1665 Commits (6af30e5b2ed0bd1709d84f870eaee0b5b7396080)

Author	SHA1	Message	Date
Anoop Saldanha	6648d1faf0	allow sigs for http uri of the form content:one; content:two; distance:0; http_[raw_]header;	16 years ago
Anoop Saldanha	8f1d17846f	allow sigs for http uri of the form content:one; content:two; distance:0; http_uri;	16 years ago
Anoop Saldanha	07f20674ac	allow sigs for http client body of the form content:one; content:two; distance:0; http_client_body;	16 years ago
Victor Julien	6a5d2cb40d	Fix potential locking issue in out of memory conditions in the http_header, http_raw_header code. Fix other potential small issues in http_ code.	16 years ago
Anoop Saldanha	eecf2d7e13	Add the makefile.am addition that I forgot to add in the previous commit for http_raw_header	16 years ago
Anoop Saldanha	7ec0382774	support fast pattern for http raw header. Also support relative modifiers for http raw header	16 years ago
Victor Julien	0c806f70bb	Fix --enable-debug compilation, just unittest with --enable-debug-validation enabled.	16 years ago
Victor Julien	1a32d9b5ec	Fix printing unprintable characters in the engine-analysis fast_pattern mode.	16 years ago
Anoop Saldanha	075719ea8c	fix fast pattern unittests	16 years ago
Victor Julien	18d3c87947	Add check to fast pattern keyword to make sure that the offset and length don't exceed the actual pattern length.	16 years ago
Anoop Saldanha	c61c68fd36	mpm and fast pattern support for http_header. Also support relative modifiers for http_header	16 years ago
Anoop Saldanha	778ec0939c	make client body buffer limit configurable. Also some minor changes	16 years ago
Anoop Saldanha	fc46f216ca	detect-http-header.c cleanup before we start working on it	16 years ago
Anoop Saldanha	302011dbca	fix compilation issues with debug enabled.	16 years ago
Anoop Saldanha	0aa5cffb12	fast pattern support for http_client_body keyword added. Also mpm support for http_client_body added	16 years ago
Anoop Saldanha	c227aeeacb	remove support for skipping reinspecting fast pattern contents once again during packet payload inspection. Also make some changes to our detection engine	16 years ago
Anoop Saldanha	bbd0c5056b	store the content added for mpm inside Signature. also carry out an unconditional cleanup of packet pattern matcher pmq det_ctx->pmq	16 years ago
Anoop Saldanha	68b78664fa	Add unittests for checking content flags. Fix indentation in PopulateMpmAddPatternToMpm(). Also fix DETECT_CONTENT_IS_SINGLE	16 years ago
Anoop Saldanha	b15ada8102	set content_packet_mpm and content_stream_mpm flag for content to prevent double check inside inspection code	16 years ago
Anoop Saldanha	67aecc73c2	set content_uri_mpm flag for uri content to prevent double check inside inspection code	16 years ago
Anoop Saldanha	1cd8bd3d3c	make changes for uri mpm, when uricontent is negated and also is the fp and we ignore checking it once again in engine-uri.c	16 years ago
Anoop Saldanha	6df051321f	fix fp when content is negated and also added to mpm	16 years ago
Anoop Saldanha	5c6a65dc58	support relative modifiers for http_client_body. Introduce body processing engine in detect-engine-hcbd.[ch]	16 years ago
Victor Julien	234656e5f6	Fix compilation in --enable-debug mode.	16 years ago
Anoop Saldanha	eade60f0fd	make some name changes. break PopulateMpm(). Set the avoid mpm double check flags	16 years ago
Anoop Saldanha	96bf15bd74	unifying content structure - http_stat_msg now uses DetectContentData	16 years ago
Anoop Saldanha	4c53a9d606	unifying content structure - http_header now uses DetectContentData	16 years ago
Anoop Saldanha	1957eee389	unifying content structure - http_method now uses DetectContentData	16 years ago
Anoop Saldanha	041f5b1a4f	unifying content structure - http_cookie now uses DetectContentData	16 years ago
Anoop Saldanha	f05b0f4e1e	unifying content structure - http_client_body now uses DetectContentData	16 years ago
Anoop Saldanha	4883efd0f6	unifying content structure - uricontent now uses DetectContentData	16 years ago
Anoop Saldanha	3b0a9ca97e	add support for http_uri; content fast_patterns	16 years ago
Anoop Saldanha	3c73854d2d	completely remove populate_mpm_flags. Some indentation changes. Also disable support to avoid double checks inside payload inspection for patterns added to mpm. Also add support to MpmFactory to reclaim a mpm_ctx	16 years ago
Anoop Saldanha	fde2c64ea7	fix code after fresh rebase. change some pmatch and amatch lists to sm_lists[] format	16 years ago
Anoop Saldanha	a6899218fc	remove populate_mpm_flags from inside PatternMatchPreparePopulateMpm()	16 years ago
Anoop Saldanha	6eaba8941c	Use new flags to indicate uricontent has a mpm set	16 years ago
Anoop Saldanha	46b4806d8e	use a single populatempm() function to add the right content for mpm	16 years ago
Anoop Saldanha	4a038511ff	Change the struct members uricontent and uricontent_len in DetectUricontentData to content and content_len. Make replacements everywhere else in the codebase to accomodate these changes	16 years ago
Anoop Saldanha	ede7be34b5	replace all Signature->tmatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_TMATCH]	16 years ago
Anoop Saldanha	3d2f81d978	replace all Signature->dmatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_DMATCH]	16 years ago
Anoop Saldanha	a7353be20d	replace all Signature->amatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_AMATCH]	16 years ago
Anoop Saldanha	e0476242c6	replace all Signature->umatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_UMATCH]	16 years ago
Anoop Saldanha	e54358a9e1	replace all Signature->pmatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_PMATCH]	16 years ago
Anoop Saldanha	82fd581b64	replace all sm lists (match, pmatch, dmatch, umatch, amatch, tmatch) with an array Signature->sm_lists[]. Replace all Signature->match instances in the engine with Signature->sm_lists[DETECT_SM_LIST_MATCH]	16 years ago
Anoop Saldanha	3656879aa0	fix some dce opnum/stub tests that would have shown success always irrespective of test results	16 years ago
Anoop Saldanha	4b77f132df	add support for sigs with uricontent fast_pattern	16 years ago
Anoop Saldanha	ea8eaf31aa	Fix fast_pattern tests that always showed success, irrespective of test results	16 years ago
Victor Julien	966c7349d3	Make sure we have a response message before inspecting it in http_stat_msg.	16 years ago
Victor Julien	07ec1ee10e	Slightly cleanup detect-engine.sgh-mpm-context option parsing.	16 years ago
Anoop Saldanha	c89507836b	if sgh-mpm-context is not available in conf, alias the auto case inside the engine	16 years ago
Victor Julien	bac621760e	Fix a potential invalid memory read in the protocol name code used by alert-fastlog.	16 years ago
Gurvinder Singh	f92ba23331	add the support for >= and <= operator for byte_test	16 years ago
Victor Julien	412498f4e4	Converts port vars in http logger from uint32_t to Port and update output.	16 years ago
Gurvinder Singh	b7ff6537d2	fixed the incorrect port issue in http.log	16 years ago
Victor Julien	275bd3b7d7	Switch back to defaulting to full for detect-engine.sgh-mpm-context as it broke many tests.	16 years ago
Victor Julien	dec4218d62	Layout updates to NFQ runmode.	16 years ago
Victor Julien	7e49aa7f76	Simplify NFQ runmode reducing the number of threads and thus queues.	16 years ago
Victor Julien	7e6f01765f	Change default of detect-engine.sgh-mpm-context to auto.	16 years ago
Victor Julien	001f91056e	Add http_raw_header as an alias to the http_header keyword as that actually inspects the raw headers (see issue #243). Closes issue #242.	16 years ago
Victor Julien	4598274d07	Fix depth error messages referring to distance instead of depth, fix their layout.	16 years ago
Victor Julien	afdb39e5f6	Print an error if the protocol field of a signature contains a unknown/invalid value.	16 years ago
Victor Julien	8d0bc27fc4	Fix a case where alerting in inline mode would lead dropping on alert sigs.	16 years ago
Victor Julien	5a10eac5bd	Cleanup http_stat_code unittests, shrink data structure.	16 years ago
Victor Julien	1636152e32	Fix negated http_method not working properly, causing false positives.	16 years ago
Gurvinder Singh	b7da115e6d	support for http_stat_code keyword has been added to detection module	16 years ago
Gurvinder Singh	1deae70cf7	added http_stat_msg keyword support for detection module	16 years ago
Jason Ish	a4d19e4130	Add new profiling sort option, maxticks.	16 years ago
Anoop Saldanha	59923316bc	change the default recursion limit in the code to 3000, the value which we currently have in the conf file. Also change print modifier for printing timeval	16 years ago
Anoop Saldanha	5d9a453e0d	find an optimal value for detect-engine:inspection-recursion_limit + unittest	16 years ago
Anoop Saldanha	bc99328ec8	define a new conf paramter detect-engine:inspection-recursion-limit; Defines a recursion limit for content inspection code	16 years ago
William Metcalf	efeab331ea	compilation fix missing UT ifdef wrapper in reference code	16 years ago
Victor Julien	746ef0d2f8	Remove stray newline char from profiling output.	16 years ago
Victor Julien	3062b19068	Clean up output of signature ordering module.	16 years ago
Victor Julien	001dcaae84	Minor reference.config support changes: improve error handling, reduce hash table size.	16 years ago
Anoop Saldanha	88d94b136d	Support for reference.config file	16 years ago
Anoop Saldanha	f5a02833dd	code cleanup in detect-reference.c	16 years ago
Victor Julien	344ea14695	Change mpm hash_size config setting highest to higher as highest wasn't the... highest. Max was higher. Leaving highest as an alias to higher for backwards compatibility.	16 years ago
Victor Julien	41fd7e51c6	Really add secunia reference support.	16 years ago
Victor Julien	33170fd181	Add secunia reference pending our reference.config support.	16 years ago
Anoop Saldanha	067e53403c	add missing sig_app_layer flags for dce sigs	16 years ago
Victor Julien	26fd2a0afd	Add telus and bid references for etpro.	16 years ago
Victor Julien	2b187a2721	Remove a BUG_ON statement from the payload inspection code.	16 years ago
Victor Julien	f2e6ec7374	Fix http_method not inspecting all http transactions all the time. Fix proper nocase setting. Switch to pattern scanning only, no more numeric compares as it turned to be incompatible with how the keyword is used (nocase, etc).	16 years ago
Anoop Saldanha	2cdb5be391	Print out file name for fast_pattern engine_analysis. Also add some info logs	16 years ago
Anoop Saldanha	0c5b82d891	provide separate ids for content, uricontent, http_(client_body_data|cookie|header|method|uri), when they share the same pattern	16 years ago
Victor Julien	3bd7441ea5	Default to 'single' ctx for ac-gfbs as well.	16 years ago
Anoop Saldanha	e072841e93	hash fix in staging to differentiate nocase duplicate patterns from case-senstive ones	16 years ago
Anoop Saldanha	de5db1a730	support cases for ac, where we have a single pattern in 2 different sigs, but one that is case-senstive and the other not. Also remove duplicate pids from the output_table	16 years ago
Anoop Saldanha	8628c572df	update todos for ac. Cleanup some memory as well.	16 years ago
Anoop Saldanha	a2d04a94b5	selecting auto for detect-engine.sgh_mpm_context now uses single if the mpm is ac, full otherwise	16 years ago
Anoop Saldanha	5cc7f90f45	fix hash bug in ac-gfbs. Should reduce the no of patterns added for single context ac-gfbs from a million to a couple of thousands. Also support no case handling. \todo support insertion of final state presence into goto_table and failure table state transitions	16 years ago
Anoop Saldanha	ded1f63323	fix ac nocase handling	16 years ago
Anoop Saldanha	174048544d	fix hash generation in b2g and ac addpattern. Brings down the no of patterns added from close to a million to a couple of thousands	16 years ago
Anoop Saldanha	29b5cb9abd	respect content flags in hash compare function during staging. For example, we would end up ignoring a nocase version of a duplicate content from another sig in the same sgh	16 years ago
Anoop Saldanha	0ef684705c	support single mpm context distribution across sghs in staging. Also see to it that ac works fine with this setup	16 years ago
Anoop Saldanha	b367c37ae6	suricata.yaml conf update to support single mpm context distribution over multiple sghs + code to parse this conf	16 years ago
Anoop Saldanha	4b2cf7e125	fix ac, ac-gfbs to support new changes to util-mpm.h + remove some junk code	16 years ago
Anoop Saldanha	b9a770740a	add comments and todos for ac and ac-gfbs	16 years ago
Anoop Saldanha	658ff5753d	aho-corasick for the cpu. We have 2 versions of ac. The first MPM_AC uses the delta table and the secone one MPM_AC_GFBS uses the goto-failure table	16 years ago
Victor Julien	bfb6aac495	Sleep after checking for a thread flag in TmThreadWaitOnThreadInit now that the check is so much cheaper.	16 years ago