53 Commits (a2bc0080932e2971590b83011df109373f7aca66)

Author	SHA1	Message	Date
Victor Julien	a499a44f7a	detect: move buffer type map into detect ctx ... Move previously global table into detect engine ctx. Now that we can register buffers at rule loading time we need to take concurrency into account. Move DetectBufferType to detect.h and update DetectBufferCtx API calls to include a detect engine ctx reference.	8 years ago
Victor Julien	f6e5cb1db6	detect: prefilter/inspect API v2, with transforms ... Introduce InspectionBuffer a structure for passing data between prefilters, transforms and inspection engines. At rule parsing time, we'll register new unique 'DetectBufferType's for a 'parent' buffer (e.g. pure file_data) with its transformations. Each unique combination of buffer with transformations gets it's own buffer id. Similarly, mpm registration and inspect engine registration will be copied from the 'parent' (again, e.g. pure file_data) to the new id's. The transforms are called from within the prefilter engines themselves. Provide generic MPM matching and setup callbacks. Can be used by keywords to avoid needless code duplication. Supports transformations. Use unique name for profiling, to distinguish between pure buffers and buffers with transformation. Add new registration calls for mpm/prefilters and inspect engines. Inspect engine api v2: Pass engine to itself. Add generic engine that uses GetData callback and other registered settings. The generic engine should be usable for every 'simple' case where there is just a single non-streaming buffer. For example HTTP uri. The v2 API assumes that registered MPM implements transformations. Add util func to set new transform in rule and add util funcs for rule parsing.	8 years ago
Jason Ish	73d1e4bc84	detect-parse: don't use pcre for rule parsing ... Don't use pcre for the high level rule parsing, instead using a tokenizing parser for breaking out the rule into keywords and options. Much faster, especially on older CPUs. Should also allow us to provide better context where a rule parse error occurs.	8 years ago
Victor Julien	ab1200fbd7	compiler: more strict compiler warnings ... Set flags by default: -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wwrite-strings -Wcast-align -Wbad-function-cast -Wformat-security -Wno-format-nonliteral -Wmissing-format-attribute -funsigned-char Fix minor compiler warnings for these new flags on gcc and clang.	8 years ago
Victor Julien	cc4010343d	detect: add and use util func for alproto sets	9 years ago
Victor Julien	d2f77978ec	detect-parse: content modifier cleanup	9 years ago
Victor Julien	779d40cedf	detect: remove hardcoded sm_list logic from setup ... Introduce utility functions to aid this.	9 years ago
Victor Julien	0a5ae415b8	detect: shrink Signature::sm_arrays ... Signature::sm_arrays now only contains 'built-in' lists, and so is sized appropriately.	9 years ago
Victor Julien	c4dcb20522	detect-parse: add new func to get last sigmatch ... Add SigMatchGetLastSM which simply returns the very last SM added to the signature. Minor cleanups.	9 years ago
Victor Julien	1c8775b340	QA: --afl-rules for faster rule fuzzing	9 years ago
Victor Julien	4a2e816bea	detect parser: add parse regex util function ... Add regex setup and free util functions. Keywords often use a regex to parse rule input. Introduce a common function to do this setup. Also create a list of registered regexes to free at engine shutdown.	9 years ago
Victor Julien	92c571b26d	detect: move sm_list to string funcs to parser code	9 years ago
Victor Julien	0d3f671b55	detect: constify mpm/detect funcs	9 years ago
Victor Julien	f5f148805c	app layer: uint16_t alproto -> AppProto alproto ... This conversion was missing in a couple of places.	12 years ago
Victor Julien	19511cda97	Remove obsolete DetectParseContentString function, it has been replaced by DetectContentDataParse	12 years ago
Anoop Saldanha	f8ae53ac02	Further customize content modifier buffer registration. ... Allow modifier setups functions to have CustomCallbacks to enable their internal conditions.	13 years ago
Anoop Saldanha	a304a98d1d	http_* setup unified.	13 years ago
Anoop Saldanha	93d7a6e671	code cleanup. Remove unused functions	14 years ago
Anoop Saldanha	eb07c345b8	code cleanup - replace SigMatchAppendThreshold with SigMatchAppendSMToList	14 years ago
Anoop Saldanha	dd7e710f35	code cleanup - replace SigMatchAppendPostMatch with SigMatchAppendSMToList	14 years ago
Anoop Saldanha	a4638fb0ad	code cleanup - replace SigMatchAppendPacket with SigMatchAppendSMToList	14 years ago
Anoop Saldanha	ff38d42bf1	code cleanup - replace SigMatchAppendTag with SigMatchAppendSMToList	14 years ago
Anoop Saldanha	ac68c3f893	code cleanup - replace SigMatchAppendDcePayload with SigMatchAppendSMToList	14 years ago
Anoop Saldanha	6cab663bf0	code cleanup - replace SigMatchAppendPayload with SigMatchAppendSMToList	14 years ago
Anoop Saldanha	c4cb37b8da	code cleanup - replace SigMatchAppendUricontent with SigMatchAppendSMToList	14 years ago
Anoop Saldanha	c9af50ea0c	code cleanup - replace SigMatchAppendAppLayer with SigMatchAppendSMToList	14 years ago
Anoop Saldanha	bbb9f35f26	code cleanup - replace SigMatchGetLastSM with SigMatchGetLastSMFromLists	14 years ago
Anoop Saldanha	acccf3a5a5	Add function declaration for SigInitReal	14 years ago
Victor Julien	c8c4a76dc6	Move threshold to it's own sig match list.	14 years ago
Victor Julien	6eeab37ab3	Add post-match list, move flowbits set, etc functions to it. Move flowint set, etc functions to it as well.	14 years ago
Victor Julien	70f0d3d2e7	Add negation to filename and fileext, use same syntax as with content.	14 years ago
Anoop Saldanha	9887084370	support multiple ipprotos in the same sig + unittest	14 years ago
Anoop Saldanha	2321a4dd58	support isdataat negation. Also fix addiing isdataat to appropriate lists	15 years ago
Anoop Saldanha	2b781f00d7	support relative pcre for client body. All pcre processing for client body moved to hcbd engine	15 years ago
Anoop Saldanha	ce8d27425d	fix signature parsing to how snort does it for content based keywords along with dce_stub_data	15 years ago
Anoop Saldanha	9ecade76b9	in case of duplicate signatures used the one with the latest revision	15 years ago
Pablo Rincon	eed0ef6e69	Adding tag keyword support	15 years ago
Anoop Saldanha	45ea0d914e	dce stub content keywords support using dcepayload.c support for all dce related content keywords	15 years ago
Victor Julien	0a607fce3d	Finish http_uri keyword, fix invalid read issue in one of the tests.	15 years ago
Victor Julien	70b32f7380	First stab at creating a stateful detection engine. ... Stateful detection for app layer detection keywords, except uricontent. Stores it's partial results in the flow structure. Other modifications: - Generalize transaction tracking, logging and inspection. - Adapt http and dcerpc to use the new transaction handling. - Stream engine now always notifies app layer of a stream eof. This commit fixes bug #124.	15 years ago
William Metcalf	ce01927515	Import of GPLv2 Header 050410	15 years ago
Pablo Rincon	c7350a8ac6	Fixing some naming convention issues and incorrect error messages	16 years ago
Pablo Rincon	b708d7f65d	Adding Uricontent inspection with spm. Modifiers for uricontent are now supported	16 years ago
Victor Julien	f298fec872	Make sure nocase applies to the last pattern, content or uricontent.	16 years ago
Victor Julien	b259e362cd	Convert uricontent to use new scanning methods as well. Move http_method and http_cookie keywords out of pmatch list for now.	16 years ago
Victor Julien	bef70a04ce	First stage of detect engine redesign: equal patterns share id's, search phase no longer used, new match verification phase.	16 years ago
Brian Rectanus	c22d42693a	Added http_method rule keyword.	16 years ago
Gurvinder Singh	a0f184866c	http_cookie keywork support	16 years ago
Pablo Rincon	6206ffb530	Adding bidirectional operator support and unittests	16 years ago
Anoop Saldanha	bb5bd91045	Support to get the last sigmatch of a particular type. To be used for content and its modifiers	16 years ago