suricata

Author	SHA1	Message	Date
Eric Leblond	fcfeeeb694	app-layer-expectation: update copyright date	6 years ago
Eric Leblond	1ddd77fae0	app-layer-expectation: clean expectation at flow end When a flow timeout, we can have still existing expectations that are linked to this flow. Given that there is a delay between the real ending of the flow and its destruction by Suricata, the expectation should be already honored so we can assume the risk to clean the expectations that have been triggered by the to-be-deleted flow.	6 years ago
Eric Leblond	6c9d1c0861	app-layer-expectation: limit number of expectations This patch introduces a limitation in term of number of expectations attached to one IPPair. This is done using a circle list so we have a FIFO approach on expectation handling. Circleq list code is copied from BSD code like was pre existing code in queue.h.	6 years ago
Eric Leblond	03e4bfeb02	app-layer-expectation: remove unused parameter	6 years ago
Eric Leblond	140f8baed9	app-layer-expectation: expectation system This patch provides a working expectation system. This will allow suricata to have a way to identify parallel connections opened by a protocol such as FTP. Expectation are a chained list and there is a cleaning by timeout of the entries. This patch also defined a counter of expectations that is also used to check if we need to query IPPairs. This way we only query the IPPairs store if we have an expectation.	9 years ago