182 Commits (20df715e64ccab00c6f6778e1453b051aee7be17)

Author	SHA1	Message	Date
Jason Ish	796dd5223b	tests: no longer necessary to provide successful return code ... 1 pass, 0 is fail.	10 years ago
Victor Julien	f0ba00e51d	detect: remove old unused code	10 years ago
Victor Julien	4f8e1f59a6	mpm: remove obsolete mpm algos ... Remove: ac-gfbs, wumanber, b2g, b3g.	10 years ago
Victor Julien	f005310ddf	detect: add corner case mpm test	10 years ago
Jason Ish	3e5b8f48b1	Bug 1281 - Add tests for rule content of lengths > 255.	11 years ago
Jason Ish	e2b04635a7	Bug 1281 - Accept rule content with lengths greater than 255.	11 years ago
Giuseppe Longo	04561f13d3	signature: set flags and test the protocol ... This checks if the signature's protocol is http when setup the content keyword. Also sets the proper flags based by protocol since the flag SIG_FLAG_TOSERVER has to be set if the proto is smtp, otherwise SIG_FLAG_TOCLIENT is it's http.	11 years ago
Giuseppe Longo	41a1a9f4af	find and replace HSBDMATCH by FILEDATA ... This commit do a find and replace of the following: - DETECT_SM_LIST_HSBDMATCH by DETECT_SM_LIST_FILEDATA sed -i 's/DETECT_SM_LIST_HSBDMATCH/DETECT_SM_LIST_FILEDATA/g' src/* - HSBD by FILEDATA: sed -i 's/HSBDMATCH/FILEDATA/g' src/*	11 years ago
Ken Steele	923a77e952	Change Match() function to take const SigMatchCtx* ... The Match functions don't need a pointer to the SigMatch object, just the context pointer contained inside, so pass the Context to the Match function rather than the SigMatch object. This allows for further optimization. Change SigMatch->ctx to have type SigMatchCtx* rather than void* for better type checking. This requires adding type casts when using or assigning it. The SigMatch contex should not be changed by the Match() funciton, so pass it as a const SigMatchCtx*.	12 years ago
Ken Steele	8f1d75039a	Enforce function coding standard ... Functions should be defined as: int foo(void) { } Rather than: int food(void) { } All functions where changed by a script to match this standard.	12 years ago
Ken Steele	f9705377ae	Remove pkt variable from Packet structure. ... The uint8_t *pkt in the Packet structure always points to the memory immediately following the Packet structure. It is better to simply calculate that value every time than store the 8 byte pointer.	13 years ago
Eric Leblond	79fcf1378a	Use unlikely in malloc failure test. ... This patch is a result of applying the following coccinelle transformation to suricata sources: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc|SCMallocAligned|SCRealloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	13 years ago
Victor Julien	7f140f6726	Coverity 1038111: fix local overrun of a string in app layer proto detect setup code.	13 years ago
Eric Leblond	c5bd04f102	unittest: recycle packet before exit ... To avoid an issue with flow validation, we need to recycle the packet before cleaning the flow.	13 years ago
Victor Julien	7292998a58	Content: set up sticky buffers like file_data and dce_stub_data w/o flags, but with a list variable	13 years ago
Victor Julien	6ba52230ed	Update DetectContentDataParse to reflect the actual data types content uses.	13 years ago
Victor Julien	19511cda97	Remove obsolete DetectParseContentString function, it has been replaced by DetectContentDataParse	13 years ago
Anoop Saldanha	4c6efa2d40	Update content id assignment. ... All fp id assignment now happens in one go. Also noticing a slight perf increase, probably emanating from improved cache perf. Removed irrelevant unittests as well.	14 years ago
Anoop Saldanha	0b5d277254	code cleanup for all content based keywords.	14 years ago
Anoop Saldanha	51dcf19817	turn dce_stub_data into a sticky buffer.	14 years ago
Anoop Saldanha	34d5aadcb8	warn users that we don't support content strings whose length's > 255.	14 years ago
Eric Leblond	6842545331	Add documentation url in list-keyword output. ... The output of the list-keyword is modified to include the url to the keyword documentation when this is available. All documented keywords should have their link set. list-keyword can be used with an optional value: no option or short: display list of keywords csv: display a csv output on info an all keywords all: display a human readable output of keywords info $KWD: display the info about one keyword.	14 years ago
Victor Julien	84bad6db77	Silence compiler warnings found by clang	14 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	14 years ago
Victor Julien	40fcae3aa0	Minor unittest fixes to make Coverity happy.	15 years ago
Eileen Donlon	793478a832	reject rules with invalid hex digits in content	15 years ago
Eileen Donlon	1a46d7a53a	fix more invalid content unittests ... fix invalid unittests with mixed relative and non-relative content modifiers and other issues; DetectContentParse19 still contains some failing dce_stub tests which are commented out.	15 years ago
Victor Julien	cdba2f50d1	Various fixes and improvements based on feedback by Coverity analyzer.	15 years ago
Anoop Saldanha	1acb7cdc7d	All http_server_body modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_SERVER_BODY	15 years ago
Anoop Saldanha	6cab663bf0	code cleanup - replace SigMatchAppendPayload with SigMatchAppendSMToList	15 years ago
Anoop Saldanha	ab35b98f76	code cleanup - remove DetectContentGetLastPattern. Replace it with SigMatchGetLastSMFromLists	15 years ago
Anoop Saldanha	d85ab5ab1f	code cleanup - remove DetectContentFindNextApplicableSM	15 years ago
Anoop Saldanha	802350f65a	code cleanup - remove DetectContentHasPrevSMPattern	15 years ago
Anoop Saldanha	9652c3672d	code cleanup - remove SigMatchGetLastPattern	15 years ago
Anoop Saldanha	dcb2afb02f	Use sm_list to differentiate between different content types while retrieving pattern ids instead of sm_type	15 years ago
Victor Julien	07e560b137	file-data: initial file_data support ... Support file_data for: content, pcre (relative), byte_test, byte_jump, byte_extract, isdataat. File_data support is handled at signature parsing time, all matches occurring after the file_data in the rule are converted to http_server_body matches. Content matches relative to the file_data are converted. Within to depth, distance to offset. Relative to the start of the body buffer.	15 years ago
Anoop Saldanha	7433d92dd2	undo this commit - ... commit eff08f93d8 Author: Anoop Saldanha <poonaatsoc@gmail.com> Date: Thu Nov 3 14:31:24 2011 +0530 update failing unittest to reflect the mpm design update Fixed a bug in the mpm code that would make all the changes in the commit just undone wrong.	15 years ago
Anoop Saldanha	eff08f93d8	update failing unittest to reflect the mpm design update	15 years ago
Anoop Saldanha	ed3b44b3b5	fix parsing content keywords. We are more strict now. All content keywords need to be enclosed in double quotes. Better validation for sid, priority and rev keywords	15 years ago
Eric Leblond	a85dc9b0e2	Add support for replace keyword. ... This patch adds support for the replace keyword. It is used with content to change selected part of the payload. The major point with this patch is that having a replace keyword made necessary to avoid all stream level check because we need to access to the could-be-modified packet payload. One of the main difficulty is to handle complex signature. If there is other content check, we must do the substitution when we're sure all match are valid. The patch adds an attribute to the thread context variable to be able to deal with recursivity of the match function. Replace is only activated in IPS mode and apply only to raw match.	15 years ago
Eric Leblond	49adc264bc	Don't print message after SCMalloc failure. ... This patch generated via coccinelle is getting rid of logging message after a SCMalloc failure. They were useless as SCMalloc already displays a message.	16 years ago
Eric Leblond	1db4aadd16	Supress usage of Packet declaration in tests. ... For convenience, a massive usage of 'Packet p;' declaration has been done in the tests function. Although this was completely legal, this is not possible anymore because of the new Packet allocation structure. This massive patch modifies all suricata files to use a SCMalloc allocated pointer to Packet instead. This patch has been done using coccinelle (http://coccinelle.lip6.fr) which is a semantic patching tool. This ensures that things like call to SCFree() should have not been forget because the semantic patch explicitly forces the call to SCFree(p) before each return. With this patch all unittests are running fine with a small and a big default packet size.	16 years ago
Eric Leblond	dd038c1906	Modify files to avoid direct pckt payload access ... This patch implements the needed modification of payload access in a Packet structure to support the abstraction introduced by the extended data system.	16 years ago
Victor Julien	014f62247a	Another batch of clang fixes. Nothing really serious. Includes a couple of fixes for broken fixes from yesterday.	16 years ago
Anoop Saldanha	3d2f81d978	replace all Signature->dmatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_DMATCH]	16 years ago
Anoop Saldanha	e0476242c6	replace all Signature->umatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_UMATCH]	16 years ago
Anoop Saldanha	e54358a9e1	replace all Signature->pmatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_PMATCH]	16 years ago
Anoop Saldanha	82fd581b64	replace all sm lists (match, pmatch, dmatch, umatch, amatch, tmatch) with an array Signature->sm_lists[]. Replace all Signature->match instances in the engine with Signature->sm_lists[DETECT_SM_LIST_MATCH]	16 years ago
Anoop Saldanha	0c5b82d891	provide separate ids for content, uricontent, http_(client_body_data|cookie|header|method|uri), when they share the same pattern	16 years ago
Anoop Saldanha	b8f5a6a4fc	throw out contents/uricnotents with invalid hex assembly	16 years ago
Anoop Saldanha	850f44022f	invalidate sigs with content/uricontent strings ", "boo, boo" + fix parsing content strings of the format content: !\"boom\";"	16 years ago
Victor Julien	fc248ca7a1	Many small performance updates.	16 years ago
Pablo Rincon	76af1b049b	Make malloc errors on initialization stage a fatal error, resulting on a exit() call	16 years ago
Victor Julien	1071a53210	Fix unittests after ip_proto keyword change.	16 years ago
Pablo Rincon	34bb107f2c	Fix for bug 207 (depth/offset not correctly updated on certain cases)	16 years ago
Anoop Saldanha	ce8d27425d	fix signature parsing to how snort does it for content based keywords along with dce_stub_data	16 years ago
Victor Julien	37442a8a84	Prefilter signatures before fully scanning them.	16 years ago
Anoop Saldanha	015385c6bd	changes to the dce parser stub data processed var. changed to stub data fresh var to indicate if the stub is fresh or not	16 years ago
Anoop Saldanha	45ea0d914e	dce stub content keywords support using dcepayload.c support for all dce related content keywords	16 years ago
Gurvinder Singh	cda664a8c4	memroy leaks fixes in detection module, app layer and counters	16 years ago
William Metcalf	2eef905c07	GPL and Copyright header updates.	16 years ago
Gerardo Iglesias Galvan	9f4fae5b1a	Fix inconsistent use of dynamic memory allocation	16 years ago
Victor Julien	7a427ec7f4	Switch to pattern id based results checking in the mpm. Move app layer proto detection towards a more signature based approach.	16 years ago
Gurvinder Singh	3721037de5	unittests for bug 134&139 and some typo correction	16 years ago
William Metcalf	ce01927515	Import of GPLv2 Header 050410	16 years ago
Gurvinder Singh	69a4fee757	fixed the API and logic error reported by clang tool	17 years ago
Pablo Rincon	227fe516a0	Adding Boyer Moore context to content patterns, should speed up the search	17 years ago
Victor Julien	ced401b554	Update http_client_body code to recent changes.	17 years ago
Anoop Saldanha	97d49d8f5e	support for http_client_body keyword	17 years ago
Pablo Rincon	c7350a8ac6	Fixing some naming convention issues and incorrect error messages	17 years ago
Pablo Rincon	b708d7f65d	Adding Uricontent inspection with spm. Modifiers for uricontent are now supported	17 years ago
Anoop Saldanha	c54b91ed94	fix for bug 113	17 years ago
Victor Julien	c1a19bcd6b	Fix compilation of new detect-filter code, fix ip-only compatibility of detect-filter code.	17 years ago
Victor Julien	80dc4f1dbe	Further simplify content api: merge flags that indicate a next relative match, remove chunks as they are unnecessary now, make negated a bitflag.	17 years ago
Victor Julien	1e01fd613c	Remove all references to the scan phase from the pattern matchers and it's api.	17 years ago
Victor Julien	dd846c9b0e	Remove all search code from the pattern matchers, cleanup mpm api, remove unused http code, more cleanups.	17 years ago
Victor Julien	8b30226914	Detection keyword cleanup	17 years ago
Victor Julien	b259e362cd	Convert uricontent to use new scanning methods as well. Move http_method and http_cookie keywords out of pmatch list for now.	17 years ago
Victor Julien	bef70a04ce	First stage of detect engine redesign: equal patterns share id's, search phase no longer used, new match verification phase.	17 years ago
Victor Julien	50e41817a7	Share content id's between identical patterns.	17 years ago
Pablo Rincon	25a3a5c6d8	Adding mem wrapper to debug runtime alloc()/free() functions. Fixing some memory leaks.	17 years ago
Gerardo Iglesias Galvan	ba6d807a6e	Improve information about errors on signature failure	17 years ago
William Metcalf	811f2f605d	small fix for ! inside of content match	17 years ago
Victor Julien	0d34990d7f	Add OpenBSD's strlcpy and strlcat and replace all strcat/strcpy/strncat/strncpy by those calls.	17 years ago
Steve Grubb	60ad9d29c5	Memory leak cleanup in detectors ... Hello, I ran the code through an analysis program and found several leaks that should be cleaned up. *In src/detect-engine-address-ipv4.c at line 472, the test for ag == NULL will never be true since that is the loop entry test. *In src/detect-engine-port.c at line 1133, the test for p == NULL will never be true since that is the loop entry test. *In src/detect-engine-mpm.c at line 263 is a return without freeing fast_pattern *In src/detect-ack.c at line 80 and 85, data catches the return from malloc. One of them should be deleted. *In src/detect-seq.c at line 81 and 86, data catches the return from malloc. One of them should be deleted. *In src/detect-content.c at line 749, many of the paths that lead to the error exit still has temp pointing to allocated memory. To clean this up, temp should be set to NULL if not immediately assigning and new value. *In src/detect-uricontent.c at line 319, both cd and str needto be freed. At lines 344, str needs to be freed. And at line 347 str and temp need to be freed. *In src/detect-flowbits.c at line 231 and 235, str was not being freed. cd was not being freed at line 235. *In src/detect-flowvar.c at line 127, str was not being freed. At line 194, cd and str were not being freed. *In src/detect-flowint.c at line 277, sfd was not being freed. At line 315, str was not being freed. *In src/detect-pktvar.c at line 121, str was not being freed. At line 188, str and cd was not being freed. *In src/detect-pcre.c at line 389, there is an extra free of "re" that should be deleted. *In src/detect-depth.c at line 42 & 48, str has not been freed. *In src/detect-distance.c at line 49 and 55, str has not been freed *In src/detect-offset.c at line 45, str has not been freed. The patch below fixes these issues. -Steve	17 years ago
Victor Julien	4284276b11	Merge applayer detect function into normal match function. Should speed up detection.	17 years ago
Pablo Rincon	b6a3395c08	Adding unittest helper functions for building generic packets, checking arrays of expected match results, perform generic tests, etc. Look at util-unittest-helper.c and detect-ipproto.c for references	17 years ago
Victor Julien	fcabd1b2ba	Fix typo.	17 years ago
Victor Julien	b7bac14040	Fixup code to compile with -Wall -Werror -Wextra -Wno-unused-parameter compiler options.	17 years ago
Victor Julien	7b2610ba1f	Fix extra spaces confusing content and uricontent.	17 years ago
Victor Julien	35e884f303	Make sure offset modifies depth.	17 years ago
Victor Julien	1d12de9500	DetectContentChunkMatchTest11 is no longer expected to fail.	17 years ago
Victor Julien	53041eeb67	Small cleanups.	17 years ago
Pablo Rincon	6f76ed6804	Match content fail when two contents are specified in the same rule and the last of them has length = 1	17 years ago
Victor Julien	8490208ba1	Fix bug fix	17 years ago
Victor Julien	fa5dbaeb1d	Fix segv when testing for sid 2002181	17 years ago
Victor Julien	ecf86f9c23	Rename to Suricata.	17 years ago
Anoop Saldanha	cd0de89bd4	Fix for handling negated content "\!CONTENT"	17 years ago
Victor Julien	2213ff933f	Compile fix.	17 years ago
Brian Rectanus	44083b6505	Fixed warning in detect-content.	17 years ago