5 Commits (ace8f9f5df3ea7ca87d2fdae934dd29ca70c1a2c)

Author	SHA1	Message	Date
Mats Klepsland	c4b918b6c4	tx: do not store ProgressCompletionStatus per ipproto ... Change AppLayerParserRegisterGetStateProgressCompletionStatus to only store one ProgressCompletionStatus callback function for each alproto, instead of storing one for each ipproto. This enables us to use AppLayerParserGetStateProgressCompletionStatus in functions where we do not know the ipproto used.	9 years ago
Victor Julien	f5f148805c	app layer: uint16_t alproto -> AppProto alproto ... This conversion was missing in a couple of places.	12 years ago
Anoop Saldanha	429c6388f6	App layer API rewritten. The main files in question are: ... app-layer.[ch], app-layer-detect-proto.[ch] and app-layer-parser.[ch]. Things addressed in this commit: - Brings out a proper separation between protocol detection phase and the parser phase. - The dns app layer now is registered such that we don't use "dnstcp" and "dnsudp" in the rules. A user who previously wrote a rule like this - "alert dnstcp....." or "alert dnsudp....." would now have to use, alert dns (ipproto:tcp;) or alert udp (app-layer-protocol:dns;) or alert ip (ipproto:udp; app-layer-protocol:dns;) The same rules extend to other another such protocol, dcerpc. - The app layer parser api now takes in the ipproto while registering callbacks. - The app inspection/detection engine also takes an ipproto. - All app layer parser functions now take direction as STREAM_TOSERVER or STREAM_TOCLIENT, as opposed to 0 or 1, which was taken by some of the functions. - FlowInitialize() and FlowRecycle() now resets proto to 0. This is needed by unittests, which would try to clean the flow, and that would call the api, AppLayerParserCleanupParserState(), which would try to clean the app state, but the app layer now needs an ipproto to figure out which api to internally call to clean the state, and if the ipproto is 0, it would return without trying to clean the state. - A lot of unittests are now updated where if they are using a flow and they need to use the app layer, we would set a flow ipproto. - The "app-layer" section in the yaml conf has also been updated as well.	12 years ago
Victor Julien	7b687da726	profiling: add tracking of missing keywords	12 years ago
Anoop Saldanha	f592c481dc	Introduce a separate inspection engine for app events.	12 years ago