213 Commits (7adac3048de98735f4df07dedd5b37b87dc07c83)

Author	SHA1	Message	Date
Victor Julien	7adac3048d	file-data: create initial keyword registration.	14 years ago
Victor Julien	fa0152fa80	Shrink signature flags field to 32 bits.	14 years ago
Victor Julien	dd9da1a56f	Merge all http mpm related signature flags into a single set: SIG_FLAG_MPM_HTTP and SIG_FLAG_MPM_HTTP_NEG.	14 years ago
Victor Julien	d5ed28b065	Remove SIG_FLAG_MPM flag.	14 years ago
Victor Julien	fe48920514	Remove per sgh mpm_streamcontent_maxlen variable. It was checked but never set.	14 years ago
Victor Julien	4992f7c417	Remove SIG_FLAG_MPM_URI flag. It was checked but never set.	14 years ago
Victor Julien	2650551192	Rename signature init flags to indicate they are init flags.	14 years ago
Victor Julien	6ebd71545b	Fix signature flag definitions on 32 bit.	14 years ago
Victor Julien	291ddd95f2	Detection engine -- mpm ... Each signature is in one mpm ctx at max, but there were 3 separate id's in use: packet, stream, http. Merged them all into one. Could shrink the SignatureHeader structure with 8 bytes because of this, should lead to better caching performance.	14 years ago
Victor Julien	7db72bce75	Optimize detection engine prefiltering logic.	14 years ago
Victor Julien	89f83e714c	Introduce http_server_body keyword. ... The http_server_body content modifier modifies the previous content to inspect the normalized (dechunked, unzipped) http_server_body. The workings are similar to http_client_body. Additionally, a new pcre flag was introduced "/S". To facilitate this change the signature flags field was changed to be 64 bit.	14 years ago
Victor Julien	04ea70ccf7	file extract: pruning ... Add pruning of files in memory so we keep only memory what we really need. Fix magic logic. Reset file part of the de_state on receiving another file in the same tx.	14 years ago
Victor Julien	9b62ec65ab	Make sure filemagic works properly regardless of filestore being in use for a flow.	14 years ago
Victor Julien	5945e652d6	Initial implementation of filemagic keyword.	14 years ago
Victor Julien	23e01d23d3	Implement filestore keyword, including a way for the stateful detection engine to conclude that a file will never have to be stored.	14 years ago
Pablo Rincon	6d60b3a747	filename and fileext keywords	14 years ago
Anoop Saldanha	2b356dadff	Support for tos keyword added	14 years ago
Victor Julien	8cc82c7241	Add -S commandline option that loads a rule file exclusively. Issue #338.	14 years ago
Anoop Saldanha	c7b9d3fecb	Remove broken dsize_sm in SigMatch used by dsize in detection engine	14 years ago
Anoop Saldanha	ba6bada155	change rev field in Signature to u32 and use strotoul to extract the value. Cleanup some dead code/comments	14 years ago
Eric Leblond	a85dc9b0e2	Add support for replace keyword. ... This patch adds support for the replace keyword. It is used with content to change selected part of the payload. The major point with this patch is that having a replace keyword made necessary to avoid all stream level check because we need to access to the could-be-modified packet payload. One of the main difficulty is to handle complex signature. If there is other content check, we must do the substitution when we're sure all match are valid. The patch adds an attribute to the thread context variable to be able to deal with recursivity of the match function. Replace is only activated in IPS mode and apply only to raw match.	14 years ago
Eric Leblond	0c34a1c5e7	rewrite constants and add flag for replace ... This patch make use of bit shift to rewrite some of the mask constants. It also delete an unused flag value and suppress the associated dead code. The numeric value of the flag is now used by the flag needed for replace code.	14 years ago
Eric Leblond	3f153fb0da	Add 'stream-event' keyword. ... This patch adds an alias to the 'engine-event' keyword. It is now possible to access to the stream events via the 'stream-event' keyword. A simple transformation is done: stream-event:reassembly_segment_before_base_seq is a shortcut for: engine-event:stream.reassembly_segment_before_base_seq	14 years ago
Eric Leblond	e3a6d8955e	Introduce engine-event keyword ... This patch renames the 'decode-event' keyword to 'engine-event' and keep it for backword compatibility of rulesets. All *DecodeEvent* references in the code are replaced by EngineEvent version.	14 years ago
Eric Leblond	03c185a3ad	threshold: add suppress keyword ... This patch adds the suppress keyword to the threshold.config file. The alerts are suppressed but the other elements like flowbits are maintained.	14 years ago
Anoop Saldanha	35f3eafa5e	byte extract added to the engine. Detection support added for packet payload, uri and dce detection engines	14 years ago
Victor Julien	1174df9712	Fix passing a uint8_t as an int. Breaks on some args.	14 years ago
Victor Julien	1e0b050a54	Add more mask flags.	14 years ago
Victor Julien	2dbfdd40af	Clean up new SIMD mask checking code, improve non-SIMD checks.	14 years ago
Victor Julien	b421019cef	Match packet mask against 16 signature masks at once using SIMD instructions for SSE3 and up.	14 years ago
Victor Julien	75439863ed	Shrink PacketAlerts structure so that Packet structure is a lot smaller. Reduce max events per packet from 256 to 15.	14 years ago
Anoop Saldanha	966119b6aa	support for http_raw_uri keyword + mpm engine	14 years ago
Eric Leblond	9beebf621a	Add support for 'nfq_set_mark' keyword ... This patch introduces 'nfq_set_mark' which is new rules option. If a packet matches a rule using nfq_set_mark in NFQ mode, it is marked with the mark/mask specified in the option during the verdict. It is thus possible to trigger different behaviour on the packet inside Linux/Netfilter.	15 years ago
Anoop Saldanha	c105a739e9	support for ssl_state keyword added	15 years ago
Gurvinder Singh	8f8b1212af	support for ssl_version keyword	15 years ago
Anoop Saldanha	c9897a44a4	fast pattern support for http_cookie. Also support relative modifiers	15 years ago
Anoop Saldanha	bbbedaf963	fast pattern support for http_method. Also support relative modifiers	15 years ago
Victor Julien	39dea56a84	Remove flowbits as a mask prefilter as they are dynamic. Add a dynamic check.	15 years ago
Anoop Saldanha	8c21511c99	don't buffer raw headers. Retrieve them individually from htp_state during mpm stage and content valiadation stage	15 years ago
Victor Julien	435d0fb327	Clean up signature flags creating room for merging flags and mpm_flags. Merge flags and mpm_flags. Move new mpm id's into signature header. Get rid of full signature access in signature prefiltering.	15 years ago
Victor Julien	169aa5581a	Rename SIG_FLAG_AMATCH flag to SIG_FLAG_STATE_MATCH to better reflects its purpose.	15 years ago
Victor Julien	d7b92d9bfe	Consolidate several signature flags into one.	15 years ago
Anoop Saldanha	25588b6910	comment out hrhd flags that we were using previously. Also remove the de_mpm_ based flags inside detect.h used by uri|hcbd|hhd|hrhd mpms. indentation fix as well	15 years ago
Anoop Saldanha	72b0fcf419	modify detection engine to carry out uri mpm run before build match array if alproto is http and if sgh has atleast one sig with uri mpm set	15 years ago
Anoop Saldanha	7ec0382774	support fast pattern for http raw header. Also support relative modifiers for http raw header	15 years ago
Anoop Saldanha	c61c68fd36	mpm and fast pattern support for http_header. Also support relative modifiers for http_header	15 years ago
Anoop Saldanha	778ec0939c	make client body buffer limit configurable. Also some minor changes	15 years ago
Anoop Saldanha	0aa5cffb12	fast pattern support for http_client_body keyword added. Also mpm support for http_client_body added	15 years ago
Anoop Saldanha	bbd0c5056b	store the content added for mpm inside Signature. also carry out an unconditional cleanup of packet pattern matcher pmq det_ctx->pmq	15 years ago
Anoop Saldanha	6df051321f	fix fp when content is negated and also added to mpm	15 years ago