Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[preview] prefilter engines v97 #2289

Closed
wants to merge 128 commits into from
Closed

[preview] prefilter engines v97 #2289

wants to merge 128 commits into from

Conversation

inliniac
Copy link
Contributor

@inliniac inliniac commented Sep 26, 2016 •
edited

@victorjulien
detect-parse: add new func to get last sigmatch
f90d81e 
Add SigMatchGetLastSM which simply returns the very last SM added
to the signature.

Minor cleanups.
@victorjulien
mpm uri: remove unused function args
ac65d15
@victorjulien
mpm raw uri: remove unused function args
96e902f
@victorjulien
mpm method: remove unused function args
d764d85
@victorjulien
mpm host: remove unused function args
f84e073
@victorjulien
mpm raw host: remove unused function args
3acc980
@victorjulien
mpm cookie: remove unused function args
11be152
@victorjulien
mpm ua: remove unused function args
fa9a072
@victorjulien
mpm stat msg: remove unused function args
2648ddb
@victorjulien
mpm stat code: remove unused function args
0082c55
@victorjulien
mpm dns query: remove unused function args
3986cf5
@victorjulien
mpm tls: remove unused function args
820b77f
@victorjulien
uricontent: remove left over func decl
24f3f5c
@victorjulien
detect-fragoffset: minor cleanup
174bc8e
@victorjulien
mpm: remove Cleanup API call
12552fd 
It's unused by all of the implementations.
@victorjulien
prefilter: rename PatternMatcherQueue datatype
09e1b3d 
In preparation of the introduction of more general purpose prefilter
engines, rename PatternMatcherQueue to PrefilterRuleStore. The new
engines will fill this structure a similar way to the current mpm
prefilters.
@victorjulien
detect: rename non_mpm lists/vars to non_pf
e412a87 
Rename to non_pf: non prefilter.
@victorjulien
detect: rename SignatureNonMpmStore
7ad9939 
New name is SignatureNonPrefilterStore to reflect that it's not just
about MPM anymore.
@victorjulien
prefilter: introduce prefilter engines
80fa638 
Introduce abstraction layer for prefilter engines.
@victorjulien
http_uri: mpm prefilter engine
a47e7d5 
Inspect partial request line as well.
@victorjulien
http_method: mpm prefilter engine
814ca40
@victorjulien
packet/stream: mpm prefilter engine
aa01195
@victorjulien
dns_query: mpm prefilter engine
891a465
@victorjulien
http_raw_uri: mpm prefilter engine
0b26985
@victorjulien
http_cookie: mpm prefilter engine
c7947be
@victorjulien
http_user_agent: mpm prefilter engine
a8947fd
@victorjulien
http_host: mpm prefilter engine
591791a
@victorjulien
http_raw_host: mpm prefilter engine
5760c30
@victorjulien
http_stat_msg: mpm prefilter engine
a7bb92e
@victorjulien
http_stat_code: mpm prefilter engine
05b18ac
@victorjulien
http_response_line: register inspect engine from keyword
df4088a
@victorjulien
http_uri: register inspect engine from keyword
31985df
@victorjulien
http_client_body: register inspect engine from keyword
9578106
@victorjulien
http_header: register inspect engine from keyword
033f453
@victorjulien
http_raw_header: register inspect engine from keyword
2d834bd
@victorjulien
http_method: register inspect engine from keyword
ad3619e
@victorjulien
http_cookie: register inspect engine from keyword
839af0e
@victorjulien
http_raw_uri: register inspect engine from keyword
3c8698e
@victorjulien
http_user_agent: register inspect engine from keyword
848e3d0
@victorjulien
http_host: register inspect engine from keyword
2fdc179
@victorjulien
http_raw_host: register inspect engine from keyword
3456b4e
@victorjulien
file_data: register inspect engine from keyword
d376569
@victorjulien
http_stat_msg: register inspect engine from keyword
e50fcff
@victorjulien
http_stat_code: register inspect engine from keyword
37eeafc
@victorjulien
tls_sni: register inspect engine from keyword
407a030
@victorjulien
tls_cert_subject: register inspect engine from keyword
b60c415
@victorjulien
tls_cert_issuer: register inspect engine from keyword
8996c1d
@victorjulien
dns detect: register inspect engine from keyword
a645391
@victorjulien
modbus detect: register inspect engine from keyword
b31bd24
@victorjulien
file detect: register inspect engines from keyword
4a84a2a
@victorjulien
template_buffer: register inspect engine from keyword
0b377d1
@victorjulien
detect: remove empty app registration table
4af741b
@victorjulien
detect app-layer-event: clean up registration
2bf3f60 
Move engine and registration into the keyword file.

Register as 'ALPROTO_UNKNOWN' instead of per alproto. The
registration will only apply it to those rules that have
events set.
@victorjulien
detect: clean up inspect engine registration
f8e896a
@victorjulien
detect: reshuffle keyword registration order
8c72912 
The order of keyword registration currently affects inspect engine
registration order and ultimately the order of inspect engines per
rule. Which in turn affects state keeping.

This patch makes sure the ordering is the same as with older
releases.
This was referenced Sep 26, 2016
Closed
Merged
@inliniac
Copy link
Contributor Author

Replaced by #2310

@inliniac inliniac closed this Sep 29, 2016
@inliniac inliniac deleted the dev-prefilter-engines-v97 branch October 4, 2016 08:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Milestone
No milestone
2 participants
@inliniac @victorjulien