106 Commits (fe6e96a8c1eb2a5a4cd57943a50c31d02fccbc0f)

Author	SHA1	Message	Date
Victor Julien	ab1200fbd7	compiler: more strict compiler warnings ... Set flags by default: -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wwrite-strings -Wcast-align -Wbad-function-cast -Wformat-security -Wno-format-nonliteral -Wmissing-format-attribute -funsigned-char Fix minor compiler warnings for these new flags on gcc and clang.	9 years ago
Victor Julien	7eda6beade	detect: don't rescan when just distance is used ... Content inspection optimization: when just distance is used without within we don't need to search recursively. E.g. content:"a"; content:"b"; distance:1; will scan the buffer for 'a' and when it finds 'a' it will scan the remainder for 'b'. Until now, the failure to find 'b' would lead to looking for the next 'a' and then for 'b' after that. However, we already inspected the entire buffer for 'b', so we know this will fail.	9 years ago
Victor Julien	dfac5276b8	detect: remove unused SIGMATCH_PAYLOAD flag	9 years ago
Victor Julien	779d40cedf	detect: remove hardcoded sm_list logic from setup ... Introduce utility functions to aid this.	9 years ago
Victor Julien	f370e88135	detect: move init only Signature members to init_data	9 years ago
Victor Julien	8edc954e82	detect: get rid of Signature::sm_lists ... Instead use the lists in init_data during setup and the SigMatchData arrays during runtime.	9 years ago
Victor Julien	39613778cd	detect: make setup/free/match funcs static where possible	9 years ago
Victor Julien	34b030b45f	distance: fix -Wshadow warning	9 years ago
Eric Leblond	a2e2f50fb9	documentation: fix list keywords URLs ... Update URLs in keyword definition to point to sphinx documentation.	9 years ago
maxtors	9d3fd82849	Removed duplicate include statements.	10 years ago
Jason Ish	796dd5223b	tests: no longer necessary to provide successful return code ... 1 pass, 0 is fail.	10 years ago
Victor Julien	4f8e1f59a6	mpm: remove obsolete mpm algos ... Remove: ac-gfbs, wumanber, b2g, b3g.	10 years ago
Andreas Herz	27f6620874	rule-parsing: quick fix for rules with wrong double quotes ... The stripping of leading and trailing "s has issues with rules like the ones described in issue 1638 thus resulted in crashing the rule parser. So for now this is a quick fix which approaches this issue directly by stripping those "s correctly and handling error cases. It also adds the skip for leading spaces at the msg keyword and worksaround a possible null pointer dereference (that should never occur though). A more general approach should be done in the future.	10 years ago
Giuseppe Longo	41a1a9f4af	find and replace HSBDMATCH by FILEDATA ... This commit do a find and replace of the following: - DETECT_SM_LIST_HSBDMATCH by DETECT_SM_LIST_FILEDATA sed -i 's/DETECT_SM_LIST_HSBDMATCH/DETECT_SM_LIST_FILEDATA/g' src/* - HSBD by FILEDATA: sed -i 's/HSBDMATCH/FILEDATA/g' src/*	11 years ago
Jason Ish	a18e2ef402	Bug 1230: Check all SigMatch lists for a named byte_extract variable.	11 years ago
Ken Steele	8f1d75039a	Enforce function coding standard ... Functions should be defined as: int foo(void) { } Rather than: int food(void) { } All functions where changed by a script to match this standard.	11 years ago
Victor Julien	7292998a58	Content: set up sticky buffers like file_data and dce_stub_data w/o flags, but with a list variable	13 years ago
Anoop Saldanha	0b5d277254	code cleanup for all content based keywords.	13 years ago
Anoop Saldanha	51dcf19817	turn dce_stub_data into a sticky buffer.	13 years ago
Anoop Saldanha	3511f91bba	Add support for the new keyword - http_raw_host header. ... The corresponding pcre modifier would be 'Z'.	13 years ago
Anoop Saldanha	c4ce19a1be	Add support for a new keyword to inspect http_host header. ... The corresponding content keyword would now be - http_host. The corresponding pcre modifier would be W.	13 years ago
Last G	8ae11f73b2	Added parentheses to fix Eclipse static code analysis ... Fixed bug in action priority (REJECT_DST had lowest prio)	13 years ago
Eric Leblond	6842545331	Add documentation url in list-keyword output. ... The output of the list-keyword is modified to include the url to the keyword documentation when this is available. All documented keywords should have their link set. list-keyword can be used with an optional value: no option or short: display list of keywords csv: display a csv output on info an all keywords all: display a human readable output of keywords info $KWD: display the info about one keyword.	13 years ago
Victor Julien	84bad6db77	Silence compiler warnings found by clang	13 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	13 years ago
pi-rho	0df4c5838d	spelling corrections documented in redmine bug#533	13 years ago
Anoop Saldanha	988c92f71c	http user agent keyword + mpm + inspection + fast pattern support added	14 years ago
Victor Julien	da3c5bf84d	Minor error message cleanups	14 years ago
Eileen Donlon	9376967e65	reject rules with duplicate content modifiers ... reject rules that have multiple depths, offsets, distances, fast_patterns, nocases, or rawbytes for the same content.	14 years ago
Eileen Donlon	0bcbd23343	reject mixed relative and non-relative keywords ... reject signatures using relative and non-relative positional keywords for the same content (depth or offset with distance or within)	14 years ago
Anoop Saldanha	35435f3284	All http_http_stat_code modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_STAT_CODE. Also remove dummy match/free functions for stat code and stat msg	14 years ago
Anoop Saldanha	507e1b66e0	All http_http_stat_msg modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_STAT_MSG	14 years ago
Anoop Saldanha	059ee217ff	All http_http_raw_uri modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_RAW_URI	14 years ago
Anoop Saldanha	b1a0d35106	All http_http_cookie modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_COOKIE	14 years ago
Anoop Saldanha	49bdad9345	All http_http_method modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_METHOD	14 years ago
Anoop Saldanha	97d8fc9cba	All http_http_raw_header modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_RAW_HEADER	14 years ago
Anoop Saldanha	97308674ee	All http_http_header modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_HEADER	14 years ago
Anoop Saldanha	1acb7cdc7d	All http_server_body modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_SERVER_BODY	14 years ago
Anoop Saldanha	a5b46e727c	All http_client_body modified patterns now are DETECT_CONTENT and not DETECT_AL_HTTP_CLIENT_BODY	14 years ago
Anoop Saldanha	4810ee9c5f	All uricontent modified patterns now are DETECT_CONTENT and not DETECT_URICONTENT. Step towards unifying all content based patterns. Makes way for easier management of patterns	14 years ago
Anoop Saldanha	35f1f7e8d9	unify payload detection engines + fix other bugs in pcre init	14 years ago
Anoop Saldanha	09313cf9bd	Support http stat code detection engine, fast pattern(mpm engine included). Fix http stat code setup function. Fix pcre option for stat msg keyword. With this the pcre options for server_body is Q, for stat_msg is Y and for stat_code is S	14 years ago
Anoop Saldanha	2007c2711c	Support http stat msg detection engine, fast pattern(mpm engine included). Fix http stat msg setup function. Fix pcre option for stat msg keyword	14 years ago
Anoop Saldanha	c2d47718c1	bug #411 - fix failing unittest	14 years ago
Anoop Saldanha	6556b4c62b	bug #411 - don't modify within/distance at setup time	14 years ago
Eileen Donlon	39b8cc2f8b	fixed relative handling for pcre cookie and method	14 years ago
Eileen Donlon	d55fef2d75	Cleaned up some error messages for detect distance and offset.	14 years ago
Victor Julien	07e560b137	file-data: initial file_data support ... Support file_data for: content, pcre (relative), byte_test, byte_jump, byte_extract, isdataat. File_data support is handled at signature parsing time, all matches occurring after the file_data in the rule are converted to http_server_body matches. Content matches relative to the file_data are converted. Within to depth, distance to offset. Relative to the start of the body buffer.	14 years ago
Anoop Saldanha	420befb180	Changed my email address to anoopsaldanha at gmail dot com from my current one	14 years ago
Victor Julien	89f83e714c	Introduce http_server_body keyword. ... The http_server_body content modifier modifies the previous content to inspect the normalized (dechunked, unzipped) http_server_body. The workings are similar to http_client_body. Additionally, a new pcre flag was introduced "/S". To facilitate this change the signature flags field was changed to be 64 bit.	14 years ago