Victor Julien
81ee6f5aad
lua: push correct length back through ScFlowvarGet, work around valgrind warning
12 years ago
Victor Julien
97bfcac444
profiling: introduce per keyword profiling
...
Initial version of per keyword profiling. Prints stats about
how ofter a keyword was checked and what the costs were.
12 years ago
Victor Julien
210eede033
content inspection: introduce no_match label
12 years ago
Anoop Saldanha
3749fc98fd
Modify handling of negated content.
...
The old behaviour of returning a failure if we found a pattern while
matching on negated content is now changed to continuing searching
for other combinations where we don't find the pattern for the
negated content.
Thanks to Will Metcalf for reporting this.
12 years ago
Anoop Saldanha
21f9cc3a39
discontinue matching on buffer if urilen returns a match failure.
12 years ago
Anoop Saldanha
ab4b15c2e7
fix for #788 .
...
Now depth is kept in mind when we inspect chunks in client/server body.
This takes care of FPs originating from inspecting subsequent chunks that
match with depth, but shouldn't.
12 years ago
Victor Julien
6e18ed0489
luajit flowvar support
...
This patch adds flowvar support to luajit. It does so by exposing two special
C functions to the luajit scripts: ScFlowvarGet and ScFlowvarSet.
12 years ago
Anoop Saldanha
71ffed5128
Handle the case of pcre combined with a relative content, where pcre has the
...
set to match from start of line and we discontinue matching on not finding
match.
13 years ago
Last G
8ae11f73b2
Added parentheses to fix Eclipse static code analysis
...
Fixed bug in action priority (REJECT_DST had lowest prio)
13 years ago
Anoop Saldanha
fd977601b6
fix for bug #574 .
...
More of a temporary solution to prevent any possible FPs. Disable content
inspection bypass for mpm patterns.
13 years ago
Anoop Saldanha
51c9955c79
fix for bug #577 .
...
If a pattern has matched on mpm, don't re-inspect it later, subject to certain
conditions met by the pattern - namely, not negated, right chop, no replacet
attached to it.
13 years ago
Eric Leblond
9c28cd40fd
Fix build if luajit is not available.
13 years ago
Victor Julien
b6834cb6b2
luajit: support http.request_body (http_client_body) and http.response_body (file_data/http_server_body).
13 years ago
Anoop Saldanha
35435f3284
All http_http_stat_code modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_STAT_CODE. Also remove dummy match/free functions for stat code and stat msg
14 years ago
Anoop Saldanha
507e1b66e0
All http_http_stat_msg modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_STAT_MSG
14 years ago
Anoop Saldanha
059ee217ff
All http_http_raw_uri modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_RAW_URI
14 years ago
Anoop Saldanha
b1a0d35106
All http_http_cookie modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_COOKIE
14 years ago
Anoop Saldanha
49bdad9345
All http_http_method modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_METHOD
14 years ago
Anoop Saldanha
97d8fc9cba
All http_http_raw_header modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_RAW_HEADER
14 years ago
Anoop Saldanha
97308674ee
All http_http_header modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_HEADER
14 years ago
Anoop Saldanha
1acb7cdc7d
All http_server_body modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_SERVER_BODY
14 years ago
Anoop Saldanha
a5b46e727c
All http_client_body modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_CLIENT_BODY
14 years ago
Anoop Saldanha
4810ee9c5f
All uricontent modified patterns now are DETECT_CONTENT and not DETECT_URICONTENT. Step towards unifying all content based patterns. Makes way for easier management of patterns
14 years ago
Anoop Saldanha
603d4a719a
remove det_ctx->payload_offset and use det_ctx->buffer_offset. Update hscd and hsmd to use the new generic content inspection engine
14 years ago
Anoop Saldanha
35f1f7e8d9
unify payload detection engines + fix other bugs in pcre init
14 years ago