180 Commits (cb150003879edc0128f1902db903c5466f86a733)

Author	SHA1	Message	Date
Victor Julien	cb15000387	http: add new events for invalid host header and host part of uri	12 years ago
Victor Julien	43b39d333f	http: fix some decoder events ... Some events we retrieved from error messages are flag now, so check those. Not all can be converted though. These are no longer set: HTTP_DECODER_EVENT_INVALID_TRANSFER_ENCODING_VALUE_IN_RESPONSE HTTP_DECODER_EVENT_INVALID_AUTHORITY_PORT Part of Bug #982.	12 years ago
Victor Julien	636791751e	http: fix field too long events	12 years ago
Victor Julien	5d10bafdba	http: don't call HTPHandleWarning before HTPHandleError as the latter handles warnings and errors.	12 years ago
Victor Julien	129b6a65ca	http: add test for HTTP_DECODER_EVENT_UNKNOWN_ERROR event as a result of a too long request	12 years ago
Anoop Saldanha	9e4eec200f	Update htp event handler to both warning and error events regardless of any conditions.	12 years ago
Anoop Saldanha	5e2d9dbdc3	Add and use EventGetInfo for getting info on an event. ... Also update existing parsers and app-layer-event Setup to use this.	12 years ago
Anoop Saldanha	6cb0014287	Move app event module registration as a part of app layer proto table.	12 years ago
Anoop Saldanha	0d7159b525	App layer protocol detection updated and improved. We now use ... confirmation from both directions and set events if there's a mismatch between the 2 directions. FPs from corrupt flows have disappeared with this.	12 years ago
Anoop Saldanha	ddde572fba	Introduce new options into the conf file to enable/disable - ... 1. Proto detection 2. Parsers For app layer protocols. libhtp has now been moved to the section under app-layer.protocols.http, but we still provide backward compatibility with older conf files.	12 years ago
Victor Julien	7f8d256e7c	Fix tests that didn't expect radix to be freed	12 years ago
Victor Julien	6f2cb141cf	Http: improve tx data cleanup	12 years ago
Victor Julien	67c12c61d3	Http: fix memory leaks when cleaning up our per-tx storage	12 years ago
Anoop Saldanha	94e2527606	Introduce a saner way to validate the completion of request and ... response bodies. Also don't change app state for http from inside inspection.	12 years ago
Anoop Saldanha	dcdcbd9721	Fix creating a backup of htp config. This is used by unittests that ... changed htp config.	12 years ago
Anoop Saldanha	56143131da	Fix unittests that use chunked encoding.	12 years ago
Ken Steele	5532af4621	Create SCMUTEX_INITIALIZER to abstract out PTHREAD_MUTEX_INITIALIZER ... This allows replacing pthread mutexes with other types of mutex.	12 years ago
Eric Leblond	cd3e32ce19	unittests: some functions needs a flow lock. ... In debug validation mode, it is required to call application layer parsing and other functions with a lock on flow. This patch updates the code to do so.	12 years ago
Victor Julien	9faa4b740d	Add --unittests-coverage option to list how many code modules have tests	12 years ago
Anoop Saldanha	48cf0585fb	Suricata upgrade to libhtp 0.5.x. ... Remove the support for now unsupported personalities from libhtp - TOMCAT_6_0, APACHE and APACHE_2_2. We instead use the APACHE_2 personality.	12 years ago
Victor Julien	080c15b3fc	Enable libhtp 0.3.0 compilation and crash free UT run. Still see 5 failed tests.	12 years ago
Victor Julien	0fd9b0c4fa	HTP: free TX from transaction free API call	12 years ago
Victor Julien	f59f90331d	Applayer: remove obsolete StateUpdateTransactionId ... Also, update StateTransactionFree to take an u64 tx id, so it's consistant with the rest of the engine. To reflect these changes, AppLayerRegisterTransactionIdFuncs has been renamed to AppLayerRegisterTxFreeFunc. HTP, DNS, SMB, DCERPC parsers updated.	12 years ago
Anoop Saldanha	058e9278c5	Fix wrong casting of htp pointer. Fixed it back to (HTPState *) inside ... htp utility functions.	12 years ago
Anoop Saldanha	ab4b15c2e7	fix for #788. ... Now depth is kept in mind when we inspect chunks in client/server body. This takes care of FPs originating from inspecting subsequent chunks that match with depth, but shouldn't.	12 years ago
Anoop Saldanha	d4d18e3136	Transaction engine redesigned. ... Improved accuracy, improved performance. Performance improvement noticeable with http heavy traffic and ruleset. A lot of other cosmetic changes carried out as well. Wrappers introduced for a lot of app layer functions. Failing dce unittests disabled. Will be reintroduced in the updated dce engine. Cross transaction matching taken care of. FPs emanating from these matches have now disappeared. Double inspection of transactions taken care of as well.	12 years ago
Eric Leblond	6d225378e4	Workaround function missing in libhtp include ... As reported in bug #688, htp_config_set_path_decode_u_encoding function is not included in libhtp header before 0.3.0. Result is that suricata compilation fail with an external htp library. The following patch detect the issue and adds the missing declaration.	13 years ago
Victor Julien	cc51eec59d	Use new libhtp query string normalization. Bug #739.	13 years ago
Victor Julien	9f519e95a2	http: add event for libhtp detection of request port not matching tcp port.	13 years ago
Last G	8ae11f73b2	Added parentheses to fix Eclipse static code analysis ... Fixed bug in action priority (REJECT_DST had lowest prio)	13 years ago
Victor Julien	5cd46433d3	http: now that htp_state has a cfg reference, use it for body limits	13 years ago
Victor Julien	2763a61213	http: allow configuration of request and response body inspection limits. Issue #560.	13 years ago
Victor Julien	aa4ae98d37	http: fix multipart parsing leading to missing chunks of files in file extraction.	13 years ago
Anoop Saldanha	028c6c1782	Make available custom features of libhtp. ... The power of libhtp customisation now available to users. Options available - path-backslash-separators: yes path-compress-separators: yes path-control-char-handling: none path-convert-utf8: yes path-decode-separators: yes path-decode-u-encoding: yes path-invalid-encoding-handling: preserve_percent path-invalid-utf8-handling: none path-nul-encoded-handling: none path-nul-raw-handling: none set-path-replacement-char: ? set-path-unicode-mapping: bestfit You can use this for your libhtp customisation. Options explained in our wiki. https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Advanced_libhtp_customization	13 years ago
Anoop Saldanha	340542c44e	refactor htpconfigure()	13 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	13 years ago
Victor Julien	fcc21ae4cc	http: fix multipart parsing bug	13 years ago
Victor Julien	869109a6a0	stream/app layer: add Truncate app layer callback that is called if stream depth is reached. Use it to trunc open files in HTTP.	13 years ago
Eric Leblond	92679442ca	Convert to atomic and disable check on HTP config change. ... This patch converts the series of variable to an atomic. Furthermore, as the callbacks are now always run, it is not necessary anymore to refuse a ruleswap if HTP parameters are changing.	13 years ago
Eric Leblond	66a083dafa	Get rid of AppLayerHtpRegisterExtraCallbacks ... This patch add a early exit condition to the body handling callback. This permits to avoid to avoid a complex system to handle htp object change.	13 years ago
Victor Julien	e737e2dc56	http: after path double decoding, also normalize the path again. #504.	13 years ago
Victor Julien	e839cea9e5	Http: don't double decode URI path and query by default. Instead add per server options to enable double decoding for both cases. #464 #504.	13 years ago
Victor Julien	ad827ad030	http: add more decoding unittests.	13 years ago
Victor Julien	43c7fd7585	file inspection: improve logging when stream.depth limit is reached. #493.	13 years ago
Victor Julien	0c98980e21	http: add unittest to test \r in header line.	13 years ago
Anoop Saldanha	6fa46d7526	If new ruleset requires any htp callbacks that aren't already set, don't load new ruleset; request user to restart suricata + disable setting fileinsepection flags unconditionally in main	13 years ago
Victor Julien	ab3fcb01f9	http: decode double decoded path and query string characters. Bug #464.	13 years ago
Victor Julien	f2f8dfd8d6	http: add test to make sure a missing space between header name and value is not a problem (ref #474).	13 years ago
Victor Julien	00948c86d5	Add debug messages to HTTP error/warning handling.	13 years ago
Anoop Saldanha	64625675ce	set stream_eof flag per stream, only when the stream initiates a close. Fix htp parser to close connection per direction based on this	13 years ago