232 Commits (46e55f1e346101ed1998ad45681e288a857a7766)

Author	SHA1	Message	Date
Victor Julien	46e55f1e34	http body handling: use streaming buffer API ... Convert HTTP body handling to use the Streaming Buffer API. This means the HtpBodyChunks no longer maintain their own data segments, but instead add their data to the StreamingBuffer instance in the HtpBody structure. In case the HtpBodyChunk needs to access it's data it can do so still through the Streaming Buffer API. Updates & simplifies the various users of the reassembled bodies: multipart parsing and the detection engine.	10 years ago
Victor Julien	52d500c670	flowworker: initial support ... Initial version of the 'FlowWorker' thread module. This module combines Flow handling, TCP handling, App layer handling and Detection in a single module. It does all flow related processing under a single flow lock.	10 years ago
Mats Klepsland	a13df67864	detect: add (mpm) keyword for tls_sni ... Match on server name indication (SNI) extension in TLS using tls_sni keyword, e.g: alert tls any any -> any any (msg:"SNI test"; tls_sni; content:"example.com"; sid:12345;)	10 years ago
Justin Viiret	cce2d114e8	spm: add and use new SPM API ... This new API allows for different SPM implementations, using a function pointer table like that used for MPM. This change also switches over the paths that make use of DetectContentData (which previously used BoyerMoore directly) to the new API.	10 years ago
Justin Viiret	ce408c4d10	spm: add SinglePatternMatchDefaultMatcher ... Allows selecting SPM algorithm with the 'spm-algo' value in the YAML config file.	10 years ago
maxtors	9d3fd82849	Removed duplicate include statements.	10 years ago
Jason Ish	796dd5223b	tests: no longer necessary to provide successful return code ... 1 pass, 0 is fail.	10 years ago
Victor Julien	d6ba01b1b7	detect: make port whitelisting configurable ... Make the port grouping whitelisting configurable. A whitelisted port ends up in it's own port group. detect: grouping: tcp-whitelist: 80, 443 udp-whitelist: 53, 5060 No portranges are allowed at this point.	10 years ago
Victor Julien	725d6c3739	yaml: convert detect-engine to just detect ... Instead of detect-engine which used a list for no good reason, use a simple map now. detect: profile: medium custom-values: toclient-groups: 3 toserver-groups: 25 sgh-mpm-context: auto inspection-recursion-limit: 3000 # If set to yes, the loading of signatures will be made after the capture # is started. This will limit the downtime in IPS mode. #delayed-detect: yes	10 years ago
Victor Julien	1dd135d512	mpm: always cleanup factory	10 years ago
Victor Julien	caea596ce5	profiling: output post-prefilter matches ... Dump a json record containing all sigs that need to be inspected after prefilter. Part of profiling. Only dump if threshold is met, which is currently set by: --set detect.profiling.inspect-logging-threshold=200 A file called packet_inspected_rules.json is created in the default log dir.	10 years ago
Victor Julien	722e2dbf7c	profiling: initial rulegroup tracking ... Per rule group tracking of checks, use of lists, mpm matches, post filter counts. Logs SGH id so it can be compared with the rule_group.json output. Implemented both in a human readable text format and a JSON format.	10 years ago
Victor Julien	c1ad08d11e	detect: remove stream pmq array	10 years ago
Victor Julien	a96fa0fc2f	detect: remove unused dport sgh hash	10 years ago
Victor Julien	fa885e1d85	mpm: remove pattern id logic	10 years ago
Victor Julien	fac2cc0560	detect: mpm deduplication ... Create hash for mpm's that we can reuse. Have packet/stream mpms use this.	10 years ago
Victor Julien	f0ba00e51d	detect: remove old unused code	10 years ago
Victor Julien	10b049304f	detect: set new defaults for grouping	10 years ago
Victor Julien	2ee9bf2aef	detect: rename groupings vars	10 years ago
Victor Julien	1f70ccfc23	detect: remove unused grouping settings	10 years ago
Victor Julien	14d9ce7b2e	detect/mpm: remove unused max_id param from API	10 years ago
Victor Julien	4f8e1f59a6	mpm: remove obsolete mpm algos ... Remove: ac-gfbs, wumanber, b2g, b3g.	10 years ago
Victor Julien	58e533858b	detect mpm: ac-tile/ac-ks default to single ... Use sgh-mpm-context single is it is set to 'auto' when ac-ks is used.	10 years ago
Victor Julien	ffb5498228	detect: fix potential deadlock during reload ... If interrupted during the BreakLoop stage during reload, a deadlock could happen.	10 years ago
Justin Viiret	13b87f5aff	mpm: add Hyperscan integration ... This adds an MPM implementation that uses the Hyperscan regex engine library from Intel, accessible as the "hs" mpm-algo.	10 years ago
Victor Julien	11099cfa42	detect reload: generic packet injection for capture ... Capture methods that are non blocking will still not generate packets that go through the system if there is no traffic. Some maintenance tasks, like rule reloads rely on packets to complete. This patch introduces a new thread flag, THV_CAPTURE_INJECT_PKT, that instructs the capture thread to create a fake packet. The capture implementations can call the TmThreadsCaptureInjectPacket utility function either with the packet they already got from the pool or without a packet. In this case the util func will get it's own packet. Implementations for pcap, AF_PACKET and PF_RING.	10 years ago
Victor Julien	eafd212661	detect reload: call 'breakloop' on capture method ... Split wait loop into three steps: - first insert pseudo packets - 2nd nudge all capture threads to break out of their loop - third, wait for the detection thread contexts to be used Interupt capture more than once if needed Move packet injection into util func	10 years ago
Victor Julien	8394b38941	cppcheck: work around snprintf warning ... Cppcheck 1.72 gives a warning on the following code pattern: char blah[32] = ""; snprintf(blah, sizeof(blah), "something"); The warning is: (error) Buffer is accessed out of bounds. While this appears to be a FP, in most cases the initialization to "" was unnecessary as the snprintf statement immediately follows the variable declaration.	10 years ago
Victor Julien	c91546022d	smtp: clean up thread local memory	10 years ago
Victor Julien	b9ee86fdb4	detect-engine: free memory in error conditions (CID 1351210)	10 years ago
Victor Julien	0dd81b85d4	multi-tenants: improve error handling (CID 1312702)	10 years ago
Victor Julien	4dfbc0effa	multi-detect: fix and simplify config ... instead mappings: - vlan: vlan-id: 1 tenant-id: 2 we'll now use: mappings: - vlan-id: 1 tenant-id: 2 For YAML it pretty much means the same thing. Ticket: 1517	10 years ago
Victor Julien	07d8617b3e	multi-detect: improve error handling	10 years ago
Victor Julien	906b95eed3	multi-detect: handle missing mappings ... Notify/warn user about missing mappings depending on other settings like unix socket and init errors fatal.	10 years ago
Victor Julien	27783f4c66	multi-detect: consider vlan tracking ... Refuse to use vlan selector if vlan tracking is disabled.	10 years ago
Victor Julien	04889f154d	multi-detect: validate vlan_id	10 years ago
Victor Julien	d7d76e7b27	multi-detect: use default tenant ... The default detect engine can be used as 'default tenant'.	10 years ago
Victor Julien	dc3c1ef01e	multi-detect: clean up output	10 years ago
Jason Ish	6b15686fd1	base64_decode, base64_data: decode and match base64	10 years ago
Eric Leblond	a4089873c7	rules-reload: fix reload with -s or -S ... When using the -S or -s option, the reload was causing the specified rules file to be forgotten and the default rules to be loaded at reload time.	10 years ago
Jason Ish	06beca62f5	app-layer: template for application layer content inspection	10 years ago
Victor Julien	979bd35277	detect loader: move to own file	10 years ago
Victor Julien	cfeaf42cab	detect-loaders: configurable amount of loaders	10 years ago
Victor Julien	99c0a7ad72	multi-detect: improve memory handling of setup code	10 years ago
Victor Julien	b7b27684c2	multi-detect: detect loader for unix socket ... Move the tenant load and reload commands to be executed by the detect loader thread(s). Limitation: no yaml parsing in parallel. The Conf API is currently not thread safe, so don't load the tenant config (yaml) in parallel.	10 years ago
Victor Julien	eb09118d64	detect: create loader threads ... To speed up startup with many tenants, tenant loading will be parallelized. As no tempary threads should be used for these memory allocation heavy tasks, this patch adds new type of 'command' thread that can be used to load and reload tenants. This patch hardcodes the number of loaders to 4. Future work will make it dynamic. The loader thread essentially sleeps constantly. When a tasks is sent to it, it will wake up and execute it.	10 years ago
Victor Julien	e19c41a807	multi-detect: hash lookup for tenants ... Use hash for storing and looking up det_ctxs.	10 years ago
Victor Julien	722c56dbf3	detect: clean up thread free code ... Introduce DetectEngineThreadCtxFree that doesn't need a 'ThreadVars' pointer.	10 years ago
Victor Julien	642c267dc4	multi-detect: refuse to add duplicate tenant ... Generate error if tentant to be added is already loaded.	10 years ago
Victor Julien	646eb4c2a8	multi-detect: load tenants from yaml file ... Load tenants and mappings from the suricata.yaml when available.	10 years ago