51 Commits (e00dcd52a0b3da1e39ba4d8d5d6043c0a97e03cc)

Author	SHA1	Message	Date
Victor Julien	666bba8121	detect: implement continue detect for dcepayload ... Also fix a corner case in start detection. Bug 1853.	9 years ago
Victor Julien	ecf4a2862c	detect: cleanup	9 years ago
Mats Klepsland	a13df67864	detect: add (mpm) keyword for tls_sni ... Match on server name indication (SNI) extension in TLS using tls_sni keyword, e.g: alert tls any any -> any any (msg:"SNI test"; tls_sni; content:"example.com"; sid:12345;)	10 years ago
Victor Julien	c4a9580fce	detect file: improve multi file handling ... When multiple files were in a tx, the first one(s) closed/complete and a new open one as well, a match in the former could lead to not inspecting the latter. This patch adds a workaround for this case, by allowing the file inspection code to return a special code for 'match, but more files available in tx'. The stateful detection engine will then not make this match final for the tx. It relies on the file pruning to kick in to make sure the already complete files are removed from the tx before the next time the detection engine is called on the tx.	10 years ago
Jason Ish	06beca62f5	app-layer: template for application layer content inspection	10 years ago
Victor Julien	6946e0be55	detect: pass flags to inspect_id update logic	10 years ago
Victor Julien	62fa9f09d4	Sync alversion/appversion types ... The app layer state 'version' field is incremented with each update to the state. It is used by the detection engine to see if the current version of the state has already been inspected. Since app layer and detect always run closely together there is no need for a big number here. The detect code really only checks for equal/not-equal, so wrap arounds are not an issue.	10 years ago
Victor Julien	433e511b63	dns: generic inspect engines for DNS	10 years ago
Victor Julien	2c8e8c2516	dns: rename type so it's purpose is more clear	10 years ago
Victor Julien	37f0bd57b6	detect-state: handle duplicate inspect/match ... If for a packet we have a TX N that has detect state and a TX N+1 that has no detect state, but does have 'progress', we have a corner case in stateful detection. ContinueDetection inspects TX N, but cannot flag the rule in the de_state_sig_array as the next (TX N+1) has already started and needs to be inspected. 'StartDetection' however, is then unaware of the fact that ContinueDetection already inspected the rule. It uses the per session 'inspect_id' that is only moved forward at the end of the detection run. This patch adds a workaround. It uses the DetectEngineThreadCtx:: de_state_sig_array to store an offset between the 'base' inspect_id and the inspect_id that StartDetection should use. The data type is limited, so if the offset would be too big, a search based fall back is implemented as well.	11 years ago
Giuseppe Longo	f0c54d4764	Detect engine for smtp file_data file_data: inspecting smtp attachments ... Create a buffer to store reassembled file chunks, and inspect the content.	11 years ago
Victor Julien	e250040b72	detect-state: implement tx state reset for reload ... In case of Detect Reload, we need to reset active tx' state.	11 years ago
Victor Julien	da3e8ad8f6	detect-state: split flow and tx state ... Use separate data structures for storing TX and FLOW (AMATCH) detect state. - move state storing into util funcs - remove de_state_m - simplify reset state logic on reload	11 years ago
Victor Julien	6723d03c7e	http: add inspection engine for http request line ... No MPM though.	11 years ago
DIALLO David	55c5081240	Detect-engine: Add Modbus detection engine ... Management of Modbus Tx Based on DNS source code. Signed-off-by: David DIALLO <diallo@et.esia.fr>	11 years ago
Victor Julien	b6e2a6f525	detect: locking update continued ... Make DeStateDetectContinueDetection get it's own alstate pointer instead of using the one that was passed to it. We now get and use it only inside a flow lock.	12 years ago
Victor Julien	cf31e2cc74	detect: locking update ... Make DeStateDetectStartDetection get it's own alstate pointer instead of using the one that was passed to it. We now get and use it only inside a flow lock.	12 years ago
Victor Julien	f5f148805c	app layer: uint16_t alproto -> AppProto alproto ... This conversion was missing in a couple of places.	12 years ago
Victor Julien	edeeb7ed44	Store TX id with alerts ... When generating an alert and storing it in the packet, store the tx_id as well. This way the output modules can log the tx_id and access the proper tx for logging. Issue #904.	12 years ago
Anoop Saldanha	f592c481dc	Introduce a separate inspection engine for app events.	12 years ago
Victor Julien	f10dd603ff	DNS: adding dns_request content modifier	13 years ago
Anoop Saldanha	a490176c8a	More lock fixes for the transaction update. Issues reported by Coverity.	13 years ago
Anoop Saldanha	d4d18e3136	Transaction engine redesigned. ... Improved accuracy, improved performance. Performance improvement noticeable with http heavy traffic and ruleset. A lot of other cosmetic changes carried out as well. Wrappers introduced for a lot of app layer functions. Failing dce unittests disabled. Will be reintroduced in the updated dce engine. Cross transaction matching taken care of. FPs emanating from these matches have now disappeared. Double inspection of transactions taken care of as well.	13 years ago
Anoop Saldanha	3511f91bba	Add support for the new keyword - http_raw_host header. ... The corresponding pcre modifier would be 'Z'.	13 years ago
Anoop Saldanha	c4ce19a1be	Add support for a new keyword to inspect http_host header. ... The corresponding content keyword would now be - http_host. The corresponding pcre modifier would be W.	13 years ago
Victor Julien	4cde2355bd	Simplify flow resetting on de_ctx update. Detect ctx id starts at 1. So in a flow 0 means uninitialized (thus set) and if we detect flow is not equal to detect id, we reset the sgh storage and de_state.	14 years ago
Anoop Saldanha	ecad4a24fa	live rule support added ... To reload ruleset during engine runtime, send the USR2 signal to the engine, and the ruleset would be reloaded from the same yaml file supplied at engine startup	14 years ago
Anoop Saldanha	988c92f71c	http user agent keyword + mpm + inspection + fast pattern support added	14 years ago
Anoop Saldanha	09313cf9bd	Support http stat code detection engine, fast pattern(mpm engine included). Fix http stat code setup function. Fix pcre option for stat msg keyword. With this the pcre options for server_body is Q, for stat_msg is Y and for stat_code is S	14 years ago
Anoop Saldanha	2007c2711c	Support http stat msg detection engine, fast pattern(mpm engine included). Fix http stat msg setup function. Fix pcre option for stat msg keyword	14 years ago
Victor Julien	c2c539942b	Rework the way the http parser can tell the de_state to reset it's file section on arrival of new files in the same tx. Fixes a dead lock in the auto runmode.	14 years ago
Victor Julien	89f83e714c	Introduce http_server_body keyword. ... The http_server_body content modifier modifies the previous content to inspect the normalized (dechunked, unzipped) http_server_body. The workings are similar to http_client_body. Additionally, a new pcre flag was introduced "/S". To facilitate this change the signature flags field was changed to be 64 bit.	14 years ago
Victor Julien	96d20098b0	file inspect: stateful inspection split ... Split stateful detection of the files in a HTTP state between toserver and toclient inspection.	14 years ago
Victor Julien	04ea70ccf7	file extract: pruning ... Add pruning of files in memory so we keep only memory what we really need. Fix magic logic. Reset file part of the de_state on receiving another file in the same tx.	14 years ago
Victor Julien	23e01d23d3	Implement filestore keyword, including a way for the stateful detection engine to conclude that a file will never have to be stored.	14 years ago
Eric Leblond	b055a21d63	doc: create doxygen group for state detection.	14 years ago
Victor Julien	73efb4c70f	Add a app layer state and stateful detection engine counter that makes sure the stateful inspection is only done when the state changes.	15 years ago
Victor Julien	50aceb11eb	Clean up stateful detection code.	15 years ago
Anoop Saldanha	966119b6aa	support for http_raw_uri keyword + mpm engine	15 years ago
Anoop Saldanha	c9897a44a4	fast pattern support for http_cookie. Also support relative modifiers	15 years ago
Anoop Saldanha	bbbedaf963	fast pattern support for http_method. Also support relative modifiers	15 years ago
Anoop Saldanha	7ec0382774	support fast pattern for http raw header. Also support relative modifiers for http raw header	15 years ago
Anoop Saldanha	c61c68fd36	mpm and fast pattern support for http_header. Also support relative modifiers for http_header	15 years ago
Anoop Saldanha	5c6a65dc58	support relative modifiers for http_client_body. Introduce body processing engine in detect-engine-hcbd.[ch]	15 years ago
Victor Julien	0d008c8135	Change stateful detection engine to be able to start the stateful detection separate from other sigs. Fixes bugs #213, #214, #215.	16 years ago
Pablo Rincon	a8cb8d830b	Fix for bug 186 and thresholding issue handling ip versions	16 years ago
Victor Julien	b8fec77f37	Fix tcp connections that are reset (RST packet) not always inspecting the reassembled stream. Update transaction id code to make sure both directions of a transaction are inspected before incrementing the inspect_id.	16 years ago
Victor Julien	8cea3779fa	Move dce payload inspection to stateful detection engine.	16 years ago
Victor Julien	e8fce5f7fa	Convert uricontent scanning to use the detect engine state.	16 years ago
William Metcalf	2eef905c07	GPL and Copyright header updates.	16 years ago