Eric Leblond
a2e2f50fb9
documentation: fix list keywords URLs
...
Update URLs in keyword definition to point to sphinx documentation.
10 years ago
Victor Julien
9030e89c94
detect: don't set alproto while registering keyword
...
The field is not used except for some printing, and is wrong for
many keywords.
10 years ago
Victor Julien
c957c62824
detect file: enable HTTP inspection from validate func
10 years ago
Victor Julien
621860f5b2
detect file: enforce protocol in single place
...
Instead of trying to enforce the app layer protocol in each file
function, enforce it in the generic validation function.
10 years ago
Eric Leblond
ed90a16e89
detect: fix setup for some keywords
...
Fix problems found by siginit.cocci.
10 years ago
Jason Ish
796dd5223b
tests: no longer necessary to provide successful return code
...
1 pass, 0 is fail.
10 years ago
David Abarbanel
c2dc686742
SMTP MIME Email Message decoder
12 years ago
Ken Steele
8f1d75039a
Enforce function coding standard
...
Functions should be defined as:
int foo(void)
{
}
Rather than:
int food(void) {
}
All functions where changed by a script to match this standard.
12 years ago
Victor Julien
4e5572b8dc
fileext: make case insensitive
...
Change keyword to be case insensitive when matching.
Ticket #597 .
13 years ago
Victor Julien
6ba52230ed
Update DetectContentDataParse to reflect the actual data types content uses.
13 years ago
Victor Julien
4d4f8fd358
file: make fileext, filename and filemagic use the same rule parsing function as others. This has as a side effect that we enforce doubly qouted values now.
13 years ago
Last G
8ae11f73b2
Added parentheses to fix Eclipse static code analysis
...
Fixed bug in action priority (REJECT_DST had lowest prio)
14 years ago
Eric Leblond
6842545331
Add documentation url in list-keyword output.
...
The output of the list-keyword is modified to include the url to
the keyword documentation when this is available. All documented
keywords should have their link set.
list-keyword can be used with an optional value:
no option or short: display list of keywords
csv: display a csv output on info an all keywords
all: display a human readable output of keywords info
$KWD: display the info about one keyword.
14 years ago
Eric Leblond
e176be6fcc
Use unlikely for error treatment.
...
When handling error case on SCMallog, SCCalloc or SCStrdup
we are in an unlikely case. This patch adds the unlikely()
expression to indicate this to gcc.
This patch has been obtained via coccinelle. The transformation
is the following:
@istested@
identifier x;
statement S1;
identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)";
@@
x = func(...)
... when != x
- if (x == NULL) S1
+ if (unlikely(x == NULL)) S1
14 years ago
Eric Leblond
655577cbbc
Add some missing checks of SCMalloc return.
14 years ago
Victor Julien
3849588c61
Create separate detect API call (FileMatch) for file detection keywords. #531 .
14 years ago
Victor Julien
d840308ae2
file detect: improve cleanup
14 years ago
Victor Julien
e1022ee5ae
file-extraction: Disconnect file handling from flow and move into the app layer state.
15 years ago
Victor Julien
23e01d23d3
Implement filestore keyword, including a way for the stateful detection engine to conclude that a file will never have to be stored.
15 years ago
Victor Julien
21acd72adf
Cleanups to the Multipart parsing code. Fixes to negation in filename and fileext.
15 years ago
Victor Julien
70f0d3d2e7
Add negation to filename and fileext, use same syntax as with content.
15 years ago
Victor Julien
9d5d46c4bb
Implement flow file storage API, create HTP wrappers for it, use it in HTTP parsing.
15 years ago
Victor Julien
a0ee6ade3e
Improve HTTP multipart parsing, add streaming parsing for files.
15 years ago
Victor Julien
4537f889ef
Handle all strings as raw strings in HTTP content-type and content-disposition header parsing.
15 years ago
Pablo Rincon
6d60b3a747
filename and fileext keywords
15 years ago