105 Commits (c5cf2967b3bc7fc074052279fe35d29fae283f43)

Author	SHA1	Message	Date
Philippe Antoine	c5cf2967b3	detect: fix integer warnings ... Ticket: #4516	3 years ago
Victor Julien	a0847e6c69	detect/analyzer: minor format string fixes ... cppcheck flagged this as: src/detect-engine-analyzer.c:1359:13: warning: %d in format string (no. 1) requires 'int' but the argument type is 'unsigned int'. [invalidPrintfArgType_sint] fprintf(rule_engine_analysis_FD, " Rule contains %d content options, %d http content options, %d pcre options, and %d pcre options with http modifiers.\n", rule_content, rule_content_http, rule_pcre, rule_pcre_http); ^ src/detect-engine-analyzer.c:1359:13: warning: %d in format string (no. 2) requires 'int' but the argument type is 'unsigned int'. [invalidPrintfArgType_sint] fprintf(rule_engine_analysis_FD, " Rule contains %d content options, %d http content options, %d pcre options, and %d pcre options with http modifiers.\n", rule_content, rule_content_http, rule_pcre, rule_pcre_http); ^ src/detect-engine-analyzer.c:1359:13: warning: %d in format string (no. 3) requires 'int' but the argument type is 'unsigned int'. [invalidPrintfArgType_sint] fprintf(rule_engine_analysis_FD, " Rule contains %d content options, %d http content options, %d pcre options, and %d pcre options with http modifiers.\n", rule_content, rule_content_http, rule_pcre, rule_pcre_http); ^ src/detect-engine-analyzer.c:1359:13: warning: %d in format string (no. 4) requires 'int' but the argument type is 'unsigned int'. [invalidPrintfArgType_sint] fprintf(rule_engine_analysis_FD, " Rule contains %d content options, %d http content options, %d pcre options, and %d pcre options with http modifiers.\n", rule_content, rule_content_http, rule_pcre, rule_pcre_http); ^ Bug: #5291.	4 years ago
Victor Julien	54a6dd09dd	detect: pattern id assignment through hash table ... Only consider active part of the pattern for mpm (so consider chop). Move data structure to hash list table over the custom array logic.	4 years ago
Victor Julien	3352c0bee4	detect: initialization optimization ... A lot of time was spent in `SigMatchListSMBelongsTo` for the `mpm_sm`. Optimize this by keeping the value at hand during Signature parsing and detection engine setup.	4 years ago
Victor Julien	4b0e3d79bb	detect/analyzer: support frames in pattern dump	4 years ago
Victor Julien	3cbe33de57	detect/analyzer: add frame support	4 years ago
Victor Julien	707b75ccda	detect: split register time and detect load time buffer funcs	4 years ago
Victor Julien	5bcaae0a01	detect: use hashes for all buffer to id ... Instead of a map that is constantly realloc'd, use 2 hash tables for DetectBufferType entries: one by name (+transforms), the other by id. Use these everywhere.	4 years ago
Philippe Antoine	cb30772372	style: remove latest warnings ... about unused variables	4 years ago
Philippe Antoine	f6ba3699bb	flowint: same analysis warnings as flowbits	4 years ago
Philippe Antoine	bce3c46874	pcre2: remove PCRE1 as dependency	4 years ago
Philippe Antoine	2a1690e110	pcre2: move header include to suricata-common only	4 years ago
Philippe Antoine	3633c48e6e	pcre2: migrate utility uses of pcre	4 years ago
Victor Julien	22dfcc928c	detect/analyzer: use rule style pretty print for patterns	4 years ago
Victor Julien	5703aec44e	detect/content: generalize pattern pretty printing	4 years ago
Victor Julien	a2e37522bb	detect/analyze: dump patterns facility ... Dump all patterns to `patterns.json`, with the pattern, a total count (`cnt`), count of how many times this pattern is the mpm (`mpm`) and some of the flags. Patterns are listed per buffer. So payload, http_uri, etc.	4 years ago
Victor Julien	f49c181ceb	detect/analyzer: display per rule prefilter details	4 years ago
Victor Julien	1c5842df12	detect/analyzer: add per rule mpm block to rules.json	4 years ago
Victor Julien	b55b327db1	detect/analyzer: suggest modern keywords	5 years ago
Victor Julien	57f7612ffd	detect/analyzer: fix json output for warnings/notes	5 years ago
Philippe Antoine	707f027231	protos: renaming ALPROTO_HTTP* constants ... Having now ALPROTO_HTTP1, ALPROTO_HTTP2 and ALPROTO_HTTP Run with 3 sed commands git grep ALPROTO_HTTP | cut -d: -f1 | uniq | xargs sed -i -e 's/ALPROTO_HTTP/ALPROTO_HTTP1/g' git grep ALPROTO_HTTP12 | cut -d: -f1 | uniq | xargs sed -i -e 's/ALPROTO_HTTP12/ALPROTO_HTTP2/g' git grep ALPROTO_HTTP1_ANY | cut -d: -f1 | uniq | xargs sed -i -e 's/ALPROTO_HTTP1_ANY/ALPROTO_HTTP/g' and then running clang-format	5 years ago
Victor Julien	0eb692e500	mingw: fix format string warnings	5 years ago
Victor Julien	7facf5785f	detect/analyzer: convert to jsonbuilder	5 years ago
Shivani Bhardwaj	6f7d8e50c8	src: use FatalError whenever possible ... Replaces all patterns of SCLogError() followed by exit() with FatalError(). Cocci script to do this: @@ constant C; constant char[] msg; @@ - SCLogError(C, + FatalError(SC_ERR_FATAL, msg); - exit(EXIT_FAILURE); Closes redmine ticket 3188.	5 years ago
Jeff Lucovsky	9c47b8c1bf	general: Fix spelling error	5 years ago
Jeff Lucovsky	31e2cff9cb	detect/analysis: Warn if required feature missing	6 years ago
Jeff Lucovsky	6c2cdbb5f0	analysis: exit if table entries are stale ... This commit causes Suricata to exit when a buffer from the analyzer table is not recognized. Since the table must match what's registered, exiting will bring noticed to the condition.	6 years ago
Jeff Lucovsky	fcfb679893	detect/analyzer: Suppress direction warnings ... This commit ensures direction warnings for ICMP v4 and v6 are suppressed and corrects check so that both protocols are checked (instead of the same protocol being checked twice).	6 years ago
Jeff Lucovsky	8f4f1cb633	detect/analyzer: Improved fast pattern display ... When transforms are part of a rule, improve information displayed with fast patterns to include the original buffer name and whether any transform(s) are applied.	6 years ago
Jeff Lucovsky	c88c1f1e14	detect/analyzer: Suppress direction warnings ... This commit suppresses direction warnings by the rules analyzer for ICMP and ICMPV6 since it's not actionable.	6 years ago
Jeff Lucovsky	ae198add6d	detect/analyzer: Refactor engine analysis code ... This commit changes the analysis code to be table driven to better identify the rule elements covered by the analysis.	6 years ago
Jeff Lucovsky	79d308db73	detect/analyzer: Add missing http_accept_enc handling	6 years ago
Jeff Lucovsky	140bfd7b0c	detect/analyzer: remove HAVE_LIBJANSSON cpp guards	6 years ago
Jeff Lucovsky	87bfce025d	spelling: correct spelling typo	6 years ago
Jeff Lucovsky	dcf5e247ca	detect/analyzer: add support for http_content_type	6 years ago
Victor Julien	4dff903b35	detect: introduce pkt mpm engines ... Instead of the hardcode L4 matching in MPM that was recently introduced, add an API similar to the AppLayer MPM and inspect engines. Share part of the registration code with the AppLayer. Implement for the tcp.hdr and udp.hdr keywords.	6 years ago
Victor Julien	bdf53f449c	detect/tcp: rename tcp keyword files	6 years ago
Jeff Lucovsky	0960ca0d00	detect/analyzer Add missing HTTP values ... This changeset adds recognition of missing HTTP values - Raw host - Header names - Server body - User agent	7 years ago
Jeff Lucovsky	462a4e2b5b	detect/analyzer: Improve warning message ... This changeset modifies the warning printed when a rule is determined to detect in both directions.	7 years ago
Jeff Lucovsky	1b1fc9fee2	rule-analyzer: Ensure content counts are accurate ... Fix for issue 2605. Make sure that content is counted, even if none of the specific content types are matched.	7 years ago
Travis Green	1743cf5dcd	engine-analysis: add support for http_host buffer ... Add support for http_host buffer for more accurate reporting. Bug: #2798	7 years ago
Victor Julien	014056f686	detect/analyzer: add detection for sigs that could use http keywords	7 years ago
Victor Julien	127937b2dd	detect/analyzer: add debug statements	7 years ago
Victor Julien	64d75496b8	detect/analyzer: add notes (and warnings)	7 years ago
Victor Julien	38b698c50f	detect/analyzer: show pattern that is used by mpm ... Set a new DETECT_CONTENT_MPM flag on the pattern that is selected during setup.	7 years ago
Victor Julien	35c5ae3458	detect: limit flush logic to sigs that need it ... Limit the early 'flush' logic to sigs that actually need to match on both stream and http bodies.	7 years ago
Victor Julien	f35a3bbae0	detect/analyzer: add built-in lists	7 years ago
Victor Julien	6694593cc0	detect/analyzer: add Signature::flags	7 years ago
Victor Julien	c0adff3770	detect: remove STATE_MATCH flag use at runtime ... Instead, use it only at init time and use Signature::app_inspect directly at runtime.	7 years ago
Victor Julien	3c72d67635	detect/analyzer: log mask flags and more engine details	7 years ago