52 Commits (ed4823bbe8d33bdfc24c858433023bf07e6aa7cf)

Author	SHA1	Message	Date
Maurizio Abba	55b14f3721	decode: set pktlen of decode handler to uint32 ... Change the decode handler signature to increase the size of its decode handler, from uint16 to uint32. This is necessary to let suricata use interfaces with mtu > 65535 (ex: lo interface has default size 65536). It's necessary to change several primitive for Packet manipulation, to unify the parameter "packet length" whenever we are before IP decoding. Add tests before calling DecodeIPVX function to avoid a possible integer overflow over the len parameter.	7 years ago
Victor Julien	c662383b53	flow: track flow for ICMP ... Change packet layout to allow for expected counterpart type.	7 years ago
Victor Julien	11be9bd971	mingw: add SCNtohl and SCNtohs macro's ... On MinGW the result of ntohl needs to be casted to uint32_t and the result of ntohs to uint16_t. To avoid doing this everywhere add SCNtohl and SCNtohs macros.	7 years ago
Victor Julien	ab1200fbd7	compiler: more strict compiler warnings ... Set flags by default: -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wwrite-strings -Wcast-align -Wbad-function-cast -Wformat-security -Wno-format-nonliteral -Wmissing-format-attribute -funsigned-char Fix minor compiler warnings for these new flags on gcc and clang.	8 years ago
Victor Julien	2f0e0f17db	flow: move flow handling into worker threads ... Instead of handling the packet update during flow lookup, handle it in the stream/detect threads. This lowers the load of the capture thread(s) in autofp mode. The decoders now set a flag in the packet if the packet needs a flow lookup. Then the workers will take care of this. The decoders also already calculate the raw flow hash value. This is so that this value can be used in flow balancing in autofp. Because the flow lookup/creation is now done in the worker threads, the flow balancing can no longer use the flow. It's not yet available. Autofp load balancing uses raw hash values instead. In the same line, move UDP AppLayer out of the DecodeUDP module, and also into the stream/detect threads. Handle TCP session reuse inside the flow engine itself. If a looked up flow matches the packet, but is a TCP stream starter, check if the ssn needs to be reused. If that is the case handle it within the lookup function. Simplies the locking and removes potential race conditions.	9 years ago
Jason Ish	796dd5223b	tests: no longer necessary to provide successful return code ... 1 pass, 0 is fail.	9 years ago
Jason Ish	52983bf314	tests: convert all test to return 0 on failure, 1 on success	9 years ago
Victor Julien	ed1cc1ee2a	icmpv4: harden embedded packet handling	9 years ago
Victor Julien	1c0b4ee0ae	counters: s/SCPerfCounterIncr/StatsIncr/g	10 years ago
Victor Julien	e9b067c1eb	counters: make increment call take threadvars ... This hides the implementation from the caller.	10 years ago
Victor Julien	9a8bff7d96	counters: threadvars s/sc_perf_pca/perf_private_ctx/g	10 years ago
Ken Steele	8f1d75039a	Enforce function coding standard ... Functions should be defined as: int foo(void) { } Rather than: int food(void) { } All functions where changed by a script to match this standard.	11 years ago
Victor Julien	de034f1867	flow: prepare flow forced reuse logging ... Most flows are marked for clean up by the flow manager, which then passes them to the recycler. The recycler logs and cleans up. However, under resource stress conditions, the packet threads can recycle existing flow directly. So here the recycler has no role to play, as the flow is immediately used. For this reason, the packet threads need to be able to invoke the flow logger directly. The flow logging thread ctx will stored in the DecodeThreadVars stucture. Therefore, this patch makes the DecodeThreadVars an argument to FlowHandlePacket.	11 years ago
Ken Steele	f9705377ae	Remove pkt variable from Packet structure. ... The uint8_t *pkt in the Packet structure always points to the memory immediately following the Packet structure. It is better to simply calculate that value every time than store the 8 byte pointer.	11 years ago
Eric Leblond	b2c58b8d14	Set packet invalid flag during decoding. ... This patch set a new value in pkt->flag to signal that a packet is invalid during decoding. The patch has been obtained via a coccinelle transformation.	11 years ago
Eric Leblond	d4b7ecfbe3	decode: update API to return error ... In some cases, the decoding is not possible and some really invalid packet can be created. This is in particular the case of tunnel. In that case, it is more interesting to forget about the tunneled packet and only consider the original packet. DecodeTunnel function is maked as warn_unused_result because it is meaningful for the decoder to know if the underlying data were not correct. And in this case, only focus detection on the content.	11 years ago
Anoop Saldanha	619414c59e	Add a /* fall through */ comment for all switch case fall throughs. ... This should server as a message to coverity that the fall through is intentional.	12 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	13 years ago
Victor Julien	cdba2f50d1	Various fixes and improvements based on feedback by Coverity analyzer.	13 years ago
Eric Leblond	acf10525f6	doc: add decode group and related documentation.	14 years ago
Eric Leblond	7425bf5ca6	Rename some decode event structure and macro. ... This patch renames DECODER_SET_EVENT, DECODER_ISSET_EVENT and some other structures to ENGINE equivalent to take into account the fact the event list is now related to all engines and not only to decoder.	14 years ago
Eric Leblond	6b9d1012ff	Transform inet_ntop call into PrintInet one.	14 years ago
Victor Julien	38e7d944c5	Fix icmpv4 unittest on big endian, extract embedded sport and dport even if a full tcph doesn't fit.	14 years ago
Victor Julien	e0afe96920	Fix broken ICMPv4 unittests on big endian, fix broken ID macro on ICMPv6.	14 years ago
Eric Leblond	1db4aadd16	Supress usage of Packet declaration in tests. ... For convenience, a massive usage of 'Packet p;' declaration has been done in the tests function. Although this was completely legal, this is not possible anymore because of the new Packet allocation structure. This massive patch modifies all suricata files to use a SCMalloc allocated pointer to Packet instead. This patch has been done using coccinelle (http://coccinelle.lip6.fr) which is a semantic patching tool. This ensures that things like call to SCFree() should have not been forget because the semantic patch explicitly forces the call to SCFree(p) before each return. With this patch all unittests are running fine with a small and a big default packet size.	14 years ago
Eric Leblond	dd038c1906	Modify files to avoid direct pckt payload access ... This patch implements the needed modification of payload access in a Packet structure to support the abstraction introduced by the extended data system.	14 years ago
William Metcalf	2eef905c07	GPL and Copyright header updates.	15 years ago
Victor Julien	f4812586de	Fix broken ICMPv4 unittests. Fixes #161.	15 years ago
Victor Julien	548a3b2c93	Improve flow hash debugging functions. Make sure ICMP errors don't create flows. Handle ICMP DEST UNREACH errors in the flow they are sending the error about.	15 years ago
Victor Julien	2dc5405d3a	Add debug code for tracking flow hash distribution. Only add ICMP DEST_UNREACH packets to the flow engine.	15 years ago
Gurvinder Singh	21a89e22de	fixed the segv caused by null payload due to incorrect icmpv6 decoding	15 years ago
William Metcalf	ce01927515	Import of GPLv2 Header 050410	15 years ago
Pablo Rincon	779f154fc6	Moving inline functions to the .h files, so gcc can inline them correctly	15 years ago
Victor Julien	10cc9d5b6a	Add icmp flow handling.	15 years ago
Victor Julien	ecf86f9c23	Rename to Suricata.	15 years ago
Anoop Saldanha	ceb7e495ae	refactoring perf stats code	16 years ago
Victor Julien	97c991f75b	Remove unused var and fix compilation with DEBUG enabled.	16 years ago
Jamie	0dc471db9c	looking inside ICMP packets	16 years ago
Breno Silva	c43319c337	Regular expression for UnitTests ... Signed-off-by: Brian Rectanus <brectanu@gmail.com>	16 years ago
Victor Julien	91bc83e5c6	More logging API usage changes.	16 years ago
Jamie	a297225157	victor must be getting sick of PPPoE and ICMP	16 years ago
Anoop Saldanha	22c0ec2bc5	Added support for the csum-<protocol> rules keyword to the detection engine. Keywords added are ipv4-csum, tcpv4-csum, tcpv6-csum, udpv4-csum, udpv6-csum, icmpv4-csum and icmpv6-csum	16 years ago
Anoop Saldanha	41dd0f8e62	checksum calculation functions for ipv4, tcp, udpv4, icmpv4	16 years ago
Victor Julien	57f71f7e4b	Pass the DecodeThreadVars to all Decoder functions properly. Improve the error handling.	16 years ago
Anoop Saldanha	244f5d547a	new registration functions for the stats api, with local thread storage for counter ids	16 years ago
Jamie	698e9c0699	fix incorrect offset in decode-ethernet for PPPoE, more debug statements	16 years ago
Victor Julien	f6a8454232	Layout fixes.	16 years ago
Jamie	afa8a6766e	test cases for PPPoE, ICMPv4	16 years ago
Brian Rectanus	fa5939ca91	64 bit cleanup part2	16 years ago
Anoop Saldanha	d0e70309c0	Implements counters for the decode module	16 years ago