102 Commits (cb174e4fd99e6cf8840f6962f880815501913451)

Author	SHA1	Message	Date
Victor Julien	b31ffde6f4	output: remove error codes from output	4 years ago
Victor Julien	39f5c7f56a	error: use SC_EINVAL for invalid input	4 years ago
Victor Julien	e250ef6402	debug: remove empty header	4 years ago
Philippe Antoine	02f2602dde	src: rework includes as per cppclean	4 years ago
Philippe Antoine	c5cf2967b3	detect: fix integer warnings ... Ticket: #4516	4 years ago
Philippe Antoine	a6a6f6d538	bytejump: fix ubsan warning ... Instead of checking the offset, we checked the pointer after adding the offset ot it...	4 years ago
Philippe Antoine	3de99a214c	pcre2: migrate keywords parsing	5 years ago
Victor Julien	6ab323d323	detect: hide RegisterTests behind ifdef UNITTESTS ... Update all callers to more aggressively use UNITTESTS guards as well.	6 years ago
Jeff Lucovsky	fb409664d2	detect: byte_math support	6 years ago
Jeff Lucovsky	39105917ce	detect/bsize: Use SCLogDebug instead of printf ... This commit updates debug "printf" message to use SCLogDebug	6 years ago
Jeff Lucovsky	620659b5f3	detect: Increase flag size for byte_jump	6 years ago
Jeff Lucovsky	23a65b5824	general: Fix typo in detect-bytejump.c	6 years ago
Jeff Lucovsky	0701d82890	detect/bytejump: Add "from_end" support ... This commit adds support for the byte jump "from_end" keyword and unittests.	6 years ago
Victor Julien	26bcc97515	detect/keywords: dynamic version part of doc URL	6 years ago
Jeff Lucovsky	d3a65fe156	detect: Provide `de_ctx` to free functions ... This commit makes sure that the `DetectEngineCtx *` is available to each detector's "free" function.	6 years ago
Shivani Bhardwaj	0e4f261224	Use StringParse* for all parsers and configurations	6 years ago
Jeff Lucovsky	7f6af10fed	general: copyright bump	6 years ago
Jeff Lucovsky	4b0085b03c	detect: Update to take advantage of PCRE refactor ... This commit changes the keyword detectors to use the refactored PCRE modifications from detect-parse.[ch]	6 years ago
Shivani Bhardwaj	d801c3e588	detect: Make keyword description consistent ... Closes redmine ticket #3137.	7 years ago
Shivani Bhardwaj	b5b429c288	detect: Add missing keyword URLs and description ... Add missing keyword URLs and their description. Fix the ones that were incorrect. Partially closes redmine ticket #2974.	7 years ago
Victor Julien	579cc9f02b	const: constify decoder, app-layer, detect funcs	7 years ago
Shivani Bhardwaj	85b56b633e	detect: Improve rule keyword alproto registration ... 1. Set WARN_UNUSED macro on DetectSignatureSetAppProto. 2. Replace all direct 'sets' of Signature::alproto from keyword registration. Closes redmine ticket #3006.	7 years ago
Victor Julien	14896365ef	detect: remove Threadvars argument from API calls ... Remove it as it's (almost) never used. If it is really needed it can be accessed through DetectEngineThreadCtx::tv as well.	7 years ago
Philippe Antoine	a370d2a91d	signature: fix memory leak in DetectBytejumpSetup	7 years ago
Victor Julien	a496c8be0c	detect/bytejump: suppress runtime error messages	7 years ago
Victor Julien	313661451d	content inspection: support transforms ... Make sure content is applied to the transformed version of a buffer. Support content with its modifiers, and also isdataat, pcre, bytetest and bytejump.	9 years ago
Victor Julien	ab1200fbd7	compiler: more strict compiler warnings ... Set flags by default: -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wwrite-strings -Wcast-align -Wbad-function-cast -Wformat-security -Wno-format-nonliteral -Wmissing-format-attribute -funsigned-char Fix minor compiler warnings for these new flags on gcc and clang.	9 years ago
Victor Julien	3626ecb474	bytejump: don't print errors when matching ... When bytejump was told to convert some payload data to int from a string it would print an error to the screen if the conversion failed. This is unwanted as the payload is controlled by an attacker and printing is expensive.	9 years ago
Victor Julien	cc4010343d	detect: add and use util func for alproto sets	10 years ago
Victor Julien	dfac5276b8	detect: remove unused SIGMATCH_PAYLOAD flag	10 years ago
Victor Julien	fe415ae518	detect: remove DMATCH list	10 years ago
Victor Julien	6bd37611ee	file_data: dynamic buffer	10 years ago
Victor Julien	779d40cedf	detect: remove hardcoded sm_list logic from setup ... Introduce utility functions to aid this.	10 years ago
Victor Julien	f370e88135	detect: move init only Signature members to init_data	10 years ago
Victor Julien	8edc954e82	detect: get rid of Signature::sm_lists ... Instead use the lists in init_data during setup and the SigMatchData arrays during runtime.	10 years ago
Victor Julien	39613778cd	detect: make setup/free/match funcs static where possible	10 years ago
Victor Julien	bfd4bc8233	detect: constify Signature/SigMatch use at runtime	10 years ago
Victor Julien	e67ae0f174	detect keywords: use parse regex util func	10 years ago
Jason Ish	796dd5223b	tests: no longer necessary to provide successful return code ... 1 pass, 0 is fail.	10 years ago
Giuseppe Longo	41a1a9f4af	find and replace HSBDMATCH by FILEDATA ... This commit do a find and replace of the following: - DETECT_SM_LIST_HSBDMATCH by DETECT_SM_LIST_FILEDATA sed -i 's/DETECT_SM_LIST_HSBDMATCH/DETECT_SM_LIST_FILEDATA/g' src/* - HSBD by FILEDATA: sed -i 's/HSBDMATCH/FILEDATA/g' src/*	11 years ago
Ken Steele	923a77e952	Change Match() function to take const SigMatchCtx* ... The Match functions don't need a pointer to the SigMatch object, just the context pointer contained inside, so pass the Context to the Match function rather than the SigMatch object. This allows for further optimization. Change SigMatch->ctx to have type SigMatchCtx* rather than void* for better type checking. This requires adding type casts when using or assigning it. The SigMatch contex should not be changed by the Match() funciton, so pass it as a const SigMatchCtx*.	12 years ago
Jason Ish	a18e2ef402	Bug 1230: Check all SigMatch lists for a named byte_extract variable.	12 years ago
Ken Steele	8f1d75039a	Enforce function coding standard ... Functions should be defined as: int foo(void) { } Rather than: int food(void) { } All functions where changed by a script to match this standard.	12 years ago
Victor Julien	59ccd7b62d	byte-test: switch to pcre_copy_substring ... Fixes cppcheck: [src/detect-bytejump.c:360]: (error) Uninitialized variable: str_ptr [src/detect-bytejump.c:372]: (error) Uninitialized variable: str_ptr [src/detect-bytejump.c:375]: (error) Uninitialized variable: str_ptr Bug #1046.	12 years ago
Victor Julien	3fa958b9a7	byte_extract/test/jump: fix coverity issues ... During keyword setup there was a path that in theory could lead to indexing an array with a negative int. Coverity 992695, 400605, 400604	13 years ago
Victor Julien	7292998a58	Content: set up sticky buffers like file_data and dce_stub_data w/o flags, but with a list variable	13 years ago
Anoop Saldanha	c3d98f9640	Fix the bug specified in the previous commit. ... Bug emanates from byte_test, byte_jump and byte_extract keyword being unable to handle negative offsets when the inspection pointer is at the end of the buffer.	13 years ago
Anoop Saldanha	0b5d277254	code cleanup for all content based keywords.	14 years ago
Anoop Saldanha	51dcf19817	turn dce_stub_data into a sticky buffer.	14 years ago
Anoop Saldanha	a308d718ae	Allow the use of relative without the presence of a related previous keyword.	14 years ago