94 Commits (071f55dcd7892924d193cc1e747bcfa01498202a)

Author	SHA1	Message	Date
Jeff Lucovsky	fb409664d2	detect: byte_math support	5 years ago
Jeff Lucovsky	39105917ce	detect/bsize: Use SCLogDebug instead of printf ... This commit updates debug "printf" message to use SCLogDebug	5 years ago
Jeff Lucovsky	620659b5f3	detect: Increase flag size for byte_jump	5 years ago
Jeff Lucovsky	23a65b5824	general: Fix typo in detect-bytejump.c	5 years ago
Jeff Lucovsky	0701d82890	detect/bytejump: Add "from_end" support ... This commit adds support for the byte jump "from_end" keyword and unittests.	5 years ago
Victor Julien	26bcc97515	detect/keywords: dynamic version part of doc URL	5 years ago
Jeff Lucovsky	d3a65fe156	detect: Provide `de_ctx` to free functions ... This commit makes sure that the `DetectEngineCtx *` is available to each detector's "free" function.	5 years ago
Shivani Bhardwaj	0e4f261224	Use StringParse* for all parsers and configurations	5 years ago
Jeff Lucovsky	7f6af10fed	general: copyright bump	5 years ago
Jeff Lucovsky	4b0085b03c	detect: Update to take advantage of PCRE refactor ... This commit changes the keyword detectors to use the refactored PCRE modifications from detect-parse.[ch]	5 years ago
Shivani Bhardwaj	d801c3e588	detect: Make keyword description consistent ... Closes redmine ticket #3137.	6 years ago
Shivani Bhardwaj	b5b429c288	detect: Add missing keyword URLs and description ... Add missing keyword URLs and their description. Fix the ones that were incorrect. Partially closes redmine ticket #2974.	6 years ago
Victor Julien	579cc9f02b	const: constify decoder, app-layer, detect funcs	6 years ago
Shivani Bhardwaj	85b56b633e	detect: Improve rule keyword alproto registration ... 1. Set WARN_UNUSED macro on DetectSignatureSetAppProto. 2. Replace all direct 'sets' of Signature::alproto from keyword registration. Closes redmine ticket #3006.	6 years ago
Victor Julien	14896365ef	detect: remove Threadvars argument from API calls ... Remove it as it's (almost) never used. If it is really needed it can be accessed through DetectEngineThreadCtx::tv as well.	6 years ago
Philippe Antoine	a370d2a91d	signature: fix memory leak in DetectBytejumpSetup	6 years ago
Victor Julien	a496c8be0c	detect/bytejump: suppress runtime error messages	6 years ago
Victor Julien	313661451d	content inspection: support transforms ... Make sure content is applied to the transformed version of a buffer. Support content with its modifiers, and also isdataat, pcre, bytetest and bytejump.	8 years ago
Victor Julien	ab1200fbd7	compiler: more strict compiler warnings ... Set flags by default: -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wwrite-strings -Wcast-align -Wbad-function-cast -Wformat-security -Wno-format-nonliteral -Wmissing-format-attribute -funsigned-char Fix minor compiler warnings for these new flags on gcc and clang.	8 years ago
Victor Julien	3626ecb474	bytejump: don't print errors when matching ... When bytejump was told to convert some payload data to int from a string it would print an error to the screen if the conversion failed. This is unwanted as the payload is controlled by an attacker and printing is expensive.	8 years ago
Victor Julien	cc4010343d	detect: add and use util func for alproto sets	9 years ago
Victor Julien	dfac5276b8	detect: remove unused SIGMATCH_PAYLOAD flag	9 years ago
Victor Julien	fe415ae518	detect: remove DMATCH list	9 years ago
Victor Julien	6bd37611ee	file_data: dynamic buffer	9 years ago
Victor Julien	779d40cedf	detect: remove hardcoded sm_list logic from setup ... Introduce utility functions to aid this.	9 years ago
Victor Julien	f370e88135	detect: move init only Signature members to init_data	9 years ago
Victor Julien	8edc954e82	detect: get rid of Signature::sm_lists ... Instead use the lists in init_data during setup and the SigMatchData arrays during runtime.	9 years ago
Victor Julien	39613778cd	detect: make setup/free/match funcs static where possible	9 years ago
Victor Julien	bfd4bc8233	detect: constify Signature/SigMatch use at runtime	9 years ago
Victor Julien	e67ae0f174	detect keywords: use parse regex util func	9 years ago
Jason Ish	796dd5223b	tests: no longer necessary to provide successful return code ... 1 pass, 0 is fail.	9 years ago
Giuseppe Longo	41a1a9f4af	find and replace HSBDMATCH by FILEDATA ... This commit do a find and replace of the following: - DETECT_SM_LIST_HSBDMATCH by DETECT_SM_LIST_FILEDATA sed -i 's/DETECT_SM_LIST_HSBDMATCH/DETECT_SM_LIST_FILEDATA/g' src/* - HSBD by FILEDATA: sed -i 's/HSBDMATCH/FILEDATA/g' src/*	10 years ago
Ken Steele	923a77e952	Change Match() function to take const SigMatchCtx* ... The Match functions don't need a pointer to the SigMatch object, just the context pointer contained inside, so pass the Context to the Match function rather than the SigMatch object. This allows for further optimization. Change SigMatch->ctx to have type SigMatchCtx* rather than void* for better type checking. This requires adding type casts when using or assigning it. The SigMatch contex should not be changed by the Match() funciton, so pass it as a const SigMatchCtx*.	11 years ago
Jason Ish	a18e2ef402	Bug 1230: Check all SigMatch lists for a named byte_extract variable.	11 years ago
Ken Steele	8f1d75039a	Enforce function coding standard ... Functions should be defined as: int foo(void) { } Rather than: int food(void) { } All functions where changed by a script to match this standard.	11 years ago
Victor Julien	59ccd7b62d	byte-test: switch to pcre_copy_substring ... Fixes cppcheck: [src/detect-bytejump.c:360]: (error) Uninitialized variable: str_ptr [src/detect-bytejump.c:372]: (error) Uninitialized variable: str_ptr [src/detect-bytejump.c:375]: (error) Uninitialized variable: str_ptr Bug #1046.	11 years ago
Victor Julien	3fa958b9a7	byte_extract/test/jump: fix coverity issues ... During keyword setup there was a path that in theory could lead to indexing an array with a negative int. Coverity 992695, 400605, 400604	12 years ago
Victor Julien	7292998a58	Content: set up sticky buffers like file_data and dce_stub_data w/o flags, but with a list variable	12 years ago
Anoop Saldanha	c3d98f9640	Fix the bug specified in the previous commit. ... Bug emanates from byte_test, byte_jump and byte_extract keyword being unable to handle negative offsets when the inspection pointer is at the end of the buffer.	12 years ago
Anoop Saldanha	0b5d277254	code cleanup for all content based keywords.	12 years ago
Anoop Saldanha	51dcf19817	turn dce_stub_data into a sticky buffer.	12 years ago
Anoop Saldanha	a308d718ae	Allow the use of relative without the presence of a related previous keyword.	12 years ago
Last G	8ae11f73b2	Added parentheses to fix Eclipse static code analysis ... Fixed bug in action priority (REJECT_DST had lowest prio)	13 years ago
Victor Julien	84bad6db77	Silence compiler warnings found by clang	13 years ago
Victor Julien	93bdaa49d8	byte_jump: when from_beginning option is used, the number of bytes to convert should not be used in the jump. Bug 627.	13 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	13 years ago
Victor Julien	40fcae3aa0	Minor unittest fixes to make Coverity happy.	13 years ago
Anoop Saldanha	1acb7cdc7d	All http_server_body modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_SERVER_BODY	14 years ago
Anoop Saldanha	4810ee9c5f	All uricontent modified patterns now are DETECT_CONTENT and not DETECT_URICONTENT. Step towards unifying all content based patterns. Makes way for easier management of patterns	14 years ago
Anoop Saldanha	ac68c3f893	code cleanup - replace SigMatchAppendDcePayload with SigMatchAppendSMToList	14 years ago