82 Commits (e75956717d6a90abeccd51a8c71bf0b3ea8a9e8b)

Author	SHA1	Message	Date
Victor Julien	8bd1422948	detect: detect engine registration cleanup	9 years ago
Victor Julien	b68343e372	files: use dynamic list	9 years ago
Victor Julien	bd456076a8	detect: pass SigMatchData to inspect functions	9 years ago
Victor Julien	bfd4bc8233	detect: constify Signature/SigMatch use at runtime	9 years ago
Eric Leblond	a2e2f50fb9	documentation: fix list keywords URLs ... Update URLs in keyword definition to point to sphinx documentation.	9 years ago
Victor Julien	6f253e1ea7	file detect: register inspect engines from keyword	9 years ago
Victor Julien	9030e89c94	detect: don't set alproto while registering keyword ... The field is not used except for some printing, and is wrong for many keywords.	9 years ago
Victor Julien	c957c62824	detect file: enable HTTP inspection from validate func	9 years ago
Victor Julien	621860f5b2	detect file: enforce protocol in single place ... Instead of trying to enforce the app layer protocol in each file function, enforce it in the generic validation function.	9 years ago
Eric Leblond	ed90a16e89	detect: fix setup for some keywords ... Fix problems found by siginit.cocci.	9 years ago
Jason Ish	796dd5223b	tests: no longer necessary to provide successful return code ... 1 pass, 0 is fail.	9 years ago
Ken Steele	923a77e952	Change Match() function to take const SigMatchCtx* ... The Match functions don't need a pointer to the SigMatch object, just the context pointer contained inside, so pass the Context to the Match function rather than the SigMatch object. This allows for further optimization. Change SigMatch->ctx to have type SigMatchCtx* rather than void* for better type checking. This requires adding type casts when using or assigning it. The SigMatch contex should not be changed by the Match() funciton, so pass it as a const SigMatchCtx*.	11 years ago
David Abarbanel	c2dc686742	SMTP MIME Email Message decoder	11 years ago
Ken Steele	8f1d75039a	Enforce function coding standard ... Functions should be defined as: int foo(void) { } Rather than: int food(void) { } All functions where changed by a script to match this standard.	11 years ago
Ken Steele	ba1e2ed69d	Fix Boyer Moore Nocase bug where BoyerMooreCtxToNocase was missing. ... Whenever DETECT_CONTENT_NOCASE is set for a BoyerMoore matcher, the function BoyerMooreCtxToNocase() must be called. This call was missing in AppLayerProtoDetectPMRegisterPattern(). Also created BoyerMooreNocaseCtxInit() that calls BoyerMooreCtxToNocase() to make some code cleaner and safer.	11 years ago
Ken Steele	967f7aefde	Store Boyer Moore no case strings in lower case. ... Rather than converting the search string to lower case while searching, convert it to lowercase during initialization. Changes the Boyer Moore search API for take BmCtx Change the API for BoyerMoore to take a BmCtx rather than the two parts that are stored in the context. Which is how it is mostly used. This enforces always calling BoyerMooreCtxToNocase() to convert to no-case. Use CtxInit and CtxDeinit functions to create and destroy the context, even in unit tests.	11 years ago
Victor Julien	6ba52230ed	Update DetectContentDataParse to reflect the actual data types content uses.	12 years ago
Victor Julien	4d4f8fd358	file: make fileext, filename and filemagic use the same rule parsing function as others. This has as a side effect that we enforce doubly qouted values now.	12 years ago
Last G	8ae11f73b2	Added parentheses to fix Eclipse static code analysis ... Fixed bug in action priority (REJECT_DST had lowest prio)	13 years ago
Eric Leblond	6842545331	Add documentation url in list-keyword output. ... The output of the list-keyword is modified to include the url to the keyword documentation when this is available. All documented keywords should have their link set. list-keyword can be used with an optional value: no option or short: display list of keywords csv: display a csv output on info an all keywords all: display a human readable output of keywords info $KWD: display the info about one keyword.	13 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	13 years ago
Eric Leblond	655577cbbc	Add some missing checks of SCMalloc return.	13 years ago
Victor Julien	3849588c61	Create separate detect API call (FileMatch) for file detection keywords. #531.	13 years ago
Victor Julien	d840308ae2	file detect: improve cleanup	13 years ago
Victor Julien	e1022ee5ae	file-extraction: Disconnect file handling from flow and move into the app layer state.	14 years ago
Victor Julien	5945e652d6	Initial implementation of filemagic keyword.	14 years ago
Victor Julien	23e01d23d3	Implement filestore keyword, including a way for the stateful detection engine to conclude that a file will never have to be stored.	14 years ago
Victor Julien	21acd72adf	Cleanups to the Multipart parsing code. Fixes to negation in filename and fileext.	14 years ago
Victor Julien	70f0d3d2e7	Add negation to filename and fileext, use same syntax as with content.	14 years ago
Victor Julien	9d5d46c4bb	Implement flow file storage API, create HTP wrappers for it, use it in HTTP parsing.	14 years ago
Victor Julien	a0ee6ade3e	Improve HTTP multipart parsing, add streaming parsing for files.	14 years ago
Pablo Rincon	6d60b3a747	filename and fileext keywords	14 years ago