2624 Commits (dec34afa4039aee40cc765a4699787ebce2da16f)

Author	SHA1	Message	Date
Victor Julien	4992f7c417	Remove SIG_FLAG_MPM_URI flag. It was checked but never set.	14 years ago
Victor Julien	2650551192	Rename signature init flags to indicate they are init flags.	14 years ago
Victor Julien	6ebd71545b	Fix signature flag definitions on 32 bit.	14 years ago
Victor Julien	291ddd95f2	Detection engine -- mpm ... Each signature is in one mpm ctx at max, but there were 3 separate id's in use: packet, stream, http. Merged them all into one. Could shrink the SignatureHeader structure with 8 bytes because of this, should lead to better caching performance.	14 years ago
Victor Julien	7db72bce75	Optimize detection engine prefiltering logic.	14 years ago
Victor Julien	89f83e714c	Introduce http_server_body keyword. ... The http_server_body content modifier modifies the previous content to inspect the normalized (dechunked, unzipped) http_server_body. The workings are similar to http_client_body. Additionally, a new pcre flag was introduced "/S". To facilitate this change the signature flags field was changed to be 64 bit.	14 years ago
Eric Leblond	6e7a8f38bf	ipfw: Add support for autofp and worker runmode ... This patch convert ipfw code to the PcktAcqLoop API and rework the running mode to use the running mode wrapper already used by NFQ.	14 years ago
Eric Leblond	c1ad64b333	ips: update copyright date and author list.	14 years ago
Eric Leblond	d4cbc7c38c	ipfw: funnier to manage capability in running code.	14 years ago
Eric Leblond	f1cb4da442	ipfw: fix indentation of the file. ... I will have to work a lot on this one. It will be easier with a correct indentation.	14 years ago
Eric Leblond	acc9634106	nfq: add some comments about possible evolution	14 years ago
Eric Leblond	9ca7257279	nfq: suppress unused functions.	14 years ago
Eric Leblond	58b20359a7	nfq: add worker runmode support.	14 years ago
Eric Leblond	aee2e3ddd6	nfq: Add autofp mode support	14 years ago
Eric Leblond	115c3499d2	nfq: factorize auto mode	14 years ago
Eric Leblond	70c574fb63	runmode: Add support for IPS running mode ... This patch adds the 'auto', 'autofp' and 'worker' runmode for IPS. It provides a set of ready-to-use functions that can be used by NFQ and IPFW to implement this running mode.	14 years ago
Eric Leblond	5cfdd7594f	util-device: Modify function name. ... This patch modifies LiveBuildQueueList name to LiveBuildDeviceList to have a consistent naming accross function. It also adds a doxygen comment to add author and description of util-device.c file.	14 years ago
Eric Leblond	7096e11ab5	af-packet: simplify code.	14 years ago
Eric Leblond	5cec22ac37	threads: Add sanity check.	14 years ago
Eileen Donlon	327fd048a0	Fixed coredump windows compile issue	14 years ago
Eric Leblond	6c55af847b	'auto' running mode does not support 'threads' var. ... This patch modifies the RunModeSetLiveCaptureAuto() prototype to be able to detect that a 'threads' variable (telling how much threads must listen to one socket in IDS mode) has been used in the configuration file. It then print a warning message if this is the case.	14 years ago
Victor Julien	6f0ca120d1	Make sure existing log-pcap and unified2-alert 'limit' settings don't break.	14 years ago
Victor Julien	678213c9f4	Fix ParseSizeString return code and a compiler warning.	14 years ago
Anoop Saldanha	4b8ebb5c53	set default response body limit for specific http server conf	14 years ago
Anoop Saldanha	6240131a4e	updates to accomodate master rebase	14 years ago
Anoop Saldanha	7c9d1b80fd	Update size parsing API with new calls for returing u8, u16, u32 and u64 values. Make updates in the codebase to use these new calls	14 years ago
Anoop Saldanha	e0c13434ef	bug 333 - support new Size Parsing API. Update various conf params inside the engine to use this API to parse sizes in the format xxx <-just the no represents bytes, xxxkb <- kilobytes, xxxmb <- megabytes, xxxgb <- gigabytes, where xxx is a \d+	14 years ago
Eileen Donlon	79e0299643	Fixed coredump compile problems on bsd, windows	14 years ago
Anoop Saldanha	b970273163	fix broken unittest	14 years ago
Anoop Saldanha	651f91e4de	fix setting pseudo packet from this commit: ... commit 259e022f721a7c3a70c26447b1cf730bb8a1f6cd Author: Anoop Saldanha <poonaatsoc@gmail.com> Date: Sun Dec 4 13:20:43 2011 +0530 fix setting ipv4 header in pseudo packet	14 years ago
Anoop Saldanha	d40fb5b933	Remove unnecessary flow NULL check	14 years ago
Anoop Saldanha	8533cd2cdf	fix mapping of tcp states to flow_established and flow_closed. Improves accuracy	14 years ago
Anoop Saldanha	cc7db6315c	Move setting packet iponly flags from decode section to stream section	14 years ago
Anoop Saldanha	eaf15911e7	fix setting ipv4 header in pseudo packet	14 years ago
Victor Julien	322779fb23	flow engine: release flow lock earlier in flow kill/prune process. Minor cleanups.	14 years ago
Victor Julien	5401764697	flow engine: minor cleanup.	14 years ago
Victor Julien	bfa872b9b7	flow engine: no longer allow FlowRequeue to be called with the same src and dst queue.	14 years ago
Victor Julien	84c7480c06	flow engine: convert flow hash code FlowRequeue call to FlowEnqueue.	14 years ago
Victor Julien	ad4e016288	flow engine: make FlowEnqueue lock the queue. Adapt callers.	14 years ago
Victor Julien	fbbdbb251f	flow engine: remove unneeded 'need_srclock' argument for FlowRequeue	14 years ago
Victor Julien	0331da9773	flow engine: introduce FlowRequeueMoveToSpare ... As part of a clean up of how FlowRequeue is used, introduce FlowRequeueMoveToSpare for moving a flow from a locked queue to the spare queue.	14 years ago
Victor Julien	7fa3df33f2	flow engine: introduce FlowRequeueMoveToBot ... As part of a clean up of how FlowRequeue is used, introduce FlowRequeueMoveToBot for moving a flow to the bottom of it's queue.	14 years ago
Victor Julien	ae1e4c1d7d	Add missing hash row unlock.	14 years ago
Victor Julien	f47f601f09	Fix unified2 setting the wrong eth_type.	14 years ago
Eric Leblond	9422a36851	unified2: avoid to log RAW packet ... If the packet datalink is ethernet, we add a fake ethernet header to stream logging to avoid that barnyard2 create different files.	14 years ago
Eric Leblond	fc56abfcd0	unified2: log an ethernet header for stream alert. ... If packet is a of type ethernet, we log the alert reconstructed payload as an ethernet packet and not a raw packet. This will avoid to confuse barnyard2 pcap output.	14 years ago
Victor Julien	49d6885ec7	Improve debug validation code for packet, add new macro for flow.	14 years ago
Victor Julien	3009429e3c	HTTP transaction handling improvement ... In some cases AppLayerTransactionGetInspectId can return -1, which is now handled by all it's callers. Improve logic of selecting which transactions are inspected by the various HTTP keywords.	14 years ago
Eileen Donlon	dbdf2d888f	Enable/disable core dump in config (feature 319)	14 years ago
Victor Julien	7b0f261fdc	Add some debug statements for debugging a smtp issue.	14 years ago
Victor Julien	004b5dde88	Support libhtp's different handling of CONNECT requests.	14 years ago
Victor Julien	117d51c965	Fix a compile warning when debug is enabled.	14 years ago
Victor Julien	1df3304655	Clean up for unittests code: only compile unittest api code when unittests are enabled. Fix unittest code that wasn't wrapped in the proper UNITTESTS ifdefs.	14 years ago
Victor Julien	a138b32533	flow manager: timing change ... Set default timeout for the flow manager to wake up to 1 second. The 0.4 sec performed best on a Xeon, but in kvm vm's it was horrible: 32 bit vm: 60% cpu for flowmgr when idle. 64 bit vm: 30% cpu for flowmgr when idle. With the 1 second timeout both are at 0.3% cpu.	14 years ago
Victor Julien	786148319c	Lower flow manager wake up timer to 0.4 seconds as that performs 2% better in my tests.	14 years ago
Anoop Saldanha	776bf633e3	flow manager code cleanup. Remove unused code + fix indentation. Remove unused vars	14 years ago
Anoop Saldanha	5133098bd6	Accomodate pcap-file mode to signal flow mgr to wakeup when it exceeds a certain time interval. This let's the flow mgr keep in sync with pcap timestamp changes	14 years ago
Anoop Saldanha	9917744707	separate timers for flow mgr thread for normal and emerg mode. Signal flow mgr thread when in emerg mode	14 years ago
Eric Leblond	5a63662766	Flow: use condition system instead of short sleep ... Short sleep can lead to some really annoying performance issue in some environnement like virtual systems. This technic was used in the flow manager. This patch uses an alternate approach based on a timed condition which is triggered each time a new flow has to be created. This avoid to run out of flow. A counter is also done to be able not to run the cleaning code at each new flow.	14 years ago
Victor Julien	34450b9b57	Don't parse layers / ext headers above ipv6 frag header. This is taken care of by defrag.	14 years ago
Victor Julien	938e9b3db0	Fix filestore related segv.	14 years ago
Victor Julien	e6d8d0443c	Unify output functions for alert-debug for IPv4 and IPv6.	14 years ago
Victor Julien	3c7f09d1ea	Add debug output to engine event.	14 years ago
Victor Julien	e6af837b25	Convert StreamTcpSetEvent function into macro. Eases debug.	14 years ago
Victor Julien	58011554b0	Don't consider payload len in ACK value validation check.	14 years ago
Victor Julien	9878eca086	file handling: expand filestore keyword ... Filestore keyword by default (... filestore; ... ) marks only the file in the same direction as the rule match for storing. This makes sense when inspecting individual files (filemagic, filename, etc) but not so much when looking at suspicious file requests, where the actual file is in the response. The filestore keyword now takes 2 optional options: filestore:<direction>,<scope>; By default the direction is "same as rule match", and scope is "currently inspected file". For direction the following values are possible: "request" and "to_server", "response" and "to_client", "both". For scope the following values are possible: "tx" for all files in the current HTTP/1.1 transation, "ssn" and "flow" for all files in the session/flow. For the above case, where a suspious request should lead to a response file download, this would work: alert http ... content:"/suspicious/"; http_uri; filestore:response; ...	14 years ago
Victor Julien	ddfa5c49c6	Stream engine: gap handling ... Set a stream event for stream gaps. Add a (disabled by default) signature to the stream-event.rules.	14 years ago
Victor Julien	45d86ff58a	Stream reassembly / app layer: disable gap errors ... Gap errors on the app layer are now silently handled. No longer printed to the screen.	14 years ago
Victor Julien	425294f912	stream reassembly: account stream gaps ... Add counter to the stream reassembly engine to count stream gaps. Stream gaps are the result of missing packets (usually due to packet loss). This missing data stops the reassembly for the app layer.	14 years ago
Victor Julien	d8d8fdd9f5	Improve handling of packets when stream is in the fin_wait1 or fin_wait2 state.	14 years ago
Victor Julien	b74c73309b	file handling: improve filestore keyword handling ... In stateful detection only inspect the file portion of the rule after all other conditions matched. This to prevent "filestore" from tagging files for storage during a partial match. Add a couple of unittests to test the behaviour change.	14 years ago
Victor Julien	4cbe7519fa	Add missing file util code.	14 years ago
Victor Julien	56b96363b8	Fix merge artefact.	14 years ago
Victor Julien	63c9a3ab85	Remove duplicate include.	14 years ago
Victor Julien	042fd850fc	Make sure we check the sgh for no magic and no store once per flow direction.	14 years ago
Victor Julien	f3fbc1a44c	file handling: filemagic matching improvement ... Magic buffer is a null terminated string. Allow matching on the final \0 using filemagic:"somevalue|00|"; so we can anchor to the end of the buffer.	14 years ago
Victor Julien	2ccd35c6e4	Fix code after rebase.	14 years ago
Victor Julien	33848124d1	Fix a multipart body parsing issue.	14 years ago
Victor Julien	96d20098b0	file inspect: stateful inspection split ... Split stateful detection of the files in a HTTP state between toserver and toclient inspection.	14 years ago
Victor Julien	d59ca75e46	file extract: split toserver and toclient tracking ... Split toserver and toclient file tracking for the http state.	14 years ago
Victor Julien	04ea70ccf7	file extract: pruning ... Add pruning of files in memory so we keep only memory what we really need. Fix magic logic. Reset file part of the de_state on receiving another file in the same tx.	14 years ago
Victor Julien	1c934acc85	Don't store fd per file (too many fd's). Enable IPv6 storing. Close file on receiving stream end flag.	14 years ago
Victor Julien	b402d97179	File carving -- enable reponse file extraction ... - Enable response body tracking - Enable file extraction for responses - File store meta file includes magic, close reason. - Option to force magic lookup for all stored files. - Fix libmagic calls thead safety.	14 years ago
Victor Julien	66a3cd96a8	Prepare HTTP response body tracking.	14 years ago
Victor Julien	417495e542	file-extraction: remove no longer used files.	14 years ago
Victor Julien	e1022ee5ae	file-extraction: Disconnect file handling from flow and move into the app layer state.	14 years ago
Victor Julien	27645f64c6	Remove unused util-filetype.[ch] from Makefile.am.	14 years ago
Victor Julien	9b62ec65ab	Make sure filemagic works properly regardless of filestore being in use for a flow.	14 years ago
Victor Julien	5945e652d6	Initial implementation of filemagic keyword.	14 years ago
Victor Julien	f4a6f4b293	Add libmagic detection, linking and a basic API.	14 years ago
Victor Julien	23e01d23d3	Implement filestore keyword, including a way for the stateful detection engine to conclude that a file will never have to be stored.	14 years ago
Victor Julien	3e7baa6810	Fix improper error handling in http body chunk function.	14 years ago
Victor Julien	403b2788d6	Add support for extracting PUT files.	14 years ago
Victor Julien	59cda9a358	Fix not using new htp callback when using the bundled htp. Add indication to --build-info. Fix valgrind warning in test and further improve test.	14 years ago
Victor Julien	ef0536794c	Adding comments, some cleanups.	14 years ago
Victor Julien	21acd72adf	Cleanups to the Multipart parsing code. Fixes to negation in filename and fileext.	14 years ago
Victor Julien	70f0d3d2e7	Add negation to filename and fileext, use same syntax as with content.	14 years ago
Victor Julien	32fb9f375d	log-file log-dir option added, meta file created, fixes.	14 years ago
Victor Julien	a6b7a560f1	Fix a bug in the HTTP file closing.	14 years ago
Victor Julien	7e3d537338	Fix setting libhtp personality.	14 years ago