82 Commits (1fb7c0dddc97b20c0ac03d6810f4e76bce523a57)

Author	SHA1	Message	Date
Victor Julien	3b8e9ffbe9	app layer: void -> AppLayerProtoDetectThreadCtx ... User AppLayerProtoDetectThreadCtx ptr instead of void.	12 years ago
Victor Julien	8dbf7a0d78	Update tests to use AppLayerParserThreadCtx ptr instead of void. Fix a few bugs uncovered by this.	12 years ago
Victor Julien	9634e60e7a	app-layer: Use opaque pointers instead of void ... For AppLayerThreadCtx, AppLayerParserState, AppLayerParserThreadCtx and AppLayerProtoDetectThreadCtx, use opaque pointers instead of void pointers. AppLayerParserState is declared in flow.h as it's part of the Flow structure. AppLayerThreadCtx is declared in decode.h, as it's part of the DecodeThreadVars structure.	12 years ago
Victor Julien	fdefb65be4	app-layer: rename AppLayerThreadCtx funcs ... AppLayerParserGetCtxThread -> AppLayerParserThreadCtxAlloc AppLayerParserDestroyCtxThread -> AppLayerParserThreadCtxFree	12 years ago
Victor Julien	f5f148805c	app layer: uint16_t alproto -> AppProto alproto ... This conversion was missing in a couple of places.	12 years ago
Anoop Saldanha	429c6388f6	App layer API rewritten. The main files in question are: ... app-layer.[ch], app-layer-detect-proto.[ch] and app-layer-parser.[ch]. Things addressed in this commit: - Brings out a proper separation between protocol detection phase and the parser phase. - The dns app layer now is registered such that we don't use "dnstcp" and "dnsudp" in the rules. A user who previously wrote a rule like this - "alert dnstcp....." or "alert dnsudp....." would now have to use, alert dns (ipproto:tcp;) or alert udp (app-layer-protocol:dns;) or alert ip (ipproto:udp; app-layer-protocol:dns;) The same rules extend to other another such protocol, dcerpc. - The app layer parser api now takes in the ipproto while registering callbacks. - The app inspection/detection engine also takes an ipproto. - All app layer parser functions now take direction as STREAM_TOSERVER or STREAM_TOCLIENT, as opposed to 0 or 1, which was taken by some of the functions. - FlowInitialize() and FlowRecycle() now resets proto to 0. This is needed by unittests, which would try to clean the flow, and that would call the api, AppLayerParserCleanupParserState(), which would try to clean the app state, but the app layer now needs an ipproto to figure out which api to internally call to clean the state, and if the ipproto is 0, it would return without trying to clean the state. - A lot of unittests are now updated where if they are using a flow and they need to use the app layer, we would set a flow ipproto. - The "app-layer" section in the yaml conf has also been updated as well.	12 years ago
Anoop Saldanha	619414c59e	Add a /* fall through */ comment for all switch case fall throughs. ... This should server as a message to coverity that the fall through is intentional.	12 years ago
Anoop Saldanha	0d7159b525	App layer protocol detection updated and improved. We now use ... confirmation from both directions and set events if there's a mismatch between the 2 directions. FPs from corrupt flows have disappeared with this.	12 years ago
Anoop Saldanha	6f8cfd999f	Allow detection ports for alproto to be specified via the conf file. ... To understand the option have a look at the option app-layer.protocols.tls.detection-ports	12 years ago
Anoop Saldanha	ddde572fba	Introduce new options into the conf file to enable/disable - ... 1. Proto detection 2. Parsers For app layer protocols. libhtp has now been moved to the section under app-layer.protocols.http, but we still provide backward compatibility with older conf files.	12 years ago
Anoop Saldanha	d9686fae57	Now supports accepting port addresses as strings, like the ones accepted in our rules. As a consequence we now accept port range, and other such combination. Support PP for ports based on ipproto as well.	12 years ago
Eric Leblond	cd3e32ce19	unittests: some functions needs a flow lock. ... In debug validation mode, it is required to call application layer parsing and other functions with a lock on flow. This patch updates the code to do so.	12 years ago
Victor Julien	9faa4b740d	Add --unittests-coverage option to list how many code modules have tests	12 years ago
Victor Julien	f59f90331d	Applayer: remove obsolete StateUpdateTransactionId ... Also, update StateTransactionFree to take an u64 tx id, so it's consistant with the rest of the engine. To reflect these changes, AppLayerRegisterTransactionIdFuncs has been renamed to AppLayerRegisterTxFreeFunc. HTP, DNS, SMB, DCERPC parsers updated.	12 years ago
Anoop Saldanha	c6d50764e5	temporarily patched smb + dcerpc parsers for direction demaraction.	13 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	13 years ago
Victor Julien	a08a0e9161	Minor output cleanup	13 years ago
Victor Julien	2055b509a3	dcerpc/smb/smb2: more robust error checking, cosmetic code updates.	13 years ago
Anoop Saldanha	109662450d	Add new command line option --list-app-layer-protocols to list supported app layer protocols in sigs	14 years ago
Anoop Saldanha	9a6aef459e	modify all relevant app layer API calls to accomodate passing parser local storage argument	14 years ago
Victor Julien	06904c9024	App Layer cleanup ... Removal of per flow 'aldata' array. It contained a ptr for each ALPROTO. Instead now we have 2 ptrs in the flow: alparser and alstate. Various cleanups and dead code removal from the app layer API. Should safe 100+ bytes memory per flow on 64 bit. Updated lots of unittests to reflect these changes.	14 years ago
Anoop Saldanha	4650bf7170	minor code cleanup. remove commented out code	14 years ago
Anoop Saldanha	78e6a7f713	enable toclient alproto detection. Detection all current alproto toclient PMP patterns	14 years ago
Anoop Saldanha	d3989e7cee	probing parser updated to always accept u32 buflens. Update all probing parser functions to accomodate this change	14 years ago
Anoop Saldanha	432c3317d2	app layer probing parser updates	14 years ago
Anoop Saldanha	4307ea2348	Replace all frees with SCFrees	14 years ago
Anoop Saldanha	be3996ac02	coverity fix - 1.1beta branch - add some comments to indicate false positives by coverity for future reference - mainly comments for switch statement fall through	14 years ago
Anoop Saldanha	6e0d98d9c4	fix valgrind issue for SMB test. Small restructuring. probing_parsers global variable now part of AlpProtoDetectCtx	14 years ago
Anoop Saldanha	7f8fb0f00d	fix bounds checking in smb probing parser	14 years ago
Anoop Saldanha	61635f302c	indentation changes in app-layer-smb.c	14 years ago
Anoop Saldanha	a40fdc794e	Added probing parser for nbss/smb on port 139	14 years ago
Anoop Saldanha	b7b7bbec37	code indentation changes in app-layer-smb.c	14 years ago
Anoop Saldanha	000ce98cd1	push all proto detection code into their respective app parser register functions for every alproto	14 years ago
Victor Julien	1859ed54c7	Add memcmp api with a plain memcmp function and a SSE3 accelerated memcmp.	15 years ago
Anoop Saldanha	ead29dc691	make detection engine use dce alstate(if present), on seeing smb traffic	15 years ago
Kirby Kuehl	18840bd96e	properly handle bytecount of 0	15 years ago
Victor Julien	bfd167521e	Fix DCERPC over SMB/SMB2 detection issues. Fix not updating transaction id in a stream direction if there was no sgh.	15 years ago
Kirby Kuehl	3a985a9f5f	fix smb leak	15 years ago
Pablo Rincon	8cc525c939	UDP support at AppLayer message handling	15 years ago
Victor Julien	52cdfb332e	Fix a compiler warning, add some comments, cleanup layout of smb parser.	15 years ago
root	73c6fb16ba	Return 0 instead of -1 when SMB and DCERPC encounter non fatal errors to clean up errors emitted in AppLayerParse.	15 years ago
William Metcalf	ce01927515	Import of GPLv2 Header 050410	15 years ago
Victor Julien	b7c089df42	Fix a couple of harmless compiler warnings.	15 years ago
Victor Julien	68576947e2	Small SMB cleanups.	16 years ago
Kirby Kuehl	f08d3e76ee	add maximum andx chain depth	16 years ago
Victor Julien	449205cfeb	Remove wrong copyright info, cleanup headers.	16 years ago
Kirby Kuehl	afb08d388d	make sure we have input_len	16 years ago
Pablo Rincon	25a3a5c6d8	Adding mem wrapper to debug runtime alloc()/free() functions. Fixing some memory leaks.	16 years ago
Kirby Kuehl	565eab1f54	fix bug88	16 years ago
Kirby Kuehl	a334a87109	smb safety checks	16 years ago