11 Commits (5cdeadb33d34ad1a08078e8e1ad51a49ba7b7cce)

Author	SHA1	Message	Date
Victor Julien	5cdeadb33d	Use u8 for ipproto ... In a few places in app layer and unittests u16 was used.	12 years ago
Anoop Saldanha	429c6388f6	App layer API rewritten. The main files in question are: ... app-layer.[ch], app-layer-detect-proto.[ch] and app-layer-parser.[ch]. Things addressed in this commit: - Brings out a proper separation between protocol detection phase and the parser phase. - The dns app layer now is registered such that we don't use "dnstcp" and "dnsudp" in the rules. A user who previously wrote a rule like this - "alert dnstcp....." or "alert dnsudp....." would now have to use, alert dns (ipproto:tcp;) or alert udp (app-layer-protocol:dns;) or alert ip (ipproto:udp; app-layer-protocol:dns;) The same rules extend to other another such protocol, dcerpc. - The app layer parser api now takes in the ipproto while registering callbacks. - The app inspection/detection engine also takes an ipproto. - All app layer parser functions now take direction as STREAM_TOSERVER or STREAM_TOCLIENT, as opposed to 0 or 1, which was taken by some of the functions. - FlowInitialize() and FlowRecycle() now resets proto to 0. This is needed by unittests, which would try to clean the flow, and that would call the api, AppLayerParserCleanupParserState(), which would try to clean the app state, but the app layer now needs an ipproto to figure out which api to internally call to clean the state, and if the ipproto is 0, it would return without trying to clean the state. - A lot of unittests are now updated where if they are using a flow and they need to use the app layer, we would set a flow ipproto. - The "app-layer" section in the yaml conf has also been updated as well.	12 years ago
Victor Julien	61cdd9be6b	dns: detect case of request flooding ... In the case where DNS requests are sent over the same flow w/o a reply being received, we now set an event in the flow and refuse to add more transactions to the state. This protects the DNS handling from getting overloaded slowing down everything. A new option to configure this behaviour was added: app-layer: protocols: dnsudp: enabled: yes detection-ports: udp: toserver: 53 request-flood: 750 The request-flood parameter can be 0 (disabling this feature) or a positive integer. It defaults to 500. This means that if 500 unreplied requests are seen in a row an event is set. Rule 2240007 was added to dns-events.rules to match on this.	12 years ago
Anoop Saldanha	5e2d9dbdc3	Add and use EventGetInfo for getting info on an event. ... Also update existing parsers and app-layer-event Setup to use this.	12 years ago
Victor Julien	1c371da46d	DNS: better handle TX' with lost replies	12 years ago
Victor Julien	1367074c75	App layer: clean up TX before lowest active one ... Update DNS to handle cleaning up this way.	12 years ago
Victor Julien	ebab9aee83	DNS: move internal tx id tracking to u64	12 years ago
Victor Julien	e8ad876b48	App layer: add 'StateHasEvents' API call ... Per TX decoder events resulted in significant overhead to the detection engine, as it walked all TX' all the time to check if decoder events were available. This commit introduces a new API call StateHasEvents, which speeds up this process, at the expense of keeping a counter in the state. Implement this for DNS as well.	12 years ago
Victor Julien	571b8ac186	DNS: add support for per TX decoder events.	12 years ago
Victor Julien	6674f4892c	DNS: add per tx internal id ... Add per TX id. Rename transaction_cnt to transaction_max (id) and increment it on tx creation.	12 years ago
Victor Julien	8e01cba85d	DNS TCP and UDP parser and DNS response logger	12 years ago