46 Commits (262a7300d701c44dba13bb2aaa2b14bed3485383)

Author	SHA1	Message	Date
Victor Julien	262a7300d7	flow: shrink Flow datatype ... Introduce a separate FlowAddress structure for holding the ipv4 or ipv6 address that doesn't have the family in it like the Address structure. Instead, the family is stored in the flow as a flag: FLOW_IPV4 and FLOW_IPV6. Add macro's to check the family, copy the address, etc. Update many unittests to reflect these changes. Introduce unittest helper functions for creating and initializing a flow and freeing it again. On 64 bit this shrinks the flow with 8 bytes.	14 years ago
Victor Julien	06904c9024	App Layer cleanup ... Removal of per flow 'aldata' array. It contained a ptr for each ALPROTO. Instead now we have 2 ptrs in the flow: alparser and alstate. Various cleanups and dead code removal from the app layer API. Should safe 100+ bytes memory per flow on 64 bit. Updated lots of unittests to reflect these changes.	14 years ago
Victor Julien	2d16abcf8b	Minor code cleanups fixing all GCC 4.6 compiler warnings for default, debug and unittests mode.	14 years ago
Anoop Saldanha	ed3b44b3b5	fix parsing content keywords. We are more strict now. All content keywords need to be enclosed in double quotes. Better validation for sid, priority and rev keywords	14 years ago
Anoop Saldanha	35f3eafa5e	byte extract added to the engine. Detection support added for packet payload, uri and dce detection engines	14 years ago
Victor Julien	e16a566a96	Account for distance when checking within. Bug #285.	14 years ago
Anoop Saldanha	d245f15f14	disable mpm pattern's retest skipping in detection engine for uri, hcbd, hmd, hrhd, hhd, hmd, hcd	14 years ago
Victor Julien	987ce57a02	Wrap a number of BUG_ON's in the detection engine in DEBUG ifdefs as the conditions they check for are not serious enough to abort the engine.	15 years ago
Victor Julien	cc116d71ef	Fix unittests after merge.	15 years ago
Victor Julien	a622ad5047	Fix new unittests introduced by rebase with next branch.	15 years ago
Victor Julien	1d971b53a6	Update all unittests	15 years ago
Anoop Saldanha	2321a4dd58	support isdataat negation. Also fix addiing isdataat to appropriate lists	15 years ago
Victor Julien	0cd2bce7da	Manually add unittest by Pablo Rincon from bug #210.	15 years ago
Anoop Saldanha	e50503e820	cleanup/remove dead code	15 years ago
Anoop Saldanha	72b0fcf419	modify detection engine to carry out uri mpm run before build match array if alproto is http and if sgh has atleast one sig with uri mpm set	15 years ago
Victor Julien	6a5d2cb40d	Fix potential locking issue in out of memory conditions in the http_header, http_raw_header code. Fix other potential small issues in http_ code.	15 years ago
Anoop Saldanha	1cd8bd3d3c	make changes for uri mpm, when uricontent is negated and also is the fp and we ignore checking it once again in engine-uri.c	15 years ago
Anoop Saldanha	eade60f0fd	make some name changes. break PopulateMpm(). Set the avoid mpm double check flags	15 years ago
Anoop Saldanha	4883efd0f6	unifying content structure - uricontent now uses DetectContentData	15 years ago
Anoop Saldanha	6eaba8941c	Use new flags to indicate uricontent has a mpm set	15 years ago
Anoop Saldanha	4a038511ff	Change the struct members uricontent and uricontent_len in DetectUricontentData to content and content_len. Make replacements everywhere else in the codebase to accomodate these changes	15 years ago
Anoop Saldanha	e0476242c6	replace all Signature->umatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_UMATCH]	15 years ago
Anoop Saldanha	bc99328ec8	define a new conf paramter detect-engine:inspection-recursion-limit; Defines a recursion limit for content inspection code	15 years ago
Anoop Saldanha	88d94b136d	Support for reference.config file	15 years ago
Victor Julien	fc248ca7a1	Many small performance updates.	15 years ago
Anoop Saldanha	60c770c434	make pcre respect discontinue_matching flag in content matching functions	15 years ago
Victor Julien	1071a53210	Fix unittests after ip_proto keyword change.	15 years ago
Anoop Saldanha	b94eaec7c2	implement relative pcre matching in detect-engine-(payload|uri|dcepayload).c. Also fix within/distance handling of RELATIVE_NEXT flag for uricontent	15 years ago
Anoop Saldanha	3a375aa43a	fix relative contents with a negated content for detect-engine-(uri|dcepayload).c like how we did for detect-engine-payload.c	15 years ago
Pablo Rincon	b7076a8ea0	Don't avoid inspecting uricontents if we get no match. It can be negated uricontents (and urilens/pcre..). But at least skip the search if we get no match	15 years ago
Anoop Saldanha	fa373516c5	fixes the offset case for content matches + a case not handled by the prevous fix for multiple relative content matches. fix for payload.c dcepayload.c and uri.c	15 years ago
Anoop Saldanha	92eb380594	multiple relative content matches changes for detect-engine-dcepayload.c and detect-engine-uri.c like how we did for detect-engine-payload.c	15 years ago
Pablo Rincon	eedafa3a17	Adding unittests for anchored pcres for anchored	15 years ago
Pablo Rincon	bcb0b9ef9b	Moving urilen inspection to detect-engine-uri. Adding unittests for pcre /U and urilen, in combination with uricontent	15 years ago
Anoop Saldanha	36e4b1830e	add pcre with U modifiers to the umatch sigmatch list. fix for bug 155	15 years ago
Victor Julien	83b2c8abdb	Improve stateful uri detection code.	15 years ago
Victor Julien	9dd753b5f3	Scan uricontent mpm on demand.	15 years ago
Victor Julien	e8fce5f7fa	Convert uricontent scanning to use the detect engine state.	15 years ago
Victor Julien	70b32f7380	First stab at creating a stateful detection engine. ... Stateful detection for app layer detection keywords, except uricontent. Stores it's partial results in the flow structure. Other modifications: - Generalize transaction tracking, logging and inspection. - Adapt http and dcerpc to use the new transaction handling. - Stream engine now always notifies app layer of a stream eof. This commit fixes bug #124.	15 years ago
William Metcalf	ce01927515	Import of GPLv2 Header 050410	15 years ago
Victor Julien	09b48d2697	Fix payload and uri detection inline errors in gnu99	15 years ago
Victor Julien	b7c089df42	Fix a couple of harmless compiler warnings.	15 years ago
Pablo Rincon	86185ecd97	Enable spm inspection with precooked pattern contexts on content, uricontent and http_client_body (we will also add this to http_header when it gets commited)	15 years ago
Victor Julien	4129146a71	Because the HTP personalities code changes how the htp state's connp is initialized, we need to check for it in more places.	15 years ago
Victor Julien	15c67bfbd2	Fix locking issue in the uri scanning code.	15 years ago
Victor Julien	08600df6b1	Small uri cleanups.	15 years ago