14 Commits (a2bc0080932e2971590b83011df109373f7aca66)

Author	SHA1	Message	Date
Victor Julien	996112edf5	pktvars: same name pktvars, key-value vars	9 years ago
Victor Julien	0f708d427b	pkt-var: abuse flowvar postmatch logic for pktvars ... Flowvars were already using a temporary store in the detect thread ctx. Use the same facility for pktvars. The reasons are: 1. packet is not always available, e.g. when running pcre on http buffers. 2. setting of vars should be done post match. Until now it was also possible that it is done on a partial match.	9 years ago
Victor Julien	22f3205664	var-names: expose outside of detect engine ... Until now variable names, such as flowbit names, were local to a detect engine. This made sense as they were only ever used in that context. For the purpose of logging these names, this needs a different approach. The loggers live outside of the detect engine. Also, in the case of reloads and multi-tenancy, there are even multiple detect engines, so it would be even more tricky to access them from the outside. This patch brings a new approach. A any time, there is a single active hash table mapping the variable names and their id's. For multiple tenants the table is shared between tenants. The table is set up in a 'staging' area, where locking makes sure that multiple loading threads don't mess things up. Then when the preparing of a detection engine is ready, but before the detect threads are made aware of the new detect engine, the active varname hash is swapped with the staging instance. For this to work, all the mappings from the 'current' or active mapping are added to the staging table. After the threads have reloaded and the new detection engine is active, the old table can be freed. For multi tenancy things are similar. The staging area is used for setting up until the new detection engines / tenants are applied to the system. This patch also changes the variable 'id'/'idx' field to uint32_t. Due to data structure padding and alignment, this should have no practical drawback while allowing for a lot more vars.	9 years ago
Victor Julien	2758f82515	flowvar: cleanups	9 years ago
Victor Julien	5111aa2ec0	detect-state: handle 'post match' locking ... The post match list was called with an unlocked flow until now. However, recent de_state handling updates changed this. The stateful detection code can now call the post match functions while keeping the flow locked. The normal detection code still calls it with an unlocked flow. This patch adds a hint to the DetectEngineThreadCtx called 'flow_locked' that is set to true if the caller has already locked the flow.	11 years ago
Ken Steele	b96645ded2	Create a wrapper around DetectFlowvarProcessList() to check for empty list ... Creates an inline wrapper to check for flowvarlist == NULL before calling DetectFlowvarProcessList() to remove the overhead of checking since the list is usually empty.	11 years ago
Victor Julien	6e18ed0489	luajit flowvar support ... This patch adds flowvar support to luajit. It does so by exposing two special C functions to the luajit scripts: ScFlowvarGet and ScFlowvarSet.	12 years ago
Victor Julien	4cd736fcc9	flowvar: fix deadlock with http buffers ... Bug #802 Flowvars are set from pcre, and lock the flow when being set. However when HTTP buffers were inspected, flow was already locked: deadlock. This patch introduces a post-match list in the detection engine thread ctx, where store candidates are kept. Then a post-match function is used to finalize the storing if the rule matches. Solves the deadlock and brings the handling of flowvars more in line with flowbits and flowints.	12 years ago
William Metcalf	ce01927515	Import of GPLv2 Header 050410	15 years ago
Gurvinder Singh	a0f184866c	http_cookie keywork support	16 years ago
Brian Rectanus	fa5939ca91	64 bit cleanup part2	16 years ago
Victor Julien	689bbfdc45	Rename all structure definitions in the "typedef struct _SomeStruct" format to "typedef struct SomeStruct_" to make the Doxygen output more useful. ... Remove the Trie multi pattern matcher code. It wasn't used anymore.	16 years ago
Victor Julien	ff4b5a5db7	Add support for flowbits.	16 years ago
Victor Julien	bab4b62376	Initial add of the files.	16 years ago