32 Commits (a44da9f5cb0be1c1c85ce847a86d4addaf2868d8)

Author	SHA1	Message	Date
Eric Leblond	569cc5d238	util-file: introduce new functions for file size ... This patch introduces the FileDataSize and FileTrackedSize functions. The first one is just a renaming of the initial FilSize function whereas the other one is using the newly introduced size field as value.	9 years ago
Victor Julien	810e43f373	magic: make optional ... Make libmagic optional. If installed it will be enabled by default in configure. Use --disable-libmagic to disable.	9 years ago
Eric Leblond	a2e2f50fb9	documentation: fix list keywords URLs ... Update URLs in keyword definition to point to sphinx documentation.	9 years ago
Victor Julien	9030e89c94	detect: don't set alproto while registering keyword ... The field is not used except for some printing, and is wrong for many keywords.	9 years ago
Victor Julien	c957c62824	detect file: enable HTTP inspection from validate func	9 years ago
Victor Julien	621860f5b2	detect file: enforce protocol in single place ... Instead of trying to enforce the app layer protocol in each file function, enforce it in the generic validation function.	9 years ago
Andreas Herz	36e4126227	detect-filemagic: fix heap-use-after-free ... This fixes the heap-use-after-free issue with sm being freed without being removed from the signature (s) list. Move the protocol check for rules with filemagic before the alloc and make the error log more precise.	9 years ago
Victor Julien	e43ce0a9ec	file: switch to streaming buffer API ... Make the file storage use the streaming buffer API. As the individual file chunks were not needed by themselves, this approach uses a chunkless implementation.	9 years ago
maxtors	9d3fd82849	Removed duplicate include statements.	9 years ago
Jason Ish	796dd5223b	tests: no longer necessary to provide successful return code ... 1 pass, 0 is fail.	9 years ago
Andreas Herz	15c98c6085	file-magic: improve libmagic handling on *nix systems	10 years ago
David Abarbanel	c2dc686742	SMTP MIME Email Message decoder	11 years ago
Victor Julien	f23399d672	Rename Lua code to just Lua ... As we support regular Lua as well as LuaJIT, it makes more sense to call it all Lua.	11 years ago
Ken Steele	8f1d75039a	Enforce function coding standard ... Functions should be defined as: int foo(void) { } Rather than: int food(void) { } All functions where changed by a script to match this standard.	11 years ago
Ken Steele	ba1e2ed69d	Fix Boyer Moore Nocase bug where BoyerMooreCtxToNocase was missing. ... Whenever DETECT_CONTENT_NOCASE is set for a BoyerMoore matcher, the function BoyerMooreCtxToNocase() must be called. This call was missing in AppLayerProtoDetectPMRegisterPattern(). Also created BoyerMooreNocaseCtxInit() that calls BoyerMooreCtxToNocase() to make some code cleaner and safer.	11 years ago
Ken Steele	967f7aefde	Store Boyer Moore no case strings in lower case. ... Rather than converting the search string to lower case while searching, convert it to lowercase during initialization. Changes the Boyer Moore search API for take BmCtx Change the API for BoyerMoore to take a BmCtx rather than the two parts that are stored in the context. Which is how it is mostly used. This enforces always calling BoyerMooreCtxToNocase() to convert to no-case. Use CtxInit and CtxDeinit functions to create and destroy the context, even in unit tests.	11 years ago
Victor Julien	6ba52230ed	Update DetectContentDataParse to reflect the actual data types content uses.	12 years ago
Victor Julien	3ad497e74f	Remove filemagic debug statement	12 years ago
Victor Julien	4d4f8fd358	file: make fileext, filename and filemagic use the same rule parsing function as others. This has as a side effect that we enforce doubly qouted values now.	12 years ago
Eric Leblond	6842545331	Add documentation url in list-keyword output. ... The output of the list-keyword is modified to include the url to the keyword documentation when this is available. All documented keywords should have their link set. list-keyword can be used with an optional value: no option or short: display list of keywords csv: display a csv output on info an all keywords all: display a human readable output of keywords info $KWD: display the info about one keyword.	13 years ago
Victor Julien	fd6df00684	Bug 585: use per detect thread libmagic ctx	13 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	13 years ago
Eric Leblond	655577cbbc	Add some missing checks of SCMalloc return.	13 years ago
Victor Julien	3849588c61	Create separate detect API call (FileMatch) for file detection keywords. #531.	13 years ago
Victor Julien	d840308ae2	file detect: improve cleanup	13 years ago
Victor Julien	adb5d05fb5	Fix a FP with negated filemagic inspection.	14 years ago
Victor Julien	f3fbc1a44c	file handling: filemagic matching improvement ... Magic buffer is a null terminated string. Allow matching on the final \0 using filemagic:"somevalue|00|"; so we can anchor to the end of the buffer.	14 years ago
Victor Julien	04ea70ccf7	file extract: pruning ... Add pruning of files in memory so we keep only memory what we really need. Fix magic logic. Reset file part of the de_state on receiving another file in the same tx.	14 years ago
Victor Julien	b402d97179	File carving -- enable reponse file extraction ... - Enable response body tracking - Enable file extraction for responses - File store meta file includes magic, close reason. - Option to force magic lookup for all stored files. - Fix libmagic calls thead safety.	14 years ago
Victor Julien	e1022ee5ae	file-extraction: Disconnect file handling from flow and move into the app layer state.	14 years ago
Victor Julien	9b62ec65ab	Make sure filemagic works properly regardless of filestore being in use for a flow.	14 years ago
Victor Julien	5945e652d6	Initial implementation of filemagic keyword.	14 years ago