61 Commits (127ef8f903f2f0cf9101c7992d3aa7e3dcbb6bee)

Author	SHA1	Message	Date
Anoop Saldanha	3749fc98fd	Modify handling of negated content. ... The old behaviour of returning a failure if we found a pattern while matching on negated content is now changed to continuing searching for other combinations where we don't find the pattern for the negated content. Thanks to Will Metcalf for reporting this.	12 years ago
Eric Leblond	cd3e32ce19	unittests: some functions needs a flow lock. ... In debug validation mode, it is required to call application layer parsing and other functions with a lock on flow. This patch updates the code to do so.	12 years ago
Anoop Saldanha	48cf0585fb	Suricata upgrade to libhtp 0.5.x. ... Remove the support for now unsupported personalities from libhtp - TOMCAT_6_0, APACHE and APACHE_2_2. We instead use the APACHE_2 personality.	12 years ago
Anoop Saldanha	ab4b15c2e7	fix for #788. ... Now depth is kept in mind when we inspect chunks in client/server body. This takes care of FPs originating from inspecting subsequent chunks that match with depth, but shouldn't.	12 years ago
Anoop Saldanha	d4d18e3136	Transaction engine redesigned. ... Improved accuracy, improved performance. Performance improvement noticeable with http heavy traffic and ruleset. A lot of other cosmetic changes carried out as well. Wrappers introduced for a lot of app layer functions. Failing dce unittests disabled. Will be reintroduced in the updated dce engine. Cross transaction matching taken care of. FPs emanating from these matches have now disappeared. Double inspection of transactions taken care of as well.	12 years ago
Anoop Saldanha	b99f9fe890	New app inspection engine introduced. Moved existing inspecting engines to use it.	13 years ago
Anoop Saldanha	7b4eac3e8d	Change all inspect callbacks to accept TV and a tx_id param.	13 years ago
Victor Julien	19a7e7f395	flow: create a flow lock macro API, implement it for mutex and rwlocks. Mutex remains the default.	14 years ago
Anoop Saldanha	603d4a719a	remove det_ctx->payload_offset and use det_ctx->buffer_offset. Update hscd and hsmd to use the new generic content inspection engine	14 years ago
Anoop Saldanha	d1d5507679	remove all old content inspection engines and references to them. We have cleaned the entire content inspection phase and improved alert accuracy	14 years ago
Anoop Saldanha	35f1f7e8d9	unify payload detection engines + fix other bugs in pcre init	14 years ago
Anoop Saldanha	9287cce674	raw urilen inspection moves to raw uri list. Won't make any difference wrt inspection	14 years ago
Anoop Saldanha	999c34111e	bug #341 - support for urilen check on both norm and raw buffers	14 years ago
Victor Julien	3009429e3c	HTTP transaction handling improvement ... In some cases AppLayerTransactionGetInspectId can return -1, which is now handled by all it's callers. Improve logic of selecting which transactions are inspected by the various HTTP keywords.	14 years ago
Anoop Saldanha	9a6aef459e	modify all relevant app layer API calls to accomodate passing parser local storage argument	14 years ago
Victor Julien	262a7300d7	flow: shrink Flow datatype ... Introduce a separate FlowAddress structure for holding the ipv4 or ipv6 address that doesn't have the family in it like the Address structure. Instead, the family is stored in the flow as a flag: FLOW_IPV4 and FLOW_IPV6. Add macro's to check the family, copy the address, etc. Update many unittests to reflect these changes. Introduce unittest helper functions for creating and initializing a flow and freeing it again. On 64 bit this shrinks the flow with 8 bytes.	14 years ago
Victor Julien	06904c9024	App Layer cleanup ... Removal of per flow 'aldata' array. It contained a ptr for each ALPROTO. Instead now we have 2 ptrs in the flow: alparser and alstate. Various cleanups and dead code removal from the app layer API. Should safe 100+ bytes memory per flow on 64 bit. Updated lots of unittests to reflect these changes.	14 years ago
Victor Julien	2d16abcf8b	Minor code cleanups fixing all GCC 4.6 compiler warnings for default, debug and unittests mode.	14 years ago
Anoop Saldanha	ed3b44b3b5	fix parsing content keywords. We are more strict now. All content keywords need to be enclosed in double quotes. Better validation for sid, priority and rev keywords	14 years ago
Anoop Saldanha	35f3eafa5e	byte extract added to the engine. Detection support added for packet payload, uri and dce detection engines	14 years ago
Victor Julien	e16a566a96	Account for distance when checking within. Bug #285.	14 years ago
Anoop Saldanha	d245f15f14	disable mpm pattern's retest skipping in detection engine for uri, hcbd, hmd, hrhd, hhd, hmd, hcd	15 years ago
Victor Julien	987ce57a02	Wrap a number of BUG_ON's in the detection engine in DEBUG ifdefs as the conditions they check for are not serious enough to abort the engine.	15 years ago
Victor Julien	cc116d71ef	Fix unittests after merge.	15 years ago
Victor Julien	a622ad5047	Fix new unittests introduced by rebase with next branch.	15 years ago
Victor Julien	1d971b53a6	Update all unittests	15 years ago
Anoop Saldanha	2321a4dd58	support isdataat negation. Also fix addiing isdataat to appropriate lists	15 years ago
Victor Julien	0cd2bce7da	Manually add unittest by Pablo Rincon from bug #210.	15 years ago
Anoop Saldanha	e50503e820	cleanup/remove dead code	15 years ago
Anoop Saldanha	72b0fcf419	modify detection engine to carry out uri mpm run before build match array if alproto is http and if sgh has atleast one sig with uri mpm set	15 years ago
Victor Julien	6a5d2cb40d	Fix potential locking issue in out of memory conditions in the http_header, http_raw_header code. Fix other potential small issues in http_ code.	15 years ago
Anoop Saldanha	1cd8bd3d3c	make changes for uri mpm, when uricontent is negated and also is the fp and we ignore checking it once again in engine-uri.c	15 years ago
Anoop Saldanha	eade60f0fd	make some name changes. break PopulateMpm(). Set the avoid mpm double check flags	15 years ago
Anoop Saldanha	4883efd0f6	unifying content structure - uricontent now uses DetectContentData	15 years ago
Anoop Saldanha	6eaba8941c	Use new flags to indicate uricontent has a mpm set	15 years ago
Anoop Saldanha	4a038511ff	Change the struct members uricontent and uricontent_len in DetectUricontentData to content and content_len. Make replacements everywhere else in the codebase to accomodate these changes	15 years ago
Anoop Saldanha	e0476242c6	replace all Signature->umatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_UMATCH]	15 years ago
Anoop Saldanha	bc99328ec8	define a new conf paramter detect-engine:inspection-recursion-limit; Defines a recursion limit for content inspection code	15 years ago
Anoop Saldanha	88d94b136d	Support for reference.config file	15 years ago
Victor Julien	fc248ca7a1	Many small performance updates.	15 years ago
Anoop Saldanha	60c770c434	make pcre respect discontinue_matching flag in content matching functions	15 years ago
Victor Julien	1071a53210	Fix unittests after ip_proto keyword change.	15 years ago
Anoop Saldanha	b94eaec7c2	implement relative pcre matching in detect-engine-(payload|uri|dcepayload).c. Also fix within/distance handling of RELATIVE_NEXT flag for uricontent	15 years ago
Anoop Saldanha	3a375aa43a	fix relative contents with a negated content for detect-engine-(uri|dcepayload).c like how we did for detect-engine-payload.c	15 years ago
Pablo Rincon	b7076a8ea0	Don't avoid inspecting uricontents if we get no match. It can be negated uricontents (and urilens/pcre..). But at least skip the search if we get no match	15 years ago
Anoop Saldanha	fa373516c5	fixes the offset case for content matches + a case not handled by the prevous fix for multiple relative content matches. fix for payload.c dcepayload.c and uri.c	15 years ago
Anoop Saldanha	92eb380594	multiple relative content matches changes for detect-engine-dcepayload.c and detect-engine-uri.c like how we did for detect-engine-payload.c	15 years ago
Pablo Rincon	eedafa3a17	Adding unittests for anchored pcres for anchored	15 years ago
Pablo Rincon	bcb0b9ef9b	Moving urilen inspection to detect-engine-uri. Adding unittests for pcre /U and urilen, in combination with uricontent	15 years ago
Anoop Saldanha	36e4b1830e	add pcre with U modifiers to the umatch sigmatch list. fix for bug 155	15 years ago