207 Commits (2913a4a86084441a2e9504bcd32a373f15aa65a9)

Author	SHA1	Message	Date
Victor Julien	1252ee3f04	stream: suppress minor scan-build warnings ... stream-tcp-reassemble.c:2569:17: warning: Value stored to 'seg' is never read seg = seg->next; ^ ~~~~~~~~~ stream-tcp-reassemble.c:2587:17: warning: Value stored to 'seg' is never read seg = seg->next;	12 years ago
Ken Steele	f9705377ae	Remove pkt variable from Packet structure. ... The uint8_t *pkt in the Packet structure always points to the memory immediately following the Packet structure. It is better to simply calculate that value every time than store the 8 byte pointer.	12 years ago
Victor Julien	8522da8ea5	stream: add option to disable raw reassembly ... Raw reassembly is used only by the detection engine. For users only caring about logging it's a significant overhead, both in cpu and memory usage. The option is called 'raw' and lives under the stream.reassembly options. stream: memcap: 32mb checksum-validation: yes # reject wrong csums inline: auto # auto will use inline mode in IPS mode, yes or no set it statically reassembly: memcap: 64mb depth: 1mb # reassemble 1mb into a stream toserver-chunk-size: 2560 toclient-chunk-size: 2560 randomize-chunk-size: yes #randomize-chunk-range: 10 raw: false # <- new option	12 years ago
Victor Julien	3f8947ff3d	app layer: set event if proto detect disabled for a stream, but we see data anyway.	12 years ago
Victor Julien	abccbe13f3	stream: add size debug code	12 years ago
Victor Julien	daedb6c557	stream: wait for protocol detection to complete ... Wait for protocol detection to complete before removing segments from the list.	12 years ago
Victor Julien	ab7677638e	stream: improve raw reassembly ... When checking the reassembly limit for raw reassembly, consider the STREAMTCP_STREAM_FLAG_NOREASSEMBLY a trigger immediately. We won't process any more segments in the reassembly engine anyway.	12 years ago
Victor Julien	0c12ad6bd0	stream: fix sequence number on smsg ... When multiple segments were put into a smsg, the seq would be updated each time a segment was added. Because of this, the seq wasn't pointing to the start of the data. This caused some false negatives when the fast_pattern was in the raw stream, but another part of the inspection was in the state. Because of the wrong seq, the inspection of the smsg could be delayed. This in turn, could make the inspection engine consider a TX inspected, even if it wasn't fully yet.	12 years ago
Anoop Saldanha	95ed53c590	Fix for #1003. ... Now that we call stream reassembly directly from proto detection, we will need to check if reassembly has been disabled inside the stream reassembly callback. This prevents any calls to bypass and re-enter proto detection, despite having reassembly disabled.	12 years ago
Anoop Saldanha	836bad85a4	Reset app layer processed flag for segments that have been sent for proto ... detection, but we failed to figure out the proto. Updated a unittest to reflect the above change.	12 years ago
Anoop Saldanha	d76a5bedbc	Update stream inline to use the improved app proto detection.	12 years ago
Anoop Saldanha	2cb5bdd3fa	Cosmetic changes to code. Introduce human readabel flag values for some constants. Here the parameter in question is "data_first_seen_dir" for session context.	12 years ago
Anoop Saldanha	976a86def4	Introduce convenience macro to set Stream app proto completion flag.	12 years ago
Anoop Saldanha	0d7159b525	App layer protocol detection updated and improved. We now use ... confirmation from both directions and set events if there's a mismatch between the 2 directions. FPs from corrupt flows have disappeared with this.	12 years ago
Anoop Saldanha	22c05da3cd	Replace ssn appproto_detection_completed flag with individual stream ones.	12 years ago
Eric Leblond	cd3e32ce19	unittests: some functions needs a flow lock. ... In debug validation mode, it is required to call application layer parsing and other functions with a lock on flow. This patch updates the code to do so.	12 years ago
Victor Julien	92b7ffad69	Improve memory cleanup in some unittests	12 years ago
Ken Steele	9c7b411a5d	More PacketGetFromMalloc() to allocate packets.	12 years ago
Victor Julien	28ea129d9b	stream: remove unused 'pause' feature	13 years ago
Victor Julien	abecef5d82	stream: send eof to app layer from stream end pkt if necessary	13 years ago
Ludovico Cavedon	ac8b087717	Wait until both sides close the TCP connection before initiating cleanup	13 years ago
Eric Leblond	09b79cb5bf	stream-tcp: fix double call to debug print function	13 years ago
Last G	8ae11f73b2	Added parentheses to fix Eclipse static code analysis ... Fixed bug in action priority (REJECT_DST had lowest prio)	13 years ago
Victor Julien	6f76ac176d	stream: add option to match on overlapping data ... Set event on overlapping data segments that have different data. Add stream-events option stream-event:reassembly_overlap_different_data and add an example rule. Issue 603.	13 years ago
Anoop Saldanha	3d74fa964a	Update all flow referencing to use the new FlowReference and FlowDeReference ... macros.	13 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	13 years ago
Victor Julien	20d2db085e	reintroduce pool free func for cases where block alloc is not used.	13 years ago
Victor Julien	8f337a3904	stream: never resend reassembled data to app layer.	13 years ago
Eric Leblond	619014a280	pool: rename Free function to Cleanup ... This patch renames Free functions to Cleanup as the free is made by the pool system.	13 years ago
Eric Leblond	fa079c1da0	pool: realize a block allocation for preallocated item. ... This patch required a evolution of Pool API as it is needed to proceed to alloc or init separetely. The PoolInit has been changed with a new Init function parameter.	13 years ago
Victor Julien	869109a6a0	stream/app layer: add Truncate app layer callback that is called if stream depth is reached. Use it to trunc open files in HTTP.	13 years ago
Victor Julien	9d2e17fa98	stream: don't NULL dereference p->flow->protoctx in StreamTcpReassembleDepthReached	13 years ago
Victor Julien	43c7fd7585	file inspection: improve logging when stream.depth limit is reached. #493.	13 years ago
Eric Leblond	0227a87fcb	cleaning: fix warning when building with clang. ... clang was issuing some warnings related to unused return in function. This patch adds some needed error treatment and ignore the rest of the warnings by adding a cast to void.	13 years ago
Anoop Saldanha	c5cc9d454d	stream raw reassembly fix	13 years ago
Victor Julien	ed3599b3d8	stream: improve error checking.	13 years ago
Victor Julien	88a21456e3	stream: keep segments in memory until we are sure the stream/state is inspected.	13 years ago
Anoop Saldanha	64625675ce	set stream_eof flag per stream, only when the stream initiates a close. Fix htp parser to close connection per direction based on this	13 years ago
Anoop Saldanha	225b917e93	remove unused stream ssn flag - STREAMTCP_FLAG_TOSERVER_REASSEMBLY_STARTED	14 years ago
Victor Julien	fddaca6e8b	Implement stream memcap enforcements using atomics instead of spinlocked counters.	14 years ago
Victor Julien	0150e66ede	flow engine: improve scalability ... Major redesign of the flow engine. Remove the flow queues that turned out to be major choke points when using many threads. Flow manager now walks the hash table directly. Simplify the way we get a new flow in case of emergency.	14 years ago
Victor Julien	e237841a8e	Fix compilation with profiling enabled. Minor unittest fixes.	14 years ago
Victor Julien	c4b34e6ef7	Fix various minor clang/scan-build warnings.	14 years ago
Victor Julien	16cfae2f51	Trigger raw stream reassembly on receiving a full HTTP request or response.	14 years ago
Victor Julien	ddfa5c49c6	Stream engine: gap handling ... Set a stream event for stream gaps. Add a (disabled by default) signature to the stream-event.rules.	14 years ago
Victor Julien	425294f912	stream reassembly: account stream gaps ... Add counter to the stream reassembly engine to count stream gaps. Stream gaps are the result of missing packets (usually due to packet loss). This missing data stops the reassembly for the app layer.	14 years ago
Victor Julien	262a7300d7	flow: shrink Flow datatype ... Introduce a separate FlowAddress structure for holding the ipv4 or ipv6 address that doesn't have the family in it like the Address structure. Instead, the family is stored in the flow as a flag: FLOW_IPV4 and FLOW_IPV6. Add macro's to check the family, copy the address, etc. Update many unittests to reflect these changes. Introduce unittest helper functions for creating and initializing a flow and freeing it again. On 64 bit this shrinks the flow with 8 bytes.	14 years ago
Victor Julien	a0b532dc45	stream reassembly: simplify base_seq tracking for protocol detection. Shrinks TcpStream structure.	14 years ago
Anoop Saldanha	4130c5e2b8	if flow has disabled app layer inspection, disable buffering the segments unnecessarily in inline reassembly	14 years ago
Anoop Saldanha	43cbed8c92	enable toclient alproto detection for inline reassembly	14 years ago