91 Commits (7f474af1d01eaf9407afc54f38a47b4a189bc92e)

Author	SHA1	Message	Date
Jason Ish	2e440169d6	lua: remove lua as a compile time feature ... Its always built-in. However, can be disabled at runtime.	2 years ago
Victor Julien	3e8db97687	detect/bytemath: fix u32 buffer size logic ... Remove u16 cast. Remove debug assert for u16 size. In 83ed2c3b97 the input was changed to u32	3 years ago
Victor Julien	e3f2b3418a	detect/content-inspect: use of replace keyword is rare ... Hint compiler about this.	3 years ago
Victor Julien	101452056d	detect/bytejump: don't reuse content flag ... To avoid future problems with overlapping flag values, give bytejump its own DETECT_BYTEJUMP_OFFSET_VAR flag. The values are currently not overlapping, so this patch should have no side effects.	3 years ago
Victor Julien	53591702aa	detect/bytemath: pass match ctx directly ... Adjust includes to enable this.	3 years ago
Victor Julien	6db02563f1	detect/isdataat: optimize recursion mismatches ... Since recursive content matching goes through the buffer from left to right, it is possible to bail early when isdataat is part of the recursive checking. If `isdataat:50,relative` fails for offset 10, it will surely also fail for offset 20. So break inspection in such cases. The exception is for dynamic isdataat, where the value is determined by a prior byte_extract that may be updated during the recursion.	3 years ago
Victor Julien	c19d11ff0d	detect/content-inspect: flatten branches ... Flatten else branches after terminating ifs.	3 years ago
Victor Julien	4cce7ba48b	detect/content-inspect: localize recursion counting ... Use stack local var instead of DetectEngineThreadCtx member. Instead setup a stack local struct that both counts and holds the limit. Make sure the limit is a const so we can avoid rereading it. This is part of an effort to reduce the size of the DetectEngineThreadCtx structure and reduce the number of memory writes to it. Additionally, it is part of an effect to reduce the number of places where detection tracks various forms of state.	3 years ago
Victor Julien	97f78e1b49	detect/content-inspect: reduce scope of internal func	3 years ago
Victor Julien	e9b33c48f0	detect/base64: move content inspection logic ... Integrate with rest of content inspect code.	3 years ago
Victor Julien	d73cce478c	detect/content-inspect: add entry for InspectionBuffer ... This is a convinience addition to abstract away the internals of the InspectionBuffer in keyword specific detection code.	3 years ago
Victor Julien	b357532e7e	detect/content-inspect: switch type of enum	3 years ago
Victor Julien	1f265d9d79	detect/content-inspect: assist branch prediction ... Hitting the recursion limit should be rare.	3 years ago
Victor Julien	0ba4b297df	detect/content-inspect: pass const to inspect func	3 years ago
Victor Julien	a7c9028f01	detect/content-inspect: reduce scope of variables	3 years ago
Victor Julien	d3ccff5822	detect/asn1: handle in PMATCH ... Since the asn1 keyword is processing payload data, move the handling of the keyword into the PMATCH with content inspection. Use u32 as buffer length in the Rust FFI	3 years ago
Victor Julien	9639da32b7	detect/content-inspect: minor code cleanups	3 years ago
Victor Julien	3d7e0927bf	detect/content: minor code/comment cleanups	3 years ago
Victor Julien	8ba7f23c9b	detect/content: use const pointer where possible	3 years ago
Victor Julien	6cf0e4d604	detect/content-inspect: keyword context as const	3 years ago
Victor Julien	7f42506760	detect: reimplement discontinue matching logic ... Previously various steps in the content inspection logic would use a variable in the DetectEngineThreadCtx to flag that matching should be discontinued. This patch reimplements this logic by using a new return code instead. Split content inspection into public and private version, so that common initialization can be done in a single place. Update the callsites.	3 years ago
Victor Julien	80f13b93aa	detect/urilen: fix discontinue matching logic ... Actually discontinue matching. Fixes: 21f9cc3a39 ("discontinue matching on buffer if urilen returns a match failure.")	3 years ago
Jeff Lucovsky	27a665546b	detect/bytejump: Change DoMatch signature to return bool ... Issue: 4624 Change the function signature of byte-jump's domatch from an int to a bool to avoid ambiguity handling return values.	3 years ago
Jeff Lucovsky	690b65ae88	detect/byte_math: Permit var name for bytes value ... Issue: 6145 Modifications to permit a variable name to be used for the byte_math bytes value.	3 years ago
Jeff Lucovsky	fb847d8bb0	detect/byte_math: Use proper index for rvalue var ... Use the proper index for extracting the rvalue variable value.	3 years ago
Jeff Lucovsky	3f118188e9	detect/bytejump: Allow nbytes to be a variable ... Issue: 6105 This commit adds the ability for nbytes to be a variable when used with the byte_jump keyword.	3 years ago
Jeff Lucovsky	da866356c0	detect/byte_test: Allow nbytes value to be a variable ... Issue: 6144 This commit allows the byte_test keyword to accept an existing variable name for a value (the value may still be specified directly as an integer). All nbytes values are subject to the same value constraints as before - 23 if included with string - 8 otherwise	3 years ago
Victor Julien	549f7873df	detect: spelling	3 years ago
Philippe Antoine	e80974966d	detect: allow 0-sized non-NULL buffers to match ... Such as a HTTP1 header with an empty value Ticket: #6025	3 years ago
Jeff Lucovsky	c083cbda33	detect/content: Negated endswith matches ... Issue: 5541 This commit handles negated endswith matches.	3 years ago
Victor Julien	b31ffde6f4	output: remove error codes from output	4 years ago
Victor Julien	39f5c7f56a	error: use SC_EINVAL for invalid input	4 years ago
Jeff Lucovsky	ccd1063e43	detect/bytemath: convert parser to Rust ... Issue: 5077 This commit - Converts the PCRE based parser to Rust. - Adds unit tests to the new Rust modules - Removes the PCRE parser from detect-bytemath.c - Adjusts the C source modules to refer to the Rust definitions - Includes the multiply operator (missing from the C parser)	4 years ago
Philippe Antoine	cfb60d0fce	detect: use generic integer functions for urilen ... Ticket: #4112	4 years ago
Philippe Antoine	b8524e70d9	detect: change InspectEngineFuncPtr2 to return uint8_t	4 years ago
Philippe Antoine	c5cf2967b3	detect: fix integer warnings ... Ticket: #4516	4 years ago
Victor Julien	27e9a871d0	detect/content-inspect: code cleanup ... Rearrange code slightly to make it more clear that `found` cannot be NULL further down the loop. cppcheck: src/detect-engine-content-inspection.c:316:50: warning: Either the condition 'found!=NULL' is redundant or there is overflow in pointer subtraction. [nullPointerArithmeticRedundantCheck] match_offset = (uint32_t)((found - buffer) + cd->content_len); ^ src/detect-engine-content-inspection.c:308:30: note: Assuming that condition 'found!=NULL' is not redundant } else if (found != NULL && (cd->flags & DETECT_CONTENT_NEGATED)) { ^ src/detect-engine-content-inspection.c:316:50: note: Null pointer subtraction match_offset = (uint32_t)((found - buffer) + cd->content_len); ^ Bug: #5291.	4 years ago
Shivani Bhardwaj	bac69af7e4	dcerpc: Add rust registration function ... Get rid of the C glue code and move registration completely to Rust.	5 years ago
Jeff Lucovsky	fb409664d2	detect: byte_math support	6 years ago
Jeff Lucovsky	620659b5f3	detect: Increase flag size for byte_jump	6 years ago
Jeff Lucovsky	aef24bee96	detect: Fix spelling errors	7 years ago
Jeff Lucovsky	f318a46d34	detect: Improve handling of variable values ... When one of offset/depth/distance is from a variable, adjust the depth by the offset as is done with scalar values at parse time.	7 years ago
Victor Julien	317376f59d	datasets: match on lists of data ... Datasets are sets/lists of data that can be accessed or added from the rule language. This patch implements 3 data types: 1. string (or buffer) 2. md5 3. sha256 The patch also implements 2 new rule keywords: 1. dataset 2. datarep The dataset keyword allows matching against a list of values to see if it exists or not. It can also add the value to the set. The set can optionally be stored to disk on exit. The datarep support matching/lookups only. With each item in the set a reputation value is stored and this value can be matched against. The reputation value is unsigned 16 bit, so values can be between 0 and 65535. Datasets can be registered in 2 ways: 1. through the yaml 2. through the rules The goal of this rules based approach is that rule writers can start using this without the need for config changes. A dataset is implemented using a thash hash table. Each dataset is its own separate thash.	7 years ago
Victor Julien	579cc9f02b	const: constify decoder, app-layer, detect funcs	7 years ago
Victor Julien	32fb7d773a	detect/content-inspect: turn void arg into Packet ... Replace the 'void *data' argument by a 'Packet *p' as this was the only user left of the data pointer.	7 years ago
Victor Julien	55db6d6fb4	detect/dcerpc: move endian handling from pointer to flags	7 years ago
Victor Julien	4d1fa4aaf9	detect: bsize keyword ... Allows matching on stickybuffers. Like dsize, it allows matching on exact values, greater than and less than, and ranges. For streaming buffers, such as HTTP bodies, the final size of the body is only known at the end of the transaction.	9 years ago
Victor Julien	d14e51a4aa	detect/content: pass START/END flags to inspection	9 years ago
Victor Julien	77c39b20f8	detect: handle very large byte_extract'ed values in isdataat	9 years ago
Victor Julien	68ddea0b26	detect: implement byte_extract support for isdataat	9 years ago