1536 Commits (067e53403c3318ca79aa54f76856ea222316f187)

Author	SHA1	Message	Date
Victor Julien	04d3832d8f	Remove ports check and fix small typo.	16 years ago
Victor Julien	a492518e7a	Properly detect detect-event-only sigs.	16 years ago
Pablo Rincon	21d79b05ad	Fix for bug221 (avoid considering sig as "decoder event only" if ports are specified). Now the sig gets grouped to get a sgh at SigMatchSignatures	16 years ago
Victor Julien	f081577fe4	Revert yesterday's dcerpc commits as there were to many corner cases for it to go into 1.0.1.	16 years ago
Victor Julien	6299fbfb0f	Fix stream msg content inspection not inspecting the correct id.	16 years ago
Anoop Saldanha	526a782002	temporary fix for dcerpc so that we don't loop endlessly, till we cover all cases with fragged pdus	16 years ago
Anoop Saldanha	361cf14f50	fix endless loop. Change dce parser to accept ctx ids that always start with a ctx with a 0 ctx id	16 years ago
Anoop Saldanha	8c774a1e2a	fix 206. Keep a count of uuids that don't belong to the first frag. Change dce_iface to match against uuids based on any_frag setting	16 years ago
Anoop Saldanha	52bb4c0670	fix endless loop in dce parser. fix parsing error of secondaryaddrlen for bindack	16 years ago
Anoop Saldanha	cda1efff29	fix mem leak in tailq that holds dce uuids	16 years ago
Anoop Saldanha	154a48fada	parse fragmented dce rpc headers correctly. Also some other minor fixes	16 years ago
Anoop Saldanha	c7fdc5ebda	do not reset dce stub buffer, if we are dealing with fragmented pdus(holds good only for first frag request pdus)	16 years ago
Anoop Saldanha	73241fc86c	support fragmented puds in dce + unittest	16 years ago
Anoop Saldanha	3ae45e5bbc	fix indentation in DCERPCParser	16 years ago
Victor Julien	c62a3d995e	Fix signatures with trailing spaces being rejected by the regex. Add test.	16 years ago
Anoop Saldanha	60c770c434	make pcre respect discontinue_matching flag in content matching functions	16 years ago
Kirby Kuehl	e8ecc94d6a	fix multiple dcerpc fragments in one packet	16 years ago
Anoop Saldanha	ce4bc5a63b	some minor modifications to the b2g cuda tests	16 years ago
Victor Julien	c25921edf0	Add config output for new stream settings.	16 years ago
Anoop Saldanha	3a0dadc0f3	Fix seg fault while running cuda tests. Don't set the alarm while running unittests, inside cuda-packet-batcher.c. Will result in a seg while the sig handler for ALRM in invoked	16 years ago
Anoop Saldanha	3536ba7348	fix seg fault due to premature cleanup/double cleanup for byte(jump|test), isdataat, on seeing no previous relative keywords	16 years ago
Pablo Rincon	c1486d7f2e	Fix bug 217 (segv on profiling summary if no rule was specified	16 years ago
Victor Julien	d1ce1c502b	Fix -Wall -Werror compilation after unittests update.	16 years ago
Pablo Rincon	0c3906a99b	Fix for bug 204 (signature ordering with flowbit priority)	16 years ago
Victor Julien	1071a53210	Fix unittests after ip_proto keyword change.	16 years ago
Pablo Rincon	70bda6506d	Fix for bug 180 (check proto specified at the IP hdr)	16 years ago
William	f7ab84ca83	PF_RING hang at exit fix	16 years ago
Victor Julien	1bd2d59253	Merge decode and stream threads in RunModeIdsPcapAuto like in the file runmode. Fix these runmodes not adhering to the cpu affinity setting if CUDA is compiled in.	16 years ago
Anoop Saldanha	ead29dc691	make detection engine use dce alstate(if present), on seeing smb traffic	16 years ago
Victor Julien	7acb97da9d	Use same mpm prepare procedure for uricontent as for normal content. More cleanups.	16 years ago
Victor Julien	9ba11dbfbd	Clean up detection engine mpm initialization phase.	16 years ago
Victor Julien	37ca07b687	Fix segv on loading signatures with unsupported combinations of pcre and the relative flag.	16 years ago
Victor Julien	0d008c8135	Change stateful detection engine to be able to start the stateful detection separate from other sigs. Fixes bugs #213, #214, #215.	16 years ago
Victor Julien	05ae4f99d8	Kick out invalid signature with uricontent and flow:to_client or flow:from_server.	16 years ago
Victor Julien	a9e78871fe	Really fix bug 205 this time, repair a broken unittest.	16 years ago
Pablo Rincon	34bb107f2c	Fix for bug 207 (depth/offset not correctly updated on certain cases)	16 years ago
Victor Julien	ef27234959	Comment out broken SSLParserTest03 test.	16 years ago
Victor Julien	196e572daa	Make sure holding up to_client reassembly stops after the proto is detected or we're sure we'll never detect it. Fixes issues related to bug 205.	16 years ago
Victor Julien	689d05b10b	Add missing protocol check in the sig matching process. This prevents FP's such as the one reported in bug #209.	16 years ago
Pablo Rincon	4c94a27b71	Fix bug 205 (at stream-tcp-reassemble)	16 years ago
Anoop Saldanha	b7a57c5210	fix setting the right value for parsed bytes in case of fragmented BIND dce PDUs	16 years ago
Anoop Saldanha	b94eaec7c2	implement relative pcre matching in detect-engine-(payload|uri|dcepayload).c. Also fix within/distance handling of RELATIVE_NEXT flag for uricontent	16 years ago
Anoop Saldanha	3a375aa43a	fix relative contents with a negated content for detect-engine-(uri|dcepayload).c like how we did for detect-engine-payload.c	16 years ago
Anoop Saldanha	ae3148aded	fix false positives for a negated content case	16 years ago
Victor Julien	0219b767b8	Fix a content pattern matching bug related to signature grouping and mpm_ctx sharing. In certain conditions (signature combinations) the mpm_stream_ctx (the ctx that handles stream pattern scanning) wasn't properly setup.	16 years ago
Kirby Kuehl	18840bd96e	properly handle bytecount of 0	16 years ago
Gurvinder Singh	7577823cdf	support for stopping the evasion, which is caused by the use of TCP RST packets for linux based systems	16 years ago
Gurvinder Singh	f0928a4555	support for enforcing the depth until when the reassembly will be performed	16 years ago
Victor Julien	13045683ff	Reenable and fix AlpDetectTestSig5	16 years ago
Pablo Rincon	c6e090f72c	App layer proto specific sigs (use the app layer to match proto)	16 years ago
Victor Julien	102092a89c	Make signature address matching more cache efficient.	16 years ago
Victor Julien	1eec149f5e	Use Address structure in DetectAddress struct.	16 years ago
Victor Julien	66dee577d7	Force stream reassembly on streams where we didn't yet detect the protocol if the stream is closing.	16 years ago
Anoop Saldanha	07491f8887	add --list-cuda-cards option to list the cuda cards on the system. Add conf parameter to select the cuda device to use. Also change the threshhold limit to 2.4k packets to buffer	16 years ago
Anoop Saldanha	89e3d92cdb	fix creating a static array of length 0 in SigMatchGetLastSMFromLists - clang fix	16 years ago
Gurvinder Singh	8b0ca4f628	support for seperate memcaps for reassembly and stream engine	16 years ago
Victor Julien	c6ddcda7f8	Improve out of memory handling during initialization.	16 years ago
Victor Julien	718fecb6fc	Better handle low memory conditions.	16 years ago
Victor Julien	f07997fd4a	Don't set negated uricontent signature flag twice.	16 years ago
Pablo Rincon	b7076a8ea0	Don't avoid inspecting uricontents if we get no match. It can be negated uricontents (and urilens/pcre..). But at least skip the search if we get no match	16 years ago
Anoop Saldanha	016af36051	todo list for cuda-packet-batcher	16 years ago
Anoop Saldanha	42830d1c5b	fixes for dce_stub_data and content data sig parsing + more unittests	16 years ago
Pablo Rincon	169cb22dc6	Updating other http modifiers for sigs with fast_pattern option	16 years ago
Pablo Rincon	e7b537cec3	Fixing unittests for fast_pattern options compatibility	16 years ago
Victor Julien	bfd167521e	Fix DCERPC over SMB/SMB2 detection issues. Fix not updating transaction id in a stream direction if there was no sgh.	16 years ago
Victor Julien	a4951286e9	Bump version to 1.0.0	16 years ago
Pablo Rincon	cc8068be0a	Print also the Signature raw string	16 years ago
Pablo Rincon	742f066fa2	Updating the http modifers that cannot be loaded with fast_pattern	16 years ago
Pablo Rincon	693d4f54eb	Load signatures with incompatible fast_pattern option (due to design differences for optimization)	16 years ago
William Metcalf	50eb3cba6a	seems to be a race between FlowTestPrune and FLOW_DESTROY in FlowTest0* comment out the later for now	16 years ago
Victor Julien	b4db93fa94	Remove leftover printf.	16 years ago
Anoop Saldanha	673322f01f	unittests for dce_stub_data content based singature parsing + fixes	16 years ago
Anoop Saldanha	ce8d27425d	fix signature parsing to how snort does it for content based keywords along with dce_stub_data	16 years ago
Victor Julien	1fb11e939a	Improve configure messages. Make sure CUDA doesn't try to process packets that are too big.	16 years ago
Victor Julien	e14331cbb2	Fix PACKET_RECYCLE not cleaning all of the packet.	16 years ago
Victor Julien	8d737310aa	Use 'simple' queue for cuda too. Fix hanging in cuda mode.	16 years ago
Victor Julien	3c1ae607cf	Fix cuda compilation.	16 years ago
Anoop Saldanha	33f4beb0bc	batching of packets support for cuda b2g mpm. Supported for both 32 and 64 bit platforms	16 years ago
Victor Julien	b3c22cd512	Improve app layer proto check.	16 years ago
Victor Julien	39cb1bdbda	Fix app layer sigs being recognized as decoder event only or ip only.	16 years ago
Victor Julien	587a53b904	Disable per second counters as they are unreliable.	16 years ago
Pablo Rincon	8f9bcef0e2	This patch for app-layer-ssl fix the bug #198 (SSLParserTest01). It seems that with -O2 and -O3, the compiler doesn't handle the initialization correctly (weird..)	16 years ago
Pablo Rincon	7003dc5c0d	Fix valgrind ctx error on asn1 test 06	16 years ago
Victor Julien	d41b5645ef	Make sure decoder event rules are inspected even if the packet is invalid and has no addesses or proto. Update fast log and alert debug log to display the alerts. Fixes #179.	16 years ago
Victor Julien	92858a211d	Fix STREAM_EOF flag overwriting STREAM_START flag on short streams. This made us miss short HTTP sessions.	16 years ago
Victor Julien	634b328d38	In case of error in pcap file reading mode, we shut the engine down hard instead of gracefully.	16 years ago
Victor Julien	426a7de5f2	Fix compiler warning about incomplete prototype (2).	16 years ago
Victor Julien	18c923318a	Fix bug where valid FIN packets would be rejected.	16 years ago
Victor Julien	67429e523f	Fix compiler warning about incomplete prototype.	16 years ago
Anoop Saldanha	fa373516c5	fixes the offset case for content matches + a case not handled by the prevous fix for multiple relative content matches. fix for payload.c dcepayload.c and uri.c	16 years ago
Anoop Saldanha	92eb380594	multiple relative content matches changes for detect-engine-dcepayload.c and detect-engine-uri.c like how we did for detect-engine-payload.c	16 years ago
Anoop Saldanha	5fb6981e9e	content handling changes in detect-engine-payload.c for multiple relative matches	16 years ago
Anoop Saldanha	a059ff276e	byte test and byte jump update dce matching option	16 years ago
Victor Julien	05d382f533	Fix broken stream engine config initialization: due wrong casts settings could be overwritten in memory.	16 years ago
Victor Julien	ec277b292c	Fall back to the old mutex based queue's to see if that fixes an obscure lockup at higher optimization levels in gcc in file pcap mode.	16 years ago
Victor Julien	ecb5fd3298	Add missing util-validate.h	16 years ago
Pablo Rincon	b8b511a54e	Avoid mem allocations while searching on radix trees (temporal prefix)	16 years ago
Victor Julien	1d74797b17	Attempt to work around NULL packets we're seeing ending up in queues when the compiler has optimized our code.	16 years ago
Pablo Rincon	868d4614b9	Tag engine improvements. Output tags only on unified format. Added atomic counter for tagged hosts/sessions	16 years ago
Victor Julien	8cdd02877f	Add unittests for ringbuffer.	16 years ago
Victor Julien	e685579231	Add optional structure validation code.	16 years ago
Victor Julien	b67fb5229b	Fix pcap file auto flow pinned runmode (disabled by default).	16 years ago
Victor Julien	393acd77d2	Detection improvements: uricontent escaping now working, better negated pattern (content) handling.	16 years ago
Gurvinder Singh	154a8b1ed9	fixed the build failure with profiling enabled	16 years ago
Victor Julien	37eb2290b0	Add some checks for 'impossible' conditions that become possible after enabling optimizations :-/	16 years ago
Victor Julien	017b95f9ef	More thoroughly cleanup a Packet when we recycle it. Fixes a corner case where we'd have a invalid tcp packet but p->proto would still say IPPROTO_TCP because of a previous run. Fixes bug #187.	16 years ago
William Metcalf	5580f3d9c2	PacketQueue postp added to TmEcodes for ipfw and pf_ring to silence compiler warnings	16 years ago
William Metcalf	876057a4da	missing flow init in DetectTagTestPacket04 fix ut lockup on older os's	16 years ago
Victor Julien	7454336ef5	Make SigWrapper private to detect-parse.c and rename to SigDuplWrapper to reflect it's use and purpose.	16 years ago
Anoop Saldanha	9ecade76b9	in case of duplicate signatures used the one with the latest revision	16 years ago
Pablo Rincon	eedafa3a17	Adding unittests for anchored pcres for anchored	16 years ago
Pablo Rincon	bcb0b9ef9b	Moving urilen inspection to detect-engine-uri. Adding unittests for pcre /U and urilen, in combination with uricontent	16 years ago
Anoop Saldanha	36e4b1830e	add pcre with U modifiers to the umatch sigmatch list. fix for bug 155	16 years ago
Gurvinder Singh	8852b83fa7	flowbits, flowvars, pktvars, flow flags and app layer info added to alert-debug.log	16 years ago
Pablo Rincon	95fef55507	Fix threshold handling ip addr	16 years ago
Victor Julien	580b09c2b8	Make sure we inspect all outstanding reassembled stream chunks (smsg) if the stream is shutting down. Make sure to do inspect signatures that use dsize against the tcp packet payload, even if that payload was already added to the stream. Likewise, the dsize signatures are not inspected against the reassembled stream.	16 years ago
Victor Julien	a3ff0e7210	Don't scan TCP packet payload if it was added to the stream. Inspect the tcp stream with the correct packet. Should fix #184 and #185.	16 years ago
Victor Julien	d500a52b58	Fix valgrind error in tls unittest.	16 years ago
Victor Julien	cff0a0bda2	Fix segv conditions caused by broken flow cleanup code.	16 years ago
Pablo Rincon	a8cb8d830b	Fix for bug 186 and thresholding issue handling ip versions	16 years ago
Victor Julien	6eb7eea705	Fix a data race for packet pool packets when defrag/tunnel code needs a packet.	16 years ago
Victor Julien	a4cb7fced0	Fix thresholding code for packets that are neither (valid) ipv4 and ipv6.	16 years ago
Jason MacLulich	ae095e585b	o Changed SCMalloc to DecodeThreadVarsAlloc in Decode thread initialization. (Ish) o Changed htons to noths. (Ish) o Added support for handling DAG cards running DSM modules and other non-standard ETH ERF types. o Added support for allowing gracefull restarts of the fetch thread if it fails to read an ERF properly.	16 years ago
William Metcalf	d5590962ff	change LogInfo to LogDebug for icmp seq matches	16 years ago
Victor Julien	38c9d843fd	Compiler warning fix for tag, make sure we do timeout checks under lock protection as well.	16 years ago
Pablo Rincon	b931895901	Fixing flow cleanup and ctx initialization	16 years ago
Pablo Rincon	eed0ef6e69	Adding tag keyword support	16 years ago
Kirby Kuehl	83c2cdabcd	remove printf	16 years ago
Kirby Kuehl	f49c743d44	dont alloc 0 length fragment	16 years ago
Victor Julien	6d68d7a450	Disable condition based waiting in ringbuffers until we fix lockup issues.	16 years ago
Victor Julien	0231ec612d	Atomic macro's typo fix.	16 years ago
Victor Julien	8615e87623	Fix dcerpc unittest, add comments.	16 years ago
Kirby Kuehl	3a985a9f5f	fix smb leak	16 years ago
Kirby Kuehl	4545d755dd	add uuid to uuid_list for udp	16 years ago
Kirby Kuehl	c3b9305259	dcerpc udp support	16 years ago
Kirby Kuehl	22d44b0677	dcerpc udp support	16 years ago
Victor Julien	6519a86ec7	Move packet pool to ringbuffer, update packet pool api and ringbuffer api. Remove memset usage from PACKET_RECYCLE, add proper cleanup macros.	16 years ago
Victor Julien	cb2fef8680	In the ringbuffers spin before the wait	16 years ago
Victor Julien	c7a744c937	Split ringbuffer queue handler into multiple, for mrsw, srsw, srmw modes.	16 years ago
Victor Julien	1ad289dfff	Add thread cond_t based waiting in the ringbuffer.	16 years ago
Victor Julien	dce323b1f4	Fix SCondWait -> SCCondWait typo.	16 years ago
Victor Julien	167c0295af	Merge different ringbuffer structures.	16 years ago
Victor Julien	012e602c3f	Add a (disabled by default) flow pinned runmode for file pcap.	16 years ago
Pablo Rincon	6950537a76	Move rate_filter rule tracking data from Signature to Threshold context	16 years ago
Pablo Rincon	1ae36b9a6a	Adding rate_filter support for threshold.config, multiline support and unittests	16 years ago
Victor Julien	ca7f54de25	Make sure ICMP unreach packets are not inspected against the flow sgh as it's for the original protocol, not for the ICMP packet. Fixes #174.	16 years ago
Victor Julien	b8fec77f37	Fix tcp connections that are reset (RST packet) not always inspecting the reassembled stream. Update transaction id code to make sure both directions of a transaction are inspected before incrementing the inspect_id.	16 years ago
Victor Julien	26f69aa3a6	Bump version to 0.9.2.	16 years ago
Victor Julien	e46b72758a	Small decode-event code cleanup.	16 years ago
Victor Julien	cdc9570f0e	Have the detect.alerts counter count actual alerts.	16 years ago