106 Commits (f2e85ab9ee31ecd7b49bdc1904f655c935c539bf)

Author	SHA1	Message	Date
Eileen Donlon	1a46d7a53a	fix more invalid content unittests ... fix invalid unittests with mixed relative and non-relative content modifiers and other issues; DetectContentParse19 still contains some failing dce_stub tests which are commented out.	14 years ago
Victor Julien	cdba2f50d1	Various fixes and improvements based on feedback by Coverity analyzer.	14 years ago
Anoop Saldanha	1acb7cdc7d	All http_server_body modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_SERVER_BODY	14 years ago
Anoop Saldanha	6cab663bf0	code cleanup - replace SigMatchAppendPayload with SigMatchAppendSMToList	14 years ago
Anoop Saldanha	ab35b98f76	code cleanup - remove DetectContentGetLastPattern. Replace it with SigMatchGetLastSMFromLists	14 years ago
Anoop Saldanha	d85ab5ab1f	code cleanup - remove DetectContentFindNextApplicableSM	14 years ago
Anoop Saldanha	802350f65a	code cleanup - remove DetectContentHasPrevSMPattern	14 years ago
Anoop Saldanha	9652c3672d	code cleanup - remove SigMatchGetLastPattern	14 years ago
Anoop Saldanha	dcb2afb02f	Use sm_list to differentiate between different content types while retrieving pattern ids instead of sm_type	14 years ago
Victor Julien	07e560b137	file-data: initial file_data support ... Support file_data for: content, pcre (relative), byte_test, byte_jump, byte_extract, isdataat. File_data support is handled at signature parsing time, all matches occurring after the file_data in the rule are converted to http_server_body matches. Content matches relative to the file_data are converted. Within to depth, distance to offset. Relative to the start of the body buffer.	14 years ago
Anoop Saldanha	7433d92dd2	undo this commit - ... commit eff08f93d8 Author: Anoop Saldanha <poonaatsoc@gmail.com> Date: Thu Nov 3 14:31:24 2011 +0530 update failing unittest to reflect the mpm design update Fixed a bug in the mpm code that would make all the changes in the commit just undone wrong.	14 years ago
Anoop Saldanha	eff08f93d8	update failing unittest to reflect the mpm design update	14 years ago
Anoop Saldanha	ed3b44b3b5	fix parsing content keywords. We are more strict now. All content keywords need to be enclosed in double quotes. Better validation for sid, priority and rev keywords	14 years ago
Eric Leblond	a85dc9b0e2	Add support for replace keyword. ... This patch adds support for the replace keyword. It is used with content to change selected part of the payload. The major point with this patch is that having a replace keyword made necessary to avoid all stream level check because we need to access to the could-be-modified packet payload. One of the main difficulty is to handle complex signature. If there is other content check, we must do the substitution when we're sure all match are valid. The patch adds an attribute to the thread context variable to be able to deal with recursivity of the match function. Replace is only activated in IPS mode and apply only to raw match.	14 years ago
Eric Leblond	49adc264bc	Don't print message after SCMalloc failure. ... This patch generated via coccinelle is getting rid of logging message after a SCMalloc failure. They were useless as SCMalloc already displays a message.	15 years ago
Eric Leblond	1db4aadd16	Supress usage of Packet declaration in tests. ... For convenience, a massive usage of 'Packet p;' declaration has been done in the tests function. Although this was completely legal, this is not possible anymore because of the new Packet allocation structure. This massive patch modifies all suricata files to use a SCMalloc allocated pointer to Packet instead. This patch has been done using coccinelle (http://coccinelle.lip6.fr) which is a semantic patching tool. This ensures that things like call to SCFree() should have not been forget because the semantic patch explicitly forces the call to SCFree(p) before each return. With this patch all unittests are running fine with a small and a big default packet size.	15 years ago
Eric Leblond	dd038c1906	Modify files to avoid direct pckt payload access ... This patch implements the needed modification of payload access in a Packet structure to support the abstraction introduced by the extended data system.	15 years ago
Victor Julien	014f62247a	Another batch of clang fixes. Nothing really serious. Includes a couple of fixes for broken fixes from yesterday.	15 years ago
Anoop Saldanha	3d2f81d978	replace all Signature->dmatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_DMATCH]	15 years ago
Anoop Saldanha	e0476242c6	replace all Signature->umatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_UMATCH]	15 years ago
Anoop Saldanha	e54358a9e1	replace all Signature->pmatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_PMATCH]	15 years ago
Anoop Saldanha	82fd581b64	replace all sm lists (match, pmatch, dmatch, umatch, amatch, tmatch) with an array Signature->sm_lists[]. Replace all Signature->match instances in the engine with Signature->sm_lists[DETECT_SM_LIST_MATCH]	15 years ago
Anoop Saldanha	0c5b82d891	provide separate ids for content, uricontent, http_(client_body_data|cookie|header|method|uri), when they share the same pattern	15 years ago
Anoop Saldanha	b8f5a6a4fc	throw out contents/uricnotents with invalid hex assembly	15 years ago
Anoop Saldanha	850f44022f	invalidate sigs with content/uricontent strings ", "boo, boo" + fix parsing content strings of the format content: !\"boom\";"	15 years ago
Victor Julien	fc248ca7a1	Many small performance updates.	15 years ago
Pablo Rincon	76af1b049b	Make malloc errors on initialization stage a fatal error, resulting on a exit() call	15 years ago
Victor Julien	1071a53210	Fix unittests after ip_proto keyword change.	15 years ago
Pablo Rincon	34bb107f2c	Fix for bug 207 (depth/offset not correctly updated on certain cases)	15 years ago
Anoop Saldanha	ce8d27425d	fix signature parsing to how snort does it for content based keywords along with dce_stub_data	15 years ago
Victor Julien	37442a8a84	Prefilter signatures before fully scanning them.	15 years ago
Anoop Saldanha	015385c6bd	changes to the dce parser stub data processed var. changed to stub data fresh var to indicate if the stub is fresh or not	15 years ago
Anoop Saldanha	45ea0d914e	dce stub content keywords support using dcepayload.c support for all dce related content keywords	15 years ago
Gurvinder Singh	cda664a8c4	memroy leaks fixes in detection module, app layer and counters	15 years ago
William Metcalf	2eef905c07	GPL and Copyright header updates.	15 years ago
Gerardo Iglesias Galvan	9f4fae5b1a	Fix inconsistent use of dynamic memory allocation	15 years ago
Victor Julien	7a427ec7f4	Switch to pattern id based results checking in the mpm. Move app layer proto detection towards a more signature based approach.	15 years ago
Gurvinder Singh	3721037de5	unittests for bug 134&139 and some typo correction	15 years ago
William Metcalf	ce01927515	Import of GPLv2 Header 050410	15 years ago
Gurvinder Singh	69a4fee757	fixed the API and logic error reported by clang tool	15 years ago
Pablo Rincon	227fe516a0	Adding Boyer Moore context to content patterns, should speed up the search	15 years ago
Victor Julien	ced401b554	Update http_client_body code to recent changes.	15 years ago
Anoop Saldanha	97d49d8f5e	support for http_client_body keyword	15 years ago
Pablo Rincon	c7350a8ac6	Fixing some naming convention issues and incorrect error messages	15 years ago
Pablo Rincon	b708d7f65d	Adding Uricontent inspection with spm. Modifiers for uricontent are now supported	15 years ago
Anoop Saldanha	c54b91ed94	fix for bug 113	16 years ago
Victor Julien	c1a19bcd6b	Fix compilation of new detect-filter code, fix ip-only compatibility of detect-filter code.	16 years ago
Victor Julien	80dc4f1dbe	Further simplify content api: merge flags that indicate a next relative match, remove chunks as they are unnecessary now, make negated a bitflag.	16 years ago
Victor Julien	1e01fd613c	Remove all references to the scan phase from the pattern matchers and it's api.	16 years ago
Victor Julien	dd846c9b0e	Remove all search code from the pattern matchers, cleanup mpm api, remove unused http code, more cleanups.	16 years ago