Commit Graph

40 Commits (43b5234055f3ed69d53fe8486a1cf01aac1cc198)

Author SHA1 Message Date
Victor Julien 954c43daf4 detect/classtype: allow undefined classtypes
Effect of classification on Suricata's working is minimal. Impact
of adding undefined classtypes is large: rules will fail to load
completely. This also leads multiple lines of log output per rule,
which in a large ruleset can lead to excessive output.

This patch changes the classtype keyword behavior. Instead of erroring
and invalidating a rule, we will merely warn.

The undefined classtype is then defined with a default priority,
so other rules using the classtype will not also warn. This way
there will be just a single warning per missing classtype.
7 years ago
Victor Julien 323a747f39 classtype: increase id size
Switch from u8 to u16 to allow for more classtypes.

Rename Signature::class to Signature::class_id to make it clear
it is an id.
7 years ago
Victor Julien ccf6c5a6ef classtype: small memory reduction
Reduce memory use by making sure SCClassConfClasstype
has a more optimal memory layout.
7 years ago
Victor Julien 26e2370f99 classtype: put UNITTESTS guards where appropriate 7 years ago
Victor Julien e104c3d913 classtype: reduce scope of functions 7 years ago
Victor Julien ab1200fbd7 compiler: more strict compiler warnings
Set flags by default:

    -Wmissing-prototypes
    -Wmissing-declarations
    -Wstrict-prototypes
    -Wwrite-strings
    -Wcast-align
    -Wbad-function-cast
    -Wformat-security
    -Wno-format-nonliteral
    -Wmissing-format-attribute
    -funsigned-char

Fix minor compiler warnings for these new flags on gcc and clang.
9 years ago
Jason Ish 796dd5223b tests: no longer necessary to provide successful return code
1 pass, 0 is fail.
10 years ago
Victor Julien 8394b38941 cppcheck: work around snprintf warning
Cppcheck 1.72 gives a warning on the following code pattern:

    char blah[32] = "";
    snprintf(blah, sizeof(blah), "something");

The warning is:

    (error) Buffer is accessed out of bounds.

While this appears to be a FP, in most cases the initialization to ""
was unnecessary as the snprintf statement immediately follows the
variable declaration.
10 years ago
Victor Julien 5fff250749 multi-detect: make classification prefix aware
Make classification loading prefix aware, so it can be part of tenant
configuration.

If the setting is missing from the tenant, the global setting is tried
and if that too is missing, the global default is used.
11 years ago
Victor Julien 46d401e3bb classification: update pcre globals use
Don't update globals each time we parse, but instead do it once at
startup.
11 years ago
Victor Julien 393689ce44 classification: remove global from parsing
Parsing code used a 'fd' global. Remove this.
11 years ago
Victor Julien 54d5e2eed5 coverity fix: don't do pointer check on static array 11 years ago
Victor Julien cc38df8074 classification: cleanups
Reduce hash table size as regular classification files are usually
below 100 in size. It's not performance critical anyway.

Convert pcre_get_substring calls to pcre_copy_substring.
11 years ago
Victor Julien 092ddc1853 detect: no exit on reference/classification errors
Don't exit on errors during classification and reference parsing.

Add some suppression of error messages when in unittest mode.
11 years ago
Victor Julien 8344854a1f Don't alloc for hash lookup in SCClassConfGetClasstype 13 years ago
Victor Julien 84bad6db77 Silence compiler warnings found by clang 14 years ago
Victor Julien d8356c5ebd Windows build and other misc fixes. 14 years ago
Victor Julien 988f22ee2e Free pcre study structs for classification, threshold and reference parsing. 14 years ago
Anoop Saldanha 0c24bbab0c code cleanup for live swap 14 years ago
Anoop Saldanha 6003c7cb6b clean classification config API 14 years ago
Eric Leblond 2d22f667c2 config: use config file in sysconfdir by default. 14 years ago
Anoop Saldanha 420befb180 Changed my email address to anoopsaldanha at gmail dot com from my current one 15 years ago
Anoop Saldanha 4307ea2348 Replace all frees with SCFrees 15 years ago
Gerardo Iglesias Galvan 44692c83aa Properly check retval for config and conversion function calls 15 years ago
Gerardo Iglesias Galvan bd6d1bfac4 Fix potential crash in classtype parsing code 15 years ago
Victor Julien 7a6d4b57f0 Add support for class id in classification code. Submitted by firnsy@securixlive.com, thanks. 16 years ago
Gerardo Iglesias Galvan 9f4fae5b1a Fix inconsistent use of dynamic memory allocation 16 years ago
William Metcalf ce01927515 Import of GPLv2 Header 050410 16 years ago
Pablo Rincon bd8111f868 Moving inline functions to the .h files, so gcc can inline them correctly 16 years ago
Gurvinder Singh 7438f981da stream memory leaks fixed and unit tests added 17 years ago
Pablo Rincon 25a3a5c6d8 Adding mem wrapper to debug runtime alloc()/free() functions. Fixing some memory leaks. 17 years ago
Pablo Rincon d0404d8447 Renaming errors with naming conventions 17 years ago
Pablo Rincon 673afeb4d3 fmemopen wrapper added (fix compilation problems on macosx and freebsd) 17 years ago
Gurvinder Singh fea277b2aa memory leak fixes 17 years ago
Gurvinder Singh 5c8d90afc8 memory leak fixes 17 years ago
Victor Julien f5ef0cc3b8 Exit if no classification.config has been found. 17 years ago
Victor Julien d284f0d333 Set default classification file location in the config file. 17 years ago
Victor Julien ecab1fae36 Remove contents of VRT classification.config. 17 years ago
Anoop Saldanha 011b74df63 Modify the classification config tests to use the buffer than a temp file and also fix an invalid free 17 years ago
Anoop Saldanha bc4df59414 Support for Classtype keyword and Classification Config file 17 years ago