97 Commits (16cfae2f51d24899cc4fac7f67303902b98f4e5e)

Author	SHA1	Message	Date
Victor Julien	16cfae2f51	Trigger raw stream reassembly on receiving a full HTTP request or response.	14 years ago
Victor Julien	f773942ce0	Disable printing dreaded app layer error messages to the screen: app layer events are here to safe us.	14 years ago
Anoop Saldanha	5311cd4866	Support for smtp decoder events	14 years ago
Anoop Saldanha	eea5ab4a7a	Support for app layer decoder events added + app_layer_event keyword added	14 years ago
Victor Julien	3009429e3c	HTTP transaction handling improvement ... In some cases AppLayerTransactionGetInspectId can return -1, which is now handled by all it's callers. Improve logic of selecting which transactions are inspected by the various HTTP keywords.	14 years ago
Victor Julien	45d86ff58a	Stream reassembly / app layer: disable gap errors ... Gap errors on the app layer are now silently handled. No longer printed to the screen.	14 years ago
Victor Julien	b74c73309b	file handling: improve filestore keyword handling ... In stateful detection only inspect the file portion of the rule after all other conditions matched. This to prevent "filestore" from tagging files for storage during a partial match. Add a couple of unittests to test the behaviour change.	14 years ago
Victor Julien	2ccd35c6e4	Fix code after rebase.	14 years ago
Victor Julien	d59ca75e46	file extract: split toserver and toclient tracking ... Split toserver and toclient file tracking for the http state.	14 years ago
Victor Julien	e1022ee5ae	file-extraction: Disconnect file handling from flow and move into the app layer state.	14 years ago
Victor Julien	23e01d23d3	Implement filestore keyword, including a way for the stateful detection engine to conclude that a file will never have to be stored.	14 years ago
Anoop Saldanha	9a6aef459e	modify all relevant app layer API calls to accomodate passing parser local storage argument	14 years ago
Anoop Saldanha	01a35bb604	introduce app layer local storage api support	14 years ago
Victor Julien	262a7300d7	flow: shrink Flow datatype ... Introduce a separate FlowAddress structure for holding the ipv4 or ipv6 address that doesn't have the family in it like the Address structure. Instead, the family is stored in the flow as a flag: FLOW_IPV4 and FLOW_IPV6. Add macro's to check the family, copy the address, etc. Update many unittests to reflect these changes. Introduce unittest helper functions for creating and initializing a flow and freeing it again. On 64 bit this shrinks the flow with 8 bytes.	14 years ago
Victor Julien	06904c9024	App Layer cleanup ... Removal of per flow 'aldata' array. It contained a ptr for each ALPROTO. Instead now we have 2 ptrs in the flow: alparser and alstate. Various cleanups and dead code removal from the app layer API. Should safe 100+ bytes memory per flow on 64 bit. Updated lots of unittests to reflect these changes.	14 years ago
Victor Julien	7e3c15e54a	stream: improve TCP ssn reuse cleanup.	14 years ago
Anoop Saldanha	de9ad02b59	Remove leftover imap and msn toclient alproto PM contents	14 years ago
Victor Julien	8186565240	Fix a number of potential issues found by CLANG and cppcheck.	14 years ago
Anoop Saldanha	0edf053f31	if app layer inspection is disabled, immediately set the eof flag	14 years ago
Anoop Saldanha	fe11e02f58	fix inspect id update bug. This should prevent unnecessary FPs for pipelined requests	14 years ago
Anoop Saldanha	4e44073c79	http logging module should log all txs in the list and not just the last complete tx available on EOF	14 years ago
Anoop Saldanha	c13ad8c28a	Provide a function to set the app layer tx eof flag. Use this in FFR code instead of diretly setting the flag. This cleans up the API as well	14 years ago
Anoop Saldanha	b406af451b	updates to http tx id vars. FFR now flags the app layer session for EOF when creating a pseudo packet for a flow	14 years ago
Anoop Saldanha	d68775d47d	introduce bitmasks instead of alproto_masks for use by the probing parser. Remove all alproto_masks we had previouslys for PP	14 years ago
Anoop Saldanha	d3989e7cee	probing parser updated to always accept u32 buflens. Update all probing parser functions to accomodate this change	14 years ago
Anoop Saldanha	432c3317d2	app layer probing parser updates	14 years ago
Eric Leblond	6b9d1012ff	Transform inet_ntop call into PrintInet one.	14 years ago
Anoop Saldanha	576ec7da66	smtp parser support	14 years ago
Victor Julien	73efb4c70f	Add a app layer state and stateful detection engine counter that makes sure the stateful inspection is only done when the state changes.	14 years ago
Anoop Saldanha	6e0d98d9c4	fix valgrind issue for SMB test. Small restructuring. probing_parsers global variable now part of AlpProtoDetectCtx	14 years ago
Anoop Saldanha	7f8fb0f00d	fix bounds checking in smb probing parser	14 years ago
Anoop Saldanha	a40fdc794e	Added probing parser for nbss/smb on port 139	14 years ago
Anoop Saldanha	7c31a2327e	Add support for port based probing parsers for alproto detection	14 years ago
Anoop Saldanha	fe6e41e3ef	Removed FLOW_AL_NO_APPLAYER_INSPECTION. Moved it as FLOW_NO_APPLAYER_INSPECTION in Flow->flags. Turned Flow->flags into uint32_t and removed Flow->alflags	14 years ago
Anoop Saldanha	38fe2b9070	Removed FLOW_AL_STREAM_START, EOF and GAP flags. We don't need these. Just use STREAM_* flags	14 years ago
Anoop Saldanha	000ce98cd1	push all proto detection code into their respective app parser register functions for every alproto	14 years ago
Victor Julien	8fa5a2c025	Split applayer and raw stream reassembly ... Split stream reassembly in 2 parts: a part that sends ack'd data to the app layer parsers as soon as it's available, and another part that queues up data into larger chunks for raw inspection.	15 years ago
Victor Julien	dda6d3e07b	Add error counters.	15 years ago
Eric Leblond	49adc264bc	Don't print message after SCMalloc failure. ... This patch generated via coccinelle is getting rid of logging message after a SCMalloc failure. They were useless as SCMalloc already displays a message.	15 years ago
Victor Julien	b8fec77f37	Fix tcp connections that are reset (RST packet) not always inspecting the reassembled stream. Update transaction id code to make sure both directions of a transaction are inspected before incrementing the inspect_id.	15 years ago
William Metcalf	0e4235cc94	FLOW_DESTROY added to clean-up UT's that init flow	15 years ago
Victor Julien	83b2c8abdb	Improve stateful uri detection code.	15 years ago
Victor Julien	e8fce5f7fa	Convert uricontent scanning to use the detect engine state.	15 years ago
Victor Julien	ba12f3c109	Applayer to flow fixes and cleanups.	15 years ago
Pablo Rincon	8cc525c939	UDP support at AppLayer message handling	15 years ago
William Metcalf	cc76aa4bc6	properly init flows inside of unit-tests caused lock-up when falling back to using mutex locks	15 years ago
Victor Julien	9f95ab7441	Make sure a stream that has a failing app layer inspection module no longer stops reassembly, but only app layer inspection. This way we can continue to inspect the reassembled stream.	15 years ago
Victor Julien	70b32f7380	First stab at creating a stateful detection engine. ... Stateful detection for app layer detection keywords, except uricontent. Stores it's partial results in the flow structure. Other modifications: - Generalize transaction tracking, logging and inspection. - Adapt http and dcerpc to use the new transaction handling. - Stream engine now always notifies app layer of a stream eof. This commit fixes bug #124.	15 years ago
Gerardo Iglesias Galvan	9f4fae5b1a	Fix inconsistent use of dynamic memory allocation	15 years ago
William Metcalf	ce01927515	Import of GPLv2 Header 050410	15 years ago