Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Detect cleanups/v3 #9949

Closed
wants to merge 19 commits into from
Closed

Detect cleanups/v3 #9949

wants to merge 19 commits into from

Commits on Dec 2, 2023

  1. detect/asn1: handle in PMATCH 

    Since the asn1 keyword is processing payload data, move the handling of
the keyword into the PMATCH with content inspection.

Use u32 as buffer length in the Rust FFI
    @victorjulien
    victorjulien committed Dec 2, 2023
    Configuration menu
    Copy the full SHA
    8786fe5 View commit details
    Browse the repository at this point in the history

  2. detect/content-inspect: reduce scope of variables

    @victorjulien
    victorjulien committed Dec 2, 2023
    Configuration menu
    Copy the full SHA
    9835616 View commit details
    Browse the repository at this point in the history

  3. detect/content-inspect: pass const to inspect func

    @victorjulien
    victorjulien committed Dec 2, 2023
    Configuration menu
    Copy the full SHA
    87035de View commit details
    Browse the repository at this point in the history

  4. detect/content-inspect: remove const casting

    @victorjulien
    victorjulien committed Dec 2, 2023
    Configuration menu
    Copy the full SHA
    e314204 View commit details
    Browse the repository at this point in the history

  5. detect/content-inspect: assist branch prediction 

    Hitting the recursion limit should be rare.
    @victorjulien
    victorjulien committed Dec 2, 2023
    Configuration menu
    Copy the full SHA
    bf72be6 View commit details
    Browse the repository at this point in the history

  6. detect/content-inspect: switch type of enum

    @victorjulien
    victorjulien committed Dec 2, 2023
    Configuration menu
    Copy the full SHA
    bd78cad View commit details
    Browse the repository at this point in the history

  7. detect/content-inspect: add entry for InspectionBuffer

    @victorjulien
    victorjulien committed Dec 2, 2023
    Configuration menu
    Copy the full SHA
    37be35f View commit details
    Browse the repository at this point in the history

  8. detect/dns.query: use new content inspect entry

    @victorjulien
    victorjulien committed Dec 2, 2023
    Configuration menu
    Copy the full SHA
    e047564 View commit details
    Browse the repository at this point in the history

  9. detect/krb5.sname: use new content inspect entry

    @victorjulien
    victorjulien committed Dec 2, 2023
    Configuration menu
    Copy the full SHA
    eb456d7 View commit details
    Browse the repository at this point in the history

  10. detect/base64: move content inspection logic 

    Integrate with rest of content inspect code.
    @victorjulien
    victorjulien committed Dec 2, 2023
    Configuration menu
    Copy the full SHA
    687c778 View commit details
    Browse the repository at this point in the history

  11. detect/content-inspect: reduce scope of internal func

    @victorjulien
    victorjulien committed Dec 2, 2023
    Configuration menu
    Copy the full SHA
    b71ce03 View commit details
    Browse the repository at this point in the history

  12. detect/content-inspect: localize recursion counting 

    Use stack local var instead of DetectEngineThreadCtx member.

Make sure the limit is a const so we can avoid rereading it.
    @victorjulien
    victorjulien committed Dec 2, 2023
    Configuration menu
    Copy the full SHA
    b5b0682 View commit details
    Browse the repository at this point in the history

  13. detect/content-inspect: flatten branches 

    Flatten else branches after terminating ifs.
    @victorjulien
    victorjulien committed Dec 2, 2023
    Configuration menu
    Copy the full SHA
    c82356a View commit details
    Browse the repository at this point in the history

  14. detect/isdataat: optimize recursion mismatches 

    Since recursive content matching goes through the buffer from left to
right, it is possible to bail early when isdataat is part of the
recursive checking. If `isdataat:50,relative` fails for offset 10, it
will surely also fail for offset 20. So break inspection in such cases.

The exception is for dynamic isdataat, where the value is determined
by a prior byte_extract that may be updated during the recursion.
    @victorjulien
    victorjulien committed Dec 2, 2023
    Configuration menu
    Copy the full SHA
    a10776e View commit details
    Browse the repository at this point in the history

  15. detect/payload: remove unneeded pointer reset 

    DetectEngineThreadCtx::replist is managed elsewhere.
    @victorjulien
    victorjulien committed Dec 2, 2023
    Configuration menu
    Copy the full SHA
    542f3fd View commit details
    Browse the repository at this point in the history

  16. detect/bytemath: pass match ctx directly 

    Adjust includes to enable this.
    @victorjulien
    victorjulien committed Dec 2, 2023
    Configuration menu
    Copy the full SHA
    e277d92 View commit details
    Browse the repository at this point in the history

  17. detect: optimize struct layout 

    Move reference count to top of DetectEngineThreadCtx, to move it to the
same cache line as the other members that are checked first in Detect().
    @victorjulien
    victorjulien committed Dec 2, 2023
    Configuration menu
    Copy the full SHA
    a06b3be View commit details
    Browse the repository at this point in the history

  18. detect/content-inspect: optimize struct layout 

    Move members used by DetectEngineContentInspection() to the same cache line.
    @victorjulien
    victorjulien committed Dec 2, 2023
    Configuration menu
    Copy the full SHA
    7d23ed2 View commit details
    Browse the repository at this point in the history

  19. detect/uri: remove tests that are now done elsewhere 

    Core logic of the tests moved to content inspection code in separate commit.
    @victorjulien
    victorjulien committed Dec 2, 2023
    Configuration menu
    Copy the full SHA
    3583b42 View commit details
    Browse the repository at this point in the history