244 Commits (05e87bf32ecb047b6da09cfb04771b5992f3d63b)

Author	SHA1	Message	Date
Victor Julien	6b2fb3fd5d	Fix minor format string issues	11 years ago
Jason Ish	75d21851cf	afl - Don't fail if app-layer proto enabled value is NULL. ... Found by using AFL on suricata.yaml.	11 years ago
Victor Julien	3083f51cc6	detect:pass DetectEngineCtx to port parsing ... Preparation for prefix handling in port parsing.	12 years ago
DIALLO David	bfc871ce85	Update AppLayerProtoDetectPrintProbingParsers with Modbus protocol	12 years ago
Victor Julien	c779065d35	Bug 1329: error out on invalid rule protocol ... Due to a logic error in AppLayerProtoDetectGetProtoByName invalid protocols would not be detected as such. Instead of ALPROTO_UNKNOWN ALPROTO_MAX was returned. Bug #1329	12 years ago
Ken Steele	ba1e2ed69d	Fix Boyer Moore Nocase bug where BoyerMooreCtxToNocase was missing. ... Whenever DETECT_CONTENT_NOCASE is set for a BoyerMoore matcher, the function BoyerMooreCtxToNocase() must be called. This call was missing in AppLayerProtoDetectPMRegisterPattern(). Also created BoyerMooreNocaseCtxInit() that calls BoyerMooreCtxToNocase() to make some code cleaner and safer.	12 years ago
Ken Steele	967f7aefde	Store Boyer Moore no case strings in lower case. ... Rather than converting the search string to lower case while searching, convert it to lowercase during initialization. Changes the Boyer Moore search API for take BmCtx Change the API for BoyerMoore to take a BmCtx rather than the two parts that are stored in the context. Which is how it is mostly used. This enforces always calling BoyerMooreCtxToNocase() to convert to no-case. Use CtxInit and CtxDeinit functions to create and destroy the context, even in unit tests.	12 years ago
jeka	dc1599e0dc	bugfix in debug mode: ... removed function calls from SCReturnX macros	12 years ago
Victor Julien	3df904475c	proto-detect: masks cleanup ... The direction specific masks were not used correctly. The toserver ones were only used for 'dp' registrations, the toclient ones only for 'sp'. The patch merges them.	12 years ago
Victor Julien	8252416c10	proto-detect: update port logic ... If a flow matches both an 'sp' based PP registration and a 'dp' based, until now we would only check the 'dp' one. This patch changes that. It will inspect both.	12 years ago
Victor Julien	eae5b1ba35	app-layer: proto detection update ... Instead of the notion of toserver and toclient protocol detection, use destination port and source port. Independent of the data direction, the flow's port settings will be used to find the correct probing parser, where we first try the dest port, and if that fails the source port. Update the configuration file format, where toserver is replaced by 'dp' and toclient by 'sp'. Toserver is intrepreted as 'dp' and toclient as 'sp' for backwards compatibility. Example for dns: dns: # memcaps. Globally and per flow/state. #global-memcap: 16mb #state-memcap: 512kb # How many unreplied DNS requests are considered a flood. # If the limit is reached, app-layer-event:dns.flooded; will match. #request-flood: 500 tcp: enabled: yes detection-ports: dp: 53 udp: enabled: yes detection-ports: dp: 53 Like before, progress of protocol detection is tracked per flow direction. Bug #1142.	12 years ago
Victor Julien	ab10c0a099	app-layer: tell pp registrar if config was found ... The probing parser registration function AppLayerProtoDetectPPParseConfPorts was a void, meaning it would give no feedback to the registering protocol implementation. If a config was missing, it would just give up. This patch changes it to return a bool. 0 if no config was found, 1 if a config was found. This allows the caller to setup a default case.	13 years ago
Victor Julien	ad7eff555d	app-layer-proto: speed up ... AppLayer Proto detection code uses a mix of pattern search and "probing parsers". The pattern search validates potential matches using a single pattern search algo. The code was using SpmSearch for this, but this made it inefficient as it builds a BoyerMoore context for each search. This lead to significant memory pressure, especially on high speed/bandwidth boxes. This patch switches the search calls to BoyerMoore and BoyerMoore- Nocase directly. This can be done as the ctx' were available already.	13 years ago
Victor Julien	634eb1d35c	app-layer proto detect: optimization ... Don't use FlowGetProtoMapping at runtime, use f->protomap instead. Add safety check to make sure its value is within range, as it's used to index an array. Update unittests to initialized flows (somewhat).	13 years ago
Victor Julien	4f1f395bb5	Coverity 1153935: fix confusing sizeof	13 years ago
Victor Julien	1f00ff6ab3	App-layer proto detect cleanups ... Remove unnecessay inlining. Rename functions with wrong naming scheme. E.g. AllocAppLayer.. instead of AppLayer..Alloc. Use AppProto instead of uint16_t. Convert u16 ipproto cases to u8.	13 years ago
Victor Julien	9952db6d6e	Fix crash in AppLayer Proto Detect ... The App Proto Detect code would use the wrong pattern count to index a results array, leading to SEGVs. Bug #1080.	13 years ago
Victor Julien	0ec375d95a	stream msg: remove structure	13 years ago
Victor Julien	446e68adca	app-layer: only typedef opaque pointers once	13 years ago
Victor Julien	3b8e9ffbe9	app layer: void -> AppLayerProtoDetectThreadCtx ... User AppLayerProtoDetectThreadCtx ptr instead of void.	13 years ago
Victor Julien	8dbf7a0d78	Update tests to use AppLayerParserThreadCtx ptr instead of void. Fix a few bugs uncovered by this.	13 years ago
Victor Julien	fdefb65be4	app-layer: rename AppLayerThreadCtx funcs ... AppLayerParserGetCtxThread -> AppLayerParserThreadCtxAlloc AppLayerParserDestroyCtxThread -> AppLayerParserThreadCtxFree	13 years ago
Victor Julien	f5f148805c	app layer: uint16_t alproto -> AppProto alproto ... This conversion was missing in a couple of places.	13 years ago
Victor Julien	5cdeadb33d	Use u8 for ipproto ... In a few places in app layer and unittests u16 was used.	13 years ago
Victor Julien	30f16ee446	Rename AppLayerProtoDetectCtxThread -> AppLayerProtoDetectThreadCtx	13 years ago
Victor Julien	67053e6ed0	Fix AppLayerProtoDetectPMFreeSignature related valgrind errors	13 years ago
Victor Julien	ff16d6fa53	app proto detect: fix valgrind test warnings ... Only in unittests when debug is enabled would valgrind warn about a print statement.	13 years ago
Victor Julien	a456bd8181	Cleanup and fix scan-build warning ... Add comments and slightly refactor to make function more understandable and fix a scan-build warning too.	13 years ago
Victor Julien	59327e0fd4	Various style fixes	13 years ago
Anoop Saldanha	429c6388f6	App layer API rewritten. The main files in question are: ... app-layer.[ch], app-layer-detect-proto.[ch] and app-layer-parser.[ch]. Things addressed in this commit: - Brings out a proper separation between protocol detection phase and the parser phase. - The dns app layer now is registered such that we don't use "dnstcp" and "dnsudp" in the rules. A user who previously wrote a rule like this - "alert dnstcp....." or "alert dnsudp....." would now have to use, alert dns (ipproto:tcp;) or alert udp (app-layer-protocol:dns;) or alert ip (ipproto:udp; app-layer-protocol:dns;) The same rules extend to other another such protocol, dcerpc. - The app layer parser api now takes in the ipproto while registering callbacks. - The app inspection/detection engine also takes an ipproto. - All app layer parser functions now take direction as STREAM_TOSERVER or STREAM_TOCLIENT, as opposed to 0 or 1, which was taken by some of the functions. - FlowInitialize() and FlowRecycle() now resets proto to 0. This is needed by unittests, which would try to clean the flow, and that would call the api, AppLayerParserCleanupParserState(), which would try to clean the app state, but the app layer now needs an ipproto to figure out which api to internally call to clean the state, and if the ipproto is 0, it would return without trying to clean the state. - A lot of unittests are now updated where if they are using a flow and they need to use the app layer, we would set a flow ipproto. - The "app-layer" section in the yaml conf has also been updated as well.	13 years ago
Anoop Saldanha	a49cbf8a49	Code cleanup. ... Use the MpmAddPattern[CS|CI] wrapper to add patterns to the mpm context. Also use MpmInitCtx() to init the mpm context.	13 years ago
Victor Julien	7074ca373b	proto detection: add limit for one sided sessions ... If a session only has data in one direction, like ftp data sessions, protocol detection will only run in one direction. This led to a situation where reassembly would hold all the segments as proto detection was never flagged as complete. This patch introduces a limit for protocol detection in this case. If the limit is reached, detection will give up.	13 years ago
Anoop Saldanha	36bd444406	Introduce new API to allow case insensitive protocol detection patterns.	13 years ago
Anoop Saldanha	e383cc27cd	Fix a leak in probing parsers. We were freeing just the head of the list, ... instead of all the members.	13 years ago
Anoop Saldanha	16144fe38a	Rename function pointer var to use the FuncPtr typing convention. Resupply "dns" as the alproto name for ALPROTO_DNS.	13 years ago
Anoop Saldanha	b1dffdfbe0	Add app layer protocol packet event detection support.	13 years ago
Anoop Saldanha	64b0939b4a	code cleanup.	13 years ago
Anoop Saldanha	0d7159b525	App layer protocol detection updated and improved. We now use ... confirmation from both directions and set events if there's a mismatch between the 2 directions. FPs from corrupt flows have disappeared with this.	13 years ago
Anoop Saldanha	c044541b1c	Provide convenience macros for setting flow flags on protocol matching by ... PM and PP phase. Replace the areas of the code that would otherwise rely on setting/reading these flags with these macros. Other minor tweaks to some api calls.	13 years ago
Anoop Saldanha	00f546e739	update pmp to return whole set of matches, rather than a single match.	13 years ago
Anoop Saldanha	d9686fae57	Now supports accepting port addresses as strings, like the ones accepted in our rules. As a consequence we now accept port range, and other such combination. Support PP for ports based on ipproto as well.	13 years ago
Eric Leblond	3dbf6c6fee	solaris: fix compilation failure ... This patch fixes a compilation failure on Solaris. Compiler does not support when a function returning void is used in return of an other function returning void.	13 years ago
Eric Leblond	cd3e32ce19	unittests: some functions needs a flow lock. ... In debug validation mode, it is required to call application layer parsing and other functions with a lock on flow. This patch updates the code to do so.	13 years ago
Anoop Saldanha	3c2ddf04c1	Update mpm init ctx to not accept the final cuda_rc_module argument. ... It was a part of our older architecture and is no longer used.	13 years ago
Anoop Saldanha	b787da5643	Remove all cuda related code in the engine except for the cuda api wrappers	13 years ago
Ken Steele	394f99e32c	Use PacketGetfromAlloc() for packet allocation instead of SCMalloc. ... Only changed in one file for testing.	13 years ago
Anoop Saldanha	34a9c047fc	updated to fix unix shutdown sequence ... Should fix crashes occuring from unix mode shutdown/cleanup phase.	14 years ago
Last G	8ae11f73b2	Added parentheses to fix Eclipse static code analysis ... Fixed bug in action priority (REJECT_DST had lowest prio)	14 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	14 years ago
Anoop Saldanha	109662450d	Add new command line option --list-app-layer-protocols to list supported app layer protocols in sigs	15 years ago
Anoop Saldanha	7511fa67cd	Add BUG_ON to avoid overruning AppLayerDetectDirection map array	15 years ago
Victor Julien	7173256754	Fix compiler warnings in a couple of unittests.	15 years ago
Anoop Saldanha	9a6aef459e	modify all relevant app layer API calls to accomodate passing parser local storage argument	15 years ago
Anoop Saldanha	01a35bb604	introduce app layer local storage api support	15 years ago
Victor Julien	262a7300d7	flow: shrink Flow datatype ... Introduce a separate FlowAddress structure for holding the ipv4 or ipv6 address that doesn't have the family in it like the Address structure. Instead, the family is stored in the flow as a flag: FLOW_IPV4 and FLOW_IPV6. Add macro's to check the family, copy the address, etc. Update many unittests to reflect these changes. Introduce unittest helper functions for creating and initializing a flow and freeing it again. On 64 bit this shrinks the flow with 8 bytes.	15 years ago
Victor Julien	06904c9024	App Layer cleanup ... Removal of per flow 'aldata' array. It contained a ptr for each ALPROTO. Instead now we have 2 ptrs in the flow: alparser and alstate. Various cleanups and dead code removal from the app layer API. Should safe 100+ bytes memory per flow on 64 bit. Updated lots of unittests to reflect these changes.	15 years ago
Anoop Saldanha	ed3b44b3b5	fix parsing content keywords. We are more strict now. All content keywords need to be enclosed in double quotes. Better validation for sid, priority and rev keywords	15 years ago
Anoop Saldanha	d68775d47d	introduce bitmasks instead of alproto_masks for use by the probing parser. Remove all alproto_masks we had previouslys for PP	15 years ago
Anoop Saldanha	d3989e7cee	probing parser updated to always accept u32 buflens. Update all probing parser functions to accomodate this change	15 years ago
Anoop Saldanha	80d80000bb	fix probing parser flag usage during protocol detection	15 years ago
Anoop Saldanha	432c3317d2	app layer probing parser updates	15 years ago
Anoop Saldanha	d68f182ebd	introduce SCPerfSyncCounters/SCPerfSyncCounters macro to synchronize counters	15 years ago
Victor Julien	820b0ded82	Add per packet profiling. ... Per packet profiling uses tick based accounting. It has 2 outputs, a summary and a csv file that contains per packet stats. Stats per packet include: 1) total ticks spent 2) ticks spent per individual thread module 3) "threading overhead" which is simply calculated by subtracting (2) of (1). A number of changes were made to integrate the new code in a clean way: a number of generic enums are now placed in tm-threads-common.h so we can include them from any part of the engine. Code depends on --enable-profiling just like the rule profiling code. New yaml parameters: profiling: # packet profiling packets: # Profiling can be disabled here, but it will still have a # performance impact if compiled in. enabled: yes filename: packet_stats.log append: yes # per packet csv output csv: # Output can be disabled here, but it will still have a # performance impact if compiled in. enabled: no filename: packet_stats.csv Example output of summary stats: IP ver Proto cnt min max avg ------ ----- ------ ------ ---------- ------- IPv4 6 19436 11448 5404365 32993 IPv4 256 4 11511 49968 30575 Per Thread module stats: Thread Module IP ver Proto cnt min max avg ------------------------ ------ ----- ------ ------ ---------- ------- TMM_DECODEPCAPFILE IPv4 6 19434 1242 47889 1770 TMM_DETECT IPv4 6 19436 1107 137241 1504 TMM_ALERTFASTLOG IPv4 6 19436 90 1323 155 TMM_ALERTUNIFIED2ALERT IPv4 6 19436 108 1359 138 TMM_ALERTDEBUGLOG IPv4 6 19436 90 1134 154 TMM_LOGHTTPLOG IPv4 6 19436 414 5392089 7944 TMM_STREAMTCP IPv4 6 19434 828 1299159 19438 The proto 256 is a counter for handling of pseudo/tunnel packets. Example output of csv: pcap_cnt,ipver,ipproto,total,TMM_DECODENFQ,TMM_VERDICTNFQ,TMM_RECEIVENFQ,TMM_RECEIVEPCAP,TMM_RECEIVEPCAPFILE,TMM_DECODEPCAP,TMM_DECODEPCAPFILE,TMM_RECEIVEPFRING,TMM_DECODEPFRING,TMM_DETECT,TMM_ALERTFASTLOG,TMM_ALERTFASTLOG4,TMM_ALERTFASTLOG6,TMM_ALERTUNIFIEDLOG,TMM_ALERTUNIFIEDALERT,TMM_ALERTUNIFIED2ALERT,TMM_ALERTPRELUDE,TMM_ALERTDEBUGLOG,TMM_ALERTSYSLOG,TMM_LOGDROPLOG,TMM_ALERTSYSLOG4,TMM_ALERTSYSLOG6,TMM_RESPONDREJECT,TMM_LOGHTTPLOG,TMM_LOGHTTPLOG4,TMM_LOGHTTPLOG6,TMM_PCAPLOG,TMM_STREAMTCP,TMM_DECODEIPFW,TMM_VERDICTIPFW,TMM_RECEIVEIPFW,TMM_RECEIVEERFFILE,TMM_DECODEERFFILE,TMM_RECEIVEERFDAG,TMM_DECODEERFDAG,threading 1,4,6,172008,0,0,0,0,0,0,47889,0,0,48582,1323,0,0,0,0,1359,0,1134,0,0,0,0,0,8028,0,0,0,49356,0,0,0,0,0,0,0,14337 First line of the file contains labels. 2 example gnuplot scripts added to plot the data.	15 years ago
Anoop Saldanha	6e0d98d9c4	fix valgrind issue for SMB test. Small restructuring. probing_parsers global variable now part of AlpProtoDetectCtx	15 years ago
Anoop Saldanha	a40fdc794e	Added probing parser for nbss/smb on port 139	15 years ago
Anoop Saldanha	7c31a2327e	Add support for port based probing parsers for alproto detection	15 years ago
Anoop Saldanha	0c94d910e4	Removed FLOW_AL_STREAM_TOSERVER and FLOW_AL_STREAM_TOCLIENT. Use STREAM_TOSERVER and STREAM_TOCLIENT instead	15 years ago
Anoop Saldanha	000ce98cd1	push all proto detection code into their respective app parser register functions for every alproto	15 years ago
Victor Julien	936b34ddf6	Remove minimum init chunk length code, set a default limit of 2560 to the minimum chunk size, allow toclient raw reassembly to start even if toserver hasn't started yet.	16 years ago
Anoop Saldanha	cacf0a9017	disabled sslv23 proto detection which we enabled previously. Although this is right, need to test a couple of things	16 years ago
Anoop Saldanha	8c6d4531ee	sslv23 support with ssl2 record format with version set to 3.0	16 years ago
Gurvinder Singh	8f8b1212af	support for ssl_version keyword	16 years ago
Eric Leblond	66a15e2d6d	Fix some Packet initialisation. ... This patch fixes Packet initialisation. In some place the pkt field was not set after a memset used to zero the structure and this could lead to some problems.	16 years ago
Victor Julien	1d971b53a6	Update all unittests	16 years ago
Eric Leblond	dd038c1906	Modify files to avoid direct pckt payload access ... This patch implements the needed modification of payload access in a Packet structure to support the abstraction introduced by the extended data system.	16 years ago
Victor Julien	fc248ca7a1	Many small performance updates.	16 years ago
Pablo Rincon	76af1b049b	Make malloc errors on initialization stage a fatal error, resulting on a exit() call	16 years ago
Victor Julien	1d73e1fb7e	Small update to the ssh module: fix a valgrind warning and a couple of compiler warnings. Do a few small style updates.	16 years ago
Pablo Rincon	9d7baa7a9f	Adding ssh app layer module with two new keywords: ssh.protoversion and ssh.softwareversion	16 years ago
Victor Julien	1071a53210	Fix unittests after ip_proto keyword change.	16 years ago
Victor Julien	13045683ff	Reenable and fix AlpDetectTestSig5	16 years ago
Pablo Rincon	c6e090f72c	App layer proto specific sigs (use the app layer to match proto)	16 years ago
Kirby Kuehl	c3b9305259	dcerpc udp support	16 years ago
Victor Julien	dce323b1f4	Fix SCondWait -> SCCondWait typo.	16 years ago
Victor Julien	ba12f3c109	Applayer to flow fixes and cleanups.	16 years ago
Pablo Rincon	8cc525c939	UDP support at AppLayer message handling	16 years ago
Victor Julien	6c6e6321fc	Fix HTTP HEAD detection code.	16 years ago
Gurvinder Singh	cda664a8c4	memroy leaks fixes in detection module, app layer and counters	16 years ago
Gurvinder Singh	5fe1dc1d24	support for sslv2/sslv3 their unit tests and better stream no reassembly flag handling	16 years ago
Victor Julien	70b32f7380	First stab at creating a stateful detection engine. ... Stateful detection for app layer detection keywords, except uricontent. Stores it's partial results in the flow structure. Other modifications: - Generalize transaction tracking, logging and inspection. - Adapt http and dcerpc to use the new transaction handling. - Stream engine now always notifies app layer of a stream eof. This commit fixes bug #124.	16 years ago
Victor Julien	7a427ec7f4	Switch to pattern id based results checking in the mpm. Move app layer proto detection towards a more signature based approach.	16 years ago
William Metcalf	ce01927515	Import of GPLv2 Header 050410	16 years ago
Victor Julien	e0c2c86342	Make HTTP proto detection more reliable. Add HEAD keyword. Thanks rmkml for the report/request.	16 years ago
Gurvinder Singh	8e444f1772	stream and application layer improvements	17 years ago
Victor Julien	cb8aaa5968	Make sure we only run the app layer proto detection (successfully) once per flow. Solves an issue found by the fuzzer where both flow directions were detected as different protos, messing up the app layer parser.	17 years ago
Victor Julien	ec47f840f3	Remove more scan references.	17 years ago
Victor Julien	1e01fd613c	Remove all references to the scan phase from the pattern matchers and it's api.	17 years ago
Pablo Rincon	25a3a5c6d8	Adding mem wrapper to debug runtime alloc()/free() functions. Fixing some memory leaks.	17 years ago
Anoop Saldanha	c26e92733d	handle the cuda cleanup at shutdown. should get rid of any errors from the call to SigGroupCleanup	17 years ago
Victor Julien	d281a6b8ac	CUDA build system support & compile fixes ... - add configure support for CUDA - make sure all code compiles if CUDA is disabled - fix compiler warnings	17 years ago
Anoop Saldanha	41e6735b92	mpm b2g cuda support added	17 years ago
Gurvinder Singh	999a200bc9	pattern matcher options support	17 years ago
Victor Julien	ed7762e843	Disable unused jabber proto detection as it made the proto detection code look way more into the stream than without it.	17 years ago
Gurvinder Singh	ed99e73622	bug 78	17 years ago
Victor Julien	7deb4e9f09	Cleanup AppLayerDetectGetProto a bit.	17 years ago
Victor Julien	fd409049cb	First step for proper HTTP CONNECT handling.	17 years ago
Victor Julien	6a53ab9c5a	Stream engine memory handling update ... The stream engine memory handling needed updating as it didn't scale. Changes: - pools can now be initialized to size 0, meaning unlimited - stream engine uses a memcap setting. Sessions, segments and aldata is part of this, app layer state isn't. - memory is accounted using a global int that is spinlocked. - a counter for sessions that have not been picked up because of memcap was added. - all reassembly errors are converted to debug msgs.	17 years ago
Victor Julien	c352bff6fb	Remove unused conditional locking code from the app layer parsing code.	17 years ago
Victor Julien	434da6b965	Set no reassembly flags on sessions we don't recognize the protocol for.	17 years ago
Gurvinder Singh	5c8d90afc8	memory leak fixes	17 years ago
Victor Julien	c1283a6628	Fix app layer proto detection code not being thread safe.	17 years ago
Victor Julien	5e8413aeea	Don't scan more of a stream for proto detection than necessary.	17 years ago
Victor Julien	a8116f65c8	Fix packet flags field not being cleared properly when the packet is being reused. Add some debug statements and cleanup some.	17 years ago
Victor Julien	4824868766	Application layer detection improvements ... - improve locking of application layer handling, making sure that the flow cannot be freed/cleared when the detection engine is still working with it. - add a check to the app layer detection to make sure that a match function will only inspect an app layer state if it's of the right type.	17 years ago
Pablo Rincon	f2f9b83280	Adding FTP app layer parser and ftpbounce detection at L7	17 years ago
Victor Julien	ecf86f9c23	Rename to Suricata.	17 years ago
Victor Julien	3233888c65	Disable noisy debugging statements	17 years ago
Kirby Kuehl	73bdc8a5c3	fix unittests	17 years ago
Kirby Kuehl	57331ea2a2	add smb2 proto and smb, smb2, dcerpc unit tests	17 years ago
Pablo Rincon	e26833be3f	Changing mutex/spinlocks/conditions naming types	17 years ago
Pablo Rincon	769022f4be	Adding support for Mac OS X, FreeBSD, centrailizing mutex/spins/conditions in a macro API, and some unittests	17 years ago
Gurvinder Singh	c1e485cc44	app layer error handling	17 years ago
Anoop Saldanha	ceb7e495ae	refactoring perf stats code	17 years ago
Kirby Kuehl	ecaa701bdf	smb and dcerpc work	17 years ago
Victor Julien	2d0e9658f8	Speed up per sgh content maxlen calc. Remove mpm ptrs from mpm ctx. Add unittests testing the detection engine internals.	17 years ago
Victor Julien	7a7bb7a390	Get rid of global mpm_ctx.	17 years ago
Gurvinder Singh	48c94bbf03	initial thread code support	17 years ago
Breno Silva	c43319c337	Regular expression for UnitTests ... Signed-off-by: Brian Rectanus <brectanu@gmail.com>	17 years ago
Victor Julien	3a28171fbd	Another round of logging api usage updates.	17 years ago
Victor Julien	4170ec8955	Make locking of the flow optional in the app layer subsys so we can also pass locked flows to it.	17 years ago
Victor Julien	5ecd187b6f	Tie app layer parsing to the stream engine.	17 years ago
Victor Julien	597d0e9a20	Fix detection of failed thread startup. Cleanup startup output a bit.	17 years ago
Victor Julien	1858be7a2f	Lock threadvars flags using spinlocks.	17 years ago
Anoop Saldanha	3a45b2711c	Fixed the Perf API startup issue	17 years ago
Victor Julien	b102ea2123	Big update: ... - Implement "closing" state in flow. - Add protocol specific timeouts. - Lots of stream tracking updates, fixing a lot of out of window issues. - Stream reassembly fixes. - Implement a new IDS runmode with 4 stream and detect threads. - Added a BUG_ON macro that aborts the engine if the expression is true. - Better balance the flow queue handler for traffic that doesn't have flow (like icmp currently). - Simplify application level protocol in the Tcp Session. - Add some debugging memory counters.	17 years ago
Anoop Saldanha	f35d9f0437	threading improvements. Replaced the use of slot(2/3) with varslot. Improve error handling in slot functions. Additional helper functions for thread creation	17 years ago
Victor Julien	85b1fd7dfc	Add TLS 1.1 and 1.2 detection.	17 years ago
Victor Julien	086ba5f49b	Add 'BySize' field parser. Add stub tls parser.	17 years ago
Victor Julien	7715e8f0fc	Work around some Tcp session free issues in the app layer parsers.	17 years ago
Victor Julien	efdd952eb5	Remove noisy debugging output.	17 years ago
Victor Julien	4369816cdd	Improvements to content keyword memory handling. ... First version of a simple pattern based L7 proto detection engine. Currently just works by matching a single pattern in the initial data. Implemented HTTP, SSL, MSN, JABBER, SMTP and a few more. Couple of pattern matcher cleanups.	17 years ago
Victor Julien	5b946443d8	Use finer grained locking for app layer parsing.	17 years ago
Brian Rectanus	fa5939ca91	64 bit cleanup part2	17 years ago
Victor Julien	8e10844f95	Initial code of Application Layer parsing framework. Rename of L7* to AppLayer*.	17 years ago