356 Commits (fadd6d63619d1512a69bf0720aeb530235a99a0f)

Author	SHA1	Message	Date
Anoop Saldanha	0d741b9a55	fix for bug 227. For negated contents that have been added to mpm we might have pmq.pattern_id_array_cnt as 0. We can't ignore inspecting sigs if this is 0, in case the content added is negated	15 years ago
Victor Julien	cbd4c298ed	Initial version of a new bitmask based signature pre-filtering method.	15 years ago
Victor Julien	94898a91cc	Reorganize SigMatchSignatures.	15 years ago
Victor Julien	fc248ca7a1	Many small performance updates.	15 years ago
Pablo Rincon	5c43db85ce	Drop streams on inline mode when a drop rule match from a reassembled stream and/or app layer inspection	15 years ago
Anoop Saldanha	f094523eb1	clang fix - some minor fixes for unittests	15 years ago
Pablo Rincon	9d7baa7a9f	Adding ssh app layer module with two new keywords: ssh.protoversion and ssh.softwareversion	15 years ago
Victor Julien	04d3832d8f	Remove ports check and fix small typo.	15 years ago
Victor Julien	a492518e7a	Properly detect detect-event-only sigs.	15 years ago
Pablo Rincon	21d79b05ad	Fix for bug221 (avoid considering sig as "decoder event only" if ports are specified). Now the sig gets grouped to get a sgh at SigMatchSignatures	15 years ago
Victor Julien	6299fbfb0f	Fix stream msg content inspection not inspecting the correct id.	15 years ago
Victor Julien	1071a53210	Fix unittests after ip_proto keyword change.	15 years ago
Pablo Rincon	70bda6506d	Fix for bug 180 (check proto specified at the IP hdr)	15 years ago
Victor Julien	7acb97da9d	Use same mpm prepare procedure for uricontent as for normal content. More cleanups.	15 years ago
Victor Julien	9ba11dbfbd	Clean up detection engine mpm initialization phase.	15 years ago
Victor Julien	0d008c8135	Change stateful detection engine to be able to start the stateful detection separate from other sigs. Fixes bugs #213, #214, #215.	15 years ago
Victor Julien	689d05b10b	Add missing protocol check in the sig matching process. This prevents FP's such as the one reported in bug #209.	15 years ago
Victor Julien	0219b767b8	Fix a content pattern matching bug related to signature grouping and mpm_ctx sharing. In certain conditions (signature combinations) the mpm_stream_ctx (the ctx that handles stream pattern scanning) wasn't properly setup.	15 years ago
Victor Julien	102092a89c	Make signature address matching more cache efficient.	15 years ago
Victor Julien	1eec149f5e	Use Address structure in DetectAddress struct.	15 years ago
Victor Julien	c6ddcda7f8	Improve out of memory handling during initialization.	15 years ago
Victor Julien	bfd167521e	Fix DCERPC over SMB/SMB2 detection issues. Fix not updating transaction id in a stream direction if there was no sgh.	15 years ago
Anoop Saldanha	33f4beb0bc	batching of packets support for cuda b2g mpm. Supported for both 32 and 64 bit platforms	15 years ago
Victor Julien	b3c22cd512	Improve app layer proto check.	15 years ago
Victor Julien	39cb1bdbda	Fix app layer sigs being recognized as decoder event only or ip only.	15 years ago
Victor Julien	d41b5645ef	Make sure decoder event rules are inspected even if the packet is invalid and has no addesses or proto. Update fast log and alert debug log to display the alerts. Fixes #179.	15 years ago
Victor Julien	e685579231	Add optional structure validation code.	15 years ago
Victor Julien	393acd77d2	Detection improvements: uricontent escaping now working, better negated pattern (content) handling.	15 years ago
Anoop Saldanha	9ecade76b9	in case of duplicate signatures used the one with the latest revision	15 years ago
Gurvinder Singh	8852b83fa7	flowbits, flowvars, pktvars, flow flags and app layer info added to alert-debug.log	15 years ago
Victor Julien	580b09c2b8	Make sure we inspect all outstanding reassembled stream chunks (smsg) if the stream is shutting down. Make sure to do inspect signatures that use dsize against the tcp packet payload, even if that payload was already added to the stream. Likewise, the dsize signatures are not inspected against the reassembled stream.	15 years ago
Victor Julien	a3ff0e7210	Don't scan TCP packet payload if it was added to the stream. Inspect the tcp stream with the correct packet. Should fix #184 and #185.	15 years ago
Pablo Rincon	a8cb8d830b	Fix for bug 186 and thresholding issue handling ip versions	15 years ago
Pablo Rincon	eed0ef6e69	Adding tag keyword support	15 years ago
Victor Julien	ca7f54de25	Make sure ICMP unreach packets are not inspected against the flow sgh as it's for the original protocol, not for the ICMP packet. Fixes #174.	15 years ago
Victor Julien	b8fec77f37	Fix tcp connections that are reset (RST packet) not always inspecting the reassembled stream. Update transaction id code to make sure both directions of a transaction are inspected before incrementing the inspect_id.	15 years ago
Victor Julien	cdc9570f0e	Have the detect.alerts counter count actual alerts.	15 years ago
William Metcalf	0e4235cc94	FLOW_DESTROY added to clean-up UT's that init flow	15 years ago
Victor Julien	2f29b8a724	Improve detection of app layer, making sure we only handle app layer on 'established' packets. Should really fix #166.	15 years ago
Victor Julien	37442a8a84	Prefilter signatures before fully scanning them.	15 years ago
Victor Julien	d6709b0961	Fix a segv caused by invalidly accessing the smsg_pmq array.	15 years ago
Victor Julien	8cea3779fa	Move dce payload inspection to stateful detection engine.	15 years ago
Anoop Saldanha	45ea0d914e	dce stub content keywords support using dcepayload.c support for all dce related content keywords	15 years ago
Victor Julien	83b2c8abdb	Improve stateful uri detection code.	15 years ago
Victor Julien	9dd753b5f3	Scan uricontent mpm on demand.	15 years ago
Victor Julien	e8fce5f7fa	Convert uricontent scanning to use the detect engine state.	15 years ago
Pablo Rincon	8cc525c939	UDP support at AppLayer message handling	15 years ago
William Metcalf	cc76aa4bc6	properly init flows inside of unit-tests caused lock-up when falling back to using mutex locks	15 years ago
Victor Julien	a24f288074	Moving the stream content scanning to have it's own mpm ctx.	15 years ago
Victor Julien	9a08d6c11c	Fixes to stream pattern matching.	15 years ago
Victor Julien	a0c1209a44	Inspect the reassembled stream together with the packet payload in the same direction.	15 years ago
Victor Julien	81f2499834	Store stream msgs processed by the app layer in the tcp session so they can be inspected by the detection module as well. The detection module returns them to the pool.	15 years ago
Victor Julien	c26434fef1	Move flow use cnt to atomic and outside of the flow mutex protection.	15 years ago
Victor Julien	2fd31a1a11	Remove dsize grouping from detection engine grouping reducing memory usage. Store sgh in flow to reduce lookups. Reduce locking in alert handling. Increase default grouping values as we use less memory.	15 years ago
Victor Julien	dff6795df5	Detect cleanups.	15 years ago
Gerardo Iglesias Galvan	55dfa36963	Add support for http_uri keyword	15 years ago
Jason Ish	ea4b7cc33b	add profiling to stateful detection engine + other fixups.	15 years ago
Victor Julien	4e7df60b2f	Make pcap file mode read multiple packets per 'read'. Update threading model to deal with this.	15 years ago
Pablo Rincon	3fa3229e01	ASN1 decoder and keyword implementation	15 years ago
Victor Julien	70b32f7380	First stab at creating a stateful detection engine. ... Stateful detection for app layer detection keywords, except uricontent. Stores it's partial results in the flow structure. Other modifications: - Generalize transaction tracking, logging and inspection. - Adapt http and dcerpc to use the new transaction handling. - Stream engine now always notifies app layer of a stream eof. This commit fixes bug #124.	15 years ago
Jason Ish	18e5ac8cde	Basic rule profiling even though the results may be skewed by a bad rule in a grouping of rules.	15 years ago
Victor Julien	42eeb84c9a	Properly lock flow before setting IP only action flags. Small alert api cleanups.	15 years ago
Pablo Rincon	9bae6a8628	Moving alert logic to detect-engine-alert.c	15 years ago
Gerardo Iglesias Galvan	9f4fae5b1a	Fix inconsistent use of dynamic memory allocation	15 years ago
William Metcalf	8d66323f62	clang fixes for null derefrences	15 years ago
Victor Julien	e27cefa6f7	Complete conversion of pattern id mpm storage vs sig id storage.	15 years ago
Victor Julien	46831e0f8f	Fix signature grouping bug for protocols without ports. Add debugging code.	15 years ago
Victor Julien	7a427ec7f4	Switch to pattern id based results checking in the mpm. Move app layer proto detection towards a more signature based approach.	15 years ago
Pablo Rincon	46187bfe73	Fix action logic after last pass changes	15 years ago
Gurvinder Singh	3721037de5	unittests for bug 134&139 and some typo correction	15 years ago
Victor Julien	a372c1d14e	Fix/workaround a strange detection issue.	15 years ago
Victor Julien	ce90e87304	Fix failing thresholding unittests	15 years ago
Pablo Rincon	e18e2ec998	Changing threshold logic	15 years ago
Pablo Rincon	8bcdf29ab7	Small fix on pass action handling and added more unittests	15 years ago
Pablo Rincon	1238668961	Adding actions order and suport for rule action "pass"	15 years ago
William Metcalf	ce01927515	Import of GPLv2 Header 050410	15 years ago
Victor Julien	070ed778b8	Libcap-ng support by Gurvinder Singh and myself. Basic support for per thread caps is added, but not activated as it doesn't seem to work yet. Work around for incompatibility between libnet 1.1 and libcap-ng added.	15 years ago
Pablo Rincon	ab02ab9ead	adding http_header keyword support	15 years ago
Pablo Rincon	224a33f19e	Moving inline functions to the .h files, so gcc can inline them correctly	15 years ago
Victor Julien	eeb98c6900	Move SCSetThreadName to proper functions.	16 years ago
Gerardo Iglesias Galvan	9f35a24a1f	Set threads name. Fix bug #83	16 years ago
Gurvinder Singh	69a4fee757	fixed the API and logic error reported by clang tool	16 years ago
Victor Julien	78e15ea7fa	Explicitly test for ipv6 in the htp personalities code. Update all affected unittests to set addr family to the flow.	16 years ago
Anoop Saldanha	47037ef9ec	fix for bug 115	16 years ago
Victor Julien	fe7ece997a	Different approach to the reference keyword. Lots of cleanups, bug fixes in reference keyword code and tests.	16 years ago
Breno Silva	89baf93a40	Reference Support	16 years ago
Pablo Rincon	e7a989e305	IP Only Engine using radix trees	16 years ago
Anoop Saldanha	97d49d8f5e	support for http_client_body keyword	16 years ago
Victor Julien	26e8a0a06a	Cleanup global threshold code.	16 years ago
Breno Silva	67f2026279	Global Threshold config	16 years ago
Victor Julien	08600df6b1	Small uri cleanups.	16 years ago
Pablo Rincon	c7350a8ac6	Fixing some naming convention issues and incorrect error messages	16 years ago
Pablo Rincon	b708d7f65d	Adding Uricontent inspection with spm. Modifiers for uricontent are now supported	16 years ago
Anoop Saldanha	c54b91ed94	fix for bug 113	16 years ago
Victor Julien	6be0778532	Comment SigMatchSignatures a bit.	16 years ago
Gerardo Iglesias Galvan	ef2ae76c42	Add support for detection_filter keyword	16 years ago
Victor Julien	297001c6d9	Only process a app layer sig if it has the proper state. Make sure a sig can't have conflicting sigmatches, such as ftpbouce and uricontent.	16 years ago
Victor Julien	ec47f840f3	Remove more scan references.	16 years ago
Victor Julien	bee4e04664	More scan/search related cleanups.	16 years ago
Victor Julien	6990d9c91b	Fix thresholding signature unittests. Because of the bug fix that made thresholding compatible to ip-only sigs the test sigs needed to be made non-ip-only.	16 years ago