135 Commits (25f5589078bb60d4d06331446834937da0cffea2)

Author	SHA1	Message	Date
Victor Julien	25f5589078	First round of adding 'stream events'. Basic stream tracking events added.	16 years ago
Victor Julien	2849d2b1d3	Initial code for stream 'inline' mode: packets that are (partly) overlapping with already accepted packets (meaning in the streams seg list) are rewritten to make sure they contain the exact same data.	16 years ago
Victor Julien	3857154f4b	Fix the pseudo packet having the wrong proto set, causing massive fp's. Flag packets to be part of the established phase of a tcp session, so we won't prematurely inspect the app layer state.	16 years ago
Gurvinder Singh	55a863359c	support for pseudo packet creation from reassembled stream segments	16 years ago
Gurvinder Singh	2beb7af7f8	support for validating the ACK before updating the last_ack field and also update next_seq if we missed the last packet	16 years ago
Victor Julien	c955254b4e	Adapt stream code to packet memory allocation changes.	16 years ago
Victor Julien	fadd6d6361	Add pseudo packet counter.	16 years ago
Victor Julien	f606621e8c	Fix the pseudo packet having the wrong proto set, causing massive fp's. Flag packets to be part of the established phase of a tcp session, so we won't prematurely inspect the app layer state.	16 years ago
Victor Julien	6482c34909	Increment flow use cnt for pseudo packets as the flow is not supposed to disappear while dealing with those packets.	16 years ago
Victor Julien	2072ad80af	Never create a pseudo packet based on a pseudo packet.	16 years ago
Victor Julien	61a9936d55	Inspect a pseudo packet upon receiving a RST so that we are sure both sides of the TCP session are inspected.	16 years ago
Gurvinder Singh	00f21f34e8	support for pseudo packet creation from reassembled stream segments	16 years ago
Victor Julien	8fa5a2c025	Split applayer and raw stream reassembly ... Split stream reassembly in 2 parts: a part that sends ack'd data to the app layer parsers as soon as it's available, and another part that queues up data into larger chunks for raw inspection.	16 years ago
Victor Julien	b5a5ef14b9	Make sure we reuse a TCP session if we receive a valid 3WHS on a closed TCP session, can happen if a new session has the same tuple.	16 years ago
Eric Leblond	1db4aadd16	Supress usage of Packet declaration in tests. ... For convenience, a massive usage of 'Packet p;' declaration has been done in the tests function. Although this was completely legal, this is not possible anymore because of the new Packet allocation structure. This massive patch modifies all suricata files to use a SCMalloc allocated pointer to Packet instead. This patch has been done using coccinelle (http://coccinelle.lip6.fr) which is a semantic patching tool. This ensures that things like call to SCFree() should have not been forget because the semantic patch explicitly forces the call to SCFree(p) before each return. With this patch all unittests are running fine with a small and a big default packet size.	16 years ago
Eric Leblond	dd038c1906	Modify files to avoid direct pckt payload access ... This patch implements the needed modification of payload access in a Packet structure to support the abstraction introduced by the extended data system.	16 years ago
Eric Leblond	8471626916	Fix error message and adds information to config ... This patch fixes a typo in an error message and add some information to the checksum verification option.	16 years ago
Victor Julien	c64b9362cf	Remove unused stream flag.	16 years ago
Anoop Saldanha	e47a9b59e9	accept tcp packets with syn+urg+push	16 years ago
Gurvinder Singh	892dea31e4	added the counter for tcp.segment_memcap_drop to show the dropped segments count due to memory limit	16 years ago
Victor Julien	0eb0d48f35	Disable broken unittests and fix one.	16 years ago
Victor Julien	f1e6e80a1e	Properly set tmp_ra_base_seq in streams. By Gurvinder.	16 years ago
Gurvinder Singh	6a5bc52461	support for several tcp evasion attacks. Thanks to Judy Novak and G2 Inc for reporting them	16 years ago
Pablo Rincon	5c43db85ce	Drop streams on inline mode when a drop rule match from a reassembled stream and/or app layer inspection	16 years ago
Victor Julien	c25921edf0	Add config output for new stream settings.	16 years ago
Gurvinder Singh	7577823cdf	support for stopping the evasion, which is caused by the use of TCP RST packets for linux based systems	16 years ago
Gurvinder Singh	f0928a4555	support for enforcing the depth until when the reassembly will be performed	16 years ago
Gurvinder Singh	8b0ca4f628	support for seperate memcaps for reassembly and stream engine	16 years ago
Victor Julien	18c923318a	Fix bug where valid FIN packets would be rejected.	16 years ago
Victor Julien	05d382f533	Fix broken stream engine config initialization: due wrong casts settings could be overwritten in memory.	16 years ago
Victor Julien	580b09c2b8	Make sure we inspect all outstanding reassembled stream chunks (smsg) if the stream is shutting down. Make sure to do inspect signatures that use dsize against the tcp packet payload, even if that payload was already added to the stream. Likewise, the dsize signatures are not inspected against the reassembled stream.	16 years ago
Victor Julien	b8fec77f37	Fix tcp connections that are reset (RST packet) not always inspecting the reassembled stream. Update transaction id code to make sure both directions of a transaction are inspected before incrementing the inspect_id.	16 years ago
Anoop Saldanha	015385c6bd	changes to the dce parser stub data processed var. changed to stub data fresh var to indicate if the stub is fresh or not	16 years ago
Anoop Saldanha	45ea0d914e	dce stub content keywords support using dcepayload.c support for all dce related content keywords	16 years ago
Pablo Rincon	8cc525c939	UDP support at AppLayer message handling	16 years ago
Victor Julien	a0c1209a44	Inspect the reassembled stream together with the packet payload in the same direction.	16 years ago
Victor Julien	9f95ab7441	Make sure a stream that has a failing app layer inspection module no longer stops reassembly, but only app layer inspection. This way we can continue to inspect the reassembled stream.	16 years ago
Victor Julien	4e7df60b2f	Make pcap file mode read multiple packets per 'read'. Update threading model to deal with this.	16 years ago
William Metcalf	2eef905c07	GPL and Copyright header updates.	16 years ago
Gurvinder Singh	5fe1dc1d24	support for sslv2/sslv3 their unit tests and better stream no reassembly flag handling	16 years ago
Gerardo Iglesias Galvan	9f4fae5b1a	Fix inconsistent use of dynamic memory allocation	16 years ago
William Metcalf	ce01927515	Import of GPLv2 Header 050410	16 years ago
Victor Julien	070ed778b8	Libcap-ng support by Gurvinder Singh and myself. Basic support for per thread caps is added, but not activated as it doesn't seem to work yet. Work around for incompatibility between libnet 1.1 and libcap-ng added.	17 years ago
Gurvinder Singh	e0b4838471	fix bug 133, error caused by seq mismatch in fin_wait_2 state, whis was dicarding the packet which should be accepted	17 years ago
Victor Julien	0eabde4a9b	Gnu99 inline fixes for stream engine.	17 years ago
Victor Julien	eeb98c6900	Move SCSetThreadName to proper functions.	17 years ago
Gerardo Iglesias Galvan	9f35a24a1f	Set threads name. Fix bug #83	17 years ago
Victor Julien	ad02732907	Properly cleanup stream engine spinlocks and mutexes at shutdown. Fixes drd errors in unittests.	17 years ago
Pablo Rincon	2ce728d019	Adding support for ecn flags after the handshake	17 years ago
Victor Julien	2b3479577b	Fix ecn/cwr unittests	17 years ago