suricata

Commit Graph

Author	SHA1	Message	Date
Ken Steele	60c46170b0	Check replist is not NULL inline before doing any processing. The replist is often NULL, so it is worth checking that case before making the function call do perform work on the list.	11 years ago
Eric Leblond	a85dc9b0e2	Add support for replace keyword. This patch adds support for the replace keyword. It is used with content to change selected part of the payload. The major point with this patch is that having a replace keyword made necessary to avoid all stream level check because we need to access to the could-be-modified packet payload. One of the main difficulty is to handle complex signature. If there is other content check, we must do the substitution when we're sure all match are valid. The patch adds an attribute to the thread context variable to be able to deal with recursivity of the match function. Replace is only activated in IPS mode and apply only to raw match.	14 years ago

Author

SHA1

Message

Date

Ken Steele

60c46170b0

Check replist is not NULL inline before doing any processing.

The replist is often NULL, so it is worth checking that case before making
the function call do perform work on the list.

Eric Leblond

a85dc9b0e2

Add support for replace keyword.

This patch adds support for the replace keyword. It is used with
content to change selected part of the payload. The major point
with this patch is that having a replace keyword made necessary
to avoid all stream level check because we need to access to the
could-be-modified packet payload.

One of the main difficulty is to handle complex signature. If there is
other content check, we must do the substitution when we're sure all
match are valid. The patch adds an attribute to the thread context
variable to be able to deal with recursivity of the match function.

Replace is only activated in IPS mode and apply only to raw match.

2 Commits (be9cd0fd843f1e412bceb3a86b0ad4e5cb7b0782)