146 Commits (2e8678a5ffa740434deb8880de1efb7e59ea0cfb)

Author	SHA1	Message	Date
Victor Julien	17e77346de	content: fix depth/within, offset/distance mix	8 years ago
Victor Julien	9e37e266b6	detect: content limits propagation ... Propagate inspection limits from anchered keywords to the rest of a rule. Examples: content:"A"; depth:1; is anchored, it can only match in the first byte content:"A"; depth:1; content:"BC"; distance:0; within:2; "BC" can only be in the 2nd and 3rd byte of the payload. So effectively it has an implicite offset of 1 and an implicit depth of 3. content:"A"; depth:1; content:"BC"; distance:0; can assume offset:1; for the 2nd content. content:"A"; depth:1; pcre:"/B/R"; content:"C"; distance:0; can assume at least offset:1; for content "C". We can't analyzer the pcre pattern (yet), so we assume it matches with 0 bytes. Add lots of test cases.	8 years ago
Victor Julien	e087d93883	detect: reject dsize rules that can't match ... Rules can contain conflicting statements and lead to a unmatchable rule. 2 examples are rejected by this patch: 1. dsize < content 2. dsize < content@offset Bug #2187	9 years ago
Victor Julien	ab1200fbd7	compiler: more strict compiler warnings ... Set flags by default: -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wwrite-strings -Wcast-align -Wbad-function-cast -Wformat-security -Wno-format-nonliteral -Wmissing-format-attribute -funsigned-char Fix minor compiler warnings for these new flags on gcc and clang.	9 years ago
Victor Julien	342059835f	detect-parse: improve common parser ... In preparation of turning input to keyword parsers to const add options to the common rule parser to enforce and strip double quotes and parse negation support. At registration, the keyword can register 3 extra flags: SIGMATCH_QUOTES_MANDATORY: value to keyword must be quoted SIGMATCH_QUOTES_OPTIONAL: value to keyword may be quoted SIGMATCH_HANDLE_NEGATION: leading ! is parsed In all cases leading spaces are removed. If the 'quote' flags are set, the quotes are removed from the input as well.	9 years ago
Victor Julien	dfac5276b8	detect: remove unused SIGMATCH_PAYLOAD flag	9 years ago
Victor Julien	fe415ae518	detect: remove DMATCH list	9 years ago
Victor Julien	6bd37611ee	file_data: dynamic buffer	9 years ago
Victor Julien	f370e88135	detect: move init only Signature members to init_data	9 years ago
Victor Julien	39613778cd	detect: make setup/free/match funcs static where possible	9 years ago
Victor Julien	d50b4b8471	content: fix -Wshadow warning	10 years ago
Eric Leblond	a2e2f50fb9	documentation: fix list keywords URLs ... Update URLs in keyword definition to point to sphinx documentation.	10 years ago
Andreas Herz	65fd09a399	rule-parsing: reject unescaped double quote within content section	10 years ago
Justin Viiret	cce2d114e8	spm: add and use new SPM API ... This new API allows for different SPM implementations, using a function pointer table like that used for MPM. This change also switches over the paths that make use of DetectContentData (which previously used BoyerMoore directly) to the new API.	10 years ago
Jason Ish	796dd5223b	tests: no longer necessary to provide successful return code ... 1 pass, 0 is fail.	10 years ago
Victor Julien	f0ba00e51d	detect: remove old unused code	10 years ago
Victor Julien	4f8e1f59a6	mpm: remove obsolete mpm algos ... Remove: ac-gfbs, wumanber, b2g, b3g.	10 years ago
Victor Julien	f005310ddf	detect: add corner case mpm test	10 years ago
Jason Ish	3e5b8f48b1	Bug 1281 - Add tests for rule content of lengths > 255.	11 years ago
Jason Ish	e2b04635a7	Bug 1281 - Accept rule content with lengths greater than 255.	11 years ago
Giuseppe Longo	04561f13d3	signature: set flags and test the protocol ... This checks if the signature's protocol is http when setup the content keyword. Also sets the proper flags based by protocol since the flag SIG_FLAG_TOSERVER has to be set if the proto is smtp, otherwise SIG_FLAG_TOCLIENT is it's http.	11 years ago
Giuseppe Longo	41a1a9f4af	find and replace HSBDMATCH by FILEDATA ... This commit do a find and replace of the following: - DETECT_SM_LIST_HSBDMATCH by DETECT_SM_LIST_FILEDATA sed -i 's/DETECT_SM_LIST_HSBDMATCH/DETECT_SM_LIST_FILEDATA/g' src/* - HSBD by FILEDATA: sed -i 's/HSBDMATCH/FILEDATA/g' src/*	11 years ago
Ken Steele	923a77e952	Change Match() function to take const SigMatchCtx* ... The Match functions don't need a pointer to the SigMatch object, just the context pointer contained inside, so pass the Context to the Match function rather than the SigMatch object. This allows for further optimization. Change SigMatch->ctx to have type SigMatchCtx* rather than void* for better type checking. This requires adding type casts when using or assigning it. The SigMatch contex should not be changed by the Match() funciton, so pass it as a const SigMatchCtx*.	11 years ago
Ken Steele	8f1d75039a	Enforce function coding standard ... Functions should be defined as: int foo(void) { } Rather than: int food(void) { } All functions where changed by a script to match this standard.	12 years ago
Ken Steele	f9705377ae	Remove pkt variable from Packet structure. ... The uint8_t *pkt in the Packet structure always points to the memory immediately following the Packet structure. It is better to simply calculate that value every time than store the 8 byte pointer.	13 years ago
Eric Leblond	79fcf1378a	Use unlikely in malloc failure test. ... This patch is a result of applying the following coccinelle transformation to suricata sources: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc|SCMallocAligned|SCRealloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	13 years ago
Victor Julien	7f140f6726	Coverity 1038111: fix local overrun of a string in app layer proto detect setup code.	13 years ago
Eric Leblond	c5bd04f102	unittest: recycle packet before exit ... To avoid an issue with flow validation, we need to recycle the packet before cleaning the flow.	13 years ago
Victor Julien	7292998a58	Content: set up sticky buffers like file_data and dce_stub_data w/o flags, but with a list variable	13 years ago
Victor Julien	6ba52230ed	Update DetectContentDataParse to reflect the actual data types content uses.	13 years ago
Victor Julien	19511cda97	Remove obsolete DetectParseContentString function, it has been replaced by DetectContentDataParse	13 years ago
Anoop Saldanha	4c6efa2d40	Update content id assignment. ... All fp id assignment now happens in one go. Also noticing a slight perf increase, probably emanating from improved cache perf. Removed irrelevant unittests as well.	13 years ago
Anoop Saldanha	0b5d277254	code cleanup for all content based keywords.	13 years ago
Anoop Saldanha	51dcf19817	turn dce_stub_data into a sticky buffer.	13 years ago
Anoop Saldanha	34d5aadcb8	warn users that we don't support content strings whose length's > 255.	14 years ago
Eric Leblond	6842545331	Add documentation url in list-keyword output. ... The output of the list-keyword is modified to include the url to the keyword documentation when this is available. All documented keywords should have their link set. list-keyword can be used with an optional value: no option or short: display list of keywords csv: display a csv output on info an all keywords all: display a human readable output of keywords info $KWD: display the info about one keyword.	14 years ago
Victor Julien	84bad6db77	Silence compiler warnings found by clang	14 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	14 years ago
Victor Julien	40fcae3aa0	Minor unittest fixes to make Coverity happy.	14 years ago
Eileen Donlon	793478a832	reject rules with invalid hex digits in content	14 years ago
Eileen Donlon	1a46d7a53a	fix more invalid content unittests ... fix invalid unittests with mixed relative and non-relative content modifiers and other issues; DetectContentParse19 still contains some failing dce_stub tests which are commented out.	14 years ago
Victor Julien	cdba2f50d1	Various fixes and improvements based on feedback by Coverity analyzer.	14 years ago
Anoop Saldanha	1acb7cdc7d	All http_server_body modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_SERVER_BODY	14 years ago
Anoop Saldanha	6cab663bf0	code cleanup - replace SigMatchAppendPayload with SigMatchAppendSMToList	14 years ago
Anoop Saldanha	ab35b98f76	code cleanup - remove DetectContentGetLastPattern. Replace it with SigMatchGetLastSMFromLists	14 years ago
Anoop Saldanha	d85ab5ab1f	code cleanup - remove DetectContentFindNextApplicableSM	14 years ago
Anoop Saldanha	802350f65a	code cleanup - remove DetectContentHasPrevSMPattern	14 years ago
Anoop Saldanha	9652c3672d	code cleanup - remove SigMatchGetLastPattern	14 years ago
Anoop Saldanha	dcb2afb02f	Use sm_list to differentiate between different content types while retrieving pattern ids instead of sm_type	14 years ago
Victor Julien	07e560b137	file-data: initial file_data support ... Support file_data for: content, pcre (relative), byte_test, byte_jump, byte_extract, isdataat. File_data support is handled at signature parsing time, all matches occurring after the file_data in the rule are converted to http_server_body matches. Content matches relative to the file_data are converted. Within to depth, distance to offset. Relative to the start of the body buffer.	15 years ago