c
|
||
| ... | ... | |
|
s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]);
|
||
|
if (pm == NULL) {
|
||
|
SCLogError(SC_ERR_HTTP_COOKIE_RELATIVE_MISSING, "http_cookie with "
|
||
|
"a distance or within requires preceeding http_cookie "
|
||
|
"a distance or within requires preceding http_cookie "
|
||
|
"content, but none was found");
|
||
|
goto error;
|
||
|
}
|
||
|
-- a/src/detect-http-method.c
|
||
|
++ b/src/detect-http-method.c
|
||
| ... | ... | |
|
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) {
|
||
|
SCLogError(SC_ERR_HTTP_METHOD_NEEDS_PRECEEDING_CONTENT, "http_method "
|
||
|
"modifies preceeding \"content\", but none was found");
|
||
|
"modifies preceding \"content\", but none was found");
|
||
|
SCReturnInt(-1);
|
||
|
}
|
||
| ... | ... | |
|
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
|
||
|
if (sm == NULL) {
|
||
|
SCLogError(SC_ERR_HTTP_METHOD_NEEDS_PRECEEDING_CONTENT, "http_method "
|
||
|
"modifies preceeding \"content\", but none was found");
|
||
|
"modifies preceding \"content\", but none was found");
|
||
|
SCReturnInt(-1);
|
||
|
}
|
||
| ... | ... | |
|
s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]);
|
||
|
if (pm == NULL) {
|
||
|
SCLogError(SC_ERR_HTTP_METHOD_RELATIVE_MISSING, "http_method with "
|
||
|
"a distance or within requires preceeding http_method "
|
||
|
"a distance or within requires preceding http_method "
|
||
|
"content, but none was found");
|
||
|
goto error;
|
||
|
}
|
||
|
-- a/src/detect-nocase.c
|
||
|
++ b/src/detect-nocase.c
|
||
| ... | ... | |
|
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH],
|
||
|
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]);
|
||
|
if (pm == NULL) {
|
||
|
SCLogError(SC_ERR_NOCASE_MISSING_PATTERN, "\"nocase\" needs a preceeding "
|
||
|
SCLogError(SC_ERR_NOCASE_MISSING_PATTERN, "\"nocase\" needs a preceding "
|
||
|
"content, uricontent, http_client_body, http_server_body, "
|
||
|
"http_header, http_method, http_uri, http_cookie, "
|
||
|
"http_raw_uri, http_stat_msg, http_stat_code or http_user_agent "
|
||
| ... | ... | |
|
break;
|
||
|
/* should never happen */
|
||
|
default:
|
||
|
SCLogError(SC_ERR_NOCASE_MISSING_PATTERN, "\"nocase\" needs a preceeding "
|
||
|
SCLogError(SC_ERR_NOCASE_MISSING_PATTERN, "\"nocase\" needs a preceding "
|
||
|
"content, uricontent, http_client_body, http_server_body, "
|
||
|
"http_header, http_method, http_uri, http_cookie or "
|
||
|
"http_raw_uri option");
|
||
|
-- a/src/detect-offset.c
|
||
|
++ b/src/detect-offset.c
|
||
| ... | ... | |
|
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
|
||
|
if (pm == NULL) {
|
||
|
SCLogError(SC_ERR_OFFSET_MISSING_CONTENT, "offset needs "
|
||
|
"preceeding content option for dcerpc sig");
|
||
|
"preceding content option for dcerpc sig");
|
||
|
if (dubbed)
|
||
|
SCFree(str);
|
||
|
return -1;
|
||
| ... | ... | |
|
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]);
|
||
|
if (pm == NULL) {
|
||
|
SCLogError(SC_ERR_OFFSET_MISSING_CONTENT, "offset needs "
|
||
|
"preceeding content or uricontent option, http_client_body, "
|
||
|
"preceding content or uricontent option, http_client_body, "
|
||
|
"http_header, http_raw_header, http_method, "
|
||
|
"http_cookie, http_raw_uri, http_stat_msg, "
|
||
|
"http_stat_code or http_user_agent option");
|
||
| ... | ... | |
|
break;
|
||
|
default:
|
||
|
SCLogError(SC_ERR_OFFSET_MISSING_CONTENT, "offset needs a preceeding"
|
||
|
SCLogError(SC_ERR_OFFSET_MISSING_CONTENT, "offset needs a preceding"
|
||
|
" content keyword");
|
||
|
goto error;
|
||
|
}
|
||
|
-- a/src/detect-parse.c
|
||
|
++ b/src/detect-parse.c
|
||
| ... | ... | |
|
DETECT_BYTEJUMP, sm->prev);
|
||
|
if (pm == NULL) {
|
||
|
SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "within needs two "
|
||
|
"preceeding content or uricontent options");
|
||
|
"preceding content or uricontent options");
|
||
|
SCReturnInt(0);
|
||
|
} else {
|
||
|
break;
|
||
|
-- a/src/detect-rawbytes.c
|
||
|
++ b/src/detect-rawbytes.c
|
||
| ... | ... | |
|
SigMatch *pm = SigMatchGetLastSMFromLists(s, 2,
|
||
|
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
|
||
|
if (pm == NULL) {
|
||
|
SCLogError(SC_ERR_RAWBYTES_MISSING_CONTENT, "\"rawbytes\" needs a preceeding content option");
|
||
|
SCLogError(SC_ERR_RAWBYTES_MISSING_CONTENT, "\"rawbytes\" needs a preceding content option");
|
||
|
SCReturnInt(-1);
|
||
|
}
|
||
| ... | ... | |
|
break;
|
||
|
}
|
||
|
default:
|
||
|
SCLogError(SC_ERR_RAWBYTES_MISSING_CONTENT, "\"rawbytes\" needs a preceeding content option");
|
||
|
SCLogError(SC_ERR_RAWBYTES_MISSING_CONTENT, "\"rawbytes\" needs a preceding content option");
|
||
|
SCReturnInt(-1);
|
||
|
}
|
||
|
-- a/src/detect-replace.c
|
||
|
++ b/src/detect-replace.c
|
||
| ... | ... | |
|
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
|
||
|
if (pm == NULL) {
|
||
|
SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "replace needs"
|
||
|
"preceeding content option for raw sig");
|
||
|
"preceding content option for raw sig");
|
||
|
SCFree(str);
|
||
|
return -1;
|
||
|
}
|
||
|
-- a/src/detect-within.c
|
||
|
++ b/src/detect-within.c
|
||
| ... | ... | |
|
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]);
|
||
|
if (pm == NULL) {
|
||
|
SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "\"within\" requires "
|
||
|
"preceeding content, uricontent, http_client_body, "
|
||
|
"preceding content, uricontent, http_client_body, "
|
||
|
"http_server_body, http_header, http_raw_header, "
|
||
|
"http_method, http_cookie, http_raw_uri, "
|
||
|
"http_stat_msg, http_stat_code or http_user_agent "
|
||
| ... | ... | |
|
default:
|
||
|
SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs two "
|
||
|
"preceeding content or uricontent options");
|
||
|
"preceding content or uricontent options");
|
||
|
goto error;
|
||
|
}
|
||