Giuseppe Longo
41a1a9f4af
find and replace HSBDMATCH by FILEDATA
...
This commit do a find and replace of the following:
- DETECT_SM_LIST_HSBDMATCH by DETECT_SM_LIST_FILEDATA
sed -i 's/DETECT_SM_LIST_HSBDMATCH/DETECT_SM_LIST_FILEDATA/g' src/*
- HSBD by FILEDATA:
sed -i 's/HSBDMATCH/FILEDATA/g' src/*
10 years ago
Jason Ish
a18e2ef402
Bug 1230: Check all SigMatch lists for a named byte_extract variable.
11 years ago
Jason Ish
dc9d1ec867
Bug 1230: Simple test case demonstrating failure.
11 years ago
Ken Steele
8f1d75039a
Enforce function coding standard
...
Functions should be defined as:
int foo(void)
{
}
Rather than:
int food(void) {
}
All functions where changed by a script to match this standard.
11 years ago
Victor Julien
7292998a58
Content: set up sticky buffers like file_data and dce_stub_data w/o flags, but with a list variable
12 years ago
Anoop Saldanha
0b5d277254
code cleanup for all content based keywords.
13 years ago
Anoop Saldanha
51dcf19817
turn dce_stub_data into a sticky buffer.
13 years ago
Anoop Saldanha
3511f91bba
Add support for the new keyword - http_raw_host header.
...
The corresponding pcre modifier would be 'Z'.
13 years ago
Anoop Saldanha
c4ce19a1be
Add support for a new keyword to inspect http_host header.
...
The corresponding content keyword would now be - http_host.
The corresponding pcre modifier would be W.
13 years ago
Last G
8ae11f73b2
Added parentheses to fix Eclipse static code analysis
...
Fixed bug in action priority (REJECT_DST had lowest prio)
13 years ago
Eric Leblond
6842545331
Add documentation url in list-keyword output.
...
The output of the list-keyword is modified to include the url to
the keyword documentation when this is available. All documented
keywords should have their link set.
list-keyword can be used with an optional value:
no option or short: display list of keywords
csv: display a csv output on info an all keywords
all: display a human readable output of keywords info
$KWD: display the info about one keyword.
13 years ago
Victor Julien
84bad6db77
Silence compiler warnings found by clang
13 years ago
Eric Leblond
e176be6fcc
Use unlikely for error treatment.
...
When handling error case on SCMallog, SCCalloc or SCStrdup
we are in an unlikely case. This patch adds the unlikely()
expression to indicate this to gcc.
This patch has been obtained via coccinelle. The transformation
is the following:
@istested@
identifier x;
statement S1;
identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)";
@@
x = func(...)
... when != x
- if (x == NULL) S1
+ if (unlikely(x == NULL)) S1
13 years ago
pi-rho
0df4c5838d
spelling corrections documented in redmine bug#533
13 years ago
Anoop Saldanha
988c92f71c
http user agent keyword + mpm + inspection + fast pattern support added
13 years ago
Victor Julien
da3c5bf84d
Minor error message cleanups
14 years ago
Eileen Donlon
0bcbd23343
reject mixed relative and non-relative keywords
...
reject signatures using relative and non-relative positional keywords for the same content (depth or offset with distance or within)
14 years ago
Anoop Saldanha
35435f3284
All http_http_stat_code modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_STAT_CODE. Also remove dummy match/free functions for stat code and stat msg
14 years ago
Anoop Saldanha
507e1b66e0
All http_http_stat_msg modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_STAT_MSG
14 years ago
Anoop Saldanha
059ee217ff
All http_http_raw_uri modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_RAW_URI
14 years ago
Anoop Saldanha
b1a0d35106
All http_http_cookie modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_COOKIE
14 years ago
Anoop Saldanha
49bdad9345
All http_http_method modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_METHOD
14 years ago
Anoop Saldanha
97d8fc9cba
All http_http_raw_header modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_RAW_HEADER
14 years ago
Anoop Saldanha
97308674ee
All http_http_header modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_HEADER
14 years ago
Anoop Saldanha
1acb7cdc7d
All http_server_body modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_SERVER_BODY
14 years ago
Anoop Saldanha
a5b46e727c
All http_client_body modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_CLIENT_BODY
14 years ago
Anoop Saldanha
4810ee9c5f
All uricontent modified patterns now are DETECT_CONTENT and not DETECT_URICONTENT. Step towards unifying all content based patterns. Makes way for easier management of patterns
14 years ago
Anoop Saldanha
35f1f7e8d9
unify payload detection engines + fix other bugs in pcre init
14 years ago
Anoop Saldanha
09313cf9bd
Support http stat code detection engine, fast pattern(mpm engine included). Fix http stat code setup function. Fix pcre option for stat msg keyword. With this the pcre options for server_body is Q, for stat_msg is Y and for stat_code is S
14 years ago
Anoop Saldanha
2007c2711c
Support http stat msg detection engine, fast pattern(mpm engine included). Fix http stat msg setup function. Fix pcre option for stat msg keyword
14 years ago
Anoop Saldanha
6556b4c62b
bug #411 - don't modify within/distance at setup time
14 years ago
Eileen Donlon
39b8cc2f8b
fixed relative handling for pcre cookie and method
14 years ago
Victor Julien
07e560b137
file-data: initial file_data support
...
Support file_data for: content, pcre (relative), byte_test, byte_jump,
byte_extract, isdataat.
File_data support is handled at signature parsing time, all matches
occurring after the file_data in the rule are converted to http_server_body
matches.
Content matches relative to the file_data are converted. Within to depth,
distance to offset. Relative to the start of the body buffer.
14 years ago
Anoop Saldanha
420befb180
Changed my email address to anoopsaldanha at gmail dot com from my current one
14 years ago
Victor Julien
89f83e714c
Introduce http_server_body keyword.
...
The http_server_body content modifier modifies the previous content to inspect
the normalized (dechunked, unzipped) http_server_body. The workings are similar
to http_client_body. Additionally, a new pcre flag was introduced "/S".
To facilitate this change the signature flags field was changed to be 64 bit.
14 years ago
Victor Julien
2d16abcf8b
Minor code cleanups fixing all GCC 4.6 compiler warnings for default, debug and unittests mode.
14 years ago
Anoop Saldanha
7433d92dd2
undo this commit -
...
commit eff08f93d8
Author: Anoop Saldanha <poonaatsoc@gmail.com>
Date: Thu Nov 3 14:31:24 2011 +0530
update failing unittest to reflect the mpm design update
Fixed a bug in the mpm code that would make all the changes in the commit just undone wrong.
14 years ago
Anoop Saldanha
eff08f93d8
update failing unittest to reflect the mpm design update
14 years ago
Anoop Saldanha
ed3b44b3b5
fix parsing content keywords. We are more strict now. All content keywords need to be enclosed in double quotes. Better validation for sid, priority and rev keywords
14 years ago
Anoop Saldanha
35f3eafa5e
byte extract added to the engine. Detection support added for packet payload, uri and dce detection engines
14 years ago
Anoop Saldanha
966119b6aa
support for http_raw_uri keyword + mpm engine
14 years ago
Anoop Saldanha
c9897a44a4
fast pattern support for http_cookie. Also support relative modifiers
15 years ago
Anoop Saldanha
bbbedaf963
fast pattern support for http_method. Also support relative modifiers
15 years ago
Victor Julien
014f62247a
Another batch of clang fixes. Nothing really serious. Includes a couple of fixes for broken fixes from yesterday.
15 years ago
Anoop Saldanha
ceb7fd748e
support /D option for pcre - http raw header. Also support relative pcre for http raw header. All pcre processing for http header moved to hrhd engine
15 years ago
Anoop Saldanha
8bd6a38318
support relative pcre for http header. All pcre processing for http header moved to hhd engine
15 years ago
Anoop Saldanha
2b781f00d7
support relative pcre for client body. All pcre processing for client body moved to hcbd engine
15 years ago
Anoop Saldanha
07f20674ac
allow sigs for http client body of the form content:one; content:two; distance:0; http_client_body;
15 years ago
Anoop Saldanha
7ec0382774
support fast pattern for http raw header. Also support relative modifiers for http raw header
15 years ago
Anoop Saldanha
c61c68fd36
mpm and fast pattern support for http_header. Also support relative modifiers for http_header
15 years ago