96 Commits (8fe9faecb2a1584ef6e706d5ee4ee914e4fe8ef0)

Author	SHA1	Message	Date
Jeff Lucovsky	fb409664d2	detect: byte_math support	6 years ago
Victor Julien	26bcc97515	detect/keywords: dynamic version part of doc URL	7 years ago
Jeff Lucovsky	d3a65fe156	detect: Provide `de_ctx` to free functions ... This commit makes sure that the `DetectEngineCtx *` is available to each detector's "free" function.	7 years ago
Shivani Bhardwaj	0e4f261224	Use StringParse* for all parsers and configurations	7 years ago
Jeff Lucovsky	e0bd79670c	detect: byte-test convert neg_op flag to a bool ... Only 8 flags are permitted so convert one of them to a struct member. I choose neg_op	7 years ago
Jeff Lucovsky	313c23a26b	detect: Add unittests to exercise bitmask	7 years ago
Jeff Lucovsky	d12950c9e4	detect: fixup incorrect comments, indentation	7 years ago
Jeff Lucovsky	31ed9786f6	detect: byte_test impl for bitmask ... This commit implements byte_test's bitmask feature.	7 years ago
Jeff Lucovsky	7f6af10fed	general: copyright bump	7 years ago
Jeff Lucovsky	4b0085b03c	detect: Update to take advantage of PCRE refactor ... This commit changes the keyword detectors to use the refactored PCRE modifications from detect-parse.[ch]	7 years ago
Shivani Bhardwaj	d801c3e588	detect: Make keyword description consistent ... Closes redmine ticket #3137.	7 years ago
Shivani Bhardwaj	b5b429c288	detect: Add missing keyword URLs and description ... Add missing keyword URLs and their description. Fix the ones that were incorrect. Partially closes redmine ticket #2974.	7 years ago
Victor Julien	579cc9f02b	const: constify decoder, app-layer, detect funcs	7 years ago
Shivani Bhardwaj	85b56b633e	detect: Improve rule keyword alproto registration ... 1. Set WARN_UNUSED macro on DetectSignatureSetAppProto. 2. Replace all direct 'sets' of Signature::alproto from keyword registration. Closes redmine ticket #3006.	7 years ago
Victor Julien	14896365ef	detect: remove Threadvars argument from API calls ... Remove it as it's (almost) never used. If it is really needed it can be accessed through DetectEngineThreadCtx::tv as well.	7 years ago
Victor Julien	9a14cb252d	detect/bytetest: debug cleanup	8 years ago
Victor Julien	94191ea960	detect/bytetest: don't print errors at runtime	8 years ago
Victor Julien	5283796018	bytetest: don't leak memory in error condition	8 years ago
Victor Julien	313661451d	content inspection: support transforms ... Make sure content is applied to the transformed version of a buffer. Support content with its modifiers, and also isdataat, pcre, bytetest and bytejump.	9 years ago
Victor Julien	ab1200fbd7	compiler: more strict compiler warnings ... Set flags by default: -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wwrite-strings -Wcast-align -Wbad-function-cast -Wformat-security -Wno-format-nonliteral -Wmissing-format-attribute -funsigned-char Fix minor compiler warnings for these new flags on gcc and clang.	10 years ago
Victor Julien	cc4010343d	detect: add and use util func for alproto sets	10 years ago
Victor Julien	dfac5276b8	detect: remove unused SIGMATCH_PAYLOAD flag	10 years ago
Victor Julien	fe415ae518	detect: remove DMATCH list	10 years ago
Victor Julien	6bd37611ee	file_data: dynamic buffer	10 years ago
Victor Julien	779d40cedf	detect: remove hardcoded sm_list logic from setup ... Introduce utility functions to aid this.	10 years ago
Victor Julien	f370e88135	detect: move init only Signature members to init_data	10 years ago
Victor Julien	8edc954e82	detect: get rid of Signature::sm_lists ... Instead use the lists in init_data during setup and the SigMatchData arrays during runtime.	10 years ago
Victor Julien	39613778cd	detect: make setup/free/match funcs static where possible	10 years ago
Victor Julien	bfd4bc8233	detect: constify Signature/SigMatch use at runtime	10 years ago
Victor Julien	e67ae0f174	detect keywords: use parse regex util func	11 years ago
Jason Ish	796dd5223b	tests: no longer necessary to provide successful return code ... 1 pass, 0 is fail.	11 years ago
Giuseppe Longo	41a1a9f4af	find and replace HSBDMATCH by FILEDATA ... This commit do a find and replace of the following: - DETECT_SM_LIST_HSBDMATCH by DETECT_SM_LIST_FILEDATA sed -i 's/DETECT_SM_LIST_HSBDMATCH/DETECT_SM_LIST_FILEDATA/g' src/* - HSBD by FILEDATA: sed -i 's/HSBDMATCH/FILEDATA/g' src/*	12 years ago
Ken Steele	923a77e952	Change Match() function to take const SigMatchCtx* ... The Match functions don't need a pointer to the SigMatch object, just the context pointer contained inside, so pass the Context to the Match function rather than the SigMatch object. This allows for further optimization. Change SigMatch->ctx to have type SigMatchCtx* rather than void* for better type checking. This requires adding type casts when using or assigning it. The SigMatch contex should not be changed by the Match() funciton, so pass it as a const SigMatchCtx*.	12 years ago
Jason Ish	a18e2ef402	Bug 1230: Check all SigMatch lists for a named byte_extract variable.	12 years ago
Ken Steele	8f1d75039a	Enforce function coding standard ... Functions should be defined as: int foo(void) { } Rather than: int food(void) { } All functions where changed by a script to match this standard.	12 years ago
Victor Julien	3fa958b9a7	byte_extract/test/jump: fix coverity issues ... During keyword setup there was a path that in theory could lead to indexing an array with a negative int. Coverity 992695, 400605, 400604	13 years ago
Victor Julien	7292998a58	Content: set up sticky buffers like file_data and dce_stub_data w/o flags, but with a list variable	14 years ago
Anoop Saldanha	c3d98f9640	Fix the bug specified in the previous commit. ... Bug emanates from byte_test, byte_jump and byte_extract keyword being unable to handle negative offsets when the inspection pointer is at the end of the buffer.	14 years ago
Victor Julien	0fbfaadd53	bytetest: fix debug messages not printing negative offset correctly	14 years ago
Anoop Saldanha	0b5d277254	code cleanup for all content based keywords.	14 years ago
Anoop Saldanha	51dcf19817	turn dce_stub_data into a sticky buffer.	14 years ago
Anoop Saldanha	a308d718ae	Allow the use of relative without the presence of a related previous keyword.	14 years ago
Last G	8ae11f73b2	Added parentheses to fix Eclipse static code analysis ... Fixed bug in action priority (REJECT_DST had lowest prio)	14 years ago
Victor Julien	84bad6db77	Silence compiler warnings found by clang	14 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	14 years ago
Victor Julien	40fcae3aa0	Minor unittest fixes to make Coverity happy.	15 years ago
Anoop Saldanha	1acb7cdc7d	All http_server_body modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_SERVER_BODY	15 years ago
Anoop Saldanha	4810ee9c5f	All uricontent modified patterns now are DETECT_CONTENT and not DETECT_URICONTENT. Step towards unifying all content based patterns. Makes way for easier management of patterns	15 years ago
Anoop Saldanha	ac68c3f893	code cleanup - replace SigMatchAppendDcePayload with SigMatchAppendSMToList	15 years ago
Anoop Saldanha	6cab663bf0	code cleanup - replace SigMatchAppendPayload with SigMatchAppendSMToList	15 years ago