32 Commits (262a7300d701c44dba13bb2aaa2b14bed3485383)

Author	SHA1	Message	Date
Victor Julien	262a7300d7	flow: shrink Flow datatype ... Introduce a separate FlowAddress structure for holding the ipv4 or ipv6 address that doesn't have the family in it like the Address structure. Instead, the family is stored in the flow as a flag: FLOW_IPV4 and FLOW_IPV6. Add macro's to check the family, copy the address, etc. Update many unittests to reflect these changes. Introduce unittest helper functions for creating and initializing a flow and freeing it again. On 64 bit this shrinks the flow with 8 bytes.	14 years ago
Victor Julien	06904c9024	App Layer cleanup ... Removal of per flow 'aldata' array. It contained a ptr for each ALPROTO. Instead now we have 2 ptrs in the flow: alparser and alstate. Various cleanups and dead code removal from the app layer API. Should safe 100+ bytes memory per flow on 64 bit. Updated lots of unittests to reflect these changes.	14 years ago
Anoop Saldanha	ed3b44b3b5	fix parsing content keywords. We are more strict now. All content keywords need to be enclosed in double quotes. Better validation for sid, priority and rev keywords	14 years ago
Anoop Saldanha	b4427e81ec	minor fixes in endianness handling in dcerpc and dce detection engine	14 years ago
Anoop Saldanha	35f3eafa5e	byte extract added to the engine. Detection support added for packet payload, uri and dce detection engines	14 years ago
Victor Julien	e16a566a96	Account for distance when checking within. Bug #285.	14 years ago
Victor Julien	987ce57a02	Wrap a number of BUG_ON's in the detection engine in DEBUG ifdefs as the conditions they check for are not serious enough to abort the engine.	15 years ago
Victor Julien	1d971b53a6	Update all unittests	15 years ago
Victor Julien	014f62247a	Another batch of clang fixes. Nothing really serious. Includes a couple of fixes for broken fixes from yesterday.	15 years ago
Anoop Saldanha	3d2f81d978	replace all Signature->dmatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_DMATCH]	15 years ago
Anoop Saldanha	e54358a9e1	replace all Signature->pmatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_PMATCH]	15 years ago
Anoop Saldanha	bc99328ec8	define a new conf paramter detect-engine:inspection-recursion-limit; Defines a recursion limit for content inspection code	15 years ago
Victor Julien	fc248ca7a1	Many small performance updates.	15 years ago
Anoop Saldanha	fc37e9d6ee	add internal ids to uuids. Use these internal ids to match uuids from bind and bind_ack. Create a new uuid list to hold all accepted uuids. Modifications to dce-iface to accomodate these changes as well + unittests	15 years ago
Anoop Saldanha	60c770c434	make pcre respect discontinue_matching flag in content matching functions	15 years ago
Victor Julien	1071a53210	Fix unittests after ip_proto keyword change.	15 years ago
Anoop Saldanha	ead29dc691	make detection engine use dce alstate(if present), on seeing smb traffic	15 years ago
Anoop Saldanha	b94eaec7c2	implement relative pcre matching in detect-engine-(payload|uri|dcepayload).c. Also fix within/distance handling of RELATIVE_NEXT flag for uricontent	15 years ago
Anoop Saldanha	3a375aa43a	fix relative contents with a negated content for detect-engine-(uri|dcepayload).c like how we did for detect-engine-payload.c	15 years ago
Anoop Saldanha	42830d1c5b	fixes for dce_stub_data and content data sig parsing + more unittests	15 years ago
Anoop Saldanha	673322f01f	unittests for dce_stub_data content based singature parsing + fixes	15 years ago
Anoop Saldanha	ce8d27425d	fix signature parsing to how snort does it for content based keywords along with dce_stub_data	15 years ago
Anoop Saldanha	fa373516c5	fixes the offset case for content matches + a case not handled by the prevous fix for multiple relative content matches. fix for payload.c dcepayload.c and uri.c	15 years ago
Anoop Saldanha	92eb380594	multiple relative content matches changes for detect-engine-dcepayload.c and detect-engine-uri.c like how we did for detect-engine-payload.c	15 years ago
Anoop Saldanha	a059ff276e	byte test and byte jump update dce matching option	15 years ago
Victor Julien	b8fec77f37	Fix tcp connections that are reset (RST packet) not always inspecting the reassembled stream. Update transaction id code to make sure both directions of a transaction are inspected before incrementing the inspect_id.	15 years ago
Victor Julien	2f29b8a724	Improve detection of app layer, making sure we only handle app layer on 'established' packets. Should really fix #166.	15 years ago
Anoop Saldanha	60668fd01d	Reset the flags used during stateful detection in ContinueDetection(). Made the tests more descriptive as well	15 years ago
Anoop Saldanha	bb8937477d	dce tests to check SigMatchSignatures()'s working against new dce transactions	15 years ago
Victor Julien	8cea3779fa	Move dce payload inspection to stateful detection engine.	15 years ago
Anoop Saldanha	015385c6bd	changes to the dce parser stub data processed var. changed to stub data fresh var to indicate if the stub is fresh or not	15 years ago
Anoop Saldanha	45ea0d914e	dce stub content keywords support using dcepayload.c support for all dce related content keywords	15 years ago