484 Commits (f4ce9011d22d2323b1029ca907f4578fe4b99be3)

Author	SHA1	Message	Date
Anoop Saldanha	f4ce9011d2	make mpm ctx container de_ctx specific. Also introduce global variable in mpm_ctx. this is a workaround for cleaning non global mpm_ctx's since we now don't supply the de_ctx around the detection engine API	13 years ago
Victor Julien	60c3af9303	detect: Only run mpm on HTTP buffers in the proper direction. Fixes a file_data FN.	13 years ago
Anoop Saldanha	0d602d9cde	we now support offset, depth inspection against all packet payloads and stream messages	13 years ago
Anoop Saldanha	db8500bb26	fast pattern cleanup - Remove FastPatternSupportEnabledForSigMatchList() and all it's associated structures	13 years ago
Anoop Saldanha	988c92f71c	http user agent keyword + mpm + inspection + fast pattern support added	13 years ago
Eileen Donlon	c81020e9a3	feature 349 rule analyzer v1	13 years ago
Victor Julien	3df573219b	Fix compilation warning.	13 years ago
Victor Julien	9f7588a756	Add filemd5 keyword that loads a list of md5's to match a file's md5 against.	13 years ago
Eric Leblond	a0e57f58e5	OpenBSD: introduce SCLocalTime function. ... This function is a wrapper to localtime_r. It is needed to avoid a compilation warning on OpenBSD. I'm forced to type the function to a non pointer first parameter. If not we will have to use two differents functions in OpenBSD where tv->tv_sec is a long (different from time_t).	13 years ago
Victor Julien	cae46ab5eb	pcre: print filename and line number for JIT warning.	13 years ago
Victor Julien	ea0d172693	No longer pass StreamMsg to output for alert logging, instead use the same callback code as is used for state alerts.	13 years ago
Anoop Saldanha	64a04fc721	code cleanup	13 years ago
Anoop Saldanha	493c3db413	fix FNs for flow- only_stream and no_stream options	13 years ago
Anoop Saldanha	ad36d55771	code cleanup - indentation fix	13 years ago
Anoop Saldanha	046819e1b8	bug 452 - fix detection bug for sigs that don't have a content but need payload inspection	13 years ago
Victor Julien	98c30be2db	ipv6: improve handling of packets with duplicate (or more) ipv6 extension headers.	13 years ago
Victor Julien	d378b76c04	http: body inspection improvement ... Improve http_client_body and file_data performance when request and response body limits are set to high values.	13 years ago
Victor Julien	40fcae3aa0	Minor unittest fixes to make Coverity happy.	13 years ago
Victor Julien	0a80e362aa	Fix some minor clang scan-build warnings.	13 years ago
Victor Julien	19a7e7f395	flow: create a flow lock macro API, implement it for mutex and rwlocks. Mutex remains the default.	13 years ago
Pierre Chifflier	4be65fd016	TLS handshake: decode the SERVER_CERTIFICATE message ... Add a decoder for the SERVER_CERTIFICATE during a TLS handshake, extracts the certificates and keep the subject name. Add the tls.subject keyword for substring match in rules (TLS layer). Signed-off-by: Pierre Chifflier <pierre.chifflier@ssi.gouv.fr>	13 years ago
Victor Julien	8b1333a277	Add more flow lock assertions to the debug validation code.	14 years ago
Anoop Saldanha	059ee217ff	All http_http_raw_uri modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_RAW_URI	14 years ago
Anoop Saldanha	b1a0d35106	All http_http_cookie modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_COOKIE	14 years ago
Anoop Saldanha	49bdad9345	All http_http_method modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_METHOD	14 years ago
Anoop Saldanha	97d8fc9cba	All http_http_raw_header modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_RAW_HEADER	14 years ago
Anoop Saldanha	97308674ee	All http_http_header modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_HEADER	14 years ago
Anoop Saldanha	a5b46e727c	All http_client_body modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_CLIENT_BODY	14 years ago
Anoop Saldanha	4810ee9c5f	All uricontent modified patterns now are DETECT_CONTENT and not DETECT_URICONTENT. Step towards unifying all content based patterns. Makes way for easier management of patterns	14 years ago
Anoop Saldanha	e682796d03	feature #414 - support listing supported keywords. Remove support for dummy keywords __address__, __proto__, __port__. Remove support for recursive keyword and all references to it	14 years ago
Anoop Saldanha	35f1f7e8d9	unify payload detection engines + fix other bugs in pcre init	14 years ago
Anoop Saldanha	0677190960	rebase commit for hscd and hsmd patches	14 years ago
Anoop Saldanha	09313cf9bd	Support http stat code detection engine, fast pattern(mpm engine included). Fix http stat code setup function. Fix pcre option for stat msg keyword. With this the pcre options for server_body is Q, for stat_msg is Y and for stat_code is S	14 years ago
Anoop Saldanha	2007c2711c	Support http stat msg detection engine, fast pattern(mpm engine included). Fix http stat msg setup function. Fix pcre option for stat msg keyword	14 years ago
Victor Julien	9dc153c8f4	Fix path handling for including rule files on win32.	14 years ago
Anoop Saldanha	716afac5a2	fix debug messages that have references to the old mpm contexts	14 years ago
Anoop Saldanha	9a665e035b	code cleanup over last 2 commits	14 years ago
Anoop Saldanha	419cdc8558	support splitting mpm ctxs based on direction v2	14 years ago
Victor Julien	28e15be526	Clean up default output. Use simpler output format for releases.	14 years ago
Victor Julien	6eeab37ab3	Add post-match list, move flowbits set, etc functions to it. Move flowint set, etc functions to it as well.	14 years ago
Victor Julien	aac2d91bcc	Set DROP flag for reject action so in addition to sending the rst, in IPS mode also drop the offending packet.	14 years ago
Victor Julien	f084874998	Fix HTTP state and raw stream not being inspected at the same time. Adds an exception to transaction id handling for HTTP.	14 years ago
Anoop Saldanha	9c4954ff42	support http response raw header inspection + carry out hrhd mpm on both request/response headers + add unittests for the same	14 years ago
Anoop Saldanha	30247dce8c	bug 389 - support http response header inspection + fix bug with stateful inspection for sigs that would have both request/response inpection	14 years ago
Victor Julien	21ee59e6f3	Add signature direction (flow:toserver/flow:toclient) as a signature flag.	14 years ago
Victor Julien	d5402d33d4	Simplify detection loop. Inspect packet keywords before the state.	14 years ago
Anoop Saldanha	eea5ab4a7a	Support for app layer decoder events added + app_layer_event keyword added	14 years ago
Anoop Saldanha	517040c4af	indentation fix	14 years ago
Anoop Saldanha	37b223645a	fix detection engine for alert stability. Fix cases where we have multiple rules having same pattern. We should see good perf increase(~5%) with this change, now that we avoid unnecessary inspection"	14 years ago
Anoop Saldanha	92643f6110	introduce separate mpm ctxs for tcp/udp/other_protos	14 years ago