16 Commits (541cafa40a1a6a7d183f9105f61160c986e2e3e0)

Author	SHA1	Message	Date
Victor Julien	da89164ba1	detect: spelling: DetectBufferMpmRegistry	3 years ago
Victor Julien	5890a8a8ab	detect: register multi-buffer keywords ... Register the keywords that use multi buffer support as such, so that rule parsing can set them up with multi-instance support. Ticket: #5784.	3 years ago
Victor Julien	2c0e434bb8	detect: pass de_ctx to DetectBufferSetActiveList	3 years ago
Victor Julien	977c5ea719	detect: initialize empty buffers	4 years ago
Victor Julien	6f1574276f	detect/mqtt: update buffer initialization logic	4 years ago
Philippe Antoine	ad713246a9	src: remove double includes ... Keep the unconditional include to be sure it works git grep '#include "' src/*.c | sort | uniq -c | awk '$1 > 1'	4 years ago
Victor Julien	3263202094	detect/tx: add AppLayerTxData to PrefilterTx ... In preparation of some file inspection optimizations, for which we need the tx data. Update all users.	4 years ago
Victor Julien	040404b093	detect/profiling: track bytes scanned by prefilter engines	4 years ago
Victor Julien	e250ef6402	debug: remove empty header	4 years ago
Philippe Antoine	b8524e70d9	detect: change InspectEngineFuncPtr2 to return uint8_t	4 years ago
Victor Julien	3c1cc1e345	mqtt: move sub/unsub limits into app-layer config	5 years ago
Sascha Steinbiss	4c0ef73bf2	detect/mqtt: add topic inspection limit ... We add a new 'mqtt.(un)subscribe-topic-match-limit' option to allow a user to specify the maximum number of topics in a MQTT SUBSCRIBE or UNSUBSCRIBE message to be evaluated in detection.	5 years ago
Philippe Antoine	7d0a39412b	detect: use u32 for InspectionBufferMultipleForList ... So that we do not have an endless loop casting index to u16 and having more than 65536 buffers in one transaction Changes for all protocols, even ones where it is impossible to have such a pattern, so as to avoid bad pattern copy/paste in the future	5 years ago
Victor Julien	3dc50322db	detect: fix multi inspect buffer issue; clean up ... Fix multi inspect buffer API causing cleanup logic in the single inspect buffer paths. This could lead to a buffer overrun in the "to clear" logic. Multi buffers now use InspectionBufferSetupMulti instead of InspectionBuffer. This is enforced by a check in debug validation. Simplify the multi inspect buffer setup code and update the callers.	5 years ago
Victor Julien	13cebb1857	detect: fix heap overflow issue with buffer setup ... In some cases, the InspectionBufferGet function would be followed by a failure to set the buffer up, for example due to a HTTP body limit not yet being reached. Yet each call to InspectionBufferGet would lead to the matching list_id to be added to the DetectEngineThreadCtx::inspect.to_clear_queue. This array is sized to add each list only once, but in this case the same id could be added multiple times, potentially overflowing the array.	6 years ago
Sascha Steinbiss	c31360070b	rust/mqtt: add MQTT parser	6 years ago