Commit Graph

7368 Commits (aaf0fe4d29e5c9d0319732c07c17bd3c1df381ea)
 

Author SHA1 Message Date
Victor Julien 798ba010ca prefilter: use array of engines per sgh
Instead of the linked list of engines setup an array
with the engines. This should provide better locality.

Also shrink the engine structure so that we can fit
2 on a cacheline.

Remove the FreeFunc from the runtime engines. Engines
now have a 'gid' (global id) that can be used to look
up the registered Free function.
8 years ago
Victor Julien 8321f04ef3 prefilter: clean up setup code 8 years ago
Victor Julien d36c0c15ea detect: reshuffle keyword registration order
The order of keyword registration currently affects inspect engine
registration order and ultimately the order of inspect engines per
rule. Which in turn affects state keeping.

This patch makes sure the ordering is the same as with older
releases.
8 years ago
Victor Julien 58ac4027ef detect: clean up inspect engine registration 8 years ago
Victor Julien a24870f29f detect app-layer-event: clean up registration
Move engine and registration into the keyword file.

Register as 'ALPROTO_UNKNOWN' instead of per alproto. The
registration will only apply it to those rules that have
events set.
8 years ago
Victor Julien 9e35fa7f41 detect: remove empty app registration table 8 years ago
Victor Julien 8a0bea872c template_buffer: register inspect engine from keyword 8 years ago
Victor Julien 6f253e1ea7 file detect: register inspect engines from keyword 8 years ago
Victor Julien 08d0fe0916 modbus detect: register inspect engine from keyword 8 years ago
Victor Julien 2db094ab7a dns detect: register inspect engine from keyword 8 years ago
Victor Julien c9bb762f64 tls_cert_issuer: register inspect engine from keyword 8 years ago
Victor Julien e28e98bcaa tls_cert_subject: register inspect engine from keyword 8 years ago
Victor Julien a87c196b60 tls_sni: register inspect engine from keyword 8 years ago
Victor Julien 200a4c1593 http_stat_code: register inspect engine from keyword 8 years ago
Victor Julien cd705752db http_stat_msg: register inspect engine from keyword 8 years ago
Victor Julien 20e93ba419 file_data: register inspect engine from keyword 8 years ago
Victor Julien 0496b3f6a5 http_raw_host: register inspect engine from keyword 8 years ago
Victor Julien a00629ab55 http_host: register inspect engine from keyword 8 years ago
Victor Julien edb2936998 http_user_agent: register inspect engine from keyword 8 years ago
Victor Julien fc857c5455 http_raw_uri: register inspect engine from keyword 8 years ago
Victor Julien b1adea6eee http_cookie: register inspect engine from keyword 8 years ago
Victor Julien cd8b1b0b4c http_method: register inspect engine from keyword 8 years ago
Victor Julien b314829614 http_raw_header: register inspect engine from keyword 8 years ago
Victor Julien eb19eb3fe4 http_header: register inspect engine from keyword 8 years ago
Victor Julien 4096f76b1b http_client_body: register inspect engine from keyword 8 years ago
Victor Julien b96c2c5db5 http_uri: register inspect engine from keyword 8 years ago
Victor Julien cc96fedb90 http_response_line: register inspect engine from keyword 8 years ago
Victor Julien 0feeb8d538 http_request_line: register inspect engine from keyword 8 years ago
Victor Julien 5bde86b0e8 detect-engine: new registration call
Make it more in line with MPM registration.
8 years ago
Victor Julien 9a0bbd6239 detect mpm: small optimization 8 years ago
Victor Julien ad3c97f470 detect-mpm: cleanup 8 years ago
Victor Julien 5f994756e6 detect-engine: improved inspect engines
Inspect engines are called per signature per sigmatch list. Most
wrap around DetectEngineContentInspection, but it's more generic.

Until now, the inspect engines were setup in a large per ipproto,
per alproto, per direction table. For stateful inspection each
engine needed a global flag.

This approach had a number of issues:
1. inefficient: each inspection round walked the table and then
   checked if the inspect engine was even needed for the current
   rule.
2. clumsy registration with global flag registration.
3. global flag space was approaching the need for 64 bits
4. duplicate registration for alprotos supporting both TCP and
   TCP (DNS).

This patch introduces a new approach.

First, it does away with the per ipproto engines. This wasn't used.

Second, it adds a per signature list of inspect engine containing
only those engines that actually apply to the rule.

Third, it gets rid of the global flags and replaces it with flags
assigned per rule per engine.
8 years ago
Victor Julien bac37fc9ae detect state: reorganize flags
List the common non-buffer specific flags on top.
8 years ago
Victor Julien f1e3840516 http_response_body: implement keyword with mpm
Implemented as 'stickybuffer'.
8 years ago
Victor Julien 4c98b6cef3 http_request_line: implement keyword and mpm
Implemented as 'stickybuffer'.

Move all logic into the keyword file and remove bad tests that tested
URI instead of request line.
8 years ago
Victor Julien 960461f4db fast_pattern: register app layer mpms automatically
Allow for duplicate registrations for the same list. After the first
registration new calls will be ignored.
8 years ago
Victor Julien 6dd4dff7b2 mpm: remove empty app_mpms table 8 years ago
Victor Julien e68b2214e5 tls: register mpm from keywords 8 years ago
Victor Julien 57ae3c43e5 dns_query: register mpm from keyword 8 years ago
Victor Julien a1a2187a0c http_cookie: register mpm from keyword 8 years ago
Victor Julien 74661449e0 http_raw_host: register mpm from keyword 8 years ago
Victor Julien b5cd4889ae http_host: register mpm from keyword 8 years ago
Victor Julien 91695c81aa http_client_body: register mpm from keyword 8 years ago
Victor Julien 644d4dc61b http_stat_code: register mpm from keyword 8 years ago
Victor Julien cf96db095a http_stat_msg: register mpm from keyword 8 years ago
Victor Julien 43b281a510 file_data: register mpm from keyword 8 years ago
Victor Julien 6d0632a9c6 http_method: register mpm from keyword 8 years ago
Victor Julien e4ea38a8de http_raw_header: register mpm from keyword 8 years ago
Victor Julien 7813a834d0 http_user_agent: register mpm from keyword 8 years ago
Victor Julien 7b98c0073f http_header: register mpm from keyword 8 years ago