65 Commits (262a7300d701c44dba13bb2aaa2b14bed3485383)

Author	SHA1	Message	Date
Victor Julien	262a7300d7	flow: shrink Flow datatype ... Introduce a separate FlowAddress structure for holding the ipv4 or ipv6 address that doesn't have the family in it like the Address structure. Instead, the family is stored in the flow as a flag: FLOW_IPV4 and FLOW_IPV6. Add macro's to check the family, copy the address, etc. Update many unittests to reflect these changes. Introduce unittest helper functions for creating and initializing a flow and freeing it again. On 64 bit this shrinks the flow with 8 bytes.	14 years ago
Victor Julien	06904c9024	App Layer cleanup ... Removal of per flow 'aldata' array. It contained a ptr for each ALPROTO. Instead now we have 2 ptrs in the flow: alparser and alstate. Various cleanups and dead code removal from the app layer API. Should safe 100+ bytes memory per flow on 64 bit. Updated lots of unittests to reflect these changes.	14 years ago
Eric Leblond	b5a3e737c9	doc: comment link between Flow and application layer.	14 years ago
Anoop Saldanha	d68775d47d	introduce bitmasks instead of alproto_masks for use by the probing parser. Remove all alproto_masks we had previouslys for PP	14 years ago
Anoop Saldanha	432c3317d2	app layer probing parser updates	14 years ago
Victor Julien	9baa16af63	Convert flow memcap to u64. Bug #332.	14 years ago
Anoop Saldanha	b6ba944e6d	Rearrange flow manager functions into flow-manager.[ch]. Some other minor changes/updates	14 years ago
Anoop Saldanha	8363533a02	support for forced stream reassembly for to be pruned flows	14 years ago
Anoop Saldanha	c365bafbf6	We now inspect timed out streams + streams not processed as yet, at engine shutdown	14 years ago
Victor Julien	a5d9c86dd3	Shrink Flow structure with 20 bytes (on 32 bit) and reorder it. Clean up init, recycle, destroy macro's.	14 years ago
Anoop Saldanha	7c31a2327e	Add support for port based probing parsers for alproto detection	14 years ago
Anoop Saldanha	fe6e41e3ef	Removed FLOW_AL_NO_APPLAYER_INSPECTION. Moved it as FLOW_NO_APPLAYER_INSPECTION in Flow->flags. Turned Flow->flags into uint32_t and removed Flow->alflags	14 years ago
Anoop Saldanha	0c94d910e4	Removed FLOW_AL_STREAM_TOSERVER and FLOW_AL_STREAM_TOCLIENT. Use STREAM_TOSERVER and STREAM_TOCLIENT instead	14 years ago
Anoop Saldanha	ac5584a863	Removed FLOW_AL_PROTO_DETECT_DONE. Replaced it with FLOW_ALPROTO_DETECT_DONE, stored it in Flow->flags	14 years ago
Anoop Saldanha	49e2b580cb	Removed FLOW_AL_PROTO_UNKNOWN. We don't need this flag	14 years ago
Anoop Saldanha	38fe2b9070	Removed FLOW_AL_STREAM_START, EOF and GAP flags. We don't need these. Just use STREAM_* flags	14 years ago
Gurvinder Singh	7d0781b349	added support to log dropped packet as netfilter logs while in inline mode	15 years ago
Victor Julien	fc248ca7a1	Many small performance updates.	15 years ago
Pablo Rincon	5c43db85ce	Drop streams on inline mode when a drop rule match from a reassembled stream and/or app layer inspection	15 years ago
Pablo Rincon	a8cb8d830b	Fix for bug 186 and thresholding issue handling ip versions	15 years ago
Pablo Rincon	eed0ef6e69	Adding tag keyword support	15 years ago
Victor Julien	b60d2c4345	Fix flags mixup issue in the app layer.	15 years ago
Pablo Rincon	8cc525c939	UDP support at AppLayer message handling	15 years ago
Victor Julien	c26434fef1	Move flow use cnt to atomic and outside of the flow mutex protection.	15 years ago
Victor Julien	2fd31a1a11	Remove dsize grouping from detection engine grouping reducing memory usage. Store sgh in flow to reduce lookups. Reduce locking in alert handling. Increase default grouping values as we use less memory.	15 years ago
Victor Julien	32e3fea9e6	Exclude parts of a flow that are not changing after init from the flow mutex. Cleanup flow-hash function.	15 years ago
Pablo Rincon	29a6fc2f03	Adding some flow improvements and recovery on emergency mode	15 years ago
William Metcalf	2eef905c07	GPL and Copyright header updates.	15 years ago
Victor Julien	70b32f7380	First stab at creating a stateful detection engine. ... Stateful detection for app layer detection keywords, except uricontent. Stores it's partial results in the flow structure. Other modifications: - Generalize transaction tracking, logging and inspection. - Adapt http and dcerpc to use the new transaction handling. - Stream engine now always notifies app layer of a stream eof. This commit fixes bug #124.	15 years ago
Pablo Rincon	1238668961	Adding actions order and suport for rule action "pass"	15 years ago
William Metcalf	ce01927515	Import of GPLv2 Header 050410	15 years ago
Victor Julien	fc2029ef58	Fix small memuse counter issue in flow subsys, remove emergency printfs	15 years ago
Victor Julien	74dfbc0c49	Move flow flags to flow.h	15 years ago
Victor Julien	e3552a8e3f	Add more comments to detect and flow structures.	15 years ago
Pablo Rincon	34216fd3e2	bug87 Fix IPOnly veredicts on flows	16 years ago
Victor Julien	10cc9d5b6a	Add icmp flow handling.	16 years ago
Pablo Rincon	e26833be3f	Changing mutex/spinlocks/conditions naming types	16 years ago
Pablo Rincon	769022f4be	Adding support for Mac OS X, FreeBSD, centrailizing mutex/spins/conditions in a macro API, and some unittests	16 years ago
Gurvinder Singh	71da019734	some minor changes	16 years ago
Gurvinder Singh	bbb385422d	function to set packet flags	16 years ago
Gurvinder Singh	cc0b4f7181	initial version to support detection byepass	16 years ago
Victor Julien	b102ea2123	Big update: ... - Implement "closing" state in flow. - Add protocol specific timeouts. - Lots of stream tracking updates, fixing a lot of out of window issues. - Stream reassembly fixes. - Implement a new IDS runmode with 4 stream and detect threads. - Added a BUG_ON macro that aborts the engine if the expression is true. - Better balance the flow queue handler for traffic that doesn't have flow (like icmp currently). - Simplify application level protocol in the Tcp Session. - Add some debugging memory counters.	16 years ago
Victor Julien	b4f0e82463	Small flow updates.	16 years ago
Gurvinder Singh	9dcf6e2de2	handle the FLOW_STATE_CLOSED	16 years ago
Gurvinder Singh	ced5157dc9	Flow get state protocol specific	16 years ago
Gurvinder Singh	ab76253ec6	registering stream timeouts and flow prunning unit tests	16 years ago
Gurvinder Singh	a4ad7939d2	proto specific free function	16 years ago
Gurvinder Singh	55cdf8947e	some modification in protocol specifc timeouts and free funtion	16 years ago
Gurvinder Singh	e3b76dcaad	efficient protocol specific timeouts	16 years ago
Gurvinder Singh	b46d9dc2b4	part2 and part3.1 of timout task	16 years ago