319 Commits (234656e5f67d89ad1fdc7877e4d2074cbd021ed3)

Author	SHA1	Message	Date
William Metcalf	0e4235cc94	FLOW_DESTROY added to clean-up UT's that init flow	15 years ago
Victor Julien	2f29b8a724	Improve detection of app layer, making sure we only handle app layer on 'established' packets. Should really fix #166.	15 years ago
Victor Julien	37442a8a84	Prefilter signatures before fully scanning them.	15 years ago
Victor Julien	d6709b0961	Fix a segv caused by invalidly accessing the smsg_pmq array.	15 years ago
Victor Julien	8cea3779fa	Move dce payload inspection to stateful detection engine.	15 years ago
Anoop Saldanha	45ea0d914e	dce stub content keywords support using dcepayload.c support for all dce related content keywords	15 years ago
Victor Julien	83b2c8abdb	Improve stateful uri detection code.	15 years ago
Victor Julien	9dd753b5f3	Scan uricontent mpm on demand.	15 years ago
Victor Julien	e8fce5f7fa	Convert uricontent scanning to use the detect engine state.	15 years ago
Pablo Rincon	8cc525c939	UDP support at AppLayer message handling	15 years ago
William Metcalf	cc76aa4bc6	properly init flows inside of unit-tests caused lock-up when falling back to using mutex locks	15 years ago
Victor Julien	a24f288074	Moving the stream content scanning to have it's own mpm ctx.	15 years ago
Victor Julien	9a08d6c11c	Fixes to stream pattern matching.	15 years ago
Victor Julien	a0c1209a44	Inspect the reassembled stream together with the packet payload in the same direction.	15 years ago
Victor Julien	81f2499834	Store stream msgs processed by the app layer in the tcp session so they can be inspected by the detection module as well. The detection module returns them to the pool.	15 years ago
Victor Julien	c26434fef1	Move flow use cnt to atomic and outside of the flow mutex protection.	15 years ago
Victor Julien	2fd31a1a11	Remove dsize grouping from detection engine grouping reducing memory usage. Store sgh in flow to reduce lookups. Reduce locking in alert handling. Increase default grouping values as we use less memory.	15 years ago
Victor Julien	dff6795df5	Detect cleanups.	15 years ago
Gerardo Iglesias Galvan	55dfa36963	Add support for http_uri keyword	15 years ago
Jason Ish	ea4b7cc33b	add profiling to stateful detection engine + other fixups.	15 years ago
Victor Julien	4e7df60b2f	Make pcap file mode read multiple packets per 'read'. Update threading model to deal with this.	15 years ago
Pablo Rincon	3fa3229e01	ASN1 decoder and keyword implementation	15 years ago
Victor Julien	70b32f7380	First stab at creating a stateful detection engine. ... Stateful detection for app layer detection keywords, except uricontent. Stores it's partial results in the flow structure. Other modifications: - Generalize transaction tracking, logging and inspection. - Adapt http and dcerpc to use the new transaction handling. - Stream engine now always notifies app layer of a stream eof. This commit fixes bug #124.	15 years ago
Jason Ish	18e5ac8cde	Basic rule profiling even though the results may be skewed by a bad rule in a grouping of rules.	15 years ago
Victor Julien	42eeb84c9a	Properly lock flow before setting IP only action flags. Small alert api cleanups.	15 years ago
Pablo Rincon	9bae6a8628	Moving alert logic to detect-engine-alert.c	15 years ago
Gerardo Iglesias Galvan	9f4fae5b1a	Fix inconsistent use of dynamic memory allocation	15 years ago
William Metcalf	8d66323f62	clang fixes for null derefrences	15 years ago
Victor Julien	e27cefa6f7	Complete conversion of pattern id mpm storage vs sig id storage.	15 years ago
Victor Julien	46831e0f8f	Fix signature grouping bug for protocols without ports. Add debugging code.	15 years ago
Victor Julien	7a427ec7f4	Switch to pattern id based results checking in the mpm. Move app layer proto detection towards a more signature based approach.	15 years ago
Pablo Rincon	46187bfe73	Fix action logic after last pass changes	15 years ago
Gurvinder Singh	3721037de5	unittests for bug 134&139 and some typo correction	15 years ago
Victor Julien	a372c1d14e	Fix/workaround a strange detection issue.	15 years ago
Victor Julien	ce90e87304	Fix failing thresholding unittests	15 years ago
Pablo Rincon	e18e2ec998	Changing threshold logic	15 years ago
Pablo Rincon	8bcdf29ab7	Small fix on pass action handling and added more unittests	15 years ago
Pablo Rincon	1238668961	Adding actions order and suport for rule action "pass"	15 years ago
William Metcalf	ce01927515	Import of GPLv2 Header 050410	15 years ago
Victor Julien	070ed778b8	Libcap-ng support by Gurvinder Singh and myself. Basic support for per thread caps is added, but not activated as it doesn't seem to work yet. Work around for incompatibility between libnet 1.1 and libcap-ng added.	15 years ago
Pablo Rincon	ab02ab9ead	adding http_header keyword support	15 years ago
Pablo Rincon	224a33f19e	Moving inline functions to the .h files, so gcc can inline them correctly	15 years ago
Victor Julien	eeb98c6900	Move SCSetThreadName to proper functions.	16 years ago
Gerardo Iglesias Galvan	9f35a24a1f	Set threads name. Fix bug #83	16 years ago
Gurvinder Singh	69a4fee757	fixed the API and logic error reported by clang tool	16 years ago
Victor Julien	78e15ea7fa	Explicitly test for ipv6 in the htp personalities code. Update all affected unittests to set addr family to the flow.	16 years ago
Anoop Saldanha	47037ef9ec	fix for bug 115	16 years ago
Victor Julien	fe7ece997a	Different approach to the reference keyword. Lots of cleanups, bug fixes in reference keyword code and tests.	16 years ago
Breno Silva	89baf93a40	Reference Support	16 years ago
Pablo Rincon	e7a989e305	IP Only Engine using radix trees	16 years ago
Anoop Saldanha	97d49d8f5e	support for http_client_body keyword	16 years ago
Victor Julien	26e8a0a06a	Cleanup global threshold code.	16 years ago
Breno Silva	67f2026279	Global Threshold config	16 years ago
Victor Julien	08600df6b1	Small uri cleanups.	16 years ago
Pablo Rincon	c7350a8ac6	Fixing some naming convention issues and incorrect error messages	16 years ago
Pablo Rincon	b708d7f65d	Adding Uricontent inspection with spm. Modifiers for uricontent are now supported	16 years ago
Anoop Saldanha	c54b91ed94	fix for bug 113	16 years ago
Victor Julien	6be0778532	Comment SigMatchSignatures a bit.	16 years ago
Gerardo Iglesias Galvan	ef2ae76c42	Add support for detection_filter keyword	16 years ago
Victor Julien	297001c6d9	Only process a app layer sig if it has the proper state. Make sure a sig can't have conflicting sigmatches, such as ftpbouce and uricontent.	16 years ago
Victor Julien	ec47f840f3	Remove more scan references.	16 years ago
Victor Julien	bee4e04664	More scan/search related cleanups.	16 years ago
Victor Julien	6990d9c91b	Fix thresholding signature unittests. Because of the bug fix that made thresholding compatible to ip-only sigs the test sigs needed to be made non-ip-only.	16 years ago
Victor Julien	b259e362cd	Convert uricontent to use new scanning methods as well. Move http_method and http_cookie keywords out of pmatch list for now.	16 years ago
Victor Julien	bef70a04ce	First stage of detect engine redesign: equal patterns share id's, search phase no longer used, new match verification phase.	16 years ago
Pablo Rincon	25a3a5c6d8	Adding mem wrapper to debug runtime alloc()/free() functions. Fixing some memory leaks.	16 years ago
Pablo Rincon	ebcbc859e3	Fix on IPOnly match at flows, for inline mode	16 years ago
Gurvinder Singh	50f7d0a887	app layer htp logging and better htp request handling. removed recent_in_tx.	16 years ago
Gurvinder Singh	4768e42159	bug 95 patch	16 years ago
Pablo Rincon	38dc7ffebc	Adding settings for detect engine group config	16 years ago
Anoop Saldanha	1a5ee37bd3	Added cuda logs for the engine, which shows device info and memory usage	16 years ago
Anoop Saldanha	c26e92733d	handle the cuda cleanup at shutdown. should get rid of any errors from the call to SigGroupCleanup	16 years ago
Anoop Saldanha	41e6735b92	mpm b2g cuda support added	16 years ago
Pablo Rincon	34216fd3e2	bug87 Fix IPOnly veredicts on flows	16 years ago
Pablo Rincon	0165b3f0d8	pcre P modifier support (pcre match over http body requests)	16 years ago
Pablo Rincon	ad2c136e8f	Renaming errors (naming conventions)	16 years ago
Breno Silva	7e299834d2	FragOffset Rule Keyword	16 years ago
Victor Julien	6a53ab9c5a	Stream engine memory handling update ... The stream engine memory handling needed updating as it didn't scale. Changes: - pools can now be initialized to size 0, meaning unlimited - stream engine uses a memcap setting. Sessions, segments and aldata is part of this, app layer state isn't. - memory is accounted using a global int that is spinlocked. - a counter for sessions that have not been picked up because of memcap was added. - all reassembly errors are converted to debug msgs.	16 years ago
Pablo Rincon	51dc773eec	Changing the veredict actions to flags to allow simultaneous veredict	16 years ago
Victor Julien	b3bcba077f	Only inspect http flows against uri sigs, clean up uri scanning code.	16 years ago
Gurvinder Singh	0cb43d27e9	uricontent new design	16 years ago
Gurvinder Singh	356a8bf385	applayer uri match and modified http handling	16 years ago
Victor Julien	0d34990d7f	Add OpenBSD's strlcpy and strlcat and replace all strcat/strcpy/strncat/strncpy by those calls.	16 years ago
Gurvinder Singh	f6b0c481b0	urilen support for engine	16 years ago
Victor Julien	4284276b11	Merge applayer detect function into normal match function. Should speed up detection.	16 years ago
Victor Julien	bcd0682150	Make engine startup a little less verbose.	16 years ago
Breno Silva	1d055b0e09	ICMP Seq Rule Keyword	16 years ago
Pablo Rincon	c80160b96d	More examples of unittest helper functions usage reference	16 years ago
Pablo Rincon	b6a3395c08	Adding unittest helper functions for building generic packets, checking arrays of expected match results, perform generic tests, etc. Look at util-unittest-helper.c and detect-ipproto.c for references	16 years ago
Victor Julien	eb67bb442e	Fixup unittests that use buffers that simulate configuration files. They now include the YAML header.	16 years ago
Gerardo Iglesias Galvan	40c514f295	Fix bug in logging msg when using --init-errors-fatal	16 years ago
Gerardo Iglesias Galvan	5eb819b0f4	Add signature line no. to error message when parsing fails	16 years ago
Gerardo Iglesias Galvan	fae92f8d7b	Fix bug#30. Fix logging call from prev patch	16 years ago
Gerardo Iglesias Galvan	988dc5520b	Improve output when loading rules	16 years ago
Victor Julien	6b36e23e45	Fix not decreasing the flow use_cnt reference counter in some cases from the app layer detection code. This caused some streams to never fully time out and thus clutter up the flow table and session pool.	16 years ago
Brian Rectanus	c22d42693a	Added http_method rule keyword.	16 years ago
Victor Julien	b7bac14040	Fixup code to compile with -Wall -Werror -Wextra -Wno-unused-parameter compiler options.	16 years ago
Victor Julien	2b66667a76	Make sure we can't overflow our packet alert storage	16 years ago
Anoop Saldanha	f684989f98	dce_iface, dce_opnum, dce_stub_data keyword support	16 years ago
Victor Julien	ecab1fae36	Remove contents of VRT classification.config.	16 years ago