65 Commits (cb174e4fd99e6cf8840f6962f880815501913451)

Author	SHA1	Message	Date
Victor Julien	b31ffde6f4	output: remove error codes from output	3 years ago
Victor Julien	cef0a84bd2	detect: turn cleanup message into debug message	3 years ago
Victor Julien	39cf5b151a	src: includes cleanup ... Work towards making `suricata-common.h` only introduce system headers and other things that are independent of complex internal Suricata data structures. Update files to compile after this. Remove special DPDK handling for strlcpy and strlcat, as this caused many compilation failures w/o including DPDK headers for all files. Remove packet macros from decode.h and move them into their own file, turn them into functions and rename them to match our function naming policy.	3 years ago
Victor Julien	d941703cd8	detect/build: minor code cleanup	3 years ago
Philippe Antoine	02f2602dde	src: rework includes as per cppclean	3 years ago
Philippe Antoine	c5cf2967b3	detect: fix integer warnings ... Ticket: #4516	3 years ago
Philippe Antoine	2b0be91f28	detect: use generic integer functions for dsize ... Ticket: #4112	3 years ago
Jason Ish	c8a5207083	detect: introduce "like" ip-only signature type ... Rules that look like they should be IP-only but contain a negated rule address are now marked with an LIKE_IPONLY flag. This is so they are treated like IPONLY rules with respect to flow action, but don't interfere with other IPONLY processing like using the radix tree. Ticket: #5361	3 years ago
Victor Julien	1b65af2867	detect/iponly: minor code cleanup	3 years ago
Victor Julien	beecc1890f	detect/iponly: include postmatch in determination	3 years ago
Philippe Antoine	0cba561fec	detect: not an iponly signature if it needs app-layer ... Ticket: 4972 This may happen with `config` keyword which is postmatch, but may require a transaction	4 years ago
Victor Julien	54a6dd09dd	detect: pattern id assignment through hash table ... Only consider active part of the pattern for mpm (so consider chop). Move data structure to hash list table over the custom array logic.	4 years ago
Victor Julien	3352c0bee4	detect: initialization optimization ... A lot of time was spent in `SigMatchListSMBelongsTo` for the `mpm_sm`. Optimize this by keeping the value at hand during Signature parsing and detection engine setup.	4 years ago
Philippe Antoine	00da0d3420	detect: makes config keyword really require a flow ... Ticket: 4972 Completes commit c3a220647 DETECT_CONFIG is added as DETECT_SM_LIST_POSTMATCH and not as DETECT_SM_LIST_MATCH as other keywords handled in SignatureCreateMask	4 years ago
Philippe Antoine	c3a220647b	detect: only apply ConfigApplyTx with app-layers ... Ticket: 4972 Otherwise, it makes no sense to look for a tx...	4 years ago
Victor Julien	f6f124f283	detect/engine: support frames ... Implement the low level detect engine support for inspecting frames, including MPM, transforms and inspect API's.	4 years ago
Victor Julien	707b75ccda	detect: split register time and detect load time buffer funcs	4 years ago
Philippe Antoine	cb30772372	style: remove latest warnings ... about unused variables	4 years ago
Philippe Antoine	ae4e3e95d5	transform: use generic Free function ... to free subelements in the context structure	4 years ago
Joshua Lumb	cf9b2b5fd1	detect-dsize: Add ! operator for dsize matching	4 years ago
Victor Julien	86681c9d7c	detect: move init only array to init data	4 years ago
Victor Julien	a2e37522bb	detect/analyze: dump patterns facility ... Dump all patterns to `patterns.json`, with the pattern, a total count (`cnt`), count of how many times this pattern is the mpm (`mpm`) and some of the flags. Patterns are listed per buffer. So payload, http_uri, etc.	4 years ago
Victor Julien	36d3c3cb8e	detect/analyzer: count mpm with depth, endswith	4 years ago
Victor Julien	de4addbc48	detect/analyzer: show payload separately in group dumping	4 years ago
Victor Julien	ef89643107	detect/analyzer: add icmp to rule group output	4 years ago
Victor Julien	16ea200846	detect/analyzer: count prefilter per rule group	4 years ago
Victor Julien	3660b8f829	detect/analyzer: support buffer names in sgh dump	4 years ago
Mats Klepsland	2a326421aa	thresholds: Fix buffer overflow in threshold context ... th_entry is resized using ThresholdHashRealloc() every time a rule with a threshold using by_rule tracking is added. The problem is that this is done before the rules are reordered, so occasionally a rule with by_rule tracking gets a higher signature number (after reordering) than the number of th_entries allocated, causing Suricata to crash. This commit fixes this by allocating th_entries after all the rules are loaded and reordered. Backtrace from core dump: Program terminated with signal SIGSEGV, Segmentation fault. #0 0x000000000051b381 in ThresholdHandlePacket (p=p@entry=0x7fb0080f3960, lookup_tsh=0x51, new_tsh=new_tsh@entry=0x7fb016c316e0, td=td@entry=0x14adedf0, sid=9800979, gid=1, pa=0x7fb0080f3b18) at detect-engine-threshold.c:415 415>---- if (TIMEVAL_DIFF_SEC(p->ts, lookup_tsh->tv1) < td->seconds) { Bug #4503.	4 years ago
Jeff Lucovsky	1eeb96696b	general: Cleanup bool usage	5 years ago
Jeff Lucovsky	db9776af64	detect/rules: Fix copy/paste error ... This commit corrects a copy/paste error handling the `include-mpm-stats` configuration setting.	5 years ago
Jeff Lucovsky	41967a53ec	detect: Apply clang-format updates	5 years ago
Jeff Lucovsky	d911fb87b8	detect/rules: Increase array size to remove SEGV ... This commit changes the size of reporting variables to be dynamic based on the buffer ids in use instead of a fixed value to address a SEGV when the fixed value was less than the max buffer/type id in use.	5 years ago
Philippe Antoine	9788b2ec8d	signature: frees transform options in SigMatchPrepare	5 years ago
Shivani Bhardwaj	6f7d8e50c8	src: use FatalError whenever possible ... Replaces all patterns of SCLogError() followed by exit() with FatalError(). Cocci script to do this: @@ constant C; constant char[] msg; @@ - SCLogError(C, + FatalError(SC_ERR_FATAL, msg); - exit(EXIT_FAILURE); Closes redmine ticket 3188.	5 years ago
Antti Tönkyrä	57d0f4bb6f	detect/flowbits: fix stack overflow in analyzer ... Fix stack overflow in DetectFlowbitsAnalyze. Use dynamically allocated array instead of stack and free it after it is no longer needed.	5 years ago
Jeff Lucovsky	d3a65fe156	detect: Provide `de_ctx` to free functions ... This commit makes sure that the `DetectEngineCtx *` is available to each detector's "free" function.	6 years ago
Victor Julien	edd2cd626f	jansson: remove HAVE_LIBJANSSON guards	6 years ago
Victor Julien	4dff903b35	detect: introduce pkt mpm engines ... Instead of the hardcode L4 matching in MPM that was recently introduced, add an API similar to the AppLayer MPM and inspect engines. Share part of the registration code with the AppLayer. Implement for the tcp.hdr and udp.hdr keywords.	6 years ago
Victor Julien	bdf53f449c	detect/tcp: rename tcp keyword files	6 years ago
Victor Julien	47ef8f5822	detect/mpm: add l4-header support ... Prepare MPM part of the detection engine for a new type of per packet matching, where the L4 header will be inspected. Preparation for TCP header inspection keyword.	6 years ago
Victor Julien	0965afd661	detect: pkt inspect engines ... Instead of hard coded calls to the inspection logic for payload inspection and 'MATCH'-list inspection use a callback approach. This will register a callback per 'sm_list' much like how app-layer inspect engines are registered. This will allow for adding more types later without adding runtime overhead. Implement the callback for the PMATCH and MATCH logic.	6 years ago
Victor Julien	2a778e439a	detect/build: minor code cleanups	6 years ago
Victor Julien	92f08d85aa	detect/iponly: improve negation handling in parsing	7 years ago
Victor Julien	6a5084ccf9	detect/parse: set the type of signature early ... This way we can know much sooner if the rule is ip-only or not.	7 years ago
Victor Julien	55e5d50496	detect/flow: optimize flow check ... Flow direction doesn't need explicit checking as the rule groups (sgh) are already per direction. So if a rule sets only flow:to_server or flow:to_client, we can avoid adding a sigmatch to the signature.	7 years ago
Victor Julien	c05459ce89	detect/analyzer: fix json analyzer being called on incomplete rules	7 years ago
Jacob Masen-Smith	b1b45a54c5	detect/analyzer: disable automatic json output ... EngineAnalysisRules2 was in a strange location where it did not respect the --engine-analysis flag. It has been moved to the same call location as EngineAnalysisRules.	7 years ago
Victor Julien	28a0291d07	detect: don't setup PMATCH if it will be unused ... Safes a bit of memory and makes it easier to debug.	7 years ago
Victor Julien	22f9875096	detect: free rule group init memory at the end of startup	7 years ago
Victor Julien	a2b8ea57fc	detect/dce: fix false positives in detection ... If a signature didn't explicitly specified 'dcerpc' or 'smb' as the app proto, false positives on other traffic could happen. This was caused by the sig not having a app_proto set. This isn't set as the rule is supposed to match against either ALPROTO_DCERPC or ALPROTO_SMB. To avoid adding runtime costs for checking for both protocols, this patch adds a new flag for DCERPC in the 'mask' logic. The flag is set on the sig if dce_* keywords are present and set on the packet if the flow's app proto is either ALPROTO_DCERPC or ALPROTO_SMB. Bug #2559 Reported-by: Jason Taylor	7 years ago