473 Commits (cf9678d926f4e09d962ac1dee1cd808786ccf8cb)

Author	SHA1	Message	Date
Victor Julien	cf9678d926	detect: global registery for keyword thread data ... Some keywords need a scratch space where they can do store the results of expensive operations that remain valid for the time of a packets journey through the detection engine. An example is the reconstructed 'http_header' field, that is needed in MPM, and then for each rule that manually inspects it. Storing this data in the flow is a waste, and reconstructing multiple times on demand as well. This API allows for registering a keyword with an init and free function. It it mean to be used an initialization time, when the keyword is registered.	9 years ago
Victor Julien	a9a228a289	profiling: fix keyword profiling	9 years ago
Victor Julien	49fbd28ceb	detect: cleanup built-in list id's	9 years ago
Victor Julien	40851eecf0	template: dynamic buffer	9 years ago
Victor Julien	815120896b	app-layer-events: dynamic list	9 years ago
Victor Julien	b68343e372	files: use dynamic list	9 years ago
Victor Julien	e4bfdd53c2	cip/enip: dynamic buffer	9 years ago
Victor Julien	f2393c1ae0	modbus: dynamic buffer	9 years ago
Victor Julien	cfdd934aba	dnp3: dynamic buffers/lists	9 years ago
Victor Julien	9ba386a141	tls: dynamic buffers	9 years ago
Victor Julien	d9b3ae6cd6	dns: use dynamic buffers	9 years ago
Victor Julien	6f867c3c73	http_raw_uri: dynamic buffer	9 years ago
Victor Julien	ee55aefa1c	http_client_body: dynamic buffer	9 years ago
Victor Julien	e7d5e845c7	http_header / http_raw_header: dynamic buffers	9 years ago
Victor Julien	b694d96e22	http_stat_msg: dynamic buffer	9 years ago
Victor Julien	7e3ab4f5ea	http_stat_code: dynamic buffer	9 years ago
Victor Julien	128b59d4f6	http_raw_host: dynamic buffer	9 years ago
Victor Julien	296c275e23	http_host: dynamic buffer	9 years ago
Victor Julien	67b7d9734e	http_cookie: dynamic buffer	9 years ago
Victor Julien	54604c7bf2	http_user_agent: dynamic buffer	9 years ago
Victor Julien	9262fa3dcf	http_response_line: dynamic buffer	9 years ago
Victor Julien	6346a074a7	http_uri: dynamic buffer ... Clean up tests	9 years ago
Victor Julien	e34102d67a	http_method: make list dynamic	9 years ago
Victor Julien	6bd37611ee	file_data: dynamic buffer	9 years ago
Victor Julien	7052f9b933	http_request_line: dynamic buffer	9 years ago
Victor Julien	779d40cedf	detect: remove hardcoded sm_list logic from setup ... Introduce utility functions to aid this.	9 years ago
Victor Julien	f370e88135	detect: move init only Signature members to init_data	9 years ago
Victor Julien	0a5ae415b8	detect: shrink Signature::sm_arrays ... Signature::sm_arrays now only contains 'built-in' lists, and so is sized appropriately.	9 years ago
Victor Julien	4978a7a133	detect: reorganize id's in prep of dynamic lists	9 years ago
Victor Julien	8edc954e82	detect: get rid of Signature::sm_lists ... Instead use the lists in init_data during setup and the SigMatchData arrays during runtime.	9 years ago
Victor Julien	bd456076a8	detect: pass SigMatchData to inspect functions	9 years ago
Victor Julien	2f87c975d4	detect: add SigMatch arg to inspect functions	9 years ago
Victor Julien	cf42fbf51f	detect: use InspectEngineFuncPtr in inspect engines ... Replace explicit function pointer use by InspectEngineFuncPtr typedef	9 years ago
Victor Julien	5f7e096be4	detect: shrink inspect engine by using 'id' as state flag	9 years ago
Victor Julien	715ff60087	detect: remove unused SIG_FLAG_INIT_PAYLOAD init_flag	9 years ago
Victor Julien	5e0b0eea4b	detect: remove unused flags	9 years ago
Victor Julien	bfd4bc8233	detect: constify Signature/SigMatch use at runtime	9 years ago
Victor Julien	be3ee5330f	detect: remove alproto from keyword registration ... It was already marked as depricated and no longer in use anywhere.	9 years ago
Victor Julien	f91d490d25	detect: remove unused flow_locked hint	9 years ago
Victor Julien	810e43f373	magic: make optional ... Make libmagic optional. If installed it will be enabled by default in configure. Use --disable-libmagic to disable.	9 years ago
Victor Julien	3f8ee2afd3	detect-lua: unify on using 'lua' name vs 'luajit'	9 years ago
Victor Julien	0366d47608	luajit: remove unused instance counter	9 years ago
Jason Ish	1a31bded4a	DNP3: dnp3_data, dnp3_func, dnp3_ind, dnp3_obj rule keywords	9 years ago
Victor Julien	0ed119068d	detect-app-layer-protocol: implement prefilter ... Introduce 'Protocol detection'-only rules. These rules will only be fully evaluated when the protocol detection completed. To allow mixing of the app-layer-protocol keyword with other types of matches the keyword can also inspect the flow's app-protos per packet. Implement prefilter for the 'PD-only' rules.	9 years ago
Victor Julien	43aed70976	detect: during detection sgh is read only so turn into const	9 years ago
Mats Klepsland	1fea52dd8a	detect: add keyword tls_cert_valid ... Add keyword to check if TLS certificate is valid.	9 years ago
Mats Klepsland	f22c9d9781	detect: add keyword tls_cert_expired ... Add keyword to check if TLS certificate is expired.	9 years ago
kwong	a3ffebd835	Adding SCADA EtherNet/IP and CIP protocol support ... Add support for the ENIP/CIP Industrial protocol This is an app layer implementation which uses the "enip" protocol and "cip_service" and "enip_command" keywords Implements AFL entry points	9 years ago
Victor Julien	798ba010ca	prefilter: use array of engines per sgh ... Instead of the linked list of engines setup an array with the engines. This should provide better locality. Also shrink the engine structure so that we can fit 2 on a cacheline. Remove the FreeFunc from the runtime engines. Engines now have a 'gid' (global id) that can be used to look up the registered Free function.	9 years ago
Victor Julien	5f994756e6	detect-engine: improved inspect engines ... Inspect engines are called per signature per sigmatch list. Most wrap around DetectEngineContentInspection, but it's more generic. Until now, the inspect engines were setup in a large per ipproto, per alproto, per direction table. For stateful inspection each engine needed a global flag. This approach had a number of issues: 1. inefficient: each inspection round walked the table and then checked if the inspect engine was even needed for the current rule. 2. clumsy registration with global flag registration. 3. global flag space was approaching the need for 64 bits 4. duplicate registration for alprotos supporting both TCP and TCP (DNS). This patch introduces a new approach. First, it does away with the per ipproto engines. This wasn't used. Second, it adds a per signature list of inspect engine containing only those engines that actually apply to the rule. Third, it gets rid of the global flags and replaces it with flags assigned per rule per engine.	9 years ago