Anoop Saldanha
0b5d277254
code cleanup for all content based keywords.
13 years ago
Anoop Saldanha
a308d718ae
Allow the use of relative without the presence of a related previous keyword.
13 years ago
Last G
8ae11f73b2
Added parentheses to fix Eclipse static code analysis
...
Fixed bug in action priority (REJECT_DST had lowest prio)
13 years ago
Eric Leblond
6842545331
Add documentation url in list-keyword output.
...
The output of the list-keyword is modified to include the url to
the keyword documentation when this is available. All documented
keywords should have their link set.
list-keyword can be used with an optional value:
no option or short: display list of keywords
csv: display a csv output on info an all keywords
all: display a human readable output of keywords info
$KWD: display the info about one keyword.
13 years ago
Victor Julien
472e061c6d
build: more checking for includes
13 years ago
Victor Julien
d378b76c04
http: body inspection improvement
...
Improve http_client_body and file_data performance when request and
response body limits are set to high values.
13 years ago
Eileen Donlon
617edf469c
reject http_client_body with inconsistent flow dir
...
reject http_client_body with flow: to_client or from_server
14 years ago
Eileen Donlon
1a46d7a53a
fix more invalid content unittests
...
fix invalid unittests with mixed relative and non-relative content modifiers and other issues; DetectContentParse19 still contains some failing dce_stub tests which are commented out.
14 years ago
Eileen Donlon
9b2bd9280a
fix invalid unittests with mixed content modifiers
...
Fixed some unittests that were incorrectly mixing relative and non-relative content modifiers.
14 years ago
Anoop Saldanha
a5b46e727c
All http_client_body modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_CLIENT_BODY
14 years ago
Anoop Saldanha
ab35b98f76
code cleanup - remove DetectContentGetLastPattern. Replace it with SigMatchGetLastSMFromLists
14 years ago
Anoop Saldanha
dcb2afb02f
Use sm_list to differentiate between different content types while retrieving pattern ids instead of sm_type
14 years ago
Anoop Saldanha
420befb180
Changed my email address to anoopsaldanha at gmail dot com from my current one
14 years ago
Victor Julien
89f83e714c
Introduce http_server_body keyword.
...
The http_server_body content modifier modifies the previous content to inspect
the normalized (dechunked, unzipped) http_server_body. The workings are similar
to http_client_body. Additionally, a new pcre flag was introduced "/S".
To facilitate this change the signature flags field was changed to be 64 bit.
14 years ago
Victor Julien
66a3cd96a8
Prepare HTTP response body tracking.
14 years ago
Anoop Saldanha
9a6aef459e
modify all relevant app layer API calls to accomodate passing parser local storage argument
14 years ago
Victor Julien
262a7300d7
flow: shrink Flow datatype
...
Introduce a separate FlowAddress structure for holding the ipv4 or ipv6 address
that doesn't have the family in it like the Address structure. Instead, the
family is stored in the flow as a flag: FLOW_IPV4 and FLOW_IPV6.
Add macro's to check the family, copy the address, etc.
Update many unittests to reflect these changes. Introduce unittest helper
functions for creating and initializing a flow and freeing it again.
On 64 bit this shrinks the flow with 8 bytes.
14 years ago
Victor Julien
06904c9024
App Layer cleanup
...
Removal of per flow 'aldata' array. It contained a ptr for each ALPROTO. Instead now we have 2 ptrs in the flow: alparser and alstate.
Various cleanups and dead code removal from the app layer API.
Should safe 100+ bytes memory per flow on 64 bit.
Updated lots of unittests to reflect these changes.
14 years ago
Eric Leblond
60a99915c1
doc: create http support group
...
This patch create an httplayer group and adds related files to
it. It also fixes some typo in documentation string and format.
14 years ago
Anoop Saldanha
ed3b44b3b5
fix parsing content keywords. We are more strict now. All content keywords need to be enclosed in double quotes. Better validation for sid, priority and rev keywords
14 years ago
Victor Julien
1d971b53a6
Update all unittests
15 years ago
Victor Julien
18b4e3380f
Make mpm-algo use the mpm_table that has the actual mpm's registered. Clean up dead code.
15 years ago
Anoop Saldanha
2b781f00d7
support relative pcre for client body. All pcre processing for client body moved to hcbd engine
15 years ago
Anoop Saldanha
07f20674ac
allow sigs for http client body of the form content:one; content:two; distance:0; http_client_body;
15 years ago
Anoop Saldanha
c61c68fd36
mpm and fast pattern support for http_header. Also support relative modifiers for http_header
15 years ago
Anoop Saldanha
0aa5cffb12
fast pattern support for http_client_body keyword added. Also mpm support for http_client_body added
15 years ago
Anoop Saldanha
68b78664fa
Add unittests for checking content flags. Fix indentation in PopulateMpmAddPatternToMpm(). Also fix DETECT_CONTENT_IS_SINGLE
15 years ago
Anoop Saldanha
5c6a65dc58
support relative modifiers for http_client_body. Introduce body processing engine in detect-engine-hcbd.[ch]
15 years ago
Anoop Saldanha
f05b0f4e1e
unifying content structure - http_client_body now uses DetectContentData
15 years ago
Anoop Saldanha
a7353be20d
replace all Signature->amatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_AMATCH]
15 years ago
Anoop Saldanha
e54358a9e1
replace all Signature->pmatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_PMATCH]
15 years ago
Anoop Saldanha
82fd581b64
replace all sm lists (match, pmatch, dmatch, umatch, amatch, tmatch) with an array Signature->sm_lists[]. Replace all Signature->match instances in the engine with Signature->sm_lists[DETECT_SM_LIST_MATCH]
15 years ago
Anoop Saldanha
0c5b82d891
provide separate ids for content, uricontent, http_(client_body_data|cookie|header|method|uri), when they share the same pattern
15 years ago
Victor Julien
fc248ca7a1
Many small performance updates.
15 years ago
Pablo Rincon
06a65cb460
moving http_client_body logic to use it per transactions. Adding unittests
15 years ago
Victor Julien
1071a53210
Fix unittests after ip_proto keyword change.
15 years ago
Pablo Rincon
169cb22dc6
Updating other http modifiers for sigs with fast_pattern option
15 years ago
William Metcalf
0e4235cc94
FLOW_DESTROY added to clean-up UT's that init flow
15 years ago
Victor Julien
2f29b8a724
Improve detection of app layer, making sure we only handle app layer on 'established' packets. Should really fix #166 .
15 years ago
Pablo Rincon
8cc525c939
UDP support at AppLayer message handling
15 years ago
William Metcalf
cc76aa4bc6
properly init flows inside of unit-tests caused lock-up when falling back to using mutex locks
15 years ago
Gurvinder Singh
cda664a8c4
memroy leaks fixes in detection module, app layer and counters
15 years ago
Victor Julien
70b32f7380
First stab at creating a stateful detection engine.
...
Stateful detection for app layer detection keywords, except uricontent. Stores it's partial results in the flow structure. Other modifications:
- Generalize transaction tracking, logging and inspection.
- Adapt http and dcerpc to use the new transaction handling.
- Stream engine now always notifies app layer of a stream eof.
This commit fixes bug #124 .
15 years ago
Gerardo Iglesias Galvan
9f4fae5b1a
Fix inconsistent use of dynamic memory allocation
15 years ago
William Metcalf
ce01927515
Import of GPLv2 Header 050410
15 years ago
Gurvinder Singh
69a4fee757
fixed the API and logic error reported by clang tool
15 years ago
Victor Julien
78e15ea7fa
Explicitly test for ipv6 in the htp personalities code. Update all affected unittests to set addr family to the flow.
15 years ago
Pablo Rincon
86185ecd97
Enable spm inspection with precooked pattern contexts on content, uricontent and http_client_body (we will also add this to http_header when it gets commited)
15 years ago
Anoop Saldanha
2c9366b83c
Enable flag in http_client_body for http request body callback
16 years ago
Victor Julien
ced401b554
Update http_client_body code to recent changes.
16 years ago