88 Commits (16ea200846605c50cc4f034cd287b3018eb269ad)

Author	SHA1	Message	Date
Victor Julien	6bd37611ee	file_data: dynamic buffer	10 years ago
Victor Julien	779d40cedf	detect: remove hardcoded sm_list logic from setup ... Introduce utility functions to aid this.	10 years ago
Victor Julien	04592efb76	detect: buffer type API ... To replace the hardcoded SigMatch list id's, use this API to register and query lists by name. Also allow for registering descriptions and whether mpm is supported. Registration is only allowed at startup.	10 years ago
Victor Julien	f370e88135	detect: move init only Signature members to init_data	10 years ago
Victor Julien	8edc954e82	detect: get rid of Signature::sm_lists ... Instead use the lists in init_data during setup and the SigMatchData arrays during runtime.	10 years ago
Jason Ish	1a31bded4a	DNP3: dnp3_data, dnp3_func, dnp3_ind, dnp3_obj rule keywords	10 years ago
Victor Julien	0ed119068d	detect-app-layer-protocol: implement prefilter ... Introduce 'Protocol detection'-only rules. These rules will only be fully evaluated when the protocol detection completed. To allow mixing of the app-layer-protocol keyword with other types of matches the keyword can also inspect the flow's app-protos per packet. Implement prefilter for the 'PD-only' rules.	10 years ago
Victor Julien	9195708d58	detect analyzer: give minimal prefilter info	10 years ago
Mats Klepsland	4172c4c8ac	tls: add (mpm) keyword tls_cert_subject ... This keyword is a replacement for tls.subject.	10 years ago
Mats Klepsland	9b2717799c	tls: add (mpm) keyword tls_cert_issuer ... This keyword is a replacement for tls.issuerdn.	10 years ago
Mats Klepsland	a13df67864	detect: add (mpm) keyword for tls_sni ... Match on server name indication (SNI) extension in TLS using tls_sni keyword, e.g: alert tls any any -> any any (msg:"SNI test"; tls_sni; content:"example.com"; sid:12345;)	10 years ago
Victor Julien	bfe49b60f7	rule analyzer: add no/both direction warning	10 years ago
Victor Julien	0d3f671b55	detect: constify mpm/detect funcs	10 years ago
Victor Julien	2c8e8c2516	dns: rename type so it's purpose is more clear	11 years ago
Victor Julien	1ed8d7b538	detect analizer: fix minor coverity warning ... ** CID 1298889: Integer handling issues (NEGATIVE_RETURNS) /src/detect-engine-analyzer.c: 102 in EngineAnalysisFP()	11 years ago
Victor Julien	8d0b090150	engine-analysis: print fast_pattern summary ... When using engine analysis for print fast_pattern stats, print a short summary at the end containing per buffer: - smallest fp - biggest fp - number of patterns - avg fp len	11 years ago
Giuseppe Longo	41a1a9f4af	find and replace HSBDMATCH by FILEDATA ... This commit do a find and replace of the following: - DETECT_SM_LIST_HSBDMATCH by DETECT_SM_LIST_FILEDATA sed -i 's/DETECT_SM_LIST_HSBDMATCH/DETECT_SM_LIST_FILEDATA/g' src/* - HSBD by FILEDATA: sed -i 's/HSBDMATCH/FILEDATA/g' src/*	11 years ago
Victor Julien	d834173bb8	detect-flow: use dedicated flags ... The flow keyword used flag names that were shared with the Packet::flowflags field. Some of the flags were'nt used by the packet though. This lead to waste of some 'flag space'. This patch defines dedicated flags for the flow keyword and removes the otherwise unused flags from the FLOW_PKT_* space.	12 years ago
Ken Steele	8f1d75039a	Enforce function coding standard ... Functions should be defined as: int foo(void) { } Rather than: int food(void) { } All functions where changed by a script to match this standard.	12 years ago
Anoop Saldanha	127ef8f903	Use a typdef AppProto <-> uint16_t for representing app layer protocol. ... Some minor refactoring/cleanup, including renaming functions.	13 years ago
Ken Steele	d4dd18eb85	Clean up SCLocalTime() usage ... Remove cast of return type from SCLocalTime() as it is not needed. Replace last use of localtime_r() with SCLocalTime().	13 years ago
Eric Leblond	34abd818dd	Prefix util-conf function with Config	13 years ago
Eric Leblond	54006de40c	Use new function GetLogDirectory()	13 years ago
Victor Julien	43ba5a677e	DNS: enable mpm/fast_pattern support for dns_query	13 years ago
Anoop Saldanha	f58c6589b4	We now print content flags in engine fp analyzer.	14 years ago
Last G	8ae11f73b2	Added parentheses to fix Eclipse static code analysis ... Fixed bug in action priority (REJECT_DST had lowest prio)	14 years ago
Eric Leblond	86709f5e9d	rule analyser: display message for invalid signatures	14 years ago
Eric Leblond	c7cfbb71c9	engine-analyzer: fix typo in message	14 years ago
Eric Leblond	b0471fb8e4	rule analyser: add msg if rule is ipv4 or ipv6 only	14 years ago
Anoop Saldanha	7a7cd6999e	feature #558. ... Print FP info in rule analysis + other cleanup.	14 years ago
Victor Julien	f1b6f7a9e6	rule analyzer: make analyzer aware of http_user_agent pcre flag /V.	14 years ago
Victor Julien	bd6b865473	rule analyzer: fix fast pattern analyzer reporting wrong filename (same as rule analyzer).	14 years ago
Anoop Saldanha	bf6cd48259	if a sig's set as stream sig only, don't updated it as both stream and pkt sig if offset/depth's present ... bug #495 - update rule analyzer to not warn on offset_depth-tcp_pkt update if sig is stream only bug #497 - rule_warnings fixed	14 years ago
Anoop Saldanha	7833883a8f	bug #496 - don't warn about offset/depth for packet sigs	14 years ago
Victor Julien	c2e484ae88	rule analyzer: fix detecting stream match	14 years ago
Anoop Saldanha	946a9ece32	rule analyzer updated for sigs with offset/depth set + alproto set	14 years ago
Victor Julien	850379552a	rule analyzer: minor cleanups. Fix warning-only setting, allow true/yes/enabled for yaml option.	14 years ago
Eileen Donlon	c81020e9a3	feature 349 rule analyzer v1	14 years ago