suricata

Commit Graph

Author	SHA1	Message	Date
Anoop Saldanha	429c6388f6	App layer API rewritten. The main files in question are: app-layer.[ch], app-layer-detect-proto.[ch] and app-layer-parser.[ch]. Things addressed in this commit: - Brings out a proper separation between protocol detection phase and the parser phase. - The dns app layer now is registered such that we don't use "dnstcp" and "dnsudp" in the rules. A user who previously wrote a rule like this - "alert dnstcp....." or "alert dnsudp....." would now have to use, alert dns (ipproto:tcp;) or alert udp (app-layer-protocol:dns;) or alert ip (ipproto:udp; app-layer-protocol:dns;) The same rules extend to other another such protocol, dcerpc. - The app layer parser api now takes in the ipproto while registering callbacks. - The app inspection/detection engine also takes an ipproto. - All app layer parser functions now take direction as STREAM_TOSERVER or STREAM_TOCLIENT, as opposed to 0 or 1, which was taken by some of the functions. - FlowInitialize() and FlowRecycle() now resets proto to 0. This is needed by unittests, which would try to clean the flow, and that would call the api, AppLayerParserCleanupParserState(), which would try to clean the app state, but the app layer now needs an ipproto to figure out which api to internally call to clean the state, and if the ipproto is 0, it would return without trying to clean the state. - A lot of unittests are now updated where if they are using a flow and they need to use the app layer, we would set a flow ipproto. - The "app-layer" section in the yaml conf has also been updated as well.	12 years ago
Anoop Saldanha	abded4200a	Disabling the ssh parser temporarily, since we are moving away from some of the archaic features we use in the app layer. We will reintroduce this parser shortly. Also do note that keywords that rely on the ssh parser would now be disabled.	12 years ago
Anoop Saldanha	0d7159b525	App layer protocol detection updated and improved. We now use confirmation from both directions and set events if there's a mismatch between the 2 directions. FPs from corrupt flows have disappeared with this.	12 years ago
Anoop Saldanha	cd80dcbfd4	bug #955 - Fix SSL parsing issue. The parser wasn't carrying out a bounds check on record length while in the middle of parsing a handshake. As a result we would step onto the next record header and consider it a part of the current handshake. - Contains an unittest to test the issue. - Disable the duplicate parser unittest registration. The issue came to light through an irregular ssl record, which was reported by Sebastian Roschke, via CVE-2013-5919. Thanks to Sebastian Roschke for reporting this issue.	12 years ago
Victor Julien	c8b71938ff	Add a fallback memrchr implementation for those platforms that dont support it. Bug #963 .	12 years ago
Eric Leblond	8e68b357c7	Suppress Suri prefix.	12 years ago
Eric Leblond	b2fa4edd36	move unittest out of suricata.c	12 years ago

7 Commits (suricata-2.0.4)