447 Commits (04592efb7655eb95a1067f92f9256e9b11a4f9bc)

Author	SHA1	Message	Date
Victor Julien	f370e88135	detect: move init only Signature members to init_data	9 years ago
Victor Julien	0a5ae415b8	detect: shrink Signature::sm_arrays ... Signature::sm_arrays now only contains 'built-in' lists, and so is sized appropriately.	9 years ago
Victor Julien	4978a7a133	detect: reorganize id's in prep of dynamic lists	9 years ago
Victor Julien	8edc954e82	detect: get rid of Signature::sm_lists ... Instead use the lists in init_data during setup and the SigMatchData arrays during runtime.	9 years ago
Victor Julien	bd456076a8	detect: pass SigMatchData to inspect functions	9 years ago
Victor Julien	2f87c975d4	detect: add SigMatch arg to inspect functions	9 years ago
Victor Julien	cf42fbf51f	detect: use InspectEngineFuncPtr in inspect engines ... Replace explicit function pointer use by InspectEngineFuncPtr typedef	9 years ago
Victor Julien	5f7e096be4	detect: shrink inspect engine by using 'id' as state flag	9 years ago
Victor Julien	715ff60087	detect: remove unused SIG_FLAG_INIT_PAYLOAD init_flag	9 years ago
Victor Julien	5e0b0eea4b	detect: remove unused flags	9 years ago
Victor Julien	bfd4bc8233	detect: constify Signature/SigMatch use at runtime	9 years ago
Victor Julien	be3ee5330f	detect: remove alproto from keyword registration ... It was already marked as depricated and no longer in use anywhere.	9 years ago
Victor Julien	f91d490d25	detect: remove unused flow_locked hint	9 years ago
Victor Julien	810e43f373	magic: make optional ... Make libmagic optional. If installed it will be enabled by default in configure. Use --disable-libmagic to disable.	9 years ago
Victor Julien	3f8ee2afd3	detect-lua: unify on using 'lua' name vs 'luajit'	9 years ago
Victor Julien	0366d47608	luajit: remove unused instance counter	9 years ago
Jason Ish	1a31bded4a	DNP3: dnp3_data, dnp3_func, dnp3_ind, dnp3_obj rule keywords	9 years ago
Victor Julien	0ed119068d	detect-app-layer-protocol: implement prefilter ... Introduce 'Protocol detection'-only rules. These rules will only be fully evaluated when the protocol detection completed. To allow mixing of the app-layer-protocol keyword with other types of matches the keyword can also inspect the flow's app-protos per packet. Implement prefilter for the 'PD-only' rules.	9 years ago
Victor Julien	43aed70976	detect: during detection sgh is read only so turn into const	9 years ago
Mats Klepsland	1fea52dd8a	detect: add keyword tls_cert_valid ... Add keyword to check if TLS certificate is valid.	9 years ago
Mats Klepsland	f22c9d9781	detect: add keyword tls_cert_expired ... Add keyword to check if TLS certificate is expired.	9 years ago
kwong	a3ffebd835	Adding SCADA EtherNet/IP and CIP protocol support ... Add support for the ENIP/CIP Industrial protocol This is an app layer implementation which uses the "enip" protocol and "cip_service" and "enip_command" keywords Implements AFL entry points	9 years ago
Victor Julien	798ba010ca	prefilter: use array of engines per sgh ... Instead of the linked list of engines setup an array with the engines. This should provide better locality. Also shrink the engine structure so that we can fit 2 on a cacheline. Remove the FreeFunc from the runtime engines. Engines now have a 'gid' (global id) that can be used to look up the registered Free function.	9 years ago
Victor Julien	5f994756e6	detect-engine: improved inspect engines ... Inspect engines are called per signature per sigmatch list. Most wrap around DetectEngineContentInspection, but it's more generic. Until now, the inspect engines were setup in a large per ipproto, per alproto, per direction table. For stateful inspection each engine needed a global flag. This approach had a number of issues: 1. inefficient: each inspection round walked the table and then checked if the inspect engine was even needed for the current rule. 2. clumsy registration with global flag registration. 3. global flag space was approaching the need for 64 bits 4. duplicate registration for alprotos supporting both TCP and TCP (DNS). This patch introduces a new approach. First, it does away with the per ipproto engines. This wasn't used. Second, it adds a per signature list of inspect engine containing only those engines that actually apply to the rule. Third, it gets rid of the global flags and replaces it with flags assigned per rule per engine.	9 years ago
Victor Julien	f1e3840516	http_response_body: implement keyword with mpm ... Implemented as 'stickybuffer'.	9 years ago
Victor Julien	4c98b6cef3	http_request_line: implement keyword and mpm ... Implemented as 'stickybuffer'. Move all logic into the keyword file and remove bad tests that tested URI instead of request line.	9 years ago
Victor Julien	5b2e36a1b0	mpm: add App Layer MPM registery ... Register keywords globally at start up. Create a map of the registery per detection engine. This we need because the sgh_mpm_context value is set per detect engine. Remove APP_MPMS_MAX.	9 years ago
Victor Julien	125603871b	detect: config opt to enable keyword prefilters	9 years ago
Victor Julien	9bb12ccb27	prefilter: move payload engines into separate list	9 years ago
Victor Julien	14b0537f95	prefilter: implement basic prefilter priority order	9 years ago
Victor Julien	31ad0a133b	prefilter: engine for tcp flags keyword ... If there are many rules for TCP flags these rules would be inspected against each TCP packet. Even though the flags check is not expensive, the combined cost of inspecting multiple rules against each and every packet is high. This patch implements a prefilter engine for flags. If a rule group has rules looking for specific flags and engine for that flag or flags combination is set up. This way those rules are only inspected if the flag is actually present in the packet.	9 years ago
Victor Julien	8798bf48b2	profiling: support prefilter engines	9 years ago
Victor Julien	56239690d0	prefilter: implement prefilter keyword ... Introduce prefilter keyword to force a keyword to be used as prefilter. e.g. alert tcp any any -> any any (content:"A"; flags:R; prefilter; sid:1;) alert tcp any any -> any any (content:"A"; flags:R; sid:2;) alert tcp any any -> any any (content:"A"; dsize:1; prefilter; sid:3;) alert tcp any any -> any any (content:"A"; dsize:1; sid:4;) In sid 2 and 4 the content keyword is used in the MPM engine. In sid 1 and 3 the flags and dsize keywords will be used.	9 years ago
Victor Julien	85cb749e8b	detect cleanup: remove sgh mpm_ctx pointers	9 years ago
Victor Julien	82d3c0b520	sgh: remove unused flags	9 years ago
Victor Julien	9ff5703c49	packet/stream: mpm prefilter engine	9 years ago
Victor Julien	5bcdbe3922	prefilter: introduce prefilter engines ... Introduce abstraction layer for prefilter engines.	9 years ago
Victor Julien	3dad824fb2	detect: rename SignatureNonMpmStore ... New name is SignatureNonPrefilterStore to reflect that it's not just about MPM anymore.	9 years ago
Victor Julien	17bc0299fe	detect: rename non_mpm lists/vars to non_pf ... Rename to non_pf: non prefilter.	9 years ago
Victor Julien	bb0cd0e883	prefilter: rename PatternMatcherQueue datatype ... In preparation of the introduction of more general purpose prefilter engines, rename PatternMatcherQueue to PrefilterRuleStore. The new engines will fill this structure a similar way to the current mpm prefilters.	9 years ago
Giuseppe Longo	07564c4e41	detect: add bypass keyword ... This adds a new keyword which permits to call the bypass callback when a sig is matched. The callback must be called when the match of the sig is complete.	9 years ago
Mats Klepsland	dc8e0b3cf2	detect: add detect engine for tls validity keywords ... Add detect engine for tls validity keywords (tls_cert_notbefore and tls_cert_notafter).	9 years ago
Mats Klepsland	ea5696812f	detect: add tls_cert_notbefore and tls_cert_notafter keywords ... Detection plugin for TLS certificate fields notBefore and notAfter. Supports equal to, less than, greater than, and range operations for both keywords. Dates can be represented as either ISO 8601 or epoch (Unix time). Examples: alert tls [...] tls_cert_notafter:1445852105; [...] alert tls [...] tls_cert_notbefore:<2015-10-22T23:59:59; [...] alert tls [...] tls_cert_notbefore:>2015-10-22; [...] alert tls [...] tls_cert_notafter:2000-10-22<>2020-05-15; [...]	9 years ago
Duarte Silva	89eb935f73	file-hashing: added support for SHA-256 file hashing	9 years ago
Duarte Silva	a6d928e269	file-hashing: added support for SHA-1 file hashing	9 years ago
Duarte Silva	188b382c46	file-hashing: common code added ... Moved and adapted code from detect-filemd5 to util-detect-file-hash, generalised code to work with SHA-1 and SHA-256 and added necessary flags and other constants.	9 years ago
Mats Klepsland	4172c4c8ac	tls: add (mpm) keyword tls_cert_subject ... This keyword is a replacement for tls.subject.	9 years ago
Mats Klepsland	9b2717799c	tls: add (mpm) keyword tls_cert_issuer ... This keyword is a replacement for tls.issuerdn.	9 years ago
Victor Julien	215d0d54c7	detect: optimize rule address parsing ... Many rules have the same address vars, so instead of parsing them each time use a hash to store the string and the parsed result. Rules now reference the stored result in the hash table.	9 years ago
Victor Julien	99dce740ef	detect: mark alproto in keyword reg deprecated ... No existing code uses it, and it had been useless for some time.	9 years ago