6537 Commits (79a96b2b9096e5850f276d98ba621439d892e7ff)

 

All Branches   

Search

Author	SHA1	Message	Date
Victor Julien	79a96b2b90	mpm: refactor 'single' setup handling	9 years ago
Victor Julien	157ca89dd7	mpm: remove useless flag from factory	9 years ago
Victor Julien	fdd05e8fb4	mpm: remove unused app proto factory	9 years ago
Victor Julien	4e91f6b1e6	mpm: in factory register, consider name const	9 years ago
Victor Julien	2b84387ea4	detect: work around cocci limitation	9 years ago
Victor Julien	0311f01b97	rule grouping: speed up port based grouping ... Create a hash table of unique DetectPort objects before trying to create a unique list of these objects. This safes a lot of cycles in the creation of the list.	9 years ago
Victor Julien	a2223bb066	mpm: consify packet/stream search	9 years ago
Victor Julien	87f3adbe4c	detect/mpm: unify packet/stream mpm_ctx pointers ... SGH's for tcp and udp are now always only per proto and per direction. This means we can simply reuse the packet and stream mpm pointers. The SGH's for the other protocols already used a directionless catch all mpm pointer.	9 years ago
Victor Julien	30755265ee	http_raw_header: improve mpm progress handling	9 years ago
Victor Julien	af3bf3dc7a	detect: optimize sgh layout	9 years ago
Victor Julien	de273d88cc	detect: remove unused content minlen tracking	9 years ago
Victor Julien	e43c4f3ea2	mpm: optimize calls ... For all mpm wrapper functions, check minlen vs the input buffer to see if we can bypass the mpm search. Next to this, make all the function inline. Also constify the input and do other minor cleanups.	9 years ago
Victor Julien	5857660568	http_uri: mpm cleanup. Use mpm_ctx's minlen	9 years ago
Victor Julien	6bb2b001a3	mpm: cleanup: move mpm funcs into buffer specific files	9 years ago
Victor Julien	e57e7d1b96	mpm: cleanup, remove unused structs and prototypes	9 years ago
Victor Julien	eb19fc4c7b	mpm: remove unused structure	9 years ago
Victor Julien	caea596ce5	profiling: output post-prefilter matches ... Dump a json record containing all sigs that need to be inspected after prefilter. Part of profiling. Only dump if threshold is met, which is currently set by: --set detect.profiling.inspect-logging-threshold=200 A file called packet_inspected_rules.json is created in the default log dir.	9 years ago
Victor Julien	92c571b26d	detect: move sm_list to string funcs to parser code	9 years ago
Victor Julien	722e2dbf7c	profiling: initial rulegroup tracking ... Per rule group tracking of checks, use of lists, mpm matches, post filter counts. Logs SGH id so it can be compared with the rule_group.json output. Implemented both in a human readable text format and a JSON format.	9 years ago
Victor Julien	e310a033be	detect: assign id to sgh	9 years ago
Victor Julien	c880b79f45	detect: shrink sgh ... Turn list of mpm_ctx pointers into a union so that we don't waste space. The sgh's for tcp and udp are in one direction only, so the ts and tc ones are now in the union.	9 years ago
Victor Julien	c804102a9a	detect: move app_mpms array to init data	9 years ago
Victor Julien	9b3d4f7e24	mpm: unify & localize mpm pattern (id) handling ... So far, the patterns as passed to the mpm's would use global id's that were shared among all buffers, directions. This would lead to a fairly large pattern id space. As the mpm algo's use the pattern id's to prevent duplicate matching through a pattern id based bitarray, shrinking this space will optimize performance. This patch implements this. It sets a flag before adding the pattern to the mpm ctx, instructing the mpm to ignore the provided pid and handle pids management itself. This leads to a shrinking of the bitarray size. This is made possible by the previous work that removes the pid logic from the code. Next to this, this patch moves the pattern setup stage to common util functions. This avoids code duplication. Update ac, ac-bs and ac-ks to use this.	9 years ago
Victor Julien	ba9d43cce5	mpm: improve negated mpm ... The idea is: if mpm is negated, it's both on mpm and nonmpm sid lists and we can kick it out in that case during the merge sort. It only works for patterns that are 'independent'. This means that the rule doesn't need to only match if the negated mpm pattern is limited to the first 10 bytes for example. Or more generally, an negated mpm pattern that has depth, offset, distance or within settings can't be handled this way. These patterns are not added to the mpm at all, but just to to non-mpm list. This makes sense as they will *always* need manual inspection. Similarly, a pattern that is 'chopped' always needs validation. This is because in this case we only inspect a part of the final pattern.	9 years ago
Victor Julien	9e71ef4c3b	detect: remove signature pattern id reference	9 years ago
Victor Julien	46734ec41b	mpm: remove unused pmq merge function	9 years ago
Victor Julien	c1ad08d11e	detect: remove stream pmq array	9 years ago
Victor Julien	4e8e591715	detect mpm: mpm store cleanup ... Move all rule modification to the fast_pattern assigment.	9 years ago
Victor Julien	c87fcb29ff	detect mpm: fast_pattern assignment cleanup	9 years ago
Victor Julien	7c94077892	detect mpm: remove unused mpm flags	9 years ago
Victor Julien	a7d126738a	detect address: remove unused features	9 years ago
Victor Julien	cbf80de6fe	detect-port: cleanup	9 years ago
Victor Julien	a96fa0fc2f	detect: remove unused dport sgh hash	9 years ago
Victor Julien	e6248b0dbe	detect: clean up sgh's at detect engine free	9 years ago
Victor Julien	1f7e33a4b0	detect: remove unused flag	9 years ago
Victor Julien	e8c9598035	detect sgh: remove unused field	9 years ago
Victor Julien	2ab20d0b9b	detect: free lookup structures	9 years ago
Victor Julien	4ba1ac55f0	detect: output sgh stats ... Output stats for the rule groups into a json format.	9 years ago
Victor Julien	810d2d3ec6	detect: add list id to string funcs	9 years ago
Victor Julien	fa885e1d85	mpm: remove pattern id logic	9 years ago
Victor Julien	69d38a3222	mpm: ac-bs use internal pattern id tracking	9 years ago
Victor Julien	4edb03ab9d	mpm: ac use internal pattern id tracking	9 years ago
Victor Julien	cd8283bb72	smtp: use rule_id mpm support instead of pattern id	9 years ago
Victor Julien	b2fcb17859	proto detect: in mpm switch to rule id ... Use the rule id API instead of pattern id API.	9 years ago
Victor Julien	a34be23002	detect: simplify negated mpm handling	9 years ago
Victor Julien	b84d6d402f	detect grouping: multiple whitelist conditions ... Instead of the binary yes/no whitelisting used so far, use different values for different sorts of whitelist reasons. The port list will be sorted by whitelist value first, then by rule count. The goal is to whitelist groups that have weak sigs: - 1 byte pattern groups - SYN sigs Rules that check for SYN packets are mostly scan detection rules. They will be checked often as SYN packets are very common. e.g. alert tcp any any -> any 22 (flags:S,12; sid:123;) This patch adds whitelisting for SYN-sigs, so that the sigs end up in as unique groups as possible. - negated mpm sigs Currently negated mpm sigs are inspected often, so they are quite expensive. For this reason, try to whitelist them. These values are set during 'stage 1', rule preprocessing.	9 years ago
Victor Julien	3c184c19cd	detect grouping: port based group whitelisting ... Whitelist some ports in grouping to make sure they get their own group.	9 years ago
Victor Julien	5772f526dc	detect grouping: warn on and fix up bad sigs ... Only inspect directionless SYN scan sigs toserver. Issue a warning for those rules.	9 years ago
Victor Julien	2ce03fbabb	detect: split non-mpm list into syn/nosyn ... Since SYN inspecting rules are expensive, this patch splits the 'non-mpm' list (i.e. the rules that are always considered) into a 'syn' and 'non-syn' list. The SYN list is only inspected if the packet has the SYN flag set, otherwise the non-syn list is used. The syn-list contains _all_ rules. The non-syn list contains all minus the rules requiring the SYN bit in a packet.	9 years ago
Victor Julien	e48d745ed7	mpm: constify search func args	9 years ago