2092 Commits (6e0d98d9c4e33ca5e61447518d7e686419fc1858)

 

All Branches   

Search

Author	SHA1	Message	Date
Victor Julien	a8bb98836b	Don't handle and validate the TCP timestamp at the same time. Instead validate first, then later when all other validation has been done as well, handle.	14 years ago
Victor Julien	8d3f9c53a9	Minor cleanups.	14 years ago
Victor Julien	bff70eed6d	Update to depth code. Get segment from the correct pool when a payload is truncated.	14 years ago
Victor Julien	66c40f782c	Have reassembly errors also set a stream event.	14 years ago
Victor Julien	0f072648e6	Another iteration of the reassembly depth enforcement, now considering retransmissions.	14 years ago
Victor Julien	935958219d	Rename RST validation function to match convention	14 years ago
Victor Julien	94fe0d5fa2	Add ACK validation to Reset/RST validation code.	14 years ago
Victor Julien	16cd31a408	Remove unused pseudo packet reassembly code.	14 years ago
Victor Julien	bf88a6de09	Add depth comment.	14 years ago
Victor Julien	a26768ce7a	Change the way the reassembly depth is enforced. Ignore retransmissions, get rid of per session counter.	14 years ago
Victor Julien	7af9c58af7	Improve ACK value validation, timestamp checking code. Overall layout.	14 years ago
Victor Julien	0f5b6a8bd7	Fix minor comment typo.	14 years ago
Victor Julien	aa04d9eefb	Improve stream gap handling. Instead of giving up as soon as we see a gap we now wait much longer before we decide it's a gap.	14 years ago
Victor Julien	6ffb9da9be	Better support ack/psh data packets on several states. Updates to ack validation code.	14 years ago
Victor Julien	6fca55e068	Add some debug output to app-layer-htp.	14 years ago
Victor Julien	25f5589078	First round of adding 'stream events'. Basic stream tracking events added.	14 years ago
Victor Julien	2849d2b1d3	Initial code for stream 'inline' mode: packets that are (partly) overlapping with already accepted packets (meaning in the streams seg list) are rewritten to make sure they contain the exact same data.	14 years ago
Victor Julien	3857154f4b	Fix the pseudo packet having the wrong proto set, causing massive fp's. Flag packets to be part of the established phase of a tcp session, so we won't prematurely inspect the app layer state.	14 years ago
Victor Julien	8b5f553a35	Inspect a pseudo packet upon receiving a RST so that we are sure both sides of the TCP session are inspected.	14 years ago
Gurvinder Singh	55a863359c	support for pseudo packet creation from reassembled stream segments	14 years ago
Victor Julien	cc116d71ef	Fix unittests after merge.	14 years ago
Gurvinder Singh	2beb7af7f8	support for validating the ACK before updating the last_ack field and also update next_seq if we missed the last packet	14 years ago
Victor Julien	acc38c9ebf	Make sure we don't try to 'verdict' the fake PKT_PSEUDO_STREAM_END packets.	14 years ago
Victor Julien	c955254b4e	Adapt stream code to packet memory allocation changes.	14 years ago
Victor Julien	44e678b86b	Comment out disabled unittests.	14 years ago
Victor Julien	a622ad5047	Fix new unittests introduced by rebase with next branch.	14 years ago
Victor Julien	1d971b53a6	Update all unittests	14 years ago
Victor Julien	fadd6d6361	Add pseudo packet counter.	14 years ago
Victor Julien	f606621e8c	Fix the pseudo packet having the wrong proto set, causing massive fp's. Flag packets to be part of the established phase of a tcp session, so we won't prematurely inspect the app layer state.	14 years ago
Victor Julien	b0901ab30d	Fix compilation with --enable-debug	14 years ago
Victor Julien	6482c34909	Increment flow use cnt for pseudo packets as the flow is not supposed to disappear while dealing with those packets.	14 years ago
Victor Julien	2072ad80af	Never create a pseudo packet based on a pseudo packet.	14 years ago
Victor Julien	61a9936d55	Inspect a pseudo packet upon receiving a RST so that we are sure both sides of the TCP session are inspected.	14 years ago
Gurvinder Singh	00f21f34e8	support for pseudo packet creation from reassembled stream segments	14 years ago
Victor Julien	8fa5a2c025	Split applayer and raw stream reassembly ... Split stream reassembly in 2 parts: a part that sends ack'd data to the app layer parsers as soon as it's available, and another part that queues up data into larger chunks for raw inspection.	14 years ago
Victor Julien	dda6d3e07b	Add error counters.	14 years ago
Victor Julien	3b239b3e48	Cleanup and document AppLayerHandleTCPData	14 years ago
Victor Julien	fe6bf728d3	Create a AppLayerHandleTCPData function to directly feed data from the reassembly engine to the app layer parsing.	14 years ago
Victor Julien	b5a5ef14b9	Make sure we reuse a TCP session if we receive a valid 3WHS on a closed TCP session, can happen if a new session has the same tuple.	14 years ago
Victor Julien	24f071cabb	Make sure http_cookie inspects all HTTP transactions. Clean up error messages. Get rid of unused code and dead comments.	14 years ago
Anoop Saldanha	c9897a44a4	fast pattern support for http_cookie. Also support relative modifiers	14 years ago
Anoop Saldanha	bbbedaf963	fast pattern support for http_method. Also support relative modifiers	14 years ago
Anoop Saldanha	2321a4dd58	support isdataat negation. Also fix addiing isdataat to appropriate lists	14 years ago
Victor Julien	4ae7144876	Fix 2 cases where overlapping data in the stream engine wouldn't be properly handled potentially causing the wrong data being used in stream reassembly.	14 years ago
Eric Leblond	9c2bdc6d0c	Main loop: increase timer. ... Timer in the main loop was of 100 usec. This patch increases it to 10 ms which should be a reasonnable delay to declare some threads dead. Signed-off-by: Eric Leblond <eric@regit.org>	14 years ago
Eric Leblond	89558ab9a4	RFC: modify error treatment in PacketCopyData ... Hello Victor This patch modifies error treatment following our discussion on IRC. It tries to follow the error treatment guideline I've been able to read in the different files. I will merge this patch in the original commit if the error treatment seems ok for you. BR, Eric	14 years ago
Eric Leblond	49adc264bc	Don't print message after SCMalloc failure. ... This patch generated via coccinelle is getting rid of logging message after a SCMalloc failure. They were useless as SCMalloc already displays a message.	14 years ago
Eric Leblond	67b95c8c4d	Auto discovery of default packet size ... If default-packet-size is not set, it is possible in some case to guess a correct value. If PCAP or PF_RING are used we are linked to a "physical" interface. Thus, it is possible to get information about the link MTU and hardware header size. This give us the ability to auto discover a decent default-packet-size. If suricata is running under a different running-mode, it will default to 1514.	14 years ago
Eric Leblond	3eada85ff8	Add interface setting discovery via ioctl ... This patch adds support for MTU discovery of link following idea of go.ph1g. It also adds some function to give a approximation of link header length.	14 years ago
Eric Leblond	1db4aadd16	Supress usage of Packet declaration in tests. ... For convenience, a massive usage of 'Packet p;' declaration has been done in the tests function. Although this was completely legal, this is not possible anymore because of the new Packet allocation structure. This massive patch modifies all suricata files to use a SCMalloc allocated pointer to Packet instead. This patch has been done using coccinelle (http://coccinelle.lip6.fr) which is a semantic patching tool. This ensures that things like call to SCFree() should have not been forget because the semantic patch explicitly forces the call to SCFree(p) before each return. With this patch all unittests are running fine with a small and a big default packet size.	14 years ago