327 Commits (04ccfda6398820ccc570497ea76aea5966dc368c)

Author	SHA1	Message	Date
Anoop Saldanha	bc4df59414	Support for Classtype keyword and Classification Config file	17 years ago
Victor Julien	d5c732f1f9	Add tag keyword stub	17 years ago
Victor Julien	4824868766	Application layer detection improvements ... - improve locking of application layer handling, making sure that the flow cannot be freed/cleared when the detection engine is still working with it. - add a check to the app layer detection to make sure that a match function will only inspect an app layer state if it's of the right type.	17 years ago
Pablo Rincon	f2f9b83280	Adding FTP app layer parser and ftpbounce detection at L7	17 years ago
Victor Julien	6ab64706b0	Improve threshold hash table handling.	17 years ago
Gerardo Iglesias Galvan	7e87f373b9	Add icmp_id keyword support	17 years ago
Victor Julien	493715c0d2	Implement alert sid storage in the flow so we can check previous alerts in the flow.	17 years ago
Victor Julien	9fd46e9425	Support for sigs with both pkt and applayer detect ... Sets a flowbit with the sig id if the packet matches match. Checks on that if the app layer matches match. Currently misuses the flowbits api for this in a way that needs fixing.	17 years ago
Breno Silva	69eb869cc9	Threshold Rule	17 years ago
Gurvinder Singh	a0f184866c	http_cookie keywork support	17 years ago
Gerardo Iglesias Galvan	b254719ffc	Add fatal failures on unittest and siginit failure (using Conf API)	17 years ago
Pablo Rincon	1ad6d75dfe	Added rpc keyword support at packet level	17 years ago
Pablo Rincon	a8d7b71490	First version of flowints	17 years ago
Gerardo Iglesias	991d421394	Changed printf's to logging API functions	17 years ago
Pablo Rincon	6206ffb530	Adding bidirectional operator support and unittests	17 years ago
Victor Julien	f1f7df0766	First iteration of doing app layer detection.	17 years ago
Anoop Saldanha	6ca5dbc9e9	Support fast_pattern modifier keyword for content	17 years ago
Anoop Saldanha	1c7ac13c25	Support for negated content	17 years ago
Pablo Rincon	f233f9fa31	Adding detect_content chunks handling for max_pattern_length and unittests. Updating modifiers to use it.	17 years ago
Victor Julien	d6be6ceb19	Fixup artifact from automatic renames: rename DetectAddresssHead to DetectAddressHead.	17 years ago
Gurvinder Singh	cacbf31aad	support for ttl keyword	17 years ago
Victor Julien	de8caa7964	Rename DetectAddressGroup* to DetectAddress*	17 years ago
Victor Julien	3c7a038477	Further memory cleanups. Split out init only vars out of the sig group head.	17 years ago
Victor Julien	32e51e5e5a	Replace sgh refcnt by a flag.	17 years ago
Victor Julien	2d0e9658f8	Speed up per sgh content maxlen calc. Remove mpm ptrs from mpm ctx. Add unittests testing the detection engine internals.	17 years ago
Victor Julien	e4c98c562c	Merge DetectAddressData and DetectAddressGroup	17 years ago
Victor Julien	15ab5d7003	More engine init memleaks fixed. HashListTable remove function fixed.	17 years ago
Victor Julien	7a7bb7a390	Get rid of global mpm_ctx.	17 years ago
Brian Rectanus	ed30067bd7	Ack/Seq Keywords	17 years ago
Brian Rectanus	ec6c5258b6	Sameip Keyword	17 years ago
Breno Silva	15a8f34d36	Gid Keyword ... Signed-off-by: Brian Rectanus <brectanu@gmail.com>	17 years ago
Breno Silva	6100a7f610	FragBits Keyword ... Signed-off-by: Brian Rectanus <brectanu@gmail.com>	17 years ago
Victor Julien	4dbcf5fbac	Add support for moving detection tests outside of detect.c and move the 'id' tests to it's own file.	17 years ago
Pablo Rincon	1a983fd316	Adding id keyword and unittests	17 years ago
Victor Julien	085b7a3c0e	Move unittests away from detect.c	17 years ago
Breno Silva	7dc985aa4e	Signature Flags Keyword ... Signed-off-by: Brian Rectanus <brectanu@gmail.com>	17 years ago
Brian Rectanus	e28647032d	Add ip_proto support.	17 years ago
Gurvinder Singh	a991ab0a19	added sigmatch payload flag	17 years ago
Anoop Saldanha	f658ffbc9c	Order the signatures based on certain rule parameters like actions, flowbits, flowvar, pktvar, priority etc	17 years ago
Breno Silva	27c61ac148	IpOpts Rule Keyword ... Signed-off-by: Brian Rectanus <brectanu@gmail.com>	17 years ago
Pablo Rincon	bdf119ade3	Adding window and isdataat keyword and some unittests	17 years ago
Brian Rectanus	02a8b583c9	Added byte_test and byte_jump support.	17 years ago
Gurvinder Singh	ac53ca5b27	Stream Size rule option	17 years ago
Anoop Saldanha	22c0ec2bc5	Added support for the csum-<protocol> rules keyword to the detection engine. Keywords added are ipv4-csum, tcpv4-csum, tcpv6-csum, udpv4-csum, udpv6-csum, icmpv4-csum and icmpv6-csum	17 years ago
Victor Julien	6eaff4be12	Fixes for issues found by static code analyzer.	17 years ago
Victor Julien	b26b5aa462	More cleanups.	17 years ago
Victor Julien	85abc3ef62	Complete removal of global de_ctx. UtRuntests now returns the number of failed tests or 0 on none. Program exits with code 1 on failed tests, code 0 otherwise. Removal of broken http uri test.	17 years ago
Victor Julien	b9972a9d2c	Cleanups	17 years ago
Victor Julien	97854cf4bb	Fixup some rule parser memleaks	17 years ago
Anoop Saldanha	244f5d547a	new registration functions for the stats api, with local thread storage for counter ids	17 years ago
Brian Rectanus	fa5939ca91	64 bit cleanup part2	17 years ago
Anoop Saldanha	8af9f902e8	additional support for type qualifier for the stats api	17 years ago
William Metcalf	dd86b51dbc	added optional option to specify signature file to load	17 years ago
Breno Silva	c90b4e6fcd	Decode event rule	17 years ago
Victor Julien	689bbfdc45	Rename all structure definitions in the "typedef struct _SomeStruct" format to "typedef struct SomeStruct_" to make the Doxygen output more useful. ... Remove the Trie multi pattern matcher code. It wasn't used anymore.	18 years ago
Victor Julien	ff4b5a5db7	Add support for flowbits.	18 years ago
Victor Julien	657be002d1	Big detection engine update: scan improvements, b2g/b3g updates, bloom fixes, iponly detection implementation, dsize/flow grouping.	18 years ago
Victor Julien	5df5b35e90	Put all globals in the detection engine ctx. Add HashList type, a hash that also stores the items ina list to it can be traversed. Many cleanups.	18 years ago
Victor Julien	efb10fc0d6	big update	18 years ago
Victor Julien	69e056e33f	Add the scanning to uricontent as well.	18 years ago
Victor Julien	fedcc397de	Detection engine improvement: don't run pattern matcher on packets with payload sizes less that the biggest content we need to match. Add some extra stats.	18 years ago
Victor Julien	dce2c12915	Add Scan before Search to the detection engine.	18 years ago
Victor Julien	c4f2fe4bd7	Implement per packet variables and switch the http stuff to it.	18 years ago
Victor Julien	3f7195454b	Big detection engine update.	18 years ago
Victor Julien	54ffe2053e	Large detection engine update.	18 years ago
Victor Julien	f3a94413db	Properly support 'alert ip' rules. Add support for handling ip only rules differently.	18 years ago
Victor Julien	dc48c58473	Switch to using a detection engine ctx.	18 years ago
Victor Julien	171c8c777d	Group signatures by protocol.	18 years ago
Victor Julien	eb1c4e4987	Large update to the detection engine. Greatly improve initialization speed and memory usage.	18 years ago
Victor Julien	b50fc8aecd	Speed up appending of sigs to a sig group head by using a tail ptr.	18 years ago
Victor Julien	eaaeb30cd6	Add noalert keyword for use with sigs that are used for capturing only.	18 years ago
Victor Julien	f0ed41fb0a	Support priority keyword, add priority to alert-fastlog.	18 years ago
Victor Julien	dc224cb2d2	Large update containing the first step to making the detection engine use rule groups. Address based rule groups are now implemented.	18 years ago
William Metcalf	559edc01e3	NFQUE drop support added with ident of 4 :-(	18 years ago
Victor Julien	b8ad4adf81	complete rename of address2 to address	18 years ago
Victor Julien	7aada782a4	WIP address matching stuff	18 years ago
Victor Julien	bab4b62376	Initial add of the files.	18 years ago