3136 Commits (suricata-1.3beta1)

 

All Branches   

Search

Author	SHA1	Message	Date
Victor Julien	96d20098b0	file inspect: stateful inspection split ... Split stateful detection of the files in a HTTP state between toserver and toclient inspection.	14 years ago
Victor Julien	d59ca75e46	file extract: split toserver and toclient tracking ... Split toserver and toclient file tracking for the http state.	14 years ago
Victor Julien	04ea70ccf7	file extract: pruning ... Add pruning of files in memory so we keep only memory what we really need. Fix magic logic. Reset file part of the de_state on receiving another file in the same tx.	14 years ago
Victor Julien	1c934acc85	Don't store fd per file (too many fd's). Enable IPv6 storing. Close file on receiving stream end flag.	14 years ago
Victor Julien	b402d97179	File carving -- enable reponse file extraction ... - Enable response body tracking - Enable file extraction for responses - File store meta file includes magic, close reason. - Option to force magic lookup for all stored files. - Fix libmagic calls thead safety.	14 years ago
Victor Julien	66a3cd96a8	Prepare HTTP response body tracking.	14 years ago
Victor Julien	417495e542	file-extraction: remove no longer used files.	14 years ago
Victor Julien	e1022ee5ae	file-extraction: Disconnect file handling from flow and move into the app layer state.	14 years ago
Victor Julien	27645f64c6	Remove unused util-filetype.[ch] from Makefile.am.	14 years ago
Victor Julien	9b62ec65ab	Make sure filemagic works properly regardless of filestore being in use for a flow.	14 years ago
Victor Julien	5945e652d6	Initial implementation of filemagic keyword.	14 years ago
Victor Julien	f4a6f4b293	Add libmagic detection, linking and a basic API.	14 years ago
Victor Julien	23e01d23d3	Implement filestore keyword, including a way for the stateful detection engine to conclude that a file will never have to be stored.	14 years ago
Victor Julien	3e7baa6810	Fix improper error handling in http body chunk function.	14 years ago
Victor Julien	403b2788d6	Add support for extracting PUT files.	14 years ago
Victor Julien	59cda9a358	Fix not using new htp callback when using the bundled htp. Add indication to --build-info. Fix valgrind warning in test and further improve test.	14 years ago
Victor Julien	64aee5e70c	Add file log to default suricata.yaml.	14 years ago
Victor Julien	ef0536794c	Adding comments, some cleanups.	14 years ago
Victor Julien	21acd72adf	Cleanups to the Multipart parsing code. Fixes to negation in filename and fileext.	14 years ago
Victor Julien	70f0d3d2e7	Add negation to filename and fileext, use same syntax as with content.	14 years ago
Victor Julien	32fb9f375d	log-file log-dir option added, meta file created, fixes.	14 years ago
Victor Julien	a6b7a560f1	Fix a bug in the HTTP file closing.	14 years ago
Victor Julien	7e3d537338	Fix setting libhtp personality.	14 years ago
Victor Julien	1eef36b011	Initial checkin of a log-file module, that can write files extracted from flows to disk.	14 years ago
Victor Julien	3c1edf3763	Add a file descriptor to the flow file structure.	14 years ago
Victor Julien	cd618e48df	Allow for 0 (unlimited) HTTP request_body_limit, fix option parsing.	14 years ago
Victor Julien	4723f07254	Improve testing and fix some bugs.	14 years ago
Victor Julien	9d5d46c4bb	Implement flow file storage API, create HTP wrappers for it, use it in HTTP parsing.	14 years ago
Victor Julien	a0ee6ade3e	Improve HTTP multipart parsing, add streaming parsing for files.	14 years ago
Victor Julien	4537f889ef	Handle all strings as raw strings in HTTP content-type and content-disposition header parsing.	14 years ago
System Administrator	222bc6e935	Flow files	14 years ago
Pablo Rincon	6d60b3a747	filename and fileext keywords	14 years ago
Victor Julien	06b1d71032	Small optimizations to IPV4 and TCP header parsing.	14 years ago
Eric Leblond	0256ca2422	af-packet: fix compilation on new systems. ... Inclusion of if_packet.h was missing when the support of new options related to packet fanout is present in the file.	14 years ago
Anoop Saldanha	bf24272c28	changes to accomodate master rebase	14 years ago
Anoop Saldanha	997eaf42a8	add thread local storage support for smtp + remove pmq that was init/freed as part of smtp_state alloc to use the thread local data passed by the app layer engine	14 years ago
Anoop Saldanha	9a6aef459e	modify all relevant app layer API calls to accomodate passing parser local storage argument	14 years ago
Anoop Saldanha	d3468d88b0	app layer udp cleanup + update dcerpc udp todo	14 years ago
Anoop Saldanha	01a35bb604	introduce app layer local storage api support	14 years ago
Anoop Saldanha	87599bc78d	minor changes in smtp parser decoder wrt direction check loop + add missing ifdef unittests	14 years ago
Anoop Saldanha	3a856fed12	update detection engine to compare flow alproto with sig_alproto, rather than sm alproto.	14 years ago
Anoop Saldanha	4d38a571cc	smtp reply code mpm phase support added	14 years ago
Anoop Saldanha	4a6908d3e9	fix smtp parser handling fragmented lines + add new unittests to check the same	14 years ago
Anoop Saldanha	2b356dadff	Support for tos keyword added	14 years ago
deltay	211193b0af	Get pidfile from config file if not available in command options	14 years ago
Victor Julien	262a7300d7	flow: shrink Flow datatype ... Introduce a separate FlowAddress structure for holding the ipv4 or ipv6 address that doesn't have the family in it like the Address structure. Instead, the family is stored in the flow as a flag: FLOW_IPV4 and FLOW_IPV6. Add macro's to check the family, copy the address, etc. Update many unittests to reflect these changes. Introduce unittest helper functions for creating and initializing a flow and freeing it again. On 64 bit this shrinks the flow with 8 bytes.	14 years ago
Victor Julien	06904c9024	App Layer cleanup ... Removal of per flow 'aldata' array. It contained a ptr for each ALPROTO. Instead now we have 2 ptrs in the flow: alparser and alstate. Various cleanups and dead code removal from the app layer API. Should safe 100+ bytes memory per flow on 64 bit. Updated lots of unittests to reflect these changes.	14 years ago
Victor Julien	a0b532dc45	stream reassembly: simplify base_seq tracking for protocol detection. Shrinks TcpStream structure.	14 years ago
Victor Julien	7e3c15e54a	stream: improve TCP ssn reuse cleanup.	14 years ago
Victor Julien	9769510ba3	flow: support requeue of flows from closed to new list for TCP ssn reuse.	14 years ago