Victor Julien
|
6a5d2cb40d
|
Fix potential locking issue in out of memory conditions in the http_header, http_raw_header code. Fix other potential small issues in http_ code.
|
14 years ago |
Anoop Saldanha
|
eecf2d7e13
|
Add the makefile.am addition that I forgot to add in the previous commit for http_raw_header
|
14 years ago |
Anoop Saldanha
|
7ec0382774
|
support fast pattern for http raw header. Also support relative modifiers for http raw header
|
14 years ago |
Victor Julien
|
0c806f70bb
|
Fix --enable-debug compilation, just unittest with --enable-debug-validation enabled.
|
14 years ago |
Victor Julien
|
1a32d9b5ec
|
Fix printing unprintable characters in the engine-analysis fast_pattern mode.
|
14 years ago |
Anoop Saldanha
|
075719ea8c
|
fix fast pattern unittests
|
14 years ago |
Victor Julien
|
18d3c87947
|
Add check to fast pattern keyword to make sure that the offset and length don't exceed the actual pattern length.
|
14 years ago |
Anoop Saldanha
|
c61c68fd36
|
mpm and fast pattern support for http_header. Also support relative modifiers for http_header
|
14 years ago |
Anoop Saldanha
|
778ec0939c
|
make client body buffer limit configurable. Also some minor changes
|
14 years ago |
Anoop Saldanha
|
fc46f216ca
|
detect-http-header.c cleanup before we start working on it
|
14 years ago |
Anoop Saldanha
|
302011dbca
|
fix compilation issues with debug enabled.
|
14 years ago |
Anoop Saldanha
|
0aa5cffb12
|
fast pattern support for http_client_body keyword added. Also mpm support for http_client_body added
|
14 years ago |
Anoop Saldanha
|
c227aeeacb
|
remove support for skipping reinspecting fast pattern contents once again during packet payload inspection. Also make some changes to our detection engine
|
14 years ago |
Anoop Saldanha
|
bbd0c5056b
|
store the content added for mpm inside Signature. also carry out an unconditional cleanup of packet pattern matcher pmq det_ctx->pmq
|
14 years ago |
Anoop Saldanha
|
68b78664fa
|
Add unittests for checking content flags. Fix indentation in PopulateMpmAddPatternToMpm(). Also fix DETECT_CONTENT_IS_SINGLE
|
14 years ago |
Anoop Saldanha
|
b15ada8102
|
set content_packet_mpm and content_stream_mpm flag for content to prevent double check inside inspection code
|
14 years ago |
Anoop Saldanha
|
67aecc73c2
|
set content_uri_mpm flag for uri content to prevent double check inside inspection code
|
14 years ago |
Anoop Saldanha
|
1cd8bd3d3c
|
make changes for uri mpm, when uricontent is negated and also is the fp and we ignore checking it once again in engine-uri.c
|
14 years ago |
Anoop Saldanha
|
6df051321f
|
fix fp when content is negated and also added to mpm
|
14 years ago |
Anoop Saldanha
|
5c6a65dc58
|
support relative modifiers for http_client_body. Introduce body processing engine in detect-engine-hcbd.[ch]
|
14 years ago |
Victor Julien
|
234656e5f6
|
Fix compilation in --enable-debug mode.
|
14 years ago |
Anoop Saldanha
|
eade60f0fd
|
make some name changes. break PopulateMpm(). Set the avoid mpm double check flags
|
14 years ago |
Anoop Saldanha
|
96bf15bd74
|
unifying content structure - http_stat_msg now uses DetectContentData
|
14 years ago |
Anoop Saldanha
|
4c53a9d606
|
unifying content structure - http_header now uses DetectContentData
|
14 years ago |
Anoop Saldanha
|
1957eee389
|
unifying content structure - http_method now uses DetectContentData
|
14 years ago |
Anoop Saldanha
|
041f5b1a4f
|
unifying content structure - http_cookie now uses DetectContentData
|
14 years ago |
Anoop Saldanha
|
f05b0f4e1e
|
unifying content structure - http_client_body now uses DetectContentData
|
14 years ago |
Anoop Saldanha
|
4883efd0f6
|
unifying content structure - uricontent now uses DetectContentData
|
14 years ago |
Anoop Saldanha
|
3b0a9ca97e
|
add support for http_uri; content fast_patterns
|
14 years ago |
Anoop Saldanha
|
3c73854d2d
|
completely remove populate_mpm_flags. Some indentation changes. Also disable support to avoid double checks inside payload inspection for patterns added to mpm. Also add support to MpmFactory to reclaim a mpm_ctx
|
14 years ago |
Anoop Saldanha
|
fde2c64ea7
|
fix code after fresh rebase. change some pmatch and amatch lists to sm_lists[] format
|
14 years ago |
Anoop Saldanha
|
a6899218fc
|
remove populate_mpm_flags from inside PatternMatchPreparePopulateMpm()
|
14 years ago |
Anoop Saldanha
|
6eaba8941c
|
Use new flags to indicate uricontent has a mpm set
|
14 years ago |
Anoop Saldanha
|
46b4806d8e
|
use a single populatempm() function to add the right content for mpm
|
14 years ago |
Anoop Saldanha
|
4a038511ff
|
Change the struct members uricontent and uricontent_len in DetectUricontentData to content and content_len. Make replacements everywhere else in the codebase to accomodate these changes
|
14 years ago |
Anoop Saldanha
|
ede7be34b5
|
replace all Signature->tmatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_TMATCH]
|
14 years ago |
Anoop Saldanha
|
3d2f81d978
|
replace all Signature->dmatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_DMATCH]
|
14 years ago |
Anoop Saldanha
|
a7353be20d
|
replace all Signature->amatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_AMATCH]
|
14 years ago |
Anoop Saldanha
|
e0476242c6
|
replace all Signature->umatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_UMATCH]
|
14 years ago |
Anoop Saldanha
|
e54358a9e1
|
replace all Signature->pmatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_PMATCH]
|
14 years ago |
Anoop Saldanha
|
82fd581b64
|
replace all sm lists (match, pmatch, dmatch, umatch, amatch, tmatch) with an array Signature->sm_lists[]. Replace all Signature->match instances in the engine with Signature->sm_lists[DETECT_SM_LIST_MATCH]
|
14 years ago |
Anoop Saldanha
|
3656879aa0
|
fix some dce opnum/stub tests that would have shown success always irrespective of test results
|
14 years ago |
Anoop Saldanha
|
4b77f132df
|
add support for sigs with uricontent fast_pattern
|
14 years ago |
Anoop Saldanha
|
ea8eaf31aa
|
Fix fast_pattern tests that always showed success, irrespective of test results
|
14 years ago |
Victor Julien
|
966c7349d3
|
Make sure we have a response message before inspecting it in http_stat_msg.
|
15 years ago |
Victor Julien
|
07ec1ee10e
|
Slightly cleanup detect-engine.sgh-mpm-context option parsing.
|
15 years ago |
Anoop Saldanha
|
c89507836b
|
if sgh-mpm-context is not available in conf, alias the auto case inside the engine
|
15 years ago |
Victor Julien
|
bac621760e
|
Fix a potential invalid memory read in the protocol name code used by alert-fastlog.
|
15 years ago |
Gurvinder Singh
|
f92ba23331
|
add the support for >= and <= operator for byte_test
|
15 years ago |
Victor Julien
|
412498f4e4
|
Converts port vars in http logger from uint32_t to Port and update output.
|
15 years ago |