141 Commits (ed4d27fdc18f1be6fbef3c32f3906b686816cda1)

Author	SHA1	Message	Date
Victor Julien	ad88efc2d8	detect: support multi buffer matching ... Multi buffer matching is implemented as a way for a rule to match on multiple buffers within the same transaction. Before this patch a rule like: dns.query; content:"example"; dns.query; content:".com"; would be equivalent to: dns.query; content:"example"; content:".com"; If a DNS query would request more than one name, e.g.: DNS: [example.net][something.com] Eeach would be inspected to have both patterns present. Otherwise, it would not be a match. So the rule above would not match, as neither example.net and somthing.com satisfy both conditions at the same time. This patch changes this behavior. Instead of the above, each time the sticky buffer is specified, it creates a separate detection unit. Each buffer is a "multi buffer" sticky buffer will now be evaluated against each "instance" of the sticky buffer. To continue with the above example: DNS: [example.net] <- matches 'dns.query; content:"example";' DNS: [something.com] <- matches 'dns.query; content:".com"' So this would now be a match. To make sure both patterns match in a single query string, the expression 'dns.query; content:"example"; content:".com";' still works for this. This patch doesn't yet enable the behavior for the keywords. That is done in a follow up patch. To be able to implement this the internal storage of parsed rules is changed. Until this patch and array of lists was used, where the index was the buffer id (e.g. http_uri, dns_query). Therefore there was only one list of matches per buffer id. As a side effect this array was always very sparsely populated as many buffers could not be mixed. This patch changes the internal representation. The new array is densely packed: dns.query; content:"1"; dns.query; bsize:1; content:"2"; [type: dns_query][list: content:"1";] [type: dns_query][list: bsize:1; content:"2";] The new scheme allows for multiple instances of the same buffer. These lists are then translated into multiple inspection engines during the final setup of the rule. Ticket: #5784.	2 years ago
Victor Julien	ad3088be14	detect/fast_pattern: use list util	2 years ago
Victor Julien	b31ffde6f4	output: remove error codes from output	3 years ago
Philippe Antoine	1f066cbbe8	unittest: fix unneeded includes as per cppclean ... Especially because there is conditional inclusion from a header	3 years ago
Philippe Antoine	02f2602dde	src: rework includes as per cppclean	3 years ago
Victor Julien	ecce116117	detect/fast_pattern: allow for rule time registration ... In preparation of more dynamic logic in rule loading also doing some registration, allow for buffers to be registered as fast_patterns during rule parsing. Leaves the register time registrations mostly as-is, but copies the resulting list into the DetectEngineCtx and works with that onwards. This list can then be extended.	4 years ago
Victor Julien	707b75ccda	detect: split register time and detect load time buffer funcs	4 years ago
Philippe Antoine	3de99a214c	pcre2: migrate keywords parsing	4 years ago
Victor Julien	e374d5ac15	detect/fast_pattern: add prefilter test	5 years ago
Victor Julien	226a82bade	detect/fast_pattern: redo unittests	5 years ago
Victor Julien	66d7f5941a	detect/fast_pattern: remove dead code	5 years ago
Gianni Tedesco	cebe15c23b	detect-fast-pattern: Mark as OPTIONAL_OPT, instead of NOOPT ... Also update the erroneous comment about it.	5 years ago
Victor Julien	6ab323d323	detect: hide RegisterTests behind ifdef UNITTESTS ... Update all callers to more aggressively use UNITTESTS guards as well.	5 years ago
Shivani Bhardwaj	0dac699197	src: remove multiple uses of atoi ... atoi() and related functions lack a mechanism for reporting errors for invalid values. Replace them with calls to the appropriate ByteExtractString* functions. Closes redmine ticket 3053.	5 years ago
Victor Julien	26bcc97515	detect/keywords: dynamic version part of doc URL	5 years ago
Philippe Antoine	cd26fc139e	detect: fix insertion in linked list for fast pattern ... Make sure we do not add the same list_id twice by checking at least all the lists with the current priority	5 years ago
Jeff Lucovsky	7f6af10fed	general: copyright bump	5 years ago
Jeff Lucovsky	4b0085b03c	detect: Update to take advantage of PCRE refactor ... This commit changes the keyword detectors to use the refactored PCRE modifications from detect-parse.[ch]	5 years ago
Victor Julien	4dff903b35	detect: introduce pkt mpm engines ... Instead of the hardcode L4 matching in MPM that was recently introduced, add an API similar to the AppLayer MPM and inspect engines. Share part of the registration code with the AppLayer. Implement for the tcp.hdr and udp.hdr keywords.	6 years ago
Victor Julien	47ef8f5822	detect/mpm: add l4-header support ... Prepare MPM part of the detection engine for a new type of per packet matching, where the L4 header will be inspected. Preparation for TCP header inspection keyword.	6 years ago
Eric Leblond	8c1b16e22d	doc: fix some links in list-keywords command	7 years ago
Victor Julien	0de86211c6	detect: register dynamic buffers into de_ctx ... Register buffers that are created during rule parsing. Currently this means an existing buffer with one or more transformations.	8 years ago
Victor Julien	a499a44f7a	detect: move buffer type map into detect ctx ... Move previously global table into detect engine ctx. Now that we can register buffers at rule loading time we need to take concurrency into account. Move DetectBufferType to detect.h and update DetectBufferCtx API calls to include a detect engine ctx reference.	8 years ago
Victor Julien	9182756891	detect/fast-pattern: use registered buffers for check	8 years ago
Victor Julien	ab1200fbd7	compiler: more strict compiler warnings ... Set flags by default: -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wwrite-strings -Wcast-align -Wbad-function-cast -Wformat-security -Wno-format-nonliteral -Wmissing-format-attribute -funsigned-char Fix minor compiler warnings for these new flags on gcc and clang.	8 years ago
Victor Julien	dfac5276b8	detect: remove unused SIGMATCH_PAYLOAD flag	9 years ago
Victor Julien	6f867c3c73	http_raw_uri: dynamic buffer	9 years ago
Victor Julien	ee55aefa1c	http_client_body: dynamic buffer	9 years ago
Victor Julien	e7d5e845c7	http_header / http_raw_header: dynamic buffers	9 years ago
Victor Julien	b694d96e22	http_stat_msg: dynamic buffer	9 years ago
Victor Julien	7e3ab4f5ea	http_stat_code: dynamic buffer	9 years ago
Victor Julien	128b59d4f6	http_raw_host: dynamic buffer	9 years ago
Victor Julien	296c275e23	http_host: dynamic buffer	9 years ago
Victor Julien	67b7d9734e	http_cookie: dynamic buffer	9 years ago
Victor Julien	54604c7bf2	http_user_agent: dynamic buffer	9 years ago
Victor Julien	6346a074a7	http_uri: dynamic buffer ... Clean up tests	9 years ago
Victor Julien	e34102d67a	http_method: make list dynamic	9 years ago
Victor Julien	6bd37611ee	file_data: dynamic buffer	9 years ago
Victor Julien	779d40cedf	detect: remove hardcoded sm_list logic from setup ... Introduce utility functions to aid this.	9 years ago
Victor Julien	8edc954e82	detect: get rid of Signature::sm_lists ... Instead use the lists in init_data during setup and the SigMatchData arrays during runtime.	9 years ago
Victor Julien	99580487e5	detect: fix file_data / http_server_body tests	9 years ago
Eric Leblond	a2e2f50fb9	documentation: fix list keywords URLs ... Update URLs in keyword definition to point to sphinx documentation.	9 years ago
Jason Ish	9d271e9a71	fast-pattern: fix tls_sni ... Use all 38 arguments in call to SigMatchGetLastSMFromLists Was preventing fast_pattern from being applied to tls_sni: https://redmine.openinfosecfoundation.org/issues/1936	9 years ago
Victor Julien	4c98b6cef3	http_request_line: implement keyword and mpm ... Implemented as 'stickybuffer'. Move all logic into the keyword file and remove bad tests that tested URI instead of request line.	9 years ago
Victor Julien	960461f4db	fast_pattern: register app layer mpms automatically ... Allow for duplicate registrations for the same list. After the first registration new calls will be ignored.	9 years ago
Victor Julien	9ff5703c49	packet/stream: mpm prefilter engine	9 years ago
Mats Klepsland	4172c4c8ac	tls: add (mpm) keyword tls_cert_subject ... This keyword is a replacement for tls.subject.	9 years ago
Mats Klepsland	9b2717799c	tls: add (mpm) keyword tls_cert_issuer ... This keyword is a replacement for tls.issuerdn.	9 years ago
Mats Klepsland	a13df67864	detect: add (mpm) keyword for tls_sni ... Match on server name indication (SNI) extension in TLS using tls_sni keyword, e.g: alert tls any any -> any any (msg:"SNI test"; tls_sni; content:"example.com"; sid:12345;)	9 years ago
Victor Julien	e67ae0f174	detect keywords: use parse regex util func	9 years ago