54 Commits (f1185d051c210ca0daacdddbe865a51af24f4ea3)

Author	SHA1	Message	Date
Alessandro Guido	13448aca1c	Fix issue #1214 ... When applying wildcard thresholds (with sid = 0 and/or gid = 0) it's wrong to exit on the first signature already having an event filter. Indeed, doing so results in the theshold not being applied to all subsequent signatures. Change the code in order to skip signatures with event filters instead of breaking out of the loop.	12 years ago
Eric Leblond	1f07d1521e	Fix realloc error handling ... This patch is fixing realloc error handling. In case of a realloc failure, it free the initial memory and continue existing error handling. The patch has been obtained via the following semantic patch and a bit oh hand editing: @@ expression x, E; identifier f; @@ f(...) { + void *ptmp; <+... - x = SCRealloc(x, E); + ptmp = SCRealloc(x, E); ... when != x - if (x == NULL) + if (ptmp == NULL) { + SCFree(x); + x = NULL; ... - } + } else { + x = ptmp; + } ...+> } @@ expression x, E; identifier f; statement ES; @@ f(...) { + void *ptmp; <+... - x = SCRealloc(x, E); + ptmp = SCRealloc(x, E); ... when != x - if (x == NULL) ES + if (ptmp == NULL) { + SCFree(x); + x = NULL; + ES + } else { + x = ptmp; + } ...+> } @@ expression x, E; identifier f; @@ f(...) { + void *ptmp; <+... - x = SCRealloc(x, E); + ptmp = SCRealloc(x, E); ... when != x - if (unlikely(x == NULL)) + if (unlikely(ptmp == NULL)) { + SCFree(x); + x = NULL; ... - } + } else { + x = ptmp; + } ...+> } @@ expression x, E; identifier f; statement ES; @@ f(...) { + void *ptmp; <+... - x = SCRealloc(x, E); + ptmp = SCRealloc(x, E); ... when != x - if (unlikely(x == NULL)) ES + if (unlikely(ptmp == NULL)) { + SCFree(x); + x = NULL; + ES + } else { + x = ptmp; + } ...+> }	12 years ago
Victor Julien	b4631794a8	Fix realloc error handling in threshold.config file parsing. Bug #1062.	12 years ago
Eric Leblond	79fcf1378a	Use unlikely in malloc failure test. ... This patch is a result of applying the following coccinelle transformation to suricata sources: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc|SCMallocAligned|SCRealloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	12 years ago
Victor Julien	7f0cc97f5b	Thresholding: move parsing code into separate func	12 years ago
Victor Julien	8ce38ac8fe	Split Thresholds and Suppression ... Thresholds and suppression can be handled independently. Suppression only suppresses output, and is not related to Threshold state tracking. This simplifies mixing suppression and thresholding rules. Part of the Bug #425 effort.	12 years ago
Victor Julien	32503bafaa	Coverity 1038089: error check fseek call	12 years ago
Eric Leblond	3f107fa130	decode: Packet action start with PACKET ... Rename all Packet action macro to have them prefixed by PACKET.	13 years ago
Eric Leblond	a35c367942	action handling: use macro for test. ... Use test macro instead of direct access to action field. This patch has been obtained by using the following spatch file: @@ Packet *p; expression E; @@ - p->action & E + TEST_PACKET_ACTION(p, E)	13 years ago
Victor Julien	f15d97b916	Bug 780 unittests, showing no problem.	13 years ago
Jamie Strandboge	bc04090bc9	suppress: DETECT_SUPPRESS_REGEX should support IPv6 addresses too. Bug #697.	13 years ago
Victor Julien	84bad6db77	Silence compiler warnings found by clang	13 years ago
Victor Julien	80d62b59ec	Fix drop (and other actions) not being applied to thresholded packets. Bug #613.	13 years ago
Victor Julien	82fc61770b	threshold: allow threshold.config to override rule ... Allow threshold.conf to override rule thresholds in the following cases: - threshold.config rule uses threshold or event_filter AND - threshold.config rule applies to a single signature (so no gid 0 or sid 0) Confirmed to work with both threshold and detection_filter rule keywords. Part of bug #425.	13 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	13 years ago
Victor Julien	d8667448c1	threshold: allow suppression for sigs with threshold set. Part of #425.	13 years ago
Victor Julien	d8356c5ebd	Windows build and other misc fixes.	14 years ago
Anoop Saldanha	cde31abe96	bug #455 - Warn users on signature event vars having precedence over threshold.conf ones	14 years ago
Victor Julien	988f22ee2e	Free pcre study structs for classification, threshold and reference parsing.	14 years ago
Anoop Saldanha	0c24bbab0c	code cleanup for live swap	14 years ago
Anoop Saldanha	83a8f6e03a	cleanup threshold config de-init	14 years ago
Eric Leblond	2d22f667c2	config: use config file in sysconfdir by default.	14 years ago
Anoop Saldanha	5d22194299	fix failing rate filter unittest	14 years ago
Anoop Saldanha	c34713321a	fix rate filter alert suppression. Log error if rate filter has count of 0. Other minor fixes as well	14 years ago
Victor Julien	c0a2cbd478	Move over src and dst thresholding to use host table. Fix a bug in threshold 'both' handling.	14 years ago
Victor Julien	e237841a8e	Fix compilation with profiling enabled. Minor unittest fixes.	14 years ago
Victor Julien	de5c1d1491	Fix minor fgetc issue.	14 years ago
Victor Julien	cdba2f50d1	Various fixes and improvements based on feedback by Coverity analyzer.	14 years ago
Anoop Saldanha	eb07c345b8	code cleanup - replace SigMatchAppendThreshold with SigMatchAppendSMToList	14 years ago
Anoop Saldanha	bbb9f35f26	code cleanup - replace SigMatchGetLastSM with SigMatchGetLastSMFromLists	14 years ago
Victor Julien	c8c4a76dc6	Move threshold to it's own sig match list.	14 years ago
Victor Julien	28e15be526	Clean up default output. Use simpler output format for releases.	14 years ago
Victor Julien	2d16abcf8b	Minor code cleanups fixing all GCC 4.6 compiler warnings for default, debug and unittests mode.	14 years ago
Victor Julien	362c25ec8a	Fix potential suppression parsing issue found by CLANG.	14 years ago
Eric Leblond	685e0e1a63	Rename rule_type_t to ThresholdRuleType.	14 years ago
Eric Leblond	8787e6f6d0	suppress: use DetectAddress instead of DetectAddressHead	14 years ago
Eric Leblond	7938344e1b	threshold: refactoring of parsing code ... This patch factorize the regular expression to be ease the parsing process. It also adds a missing free and factorize exit code.	14 years ago
Eric Leblond	03c185a3ad	threshold: add suppress keyword ... This patch adds the suppress keyword to the threshold.config file. The alerts are suppressed but the other elements like flowbits are maintained.	14 years ago
Eric Leblond	a56f8dd6b2	doc: introduce doxygen group "threshold" ... This patch introduces a doxygen group to put together the documentation relative to threshold. Group appear in a separate page and they can have their own documentation. This is useful when a feature is splitted into different files.	14 years ago
Gerardo Iglesias Galvan	c968ca0f85	Fix potential small issue with ftell and fseek	15 years ago
Gerardo Iglesias Galvan	44692c83aa	Properly check retval for config and conversion function calls	15 years ago
Gerardo Iglesias Galvan	58f713254e	Make sure return value of fgetc isn't truncated	15 years ago
Eric Leblond	277a384af7	Use already defined macro instead of integer ... Code was using a integer instead of the already defined macro.	15 years ago
Victor Julien	3d60e9bfeb	Clean up output.	15 years ago
Anoop Saldanha	82fd581b64	replace all sm lists (match, pmatch, dmatch, umatch, amatch, tmatch) with an array Signature->sm_lists[]. Replace all Signature->match instances in the engine with Signature->sm_lists[DETECT_SM_LIST_MATCH]	15 years ago
Anoop Saldanha	f094523eb1	clang fix - some minor fixes for unittests	15 years ago
Pablo Rincon	6950537a76	Move rate_filter rule tracking data from Signature to Threshold context	16 years ago
Pablo Rincon	1ae36b9a6a	Adding rate_filter support for threshold.config, multiline support and unittests	16 years ago
Gerardo Iglesias Galvan	9f4fae5b1a	Fix inconsistent use of dynamic memory allocation	16 years ago
William Metcalf	ce01927515	Import of GPLv2 Header 050410	16 years ago