245 Commits (9cab3ea2cdf78e815714febcf364317fb7072f60)

Author	SHA1	Message	Date
Victor Julien	9cab3ea2cd	http_stat_code: mpm prefilter engine	9 years ago
Victor Julien	4d57b2fc63	http_stat_msg: mpm prefilter engine	9 years ago
Victor Julien	86d303e32b	http_raw_host: mpm prefilter engine	9 years ago
Victor Julien	5218849213	http_host: mpm prefilter engine	9 years ago
Victor Julien	61c3748fc4	http_user_agent: mpm prefilter engine	9 years ago
Victor Julien	a43a69305d	http_cookie: mpm prefilter engine	9 years ago
Victor Julien	7a46364e42	http_raw_uri: mpm prefilter engine	9 years ago
Victor Julien	746a169127	dns_query: mpm prefilter engine	9 years ago
Victor Julien	9ff5703c49	packet/stream: mpm prefilter engine	9 years ago
Victor Julien	72f2a78b1f	http_method: mpm prefilter engine	9 years ago
Victor Julien	b62c4cc359	http_uri: mpm prefilter engine ... Inspect partial request line as well.	9 years ago
Victor Julien	4c0ab681f2	mpm: remove Cleanup API call ... It's unused by all of the implementations.	9 years ago
Mats Klepsland	4172c4c8ac	tls: add (mpm) keyword tls_cert_subject ... This keyword is a replacement for tls.subject.	9 years ago
Mats Klepsland	9b2717799c	tls: add (mpm) keyword tls_cert_issuer ... This keyword is a replacement for tls.issuerdn.	9 years ago
Victor Julien	ec0217f52c	detect: minor style fixes	9 years ago
Victor Julien	b3bf7a5729	output: introduce config and perf output levels ... Goal is to reduce info output	9 years ago
Victor Julien	371113e21e	ac-ks: don't allow use on big-endian	9 years ago
Justin Viiret	c9d0d6f698	mpm: add "auto" default for mpm-algo ... Setting mpm-algo to "auto" will use "hs" if Suricata was built against Hyperscan, and "ac" otherwise (or "ac-tile" on Tilera platforms).	9 years ago
Mats Klepsland	a13df67864	detect: add (mpm) keyword for tls_sni ... Match on server name indication (SNI) extension in TLS using tls_sni keyword, e.g: alert tls any any -> any any (msg:"SNI test"; tls_sni; content:"example.com"; sid:12345;)	9 years ago
maxtors	9d3fd82849	Removed duplicate include statements.	9 years ago
Victor Julien	d085362e61	detect: fix error handling in mpm setup ... *** CID 1358124: Null pointer dereferences (REVERSE_INULL) /src/detect-engine-mpm.c: 940 in MpmStoreSetup() 934 PopulateMpmHelperAddPatternToPktCtx(ms->mpm_ctx, 935 cd, s, 0, (cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP)); 936 } 937 } 938 } 939 >>> CID 1358124: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "ms->mpm_ctx" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 940 if (ms->mpm_ctx != NULL) { 941 if (ms->mpm_ctx->pattern_cnt == 0) { 942 MpmFactoryReClaimMpmCtx(de_ctx, ms->mpm_ctx); 943 ms->mpm_ctx = NULL; 944 } else { 945 if (ms->sgh_mpm_context == MPM_CTX_FACTORY_UNIQUE_CONTEXT) {	9 years ago
Victor Julien	5b1d75f0bd	detect: suppress output	9 years ago
Victor Julien	ac2c206359	mpm: clean up builtin mpm setup, enable single/full	9 years ago
Victor Julien	6ef27c9f92	mpm: allow app buffer shared/unique ... Allow setting of shared or unique setting per app buffer type: e.g. detect.mpm.http_uri.shared=true	9 years ago
Victor Julien	79a96b2b90	mpm: refactor 'single' setup handling	9 years ago
Victor Julien	157ca89dd7	mpm: remove useless flag from factory	9 years ago
Victor Julien	87f3adbe4c	detect/mpm: unify packet/stream mpm_ctx pointers ... SGH's for tcp and udp are now always only per proto and per direction. This means we can simply reuse the packet and stream mpm pointers. The SGH's for the other protocols already used a directionless catch all mpm pointer.	9 years ago
Victor Julien	6bb2b001a3	mpm: cleanup: move mpm funcs into buffer specific files	9 years ago
Victor Julien	c880b79f45	detect: shrink sgh ... Turn list of mpm_ctx pointers into a union so that we don't waste space. The sgh's for tcp and udp are in one direction only, so the ts and tc ones are now in the union.	9 years ago
Victor Julien	c804102a9a	detect: move app_mpms array to init data	9 years ago
Victor Julien	9b3d4f7e24	mpm: unify & localize mpm pattern (id) handling ... So far, the patterns as passed to the mpm's would use global id's that were shared among all buffers, directions. This would lead to a fairly large pattern id space. As the mpm algo's use the pattern id's to prevent duplicate matching through a pattern id based bitarray, shrinking this space will optimize performance. This patch implements this. It sets a flag before adding the pattern to the mpm ctx, instructing the mpm to ignore the provided pid and handle pids management itself. This leads to a shrinking of the bitarray size. This is made possible by the previous work that removes the pid logic from the code. Next to this, this patch moves the pattern setup stage to common util functions. This avoids code duplication. Update ac, ac-bs and ac-ks to use this.	9 years ago
Victor Julien	ba9d43cce5	mpm: improve negated mpm ... The idea is: if mpm is negated, it's both on mpm and nonmpm sid lists and we can kick it out in that case during the merge sort. It only works for patterns that are 'independent'. This means that the rule doesn't need to only match if the negated mpm pattern is limited to the first 10 bytes for example. Or more generally, an negated mpm pattern that has depth, offset, distance or within settings can't be handled this way. These patterns are not added to the mpm at all, but just to to non-mpm list. This makes sense as they will *always* need manual inspection. Similarly, a pattern that is 'chopped' always needs validation. This is because in this case we only inspect a part of the final pattern.	9 years ago
Victor Julien	9e71ef4c3b	detect: remove signature pattern id reference	9 years ago
Victor Julien	c1ad08d11e	detect: remove stream pmq array	9 years ago
Victor Julien	4e8e591715	detect mpm: mpm store cleanup ... Move all rule modification to the fast_pattern assigment.	9 years ago
Victor Julien	c87fcb29ff	detect mpm: fast_pattern assignment cleanup	9 years ago
Victor Julien	7c94077892	detect mpm: remove unused mpm flags	9 years ago
Victor Julien	a34be23002	detect: simplify negated mpm handling	9 years ago
Victor Julien	e48d745ed7	mpm: constify search func args	9 years ago
Victor Julien	26517b8b61	detect: mpm store frees mpm_ctx' it owns	9 years ago
Victor Julien	102a82fc7b	detect: use mpm store for app layer mpms ... Rework app-layer mpm setup and registration to make this possible.	9 years ago
Victor Julien	fac2cc0560	detect: mpm deduplication ... Create hash for mpm's that we can reuse. Have packet/stream mpms use this.	9 years ago
Victor Julien	f0ba00e51d	detect: remove old unused code	9 years ago
Victor Julien	d82df4eb8b	detect-mpm: make sgh setup proto aware ... Allow multi-proto, multi-direction sgh's.	9 years ago
Victor Julien	66b3dba676	detect: remove dead code	9 years ago
Victor Julien	b3dcdb10be	detect mpm: remove dead code	9 years ago
Victor Julien	14d9ce7b2e	detect/mpm: remove unused max_id param from API	9 years ago
Victor Julien	0d3f671b55	detect: constify mpm/detect funcs	9 years ago
Justin Viiret	c37195c95f	mpm: pass offset, depth args to add functions ... MpmAddPatternCI and MpmAddPatternCS had arguments for offset and depth, but these were not being passed in by the caller.	9 years ago
Victor Julien	9c5ee76455	tcp: fix unlikely NULL-ptr dereference ... If a TCP packet could not get a flow (flow engine out of flows/memory) and there were *only* TCP inspecting rules with the direction explicitly set to 'to_server', a NULL pointer deref could happen. PacketPatternSearchWithStreamCtx would fall through to the 'to_client' case which was not initialized.	9 years ago