78 Commits (39f5c7f56ab7c70616304ad55be4a118edee2530)

Author	SHA1	Message	Date
Philippe Antoine	1f066cbbe8	unittest: fix unneeded includes as per cppclean ... Especially because there is conditional inclusion from a header	3 years ago
Philippe Antoine	02f2602dde	src: rework includes as per cppclean	3 years ago
Philippe Antoine	ced96a8aad	detect: parsing avoiding infinite loop ... by comparing size_t to strlen result Instead of uint16_t which would loop Ticket: #5310	3 years ago
Philippe Antoine	3de99a214c	pcre2: migrate keywords parsing	4 years ago
Victor Julien	4c7eb64411	decode: convert 'action' macros to inline funcs ... Make sure most common branch is handled first to assist branch prediction. Macros still play a small role to please our 'action' cocci check.	4 years ago
Mats Klepsland	2a326421aa	thresholds: Fix buffer overflow in threshold context ... th_entry is resized using ThresholdHashRealloc() every time a rule with a threshold using by_rule tracking is added. The problem is that this is done before the rules are reordered, so occasionally a rule with by_rule tracking gets a higher signature number (after reordering) than the number of th_entries allocated, causing Suricata to crash. This commit fixes this by allocating th_entries after all the rules are loaded and reordered. Backtrace from core dump: Program terminated with signal SIGSEGV, Segmentation fault. #0 0x000000000051b381 in ThresholdHandlePacket (p=p@entry=0x7fb0080f3960, lookup_tsh=0x51, new_tsh=new_tsh@entry=0x7fb016c316e0, td=td@entry=0x14adedf0, sid=9800979, gid=1, pa=0x7fb0080f3b18) at detect-engine-threshold.c:415 415>---- if (TIMEVAL_DIFF_SEC(p->ts, lookup_tsh->tv1) < td->seconds) { Bug #4503.	4 years ago
Jeff Lucovsky	e873632a28	detect/threshold: Function to deep-copy thresh obj ... This commit adds a function to make a deep copy of a DetectThresholdData object. The function is used when parsing threshold.config items to make a one-time object and then add copies as needed.	4 years ago
Victor Julien	6ab323d323	detect: hide RegisterTests behind ifdef UNITTESTS ... Update all callers to more aggressively use UNITTESTS guards as well.	5 years ago
Victor Julien	26bcc97515	detect/keywords: dynamic version part of doc URL	5 years ago
Jeff Lucovsky	d3a65fe156	detect: Provide `de_ctx` to free functions ... This commit makes sure that the `DetectEngineCtx *` is available to each detector's "free" function.	5 years ago
Todd Mortimer	944209592f	detect/threshold: Add tests for thresholding by_rule and by_both.	5 years ago
Todd Mortimer	50e5b80463	detect/threshold: Add a common function to (re)allocate the by_rule threshold table. ... Ensure that the by_rule threshold table is initialized if a rule is thresholded by_rule. Replace manual table reallocaton with calls to the common function.	5 years ago
Todd Mortimer	e945dea244	detect/threshold: Parse by_rule and by_both in rules. ... Also add tests for parsing them.	5 years ago
Shivani Bhardwaj	0e4f261224	Use StringParse* for all parsers and configurations	6 years ago
Jeff Lucovsky	4b0085b03c	detect: Update to take advantage of PCRE refactor ... This commit changes the keyword detectors to use the refactored PCRE modifications from detect-parse.[ch]	6 years ago
Jeff Lucovsky	c20ab53eae	detect/threshold: Correct typos	6 years ago
Jeff Lucovsky	ff9a01ee1b	detect/threshold: Don't allow duplicates ... This commit detects duplicate threshold rule options. When duplicates are found in a rule, an error message is displayed and the rule is rejected.	6 years ago
Shivani Bhardwaj	d801c3e588	detect: Make keyword description consistent ... Closes redmine ticket #3137.	6 years ago
Shivani Bhardwaj	b5b429c288	detect: Add missing keyword URLs and description ... Add missing keyword URLs and their description. Fix the ones that were incorrect. Partially closes redmine ticket #2974.	6 years ago
Victor Julien	14896365ef	detect: remove Threadvars argument from API calls ... Remove it as it's (almost) never used. If it is really needed it can be accessed through DetectEngineThreadCtx::tv as well.	6 years ago
Victor Julien	ab1200fbd7	compiler: more strict compiler warnings ... Set flags by default: -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wwrite-strings -Wcast-align -Wbad-function-cast -Wformat-security -Wno-format-nonliteral -Wmissing-format-attribute -funsigned-char Fix minor compiler warnings for these new flags on gcc and clang.	8 years ago
Victor Julien	779d40cedf	detect: remove hardcoded sm_list logic from setup ... Introduce utility functions to aid this.	9 years ago
Victor Julien	8edc954e82	detect: get rid of Signature::sm_lists ... Instead use the lists in init_data during setup and the SigMatchData arrays during runtime.	9 years ago
Victor Julien	bfd4bc8233	detect: constify Signature/SigMatch use at runtime	9 years ago
Eric Leblond	a2e2f50fb9	documentation: fix list keywords URLs ... Update URLs in keyword definition to point to sphinx documentation.	9 years ago
maxtors	9d3fd82849	Removed duplicate include statements.	9 years ago
Victor Julien	e67ae0f174	detect keywords: use parse regex util func	10 years ago
Jason Ish	796dd5223b	tests: no longer necessary to provide successful return code ... 1 pass, 0 is fail.	10 years ago
Jason Ish	52983bf314	tests: convert all test to return 0 on failure, 1 on success	10 years ago
Victor Julien	e85a44c383	suppress: support ip-lists ... Ticket: 1137 Support supplying a list of IP's to the suppress keyword. Variables from the address-groups and negation is supported. The same logic (and code) is used that is also used in parting the IP portions of regular detection rules.	10 years ago
Victor Julien	bc2b53f10b	parsing: s/strtok/strtok_r/g ... Remove all strtok uses and replace them by strtok_r. Do the same for Windows builds. Cygwin builds fine with strtok_r. Add strtok to banned function list.	10 years ago
Ken Steele	923a77e952	Change Match() function to take const SigMatchCtx* ... The Match functions don't need a pointer to the SigMatch object, just the context pointer contained inside, so pass the Context to the Match function rather than the SigMatch object. This allows for further optimization. Change SigMatch->ctx to have type SigMatchCtx* rather than void* for better type checking. This requires adding type casts when using or assigning it. The SigMatch contex should not be changed by the Match() funciton, so pass it as a const SigMatchCtx*.	11 years ago
Ken Steele	8f1d75039a	Enforce function coding standard ... Functions should be defined as: int foo(void) { } Rather than: int food(void) { } All functions where changed by a script to match this standard.	11 years ago
Ken Steele	a63b87df9e	Clean up function syntax ... Remove space before ( in function names. Put { on new line. Make tests static.	12 years ago
Victor Julien	3cf3b485f2	Coverity 1038138 fix ... Clean up parsing code to suppress Coverity: Dereference before null check (REVERSE_INULL) Proper checking was already done.	12 years ago
Victor Julien	27023872de	Use Host Storage API for per host thresholding	12 years ago
Eric Leblond	3f107fa130	decode: Packet action start with PACKET ... Rename all Packet action macro to have them prefixed by PACKET.	12 years ago
Eric Leblond	a35c367942	action handling: use macro for test. ... Use test macro instead of direct access to action field. This patch has been obtained by using the following spatch file: @@ Packet *p; expression E; @@ - p->action & E + TEST_PACKET_ACTION(p, E)	12 years ago
Eric Leblond	6842545331	Add documentation url in list-keyword output. ... The output of the list-keyword is modified to include the url to the keyword documentation when this is available. All documented keywords should have their link set. list-keyword can be used with an optional value: no option or short: display list of keywords csv: display a csv output on info an all keywords all: display a human readable output of keywords info $KWD: display the info about one keyword.	13 years ago
Victor Julien	80d62b59ec	Fix drop (and other actions) not being applied to thresholded packets. Bug #613.	13 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	13 years ago
Victor Julien	c0a2cbd478	Move over src and dst thresholding to use host table. Fix a bug in threshold 'both' handling.	14 years ago
Victor Julien	cdba2f50d1	Various fixes and improvements based on feedback by Coverity analyzer.	14 years ago
Anoop Saldanha	eb07c345b8	code cleanup - replace SigMatchAppendThreshold with SigMatchAppendSMToList	14 years ago
Anoop Saldanha	bbb9f35f26	code cleanup - replace SigMatchGetLastSM with SigMatchGetLastSMFromLists	14 years ago
Victor Julien	c8c4a76dc6	Move threshold to it's own sig match list.	14 years ago
Anoop Saldanha	7433d92dd2	undo this commit - ... commit eff08f93d8 Author: Anoop Saldanha <poonaatsoc@gmail.com> Date: Thu Nov 3 14:31:24 2011 +0530 update failing unittest to reflect the mpm design update Fixed a bug in the mpm code that would make all the changes in the commit just undone wrong.	14 years ago
Anoop Saldanha	eff08f93d8	update failing unittest to reflect the mpm design update	14 years ago
Victor Julien	e13181496c	ip-only: added support for matching on ports.	14 years ago
Eric Leblond	8787e6f6d0	suppress: use DetectAddress instead of DetectAddressHead	14 years ago