Commit Graph

5113 Commits (suricata-2.0.4)
 

Author SHA1 Message Date
Victor Julien 4f1f395bb5 Coverity 1153935: fix confusing sizeof 12 years ago
Victor Julien 1f00ff6ab3 App-layer proto detect cleanups
Remove unnecessay inlining.
Rename functions with wrong naming scheme. E.g. AllocAppLayer.. instead
of AppLayer..Alloc.
Use AppProto instead of uint16_t.
Convert u16 ipproto cases to u8.
12 years ago
Victor Julien 657b83d238 dns: add event for when memcap is reached
Raise event if state-memcap is reached for a flow.
12 years ago
Victor Julien 9a21a2f64b dns: update counters
This patch updates the DNS counters from the main AppLayer entry
functions. Due to the limited scope of AppLayerThreadCtx some of
the logic had to be implemented in app-layer.c, where it doesn't
belong.
12 years ago
Victor Julien 66f764ce7b dns: register counters
Register dns memory counters.
Keep track of memcap reached conditions, and increment counters for
those.
12 years ago
Victor Julien 09e5ea230a app-layer: update UDP entry function
Update AppLayerHandleUdp to take the ThreadVars pointer as an
argument in prepraration of handling counters in this function.
12 years ago
Victor Julien 5f307acace Pass ThreadVars ptr to various thread init funcs
To be able to register counters from AppLayerGetCtxThread, the
ThreadVars pointer needs to be available in it and thus in it's
callers:

- AppLayerGetCtxThread
- DecodeThreadVarsAlloc
- StreamTcpReassembleInitThreadCtx
12 years ago
Victor Julien b844d4315f dns: add memcap checking
Add memuse tracking and memcap checking to the DNS parsers. Memuse
is tracked globally and per flow (state).

Memcaps are also checked per flow and globally before memory allocs
are done.
12 years ago
Victor Julien 850fac84d6 dns: make DNSTransactionAlloc static 12 years ago
Victor Julien d97e93ea71 dns: add memcap options
Add per state and global memcap option parsing.
12 years ago
Victor Julien 0130a89d52 dns: fix dns configure code
Yaml layout changed. DNS had to be updated to retrievel value
for dns flood from the correct location in the config tree.
12 years ago
Victor Julien 80456f3e7d Bug 1083 and 1084: add valgrind suppressions
Add suppressions as these are minor issues and likely not bugs in
Suricata.
12 years ago
Victor Julien 32271bdb66 app-layer-ssl: fix unusual memory leak
In some cases the TLS state pointers to subject and issuerdn could
be overwritten by a new memory allocation, causing us to loose
track of the old.

This has been observed in the case of improper VLAN handling, where
it was suspected that multiple unrelated TLS streams were mangled
together.
12 years ago
Victor Julien 28f14b1ed3 app-layer-ssl: style fixes
Coding style fixes for TLS handshake parser.
12 years ago
Victor Julien b57ac888f8 app-layer-ssl: code cleanup
Don't alloc a void ptr and then cast in every operation. Instead,
alloc a SSLState ptr and only case to void on returning the ptr.
12 years ago
Eric Leblond 7d104fde1d util-device: use safe tailq foreach
The loop is freeing elements so we need to use the safe version
of TIALQ_FOREACH.

This fixes a valgrind error:

 Thread 1 Suricata-Main:
 Invalid read of size 8
    at 0x8E129C: LiveDeviceListClean (util-device.c:167)
    by 0x89B742: main (suricata.c:2284)
  Address 0x8382988 is 24 bytes inside a block of size 40 free'd
    at 0x4C2A70C: free (vg_replace_malloc.c:468)
    by 0x8E1297: LiveDeviceListClean (util-device.c:179)
    by 0x89B742: main (suricata.c:2284)
12 years ago
Victor Julien 84f14438c3 Bug 980: fix HTTP memory cleanup at shutdown
Buffers in per thread HTTP header, client body and server body storage
would be freed based on the usage indicator instead of the size
indicator.

As the usage indicator (e.g. hsbd_buffers_list_len) could be reset
while leaving the memory untouched for later reuse, the free function
would not iterate over all memory blocks.

Removed DrMemory suppressions as well.

Bug #980.
12 years ago
Eric Leblond 82a2dd859b af-packet: fix problem introduced in recent commit
Logic of patch 98e4a14f6d was correct
but implementation is wrong because TP_STATUS_KERNEL is equal to
zero and thus can not be evaluated in a binary operation. This patch
updates the logic by doing two tests.

Reported-by: Alessandro Guido
12 years ago
Anoop Saldanha d06a193012 Remove BUG_ON(1) in app layer event second stage preparation function.
This lets us single out and print rules that result in a failure, than
just post a core dump.
12 years ago
Ken Steele 92a821cdd9 Fix make distcheck for Tile
src/Makefile.am was missing util-mpm-ac-tile-small.c which caused
release tarballs for fail to build on Tile-Gx.
12 years ago
Victor Julien 9952db6d6e Fix crash in AppLayer Proto Detect
The App Proto Detect code would use the wrong pattern count to
index a results array, leading to SEGVs.

Bug #1080.
12 years ago
Victor Julien 06f9b0adbf Cygwin: make configure pass with -Werror 12 years ago
Victor Julien 2eeddf969d Cygwin: fix compilation
tm-threads.c:1190:5: error: unknown type name ‘DWORD’
12 years ago
Victor Julien 2f14d1e94e Fix compiler warning:
array subscript has type ‘char’ [-Werror=char-subscripts]
12 years ago
Victor Julien e4b39a413a Fix coccinelle autotools check 12 years ago
Victor Julien 7fb860ac47 coccinelle: add --disable-coccinelle to configure
This allows disabling of the expensive cocci QA checks during
QA.
12 years ago
Victor Julien 0d280e88d0 pool thread: undo CLS alignment
This breaks clang on 32bit.

Test PoolThreadTestGrow01                                         : process killed by signal 11
12 years ago
Victor Julien d5fdfa4bc1 Fix unittest size_t printing on 32bit 12 years ago
Victor Julien 9b736b6b9e dns: tag each tx we get a reply for as replied
Also, detect and print when server says recursion is desired.
12 years ago
Victor Julien 2047e72cbe DNS: don't store duplicate queries
When an exact duplicate DNS query is received, don't store it in the
tx.
12 years ago
Victor Julien e1e2ebe2da memcmp: convert all pointer arguments to be const pointers, like memcmp itself uses. 12 years ago
Victor Julien a9bf939441 dns log: cleanups 12 years ago
Victor Julien b2d420bed4 app-layer: API calls to check for TX aware proto
Introduce AppLayerParserProtocolIsTxAware which returns 1 if protocol
is Tx aware, 0 if not.
12 years ago
Ken Steele bc29684df4 Remove GCC -no-strict-aliasing compiler flag.
GCC typically generates better code without the -no-strict-aliasing flag.
It is only required if code makes assumptiosn that break strict aliasing.
The unit tests pass on x86 and Tile without the flag.
12 years ago
Ken Steele 1f99096b30 Fix PmqSetup() argument removal in ac-tile MPM unit tests.
Needed to remove the second argument from all the calls, which was always 0
and was removed in other tests in a previous checkin.
12 years ago
Victor Julien 399246881d counters: fix 2 scan-build warnings
counters.c:1069:13: warning: Potential leak of memory pointed to by 'temp'
            SCMutexUnlock(&sc_perf_op_ctx->pctmi_lock);
            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
./threads.h:121:28: note: expanded from macro 'SCMutexUnlock'
                           ^~~~~~~~~~~~~~~~~~~~
counters.c:1156:16: warning: Potential leak of memory pointed to by 'pca'
        return NULL;
               ^~~~
/usr/include/clang/3.3/include/stddef.h:77:24: note: expanded from macro 'NULL'
                       ^
2 warnings generated.
12 years ago
Victor Julien 2c857087fb app-layer: configurable GetActiveTxId function
In preparation of a patchset that will allow for disabling the detect
module, this patch introduces a way to register a function for getting
the lowest active tx id. This is used by the app layer for cleaning up
transactions that already fully inspected, and by the flow timeout code
to determine if a flow is fully inspected and logged at timeout.

The registration function RegisterAppLayerGetActiveTxIdFunc allows for
registration of a custom function of type:
  uint64_t (*GetActiveTxIdFunc)(Flow *f, uint8_t flags);

If no function is called, AppLayerTransactionGetActiveDetectLog is used,
which implements the existing behaviour of considering both the
inspect_id's and the log_id.
12 years ago
Victor Julien c06c595c56 Clean up TX clean up
In AppLayerTransactionsCleanup instead of figuring out 'done' tx id's
itself, now call AppLayerTransactionGetActive for both directions to
figure out the completed TX id's.
12 years ago
Victor Julien 6e389a1fbb stream: don't send empty streammsg at stream end
No longer send an empty StreamMsg through the engine on stream end,
the messages were ignored anyway.
12 years ago
Victor Julien eb1f5ce358 stream: increase max StreamMsg data
Increase from 4024 bytes to 4072 to make the whole structure
4096 again.
12 years ago
Victor Julien c801ef3515 stream: remove flags from StreamMsg 12 years ago
Victor Julien 261881fce2 stream: remove per thread queue for stream msgs
StreamMsgs would be stored in a per thread queue before being
attached to the tcp ssn. This is unnecessary, so this patch
removes this queue and puts the smsgs into the ssn directly.

Large patch as it affects a lot of tests.
12 years ago
Victor Julien b159c1714c stream: remove flow reference from StreamMsg
StreamMsg' flow reference was used mostly to make sure a flow would
not get removed from the hash before inspection. For this it needed
to reference the flow use_cnt reference counter. Nowadays we have
more advanced flow timeout handling. This will make sure that if
there still are pending smsgs' in a flow, these will still be
processed.
12 years ago
Victor Julien 1d08a3ff26 stream: pass TcpSession to StreamTcpReassembleProcessAppLayer
Preparation for removing flow pointer from StreamMsg. Instead of
getting the ssn indirectly through StreamMsg->flow, we pass it
directly as all callers have it already.
12 years ago
Victor Julien 0ec375d95a stream msg: remove structure 12 years ago
Victor Julien 5ca0139cbc stream: remove unused gap structure from StreamMsg. 12 years ago
Victor Julien 3804f3f1b3 stream: no longer process STREAM_GAP smsgs
StreamSmgs are used for raw stream reassembly only. They could also
be used to tell the rest of the engine about sequence gaps. This was
a left over from the older implementation, where the app layer used
the smsgs as well.
12 years ago
Jason Ish 5850607fea Remove the old include support. 12 years ago
Ken Steele 3a9a14711a Correct coding style in decode-ethernet.c
This file is given as the example of correct coding style, so make sure it
follows the coding standard.
12 years ago
Eric Leblond 7561da4b87 debug: default logging level is notice
Update the string in message because default logging level is
now notice and not info.
12 years ago