97 Commits (77ae8b8878982a3fd22ca0b582fd9b2723b65ed9)

Author	SHA1	Message	Date
Victor Julien	77ae8b8878	flow: set correct family in FLOW_COPY_IPV6_ADDR_TO_PACKET	12 years ago
Anoop Saldanha	558f5705eb	Remove the unused flow flags - FLOW_TS_PM_PP_ALPROTO_DETECT_DONE and ... FLOW_TC_PM_PP_ALPROTO_DETECT_DONE.	12 years ago
Anoop Saldanha	0d7159b525	App layer protocol detection updated and improved. We now use ... confirmation from both directions and set events if there's a mismatch between the 2 directions. FPs from corrupt flows have disappeared with this.	12 years ago
Ken Steele	b08ddfa7f1	Support for Tile Gx atomic instructions ... Tilera's GCC supports the GCC __sync_ intrinsics. Increase the size of some atomic variables for better performance on Tile. The Tile-Gx architecture has native support for 32-bit and 64-bit atomic operations, but not 8-bit and 16-bit, which are emulated using 32-bit atomics, so changing some 16-bit and 8-bit atomic into ints improves performance. Increasing the size of the atomic variables modified in this change does not increase the total size of the structures in which they reside because of existing padding requirements. The one case that would increase the size of the structure (Flow_) was confitionalized to only change the size on Tile.	12 years ago
Ken Steele	d84079ba7d	Move FlowIncrUsecnt to header file to allow for inlining. ... Move FlowIncrUsecnt() and FlowDecrUsecnt() from flow.c to flow.h to allow for inlining.	12 years ago
Eric Leblond	fb55931c30	flow tag: conversion to flow storage API ... This patch is updating the flow tag system to use the flow storage API. The tag_list member of Flow structure is suppressed and its cleaning operation are suppressed too as this is handled transparently by the flow storage API.	13 years ago
Victor Julien	58ed1f2411	flow: take vlan_id's into account in the flow hash ... In VLAN we can have 2 layers of encapsulation. In this patch both layers are used in the flow hash to distinguish between encapsulated traffic.	13 years ago
Victor Julien	37c80ea508	If an IP-only pass rule matches, set the no inspect flag for that flow. Bug #718.	13 years ago
Anoop Saldanha	870a98b528	Remove dead comment about flow reference api duplicate	13 years ago
Anoop Saldanha	f08497d1e4	Move Flow Reference/Dereferene api from flow-util.h to flow.h. ... Remove duplicate FlowDeReference from decode.h	13 years ago
Victor Julien	8f71333e12	file: implement filesize keyword. #489.	13 years ago
Victor Julien	a5587fec2e	flow: remove unused prune-flows option	14 years ago
Victor Julien	c9e93ec52c	filemd5: add support code for md5 handling for signatures.	14 years ago
Victor Julien	4cde2355bd	Simplify flow resetting on de_ctx update. Detect ctx id starts at 1. So in a flow 0 means uninitialized (thus set) and if we detect flow is not equal to detect id, we reset the sgh storage and de_state.	14 years ago
Anoop Saldanha	ecad4a24fa	live rule support added ... To reload ruleset during engine runtime, send the USR2 signal to the engine, and the ruleset would be reloaded from the same yaml file supplied at engine startup	14 years ago
Victor Julien	19a7e7f395	flow: create a flow lock macro API, implement it for mutex and rwlocks. Mutex remains the default.	14 years ago
Victor Julien	22349f863b	file magic: don't disable inspecting magic for both directions if files in only one direction don't need magic.	14 years ago
Victor Julien	40ed10ab38	Minor flowq updates.	14 years ago
Anoop Saldanha	5ffb050ada	Adapt flow tmqh counters to be atomic vars. Remove support for active flows q handler. Introduce SC_ATOMIC_SET	14 years ago
Anoop Saldanha	e252048900	support for custom flow qhandlers - round robin support added	14 years ago
Victor Julien	a05df345de	Introduce host table, make tag use it ... Add a host table similar to the flow table. A hash using fine grained locking. Flow manager for now takes care of book keeping / garbage collecting. Tag subsystem now uses this for host based tagging instead of the global tag hash table. Because the latter used a global lock and the new code uses very fine grained locking this patch should improve scalability.	14 years ago
Victor Julien	db24258acf	Undo changes from 88b8f15663. Atomic stack implementation had a-b-a problem.	14 years ago
Victor Julien	88b8f15663	Add atomic stack implementation. Convert flow spare queue to use this stack. Remove now unused flow-queue code.	14 years ago
Victor Julien	0150e66ede	flow engine: improve scalability ... Major redesign of the flow engine. Remove the flow queues that turned out to be major choke points when using many threads. Flow manager now walks the hash table directly. Simplify the way we get a new flow in case of emergency.	14 years ago
Victor Julien	bfb3f1b7cf	flow: Refactor how FlowPrune deals with forced timeouts, improving locking logic.	14 years ago
Victor Julien	cdba2f50d1	Various fixes and improvements based on feedback by Coverity analyzer.	14 years ago
Victor Julien	298289f43f	Let flow:only_stream and flow:no_stream set the require packet and require stream flags. Toss out sigs with conflicting settings. Rename flow:stream_only to flow:only_stream. Fixes #261.	14 years ago
Victor Julien	56b96363b8	Fix merge artefact.	14 years ago
Victor Julien	04ea70ccf7	file extract: pruning ... Add pruning of files in memory so we keep only memory what we really need. Fix magic logic. Reset file part of the de_state on receiving another file in the same tx.	14 years ago
Victor Julien	e1022ee5ae	file-extraction: Disconnect file handling from flow and move into the app layer state.	14 years ago
Victor Julien	23e01d23d3	Implement filestore keyword, including a way for the stateful detection engine to conclude that a file will never have to be stored.	14 years ago
Pablo Rincon	6d60b3a747	filename and fileext keywords	14 years ago
Victor Julien	262a7300d7	flow: shrink Flow datatype ... Introduce a separate FlowAddress structure for holding the ipv4 or ipv6 address that doesn't have the family in it like the Address structure. Instead, the family is stored in the flow as a flag: FLOW_IPV4 and FLOW_IPV6. Add macro's to check the family, copy the address, etc. Update many unittests to reflect these changes. Introduce unittest helper functions for creating and initializing a flow and freeing it again. On 64 bit this shrinks the flow with 8 bytes.	14 years ago
Victor Julien	06904c9024	App Layer cleanup ... Removal of per flow 'aldata' array. It contained a ptr for each ALPROTO. Instead now we have 2 ptrs in the flow: alparser and alstate. Various cleanups and dead code removal from the app layer API. Should safe 100+ bytes memory per flow on 64 bit. Updated lots of unittests to reflect these changes.	14 years ago
Eric Leblond	b5a3e737c9	doc: comment link between Flow and application layer.	14 years ago
Anoop Saldanha	d68775d47d	introduce bitmasks instead of alproto_masks for use by the probing parser. Remove all alproto_masks we had previouslys for PP	14 years ago
Anoop Saldanha	432c3317d2	app layer probing parser updates	14 years ago
Victor Julien	9baa16af63	Convert flow memcap to u64. Bug #332.	14 years ago
Anoop Saldanha	b6ba944e6d	Rearrange flow manager functions into flow-manager.[ch]. Some other minor changes/updates	14 years ago
Anoop Saldanha	8363533a02	support for forced stream reassembly for to be pruned flows	14 years ago
Anoop Saldanha	c365bafbf6	We now inspect timed out streams + streams not processed as yet, at engine shutdown	14 years ago
Victor Julien	a5d9c86dd3	Shrink Flow structure with 20 bytes (on 32 bit) and reorder it. Clean up init, recycle, destroy macro's.	15 years ago
Anoop Saldanha	7c31a2327e	Add support for port based probing parsers for alproto detection	15 years ago
Anoop Saldanha	fe6e41e3ef	Removed FLOW_AL_NO_APPLAYER_INSPECTION. Moved it as FLOW_NO_APPLAYER_INSPECTION in Flow->flags. Turned Flow->flags into uint32_t and removed Flow->alflags	15 years ago
Anoop Saldanha	0c94d910e4	Removed FLOW_AL_STREAM_TOSERVER and FLOW_AL_STREAM_TOCLIENT. Use STREAM_TOSERVER and STREAM_TOCLIENT instead	15 years ago
Anoop Saldanha	ac5584a863	Removed FLOW_AL_PROTO_DETECT_DONE. Replaced it with FLOW_ALPROTO_DETECT_DONE, stored it in Flow->flags	15 years ago
Anoop Saldanha	49e2b580cb	Removed FLOW_AL_PROTO_UNKNOWN. We don't need this flag	15 years ago
Anoop Saldanha	38fe2b9070	Removed FLOW_AL_STREAM_START, EOF and GAP flags. We don't need these. Just use STREAM_* flags	15 years ago
Gurvinder Singh	7d0781b349	added support to log dropped packet as netfilter logs while in inline mode	15 years ago
Victor Julien	fc248ca7a1	Many small performance updates.	15 years ago