405 Commits (b95d7efbd0b699248f633193acee71cf7289c92d)

Author	SHA1	Message	Date
Victor Julien	b31ffde6f4	output: remove error codes from output	4 years ago
Victor Julien	e042cd785e	error: use SC_ENOMEM for alloc errors	4 years ago
Victor Julien	8ef95c10a8	pool: use errno style error reporting	4 years ago
Victor Julien	892b7021b2	stream: debug message cleanup	4 years ago
Eric Leblond	e6768118da	stream: flag TCP streams with gap	4 years ago
Victor Julien	235f369ab9	stream: reduce pool locking overhead ... Add thread local cache to avoid locking overhead for ssns and segments. A thread will return segments/ssns to a local cache first, and if that is full, to a return queue where the actual return to the pool returns a batch, to amortize locking overhead. Adds segment and session pool/cache counters to see where how effective the cache is.	4 years ago
Victor Julien	23323a961f	app-layer: reduce app cleanup and output-tx calls ... Track packets that updated the app-layer, and for those run the transaction housekeeping and output-tx logging loops. Do the same of end of flow packets. This skips needless iterations over the transaction stores.	4 years ago
Victor Julien	e250ef6402	debug: remove empty header	4 years ago
Jeff Lucovsky	e133ab029e	stream/event: Trigger stream reassembly event ... Issue: 3512 This commit triggers the stream reassembly depth reached event.	4 years ago
Victor Julien	100d821a9f	stream: fix GAP check ... Gap check would consider a GAP when the current data was in fact exactly not a gap, but next segment(s) were already available.	4 years ago
Victor Julien	0ebe372607	stream: after missing segments, be liberal on RST ... This avoids long lasting inactive flows because in the most likely case the RST did in fact end the connection. However Suricata may still consider it to be "established".	4 years ago
Victor Julien	8580499ded	exceptions: initial exception-policy implementation ... Adds a framework for setting exception policies. These would be called when the engine reaches some kind of exception condition, like hitting a memcap or some traffic processing error. The policy gives control over what should happen next: drop the packet, drop the packet and flow, bypass, etc. Implements the policy for: stream: If stream session or reassembly memcaps are hit call the memcap policy on the packet and flow. flow: Apply policy when memcap is reached and no flow could be freed up. defrag: Apply policy when no tracker could be picked up. app-layer: Apply ppolicy if a parser reaches an error state. All options default to 'ignore', which means the default behavior is unchanged. Adds commandline options: add simulation options for exceptions. These are only exposed if compiled with `--enable-debug`. Ticket: #5214. Ticket: #5215. Ticket: #5216. Ticket: #5218. Ticket: #5194.	4 years ago
Victor Julien	55fb2d5d2d	stream/tests: remove bad test; update failing test to new behavior	4 years ago
Victor Julien	b6cf79901a	stream/reassemble: clarify error handling	4 years ago
Victor Julien	84448d3bae	tests: remove unnecessary flow locks ... Added once to satisfy debug validation, but we don't mix unittests and debug validation anymore. sed -i -E '/.*FLOWLOCK_.*LOCK/d' *.c	4 years ago
Philippe Antoine	5bd19135b0	util: remove malloc from streaming buffer config ... as it is unused	4 years ago
Scott Jordan	2bf3172dd1	stream: memcap tracking for TcpSegment alloc	4 years ago
Eric Leblond	3908166f91	stream: count realloc in memcap ... TCP memory cap was not taking into account the memory that can be used by realloc of Packet headers in TCP segments.	4 years ago
Eric Leblond	b416a4455c	stream: conditionally add packet header to segment ... This patch optionally adds packet header to the TCP segment and update the for each segment function by changing the callback. This patch is based on the work by Scott Jordan <scottfgjordan@gmail.com>	4 years ago
Victor Julien	1282b179cc	stream/reassembly: reduce scope of variable	4 years ago
Victor Julien	3a7d09edfc	detect/frame: get data using stream callback ... Inspect only data that has already been consumed by the app-layer parser. This allows for simpler progress tracking.	4 years ago
Victor Julien	ffe036e881	frame: introduce entry for getting stream data for frame	4 years ago
Victor Julien	96bc11d0d0	stream: make raw data handling more generally usable ... Move raw detection logic out of main StreamReassembleRawDo() so that it can be reused for other parts of the engine. The caller now has to specify a right edge of the data.	4 years ago
Victor Julien	afb97d1dee	stream: add offset to raw stream callback ... This gives the called function to understand where it is in the stream.	4 years ago
Philippe Antoine	2a22b4ca1f	flow: fix integer warnings ... Ticket: 4516	4 years ago
Victor Julien	6e90bf4739	streaming: remove unused 'auto slide' support ... Add debug validation checks for "impossible" conditions.	4 years ago
Philippe Antoine	dca76a45a8	stream-tcp: fix integer warnings ... Ticket: 4516	4 years ago
Angelo Mirabella	41a139b590	stream-tcp-reassemble: fix reassembly direction for FIN packets ... Suricata invokes the stream reassembly logic only for the current packet direction if the packet contains a FIN flag. However, this does not handle the case in which the packet ACKs data from the opposing direction. This patch forces the invocation of the stream reassembly logic on both direction when Suricata sees a FIN packet.	5 years ago
Victor Julien	1556e86c7d	app/frames: initial support ... The idea of stream frames is that the applayer parsers can tag PDUs and other arbitrary frames in the stream while parsing. These frames can then be inspected from the rule language. This will allow rules that are more precise and less costly. The frames are stored per direction in the `AppLayerParserState` and will only be initialized when actual frames are in use. The per direction storage has a fixed size static portion and dynamic support for a larger number. This is done for effeciency. When the Stream Buffer slides, frames are updated as they use offsets relative to the stream. A negative offset is used for frames that started before the current window. Frames have events to inspect/log parser errors that don't fit the TX model. Frame id starts at 1. So implementations can keep track of frame ids where 0 is not set. Frames affect TCP window sliding. The frames keep a "left edge" which signifies how much data to keep for frames that are still in progress.	5 years ago
Victor Julien	eeee740e84	stream: add util function to get 'usable' data	5 years ago
Victor Julien	a7e77dd22d	stream: suppress noisy debug message	5 years ago
Victor Julien	544ff0fb52	stream: debug code for showing segment list state	5 years ago
Victor Julien	258415b23f	stream: unify ack'd right edge handling ... Use util function in all code needing the ack'd data.	5 years ago
Philippe Antoine	527415dba0	protodetect: handle all gaps, even when depth is reached	5 years ago
Juliana Fajardini	ff976df704	stream-tcp-reassemble: fix typo, updt copyright yr	5 years ago
Juliana Fajardini	613f9b2f5a	stream-tcp-reassemble: fix ConfGetBool unc'kd call	5 years ago
Victor Julien	7a114e506a	app-layer/pd: only consider actual available data ... For size limit checks consider only available data at the stream start and before any GAPS. The old check would consider too much data if there were temporary gaps, like when a data packet was in-window but (far) ahead of the expected segment.	5 years ago
Jeff Lucovsky	1eeb96696b	general: Cleanup bool usage	5 years ago
Ilya Bakhtin	1ecea0f44c	stream/tcp: fix stream side after direction change	6 years ago
Philippe Antoine	7264f58f2c	tcp: remove debug asserts about large windows ... Completes 00d7c9034b	6 years ago
Philippe Antoine	707f027231	protos: renaming ALPROTO_HTTP* constants ... Having now ALPROTO_HTTP1, ALPROTO_HTTP2 and ALPROTO_HTTP Run with 3 sed commands git grep ALPROTO_HTTP | cut -d: -f1 | uniq | xargs sed -i -e 's/ALPROTO_HTTP/ALPROTO_HTTP1/g' git grep ALPROTO_HTTP12 | cut -d: -f1 | uniq | xargs sed -i -e 's/ALPROTO_HTTP12/ALPROTO_HTTP2/g' git grep ALPROTO_HTTP1_ANY | cut -d: -f1 | uniq | xargs sed -i -e 's/ALPROTO_HTTP1_ANY/ALPROTO_HTTP/g' and then running clang-format	6 years ago
Victor Julien	00d7c9034b	stream: remove debug assert ... In cases of large windows in the past the check would tigger.	6 years ago
Victor Julien	4e925ca260	stream: harden data size handling ... Handle edge cases around ACKs and last_ack getting below 'app_progress', which can happen during shutdown of a flow with multiple GAPs.	6 years ago
Victor Julien	5391746518	stream: bail early if no data after a gap	6 years ago
Victor Julien	27c9280735	stream: harden data size handling	6 years ago
Victor Julien	8a08fe82d4	stream: don't send STREAM_START multiple times	6 years ago
Victor Julien	a5a46795bd	stream: make sure to call app-layer in case of depth reached	6 years ago
Victor Julien	34e83b8acf	stream: remove GAP flag from stream ... This flag was checked in many places, but never set expect in 2 unittests.	6 years ago
Victor Julien	b6fed6d431	stream: fix GAP size ... Fix GAPs sizes sometimes exceeding the ACK'd data size.	6 years ago
Victor Julien	6978d8dac6	stream: fix deinit after incomplete init	6 years ago