Anoop Saldanha
4a038511ff
Change the struct members uricontent and uricontent_len in DetectUricontentData to content and content_len. Make replacements everywhere else in the codebase to accomodate these changes
15 years ago
Anoop Saldanha
e0476242c6
replace all Signature->umatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_UMATCH]
15 years ago
Anoop Saldanha
bc99328ec8
define a new conf paramter detect-engine:inspection-recursion-limit; Defines a recursion limit for content inspection code
15 years ago
Anoop Saldanha
88d94b136d
Support for reference.config file
15 years ago
Victor Julien
fc248ca7a1
Many small performance updates.
15 years ago
Anoop Saldanha
60c770c434
make pcre respect discontinue_matching flag in content matching functions
15 years ago
Victor Julien
1071a53210
Fix unittests after ip_proto keyword change.
15 years ago
Anoop Saldanha
b94eaec7c2
implement relative pcre matching in detect-engine-(payload|uri|dcepayload).c. Also fix within/distance handling of RELATIVE_NEXT flag for uricontent
15 years ago
Anoop Saldanha
3a375aa43a
fix relative contents with a negated content for detect-engine-(uri|dcepayload).c like how we did for detect-engine-payload.c
15 years ago
Pablo Rincon
b7076a8ea0
Don't avoid inspecting uricontents if we get no match. It can be negated uricontents (and urilens/pcre..). But at least skip the search if we get no match
15 years ago
Anoop Saldanha
fa373516c5
fixes the offset case for content matches + a case not handled by the prevous fix for multiple relative content matches. fix for payload.c dcepayload.c and uri.c
15 years ago
Anoop Saldanha
92eb380594
multiple relative content matches changes for detect-engine-dcepayload.c and detect-engine-uri.c like how we did for detect-engine-payload.c
15 years ago
Pablo Rincon
eedafa3a17
Adding unittests for anchored pcres for anchored
15 years ago
Pablo Rincon
bcb0b9ef9b
Moving urilen inspection to detect-engine-uri. Adding unittests for pcre /U and urilen, in combination with uricontent
15 years ago
Anoop Saldanha
36e4b1830e
add pcre with U modifiers to the umatch sigmatch list. fix for bug 155
15 years ago
Victor Julien
83b2c8abdb
Improve stateful uri detection code.
15 years ago
Victor Julien
9dd753b5f3
Scan uricontent mpm on demand.
15 years ago
Victor Julien
e8fce5f7fa
Convert uricontent scanning to use the detect engine state.
15 years ago
Victor Julien
70b32f7380
First stab at creating a stateful detection engine.
...
Stateful detection for app layer detection keywords, except uricontent. Stores it's partial results in the flow structure. Other modifications:
- Generalize transaction tracking, logging and inspection.
- Adapt http and dcerpc to use the new transaction handling.
- Stream engine now always notifies app layer of a stream eof.
This commit fixes bug #124 .
15 years ago
William Metcalf
ce01927515
Import of GPLv2 Header 050410
15 years ago
Victor Julien
09b48d2697
Fix payload and uri detection inline errors in gnu99
15 years ago
Victor Julien
b7c089df42
Fix a couple of harmless compiler warnings.
15 years ago
Pablo Rincon
86185ecd97
Enable spm inspection with precooked pattern contexts on content, uricontent and http_client_body (we will also add this to http_header when it gets commited)
15 years ago
Victor Julien
4129146a71
Because the HTP personalities code changes how the htp state's connp is initialized, we need to check for it in more places.
15 years ago
Victor Julien
15c67bfbd2
Fix locking issue in the uri scanning code.
16 years ago
Victor Julien
08600df6b1
Small uri cleanups.
16 years ago