101 Commits (47a199ee978608ba4351c40f48c00833bdc3b6c6)

Author	SHA1	Message	Date
Anoop Saldanha	976a86def4	Introduce convenience macro to set Stream app proto completion flag.	12 years ago
Anoop Saldanha	b1dffdfbe0	Add app layer protocol packet event detection support.	12 years ago
Anoop Saldanha	0d7159b525	App layer protocol detection updated and improved. We now use ... confirmation from both directions and set events if there's a mismatch between the 2 directions. FPs from corrupt flows have disappeared with this.	12 years ago
Anoop Saldanha	22c05da3cd	Replace ssn appproto_detection_completed flag with individual stream ones.	12 years ago
Anoop Saldanha	c044541b1c	Provide convenience macros for setting flow flags on protocol matching by ... PM and PP phase. Replace the areas of the code that would otherwise rely on setting/reading these flags with these macros. Other minor tweaks to some api calls.	12 years ago
Anoop Saldanha	4f7339c423	code cleanup.	12 years ago
Anoop Saldanha	8e8bc49063	Introduce detection parser function pointer.	12 years ago
Victor Julien	bc3f941acb	profiling: enabled app layer profiling for UDP app layer modules	13 years ago
Last G	8ae11f73b2	Added parentheses to fix Eclipse static code analysis ... Fixed bug in action priority (REJECT_DST had lowest prio)	13 years ago
Anoop Saldanha	3d74fa964a	Update all flow referencing to use the new FlowReference and FlowDeReference ... macros.	13 years ago
Victor Julien	19a7e7f395	flow: create a flow lock macro API, implement it for mutex and rwlocks. Mutex remains the default.	14 years ago
Victor Julien	8b1333a277	Add more flow lock assertions to the debug validation code.	14 years ago
Victor Julien	5ba41c7890	Fix locking error in filestore handling. Add debug validate check for asserting a flow is locked.	14 years ago
Anoop Saldanha	9a6aef459e	modify all relevant app layer API calls to accomodate passing parser local storage argument	14 years ago
Anoop Saldanha	d3468d88b0	app layer udp cleanup + update dcerpc udp todo	14 years ago
Victor Julien	06904c9024	App Layer cleanup ... Removal of per flow 'aldata' array. It contained a ptr for each ALPROTO. Instead now we have 2 ptrs in the flow: alparser and alstate. Various cleanups and dead code removal from the app layer API. Should safe 100+ bytes memory per flow on 64 bit. Updated lots of unittests to reflect these changes.	14 years ago
Anoop Saldanha	08bd8ec4e2	on failed alproto detection on both sides, only disable app layer inspection. No reassembly disabling for any direction	14 years ago
Anoop Saldanha	55ed6c2a55	disable session reassembly for either/both the directions, only when we have established failed proto detection in both the directions	14 years ago
Anoop Saldanha	bc216a3396	fix/updates to app layer proto detection	14 years ago
Victor Julien	e8e392fb1f	Profiling: add per packet accounting of how much ticks are spend in protocol detection.	14 years ago
Victor Julien	fca541f40e	Add per app layer parser profiling ... Per packet per app layer parser profiling. Example summary output: Per App layer parser stats: App Layer IP ver Proto cnt min max avg -------------------- ------ ----- ------ ------ ---------- ------- ALPROTO_HTTP IPv4 6 163394 126 38560320 42814 ALPROTO_FTP IPv4 6 644 117 26100 2566 ALPROTO_TLS IPv4 6 670 117 7137 799 ALPROTO_SMB IPv4 6 114794 126 225270 957 ALPROTO_DCERPC IPv4 6 5207 126 25596 1266 Also added to the csv out. In the csv out there is a new column "stream (no app)" that removes the app layer parsers from the stream tracking. So raw stream engine performance becomes visible.	14 years ago
Anoop Saldanha	7c31a2327e	Add support for port based probing parsers for alproto detection	15 years ago
Anoop Saldanha	fe6e41e3ef	Removed FLOW_AL_NO_APPLAYER_INSPECTION. Moved it as FLOW_NO_APPLAYER_INSPECTION in Flow->flags. Turned Flow->flags into uint32_t and removed Flow->alflags	15 years ago
Anoop Saldanha	0c94d910e4	Removed FLOW_AL_STREAM_TOSERVER and FLOW_AL_STREAM_TOCLIENT. Use STREAM_TOSERVER and STREAM_TOCLIENT instead	15 years ago
Anoop Saldanha	ac5584a863	Removed FLOW_AL_PROTO_DETECT_DONE. Replaced it with FLOW_ALPROTO_DETECT_DONE, stored it in Flow->flags	15 years ago
Anoop Saldanha	49e2b580cb	Removed FLOW_AL_PROTO_UNKNOWN. We don't need this flag	15 years ago
Anoop Saldanha	38fe2b9070	Removed FLOW_AL_STREAM_START, EOF and GAP flags. We don't need these. Just use STREAM_* flags	15 years ago
Victor Julien	5d2a341096	Disable unused code, fix compiler warning.	15 years ago
Victor Julien	00e4dde6a6	Fix PKT_STREAM_EOF never being set, resulting in some raw stream chunks never being inspected. Improve debug output.	15 years ago
Victor Julien	121e9c72aa	Add more debug printing of reassembled data into the app layer api.	15 years ago
Victor Julien	8fa5a2c025	Split applayer and raw stream reassembly ... Split stream reassembly in 2 parts: a part that sends ack'd data to the app layer parsers as soon as it's available, and another part that queues up data into larger chunks for raw inspection.	15 years ago
Victor Julien	3b239b3e48	Cleanup and document AppLayerHandleTCPData	15 years ago
Victor Julien	fe6bf728d3	Create a AppLayerHandleTCPData function to directly feed data from the reassembly engine to the app layer parsing.	15 years ago
Victor Julien	0e8e8e3728	Don't stop stream reassembly if protocol detection failed, only stop/prevent app layer parsing.	15 years ago
Pablo Rincon	5c43db85ce	Drop streams on inline mode when a drop rule match from a reassembled stream and/or app layer inspection	15 years ago
Gurvinder Singh	8852b83fa7	flowbits, flowvars, pktvars, flow flags and app layer info added to alert-debug.log	15 years ago
Victor Julien	b8fec77f37	Fix tcp connections that are reset (RST packet) not always inspecting the reassembled stream. Update transaction id code to make sure both directions of a transaction are inspected before incrementing the inspect_id.	15 years ago
Victor Julien	ba12f3c109	Applayer to flow fixes and cleanups.	15 years ago
Pablo Rincon	8cc525c939	UDP support at AppLayer message handling	15 years ago
Victor Julien	9a08d6c11c	Fixes to stream pattern matching.	15 years ago
Victor Julien	a0c1209a44	Inspect the reassembled stream together with the packet payload in the same direction.	15 years ago
Victor Julien	9f95ab7441	Make sure a stream that has a failing app layer inspection module no longer stops reassembly, but only app layer inspection. This way we can continue to inspect the reassembled stream.	15 years ago
Victor Julien	81f2499834	Store stream msgs processed by the app layer in the tcp session so they can be inspected by the detection module as well. The detection module returns them to the pool.	15 years ago
Victor Julien	c26434fef1	Move flow use cnt to atomic and outside of the flow mutex protection.	15 years ago
Victor Julien	70b32f7380	First stab at creating a stateful detection engine. ... Stateful detection for app layer detection keywords, except uricontent. Stores it's partial results in the flow structure. Other modifications: - Generalize transaction tracking, logging and inspection. - Adapt http and dcerpc to use the new transaction handling. - Stream engine now always notifies app layer of a stream eof. This commit fixes bug #124.	16 years ago
Victor Julien	7a427ec7f4	Switch to pattern id based results checking in the mpm. Move app layer proto detection towards a more signature based approach.	16 years ago
William Metcalf	ce01927515	Import of GPLv2 Header 050410	16 years ago
Victor Julien	4824868766	Application layer detection improvements ... - improve locking of application layer handling, making sure that the flow cannot be freed/cleared when the detection engine is still working with it. - add a check to the app layer detection to make sure that a match function will only inspect an app layer state if it's of the right type.	16 years ago
Victor Julien	ecf86f9c23	Rename to Suricata.	16 years ago
Victor Julien	2cfa284999	Fix app layer detect to actually work.	16 years ago
Victor Julien	f1f7df0766	First iteration of doing app layer detection.	16 years ago