Commit Graph

425 Commits (f9b422bba74383d84eca905469865a7538394b43)

Author SHA1 Message Date
Brian Rectanus 3e9223c22c Cleanup bytetest and bytejump. 16 years ago
Victor Julien a4fe971897 Fix datalink retrieval for pcap file mode and nfq mode for use in unified2. 16 years ago
Breno Silva c8308222c1 Unified2rev2
Signed-off-by: Breno Silva <breno.silva@gmail.com>
16 years ago
Victor Julien bff8ae299f Fix pcap file mode 16 years ago
Victor Julien 597d0e9a20 Fix detection of failed thread startup. Cleanup startup output a bit. 16 years ago
Victor Julien ab09e80205 Remove unnecessary header. 16 years ago
Victor Julien 0d0ffb9963 Reorganize header inclusions. 16 years ago
Victor Julien 1727d191a4 Add pktvar and flowvar tests to ip only unittest. Make output cleaner. 16 years ago
Pablo Rincon 3458c07f46 Changed SignatureIsIPOnly and added some unittests 16 years ago
Jason Ish f508d1e0fd Add getters for integer and boolean values. 16 years ago
root 2c796339f7 Small fixes 16 years ago
Pablo Rincon bdf119ade3 Adding window and isdataat keyword and some unittests 16 years ago
Victor Julien 0941c152fd Minor layout fixes. 16 years ago
Breno Silva f6b36b7241 Unified2rev2
Signed-off-by: Breno Silva <breno.silva@gmail.com>
16 years ago
Breno Silva ee8fef2e68 Unified2rev2
Signed-off-by: Breno Silva <breno.silva@gmail.com>
16 years ago
Breno Silva 8c797927cd Unified2rev2
Signed-off-by: Breno Silva <breno.silva@gmail.com>
16 years ago
Breno Silva 145d89ba01 Unified2rev1
Signed-off-by: Breno Silva <breno.silva@gmail.com>
16 years ago
Breno Silva a5e386ce52 Unified2
Signed-off-by: Breno Silva <breno.silva@gmail.com>
16 years ago
William Metcalf c313444991 comment out printf for unittest format 16 years ago
Jason Ish beef3c6c24 Fix access to ttl. 16 years ago
Victor Julien daf3078279 Fix compilation on 32bit 16 years ago
Brian Rectanus ed3fee2bac Fixed detect-byte src to use new util-byte return codes. 16 years ago
Brian Rectanus ba4c2e599d Add byte test to detection engine. 16 years ago
Brian Rectanus 11d068740a Byte utils return num bytes extracted on success instead of zero. 16 years ago
Brian Rectanus 02a8b583c9 Added byte_test and byte_jump support. 16 years ago
Brian Rectanus af06e6a288 Added byte extraction util. 16 years ago
Victor Julien cfb605aa8a Put the precooked runmodes in a separate file. 16 years ago
William Metcalf e95e5cb36a missing memsets in pppoe unit tests 16 years ago
Victor Julien 301522f316 Add TCP_GET_WSCALE macro for easy access to wscale. Update StreamTcp to use it. Default to wscale 14 (max) in case of midstream as there seems to be no reliable way to predict wscale if we missed it. 16 years ago
Victor Julien f92ac1fbdb Merge branch 'tcpopt' into next 16 years ago
Victor Julien a6fe5a7331 Add TCP_GET_TS1 and TCP_GET_TS2 marco's to efficiently retrieve the TCP timestamps in host order. 16 years ago
Jamie a297225157 victor must be getting sick of PPPoE and ICMP 16 years ago
Victor Julien b6deadd2b4 Fixed a few missing places for tv->flags access. Changed mutex init for packets slightly. 16 years ago
Victor Julien 968dc45d27 Merge branch 'threading' into t 16 years ago
Victor Julien 1858be7a2f Lock threadvars flags using spinlocks. 16 years ago
Victor Julien edfddcb282 Clean up stream tests memory handling. Remove counters in the address handling that were thread unsafe. 16 years ago
William Metcalf 6095b8f2a1 fix for older libc's missing def for IPPROTO_DCCP 16 years ago
Victor Julien f03d540d2f Suppress debug output in yaml loader. 16 years ago
Jason Ish c91a4baad5 - Autoconf goo for libyaml.
- Mock YAML configuration file.

- YAML loader for basic YAML files - not all YAML elements support yet..
  todo.

- Add --dump-config command line parameter to dump the state of the
  configuration db after loading the config file.
16 years ago
Victor Julien 733c3bcb8c Fix "ip" rules not ending up in the tcp and udp sig group heads correctly. 16 years ago
Victor Julien d883a993f7 Make sure stream_size works on IPv6 as well, only checks TCP packets, validates input better. 16 years ago
Gurvinder Singh 0675b7d7cf fixed unittests against protoctx 16 years ago
Gurvinder Singh d82d83eba2 fixed regex to handle space 16 years ago
Gurvinder Singh df74597a1f use next_seq for stream size and comments 16 years ago
Gurvinder Singh 7e5f5e68e8 regex intial version 16 years ago
Gurvinder Singh aa87f70470 stream size match function and unittests 16 years ago
Gurvinder Singh ac53ca5b27 Stream Size rule option 16 years ago
Anoop Saldanha 3a45b2711c Fixed the Perf API startup issue 16 years ago
William Metcalf 07bb501aca compile fix for source-nfq.c 16 years ago
Victor Julien 15b75d727a Fix reassembly unittests. 16 years ago
Victor Julien a39108843e Small tm module API rename to reflect that Init/Deinit/ExitPrintStats are per thread calls. 16 years ago
Victor Julien b102ea2123 Big update:
- Implement "closing" state in flow.
- Add protocol specific timeouts.
- Lots of stream tracking updates, fixing a lot of out of window issues.
- Stream reassembly fixes.
- Implement a new IDS runmode with 4 stream and detect threads.
- Added a BUG_ON macro that aborts the engine if the expression is true.
- Better balance the flow queue handler for traffic that doesn't have flow (like icmp currently).
- Simplify application level protocol in the Tcp Session.
- Add some debugging memory counters.
16 years ago
Victor Julien b4f0e82463 Small flow updates. 16 years ago
Gurvinder Singh 2e3d7fcb9d Fixed seg fault 16 years ago
Gurvinder Singh 9dcf6e2de2 handle the FLOW_STATE_CLOSED 16 years ago
Gurvinder Singh ced5157dc9 Flow get state protocol specific 16 years ago
Gurvinder Singh ec4fee215c registering unit tests 16 years ago
Gurvinder Singh ab76253ec6 registering stream timeouts and flow prunning unit tests 16 years ago
Gurvinder Singh a4ad7939d2 proto specific free function 16 years ago
Gurvinder Singh 55cdf8947e some modification in protocol specifc timeouts and free funtion 16 years ago
Gurvinder Singh efcde9f52e Some fixes for timeouts 16 years ago
Gurvinder Singh e3b76dcaad efficient protocol specific timeouts 16 years ago
Gurvinder Singh b46d9dc2b4 part2 and part3.1 of timout task 16 years ago
Gurvinder Singh 59e2232211 setting timeout on first packet in the flow 16 years ago
Gurvinder Singh a31a261737 Another and right way i guess for timeouts 16 years ago
Gurvinder Singh 0e64fa78b4 Protocol Specific Timeouts 16 years ago
Gurvinder Singh a65d558d2f Changed the debug message 16 years ago
Victor Julien 7c5f95db01 Small threading update. 16 years ago
Anoop Saldanha f35d9f0437 threading improvements. Replaced the use of slot(2/3) with varslot. Improve error handling in slot functions. Additional helper functions for thread creation 16 years ago
Victor Julien 03d084858c Add macro's for access to ICMPv(4|6) type & code. 16 years ago
Jason Ish 00821489d7 Unit test will now fail if allow_override bug is reintroduced. 16 years ago
Jason Ish 3f51fc2ce7 - Add a configuration dumper.
- Fix a bug where you could override a configuration value that did not
  set allow_override to true.
16 years ago
Victor Julien aad8aaf3cb Actually add the new queue handler. 16 years ago
Victor Julien 3636ca9703 Adding a "flow" queue handler. This queue handler passes packets of the same flow to the same queue. Changed the default IDS mode to use this.
Some output cleanups, shutdown should be cleaner now.
16 years ago
Victor Julien e7206623bb GRE struct naming fix, comment adds. 16 years ago
Anoop Saldanha 22c0ec2bc5 Added support for the csum-<protocol> rules keyword to the detection engine. Keywords added are ipv4-csum, tcpv4-csum, tcpv6-csum, udpv4-csum, udpv6-csum, icmpv4-csum and icmpv6-csum 16 years ago
Victor Julien 39724df664 2nd try of fixing some bugs reported by static code analysis tool. 16 years ago
Victor Julien 6eaff4be12 Fixes for issues found by static code analyzer. 16 years ago
Victor Julien 85b1fd7dfc Add TLS 1.1 and 1.2 detection. 16 years ago
Anoop Saldanha 401a0313d4 checksum calculation functions for icmpv6, udp over ipv6 and tcp over ipv6 16 years ago
Victor Julien 1f782bb912 Fix pointer issue in sig loading. 16 years ago
Victor Julien 086ba5f49b Add 'BySize' field parser. Add stub tls parser. 16 years ago
Victor Julien b26b5aa462 More cleanups. 16 years ago
Jamie 9adfe54620 more unit tests for pppoe - part I 16 years ago
Victor Julien 44b6042cf9 Fix wrong data type used in a reassembly error checking. 16 years ago
Anoop Saldanha 41dd0f8e62 checksum calculation functions for ipv4, tcp, udpv4, icmpv4 16 years ago
Victor Julien 18f556ade1 Fix a number of broken overlap calculations. Add comments exmplaining them all. 16 years ago
Victor Julien 85abc3ef62 Complete removal of global de_ctx. UtRuntests now returns the number of failed tests or 0 on none. Program exits with code 1 on failed tests, code 0 otherwise. Removal of broken http uri test. 16 years ago
Victor Julien 1132ab635a Rename all pmt->det_ctx. 16 years ago
Victor Julien b9972a9d2c Cleanups 16 years ago
Victor Julien 855dc62e30 Git merge artifact. 16 years ago
Brian Rectanus 63d970eb0b Fix compiler warning and add better ipv4 options debugging output. 16 years ago
Victor Julien 84da1e9dc4 Add seg_list integrity testing to reassemly. Remove all debug output but some. Better deal with packets before the point that we already reassembled. 16 years ago
Gurvinder Singh 65ebb5611d Task 4 handling of missed packets by IDS only and both IDs and end host 16 years ago
Gurvinder Singh feecb7406a Fixed some issues in gap handling 16 years ago
Gurvinder Singh 0a32b6491f Handling of IDS missed packets and its unitests 16 years ago
Gurvinder Singh b267d4072a test the bug in freeing memory 16 years ago
Gurvinder Singh bcebbebdfd Handling IDS missed packets 16 years ago
Victor Julien 7715e8f0fc Work around some Tcp session free issues in the app layer parsers. 16 years ago
Victor Julien 391e69e699 Fix tunnel packet handling. 16 years ago
Victor Julien e7f8a02484 Improve GRE counting. Actually use the GRE decoder. Register the GRE counter. 16 years ago
Breno Silva 9528e02e46 GRE support 16 years ago
Victor Julien f5fe190b45 Fix a ipv4 compiler warning. Improve TCP opt decoding error handling logic. 16 years ago
Brian Rectanus 74cb73fc1d Decode IPv4 options. 16 years ago
Victor Julien d7de22d0f0 Removing GPLv2 license info as our bylaws aren't final yet and we will redist code non-GPL as well. Rename struct conf_node to ConfNode to comply with engine coding style. 16 years ago
Victor Julien efdd952eb5 Remove noisy debugging output. 16 years ago
Victor Julien 6a1acba1ab Fix missing conf include. 16 years ago
Jason Ish e3b538c7d7 Simple configuration API.
Allow the log directory to be changed.
16 years ago
Victor Julien c73f4334d0 Fix compiler warning. 16 years ago
Victor Julien 4369816cdd Improvements to content keyword memory handling.
First version of a simple pattern based L7 proto detection engine. Currently just works by matching a single pattern in the initial data. Implemented HTTP, SSL, MSN, JABBER, SMTP and a few more.

Couple of pattern matcher cleanups.
16 years ago
Victor Julien 0242fad770 Fix error in freeing the ctx of a SigMatch. 17 years ago
Victor Julien 97854cf4bb Fixup some rule parser memleaks 17 years ago
Victor Julien 25aa05fdb2 use C99 int's. 17 years ago
Gurvinder Singh 6393b6778c unittests for gap handling 17 years ago
Victor Julien 57f71f7e4b Pass the DecodeThreadVars to all Decoder functions properly. Improve the error handling. 17 years ago
Victor Julien 63bc68ee90 Unify all counter registration code on uint16_t counter id's. 17 years ago
Anoop Saldanha 244f5d547a new registration functions for the stats api, with local thread storage for counter ids 17 years ago
Victor Julien d67eec918f Adapted flow comments to doxygen style. 17 years ago
Victor Julien 0a9fca7e57 Fix compilation without unittests enabled. 17 years ago
Victor Julien 451adaff34 Small name support code update for flowbits, flowvars and pktvars. 17 years ago
Victor Julien 522efdcf03 Small reshuffle of the free funcs in the Stream code. 17 years ago
Gurvinder Singh 6824eddb0f New function for task3 17 years ago
Victor Julien 5b946443d8 Use finer grained locking for app layer parsing. 17 years ago
Victor Julien 2d406555a8 Fix compiler warning about 'mode'. 17 years ago
Jamie 698e9c0699 fix incorrect offset in decode-ethernet for PPPoE, more debug statements 17 years ago
Victor Julien 4ec31e0445 Fix short IPv4 packets not getting detected in the decoder. Set decode event on short ipv6 packets. 17 years ago
Victor Julien 265038a75a Fix a memory read error in the BDNM search algorithms. Also (hopefully) fix a 64bit error. 17 years ago
Victor Julien f6a8454232 Layout fixes. 17 years ago
Jamie fdbd09db6c add perfcounter to pppoe 17 years ago
Jamie afa8a6766e test cases for PPPoE, ICMPv4 17 years ago
Victor Julien e31563f61c Fix nfq compilation. 17 years ago
Victor Julien 720ac9efe8 Improve unittest error message if unittests are not compiled in. 17 years ago
Victor Julien 5501212e62 Fix sizeof printf related compiler warnings. 17 years ago
Brian Rectanus fa5939ca91 64 bit cleanup part2 17 years ago
Brian Rectanus 9a9b506c34 64 bit cleanup 17 years ago
Victor Julien 2a6aa00cd8 Use double for the avg counter. 17 years ago
Victor Julien 2e4cc2ad3d Convert tabs to spaces in PPPoE code. 17 years ago
Jamie 8817364ef6 initial PPPoE decoder commit 17 years ago
Victor Julien 3cf7e2e94e Add two counters: avg_pkt_size and max_pkt_size. 17 years ago
Victor Julien 1c3c13c7eb Fix missing limits.h include. 17 years ago
Anoop Saldanha 8af9f902e8 additional support for type qualifier for the stats api 17 years ago
Victor Julien 630a58b719 Fix unittests -u commandline option. 17 years ago
William Metcalf dd86b51dbc added optional option to specify signature file to load 17 years ago
Victor Julien 73217d60b9 Fix compiler warning in binsearch fix. 17 years ago
Victor Julien 9f78d47c2a Further work on the stream L7 parser, it's api and the http stub implementation. 17 years ago
Victor Julien 08ae4482a2 Fix 1 byte searching in BinSearch function. 17 years ago
Victor Julien 9b7ee312e3 Small update. 17 years ago
Victor Julien 5a9a23f9bb Update to the parsers. 17 years ago
Victor Julien 8e10844f95 Initial code of Application Layer parsing framework. Rename of L7* to AppLayer*. 17 years ago
Victor Julien 95f4706549 Merge branch 'victor_local' 17 years ago