29 Commits (464ff80c6a8efd1212b617a80c726173573caf42)

Author	SHA1	Message	Date
Victor Julien	13cebb1857	detect: fix heap overflow issue with buffer setup ... In some cases, the InspectionBufferGet function would be followed by a failure to set the buffer up, for example due to a HTTP body limit not yet being reached. Yet each call to InspectionBufferGet would lead to the matching list_id to be added to the DetectEngineThreadCtx::inspect.to_clear_queue. This array is sized to add each list only once, but in this case the same id could be added multiple times, potentially overflowing the array.	5 years ago
Victor Julien	26bcc97515	detect/keywords: dynamic version part of doc URL	6 years ago
Mats Klepsland	a260a57b68	detect-tls-sni: move unittests to tests/	7 years ago
Mats Klepsland	12d37b8b2c	detect-tls: tidy up unittests ... By doing the following: - removing unnecessary locks - moving variable declarations - removing redundant function 'SigCleanSignatures'	7 years ago
Mats Klepsland	285855d928	detect-tls: remove NULL settings from keyword registration	7 years ago
Mats Klepsland	008f08c1b3	detect-tls: declare ssl_state as const in GetData()	7 years ago
Mats Klepsland	0f7f35bd85	detect-tls: check return values of functions on setup ... Check the return values of DetectBufferSetActiveList() and DetectSignatureSetAppProto().	7 years ago
Mats Klepsland	1c04d7cdae	detect-tls: remove confusing underscores from variables ... Remove confusing underscore prefix from variables in GetData() for all tls keywords.	7 years ago
Jeff Lucovsky	7f102d95b6	detect: Modernize TLS keywords ... This changeset adds keywords for "tls.<name>" and moves the existing value of "tls_<name>" to an alias.	7 years ago
Victor Julien	0b3220a0df	detect: improve inspect buffer handling ... Fix and Optimize cleanup. For the simple single inspect buffer optimize the cleanup by keeping track of the actually used buffers. This avoid looping over unused buffers. Fix the case of cleaning not being done after a tx if the next tx is also inspected in the context of the same packet. Fix cleanup of the multi-inspect buffers. Optimize in 2 ways. First like with single keep track of which multi-inspect buffers have been used. Second, keep a max of the buffers within a multi-inspect buffer. Use this max to limit (nested) looping.	7 years ago
Mats Klepsland	efdc592172	detect-tls-sni: use *_Register2 API functions ... Use *_Register2 API functions when registering 'tls_sni' detection keyword.	8 years ago
Victor Julien	ab1200fbd7	compiler: more strict compiler warnings ... Set flags by default: -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wwrite-strings -Wcast-align -Wbad-function-cast -Wformat-security -Wno-format-nonliteral -Wmissing-format-attribute -funsigned-char Fix minor compiler warnings for these new flags on gcc and clang.	9 years ago
Victor Julien	d304be5bc3	detect: register progress in inspect engines ... Register required progress so we can stop inspecting as soon as the progress isn't far enough yet.	9 years ago
Victor Julien	dfac5276b8	detect: remove unused SIGMATCH_PAYLOAD flag	9 years ago
Victor Julien	775e182531	detect: remove AppLayerMatch API call	9 years ago
Victor Julien	8bd1422948	detect: detect engine registration cleanup	9 years ago
Victor Julien	9ba386a141	tls: dynamic buffers	9 years ago
Victor Julien	f370e88135	detect: move init only Signature members to init_data	9 years ago
Eric Leblond	f407d77016	detect-tls-sni: add link to documentation	9 years ago
Sascha Steinbiss	e6044aaf1c	mpm/spm: check for SSSE3 and enable/disable HS ... The new Hyperscan 4.4 API provides a function to check for SSSE3 presence at runtime. This allows us to fall back to non-Hyperscan matchers on systems without SSSE3 even when the suricata executable is built with Hyperscan support. Addresses Redmine issue #2010. Signed-off-by: Sascha Steinbiss <sascha@steinbiss.name> Tested-by: Arturo Borrero Gonzalez <arturo@debian.org>	9 years ago
Victor Julien	a87c196b60	tls_sni: register inspect engine from keyword	9 years ago
Victor Julien	960461f4db	fast_pattern: register app layer mpms automatically ... Allow for duplicate registrations for the same list. After the first registration new calls will be ignored.	9 years ago
Victor Julien	e68b2214e5	tls: register mpm from keywords	9 years ago
Giuseppe Longo	675fa56497	app-layer: add ThreadVars to AppLayerParserParse ... To be able to add a transaction counter we will need a ThreadVars in the AppLayerParserParse function. This function is massively used in unittests and this result in an long commit.	9 years ago
Mats Klepsland	d9e2cde585	detect-tls-sni: use new unit test macros	9 years ago
Mats Klepsland	8e77d0c312	detect: fix faulty tls_sni unittests	9 years ago
Victor Julien	6530c3d0d8	unittests: replace SCMutex* calls by FLOWLOCK_*	9 years ago
Victor Julien	9030e89c94	detect: don't set alproto while registering keyword ... The field is not used except for some printing, and is wrong for many keywords.	9 years ago
Mats Klepsland	a13df67864	detect: add (mpm) keyword for tls_sni ... Match on server name indication (SNI) extension in TLS using tls_sni keyword, e.g: alert tls any any -> any any (msg:"SNI test"; tls_sni; content:"example.com"; sid:12345;)	10 years ago