19 Commits (d1151f3f8e5d21f08c47dd9d3e3650768f7d3004)

Author	SHA1	Message	Date
Jeff Lucovsky	7f6af10fed	general: copyright bump	5 years ago
Jeff Lucovsky	4b0085b03c	detect: Update to take advantage of PCRE refactor ... This commit changes the keyword detectors to use the refactored PCRE modifications from detect-parse.[ch]	5 years ago
Victor Julien	14896365ef	detect: remove Threadvars argument from API calls ... Remove it as it's (almost) never used. If it is really needed it can be accessed through DetectEngineThreadCtx::tv as well.	6 years ago
Eric Leblond	e09fa43ba5	detect-xbits: error on some invalid config	7 years ago
Victor Julien	ab1200fbd7	compiler: more strict compiler warnings ... Set flags by default: -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wwrite-strings -Wcast-align -Wbad-function-cast -Wformat-security -Wno-format-nonliteral -Wmissing-format-attribute -funsigned-char Fix minor compiler warnings for these new flags on gcc and clang.	8 years ago
Victor Julien	22f3205664	var-names: expose outside of detect engine ... Until now variable names, such as flowbit names, were local to a detect engine. This made sense as they were only ever used in that context. For the purpose of logging these names, this needs a different approach. The loggers live outside of the detect engine. Also, in the case of reloads and multi-tenancy, there are even multiple detect engines, so it would be even more tricky to access them from the outside. This patch brings a new approach. A any time, there is a single active hash table mapping the variable names and their id's. For multiple tenants the table is shared between tenants. The table is set up in a 'staging' area, where locking makes sure that multiple loading threads don't mess things up. Then when the preparing of a detection engine is ready, but before the detect threads are made aware of the new detect engine, the active varname hash is swapped with the staging instance. For this to work, all the mappings from the 'current' or active mapping are added to the staging table. After the threads have reloaded and the new detection engine is active, the old table can be freed. For multi tenancy things are similar. The staging area is used for setting up until the new detection engines / tenants are applied to the system. This patch also changes the variable 'id'/'idx' field to uint32_t. Due to data structure padding and alignment, this should have no practical drawback while allowing for a lot more vars.	9 years ago
Victor Julien	bfd4bc8233	detect: constify Signature/SigMatch use at runtime	9 years ago
Eric Leblond	0695ad4bf0	detect-xbits: set documentation URL	9 years ago
Victor Julien	cb08f02140	xbits: clean up parsing and tests	9 years ago
Eric Leblond	a2e2f50fb9	documentation: fix list keywords URLs ... Update URLs in keyword definition to point to sphinx documentation.	9 years ago
Victor Julien	e67ae0f174	detect keywords: use parse regex util func	9 years ago
Jason Ish	796dd5223b	tests: no longer necessary to provide successful return code ... 1 pass, 0 is fail.	9 years ago
Victor Julien	1a83fee5f5	xbits: fix coverity warnings ... Switch statement would contain NOALERT even though this was unreachable.	10 years ago
Victor Julien	ca1f3e68d4	ippair: implement xbits expiration	10 years ago
Victor Julien	fbdcffabc2	xbits: expire (first steps)	10 years ago
Victor Julien	7b79b9458d	xbits: implement ip_src/ip_dst support ... Just a wrapper for regular 'hostbits'.	10 years ago
Victor Julien	8e6453faac	xbits: prepare for non-ippair support	10 years ago
Victor Julien	dea8dda3c1	vars: redo var name <-> idx handling ... Can't use sm type anymore as multiple var carriers (host/flow/etc) will all have xbits.	10 years ago
Victor Julien	61cb2abc8d	ippair: xbit implementation ... detect xbits for ippair: initial implementation	10 years ago