170 Commits (e50503e82012f4eccf0df87a662223a7f577a349)

Author	SHA1	Message	Date
Anoop Saldanha	72b0fcf419	modify detection engine to carry out uri mpm run before build match array if alproto is http and if sgh has atleast one sig with uri mpm set	15 years ago
Anoop Saldanha	7ec0382774	support fast pattern for http raw header. Also support relative modifiers for http raw header	15 years ago
Anoop Saldanha	c61c68fd36	mpm and fast pattern support for http_header. Also support relative modifiers for http_header	15 years ago
Anoop Saldanha	778ec0939c	make client body buffer limit configurable. Also some minor changes	15 years ago
Anoop Saldanha	0aa5cffb12	fast pattern support for http_client_body keyword added. Also mpm support for http_client_body added	15 years ago
Anoop Saldanha	bbd0c5056b	store the content added for mpm inside Signature. also carry out an unconditional cleanup of packet pattern matcher pmq det_ctx->pmq	15 years ago
Anoop Saldanha	6df051321f	fix fp when content is negated and also added to mpm	15 years ago
Anoop Saldanha	5c6a65dc58	support relative modifiers for http_client_body. Introduce body processing engine in detect-engine-hcbd.[ch]	15 years ago
Anoop Saldanha	eade60f0fd	make some name changes. break PopulateMpm(). Set the avoid mpm double check flags	15 years ago
Anoop Saldanha	6eaba8941c	Use new flags to indicate uricontent has a mpm set	15 years ago
Anoop Saldanha	ede7be34b5	replace all Signature->tmatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_TMATCH]	15 years ago
Anoop Saldanha	3d2f81d978	replace all Signature->dmatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_DMATCH]	15 years ago
Anoop Saldanha	a7353be20d	replace all Signature->amatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_AMATCH]	15 years ago
Anoop Saldanha	e0476242c6	replace all Signature->umatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_UMATCH]	15 years ago
Anoop Saldanha	e54358a9e1	replace all Signature->pmatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_PMATCH]	15 years ago
Anoop Saldanha	82fd581b64	replace all sm lists (match, pmatch, dmatch, umatch, amatch, tmatch) with an array Signature->sm_lists[]. Replace all Signature->match instances in the engine with Signature->sm_lists[DETECT_SM_LIST_MATCH]	15 years ago
Victor Julien	001f91056e	Add http_raw_header as an alias to the http_header keyword as that actually inspects the raw headers (see issue #243). Closes issue #242.	15 years ago
Gurvinder Singh	b7da115e6d	support for http_stat_code keyword has been added to detection module	15 years ago
Gurvinder Singh	1deae70cf7	added http_stat_msg keyword support for detection module	15 years ago
Anoop Saldanha	bc99328ec8	define a new conf paramter detect-engine:inspection-recursion-limit; Defines a recursion limit for content inspection code	15 years ago
Anoop Saldanha	88d94b136d	Support for reference.config file	15 years ago
Anoop Saldanha	0ef684705c	support single mpm context distribution across sghs in staging. Also see to it that ac works fine with this setup	15 years ago
Anoop Saldanha	b367c37ae6	suricata.yaml conf update to support single mpm context distribution over multiple sghs + code to parse this conf	15 years ago
Victor Julien	cbd4c298ed	Initial version of a new bitmask based signature pre-filtering method.	15 years ago
Victor Julien	fc248ca7a1	Many small performance updates.	15 years ago
Victor Julien	57b098e98c	Add padding to commonly used data structures.	15 years ago
Pablo Rincon	f225bd1428	Adding modifiers /C /H and /M to pcre (http cookie, header and method)	15 years ago
Pablo Rincon	9d7baa7a9f	Adding ssh app layer module with two new keywords: ssh.protoversion and ssh.softwareversion	15 years ago
Victor Julien	9ba11dbfbd	Clean up detection engine mpm initialization phase.	15 years ago
Anoop Saldanha	b94eaec7c2	implement relative pcre matching in detect-engine-(payload|uri|dcepayload).c. Also fix within/distance handling of RELATIVE_NEXT flag for uricontent	15 years ago
Anoop Saldanha	ae3148aded	fix false positives for a negated content case	15 years ago
Victor Julien	102092a89c	Make signature address matching more cache efficient.	15 years ago
Victor Julien	1eec149f5e	Use Address structure in DetectAddress struct.	15 years ago
Pablo Rincon	693d4f54eb	Load signatures with incompatible fast_pattern option (due to design differences for optimization)	15 years ago
Victor Julien	d41b5645ef	Make sure decoder event rules are inspected even if the packet is invalid and has no addesses or proto. Update fast log and alert debug log to display the alerts. Fixes #179.	15 years ago
Victor Julien	67429e523f	Fix compiler warning about incomplete prototype.	15 years ago
Victor Julien	7454336ef5	Make SigWrapper private to detect-parse.c and rename to SigDuplWrapper to reflect it's use and purpose.	15 years ago
Anoop Saldanha	9ecade76b9	in case of duplicate signatures used the one with the latest revision	15 years ago
Gurvinder Singh	8852b83fa7	flowbits, flowvars, pktvars, flow flags and app layer info added to alert-debug.log	15 years ago
Victor Julien	580b09c2b8	Make sure we inspect all outstanding reassembled stream chunks (smsg) if the stream is shutting down. Make sure to do inspect signatures that use dsize against the tcp packet payload, even if that payload was already added to the stream. Likewise, the dsize signatures are not inspected against the reassembled stream.	15 years ago
Pablo Rincon	eed0ef6e69	Adding tag keyword support	15 years ago
Pablo Rincon	6950537a76	Move rate_filter rule tracking data from Signature to Threshold context	15 years ago
Victor Julien	37442a8a84	Prefilter signatures before fully scanning them.	15 years ago
Anoop Saldanha	45ea0d914e	dce stub content keywords support using dcepayload.c support for all dce related content keywords	15 years ago
Victor Julien	83b2c8abdb	Improve stateful uri detection code.	15 years ago
Victor Julien	9dd753b5f3	Scan uricontent mpm on demand.	15 years ago
Victor Julien	a24f288074	Moving the stream content scanning to have it's own mpm ctx.	15 years ago
Victor Julien	a0c1209a44	Inspect the reassembled stream together with the packet payload in the same direction.	15 years ago
Victor Julien	2fd31a1a11	Remove dsize grouping from detection engine grouping reducing memory usage. Store sgh in flow to reduce lookups. Reduce locking in alert handling. Increase default grouping values as we use less memory.	15 years ago
Victor Julien	dff6795df5	Detect cleanups.	15 years ago