14 Commits (c961da2dceefd6a82168eadabdcfc624ea8d799a)

Author	SHA1	Message	Date
Jason Ish	bbaa79b80e	DNP3: Application layer decoder. ... Decodes TCP DNP3 and raises some DNP3 decoder alerts.	10 years ago
Victor Julien	dbb3a12b32	logging: return string for ALPROTO_FAILED	10 years ago
kwong	a3ffebd835	Adding SCADA EtherNet/IP and CIP protocol support ... Add support for the ENIP/CIP Industrial protocol This is an app layer implementation which uses the "enip" protocol and "cip_service" and "enip_command" keywords Implements AFL entry points	10 years ago
Jason Ish	c1b921265f	app-layer: template for application layer parser	11 years ago
Victor Julien	925aac854e	alproto: improve AppProtoToString ... Make AppProtoToString compilation fail on missing 'case's.	12 years ago
Eric Leblond	0bafc71689	app-layer: add modbus to AppProtoToString ... It was missing causing protocol identified as modbus not to be displayed in netflow events.	12 years ago
Anoop Saldanha	429c6388f6	App layer API rewritten. The main files in question are: ... app-layer.[ch], app-layer-detect-proto.[ch] and app-layer-parser.[ch]. Things addressed in this commit: - Brings out a proper separation between protocol detection phase and the parser phase. - The dns app layer now is registered such that we don't use "dnstcp" and "dnsudp" in the rules. A user who previously wrote a rule like this - "alert dnstcp....." or "alert dnsudp....." would now have to use, alert dns (ipproto:tcp;) or alert udp (app-layer-protocol:dns;) or alert ip (ipproto:udp; app-layer-protocol:dns;) The same rules extend to other another such protocol, dcerpc. - The app layer parser api now takes in the ipproto while registering callbacks. - The app inspection/detection engine also takes an ipproto. - All app layer parser functions now take direction as STREAM_TOSERVER or STREAM_TOCLIENT, as opposed to 0 or 1, which was taken by some of the functions. - FlowInitialize() and FlowRecycle() now resets proto to 0. This is needed by unittests, which would try to clean the flow, and that would call the api, AppLayerParserCleanupParserState(), which would try to clean the app state, but the app layer now needs an ipproto to figure out which api to internally call to clean the state, and if the ipproto is 0, it would return without trying to clean the state. - A lot of unittests are now updated where if they are using a flow and they need to use the app layer, we would set a flow ipproto. - The "app-layer" section in the yaml conf has also been updated as well.	13 years ago
Anoop Saldanha	127ef8f903	Use a typdef AppProto <-> uint16_t for representing app layer protocol. ... Some minor refactoring/cleanup, including renaming functions.	13 years ago
Anoop Saldanha	3ec411486e	Fix compilation failure when we don't enable unittests. Got to #ifdef ... ALPROTO_TEST.	13 years ago
Anoop Saldanha	16144fe38a	Rename function pointer var to use the FuncPtr typing convention. Resupply "dns" as the alproto name for ALPROTO_DNS.	13 years ago
Anoop Saldanha	6f8cfd999f	Allow detection ports for alproto to be specified via the conf file. ... To understand the option have a look at the option app-layer.protocols.tls.detection-ports	13 years ago
Victor Julien	43ba5a677e	DNS: enable mpm/fast_pattern support for dns_query	14 years ago
Victor Julien	8e01cba85d	DNS TCP and UDP parser and DNS response logger	14 years ago
Victor Julien	fca541f40e	Add per app layer parser profiling ... Per packet per app layer parser profiling. Example summary output: Per App layer parser stats: App Layer IP ver Proto cnt min max avg -------------------- ------ ----- ------ ------ ---------- ------- ALPROTO_HTTP IPv4 6 163394 126 38560320 42814 ALPROTO_FTP IPv4 6 644 117 26100 2566 ALPROTO_TLS IPv4 6 670 117 7137 799 ALPROTO_SMB IPv4 6 114794 126 225270 957 ALPROTO_DCERPC IPv4 6 5207 126 25596 1266 Also added to the csv out. In the csv out there is a new column "stream (no app)" that removes the app layer parsers from the stream tracking. So raw stream engine performance becomes visible.	15 years ago