suricata

Commit Graph

Author	SHA1	Message	Date
Victor Julien	b130234b26	var-names: reimplement var name handling Implement a new design for handling var name id's. The old logic was aware of detection engine versions and generally didn't work well for multi-tenancy cases. Other than memory leaks and crashes, logging of var names worked or failed based on which tenant was loaded last. This patch implements a new approach, where there is a global store of vars and their id's for the lifetime of the program. Overall Design: Base Store: "base" Used during keyword registration. Operates under lock. Base is shared between all detect engines, detect engine versions and tenants. Each variable name is ref counted. During the freeing of a detect engine / tenant, unregistration decreases the ref cnt. Base has both a string to id and a id to string hash table. String to id is used during parsing/registration. id to string during unregistration. Active Store Pointer (atomic) The "active" store atomic pointer points to the active lookup store. The call to `VarNameStoreActivate` will build a new lookup store and hot swap the pointer. Ensuring memory safety. During the hot swap, the pointer is replaced, so any new call to the lookup functions will automatically use the new store. This leaves the case of any lookup happening concurrently with the pointer swap. For this case we add the old store to a free list. It gets a timestamp before which it cannot be freed. Free List The free list contains old stores that are waiting to get removed. They contain a timestamp that is checked before they are freed. Bug: #6044. Bug: #6201.	3 years ago
Jeff Lucovsky	3286c3b912	detect/pcre: Use local match variables pcre2 is not thread-safe wrt match objects so use locally scoped objects. Issue: 4797	3 years ago
Victor Julien	b31ffde6f4	output: remove error codes from output	4 years ago
Philippe Antoine	02f2602dde	src: rework includes as per cppclean	4 years ago
Philippe Antoine	3de99a214c	pcre2: migrate keywords parsing	5 years ago
Victor Julien	6ab323d323	detect: hide RegisterTests behind ifdef UNITTESTS Update all callers to more aggressively use UNITTESTS guards as well.	6 years ago
Jeff Lucovsky	d3a65fe156	detect: Provide `de_ctx` to free functions This commit makes sure that the `DetectEngineCtx *` is available to each detector's "free" function.	7 years ago
Victor Julien	aba4e19548	detect/pktvar: fix memory leaks	7 years ago
Jeff Lucovsky	7f6af10fed	general: copyright bump	7 years ago
Jeff Lucovsky	4b0085b03c	detect: Update to take advantage of PCRE refactor This commit changes the keyword detectors to use the refactored PCRE modifications from detect-parse.[ch]	7 years ago
Victor Julien	14896365ef	detect: remove Threadvars argument from API calls Remove it as it's (almost) never used. If it is really needed it can be accessed through DetectEngineThreadCtx::tv as well.	7 years ago
Victor Julien	e834d94fd2	detect/pktvar: clean up keyword parsing	9 years ago
Victor Julien	ab1200fbd7	compiler: more strict compiler warnings Set flags by default: -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wwrite-strings -Wcast-align -Wbad-function-cast -Wformat-security -Wno-format-nonliteral -Wmissing-format-attribute -funsigned-char Fix minor compiler warnings for these new flags on gcc and clang.	10 years ago
Victor Julien	5e39486399	pkt-var: use id instead of name pointer	10 years ago
Victor Julien	dfac5276b8	detect: remove unused SIGMATCH_PAYLOAD flag	10 years ago
Victor Julien	bfd4bc8233	detect: constify Signature/SigMatch use at runtime	10 years ago
Victor Julien	e67ae0f174	detect keywords: use parse regex util func	11 years ago
Victor Julien	ed93e9394d	coverity: suppress CID 1038112	11 years ago
Ken Steele	923a77e952	Change Match() function to take const SigMatchCtx* The Match functions don't need a pointer to the SigMatch object, just the context pointer contained inside, so pass the Context to the Match function rather than the SigMatch object. This allows for further optimization. Change SigMatch->ctx to have type SigMatchCtx* rather than void* for better type checking. This requires adding type casts when using or assigning it. The SigMatch contex should not be changed by the Match() funciton, so pass it as a const SigMatchCtx*.	12 years ago
Ken Steele	8f1d75039a	Enforce function coding standard Functions should be defined as: int foo(void) { } Rather than: int food(void) { } All functions where changed by a script to match this standard.	12 years ago
Victor Julien	a698a7600d	clang: fix warnings when debug is enabled	14 years ago
Victor Julien	84bad6db77	Silence compiler warnings found by clang	14 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc\|SCStrdup\|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	14 years ago
Victor Julien	e7b36051de	Improve pktvar keyword parsing and error handling.	15 years ago
Anoop Saldanha	a4638fb0ad	code cleanup - replace SigMatchAppendPacket with SigMatchAppendSMToList	15 years ago
Victor Julien	e19f6ebaf4	Various fixes for issues reported by clang.	16 years ago
William Metcalf	2eef905c07	GPL and Copyright header updates.	17 years ago
Gerardo Iglesias Galvan	9f4fae5b1a	Fix inconsistent use of dynamic memory allocation	17 years ago
William Metcalf	ce01927515	Import of GPLv2 Header 050410	17 years ago
Victor Julien	8b30226914	Detection keyword cleanup	17 years ago
Victor Julien	b259e362cd	Convert uricontent to use new scanning methods as well. Move http_method and http_cookie keywords out of pmatch list for now.	17 years ago
Pablo Rincon	25a3a5c6d8	Adding mem wrapper to debug runtime alloc()/free() functions. Fixing some memory leaks.	17 years ago
Gerardo Iglesias Galvan	ba6d807a6e	Improve information about errors on signature failure	17 years ago
Steve Grubb	60ad9d29c5	Memory leak cleanup in detectors Hello, I ran the code through an analysis program and found several leaks that should be cleaned up. In src/detect-engine-address-ipv4.c at line 472, the test for ag == NULL will never be true since that is the loop entry test. In src/detect-engine-port.c at line 1133, the test for p == NULL will never be true since that is the loop entry test. In src/detect-engine-mpm.c at line 263 is a return without freeing fast_pattern In src/detect-ack.c at line 80 and 85, data catches the return from malloc. One of them should be deleted. In src/detect-seq.c at line 81 and 86, data catches the return from malloc. One of them should be deleted. In src/detect-content.c at line 749, many of the paths that lead to the error exit still has temp pointing to allocated memory. To clean this up, temp should be set to NULL if not immediately assigning and new value. In src/detect-uricontent.c at line 319, both cd and str needto be freed. At lines 344, str needs to be freed. And at line 347 str and temp need to be freed. In src/detect-flowbits.c at line 231 and 235, str was not being freed. cd was not being freed at line 235. In src/detect-flowvar.c at line 127, str was not being freed. At line 194, cd and str were not being freed. In src/detect-flowint.c at line 277, sfd was not being freed. At line 315, str was not being freed. In src/detect-pktvar.c at line 121, str was not being freed. At line 188, str and cd was not being freed. In src/detect-pcre.c at line 389, there is an extra free of "re" that should be deleted. In src/detect-depth.c at line 42 & 48, str has not been freed. In src/detect-distance.c at line 49 and 55, str has not been freed *In src/detect-offset.c at line 45, str has not been freed. The patch below fixes these issues. -Steve	17 years ago
Pablo Rincon	705471e4ee	Adding single pattern matcher algorithms. If you cannot store a context for the patterns, use SpmSearch() macro. Adding unittests and stats	17 years ago
Victor Julien	ecf86f9c23	Rename to Suricata.	17 years ago
Gurvinder Singh	a991ab0a19	added sigmatch payload flag	17 years ago
Victor Julien	968d8df12b	More logging API usage. Changed logging macro's slightly so the vars inside them won't conflict with vars used by the calling function.	17 years ago
Anoop Saldanha	f658ffbc9c	Order the signatures based on certain rule parameters like actions, flowbits, flowvar, pktvar, priority etc	17 years ago
Victor Julien	0d0ffb9963	Reorganize header inclusions.	17 years ago
Victor Julien	1727d191a4	Add pktvar and flowvar tests to ip only unittest. Make output cleaner.	17 years ago
Victor Julien	39724df664	2nd try of fixing some bugs reported by static code analysis tool.	17 years ago
Victor Julien	6eaff4be12	Fixes for issues found by static code analyzer.	17 years ago
Victor Julien	1132ab635a	Rename all pmt->det_ctx.	17 years ago
Victor Julien	b9972a9d2c	Cleanups	17 years ago
Brian Rectanus	fa5939ca91	64 bit cleanup part2	17 years ago
Victor Julien	5df5b35e90	Put all globals in the detection engine ctx. Add HashList type, a hash that also stores the items ina list to it can be traversed. Many cleanups.	17 years ago
Victor Julien	c4f2fe4bd7	Implement per packet variables and switch the http stuff to it.	17 years ago

48 Commits (e38b9de6a2fe8ca53f19585f84b24ae31ee720c9)