139 Commits (4cd736fcc9d0e0218ec32037100212a8db158f1b)

Author	SHA1	Message	Date
Victor Julien	4cd736fcc9	flowvar: fix deadlock with http buffers ... Bug #802 Flowvars are set from pcre, and lock the flow when being set. However when HTTP buffers were inspected, flow was already locked: deadlock. This patch introduces a post-match list in the detection engine thread ctx, where store candidates are kept. Then a post-match function is used to finalize the storing if the rule matches. Solves the deadlock and brings the handling of flowvars more in line with flowbits and flowints.	12 years ago
Anoop Saldanha	0d7305dfc7	Update the way we handle http_host keywords. ... Previously we would have forced all users to use nocase with http_host keywords(since the hostname buffer is lowercase). We now error out on sigs that has nocase set with http_host set. Also if the http_host pattern or http_host pcre has an uppercase character set, we invalidate such sigs. Unittests also updated to reflect the above change.	12 years ago
Anoop Saldanha	0b5d277254	code cleanup for all content based keywords.	13 years ago
Anoop Saldanha	51dcf19817	turn dce_stub_data into a sticky buffer.	13 years ago
Anoop Saldanha	a308d718ae	Allow the use of relative without the presence of a related previous keyword.	13 years ago
Anoop Saldanha	3511f91bba	Add support for the new keyword - http_raw_host header. ... The corresponding pcre modifier would be 'Z'.	13 years ago
Anoop Saldanha	c4ce19a1be	Add support for a new keyword to inspect http_host header. ... The corresponding content keyword would now be - http_host. The corresponding pcre modifier would be W.	13 years ago
Last G	8ae11f73b2	Added parentheses to fix Eclipse static code analysis ... Fixed bug in action priority (REJECT_DST had lowest prio)	13 years ago
Eric Leblond	6842545331	Add documentation url in list-keyword output. ... The output of the list-keyword is modified to include the url to the keyword documentation when this is available. All documented keywords should have their link set. list-keyword can be used with an optional value: no option or short: display list of keywords csv: display a csv output on info an all keywords all: display a human readable output of keywords info $KWD: display the info about one keyword.	13 years ago
Victor Julien	84bad6db77	Silence compiler warnings found by clang	13 years ago
Victor Julien	472e061c6d	build: more checking for includes	13 years ago
Victor Julien	d386606b80	Remove pcre jit warning. Bug #579.	13 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	13 years ago
Anoop Saldanha	f9a6c890d4	fix for #529 ... Respect pcre's anchor during content inspection.	13 years ago
Anoop Saldanha	b0b4052860	detect-pcre.c cleanup. Delete old pcre functions that we no longer use.	13 years ago
Anoop Saldanha	f2dd61868d	variable names global vars, global no more. Moved to detection engine ctx, a place it belongs	13 years ago
Anoop Saldanha	988c92f71c	http user agent keyword + mpm + inspection + fast pattern support added	13 years ago
Victor Julien	cae46ab5eb	pcre: print filename and line number for JIT warning.	13 years ago
Eileen Donlon	b22529d6f4	disallow pcre /P/I/U with flow:to_client/from_svr	13 years ago
Victor Julien	d378b76c04	http: body inspection improvement ... Improve http_client_body and file_data performance when request and response body limits are set to high values.	13 years ago
Eileen Donlon	4327aaf68a	reject pcre modifiers U with B	13 years ago
Victor Julien	19a7e7f395	flow: create a flow lock macro API, implement it for mutex and rwlocks. Mutex remains the default.	14 years ago
Eileen Donlon	0b09416a48	reject invalid combinations of pcre modifiers ... don't allow /B with normalized buffers, and don't mix modifiers for normalized and raw buffers	14 years ago
Anoop Saldanha	35435f3284	All http_http_stat_code modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_STAT_CODE. Also remove dummy match/free functions for stat code and stat msg	14 years ago
Anoop Saldanha	507e1b66e0	All http_http_stat_msg modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_STAT_MSG	14 years ago
Anoop Saldanha	059ee217ff	All http_http_raw_uri modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_RAW_URI	14 years ago
Anoop Saldanha	b1a0d35106	All http_http_cookie modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_COOKIE	14 years ago
Anoop Saldanha	49bdad9345	All http_http_method modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_METHOD	14 years ago
Anoop Saldanha	97d8fc9cba	All http_http_raw_header modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_RAW_HEADER	14 years ago
Anoop Saldanha	97308674ee	All http_http_header modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_HEADER	14 years ago
Anoop Saldanha	1acb7cdc7d	All http_server_body modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_SERVER_BODY	14 years ago
Anoop Saldanha	a5b46e727c	All http_client_body modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_CLIENT_BODY	14 years ago
Anoop Saldanha	4810ee9c5f	All uricontent modified patterns now are DETECT_CONTENT and not DETECT_URICONTENT. Step towards unifying all content based patterns. Makes way for easier management of patterns	14 years ago
Anoop Saldanha	ac68c3f893	code cleanup - replace SigMatchAppendDcePayload with SigMatchAppendSMToList	14 years ago
Anoop Saldanha	6cab663bf0	code cleanup - replace SigMatchAppendPayload with SigMatchAppendSMToList	14 years ago
Anoop Saldanha	c4cb37b8da	code cleanup - replace SigMatchAppendUricontent with SigMatchAppendSMToList	14 years ago
Anoop Saldanha	e682796d03	feature #414 - support listing supported keywords. Remove support for dummy keywords __address__, __proto__, __port__. Remove support for recursive keyword and all references to it	14 years ago
Anoop Saldanha	603d4a719a	remove det_ctx->payload_offset and use det_ctx->buffer_offset. Update hscd and hsmd to use the new generic content inspection engine	14 years ago
Anoop Saldanha	35f1f7e8d9	unify payload detection engines + fix other bugs in pcre init	14 years ago
Anoop Saldanha	09313cf9bd	Support http stat code detection engine, fast pattern(mpm engine included). Fix http stat code setup function. Fix pcre option for stat msg keyword. With this the pcre options for server_body is Q, for stat_msg is Y and for stat_code is S	14 years ago
Anoop Saldanha	2007c2711c	Support http stat msg detection engine, fast pattern(mpm engine included). Fix http stat msg setup function. Fix pcre option for stat msg keyword	14 years ago
Victor Julien	6aa0ad1c5f	Remove unused definitions in pcre code.	14 years ago
Victor Julien	bb6f93e675	Fix unittest missing a flow direction in the rule.	14 years ago
Eileen Donlon	39b8cc2f8b	fixed relative handling for pcre cookie and method	14 years ago
Victor Julien	2d9449d060	Make code default for pcre match limit match the suricata.yaml default.	14 years ago
Victor Julien	28e15be526	Clean up default output. Use simpler output format for releases.	14 years ago
Victor Julien	077970051e	file-data: implement relative pcre support.	14 years ago
Victor Julien	89f83e714c	Introduce http_server_body keyword. ... The http_server_body content modifier modifies the previous content to inspect the normalized (dechunked, unzipped) http_server_body. The workings are similar to http_client_body. Additionally, a new pcre flag was introduced "/S". To facilitate this change the signature flags field was changed to be 64 bit.	14 years ago
Victor Julien	3009429e3c	HTTP transaction handling improvement ... In some cases AppLayerTransactionGetInspectId can return -1, which is now handled by all it's callers. Improve logic of selecting which transactions are inspected by the various HTTP keywords.	14 years ago
Victor Julien	66a3cd96a8	Prepare HTTP response body tracking.	14 years ago