126 Commits (00e4dde6a6ed77c64b0653f04bec9136ded9226d)

Author	SHA1	Message	Date
Victor Julien	e92ab40d39	Fix compilation for non-DEBUG case.	15 years ago
Victor Julien	2db06cc79e	Improve Inline reassembly wrt to GAP handling. Add more tests.	15 years ago
Victor Julien	4c82c0e750	Improve RawInline reassembly: remove unnecessary segments from the stream in an earlier stage. Test this properly.	15 years ago
Victor Julien	3a774165fa	Initial version of a inline raw reassembly function that reassembles in a sliding window. Introduce new unittest helpers for stream reassembly.	15 years ago
Victor Julien	abdffadc1c	Add a new app layer reassembly function that is for inline use, and use it when the stream engine is in inline mode.	15 years ago
Victor Julien	bff70eed6d	Update to depth code. Get segment from the correct pool when a payload is truncated.	15 years ago
Victor Julien	66c40f782c	Have reassembly errors also set a stream event.	15 years ago
Victor Julien	0f072648e6	Another iteration of the reassembly depth enforcement, now considering retransmissions.	15 years ago
Victor Julien	16cd31a408	Remove unused pseudo packet reassembly code.	15 years ago
Victor Julien	bf88a6de09	Add depth comment.	15 years ago
Victor Julien	a26768ce7a	Change the way the reassembly depth is enforced. Ignore retransmissions, get rid of per session counter.	15 years ago
Victor Julien	aa04d9eefb	Improve stream gap handling. Instead of giving up as soon as we see a gap we now wait much longer before we decide it's a gap.	15 years ago
Victor Julien	2849d2b1d3	Initial code for stream 'inline' mode: packets that are (partly) overlapping with already accepted packets (meaning in the streams seg list) are rewritten to make sure they contain the exact same data.	15 years ago
Victor Julien	8b5f553a35	Inspect a pseudo packet upon receiving a RST so that we are sure both sides of the TCP session are inspected.	15 years ago
Gurvinder Singh	55a863359c	support for pseudo packet creation from reassembled stream segments	15 years ago
Victor Julien	44e678b86b	Comment out disabled unittests.	15 years ago
Victor Julien	1d971b53a6	Update all unittests	15 years ago
Victor Julien	b0901ab30d	Fix compilation with --enable-debug	15 years ago
Victor Julien	61a9936d55	Inspect a pseudo packet upon receiving a RST so that we are sure both sides of the TCP session are inspected.	15 years ago
Gurvinder Singh	00f21f34e8	support for pseudo packet creation from reassembled stream segments	15 years ago
Victor Julien	8fa5a2c025	Split applayer and raw stream reassembly ... Split stream reassembly in 2 parts: a part that sends ack'd data to the app layer parsers as soon as it's available, and another part that queues up data into larger chunks for raw inspection.	15 years ago
Victor Julien	dda6d3e07b	Add error counters.	15 years ago
Victor Julien	4ae7144876	Fix 2 cases where overlapping data in the stream engine wouldn't be properly handled potentially causing the wrong data being used in stream reassembly.	15 years ago
Eric Leblond	1db4aadd16	Supress usage of Packet declaration in tests. ... For convenience, a massive usage of 'Packet p;' declaration has been done in the tests function. Although this was completely legal, this is not possible anymore because of the new Packet allocation structure. This massive patch modifies all suricata files to use a SCMalloc allocated pointer to Packet instead. This patch has been done using coccinelle (http://coccinelle.lip6.fr) which is a semantic patching tool. This ensures that things like call to SCFree() should have not been forget because the semantic patch explicitly forces the call to SCFree(p) before each return. With this patch all unittests are running fine with a small and a big default packet size.	15 years ago
Gurvinder Singh	892dea31e4	added the counter for tcp.segment_memcap_drop to show the dropped segments count due to memory limit	15 years ago
Gurvinder Singh	6a5bc52461	support for several tcp evasion attacks. Thanks to Judy Novak and G2 Inc for reporting them	15 years ago
Victor Julien	1d73e1fb7e	Small update to the ssh module: fix a valgrind warning and a couple of compiler warnings. Do a few small style updates.	15 years ago
Pablo Rincon	9d7baa7a9f	Adding ssh app layer module with two new keywords: ssh.protoversion and ssh.softwareversion	15 years ago
Gurvinder Singh	0dab0e3935	fix the reassembly depth test (bug 216)	15 years ago
Victor Julien	a9e78871fe	Really fix bug 205 this time, repair a broken unittest.	15 years ago
Victor Julien	196e572daa	Make sure holding up to_client reassembly stops after the proto is detected or we're sure we'll never detect it. Fixes issues related to bug 205.	15 years ago
Pablo Rincon	4c94a27b71	Fix bug 205 (at stream-tcp-reassemble)	15 years ago
Gurvinder Singh	f0928a4555	support for enforcing the depth until when the reassembly will be performed	15 years ago
Victor Julien	66dee577d7	Force stream reassembly on streams where we didn't yet detect the protocol if the stream is closing.	15 years ago
Gurvinder Singh	8b0ca4f628	support for seperate memcaps for reassembly and stream engine	15 years ago
Victor Julien	92858a211d	Fix STREAM_EOF flag overwriting STREAM_START flag on short streams. This made us miss short HTTP sessions.	15 years ago
Victor Julien	a3ff0e7210	Don't scan TCP packet payload if it was added to the stream. Inspect the tcp stream with the correct packet. Should fix #184 and #185.	15 years ago
Pablo Rincon	8cc525c939	UDP support at AppLayer message handling	15 years ago
William Metcalf	cc76aa4bc6	properly init flows inside of unit-tests caused lock-up when falling back to using mutex locks	15 years ago
Victor Julien	9a08d6c11c	Fixes to stream pattern matching.	15 years ago
Victor Julien	81f2499834	Store stream msgs processed by the app layer in the tcp session so they can be inspected by the detection module as well. The detection module returns them to the pool.	15 years ago
Victor Julien	c26434fef1	Move flow use cnt to atomic and outside of the flow mutex protection.	15 years ago
William Metcalf	2eef905c07	GPL and Copyright header updates.	15 years ago
Gurvinder Singh	5fe1dc1d24	support for sslv2/sslv3 their unit tests and better stream no reassembly flag handling	15 years ago
Victor Julien	70b32f7380	First stab at creating a stateful detection engine. ... Stateful detection for app layer detection keywords, except uricontent. Stores it's partial results in the flow structure. Other modifications: - Generalize transaction tracking, logging and inspection. - Adapt http and dcerpc to use the new transaction handling. - Stream engine now always notifies app layer of a stream eof. This commit fixes bug #124.	15 years ago
Gerardo Iglesias Galvan	9f4fae5b1a	Fix inconsistent use of dynamic memory allocation	15 years ago
Victor Julien	ecf5a8fbcc	Fix broken stream unittest.	15 years ago
Victor Julien	7a427ec7f4	Switch to pattern id based results checking in the mpm. Move app layer proto detection towards a more signature based approach.	15 years ago
William Metcalf	ce01927515	Import of GPLv2 Header 050410	15 years ago
Victor Julien	b6a45fd1a4	Hack around cornercase in debug code in stream engine. Works around #140.	15 years ago