20 Commits (6730f3d5ccd422a0b557bc2ff69814c8fe528abf)

Author	SHA1	Message	Date
Victor Julien	61cdd9be6b	dns: detect case of request flooding ... In the case where DNS requests are sent over the same flow w/o a reply being received, we now set an event in the flow and refuse to add more transactions to the state. This protects the DNS handling from getting overloaded slowing down everything. A new option to configure this behaviour was added: app-layer: protocols: dnsudp: enabled: yes detection-ports: udp: toserver: 53 request-flood: 750 The request-flood parameter can be 0 (disabling this feature) or a positive integer. It defaults to 500. This means that if 500 unreplied requests are seen in a row an event is set. Rule 2240007 was added to dns-events.rules to match on this.	12 years ago
Victor Julien	07c97412f3	DNS: fix response name length logic ... In some cases where the length would be calculated as 0 we'd loop until we'd hit our loop limit. Update name logic everywhere.	12 years ago
Eric Leblond	79fcf1378a	Use unlikely in malloc failure test. ... This patch is a result of applying the following coccinelle transformation to suricata sources: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc|SCMallocAligned|SCRealloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	12 years ago
Victor Julien	5c08b2296f	DNS: copy only the length of the hardcoded string, not the length of the destination buffer.	12 years ago
Anoop Saldanha	f592c481dc	Introduce a separate inspection engine for app events.	12 years ago
Anoop Saldanha	5e2d9dbdc3	Add and use EventGetInfo for getting info on an event. ... Also update existing parsers and app-layer-event Setup to use this.	12 years ago
Anoop Saldanha	6cb0014287	Move app event module registration as a part of app layer proto table.	12 years ago
Victor Julien	3d78cc8ca6	DNS: free TX events using proper function	12 years ago
Victor Julien	6aed56d093	Dns: fix memory leak when events are set	12 years ago
Victor Julien	91fb47475b	DNS: break out of DNSResponseGetNameByOffset if we're in there too long. Can happen on bad data.	12 years ago
Victor Julien	2f3f577fb6	DNS: convert info logs to debugs	12 years ago
Victor Julien	1c371da46d	DNS: better handle TX' with lost replies	12 years ago
Victor Julien	1367074c75	App layer: clean up TX before lowest active one ... Update DNS to handle cleaning up this way.	12 years ago
Victor Julien	ebab9aee83	DNS: move internal tx id tracking to u64	12 years ago
Victor Julien	e8ad876b48	App layer: add 'StateHasEvents' API call ... Per TX decoder events resulted in significant overhead to the detection engine, as it walked all TX' all the time to check if decoder events were available. This commit introduces a new API call StateHasEvents, which speeds up this process, at the expense of keeping a counter in the state. Implement this for DNS as well.	12 years ago
Victor Julien	571b8ac186	DNS: add support for per TX decoder events.	12 years ago
Victor Julien	43ba5a677e	DNS: enable mpm/fast_pattern support for dns_query	12 years ago
Victor Julien	f10dd603ff	DNS: adding dns_request content modifier	12 years ago
Victor Julien	6674f4892c	DNS: add per tx internal id ... Add per TX id. Rename transaction_cnt to transaction_max (id) and increment it on tx creation.	12 years ago
Victor Julien	8e01cba85d	DNS TCP and UDP parser and DNS response logger	12 years ago