78 Commits (5d62995e2684ce398a657269e21fdb49d043a52d)

Author	SHA1	Message	Date
Philippe Antoine	1f066cbbe8	unittest: fix unneeded includes as per cppclean ... Especially because there is conditional inclusion from a header	4 years ago
Jeff Lucovsky	7eb5fb1826	detect/content: Consider distance in validation ... Ticket: 2982 This commit validates that the content usage in a rule will not exceed the dsize value. Values of distance that cause the right edge to be exceeded are considered an error and the signature will be rejected.	4 years ago
Victor Julien	39cf5b151a	src: includes cleanup ... Work towards making `suricata-common.h` only introduce system headers and other things that are independent of complex internal Suricata data structures. Update files to compile after this. Remove special DPDK handling for strlcpy and strlcat, as this caused many compilation failures w/o including DPDK headers for all files. Remove packet macros from decode.h and move them into their own file, turn them into functions and rename them to match our function naming policy.	4 years ago
Philippe Antoine	02f2602dde	src: rework includes as per cppclean	4 years ago
Philippe Antoine	2b0be91f28	detect: use generic integer functions for dsize ... Ticket: #4112	4 years ago
Juliana Fajardini	a6bda3596b	unittests: alloc Packet with PacketGetFromAlloc ... Some unittests used SCMalloc for allocating new Packet the unittests. While this is valid, it leads to segmentation faults when we move to dynamic allocation of the maximum alerts allowed to be triggered by a single packet. This massive patch uses PacketGetFromAlloc, which initializes a Packet in such a way that any dynamic allocated structures within will also be initialized. Related to Task #4207	4 years ago
Juliana Fajardini	f328ba527a	detect/dsize: convert unittests to FAIL/PASS API ... Also: change them to comply with the deletion of PASS_IF macro & condense checks for invalid dsizes in one test, have all checks on same valid dsize happen in a single test. Task: #4021	5 years ago
Philippe Antoine	56f664af6b	pcre2: follow code naming style	5 years ago
Philippe Antoine	48dd0cf804	pcre2: check for PCRE2_ERROR_UNSET ... Needs maybe to be generalized	5 years ago
Philippe Antoine	3de99a214c	pcre2: migrate keywords parsing	5 years ago
Joshua Lumb	cf9b2b5fd1	detect-dsize: Add ! operator for dsize matching	5 years ago
Victor Julien	af104dd223	detect/dsize: set depth flag when applying dsize as depth	5 years ago
Jeff Lucovsky	1eeb96696b	general: Cleanup bool usage	5 years ago
Victor Julien	6ab323d323	detect: hide RegisterTests behind ifdef UNITTESTS ... Update all callers to more aggressively use UNITTESTS guards as well.	6 years ago
Victor Julien	26bcc97515	detect/keywords: dynamic version part of doc URL	6 years ago
Jeff Lucovsky	d3a65fe156	detect: Provide `de_ctx` to free functions ... This commit makes sure that the `DetectEngineCtx *` is available to each detector's "free" function.	6 years ago
Shivani Bhardwaj	0e4f261224	Use StringParse* for all parsers and configurations	6 years ago
Jeff Lucovsky	7f6af10fed	general: copyright bump	6 years ago
Jeff Lucovsky	4b0085b03c	detect: Update to take advantage of PCRE refactor ... This commit changes the keyword detectors to use the refactored PCRE modifications from detect-parse.[ch]	6 years ago
Jeff Lucovsky	be4c6b85de	general: Convert _Bool to bool ... This commit addresses task 3167 and changes usages of '_Bool` to `bool`. The latter is included from `suricata-common.h`	7 years ago
Victor Julien	f8aed4ce2d	threading: change local packet queue logic ... Previously each 'TmSlot' had it's own packet queue that was passed to the registered SlotFunc as an argument. This was used mostly for tunnel packets by the decoders and by defrag. This patch removes that in favor of a single queue in the ThreadVars: decode_pq. This is the non-locked version of the queue as this is only a temporary store for handling packets within a thread. This patch removes the PacketQueue pointer argument from the API. The new queue can be accessed directly through the ThreadVars pointer.	7 years ago
Shivani Bhardwaj	d801c3e588	detect: Make keyword description consistent ... Closes redmine ticket #3137.	7 years ago
Shivani Bhardwaj	b5b429c288	detect: Add missing keyword URLs and description ... Add missing keyword URLs and their description. Fix the ones that were incorrect. Partially closes redmine ticket #2974.	7 years ago
Victor Julien	14896365ef	detect: remove Threadvars argument from API calls ... Remove it as it's (almost) never used. If it is really needed it can be accessed through DetectEngineThreadCtx::tv as well.	7 years ago
Victor Julien	91296d1eec	detect/prefilter: add de_ctx to registration	9 years ago
Victor Julien	e087d93883	detect: reject dsize rules that can't match ... Rules can contain conflicting statements and lead to a unmatchable rule. 2 examples are rejected by this patch: 1. dsize < content 2. dsize < content@offset Bug #2187	9 years ago
Victor Julien	ab1200fbd7	compiler: more strict compiler warnings ... Set flags by default: -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wwrite-strings -Wcast-align -Wbad-function-cast -Wformat-security -Wno-format-nonliteral -Wmissing-format-attribute -funsigned-char Fix minor compiler warnings for these new flags on gcc and clang.	9 years ago
Victor Julien	779d40cedf	detect: remove hardcoded sm_list logic from setup ... Introduce utility functions to aid this.	10 years ago
Victor Julien	f370e88135	detect: move init only Signature members to init_data	10 years ago
Victor Julien	8edc954e82	detect: get rid of Signature::sm_lists ... Instead use the lists in init_data during setup and the SigMatchData arrays during runtime.	10 years ago
Victor Julien	39613778cd	detect: make setup/free/match funcs static where possible	10 years ago
Victor Julien	bfd4bc8233	detect: constify Signature/SigMatch use at runtime	10 years ago
Eric Leblond	a2e2f50fb9	documentation: fix list keywords URLs ... Update URLs in keyword definition to point to sphinx documentation.	10 years ago
Victor Julien	fbb0490c31	detect-dsize: extra match support	10 years ago
Victor Julien	065d9bceae	detect-dsize: enable prefilter support ... Enable prefilter support for the dsize keyword.	10 years ago
maxtors	9d3fd82849	Removed duplicate include statements.	10 years ago
Victor Julien	e67ae0f174	detect keywords: use parse regex util func	10 years ago
Jason Ish	796dd5223b	tests: no longer necessary to provide successful return code ... 1 pass, 0 is fail.	10 years ago
Ken Steele	923a77e952	Change Match() function to take const SigMatchCtx* ... The Match functions don't need a pointer to the SigMatch object, just the context pointer contained inside, so pass the Context to the Match function rather than the SigMatch object. This allows for further optimization. Change SigMatch->ctx to have type SigMatchCtx* rather than void* for better type checking. This requires adding type casts when using or assigning it. The SigMatch contex should not be changed by the Match() funciton, so pass it as a const SigMatchCtx*.	12 years ago
Ken Steele	8f1d75039a	Enforce function coding standard ... Functions should be defined as: int foo(void) { } Rather than: int food(void) { } All functions where changed by a script to match this standard.	12 years ago
Ken Steele	f9705377ae	Remove pkt variable from Packet structure. ... The uint8_t *pkt in the Packet structure always points to the memory immediately following the Packet structure. It is better to simply calculate that value every time than store the 8 byte pointer.	13 years ago
Victor Julien	2be6829986	Convert dsize keyword parsing to use pcre_copy_substring	13 years ago
Eric Leblond	c5bd04f102	unittest: recycle packet before exit ... To avoid an issue with flow validation, we need to recycle the packet before cleaning the flow.	13 years ago
Eric Leblond	6842545331	Add documentation url in list-keyword output. ... The output of the list-keyword is modified to include the url to the keyword documentation when this is available. All documented keywords should have their link set. list-keyword can be used with an optional value: no option or short: display list of keywords csv: display a csv output on info an all keywords all: display a human readable output of keywords info $KWD: display the info about one keyword.	14 years ago
Victor Julien	45cbef0735	For signatures with the dsize option set depth on any content match in that sig.	14 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	14 years ago
pi-rho	0df4c5838d	spelling corrections documented in redmine bug#533	14 years ago
Victor Julien	cdba2f50d1	Various fixes and improvements based on feedback by Coverity analyzer.	15 years ago
Anoop Saldanha	a4638fb0ad	code cleanup - replace SigMatchAppendPacket with SigMatchAppendSMToList	15 years ago
Anoop Saldanha	bbb9f35f26	code cleanup - replace SigMatchGetLastSM with SigMatchGetLastSMFromLists	15 years ago