353 Commits (7afc2e3aed27beab3002923dd9c8d249b3a7e3e9)

Author	SHA1	Message	Date
Victor Julien	cb332b4cda	detect/http_method: move all tests into tests/	8 years ago
Victor Julien	0a405e27a0	detect/http_raw_uri: code reorganization ... Move registration into http_uri logic, move tests into the other uri tests. Switch to v2 mpm/inspect APIs.	8 years ago
Victor Julien	10e2731f18	detect/http-uri: move tests into tests/	8 years ago
Victor Julien	3111910fc6	detect/http_user_agent: move tests into tests/	8 years ago
Victor Julien	6f2b974f9c	detect/mpm: fix fast_pattern handling of len >255 ... The fast pattern selection logic would truncate a patterns len to 255 leading to assigning the same pid to different patterns. This in turn would be caught by the hyperscan setup code which would abort. Bug #2714.	8 years ago
Victor Julien	3a0eca9fde	detect/mpm: minor code cleanup	8 years ago
Victor Julien	7abb8745bf	detect/mpm: clean up setup code	8 years ago
Victor Julien	38b698c50f	detect/analyzer: show pattern that is used by mpm ... Set a new DETECT_CONTENT_MPM flag on the pattern that is selected during setup.	8 years ago
Victor Julien	91296d1eec	detect/prefilter: add de_ctx to registration	9 years ago
Victor Julien	efbd901385	detect: move mpm engines into detect engine ctx ... This allows safe registration at runtime.	9 years ago
Victor Julien	0de86211c6	detect: register dynamic buffers into de_ctx ... Register buffers that are created during rule parsing. Currently this means an existing buffer with one or more transformations.	9 years ago
Victor Julien	a499a44f7a	detect: move buffer type map into detect ctx ... Move previously global table into detect engine ctx. Now that we can register buffers at rule loading time we need to take concurrency into account. Move DetectBufferType to detect.h and update DetectBufferCtx API calls to include a detect engine ctx reference.	9 years ago
Victor Julien	f6e5cb1db6	detect: prefilter/inspect API v2, with transforms ... Introduce InspectionBuffer a structure for passing data between prefilters, transforms and inspection engines. At rule parsing time, we'll register new unique 'DetectBufferType's for a 'parent' buffer (e.g. pure file_data) with its transformations. Each unique combination of buffer with transformations gets it's own buffer id. Similarly, mpm registration and inspect engine registration will be copied from the 'parent' (again, e.g. pure file_data) to the new id's. The transforms are called from within the prefilter engines themselves. Provide generic MPM matching and setup callbacks. Can be used by keywords to avoid needless code duplication. Supports transformations. Use unique name for profiling, to distinguish between pure buffers and buffers with transformation. Add new registration calls for mpm/prefilters and inspect engines. Inspect engine api v2: Pass engine to itself. Add generic engine that uses GetData callback and other registered settings. The generic engine should be usable for every 'simple' case where there is just a single non-streaming buffer. For example HTTP uri. The v2 API assumes that registered MPM implements transformations. Add util func to set new transform in rule and add util funcs for rule parsing.	9 years ago
Victor Julien	ac0ae2dcd1	file_data: smtp file_data to generic file_data ... Generalize the SMTP file_data inspection into a 'files' file_data inspection that can be used for any protocol that uses the File API.	9 years ago
Victor Julien	0b97fbbc13	detect/mpm: micro optimization in setup	9 years ago
Victor Julien	26abf5337c	detect/mpm: minor cleanup: remove unused function arg	9 years ago
Victor Julien	dbd2d7c058	detect: more gracefully handle mpm prepare failure ... Exit with error instead of using the detection engine in a broken state. Bug #2187	9 years ago
Victor Julien	ab1200fbd7	compiler: more strict compiler warnings ... Set flags by default: -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wwrite-strings -Wcast-align -Wbad-function-cast -Wformat-security -Wno-format-nonliteral -Wmissing-format-attribute -funsigned-char Fix minor compiler warnings for these new flags on gcc and clang.	9 years ago
Victor Julien	b099008b94	stream: handle no stream scanning case ... Now that detect moves the raw progress forward, it's important to deal with the case where detect don't consider raw inspection. If no 'stream' rules are active, disable raw. For this the disable raw flag is now per stream.	9 years ago
Victor Julien	5ee68ca2b2	http_header: remove old files	10 years ago
Victor Julien	a1465bc4fa	detect-engine-mpm: api cleanup	10 years ago
Victor Julien	779d40cedf	detect: remove hardcoded sm_list logic from setup ... Introduce utility functions to aid this.	10 years ago
Victor Julien	f370e88135	detect: move init only Signature members to init_data	10 years ago
Victor Julien	4978a7a133	detect: reorganize id's in prep of dynamic lists	10 years ago
Victor Julien	8edc954e82	detect: get rid of Signature::sm_lists ... Instead use the lists in init_data during setup and the SigMatchData arrays during runtime.	10 years ago
Sascha Steinbiss	e6044aaf1c	mpm/spm: check for SSSE3 and enable/disable HS ... The new Hyperscan 4.4 API provides a function to check for SSSE3 presence at runtime. This allows us to fall back to non-Hyperscan matchers on systems without SSSE3 even when the suricata executable is built with Hyperscan support. Addresses Redmine issue #2010. Signed-off-by: Sascha Steinbiss <sascha@steinbiss.name> Tested-by: Arturo Borrero Gonzalez <arturo@debian.org>	10 years ago
Victor Julien	879c3d8ad7	detect: fix scan-build 0-size alloc warnings	10 years ago
Victor Julien	9a0bbd6239	detect mpm: small optimization	10 years ago
Victor Julien	ad3c97f470	detect-mpm: cleanup	10 years ago
Victor Julien	960461f4db	fast_pattern: register app layer mpms automatically ... Allow for duplicate registrations for the same list. After the first registration new calls will be ignored.	10 years ago
Victor Julien	6dd4dff7b2	mpm: remove empty app_mpms table	10 years ago
Victor Julien	e68b2214e5	tls: register mpm from keywords	10 years ago
Victor Julien	57ae3c43e5	dns_query: register mpm from keyword	10 years ago
Victor Julien	a1a2187a0c	http_cookie: register mpm from keyword	10 years ago
Victor Julien	74661449e0	http_raw_host: register mpm from keyword	10 years ago
Victor Julien	b5cd4889ae	http_host: register mpm from keyword	10 years ago
Victor Julien	91695c81aa	http_client_body: register mpm from keyword	10 years ago
Victor Julien	644d4dc61b	http_stat_code: register mpm from keyword	10 years ago
Victor Julien	cf96db095a	http_stat_msg: register mpm from keyword	10 years ago
Victor Julien	43b281a510	file_data: register mpm from keyword	10 years ago
Victor Julien	6d0632a9c6	http_method: register mpm from keyword	10 years ago
Victor Julien	e4ea38a8de	http_raw_header: register mpm from keyword	10 years ago
Victor Julien	7813a834d0	http_user_agent: register mpm from keyword	10 years ago
Victor Julien	7b98c0073f	http_header: register mpm from keyword	10 years ago
Victor Julien	38e018e2d3	http_raw_uri: register mpm from keyword	10 years ago
Victor Julien	7289d12f1b	http_uri: register mpm from keyword	10 years ago
Victor Julien	5b2e36a1b0	mpm: add App Layer MPM registery ... Register keywords globally at start up. Create a map of the registery per detection engine. This we need because the sgh_mpm_context value is set per detect engine. Remove APP_MPMS_MAX.	10 years ago
Victor Julien	732921922a	detect mpm: consider sgh direction when adding rules	10 years ago
Victor Julien	9187c20782	detect mpm: negated setup fix	10 years ago
Victor Julien	56239690d0	prefilter: implement prefilter keyword ... Introduce prefilter keyword to force a keyword to be used as prefilter. e.g. alert tcp any any -> any any (content:"A"; flags:R; prefilter; sid:1;) alert tcp any any -> any any (content:"A"; flags:R; sid:2;) alert tcp any any -> any any (content:"A"; dsize:1; prefilter; sid:3;) alert tcp any any -> any any (content:"A"; dsize:1; sid:4;) In sid 2 and 4 the content keyword is used in the MPM engine. In sid 1 and 3 the flags and dsize keywords will be used.	10 years ago
Victor Julien	85cb749e8b	detect cleanup: remove sgh mpm_ctx pointers	10 years ago
Victor Julien	82d3c0b520	sgh: remove unused flags	10 years ago
Victor Julien	08407b6d47	tls: mpm prefilter engines	10 years ago
Victor Julien	7acdc66061	smtp file_data: mpm prefilter engine	10 years ago
Victor Julien	0019a7bd9f	http_raw_header: mpm prefilter engine ... Register for both regular headers and trailer.	10 years ago
Victor Julien	cef12ed80f	http_server_body / file_data: mpm prefilter engine	10 years ago
Victor Julien	5646dd9ecf	http_client_body: mpm prefilter engine	10 years ago
Victor Julien	9b6fd6bb48	http_headers: mpm prefilter engines ... Register for both regular headers and trailers.	10 years ago
Victor Julien	9cab3ea2cd	http_stat_code: mpm prefilter engine	10 years ago
Victor Julien	4d57b2fc63	http_stat_msg: mpm prefilter engine	10 years ago
Victor Julien	86d303e32b	http_raw_host: mpm prefilter engine	10 years ago
Victor Julien	5218849213	http_host: mpm prefilter engine	10 years ago
Victor Julien	61c3748fc4	http_user_agent: mpm prefilter engine	10 years ago
Victor Julien	a43a69305d	http_cookie: mpm prefilter engine	10 years ago
Victor Julien	7a46364e42	http_raw_uri: mpm prefilter engine	10 years ago
Victor Julien	746a169127	dns_query: mpm prefilter engine	10 years ago
Victor Julien	9ff5703c49	packet/stream: mpm prefilter engine	10 years ago
Victor Julien	72f2a78b1f	http_method: mpm prefilter engine	10 years ago
Victor Julien	b62c4cc359	http_uri: mpm prefilter engine ... Inspect partial request line as well.	10 years ago
Victor Julien	4c0ab681f2	mpm: remove Cleanup API call ... It's unused by all of the implementations.	10 years ago
Mats Klepsland	4172c4c8ac	tls: add (mpm) keyword tls_cert_subject ... This keyword is a replacement for tls.subject.	10 years ago
Mats Klepsland	9b2717799c	tls: add (mpm) keyword tls_cert_issuer ... This keyword is a replacement for tls.issuerdn.	10 years ago
Victor Julien	ec0217f52c	detect: minor style fixes	10 years ago
Victor Julien	b3bf7a5729	output: introduce config and perf output levels ... Goal is to reduce info output	10 years ago
Victor Julien	371113e21e	ac-ks: don't allow use on big-endian	10 years ago
Justin Viiret	c9d0d6f698	mpm: add "auto" default for mpm-algo ... Setting mpm-algo to "auto" will use "hs" if Suricata was built against Hyperscan, and "ac" otherwise (or "ac-tile" on Tilera platforms).	10 years ago
Mats Klepsland	a13df67864	detect: add (mpm) keyword for tls_sni ... Match on server name indication (SNI) extension in TLS using tls_sni keyword, e.g: alert tls any any -> any any (msg:"SNI test"; tls_sni; content:"example.com"; sid:12345;)	10 years ago
maxtors	9d3fd82849	Removed duplicate include statements.	10 years ago
Victor Julien	d085362e61	detect: fix error handling in mpm setup ... *** CID 1358124: Null pointer dereferences (REVERSE_INULL) /src/detect-engine-mpm.c: 940 in MpmStoreSetup() 934 PopulateMpmHelperAddPatternToPktCtx(ms->mpm_ctx, 935 cd, s, 0, (cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP)); 936 } 937 } 938 } 939 >>> CID 1358124: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "ms->mpm_ctx" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 940 if (ms->mpm_ctx != NULL) { 941 if (ms->mpm_ctx->pattern_cnt == 0) { 942 MpmFactoryReClaimMpmCtx(de_ctx, ms->mpm_ctx); 943 ms->mpm_ctx = NULL; 944 } else { 945 if (ms->sgh_mpm_context == MPM_CTX_FACTORY_UNIQUE_CONTEXT) {	10 years ago
Victor Julien	5b1d75f0bd	detect: suppress output	10 years ago
Victor Julien	ac2c206359	mpm: clean up builtin mpm setup, enable single/full	10 years ago
Victor Julien	6ef27c9f92	mpm: allow app buffer shared/unique ... Allow setting of shared or unique setting per app buffer type: e.g. detect.mpm.http_uri.shared=true	10 years ago
Victor Julien	79a96b2b90	mpm: refactor 'single' setup handling	10 years ago
Victor Julien	157ca89dd7	mpm: remove useless flag from factory	10 years ago
Victor Julien	87f3adbe4c	detect/mpm: unify packet/stream mpm_ctx pointers ... SGH's for tcp and udp are now always only per proto and per direction. This means we can simply reuse the packet and stream mpm pointers. The SGH's for the other protocols already used a directionless catch all mpm pointer.	10 years ago
Victor Julien	6bb2b001a3	mpm: cleanup: move mpm funcs into buffer specific files	10 years ago
Victor Julien	c880b79f45	detect: shrink sgh ... Turn list of mpm_ctx pointers into a union so that we don't waste space. The sgh's for tcp and udp are in one direction only, so the ts and tc ones are now in the union.	10 years ago
Victor Julien	c804102a9a	detect: move app_mpms array to init data	10 years ago
Victor Julien	9b3d4f7e24	mpm: unify & localize mpm pattern (id) handling ... So far, the patterns as passed to the mpm's would use global id's that were shared among all buffers, directions. This would lead to a fairly large pattern id space. As the mpm algo's use the pattern id's to prevent duplicate matching through a pattern id based bitarray, shrinking this space will optimize performance. This patch implements this. It sets a flag before adding the pattern to the mpm ctx, instructing the mpm to ignore the provided pid and handle pids management itself. This leads to a shrinking of the bitarray size. This is made possible by the previous work that removes the pid logic from the code. Next to this, this patch moves the pattern setup stage to common util functions. This avoids code duplication. Update ac, ac-bs and ac-ks to use this.	10 years ago
Victor Julien	ba9d43cce5	mpm: improve negated mpm ... The idea is: if mpm is negated, it's both on mpm and nonmpm sid lists and we can kick it out in that case during the merge sort. It only works for patterns that are 'independent'. This means that the rule doesn't need to only match if the negated mpm pattern is limited to the first 10 bytes for example. Or more generally, an negated mpm pattern that has depth, offset, distance or within settings can't be handled this way. These patterns are not added to the mpm at all, but just to to non-mpm list. This makes sense as they will *always* need manual inspection. Similarly, a pattern that is 'chopped' always needs validation. This is because in this case we only inspect a part of the final pattern.	10 years ago
Victor Julien	9e71ef4c3b	detect: remove signature pattern id reference	10 years ago
Victor Julien	c1ad08d11e	detect: remove stream pmq array	10 years ago
Victor Julien	4e8e591715	detect mpm: mpm store cleanup ... Move all rule modification to the fast_pattern assigment.	10 years ago
Victor Julien	c87fcb29ff	detect mpm: fast_pattern assignment cleanup	10 years ago
Victor Julien	7c94077892	detect mpm: remove unused mpm flags	10 years ago
Victor Julien	a34be23002	detect: simplify negated mpm handling	10 years ago
Victor Julien	e48d745ed7	mpm: constify search func args	10 years ago
Victor Julien	26517b8b61	detect: mpm store frees mpm_ctx' it owns	10 years ago
Victor Julien	102a82fc7b	detect: use mpm store for app layer mpms ... Rework app-layer mpm setup and registration to make this possible.	10 years ago
Victor Julien	fac2cc0560	detect: mpm deduplication ... Create hash for mpm's that we can reuse. Have packet/stream mpms use this.	10 years ago