Commit Graph

42 Commits (da1645b3e1ef51f9f0e4b05c76cae84a9b4d71e4)

Author SHA1 Message Date
Victor Julien 3c7ad453fe classification: spelling 3 years ago
Victor Julien b31ffde6f4 output: remove error codes from output 3 years ago
Philippe Antoine ced96a8aad detect: parsing avoiding infinite loop
by comparing size_t to strlen result
Instead of uint16_t which would loop

Ticket: #5310
4 years ago
Juliana Fajardini 2765bff0c5 detect/msg: convert to FAIL/PASS API
Issue 4053. Adjust code formatting style (wrap long lines).
Replace SigInit with DetectEngineAppendSig.
5 years ago
Victor Julien 6ab323d323 detect: hide RegisterTests behind ifdef UNITTESTS
Update all callers to more aggressively use UNITTESTS guards as well.
5 years ago
Victor Julien 26bcc97515 detect/keywords: dynamic version part of doc URL 6 years ago
Jeff Lucovsky d3a65fe156 detect: Provide `de_ctx` to free functions
This commit makes sure that the `DetectEngineCtx *` is available
to each detector's "free" function.
6 years ago
Shivani Bhardwaj d801c3e588 detect: Make keyword description consistent
Closes redmine ticket #3137.
6 years ago
Shivani Bhardwaj b5b429c288 detect: Add missing keyword URLs and description
Add missing keyword URLs and their description. Fix the ones that
were incorrect.

Partially closes redmine ticket #2974.
6 years ago
Victor Julien ac12c04f11 detect-msg: cleanup error message 8 years ago
Andreas Herz 88a3ba52d6 rule-parser: ignore duplicated msg keyword 8 years ago
Victor Julien ab1200fbd7 compiler: more strict compiler warnings
Set flags by default:

    -Wmissing-prototypes
    -Wmissing-declarations
    -Wstrict-prototypes
    -Wwrite-strings
    -Wcast-align
    -Wbad-function-cast
    -Wformat-security
    -Wno-format-nonliteral
    -Wmissing-format-attribute
    -funsigned-char

Fix minor compiler warnings for these new flags on gcc and clang.
9 years ago
Victor Julien 342059835f detect-parse: improve common parser
In preparation of turning input to keyword parsers to const add
options to the common rule parser to enforce and strip double
quotes and parse negation support.

At registration, the keyword can register 3 extra flags:

    SIGMATCH_QUOTES_MANDATORY: value to keyword must be quoted

    SIGMATCH_QUOTES_OPTIONAL: value to keyword may be quoted

    SIGMATCH_HANDLE_NEGATION: leading ! is parsed

In all cases leading spaces are removed. If the 'quote' flags are
set, the quotes are removed from the input as well.
9 years ago
Eric Leblond a2e2f50fb9 documentation: fix list keywords URLs
Update URLs in keyword definition to point to sphinx documentation.
9 years ago
Eric Leblond 63937cd903 detect-msg: fix option parsing
Code removing the space before the double quote at msg option start
was not working correctly for option starting with a space.
10 years ago
Jason Ish 796dd5223b tests: no longer necessary to provide successful return code
1 pass, 0 is fail.
10 years ago
Andreas Herz 5d34ac071d rule-parsing: remove unnecessary code
Those lines were included former to prevent possible null pointer
dereference but that won't happen anymore with the rest of the rework
done in the code. The code even results in a control flow issue reported
by coverity scan, so just remove it.
10 years ago
Andreas Herz 27f6620874 rule-parsing: quick fix for rules with wrong double quotes
The stripping of leading and trailing "s has issues with rules like the
ones described in issue 1638 thus resulted in crashing the rule parser.
So for now this is a quick fix which approaches this issue directly by
stripping those "s correctly and handling error cases. It also adds the
skip for leading spaces at the msg keyword and worksaround a possible
null pointer dereference (that should never occur though).
A more general approach should be done in the future.
10 years ago
Victor Julien 393689ce44 classification: remove global from parsing
Parsing code used a 'fd' global. Remove this.
11 years ago
Ken Steele 8f1d75039a Enforce function coding standard
Functions should be defined as:

int foo(void)
{
}

Rather than:
int food(void) {
}

All functions where changed by a script to match this standard.
11 years ago
Eric Leblond 6842545331 Add documentation url in list-keyword output.
The output of the list-keyword is modified to include the url to
the keyword documentation when this is available. All documented
keywords should have their link set.

list-keyword can be used with an optional value:
 no option or short: display list of keywords
 csv: display a csv output on info an all keywords
 all: display a human readable output of keywords info
 $KWD: display the info about one keyword.
13 years ago
Eric Leblond e176be6fcc Use unlikely for error treatment.
When handling error case on SCMallog, SCCalloc or SCStrdup
we are in an unlikely case. This patch adds the unlikely()
expression to indicate this to gcc.

This patch has been obtained via coccinelle. The transformation
is the following:

@istested@
identifier x;
statement S1;
identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)";
@@

x = func(...)
... when != x
- if (x == NULL) S1
+ if (unlikely(x == NULL)) S1
13 years ago
Victor Julien 014f62247a Another batch of clang fixes. Nothing really serious. Includes a couple of fixes for broken fixes from yesterday. 15 years ago
William Metcalf ce01927515 Import of GPLv2 Header 050410 16 years ago
Victor Julien 8b30226914 Detection keyword cleanup 16 years ago
Pablo Rincon 25a3a5c6d8 Adding mem wrapper to debug runtime alloc()/free() functions. Fixing some memory leaks. 16 years ago
Gerardo Iglesias Galvan ba6d807a6e Improve information about errors on signature failure 16 years ago
Victor Julien 0d34990d7f Add OpenBSD's strlcpy and strlcat and replace all strcat/strcpy/strncat/strncpy by those calls. 16 years ago
Anoop Saldanha 011b74df63 Modify the classification config tests to use the buffer than a temp file and also fix an invalid free 16 years ago
Anoop Saldanha bc4df59414 Support for Classtype keyword and Classification Config file 16 years ago
Victor Julien f6f0ad94ce silence a debug statement in the msg handling 16 years ago
Victor Julien ecf86f9c23 Rename to Suricata. 16 years ago
Victor Julien 8b8e2fef2d Fix msg parsing. 16 years ago
William Metcalf e458b2a26e detct-msg changes and unittests 16 years ago
William Metcalf 7fb28ce5b6 fixes to mimic snort escape behavior in msg 16 years ago
Victor Julien 91bc83e5c6 More logging API usage changes. 16 years ago
William Metcalf cf473bf0ce added support for escapes inside of msg keyword 16 years ago
Victor Julien 0d0ffb9963 Reorganize header inclusions. 16 years ago
Victor Julien 6eaff4be12 Fixes for issues found by static code analyzer. 16 years ago
Victor Julien 5df5b35e90 Put all globals in the detection engine ctx. Add HashList type, a hash that also stores the items ina list to it can be traversed. Many cleanups. 17 years ago
Victor Julien 9e5049cddc Improve memory handling and parsing of the msg rule keyword. 17 years ago
Victor Julien bab4b62376 Initial add of the files. 17 years ago