57ed5dfd32
Fix return value from DetectProtoParse() which is used by probing
...
parser.
11 years ago
ac65784cbc
Fix coverity scan defect #1099714 .
...
Sending back uninitialized variable in DetectParseProto().
11 years ago
e383cc27cd
Fix a leak in probing parsers. We were freeing just the head of the list,
...
instead of all the members.
11 years ago
980934d670
Fix a leak in app layer parser proto code. Free the proto signatures
...
allocated internally for PM parser.
11 years ago
fc82614025
Fix mem leak in b2g.
11 years ago
06db1e4cb8
Remove unused vars alp_content_module_handle and proto_map from
...
struct AlpProtoDetectCtx.
11 years ago
558f5705eb
Remove the unused flow flags - FLOW_TS_PM_PP_ALPROTO_DETECT_DONE and
...
FLOW_TC_PM_PP_ALPROTO_DETECT_DONE.
11 years ago
36220b689b
Reset some flow flags when port numbers are re-used and we re-use the
...
flow as a part of a new session.
11 years ago
af1df7a89d
Remove the smtp parser restriction that it accepts data only in to client
...
direction first.
11 years ago
3ec411486e
Fix compilation failure when we don't enable unittests. Got to #ifdef
...
ALPROTO_TEST.
11 years ago
d76a5bedbc
Update stream inline to use the improved app proto detection.
11 years ago
96d1ba9106
Cosmetic changes to app parser struct.
...
Removed a flag parameter introuced earlier to indicate the data
that is first acceptable by the parser. We now use a differently
named parameter to carry out the same activity.
11 years ago
2cb5bdd3fa
Cosmetic changes to code. Introduce human readabel flag values for some constants. Here the parameter in question is "data_first_seen_dir" for session context.
11 years ago
e42905f3b9
indentation fix.
11 years ago
6bef5fda06
If we have proto mismatch from 2 directions, use one of the protos, instead of erroring out and not sending the data further to the parser.
...
The logic we use currently is if we have already sent some data to
a parser before we figure out we have a proto mismatch, we use the
proto from the first direction from which we have already sent the
data to the parser, else we stick to the the to client direction.
11 years ago
976a86def4
Introduce convenience macro to set Stream app proto completion flag.
11 years ago
16144fe38a
Rename function pointer var to use the FuncPtr typing convention. Resupply "dns" as the alproto name for ALPROTO_DNS.
11 years ago
8ae92c7a5e
Add unittest to test for http ambiguous host header.
...
Previously we would not check the port part of the host from the uri
hostname, while we did use the port part from the host header, leading
to FPs.
11 years ago
d0c5f51293
Update rule engine relationship with regard to setting ip protocol between specifying protocol after action, ip_proto and app-layer-protocol.
...
Now we can specify alproto, ip_proto combinations this way
alert dns (ip_proto:[tcp/udp];)
alert ip (app-layer-protocol:dns;)
alert ip (app-layer-protocol:dns; ip_proto:tcp;)
alert tcp (app-layer-protocol:dns:)
so on. Neater than using dnstcp/dnsudp.
This is related to feature #424 .
11 years ago
6eb8f66f0a
alert ipv4 and alert ipv6 specified proto rules should be treated and PROTO_ANY just like how we treat alert ip rules.
11 years ago
f592c481dc
Introduce a separate inspection engine for app events.
11 years ago
9e4eec200f
Update htp event handler to both warning and error events regardless of any conditions.
11 years ago
b1dffdfbe0
Add app layer protocol packet event detection support.
11 years ago
5e2d9dbdc3
Add and use EventGetInfo for getting info on an event.
...
Also update existing parsers and app-layer-event Setup to use this.
11 years ago
60a2b157b2
Fix duplicate packet decoder events. Add event entries that were missing as well.
11 years ago
1077acecd7
validate dns sigs that are reported as plain dns and not dnsudp or dnstcp.
11 years ago
6cb0014287
Move app event module registration as a part of app layer proto table.
11 years ago
64b0939b4a
code cleanup.
11 years ago
0d7159b525
App layer protocol detection updated and improved. We now use
...
confirmation from both directions and set events if there's a mismatch
between the 2 directions.
FPs from corrupt flows have disappeared with this.
11 years ago
22c05da3cd
Replace ssn appproto_detection_completed flag with individual stream ones.
11 years ago
c044541b1c
Provide convenience macros for setting flow flags on protocol matching by
...
PM and PP phase.
Replace the areas of the code that would otherwise rely on setting/reading
these flags with these macros.
Other minor tweaks to some api calls.
11 years ago
00f546e739
update pmp to return whole set of matches, rather than a single match.
11 years ago
4f7339c423
code cleanup.
11 years ago
8e8bc49063
Introduce detection parser function pointer.
11 years ago
94e40907e2
feature #727 - Add support for app-layer-protocol:<protocol> keyword
11 years ago
6f8cfd999f
Allow detection ports for alproto to be specified via the conf file.
...
To understand the option have a look at the option
app-layer.protocols.tls.detection-ports
11 years ago
ddde572fba
Introduce new options into the conf file to enable/disable -
...
1. Proto detection
2. Parsers
For app layer protocols.
libhtp has now been moved to the section under app-layer.protocols.http,
but we still provide backward compatibility with older conf files.
11 years ago
d9686fae57
Now supports accepting port addresses as strings, like the ones accepted in our rules. As a consequence we now accept port range, and other such combination. Support PP for ports based on ipproto as well.
11 years ago
48b5513ed9
Properly clean up decoder event rules
...
Addresses:
~~Dr.M~~ Error #3 : LEAK 120 direct bytes 0x08a26ac8-0x08a26b40 + 1871 indirect bytes
~~Dr.M~~ # 0 replace_malloc [/work/drmemory_package/common/alloc_replace.c:2292]
~~Dr.M~~ # 1 SigGroupHeadAlloc [/home/victor/dev/oisf/src/detect-engine-siggroup.c:144]
~~Dr.M~~ # 2 SigGroupHeadAppendSig [/home/victor/dev/oisf/src/detect-engine-siggroup.c:1014]
~~Dr.M~~ # 3 DetectEngineAddDecoderEventSig [/home/victor/dev/oisf/src/detect.c:3026]
~~Dr.M~~ # 4 SigAddressPrepareStage2 [/home/victor/dev/oisf/src/detect.c:3075]
~~Dr.M~~ # 5 SigGroupBuild [/home/victor/dev/oisf/src/detect.c:4311]
~~Dr.M~~ # 6 SigLoadSignatures [/home/victor/dev/oisf/src/detect.c:464]
~~Dr.M~~ # 7 LoadSignatures [/home/victor/dev/oisf/src/suricata.c:1706]
~~Dr.M~~ # 8 main [/home/victor/dev/oisf/src/suricata.c:1994]
11 years ago
c43e078db8
ipproto: improve cleanup
...
To address:
~~Dr.M~~ Error #2 : LEAK 16 direct bytes 0x08399688-0x08399698 + 2 indirect bytes
~~Dr.M~~ # 0 replace_malloc [/work/drmemory_package/common/alloc_replace.c:2292]
~~Dr.M~~ # 1 SigMatchAlloc [/home/victor/dev/oisf/src/detect-parse.c:201]
~~Dr.M~~ # 2 DetectIPProtoSetup [/home/victor/dev/oisf/src/detect-ipproto.c:523]
~~Dr.M~~ # 3 SigParseOptions [/home/victor/dev/oisf/src/detect-parse.c:510]
~~Dr.M~~ # 4 SigParseOptions [/home/victor/dev/oisf/src/detect-parse.c:523]
~~Dr.M~~ # 5 SigParse [/home/victor/dev/oisf/src/detect-parse.c:881]
~~Dr.M~~ # 6 SigInitHelper [/home/victor/dev/oisf/src/detect-parse.c:1309]
~~Dr.M~~ # 7 SigInit [/home/victor/dev/oisf/src/detect-parse.c:1456]
~~Dr.M~~ # 8 DetectEngineAppendSig [/home/victor/dev/oisf/src/detect-parse.c:1728]
~~Dr.M~~ # 9 DetectLoadSigFile [/home/victor/dev/oisf/src/detect.c:334]
~~Dr.M~~ #10 SigLoadSignatures [/home/victor/dev/oisf/src/detect.c:422]
~~Dr.M~~ #11 LoadSignatures [/home/victor/dev/oisf/src/suricata.c:1706]
11 years ago
1006d905d0
Improve memory cleanup for decoder-events
...
To address:
~~Dr.M~~ Error #1 : LEAK 1 direct bytes 0x0892c108-0x0892c109 + 0 indirect bytes
~~Dr.M~~ # 0 replace_malloc [/work/drmemory_package/common/alloc_replace.c:2292]
~~Dr.M~~ # 1 DetectEngineEventParse [/home/victor/dev/oisf/src/detect-engine-event.c:173]
~~Dr.M~~ # 2 _DetectEngineEventSetup [/home/victor/dev/oisf/src/detect-engine-event.c:204]
~~Dr.M~~ # 3 DetectDecodeEventSetup [/home/victor/dev/oisf/src/detect-engine-event.c:248]
~~Dr.M~~ # 4 SigParseOptions [/home/victor/dev/oisf/src/detect-parse.c:510]
~~Dr.M~~ # 5 SigParseOptions [/home/victor/dev/oisf/src/detect-parse.c:523]
~~Dr.M~~ # 6 SigParse [/home/victor/dev/oisf/src/detect-parse.c:881]
~~Dr.M~~ # 7 SigInitHelper [/home/victor/dev/oisf/src/detect-parse.c:1309]
~~Dr.M~~ # 8 SigInit [/home/victor/dev/oisf/src/detect-parse.c:1456]
~~Dr.M~~ # 9 DetectEngineAppendSig [/home/victor/dev/oisf/src/detect-parse.c:1728]
~~Dr.M~~ #10 DetectLoadSigFile [/home/victor/dev/oisf/src/detect.c:334]
~~Dr.M~~ #11 SigLoadSignatures [/home/victor/dev/oisf/src/detect.c:422]
11 years ago
1180f633e2
Add DrMemory suppress file
...
The suppress file currently suppresses:
- bug #978
- bug #979
Plus a seemingly harmeless warning that happens during libmagic init.
DrMemory is a valgrind like memory checker: http://www.drmemory.org/
11 years ago
1be6a8a48b
Fix small leak in ports validation at startup
11 years ago
3601091952
flowint: further setup fixes and cleanups
11 years ago
8080494e9a
counters: consolidate counters after all ThreadInit functions of a thread have run. This prevents duplicate and overwriting memory allocations.
11 years ago
7f8d256e7c
Fix tests that didn't expect radix to be freed
11 years ago
d2d784e31a
radix: actually free a tree in SCRadixReleaseRadixTree
11 years ago
c94b920874
flowint: fix compile warning
11 years ago
a8c416fc8b
flowint: fix setup memory leaks
11 years ago
16130cc974
ssh: fix memleaks during ssh.softwareversion init and cleanup
11 years ago
Anoop Saldanha
Victor Julien