Victor Julien
aa04d9eefb
Improve stream gap handling. Instead of giving up as soon as we see a gap we now wait much longer before we decide it's a gap.
15 years ago
Victor Julien
2849d2b1d3
Initial code for stream 'inline' mode: packets that are (partly) overlapping with already accepted packets (meaning in the streams seg list) are rewritten to make sure they contain the exact same data.
15 years ago
Victor Julien
8b5f553a35
Inspect a pseudo packet upon receiving a RST so that we are sure both sides of the TCP session are inspected.
15 years ago
Gurvinder Singh
55a863359c
support for pseudo packet creation from reassembled stream segments
15 years ago
Victor Julien
44e678b86b
Comment out disabled unittests.
15 years ago
Victor Julien
1d971b53a6
Update all unittests
15 years ago
Victor Julien
b0901ab30d
Fix compilation with --enable-debug
15 years ago
Victor Julien
61a9936d55
Inspect a pseudo packet upon receiving a RST so that we are sure both sides of the TCP session are inspected.
15 years ago
Gurvinder Singh
00f21f34e8
support for pseudo packet creation from reassembled stream segments
15 years ago
Victor Julien
8fa5a2c025
Split applayer and raw stream reassembly
...
Split stream reassembly in 2 parts: a part that sends ack'd data to the app
layer parsers as soon as it's available, and another part that queues up
data into larger chunks for raw inspection.
15 years ago
Victor Julien
dda6d3e07b
Add error counters.
15 years ago
Victor Julien
4ae7144876
Fix 2 cases where overlapping data in the stream engine wouldn't be properly handled potentially causing the wrong data being used in stream reassembly.
15 years ago
Eric Leblond
1db4aadd16
Supress usage of Packet declaration in tests.
...
For convenience, a massive usage of 'Packet p;' declaration has
been done in the tests function. Although this was completely
legal, this is not possible anymore because of the new Packet
allocation structure. This massive patch modifies all suricata
files to use a SCMalloc allocated pointer to Packet instead.
This patch has been done using coccinelle (http://coccinelle.lip6.fr )
which is a semantic patching tool. This ensures that things like call
to SCFree() should have not been forget because the semantic patch
explicitly forces the call to SCFree(p) before each return. With this
patch all unittests are running fine with a small and a big default
packet size.
15 years ago
Gurvinder Singh
892dea31e4
added the counter for tcp.segment_memcap_drop to show the dropped segments count due to memory limit
15 years ago
Gurvinder Singh
6a5bc52461
support for several tcp evasion attacks. Thanks to Judy Novak and G2 Inc for reporting them
15 years ago
Victor Julien
1d73e1fb7e
Small update to the ssh module: fix a valgrind warning and a couple of compiler warnings. Do a few small style updates.
15 years ago
Pablo Rincon
9d7baa7a9f
Adding ssh app layer module with two new keywords: ssh.protoversion and ssh.softwareversion
15 years ago
Gurvinder Singh
0dab0e3935
fix the reassembly depth test (bug 216)
15 years ago
Victor Julien
a9e78871fe
Really fix bug 205 this time, repair a broken unittest.
15 years ago
Victor Julien
196e572daa
Make sure holding up to_client reassembly stops after the proto is detected or we're sure we'll never detect it. Fixes issues related to bug 205.
15 years ago
Pablo Rincon
4c94a27b71
Fix bug 205 (at stream-tcp-reassemble)
15 years ago
Gurvinder Singh
f0928a4555
support for enforcing the depth until when the reassembly will be performed
15 years ago
Victor Julien
66dee577d7
Force stream reassembly on streams where we didn't yet detect the protocol if the stream is closing.
15 years ago
Gurvinder Singh
8b0ca4f628
support for seperate memcaps for reassembly and stream engine
15 years ago
Victor Julien
92858a211d
Fix STREAM_EOF flag overwriting STREAM_START flag on short streams. This made us miss short HTTP sessions.
15 years ago
Victor Julien
a3ff0e7210
Don't scan TCP packet payload if it was added to the stream. Inspect the tcp stream with the correct packet. Should fix #184 and #185 .
15 years ago
Pablo Rincon
8cc525c939
UDP support at AppLayer message handling
15 years ago
William Metcalf
cc76aa4bc6
properly init flows inside of unit-tests caused lock-up when falling back to using mutex locks
15 years ago
Victor Julien
9a08d6c11c
Fixes to stream pattern matching.
15 years ago
Victor Julien
81f2499834
Store stream msgs processed by the app layer in the tcp session so they can be inspected by the detection module as well. The detection module returns them to the pool.
15 years ago
Victor Julien
c26434fef1
Move flow use cnt to atomic and outside of the flow mutex protection.
15 years ago
William Metcalf
2eef905c07
GPL and Copyright header updates.
15 years ago
Gurvinder Singh
5fe1dc1d24
support for sslv2/sslv3 their unit tests and better stream no reassembly flag handling
15 years ago
Victor Julien
70b32f7380
First stab at creating a stateful detection engine.
...
Stateful detection for app layer detection keywords, except uricontent. Stores it's partial results in the flow structure. Other modifications:
- Generalize transaction tracking, logging and inspection.
- Adapt http and dcerpc to use the new transaction handling.
- Stream engine now always notifies app layer of a stream eof.
This commit fixes bug #124 .
15 years ago
Gerardo Iglesias Galvan
9f4fae5b1a
Fix inconsistent use of dynamic memory allocation
15 years ago
Victor Julien
ecf5a8fbcc
Fix broken stream unittest.
15 years ago
Victor Julien
7a427ec7f4
Switch to pattern id based results checking in the mpm. Move app layer proto detection towards a more signature based approach.
15 years ago
William Metcalf
ce01927515
Import of GPLv2 Header 050410
15 years ago
Victor Julien
b6a45fd1a4
Hack around cornercase in debug code in stream engine. Works around #140 .
15 years ago
Victor Julien
e0c2c86342
Make HTTP proto detection more reliable. Add HEAD keyword. Thanks rmkml for the report/request.
15 years ago
Victor Julien
59c5e819b1
Fix compilation if debugging is disabled.
15 years ago
Victor Julien
ad02732907
Properly cleanup stream engine spinlocks and mutexes at shutdown. Fixes drd errors in unittests.
15 years ago
Victor Julien
156b844ccb
Fix tcp segment list corruption bug
16 years ago
Pablo Rincon
b708d7f65d
Adding Uricontent inspection with spm. Modifiers for uricontent are now supported
16 years ago
Gurvinder Singh
8e444f1772
stream and application layer improvements
16 years ago
Victor Julien
3d7b882bde
Make sure all smsgs are handled every time, even in case or error. The fuzzer found an issue where unhandled messages remained in the queue leading to threading issues.
16 years ago
Gurvinder Singh
7438f981da
stream memory leaks fixed and unit tests added
16 years ago
Pablo Rincon
25a3a5c6d8
Adding mem wrapper to debug runtime alloc()/free() functions. Fixing some memory leaks.
16 years ago
Victor Julien
f96511a8b1
Check reassembly limits against correct stream direction. Set proper direction flag in stream msgs.
16 years ago
Gurvinder Singh
ed99e73622
bug 78
16 years ago