Commit Graph

2845 Commits (c4b34e6ef73f9915b4da1d52673279ea7537f6f0)
 

Author SHA1 Message Date
Victor Julien c4b34e6ef7 Fix various minor clang/scan-build warnings. 13 years ago
Victor Julien 791fc2f6ea Adapt signature ordering to new flowbits post-match handling. 13 years ago
Victor Julien 8339ca6d4e Implement post match support for ip-only. 13 years ago
Victor Julien e69c584317 Let timing out flow use pseudo packets also if state is not fully closed. 13 years ago
Victor Julien 6eeab37ab3 Add post-match list, move flowbits set, etc functions to it. Move flowint set, etc functions to it as well. 13 years ago
Victor Julien 67a4153137 Add export of wiki install docs to our doc/ dir. 13 years ago
Victor Julien 0818a151ec Add reject support to live single, autofp and workers runmodes. 13 years ago
Eric Leblond 0b2c7dfa5d runmode: Add Reject to IPS worker mode. 13 years ago
Victor Julien 515d070554 Print elapsed time with millisecond precision. 13 years ago
Victor Julien aac2d91bcc Set DROP flag for reject action so in addition to sending the rst, in IPS mode also drop the offending packet. 13 years ago
Victor Julien f084874998 Fix HTTP state and raw stream not being inspected at the same time. Adds an exception to transaction id handling for HTTP. 13 years ago
Victor Julien 16cfae2f51 Trigger raw stream reassembly on receiving a full HTTP request or response. 13 years ago
Victor Julien f773942ce0 Disable printing dreaded app layer error messages to the screen: app layer events are here to safe us. 13 years ago
Victor Julien 132d9d1789 Add http-events.rules with an example rule for each HTTP event. 13 years ago
Victor Julien f713b653ab Convert error logging for HTTP to use new app layer event API. Expose libhtp warnings to this as well. 13 years ago
Victor Julien e55390e4e7 Add check to invalidate signatures that inspect raw http headers in the to_client direction (response headers) if libhtp hasn't been patched yet. Also add hack to disable the test for unittests, many tests fail and we'll fix those ASAP. 13 years ago
Victor Julien 1ac6054c23 Clean up configure check for htp_tx_get_response_headers_raw. Misc changes. 13 years ago
Anoop Saldanha 4acd5a04e6 Enable http raw response header inspection only if libhtp supports raw response header buffering which should be available post 0.2.6 13 years ago
Anoop Saldanha 9c4954ff42 support http response raw header inspection + carry out hrhd mpm on both request/response headers + add unittests for the same 13 years ago
Anoop Saldanha 1b434f5fff hhd unittests for response headers 13 years ago
Anoop Saldanha e5c3e2cdb1 carry out hhd mpm on both request/response headers 13 years ago
Anoop Saldanha 30247dce8c bug 389 - support http response header inspection + fix bug with stateful inspection for sigs that would have both request/response inpection 13 years ago
William 7d07b5375e Add simple socket to gzip file PoC. 13 years ago
Victor Julien 64f717c880 Set 'livedev' in pcap acquisition module for older libpcap version as well. Fixes a segv. 13 years ago
Victor Julien 5a1a443701 Add example smtp decoding events rules file. 13 years ago
Victor Julien 026a4efc57 Make sure that continued stateful detection only inspects sigs in the proper direction. 13 years ago
Victor Julien 21ee59e6f3 Add signature direction (flow:toserver/flow:toclient) as a signature flag. 13 years ago
Victor Julien d5402d33d4 Simplify detection loop. Inspect packet keywords before the state. 13 years ago
Victor Julien 7fa22e8453 Rename app_layer_events to app-layer-events. Misc fixes/changes. 13 years ago
Victor Julien ecd457db7b Allow flowint names to have dots in them. 13 years ago
Anoop Saldanha 5311cd4866 Support for smtp decoder events 13 years ago
Anoop Saldanha eea5ab4a7a Support for app layer decoder events added + app_layer_event keyword added 13 years ago
Victor Julien 4c1e417d49 Allow non-existing flowints to be incremented. A 'set' to 0 is implied in this case. 13 years ago
Victor Julien d24b3a0e50 Clean up csum detection output, misc fixes. 13 years ago
Eric Leblond 279b8b4027 config: Add explanation for checksum-checks options 13 years ago
Eric Leblond 9a2a4802f4 pf-ring: add support for checksum verif mode
This patch adds support for checksum verification mode.
Supported mode are yes, no, auto and rx-only.
13 years ago
Eric Leblond 0399a06f4f pcap: fix typo 13 years ago
Eric Leblond db5ca0f3a4 pcap: add auto mode support 13 years ago
Eric Leblond a565148fb1 af-packet: fallback if 'kernel' mode is not supported
This patch adds a fallback to full checksum validation if 'kernel'
mode is not supported by the running kernel.
13 years ago
Eric Leblond 51eb96053c af-packet: auto mode support 13 years ago
Eric Leblond c3eaa6cc60 Add per-interface counter for invalid checksum.
This patch adds a per-device counter for invalid checksum as
well as a simple packet counter.
13 years ago
Eric Leblond 745b61171a Introduce LiveGetDevice function 13 years ago
Eric Leblond e893e860d4 Rename LiveGetDevice to LiveGetDeviceName
The function LiveGetDevice is returning a point to
the name of the interface. This patch renames it to
LiveGetDeviceName which is more appropriate.
13 years ago
Eric Leblond 1d1271fd38 pcap: add support for checksum verif mode
This patch adds support for checksum verification mode.
Auto mode is not yet supported.
13 years ago
Eric Leblond 6062e00c2b af-packet: add support for checksum verif mode
This patch adds support for checksum verification mode.
Auto mode is not yet supported.
13 years ago
Eric Leblond 551cb3e4c2 decode: introduce checksum mode enum. 13 years ago
Eric Leblond 623bb38d1c af-packet: Fix typo in error message. 13 years ago
Eric Leblond 8d635ddfc2 detect-csum: incomplete checksum is a valid checksum
This patch modify checksum match to not alert on packet with
incomplete checksum. They will be checksummed later and thus
can be considered as valid one.
13 years ago
Eric Leblond 67f791e891 af-packet: add variable to disable offloading detection
This flag adds variable to disable offloading detection. The effect
of the flag is to avoid to transmit auxiliary data at each packet.
This could result in a potential performance gain.
13 years ago
Eric Leblond f6ddaf3341 af-packet: parse message to find lack of checksum
Emitted packet can have checksum offloading. This patch reads
af-packet message parameter to see if the kernel has sent a non
checksummed packet.
13 years ago