33 Commits (6079963f551455aaebf9d9545484eaa9b4da9a83)

Author	SHA1	Message	Date
Philippe Antoine	8461e3f3e7	src: do not include "util-unittest.h" directly ... It is included in suricata-common.h Ticket: 945	3 weeks ago
Lukas Sismis	b596073a79	src: doc: remove double-space typos	10 months ago
Fupeng Zhao	e740307cd5	detect: replace strtoul with ByteExtractStringUint32 ... Also added and updated unit tests to ensure correctness. Ticket: #7212	1 year ago
Philippe Antoine	a2b5225612	rust: bindgen SCSigMatchAppendSMToList ... Ticket: 7667	1 year ago
Victor Julien	e5d3fad5f4	nfq: stricter thread sync ... No longer update `Packet::flags` for tracking packet modifications, as thread safety was not guaranteed. Clearly separate between various kinds of `Packet::nfq_v` accesses for: - mark - mark_modified - verdicted These are either done under lock (Packet::persistent.tunnel_lock) or, if the Packet is not part of a tunnel, not under lock. This is safe as in all the related logic the Packet's tunnel state is fixed and can no longer change.	3 years ago
Victor Julien	6066c4d6e7	decode/tunnel: improve tunnel handling ... Give each packet explicit tunnel type `ttype`: none, root, child. Assigning happens when a (tunnel) packet is set up and is thread safe.	3 years ago
Philippe Antoine	c272a646c5	detect: SigMatchAppendSMToList can fail ... Ticket: #6104 And failures should be handled to say that the rule failed to load Reverts the fix by 299ee6ed55 that was simple, but not complete (memory leak), to have this bigger API change which simplifies code.	3 years ago
Jeff Lucovsky	3286c3b912	detect/pcre: Use local match variables ... pcre2 is not thread-safe wrt match objects so use locally scoped objects. Issue: 4797	3 years ago
Victor Julien	b31ffde6f4	output: remove error codes from output	4 years ago
Victor Julien	1fafb83fed	packet: turn tunnel lock into spinlock ... Lock is only held to update/check ints, so spin lock will be more efficient. Place the member of Packet in a new "persistent" area to make it clear this is not touched by the PacketReinit logic. Ticket: #5592.	4 years ago
Juliana Fajardini	b3743cf5c0	unittests (assorted): remove PASS_IF macro ... Also small documentation clean up and test adjusments where that was needed. affected: counters, decode-vntag, detect-mark Related to #4795	5 years ago
Philippe Antoine	3de99a214c	pcre2: migrate keywords parsing	5 years ago
Janani Ramjee	2d3cf11906	detect/mark: convert unittests to use PASS/FAIL API	6 years ago
Victor Julien	6ab323d323	detect: hide RegisterTests behind ifdef UNITTESTS ... Update all callers to more aggressively use UNITTESTS guards as well.	6 years ago
Jeff Lucovsky	d3a65fe156	detect: Provide `de_ctx` to free functions ... This commit makes sure that the `DetectEngineCtx *` is available to each detector's "free" function.	7 years ago
Jeff Lucovsky	7f6af10fed	general: copyright bump	7 years ago
Jeff Lucovsky	4b0085b03c	detect: Update to take advantage of PCRE refactor ... This commit changes the keyword detectors to use the refactored PCRE modifications from detect-parse.[ch]	7 years ago
Victor Julien	14896365ef	detect: remove Threadvars argument from API calls ... Remove it as it's (almost) never used. If it is really needed it can be accessed through DetectEngineThreadCtx::tv as well.	7 years ago
Victor Julien	6bf35a42f1	detect/mark: use postmatch instead of tag list ... Keep the tag list for just tags. Post match list is better so the keyword also works with pass and noalert rules.	8 years ago
Victor Julien	4dbf600d64	detect/mark: minor code cleanups	8 years ago
Victor Julien	ab1200fbd7	compiler: more strict compiler warnings ... Set flags by default: -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wwrite-strings -Wcast-align -Wbad-function-cast -Wformat-security -Wno-format-nonliteral -Wmissing-format-attribute -funsigned-char Fix minor compiler warnings for these new flags on gcc and clang.	10 years ago
Victor Julien	bfd4bc8233	detect: constify Signature/SigMatch use at runtime	10 years ago
Victor Julien	7021959689	nfq: suppress CID 1374302 and 1374303	10 years ago
Victor Julien	629fa30345	nfq_set_mask: set mark on root pkt for tunnels	10 years ago
Victor Julien	e67ae0f174	detect keywords: use parse regex util func	11 years ago
Jason Ish	796dd5223b	tests: no longer necessary to provide successful return code ... 1 pass, 0 is fail.	11 years ago
Jason Ish	52983bf314	tests: convert all test to return 0 on failure, 1 on success	11 years ago
Ken Steele	923a77e952	Change Match() function to take const SigMatchCtx* ... The Match functions don't need a pointer to the SigMatch object, just the context pointer contained inside, so pass the Context to the Match function rather than the SigMatch object. This allows for further optimization. Change SigMatch->ctx to have type SigMatchCtx* rather than void* for better type checking. This requires adding type casts when using or assigning it. The SigMatch contex should not be changed by the Match() funciton, so pass it as a const SigMatchCtx*.	12 years ago
Ken Steele	8f1d75039a	Enforce function coding standard ... Functions should be defined as: int foo(void) { } Rather than: int food(void) { } All functions where changed by a script to match this standard.	12 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	14 years ago
Anoop Saldanha	ff38d42bf1	code cleanup - replace SigMatchAppendTag with SigMatchAppendSMToList	15 years ago
Victor Julien	c865ee2217	Fix compilation for nfq_set_mark code when NFQ is not enabled.	16 years ago
Eric Leblond	9beebf621a	Add support for 'nfq_set_mark' keyword ... This patch introduces 'nfq_set_mark' which is new rules option. If a packet matches a rule using nfq_set_mark in NFQ mode, it is marked with the mark/mask specified in the option during the verdict. It is thus possible to trigger different behaviour on the packet inside Linux/Netfilter.	16 years ago