Commit Graph

42 Commits (9dc153c8f4b318480769b7c984271d49b12c8e5f)

Author SHA1 Message Date
Victor Julien 89f83e714c Introduce http_server_body keyword.
The http_server_body content modifier modifies the previous content to inspect
the normalized (dechunked, unzipped) http_server_body. The workings are similar
to http_client_body. Additionally, a new pcre flag was introduced "/S".

To facilitate this change the signature flags field was changed to be 64 bit.
14 years ago
Victor Julien 047fcd6ade Add missing case sensitive to insensitive conversions for http_header, http_raw_header, http_method, http_cookie and http_raw_uri with 'nocase' set. 14 years ago
Anoop Saldanha 966119b6aa support for http_raw_uri keyword + mpm engine 14 years ago
Anoop Saldanha c9897a44a4 fast pattern support for http_cookie. Also support relative modifiers 15 years ago
Anoop Saldanha bbbedaf963 fast pattern support for http_method. Also support relative modifiers 15 years ago
Anoop Saldanha 7ec0382774 support fast pattern for http raw header. Also support relative modifiers for http raw header 15 years ago
Anoop Saldanha c61c68fd36 mpm and fast pattern support for http_header. Also support relative modifiers for http_header 15 years ago
Anoop Saldanha 5c6a65dc58 support relative modifiers for http_client_body. Introduce body processing engine in detect-engine-hcbd.[ch] 15 years ago
Anoop Saldanha 4c53a9d606 unifying content structure - http_header now uses DetectContentData 15 years ago
Anoop Saldanha 1957eee389 unifying content structure - http_method now uses DetectContentData 15 years ago
Anoop Saldanha 041f5b1a4f unifying content structure - http_cookie now uses DetectContentData 15 years ago
Anoop Saldanha f05b0f4e1e unifying content structure - http_client_body now uses DetectContentData 15 years ago
Anoop Saldanha 4883efd0f6 unifying content structure - uricontent now uses DetectContentData 15 years ago
Anoop Saldanha 4a038511ff Change the struct members uricontent and uricontent_len in DetectUricontentData to content and content_len. Make replacements everywhere else in the codebase to accomodate these changes 15 years ago
Anoop Saldanha a7353be20d replace all Signature->amatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_AMATCH] 15 years ago
Anoop Saldanha e0476242c6 replace all Signature->umatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_UMATCH] 15 years ago
Anoop Saldanha e54358a9e1 replace all Signature->pmatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_PMATCH] 15 years ago
William Metcalf 7b13ba9f9e Fixed broken nocase for http_method and http_header 15 years ago
Victor Julien 70b32f7380 First stab at creating a stateful detection engine.
Stateful detection for app layer detection keywords, except uricontent. Stores it's partial results in the flow structure. Other modifications:

- Generalize transaction tracking, logging and inspection.
- Adapt http and dcerpc to use the new transaction handling.
- Stream engine now always notifies app layer of a stream eof.

This commit fixes bug #124.
15 years ago
Gerardo Iglesias Galvan 9f4fae5b1a Fix inconsistent use of dynamic memory allocation 15 years ago
William Metcalf ce01927515 Import of GPLv2 Header 050410 15 years ago
Pablo Rincon a152623e11 Bug 130: detect-nocase was not recreating the BmCtx with nocase chars, so it was not working with patterns of capital letters as expected 15 years ago
Pablo Rincon 9209eaeaf6 Fix some error messages and coding style at uri/content modifiers 15 years ago
Victor Julien 531594a35f Small error message and comment update to the nocase keyword. 15 years ago
Anoop Saldanha a9d3a85b56 support nocase and negation for http_cookie 15 years ago
Victor Julien ced401b554 Update http_client_body code to recent changes. 16 years ago
Anoop Saldanha 97d49d8f5e support for http_client_body keyword 16 years ago
Pablo Rincon c7350a8ac6 Fixing some naming convention issues and incorrect error messages 16 years ago
Pablo Rincon b708d7f65d Adding Uricontent inspection with spm. Modifiers for uricontent are now supported 16 years ago
Victor Julien dd846c9b0e Remove all search code from the pattern matchers, cleanup mpm api, remove unused http code, more cleanups. 16 years ago
Victor Julien f298fec872 Make sure nocase applies to the last pattern, content or uricontent. 16 years ago
Victor Julien 8b30226914 Detection keyword cleanup 16 years ago
Victor Julien bef70a04ce First stage of detect engine redesign: equal patterns share id's, search phase no longer used, new match verification phase. 16 years ago
Gerardo Iglesias Galvan ba6d807a6e Improve information about errors on signature failure 16 years ago
Victor Julien ae94b102cb Improve distance/within/nocase handling, sig parsing error reporting. 16 years ago
Victor Julien ecf86f9c23 Rename to Suricata. 16 years ago
Gurvinder Singh a991ab0a19 added sigmatch payload flag 16 years ago
Victor Julien 0d0ffb9963 Reorganize header inclusions. 16 years ago
Brian Rectanus fa5939ca91 64 bit cleanup part2 16 years ago
Victor Julien 5df5b35e90 Put all globals in the detection engine ctx. Add HashList type, a hash that also stores the items ina list to it can be traversed. Many cleanups. 16 years ago
Victor Julien ac60f32197 Make nocase keyword initilization failure fatal and slightly improve the error message it prints. 16 years ago
Victor Julien bab4b62376 Initial add of the files. 16 years ago