421 Commits (ee15bd80760f9d8298cdc676c3f9f0b80cd5ca46)

Author	SHA1	Message	Date
Victor Julien	ee15bd8076	detect/mpm: rename variable to ease code review	6 years ago
Shivani Bhardwaj	e9fe5ada7f	datasets: reload static sets	6 years ago
Jeff Lucovsky	fb409664d2	detect: byte_math support	6 years ago
Jeff Lucovsky	2d055ed1f7	detect: Correct Coverity REVERSE_INULL issue ... This commit corrects the "Null pointer dereferences" issue (CID 1465221).	6 years ago
Jeff Lucovsky	197a593078	detect: Add transform validation api ... This commit extends the API with a function that validates arguments against the transforms for the SM list (if any).	6 years ago
Jeff Lucovsky	5d10db88bc	detect/transform: Support transform options ... This commit adds support for transform-specific options. During Setup, transforms have the signature string available for options detection. When a transform detects an option, it should convert the option into an internal format and supply a pointer to this format as the last argument to DetectSignatureAddTransform. Transforms that support options must provide a function in their Sigmatch table entry. When the transform is freed, a pointer to the internal format of the option is passed to this function.	6 years ago
Shivani Bhardwaj	e7c0f0ad91	src: remove multiple uses of atoi ... atoi() and related functions lack a mechanism for reporting errors for invalid values. Replace them with calls to the appropriate ByteExtractString* functions. Partially closes redmine ticket #3053.	6 years ago
Jeff Lucovsky	d3a65fe156	detect: Provide `de_ctx` to free functions ... This commit makes sure that the `DetectEngineCtx *` is available to each detector's "free" function.	6 years ago
Jeff Lucovsky	d1151f3f8e	detect: Provide function to clear per-thread ctx ... This commit provides an interface to free previously allocated per-thread contextual information on the keyword lists.	6 years ago
Victor Julien	7f19da1cc0	detect: more robust against transform issues ... In case of transform issues (transform not consumed before pkt_data for example), the code would hit an ugly BUG_ON. Address this by a more graceful error message, that will still invalidate the sig but not crash the engine.	6 years ago
Shivani Bhardwaj	0e4f261224	Use StringParse* for all parsers and configurations	6 years ago
Jeff Lucovsky	be4c6b85de	general: Convert _Bool to bool ... This commit addresses task 3167 and changes usages of '_Bool` to `bool`. The latter is included from `suricata-common.h`	7 years ago
Jeff Lucovsky	1cddbc085b	detect: Fix typos/spelling errors.	7 years ago
Victor Julien	d369e54f1d	app-layer: all protocols are tx aware now ... So remove the runtime check for it.	7 years ago
Victor Julien	550cfdd98d	threading: hide 'trans_q' from queue handlers	7 years ago
Victor Julien	d7cb0774dd	detect: cleanup reload thread handling	7 years ago
Victor Julien	1a8562b3c6	detect: clean up threads handling ... Clean up reload and break loop thread handling.	7 years ago
Victor Julien	e5010d7704	detect: inject packet cleanup	7 years ago
Jason Ish	fdb587d2fc	detect-engine: check for tx detect flag support ... When registing a detection engine, check that the app-layer protocol supports tx detect flags. Exit with a fatal error if it does not as this is a code implementation error that should be resolved during development.	7 years ago
Victor Julien	0a809bf577	packet: set unique pkt_src 'flush' packets ... Set unique type for capture timeout and for detect reload flush to assist in debugging.	7 years ago
Victor Julien	58e48bcb87	debug: make it easier to trace flush logic	7 years ago
Victor Julien	4dff903b35	detect: introduce pkt mpm engines ... Instead of the hardcode L4 matching in MPM that was recently introduced, add an API similar to the AppLayer MPM and inspect engines. Share part of the registration code with the AppLayer. Implement for the tcp.hdr and udp.hdr keywords.	7 years ago
Victor Julien	14896365ef	detect: remove Threadvars argument from API calls ... Remove it as it's (almost) never used. If it is really needed it can be accessed through DetectEngineThreadCtx::tv as well.	7 years ago
Victor Julien	ba5679de0f	profiling: fix undefined profiling code use	7 years ago
Victor Julien	35be8385eb	detect: tcp.hdr sticky buffer ... Sticky buffer to inspect the TCP header.	7 years ago
Victor Julien	47ef8f5822	detect/mpm: add l4-header support ... Prepare MPM part of the detection engine for a new type of per packet matching, where the L4 header will be inspected. Preparation for TCP header inspection keyword.	7 years ago
Victor Julien	0965afd661	detect: pkt inspect engines ... Instead of hard coded calls to the inspection logic for payload inspection and 'MATCH'-list inspection use a callback approach. This will register a callback per 'sm_list' much like how app-layer inspect engines are registered. This will allow for adding more types later without adding runtime overhead. Implement the callback for the PMATCH and MATCH logic.	7 years ago
Victor Julien	d270a7603a	detect/inspect: add flags to inspect buffer	7 years ago
Victor Julien	32fb7d773a	detect/content-inspect: turn void arg into Packet ... Replace the 'void *data' argument by a 'Packet *p' as this was the only user left of the data pointer.	7 years ago
Victor Julien	d78c6ff714	detect/thread: ctx info is allowed to have NULL data	7 years ago
Victor Julien	3f253cb8c0	mpm: rename internal id for ac-tile to ac-ks	8 years ago
Victor Julien	477e46da78	detect/http-client-body: convert to inspect api v2	8 years ago
Victor Julien	76fd666cad	detect/http_raw_header: move tests into tests/	8 years ago
Victor Julien	10e2731f18	detect/http-uri: move tests into tests/	8 years ago
Victor Julien	e30212c5d8	detect: fix crash during startup with malformed yaml ... detect-engine: custom-values: toclient-groups: 200 toserver-groups: 200 Bug #2745	8 years ago
Victor Julien	ad1945aae4	detect: fix content inspection flags ... Fix generic inspect function content inspection flags so that streaming buffers work correctly.	8 years ago
Victor Julien	0b3220a0df	detect: improve inspect buffer handling ... Fix and Optimize cleanup. For the simple single inspect buffer optimize the cleanup by keeping track of the actually used buffers. This avoid looping over unused buffers. Fix the case of cleaning not being done after a tx if the next tx is also inspected in the context of the same packet. Fix cleanup of the multi-inspect buffers. Optimize in 2 ways. First like with single keep track of which multi-inspect buffers have been used. Second, keep a max of the buffers within a multi-inspect buffer. Use this max to limit (nested) looping.	8 years ago
Victor Julien	506f299b09	coverity: suppress warnings	8 years ago
Victor Julien	575fb69a06	coverity: suppress warning for intentional code	8 years ago
Victor Julien	35c5ae3458	detect: limit flush logic to sigs that need it ... Limit the early 'flush' logic to sigs that actually need to match on both stream and http bodies.	8 years ago
Victor Julien	c0adff3770	detect: remove STATE_MATCH flag use at runtime ... Instead, use it only at init time and use Signature::app_inspect directly at runtime.	8 years ago
Victor Julien	12fec46d13	multi-tenant: introduce device selector ... Add device to tenant mapping support: mappings: - device: ens5f0 tenant-id: 1 - device: ens5f1 tenant-id: 23 Implemented by assigning the tenant id to the 'livedev', which means it's only supported for capture methods that use the livedev API. It's also currently not supported for IPS. In a case like 'eth0 -> eth1' it's unclear which tenant should be used for the return traffic in a flow, where the incoming device is 'eth1'.	8 years ago
Victor Julien	bfa884c956	detect: avoid potential use-after-free in error path	8 years ago
Victor Julien	d062089c60	detect: clean up counter registration	8 years ago
Victor Julien	df88c048ba	detect: fix delayed detect ... Last multi-detect changes broken delayed-detect by refusing to reload a 'stub' detect engine. This patch distinguishes between a stub for multi-tenancy and for delayed detect.	8 years ago
Victor Julien	5bcae21653	detect: reload-rules shouldn't reload a stub	8 years ago
Victor Julien	4eaec2dff0	detect/debug: suppress noisy info messages	8 years ago
Victor Julien	8c918a4bea	detect/multi-tenant: fix mix of default detect engine and tenants	8 years ago
Victor Julien	6e9d81289d	detect: make detect engine types explicit ... There are 3 types of detect engine objects: 1. normal The normal detection engine if no multi-tenancy is in use 2. tenant A per tenant detection engine 3. stub A stub (or minimal as it was called before) detect engine that is needed to have something in place when there are only tenants. A stub is also used in case of 'delayed detect', where we need a minimal detect engine to start up which is replaced by a full (normal type) detect engine after startup. This patch adds a new field 'type' to the DetectEngineCtx object to distinguish between the types. This replaces the boolean 'minimal'.	8 years ago
Victor Julien	d377eba254	detect/multi-tenant: fix removing of tenant id 0	8 years ago