Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Ips delayed v1.1 #14

Closed
wants to merge 4 commits into from
Closed

Ips delayed v1.1 #14

wants to merge 4 commits into from

Commits on Aug 21, 2012

  1. pcap: handle failure of packet treatment 

    If the loop is breaked, this means we've got a treatment error. We
don't need to reconnect but we must exit with correct status.
    @regit
    regit committed Aug 21, 2012
    Configuration menu
    Copy the full SHA
    2ce3133 View commit details
    Browse the repository at this point in the history

  2. Delay Detect threads initialization 

    This patch modifies the init of Detect threads. They are now started
with a dummy function and their initialisation is done after the
signatures are loaded. Just after this, the dummy function is switched
to normal one.

In IPS mode, this permit to route packets without waiting for the
signature to start and should fix OISF#488.

Offline mode such as pcap file don't use this mode to be sure to
analyse all packets in the file.

The patch introduces a "delayed-detect" configuration variable
which can be use to restore previous behavior (set to "no" to
have signature loaded first).
    @regit
    regit committed Aug 21, 2012
    Configuration menu
    Copy the full SHA
    e63ee29 View commit details
    Browse the repository at this point in the history

  3. Get rid of AppLayerHtpRegisterExtraCallbacks 

    This patch add a early exit condition to the body handling callback.
This permits to avoid to avoid a complex system to handle htp
object change.
    @regit
    regit committed Aug 21, 2012
    Configuration menu
    Copy the full SHA
    e81485d View commit details
    Browse the repository at this point in the history

  4. Convert to atomic and disable check on HTP config change. 

    This patch converts the series of variable to an atomic.

Furthermore, as the callbacks are now always run, it is not
necessary anymore to refuse a ruleswap if HTP parameters are
changing.
    @regit
    regit committed Aug 21, 2012
    Configuration menu
    Copy the full SHA
    353fbf7 View commit details
    Browse the repository at this point in the history