8085 Commits (suricata-4.0.0-beta1)

 

All Branches   

Search

Author	SHA1	Message	Date
Giuseppe Longo	3f214b506a	file-store: add depth setting ... When a rules match and fired filestore we may want to increase the stream reassembly depth for this specific. This add the 'depth' setting in file-store config, which permits to specify how much data we want to reassemble into a stream.	9 years ago
Giuseppe Longo	4751677e24	app-layer: use StreamTcpSetReassemblyDepth ... This calls StreamTcpSetReassemblyDepth to set the stream depth specified for the protocol.	9 years ago
Giuseppe Longo	9ab1194f68	modbus: set stream depth ... Some protocol like modbus requires a infinite stream depth because session are kept open and we want to analyze everything. Since we have a stream reassembly depth per stream, we can also set a stream reassembly depth per proto.	9 years ago
Giuseppe Longo	b160c49e9e	app-layer-parser: add stream depth ... This permits to set a stream depth value for each app-layer. By default, the stream depth specified for tcp is set, then it's possible to specify a own value into the app-layer module with a proper API.	9 years ago
Eric Leblond	a63c6b320e	stream: per TcpStream reassembly depth	9 years ago
Victor Julien	960ebb2822	enip: fix scan-build warnings ... detect-cipservice.c:161:29: warning: Assigned value is garbage or undefined cipserviced->cipservice = input[0]; ^ ~~~~~~~~ detect-cipservice.c:162:27: warning: Assigned value is garbage or undefined cipserviced->cipclass = input[1]; ^ ~~~~~~~~ detect-cipservice.c:163:31: warning: Assigned value is garbage or undefined cipserviced->cipattribute = input[2]; ^ ~~~~~~~~ 3 warnings generated.	9 years ago
Victor Julien	80c3aedbfc	enip: parsing and tests cleanup	9 years ago
Victor Julien	72b5da4313	enip/cip: improve output & style ... Remove printf, remove \n from SCLogDebug. Add SCLogError for rule parsing issues. Fix various style issues	9 years ago
Victor Julien	92b393ee9a	doc: include enip page	9 years ago
Victor Julien	a2d8cfb5d3	doc: reorder rule docs	9 years ago
Victor Julien	050f36eaa5	enip: improve yaml	9 years ago
Victor Julien	6b1c21b115	enip/cip: register inspect engines	9 years ago
kwong	a3ffebd835	Adding SCADA EtherNet/IP and CIP protocol support ... Add support for the ENIP/CIP Industrial protocol This is an app layer implementation which uses the "enip" protocol and "cip_service" and "enip_command" keywords Implements AFL entry points	9 years ago
Victor Julien	5bd906ae9f	doc: prefilter keyword and config	9 years ago
Victor Julien	d9811e58b6	http_header: don't separately inspect trailer yet ... Currently the regular 'Header' inspection code will run each time after the HTTP progress moved beyond 'headers'. This will include the trailers if there are any. Leave the code in place as this model will change in the not too distant future.	9 years ago
Victor Julien	358eacf14f	http_header: only run trailer mpm if we have trailers	9 years ago
Victor Julien	44022743f2	http: track if request/response have trailers	9 years ago
Victor Julien	798ba010ca	prefilter: use array of engines per sgh ... Instead of the linked list of engines setup an array with the engines. This should provide better locality. Also shrink the engine structure so that we can fit 2 on a cacheline. Remove the FreeFunc from the runtime engines. Engines now have a 'gid' (global id) that can be used to look up the registered Free function.	9 years ago
Victor Julien	8321f04ef3	prefilter: clean up setup code	9 years ago
Victor Julien	d36c0c15ea	detect: reshuffle keyword registration order ... The order of keyword registration currently affects inspect engine registration order and ultimately the order of inspect engines per rule. Which in turn affects state keeping. This patch makes sure the ordering is the same as with older releases.	9 years ago
Victor Julien	58ac4027ef	detect: clean up inspect engine registration	9 years ago
Victor Julien	a24870f29f	detect app-layer-event: clean up registration ... Move engine and registration into the keyword file. Register as 'ALPROTO_UNKNOWN' instead of per alproto. The registration will only apply it to those rules that have events set.	9 years ago
Victor Julien	9e35fa7f41	detect: remove empty app registration table	9 years ago
Victor Julien	8a0bea872c	template_buffer: register inspect engine from keyword	9 years ago
Victor Julien	6f253e1ea7	file detect: register inspect engines from keyword	9 years ago
Victor Julien	08d0fe0916	modbus detect: register inspect engine from keyword	9 years ago
Victor Julien	2db094ab7a	dns detect: register inspect engine from keyword	9 years ago
Victor Julien	c9bb762f64	tls_cert_issuer: register inspect engine from keyword	9 years ago
Victor Julien	e28e98bcaa	tls_cert_subject: register inspect engine from keyword	9 years ago
Victor Julien	a87c196b60	tls_sni: register inspect engine from keyword	9 years ago
Victor Julien	200a4c1593	http_stat_code: register inspect engine from keyword	9 years ago
Victor Julien	cd705752db	http_stat_msg: register inspect engine from keyword	9 years ago
Victor Julien	20e93ba419	file_data: register inspect engine from keyword	9 years ago
Victor Julien	0496b3f6a5	http_raw_host: register inspect engine from keyword	9 years ago
Victor Julien	a00629ab55	http_host: register inspect engine from keyword	9 years ago
Victor Julien	edb2936998	http_user_agent: register inspect engine from keyword	9 years ago
Victor Julien	fc857c5455	http_raw_uri: register inspect engine from keyword	9 years ago
Victor Julien	b1adea6eee	http_cookie: register inspect engine from keyword	9 years ago
Victor Julien	cd8b1b0b4c	http_method: register inspect engine from keyword	9 years ago
Victor Julien	b314829614	http_raw_header: register inspect engine from keyword	9 years ago
Victor Julien	eb19eb3fe4	http_header: register inspect engine from keyword	9 years ago
Victor Julien	4096f76b1b	http_client_body: register inspect engine from keyword	9 years ago
Victor Julien	b96c2c5db5	http_uri: register inspect engine from keyword	9 years ago
Victor Julien	cc96fedb90	http_response_line: register inspect engine from keyword	9 years ago
Victor Julien	0feeb8d538	http_request_line: register inspect engine from keyword	9 years ago
Victor Julien	5bde86b0e8	detect-engine: new registration call ... Make it more in line with MPM registration.	9 years ago
Victor Julien	9a0bbd6239	detect mpm: small optimization	9 years ago
Victor Julien	ad3c97f470	detect-mpm: cleanup	9 years ago
Victor Julien	5f994756e6	detect-engine: improved inspect engines ... Inspect engines are called per signature per sigmatch list. Most wrap around DetectEngineContentInspection, but it's more generic. Until now, the inspect engines were setup in a large per ipproto, per alproto, per direction table. For stateful inspection each engine needed a global flag. This approach had a number of issues: 1. inefficient: each inspection round walked the table and then checked if the inspect engine was even needed for the current rule. 2. clumsy registration with global flag registration. 3. global flag space was approaching the need for 64 bits 4. duplicate registration for alprotos supporting both TCP and TCP (DNS). This patch introduces a new approach. First, it does away with the per ipproto engines. This wasn't used. Second, it adds a per signature list of inspect engine containing only those engines that actually apply to the rule. Third, it gets rid of the global flags and replaces it with flags assigned per rule per engine.	9 years ago
Victor Julien	bac37fc9ae	detect state: reorganize flags ... List the common non-buffer specific flags on top.	9 years ago