141 Commits (ed4d27fdc18f1be6fbef3c32f3906b686816cda1)

Author	SHA1	Message	Date
Jason Ish	796dd5223b	tests: no longer necessary to provide successful return code ... 1 pass, 0 is fail.	9 years ago
Victor Julien	4f8e1f59a6	mpm: remove obsolete mpm algos ... Remove: ac-gfbs, wumanber, b2g, b3g.	9 years ago
Victor Julien	2c8e8c2516	dns: rename type so it's purpose is more clear	10 years ago
Giuseppe Longo	41a1a9f4af	find and replace HSBDMATCH by FILEDATA ... This commit do a find and replace of the following: - DETECT_SM_LIST_HSBDMATCH by DETECT_SM_LIST_FILEDATA sed -i 's/DETECT_SM_LIST_HSBDMATCH/DETECT_SM_LIST_FILEDATA/g' src/* - HSBD by FILEDATA: sed -i 's/HSBDMATCH/FILEDATA/g' src/*	10 years ago
Victor Julien	5b6f8bda1d	detect: fix small memory leaks ... Fix small memory leaks in option parsing. Move away from pcre_get_substring in favor of pcre_copy_substring. Related to #1046.	11 years ago
Ken Steele	923a77e952	Change Match() function to take const SigMatchCtx* ... The Match functions don't need a pointer to the SigMatch object, just the context pointer contained inside, so pass the Context to the Match function rather than the SigMatch object. This allows for further optimization. Change SigMatch->ctx to have type SigMatchCtx* rather than void* for better type checking. This requires adding type casts when using or assigning it. The SigMatch contex should not be changed by the Match() funciton, so pass it as a const SigMatchCtx*.	11 years ago
Victor Julien	02529b13a8	rule parser: set flag for optionless keywords ... If a keyword doesn't have an argument, it should set the SIGMATCH_NOOPT flag so the parser knows.	11 years ago
Victor Julien	aa8918abd1	fast-pattern: fix error check in keyword setup ... Check the right variable. Coverity 1038096	12 years ago
Victor Julien	8516000208	Minor code cleanup/fixes to fast pattern unittests ... cppcheck: [detect-fast-pattern.c:1183] -> [detect-fast-pattern.c:1183]: (style) Same expression on both sides of '&'. [detect-fast-pattern.c:1217] -> [detect-fast-pattern.c:1217]: (style) Same expression on both sides of '&'. [detect-fast-pattern.c:1449] -> [detect-fast-pattern.c:1449]: (style) Same expression on both sides of '&'. [detect-fast-pattern.c:1479] -> [detect-fast-pattern.c:1479]: (style) Same expression on both sides of '&'. [detect-fast-pattern.c:1509] -> [detect-fast-pattern.c:1509]: (style) Same expression on both sides of '&'. [detect-fast-pattern.c:1539] -> [detect-fast-pattern.c:1539]: (style) Same expression on both sides of '&'. [detect-fast-pattern.c:1570] -> [detect-fast-pattern.c:1570]: (style) Same expression on both sides of '&'. [detect-fast-pattern.c:1686] -> [detect-fast-pattern.c:1686]: (style) Same expression on both sides of '&'. [detect-fast-pattern.c:1716] -> [detect-fast-pattern.c:1716]: (style) Same expression on both sides of '&'. [detect-fast-pattern.c:1746] -> [detect-fast-pattern.c:1746]: (style) Same expression on both sides of '&'. [detect-fast-pattern.c:1776] -> [detect-fast-pattern.c:1776]: (style) Same expression on both sides of '&'. [detect-fast-pattern.c:1806] -> [detect-fast-pattern.c:1806]: (style) Same expression on both sides of '&'. [detect-fast-pattern.c:1836] -> [detect-fast-pattern.c:1836]: (style) Same expression on both sides of '&'. [detect-fast-pattern.c:1866] -> [detect-fast-pattern.c:1866]: (style) Same expression on both sides of '&'. [detect-fast-pattern.c:1896] -> [detect-fast-pattern.c:1896]: (style) Same expression on both sides of '&'. [detect-fast-pattern.c:1926] -> [detect-fast-pattern.c:1926]: (style) Same expression on both sides of '&'. [detect-fast-pattern.c:2022] -> [detect-fast-pattern.c:2022]: (style) Same expression on both sides of '&'.	12 years ago
Anoop Saldanha	4da2f29054	Unittest for bug #973.	12 years ago
Victor Julien	43ba5a677e	DNS: enable mpm/fast_pattern support for dns_query	12 years ago
Anoop Saldanha	0d7305dfc7	Update the way we handle http_host keywords. ... Previously we would have forced all users to use nocase with http_host keywords(since the hostname buffer is lowercase). We now error out on sigs that has nocase set with http_host set. Also if the http_host pattern or http_host pcre has an uppercase character set, we invalidate such sigs. Unittests also updated to reflect the above change.	13 years ago
Anoop Saldanha	601836d831	Fast pattern setup now configurable in our code. ... You can either enable/disable fp for a particular type + set priority.	13 years ago
Anoop Saldanha	66f3c37016	code cleanup + unittests added against http_host and http_raw_host keywords, ... against various combinations of hostname in uri and host header.	13 years ago
Anoop Saldanha	3511f91bba	Add support for the new keyword - http_raw_host header. ... The corresponding pcre modifier would be 'Z'.	13 years ago
Anoop Saldanha	c4ce19a1be	Add support for a new keyword to inspect http_host header. ... The corresponding content keyword would now be - http_host. The corresponding pcre modifier would be W.	13 years ago
Last G	8ae11f73b2	Added parentheses to fix Eclipse static code analysis ... Fixed bug in action priority (REJECT_DST had lowest prio)	13 years ago
Eric Leblond	6842545331	Add documentation url in list-keyword output. ... The output of the list-keyword is modified to include the url to the keyword documentation when this is available. All documented keywords should have their link set. list-keyword can be used with an optional value: no option or short: display list of keywords csv: display a csv output on info an all keywords all: display a human readable output of keywords info $KWD: display the info about one keyword.	13 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	13 years ago
Anoop Saldanha	db8500bb26	fast pattern cleanup - Remove FastPatternSupportEnabledForSigMatchList() and all it's associated structures	13 years ago
Anoop Saldanha	988c92f71c	http user agent keyword + mpm + inspection + fast pattern support added	13 years ago
Anoop Saldanha	34fde4ed75	bug #471 - file_data fast pattern unittests added	13 years ago
Anoop Saldanha	90ccbfd80a	bug #471 - http server body fast pattern unittests added	13 years ago
Anoop Saldanha	d2738c851f	fix failing fast pattern unittests	13 years ago
Eileen Donlon	195eb42d4e	allow only one content to use fast_pattern	14 years ago
Victor Julien	40fcae3aa0	Minor unittest fixes to make Coverity happy.	14 years ago
Anoop Saldanha	c22755fec5	fix cppcheck analyzer warnings - bug 439	14 years ago
Victor Julien	da3c5bf84d	Minor error message cleanups	14 years ago
Eileen Donlon	9376967e65	reject rules with duplicate content modifiers ... reject rules that have multiple depths, offsets, distances, fast_patterns, nocases, or rawbytes for the same content.	14 years ago
Anoop Saldanha	35435f3284	All http_http_stat_code modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_STAT_CODE. Also remove dummy match/free functions for stat code and stat msg	14 years ago
Anoop Saldanha	507e1b66e0	All http_http_stat_msg modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_STAT_MSG	14 years ago
Anoop Saldanha	059ee217ff	All http_http_raw_uri modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_RAW_URI	14 years ago
Anoop Saldanha	b1a0d35106	All http_http_cookie modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_COOKIE	14 years ago
Anoop Saldanha	49bdad9345	All http_http_method modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_METHOD	14 years ago
Anoop Saldanha	97d8fc9cba	All http_http_raw_header modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_RAW_HEADER	14 years ago
Anoop Saldanha	97308674ee	All http_http_header modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_HEADER	14 years ago
Anoop Saldanha	1acb7cdc7d	All http_server_body modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_SERVER_BODY	14 years ago
Anoop Saldanha	a5b46e727c	All http_client_body modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_CLIENT_BODY	14 years ago
Anoop Saldanha	4810ee9c5f	All uricontent modified patterns now are DETECT_CONTENT and not DETECT_URICONTENT. Step towards unifying all content based patterns. Makes way for easier management of patterns	14 years ago
Anoop Saldanha	2e2398147c	fast pattern unittests added for http server body	14 years ago
Anoop Saldanha	09313cf9bd	Support http stat code detection engine, fast pattern(mpm engine included). Fix http stat code setup function. Fix pcre option for stat msg keyword. With this the pcre options for server_body is Q, for stat_msg is Y and for stat_code is S	14 years ago
Anoop Saldanha	2007c2711c	Support http stat msg detection engine, fast pattern(mpm engine included). Fix http stat msg setup function. Fix pcre option for stat msg keyword	14 years ago
Victor Julien	02e1229565	Enforce flow direction for http_raw_header sigs. Fix unittests that missed the flow direction.	14 years ago
Anoop Saldanha	420befb180	Changed my email address to anoopsaldanha at gmail dot com from my current one	14 years ago
Victor Julien	89f83e714c	Introduce http_server_body keyword. ... The http_server_body content modifier modifies the previous content to inspect the normalized (dechunked, unzipped) http_server_body. The workings are similar to http_client_body. Additionally, a new pcre flag was introduced "/S". To facilitate this change the signature flags field was changed to be 64 bit.	14 years ago
Anoop Saldanha	7433d92dd2	undo this commit - ... commit eff08f93d8 Author: Anoop Saldanha <poonaatsoc@gmail.com> Date: Thu Nov 3 14:31:24 2011 +0530 update failing unittest to reflect the mpm design update Fixed a bug in the mpm code that would make all the changes in the commit just undone wrong.	14 years ago
Anoop Saldanha	eff08f93d8	update failing unittest to reflect the mpm design update	14 years ago
Anoop Saldanha	539ce13695	fix broken unittests	14 years ago
Victor Julien	8186565240	Fix a number of potential issues found by CLANG and cppcheck.	14 years ago
Anoop Saldanha	ed3b44b3b5	fix parsing content keywords. We are more strict now. All content keywords need to be enclosed in double quotes. Better validation for sid, priority and rev keywords	14 years ago
Anoop Saldanha	13ea299ee0	Replace all mallocs with SCMallocs	14 years ago
Anoop Saldanha	966119b6aa	support for http_raw_uri keyword + mpm engine	15 years ago
Anoop Saldanha	c9897a44a4	fast pattern support for http_cookie. Also support relative modifiers	15 years ago
Anoop Saldanha	bbbedaf963	fast pattern support for http_method. Also support relative modifiers	15 years ago
Victor Julien	014f62247a	Another batch of clang fixes. Nothing really serious. Includes a couple of fixes for broken fixes from yesterday.	15 years ago
Anoop Saldanha	72b0fcf419	modify detection engine to carry out uri mpm run before build match array if alproto is http and if sgh has atleast one sig with uri mpm set	15 years ago
Anoop Saldanha	7ec0382774	support fast pattern for http raw header. Also support relative modifiers for http raw header	15 years ago
Anoop Saldanha	075719ea8c	fix fast pattern unittests	15 years ago
Victor Julien	18d3c87947	Add check to fast pattern keyword to make sure that the offset and length don't exceed the actual pattern length.	15 years ago
Anoop Saldanha	c61c68fd36	mpm and fast pattern support for http_header. Also support relative modifiers for http_header	15 years ago
Anoop Saldanha	0aa5cffb12	fast pattern support for http_client_body keyword added. Also mpm support for http_client_body added	15 years ago
Anoop Saldanha	eade60f0fd	make some name changes. break PopulateMpm(). Set the avoid mpm double check flags	15 years ago
Anoop Saldanha	4883efd0f6	unifying content structure - uricontent now uses DetectContentData	15 years ago
Anoop Saldanha	3b0a9ca97e	add support for http_uri; content fast_patterns	15 years ago
Anoop Saldanha	46b4806d8e	use a single populatempm() function to add the right content for mpm	15 years ago
Anoop Saldanha	e0476242c6	replace all Signature->umatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_UMATCH]	15 years ago
Anoop Saldanha	e54358a9e1	replace all Signature->pmatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_PMATCH]	15 years ago
Anoop Saldanha	4b77f132df	add support for sigs with uricontent fast_pattern	15 years ago
Anoop Saldanha	ea8eaf31aa	Fix fast_pattern tests that always showed success, irrespective of test results	15 years ago
Anoop Saldanha	a85fa6b792	support for fast_pattern only and fast_pattern:offset,length. Also support the new option for engine-analysis	15 years ago
Victor Julien	1071a53210	Fix unittests after ip_proto keyword change.	15 years ago
Pablo Rincon	693d4f54eb	Load signatures with incompatible fast_pattern option (due to design differences for optimization)	15 years ago
Victor Julien	2fd31a1a11	Remove dsize grouping from detection engine grouping reducing memory usage. Store sgh in flow to reduce lookups. Reduce locking in alert handling. Increase default grouping values as we use less memory.	15 years ago
Victor Julien	7a427ec7f4	Switch to pattern id based results checking in the mpm. Move app layer proto detection towards a more signature based approach.	15 years ago
William Metcalf	ce01927515	Import of GPLv2 Header 050410	15 years ago
Pablo Rincon	591e5e7da7	Moving inline functions to the .h files, so gcc can inline them correctly	16 years ago
Gurvinder Singh	69a4fee757	fixed the API and logic error reported by clang tool	16 years ago
Pablo Rincon	c7350a8ac6	Fixing some naming convention issues and incorrect error messages	16 years ago
Victor Julien	ec47f840f3	Remove more scan references.	16 years ago
Victor Julien	8b30226914	Detection keyword cleanup	16 years ago
Victor Julien	bef70a04ce	First stage of detect engine redesign: equal patterns share id's, search phase no longer used, new match verification phase.	16 years ago
Pablo Rincon	25a3a5c6d8	Adding mem wrapper to debug runtime alloc()/free() functions. Fixing some memory leaks.	16 years ago
Gerardo Iglesias Galvan	ba6d807a6e	Improve information about errors on signature failure	16 years ago
Pablo Rincon	ad2c136e8f	Renaming errors (naming conventions)	16 years ago
Victor Julien	4824868766	Application layer detection improvements ... - improve locking of application layer handling, making sure that the flow cannot be freed/cleared when the detection engine is still working with it. - add a check to the app layer detection to make sure that a match function will only inspect an app layer state if it's of the right type.	16 years ago
Victor Julien	ecf86f9c23	Rename to Suricata.	16 years ago
William Metcalf	af13665684	failing unit test where fast_pattern rule and non-fast_pattern rule inspect same payload	16 years ago
Victor Julien	fdf8943dfb	Remove a few commented out code lines.	16 years ago
Anoop Saldanha	bb5bd91045	Support to get the last sigmatch of a particular type. To be used for content and its modifiers	16 years ago
Anoop Saldanha	7a10ddc07b	Fixes for the fast-pattern tests and a couple of other minor changes	16 years ago
Anoop Saldanha	6ca5dbc9e9	Support fast_pattern modifier keyword for content	16 years ago