222 Commits (d9686fae57f85f2bd4808dabc327c1c6ce7ef7d7)

Author	SHA1	Message	Date
Anoop Saldanha	3b5d95547d	bug #412 - Remove the commented out SigInitReal()	14 years ago
Anoop Saldanha	6cbd3a1046	bug #412 - Unify SigInit() and SigInitReal(). Remove any use of SigInitReal()	14 years ago
Anoop Saldanha	88ad3691d1	bug #405 - fix bug where raw uri inspection sigs were not treated as stateful sigs	14 years ago
Victor Julien	c8c4a76dc6	Move threshold to it's own sig match list.	14 years ago
Victor Julien	02e1229565	Enforce flow direction for http_raw_header sigs. Fix unittests that missed the flow direction.	14 years ago
Victor Julien	e81f94cd83	Fix flowbits sigmatch structure added to the match and post-match list, causing corruption of the prev ptr. This lead to an endless loop condition in the thresholding code. Thanks to Chris Wakelin for reporting the issue.	14 years ago
Victor Julien	6eeab37ab3	Add post-match list, move flowbits set, etc functions to it. Move flowint set, etc functions to it as well.	14 years ago
Victor Julien	aac2d91bcc	Set DROP flag for reject action so in addition to sending the rst, in IPS mode also drop the offending packet.	14 years ago
Victor Julien	e55390e4e7	Add check to invalidate signatures that inspect raw http headers in the to_client direction (response headers) if libhtp hasn't been patched yet. Also add hack to disable the test for unittests, many tests fail and we'll fix those ASAP.	14 years ago
Victor Julien	21ee59e6f3	Add signature direction (flow:toserver/flow:toclient) as a signature flag.	14 years ago
Victor Julien	298289f43f	Let flow:only_stream and flow:no_stream set the require packet and require stream flags. Toss out sigs with conflicting settings. Rename flow:stream_only to flow:only_stream. Fixes #261.	14 years ago
Victor Julien	e0cf2ccb91	Fix invalid direction error message.	14 years ago
Victor Julien	07e560b137	file-data: initial file_data support ... Support file_data for: content, pcre (relative), byte_test, byte_jump, byte_extract, isdataat. File_data support is handled at signature parsing time, all matches occurring after the file_data in the rule are converted to http_server_body matches. Content matches relative to the file_data are converted. Within to depth, distance to offset. Relative to the start of the body buffer.	14 years ago
Victor Julien	d5ed28b065	Remove SIG_FLAG_MPM flag.	14 years ago
Victor Julien	4992f7c417	Remove SIG_FLAG_MPM_URI flag. It was checked but never set.	14 years ago
Victor Julien	2650551192	Rename signature init flags to indicate they are init flags.	14 years ago
Victor Julien	89f83e714c	Introduce http_server_body keyword. ... The http_server_body content modifier modifies the previous content to inspect the normalized (dechunked, unzipped) http_server_body. The workings are similar to http_client_body. Additionally, a new pcre flag was introduced "/S". To facilitate this change the signature flags field was changed to be 64 bit.	14 years ago
Victor Julien	23e01d23d3	Implement filestore keyword, including a way for the stateful detection engine to conclude that a file will never have to be stored.	14 years ago
Victor Julien	70f0d3d2e7	Add negation to filename and fileext, use same syntax as with content.	14 years ago
Eileen Donlon	a92d15ed37	Fixed duplicate signature check	14 years ago
Anoop Saldanha	7433d92dd2	undo this commit - ... commit eff08f93d8 Author: Anoop Saldanha <poonaatsoc@gmail.com> Date: Thu Nov 3 14:31:24 2011 +0530 update failing unittest to reflect the mpm design update Fixed a bug in the mpm code that would make all the changes in the commit just undone wrong.	14 years ago
Victor Julien	d070869c48	Reinstate replace validation check.	14 years ago
Anoop Saldanha	eff08f93d8	update failing unittest to reflect the mpm design update	14 years ago
Victor Julien	af51493da2	Mpm update: Toss out signatures that mix pkt and stream/state. Update profiling code to track new mpm.	14 years ago
Anoop Saldanha	9887084370	support multiple ipprotos in the same sig + unittest	14 years ago
Anoop Saldanha	432c3317d2	app layer probing parser updates	14 years ago
Anoop Saldanha	4307ea2348	Replace all frees with SCFrees	14 years ago
Eric Leblond	a85dc9b0e2	Add support for replace keyword. ... This patch adds support for the replace keyword. It is used with content to change selected part of the payload. The major point with this patch is that having a replace keyword made necessary to avoid all stream level check because we need to access to the could-be-modified packet payload. One of the main difficulty is to handle complex signature. If there is other content check, we must do the substitution when we're sure all match are valid. The patch adds an attribute to the thread context variable to be able to deal with recursivity of the match function. Replace is only activated in IPS mode and apply only to raw match.	14 years ago
Gerardo Iglesias Galvan	44692c83aa	Properly check retval for config and conversion function calls	14 years ago
Gerardo Iglesias Galvan	73dd5562c3	Fix potential crash in signature parsing code	14 years ago
Victor Julien	681f8329a6	Make error on <- direction operation use more explicit.	14 years ago
Anoop Saldanha	966119b6aa	support for http_raw_uri keyword + mpm engine	14 years ago
Victor Julien	b9fd978253	Fix compiler warnings in two unittests.	15 years ago
Victor Julien	153f9298e7	Fix priority handling during the signature parsing stage. Fixes #275.	15 years ago
Gurvinder Singh	27f67c97de	log error on duplicate sig and also for dup sig with newer revision	15 years ago
Eric Leblond	2c80f18dc9	detect: Add sctp detection and parsing. ... This patch adds the support of SCTP in signature subsystem.	15 years ago
Anoop Saldanha	c9897a44a4	fast pattern support for http_cookie. Also support relative modifiers	15 years ago
Anoop Saldanha	bbbedaf963	fast pattern support for http_method. Also support relative modifiers	15 years ago
Anoop Saldanha	2321a4dd58	support isdataat negation. Also fix addiing isdataat to appropriate lists	15 years ago
Eric Leblond	1db4aadd16	Supress usage of Packet declaration in tests. ... For convenience, a massive usage of 'Packet p;' declaration has been done in the tests function. Although this was completely legal, this is not possible anymore because of the new Packet allocation structure. This massive patch modifies all suricata files to use a SCMalloc allocated pointer to Packet instead. This patch has been done using coccinelle (http://coccinelle.lip6.fr) which is a semantic patching tool. This ensures that things like call to SCFree() should have not been forget because the semantic patch explicitly forces the call to SCFree(p) before each return. With this patch all unittests are running fine with a small and a big default packet size.	15 years ago
Anoop Saldanha	2b781f00d7	support relative pcre for client body. All pcre processing for client body moved to hcbd engine	15 years ago
Victor Julien	435d0fb327	Clean up signature flags creating room for merging flags and mpm_flags. Merge flags and mpm_flags. Move new mpm id's into signature header. Get rid of full signature access in signature prefiltering.	15 years ago
Victor Julien	169aa5581a	Rename SIG_FLAG_AMATCH flag to SIG_FLAG_STATE_MATCH to better reflects its purpose.	15 years ago
Victor Julien	d7b92d9bfe	Consolidate several signature flags into one.	15 years ago
Anoop Saldanha	07f20674ac	allow sigs for http client body of the form content:one; content:two; distance:0; http_client_body;	15 years ago
Anoop Saldanha	5c6a65dc58	support relative modifiers for http_client_body. Introduce body processing engine in detect-engine-hcbd.[ch]	15 years ago
Anoop Saldanha	4883efd0f6	unifying content structure - uricontent now uses DetectContentData	15 years ago
Anoop Saldanha	6eaba8941c	Use new flags to indicate uricontent has a mpm set	15 years ago
Anoop Saldanha	46b4806d8e	use a single populatempm() function to add the right content for mpm	15 years ago
Anoop Saldanha	4a038511ff	Change the struct members uricontent and uricontent_len in DetectUricontentData to content and content_len. Make replacements everywhere else in the codebase to accomodate these changes	15 years ago
Anoop Saldanha	ede7be34b5	replace all Signature->tmatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_TMATCH]	15 years ago
Anoop Saldanha	3d2f81d978	replace all Signature->dmatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_DMATCH]	15 years ago
Anoop Saldanha	a7353be20d	replace all Signature->amatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_AMATCH]	15 years ago
Anoop Saldanha	e0476242c6	replace all Signature->umatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_UMATCH]	15 years ago
Anoop Saldanha	e54358a9e1	replace all Signature->pmatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_PMATCH]	15 years ago
Anoop Saldanha	82fd581b64	replace all sm lists (match, pmatch, dmatch, umatch, amatch, tmatch) with an array Signature->sm_lists[]. Replace all Signature->match instances in the engine with Signature->sm_lists[DETECT_SM_LIST_MATCH]	15 years ago
Victor Julien	afdb39e5f6	Print an error if the protocol field of a signature contains a unknown/invalid value.	15 years ago
Anoop Saldanha	88d94b136d	Support for reference.config file	15 years ago
Anoop Saldanha	fe700737a3	fix null dereference in detect parse test - clang fix	15 years ago
Anoop Saldanha	f094523eb1	clang fix - some minor fixes for unittests	15 years ago
Pablo Rincon	bbab0f9987	Set default gid to 1 on Sig init	15 years ago
Victor Julien	c62a3d995e	Fix signatures with trailing spaces being rejected by the regex. Add test.	15 years ago
Victor Julien	05ae4f99d8	Kick out invalid signature with uricontent and flow:to_client or flow:from_server.	15 years ago
Pablo Rincon	c6e090f72c	App layer proto specific sigs (use the app layer to match proto)	15 years ago
Victor Julien	102092a89c	Make signature address matching more cache efficient.	15 years ago
Anoop Saldanha	89e3d92cdb	fix creating a static array of length 0 in SigMatchGetLastSMFromLists - clang fix	15 years ago
Pablo Rincon	693d4f54eb	Load signatures with incompatible fast_pattern option (due to design differences for optimization)	15 years ago
Anoop Saldanha	673322f01f	unittests for dce_stub_data content based singature parsing + fixes	15 years ago
Anoop Saldanha	ce8d27425d	fix signature parsing to how snort does it for content based keywords along with dce_stub_data	15 years ago
Anoop Saldanha	5fb6981e9e	content handling changes in detect-engine-payload.c for multiple relative matches	15 years ago
Victor Julien	393acd77d2	Detection improvements: uricontent escaping now working, better negated pattern (content) handling.	15 years ago
Victor Julien	7454336ef5	Make SigWrapper private to detect-parse.c and rename to SigDuplWrapper to reflect it's use and purpose.	15 years ago
Anoop Saldanha	9ecade76b9	in case of duplicate signatures used the one with the latest revision	15 years ago
Pablo Rincon	b931895901	Fixing flow cleanup and ctx initialization	15 years ago
Pablo Rincon	eed0ef6e69	Adding tag keyword support	15 years ago
Victor Julien	37442a8a84	Prefilter signatures before fully scanning them.	15 years ago
Anoop Saldanha	45ea0d914e	dce stub content keywords support using dcepayload.c support for all dce related content keywords	15 years ago
Victor Julien	0a607fce3d	Finish http_uri keyword, fix invalid read issue in one of the tests.	15 years ago
Gurvinder Singh	cda664a8c4	memroy leaks fixes in detection module, app layer and counters	15 years ago
Victor Julien	70b32f7380	First stab at creating a stateful detection engine. ... Stateful detection for app layer detection keywords, except uricontent. Stores it's partial results in the flow structure. Other modifications: - Generalize transaction tracking, logging and inspection. - Adapt http and dcerpc to use the new transaction handling. - Stream engine now always notifies app layer of a stream eof. This commit fixes bug #124.	15 years ago
Victor Julien	7a427ec7f4	Switch to pattern id based results checking in the mpm. Move app layer proto detection towards a more signature based approach.	15 years ago
Gurvinder Singh	3721037de5	unittests for bug 134&139 and some typo correction	15 years ago
William Metcalf	5fb405335e	Small wrapper fixes to allow for windows compilation	15 years ago
William Metcalf	ce01927515	Import of GPLv2 Header 050410	15 years ago
Victor Julien	070ed778b8	Libcap-ng support by Gurvinder Singh and myself. Basic support for per thread caps is added, but not activated as it doesn't seem to work yet. Work around for incompatibility between libnet 1.1 and libcap-ng added.	15 years ago
Victor Julien	565b44a7e5	Improve sig parsing unittest error handling.	15 years ago
Gurvinder Singh	69a4fee757	fixed the API and logic error reported by clang tool	15 years ago
Victor Julien	fe7ece997a	Different approach to the reference keyword. Lots of cleanups, bug fixes in reference keyword code and tests.	15 years ago
Breno Silva	89baf93a40	Reference Support	15 years ago
Victor Julien	01c0e316b9	Cleanup of libnet patch.	15 years ago
William Metcalf	3678dda185	libnet now optional	15 years ago
Pablo Rincon	e7a989e305	IP Only Engine using radix trees	15 years ago
Pablo Rincon	c7350a8ac6	Fixing some naming convention issues and incorrect error messages	15 years ago
Pablo Rincon	b708d7f65d	Adding Uricontent inspection with spm. Modifiers for uricontent are now supported	15 years ago
Victor Julien	c1a19bcd6b	Fix compilation of new detect-filter code, fix ip-only compatibility of detect-filter code.	16 years ago
Victor Julien	80dc4f1dbe	Further simplify content api: merge flags that indicate a next relative match, remove chunks as they are unnecessary now, make negated a bitflag.	16 years ago
Victor Julien	f298fec872	Make sure nocase applies to the last pattern, content or uricontent.	16 years ago
Victor Julien	0e7cb90212	Fix broken pmatch list handling.	16 years ago
Victor Julien	8b30226914	Detection keyword cleanup	16 years ago
Victor Julien	6637873348	Update prev ptrs in SigMatchReplaceContent	16 years ago