243 Commits (bf386a396d693043b77fa58006d23474d041f0fc)

Author	SHA1	Message	Date
Victor Julien	c9e93ec52c	filemd5: add support code for md5 handling for signatures.	13 years ago
Anoop Saldanha	0c24bbab0c	code cleanup for live swap	13 years ago
Anoop Saldanha	ecad4a24fa	live rule support added ... To reload ruleset during engine runtime, send the USR2 signal to the engine, and the ruleset would be reloaded from the same yaml file supplied at engine startup	13 years ago
Anoop Saldanha	5878d83174	byte_extract_id var now a non-global de_ctx specific var	13 years ago
Anoop Saldanha	f4ce9011d2	make mpm ctx container de_ctx specific. Also introduce global variable in mpm_ctx. this is a workaround for cleaning non global mpm_ctx's since we now don't supply the de_ctx around the detection engine API	13 years ago
Anoop Saldanha	f2dd61868d	variable names global vars, global no more. Moved to detection engine ctx, a place it belongs	13 years ago
Anoop Saldanha	f9612f3b83	mpm engine cleanup. Remove unnecessary flags	13 years ago
Anoop Saldanha	988c92f71c	http user agent keyword + mpm + inspection + fast pattern support added	13 years ago
Victor Julien	9f7588a756	Add filemd5 keyword that loads a list of md5's to match a file's md5 against.	13 years ago
Victor Julien	cae46ab5eb	pcre: print filename and line number for JIT warning.	13 years ago
Anoop Saldanha	493c3db413	fix FNs for flow- only_stream and no_stream options	13 years ago
Victor Julien	d378b76c04	http: body inspection improvement ... Improve http_client_body and file_data performance when request and response body limits are set to high values.	13 years ago
Eric Leblond	ad0e05a112	TLS app layer: Add tls.issuerdn keyword.	14 years ago
Pierre Chifflier	4be65fd016	TLS handshake: decode the SERVER_CERTIFICATE message ... Add a decoder for the SERVER_CERTIFICATE during a TLS handshake, extracts the certificates and keep the subject name. Add the tls.subject keyword for substring match in rules (TLS layer). Signed-off-by: Pierre Chifflier <pierre.chifflier@ssi.gouv.fr>	14 years ago
Victor Julien	c0a2cbd478	Move over src and dst thresholding to use host table. Fix a bug in threshold 'both' handling.	14 years ago
Victor Julien	a05df345de	Introduce host table, make tag use it ... Add a host table similar to the flow table. A hash using fine grained locking. Flow manager for now takes care of book keeping / garbage collecting. Tag subsystem now uses this for host based tagging instead of the global tag hash table. Because the latter used a global lock and the new code uses very fine grained locking this patch should improve scalability.	14 years ago
Anoop Saldanha	e682796d03	feature #414 - support listing supported keywords. Remove support for dummy keywords __address__, __proto__, __port__. Remove support for recursive keyword and all references to it	14 years ago
Anoop Saldanha	603d4a719a	remove det_ctx->payload_offset and use det_ctx->buffer_offset. Update hscd and hsmd to use the new generic content inspection engine	14 years ago
Anoop Saldanha	35f1f7e8d9	unify payload detection engines + fix other bugs in pcre init	14 years ago
Anoop Saldanha	09313cf9bd	Support http stat code detection engine, fast pattern(mpm engine included). Fix http stat code setup function. Fix pcre option for stat msg keyword. With this the pcre options for server_body is Q, for stat_msg is Y and for stat_code is S	14 years ago
Anoop Saldanha	2007c2711c	Support http stat msg detection engine, fast pattern(mpm engine included). Fix http stat msg setup function. Fix pcre option for stat msg keyword	14 years ago
Anoop Saldanha	419cdc8558	support splitting mpm ctxs based on direction v2	14 years ago
Victor Julien	c8c4a76dc6	Move threshold to it's own sig match list.	14 years ago
Victor Julien	6eeab37ab3	Add post-match list, move flowbits set, etc functions to it. Move flowint set, etc functions to it as well.	14 years ago
Victor Julien	21ee59e6f3	Add signature direction (flow:toserver/flow:toclient) as a signature flag.	14 years ago
Anoop Saldanha	eea5ab4a7a	Support for app layer decoder events added + app_layer_event keyword added	14 years ago
Anoop Saldanha	92643f6110	introduce separate mpm ctxs for tcp/udp/other_protos	14 years ago
Victor Julien	298289f43f	Let flow:only_stream and flow:no_stream set the require packet and require stream flags. Toss out sigs with conflicting settings. Rename flow:stream_only to flow:only_stream. Fixes #261.	14 years ago
Victor Julien	18d79c4215	file store: respect flowbits and other keywords ... The filestore keyword until now flagged a file, tx or ssn for storage as soon as the keyword was inspected. This happens before flowbits and some other keywords, so files were stored that weren't supposed to. This patch makes the filestore keyword fill an array in the detect engine thread ctx. Then if the full signature matches, a post-match filestore function makes the store final.	14 years ago
Victor Julien	07e560b137	file-data: initial file_data support ... Support file_data for: content, pcre (relative), byte_test, byte_jump, byte_extract, isdataat. File_data support is handled at signature parsing time, all matches occurring after the file_data in the rule are converted to http_server_body matches. Content matches relative to the file_data are converted. Within to depth, distance to offset. Relative to the start of the body buffer.	14 years ago
Victor Julien	7adac3048d	file-data: create initial keyword registration.	14 years ago
Victor Julien	fa0152fa80	Shrink signature flags field to 32 bits.	14 years ago
Victor Julien	dd9da1a56f	Merge all http mpm related signature flags into a single set: SIG_FLAG_MPM_HTTP and SIG_FLAG_MPM_HTTP_NEG.	14 years ago
Victor Julien	d5ed28b065	Remove SIG_FLAG_MPM flag.	14 years ago
Victor Julien	fe48920514	Remove per sgh mpm_streamcontent_maxlen variable. It was checked but never set.	14 years ago
Victor Julien	4992f7c417	Remove SIG_FLAG_MPM_URI flag. It was checked but never set.	14 years ago
Victor Julien	2650551192	Rename signature init flags to indicate they are init flags.	14 years ago
Victor Julien	6ebd71545b	Fix signature flag definitions on 32 bit.	14 years ago
Victor Julien	291ddd95f2	Detection engine -- mpm ... Each signature is in one mpm ctx at max, but there were 3 separate id's in use: packet, stream, http. Merged them all into one. Could shrink the SignatureHeader structure with 8 bytes because of this, should lead to better caching performance.	14 years ago
Victor Julien	7db72bce75	Optimize detection engine prefiltering logic.	14 years ago
Victor Julien	89f83e714c	Introduce http_server_body keyword. ... The http_server_body content modifier modifies the previous content to inspect the normalized (dechunked, unzipped) http_server_body. The workings are similar to http_client_body. Additionally, a new pcre flag was introduced "/S". To facilitate this change the signature flags field was changed to be 64 bit.	14 years ago
Victor Julien	04ea70ccf7	file extract: pruning ... Add pruning of files in memory so we keep only memory what we really need. Fix magic logic. Reset file part of the de_state on receiving another file in the same tx.	14 years ago
Victor Julien	9b62ec65ab	Make sure filemagic works properly regardless of filestore being in use for a flow.	14 years ago
Victor Julien	5945e652d6	Initial implementation of filemagic keyword.	14 years ago
Victor Julien	23e01d23d3	Implement filestore keyword, including a way for the stateful detection engine to conclude that a file will never have to be stored.	14 years ago
Pablo Rincon	6d60b3a747	filename and fileext keywords	14 years ago
Anoop Saldanha	2b356dadff	Support for tos keyword added	14 years ago
Victor Julien	8cc82c7241	Add -S commandline option that loads a rule file exclusively. Issue #338.	14 years ago
Anoop Saldanha	c7b9d3fecb	Remove broken dsize_sm in SigMatch used by dsize in detection engine	14 years ago
Anoop Saldanha	ba6bada155	change rev field in Signature to u32 and use strotoul to extract the value. Cleanup some dead code/comments	14 years ago