52 Commits (c587e90ebccfe8883ea951e723be461dc58dcc06)

Author	SHA1	Message	Date
Victor Julien	2d1ccb76b1	detect: remove pseudo checks from packet keywords ... Keep as debug validation check.	1 year ago
Victor Julien	2d5c381c3b	decode/ipv4: prep for turning ip4h/ip6h into union ... Store IPv4 decoder vars in a new Packet::l3 section in the packet. Use inline functions instead of the often multi-layer macro's for various IPv4 header getters. Ticket: #6938.	1 year ago
Victor Julien	eb3ca643c1	decode: reduce PKT_IS_IPV4/PKT_IS_IPV6 use ... Replace it with inline functions. Adds inline functions to wrap PKT_IS_IPV4/PKT_IS_IPV6. This is in preparation of removing the macro's, and cleaning up the header pointers. Ticket: #5517.	1 year ago
Jeff Lucovsky	d7026b7b11	detect/ipopts: Handle multiple ip options ... Issue: 6864 Multiple IP options were not handled properly as the value being OR'd into the packet's ip option variable were enum values instead of bit values.	1 year ago
Jeff Lucovsky	ee942391f7	detect/ipopts: Remove unneeded PCRE logic ... Issue: 6864 Reduce complexity by eliminating the PCRE logic and adding a unittest to validate null/empty string handling	1 year ago
Jeff Lucovsky	c27dee7a9b	detect/ipopt: Misc. cleanup ... Minor changes to improve readability, remove extraneous include files.	1 year ago
Philippe Antoine	c272a646c5	detect: SigMatchAppendSMToList can fail ... Ticket: #6104 And failures should be handled to say that the rule failed to load Reverts the fix by 299ee6ed55 that was simple, but not complete (memory leak), to have this bigger API change which simplifies code.	2 years ago
Juliana Fajardini	3ecb923db1	detect/analyzer: add more details for ipopts ... In addition to the ipopts keyword name, also log the ip option that was matched on. Task #6348	2 years ago
Jeff Lucovsky	3286c3b912	detect/pcre: Use local match variables ... pcre2 is not thread-safe wrt match objects so use locally scoped objects. Issue: 4797	2 years ago
Victor Julien	b31ffde6f4	output: remove error codes from output	3 years ago
Sascha Steinbiss	fb790121bb	decode-ipv4: implement extended security option ... IP option 0x85 (extended security) is mentioned in the documentation for the ipopts keyword but was not implemented.	3 years ago
Juliana Fajardini	a6bda3596b	unittests: alloc Packet with PacketGetFromAlloc ... Some unittests used SCMalloc for allocating new Packet the unittests. While this is valid, it leads to segmentation faults when we move to dynamic allocation of the maximum alerts allowed to be triggered by a single packet. This massive patch uses PacketGetFromAlloc, which initializes a Packet in such a way that any dynamic allocated structures within will also be initialized. Related to Task #4207	3 years ago
Modupe Falodun	76131c8cff	detect-ipopts: convert unittests to FAIL/PASS APIs ... Bug: 4047	4 years ago
Philippe Antoine	3de99a214c	pcre2: migrate keywords parsing	4 years ago
Victor Julien	6ab323d323	detect: hide RegisterTests behind ifdef UNITTESTS ... Update all callers to more aggressively use UNITTESTS guards as well.	5 years ago
Victor Julien	26bcc97515	detect/keywords: dynamic version part of doc URL	5 years ago
Jeff Lucovsky	d3a65fe156	detect: Provide `de_ctx` to free functions ... This commit makes sure that the `DetectEngineCtx *` is available to each detector's "free" function.	5 years ago
Jeff Lucovsky	7f6af10fed	general: copyright bump	5 years ago
Jeff Lucovsky	4b0085b03c	detect: Update to take advantage of PCRE refactor ... This commit changes the keyword detectors to use the refactored PCRE modifications from detect-parse.[ch]	5 years ago
Shivani Bhardwaj	d801c3e588	detect: Make keyword description consistent ... Closes redmine ticket #3137.	6 years ago
Shivani Bhardwaj	b5b429c288	detect: Add missing keyword URLs and description ... Add missing keyword URLs and their description. Fix the ones that were incorrect. Partially closes redmine ticket #2974.	6 years ago
Victor Julien	14896365ef	detect: remove Threadvars argument from API calls ... Remove it as it's (almost) never used. If it is really needed it can be accessed through DetectEngineThreadCtx::tv as well.	6 years ago
Victor Julien	ab1200fbd7	compiler: more strict compiler warnings ... Set flags by default: -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wwrite-strings -Wcast-align -Wbad-function-cast -Wformat-security -Wno-format-nonliteral -Wmissing-format-attribute -funsigned-char Fix minor compiler warnings for these new flags on gcc and clang.	8 years ago
Victor Julien	bfd4bc8233	detect: constify Signature/SigMatch use at runtime	9 years ago
Eric Leblond	a2e2f50fb9	documentation: fix list keywords URLs ... Update URLs in keyword definition to point to sphinx documentation.	9 years ago
Victor Julien	64405ae194	detect-ipopts: optimize matching	9 years ago
Victor Julien	3ab7dfd988	detect-ipopts: cleanup	9 years ago
Victor Julien	8c37906cf9	ipv4: store ipopts as flags, not bools	9 years ago
Victor Julien	be5a5df1f7	ipv4: shrink per packet ipopts storage	9 years ago
Victor Julien	e67ae0f174	detect keywords: use parse regex util func	9 years ago
Jason Ish	796dd5223b	tests: no longer necessary to provide successful return code ... 1 pass, 0 is fail.	9 years ago
Jason Ish	52983bf314	tests: convert all test to return 0 on failure, 1 on success	9 years ago
Ken Steele	923a77e952	Change Match() function to take const SigMatchCtx* ... The Match functions don't need a pointer to the SigMatch object, just the context pointer contained inside, so pass the Context to the Match function rather than the SigMatch object. This allows for further optimization. Change SigMatch->ctx to have type SigMatchCtx* rather than void* for better type checking. This requires adding type casts when using or assigning it. The SigMatch contex should not be changed by the Match() funciton, so pass it as a const SigMatchCtx*.	11 years ago
Ken Steele	8f1d75039a	Enforce function coding standard ... Functions should be defined as: int foo(void) { } Rather than: int food(void) { } All functions where changed by a script to match this standard.	11 years ago
Ken Steele	f9705377ae	Remove pkt variable from Packet structure. ... The uint8_t *pkt in the Packet structure always points to the memory immediately following the Packet structure. It is better to simply calculate that value every time than store the 8 byte pointer.	12 years ago
Eric Leblond	6842545331	Add documentation url in list-keyword output. ... The output of the list-keyword is modified to include the url to the keyword documentation when this is available. All documented keywords should have their link set. list-keyword can be used with an optional value: no option or short: display list of keywords csv: display a csv output on info an all keywords all: display a human readable output of keywords info $KWD: display the info about one keyword.	13 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	13 years ago
Anoop Saldanha	a4638fb0ad	code cleanup - replace SigMatchAppendPacket with SigMatchAppendSMToList	14 years ago
Anoop Saldanha	17f3f36d38	packet keywords only added for packet mpm. Rest in stream mpm. Update detection engine to handle the same	14 years ago
Victor Julien	addab7b5ee	Don't test the several packet detection checks against pseudo packets as the matches would not be meaningful anyway. Prevents a segv in the csum detection.	15 years ago
Eric Leblond	1db4aadd16	Supress usage of Packet declaration in tests. ... For convenience, a massive usage of 'Packet p;' declaration has been done in the tests function. Although this was completely legal, this is not possible anymore because of the new Packet allocation structure. This massive patch modifies all suricata files to use a SCMalloc allocated pointer to Packet instead. This patch has been done using coccinelle (http://coccinelle.lip6.fr) which is a semantic patching tool. This ensures that things like call to SCFree() should have not been forget because the semantic patch explicitly forces the call to SCFree(p) before each return. With this patch all unittests are running fine with a small and a big default packet size.	15 years ago
Eric Leblond	dd038c1906	Modify files to avoid direct pckt payload access ... This patch implements the needed modification of payload access in a Packet structure to support the abstraction introduced by the extended data system.	15 years ago
Gerardo Iglesias Galvan	9f4fae5b1a	Fix inconsistent use of dynamic memory allocation	15 years ago
William Metcalf	ce01927515	Import of GPLv2 Header 050410	15 years ago
Victor Julien	8b30226914	Detection keyword cleanup	16 years ago
Victor Julien	b259e362cd	Convert uricontent to use new scanning methods as well. Move http_method and http_cookie keywords out of pmatch list for now.	16 years ago
Pablo Rincon	25a3a5c6d8	Adding mem wrapper to debug runtime alloc()/free() functions. Fixing some memory leaks.	16 years ago
Gerardo Iglesias Galvan	ba6d807a6e	Improve information about errors on signature failure	16 years ago
Victor Julien	ecf86f9c23	Rename to Suricata.	16 years ago
Breno Silva	c43319c337	Regular expression for UnitTests ... Signed-off-by: Brian Rectanus <brectanu@gmail.com>	16 years ago