← Back to branch summary

~ubuntu-branches/ubuntu/utopic/suricata/utopic

~ubuntu-branches/ubuntu/utopic/suricata/utopic

« back to all changes in this revision

Viewing changes to src/detect-window.c

Committer: Package Import Robot
Author(s): Pierre Chifflier
Date: 2011-11-17 23:20:51 UTC
mfrom: (1.1.10)
Revision ID: package-import@ubuntu.com-20111117232051-wlo0g2fyinx0zi25

Tags: 1.1-1

* Imported Upstream version 1.1
* Add instructions on getting new rules using oinkmaster
* Add Recommends on oinkmaster
* Move snort-rules-default to Recommends

files added:
qa

qa/Makefile.am

qa/Makefile.in

qa/coccinelle

qa/coccinelle/Makefile.am

qa/coccinelle/Makefile.in

qa/coccinelle/access-pkt-packet.cocci

qa/coccinelle/banned-functions.cocci

qa/coccinelle/direct-packet.cocci

qa/coccinelle/pktnotset-packet.cocci

qa/coccinelle/run_check.sh

qa/wirefuzz.pl

reference.config

rules

rules/decoder-events.rules

rules/stream-events.rules

src/alert-pcapinfo.c

src/alert-pcapinfo.h

src/alert-syslog.c

src/alert-syslog.h

src/app-layer-protos.c

src/app-layer-smtp.c

src/app-layer-smtp.h

src/cuda-ptxdump.h

src/decode-sctp.c

src/decode-sctp.h

src/detect-byte-extract.c

src/detect-byte-extract.h

src/detect-engine-event.c

src/detect-engine-event.h

src/detect-engine-hcbd.c

src/detect-engine-hcbd.h

src/detect-engine-hcd.c

src/detect-engine-hcd.h

src/detect-engine-hhd.c

src/detect-engine-hhd.h

src/detect-engine-hmd.c

src/detect-engine-hmd.h

src/detect-engine-hrhd.c

src/detect-engine-hrhd.h

src/detect-engine-hrud.c

src/detect-engine-hrud.h

src/detect-http-raw-header.c

src/detect-http-raw-header.h

src/detect-http-raw-uri.c

src/detect-http-raw-uri.h

src/detect-http-stat-code.c

src/detect-http-stat-code.h

src/detect-http-stat-msg.c

src/detect-http-stat-msg.h

src/detect-mark.c

src/detect-mark.h

src/detect-replace.c

src/detect-replace.h

src/detect-ssl-state.c

src/detect-ssl-state.h

src/detect-ssl-version.c

src/detect-ssl-version.h

src/flow-manager.c

src/flow-manager.h

src/flow-timeout.c

src/flow-timeout.h

src/log-droplog.c

src/log-droplog.h

src/log-pcap.c

src/log-pcap.h

src/runmode-af-packet.c

src/runmode-af-packet.h

src/runmode-erf-dag.c

src/runmode-erf-dag.h

src/runmode-erf-file.c

src/runmode-erf-file.h

src/runmode-ipfw.c

src/runmode-ipfw.h

src/runmode-nfq.c

src/runmode-nfq.h

src/runmode-pcap-file.c

src/runmode-pcap-file.h

src/runmode-pcap.c

src/runmode-pcap.h

src/runmode-pfring.c

src/runmode-pfring.h

src/source-af-packet.c

src/source-af-packet.h

src/stream-tcp-inline.c

src/stream-tcp-inline.h

src/stream-tcp-sack.c

src/stream-tcp-sack.h

src/stream-tcp-util.c

src/stream-tcp-util.h

src/tm-threads-common.h

src/util-affinity.c

src/util-affinity.h

src/util-checksum.c

src/util-checksum.h

src/util-device.c

src/util-device.h

src/util-ioctl.c

src/util-ioctl.h

src/util-memcmp.c

src/util-memcmp.h

src/util-mpm-ac-gfbs.c

src/util-mpm-ac-gfbs.h

src/util-mpm-ac.c

src/util-mpm-ac.h

src/util-mpm-b2gc.c

src/util-mpm-b2gc.h

src/util-mpm-b2gm.c

src/util-mpm-b2gm.h

src/util-optimize.h

src/util-proto-name.c

src/util-proto-name.h

src/util-reference-config.c

src/util-reference-config.h

src/util-runmodes.c

src/util-runmodes.h

src/util-syslog.c

src/util-syslog.h

src/util-vector.h

files removed:
src/alert-unified-alert.c

src/alert-unified-alert.h

src/alert-unified-log.c

src/alert-unified-log.h

src/app-layer-tls.c

src/app-layer-tls.h

src/detect-decode-event.c

src/detect-decode-event.h

files modified:
ChangeLog

Makefile.am

Makefile.in

aclocal.m4

config.guess

config.h.in

config.sub

configure

configure.in

debian/README.Debian

debian/changelog

debian/control

doc/INSTALL

doc/INSTALL.PF_RING

doc/INSTALL.WINDOWS

libhtp/Makefile.in

libhtp/aclocal.m4

libhtp/configure

libhtp/htp/Makefile.am

libhtp/htp/Makefile.in

libhtp/htp/bstr.c

libhtp/htp/bstr.h

libhtp/htp/dslib.c

libhtp/htp/hooks.c

libhtp/htp/hooks.h

libhtp/htp/htp.c

libhtp/htp/htp.h

libhtp/htp/htp_config.c

libhtp/htp/htp_connection.c

libhtp/htp/htp_connection_parser.c

libhtp/htp/htp_decompressors.c

libhtp/htp/htp_decompressors.h

libhtp/htp/htp_parsers.c

libhtp/htp/htp_request.c

libhtp/htp/htp_request_apache_2_2.c

libhtp/htp/htp_request_generic.c

libhtp/htp/htp_request_parsers.c

libhtp/htp/htp_response.c

libhtp/htp/htp_response_generic.c

libhtp/htp/htp_transaction.c

libhtp/htp/htp_util.c

libhtp/htp/utf8_decoder.h

libhtp/test/Makefile.am

libhtp/test/Makefile.in

libhtp/test/main.c

libhtp/test/test.c

ltmain.sh

m4/libtool.m4

m4/ltoptions.m4

m4/ltversion.m4

m4/lt~obsolete.m4

src/Makefile.am

src/Makefile.in

src/action-globals.h

src/alert-debuglog.c

src/alert-fastlog.c

src/alert-fastlog.h

src/alert-prelude.c

src/alert-unified2-alert.c

src/app-layer-dcerpc-common.h

src/app-layer-dcerpc-udp.c

src/app-layer-dcerpc.c

src/app-layer-detect-proto.c

src/app-layer-detect-proto.h

src/app-layer-ftp.c

src/app-layer-ftp.h

src/app-layer-htp.c

src/app-layer-htp.h

src/app-layer-parser.c

src/app-layer-parser.h

src/app-layer-protos.h

src/app-layer-smb.c

src/app-layer-smb.h

src/app-layer-smb2.c

src/app-layer-ssh.c

src/app-layer-ssh.h

src/app-layer-ssl.c

src/app-layer-ssl.h

src/app-layer.c

src/app-layer.h

src/conf-yaml-loader.c

src/conf-yaml-loader.h

src/conf.c

src/conf.h

src/counters.c

src/counters.h

src/cuda-packet-batcher.c

src/cuda-packet-batcher.h

src/data-queue.h

src/decode-ethernet.c

src/decode-events.h

src/decode-gre.c

src/decode-icmpv4.c

src/decode-icmpv4.h

src/decode-icmpv6.c

src/decode-icmpv6.h

src/decode-ipv4.c

src/decode-ipv4.h

src/decode-ipv6.c

src/decode-ipv6.h

src/decode-ppp.c

src/decode-pppoe.c

src/decode-raw.c

src/decode-sll.c

src/decode-tcp.c

src/decode-tcp.h

src/decode-udp.c

src/decode-vlan.c

src/decode.c

src/decode.h

src/defrag.c

src/defrag.h

src/detect-ack.c

src/detect-asn1.c

src/detect-bytejump.c

src/detect-bytejump.h

src/detect-bytetest.c

src/detect-bytetest.h

src/detect-content.c

src/detect-content.h

src/detect-csum.c

src/detect-dce-iface.c

src/detect-dce-opnum.c

src/detect-dce-stub-data.c

src/detect-depth.c

src/detect-detection-filter.c

src/detect-distance.c

src/detect-dsize.c

src/detect-engine-address-ipv4.c

src/detect-engine-address-ipv6.c

src/detect-engine-address.c

src/detect-engine-address.h

src/detect-engine-alert.c

src/detect-engine-alert.h

src/detect-engine-dcepayload.c

src/detect-engine-iponly.c

src/detect-engine-iponly.h

src/detect-engine-mpm.c

src/detect-engine-mpm.h

src/detect-engine-payload.c

src/detect-engine-port.c

src/detect-engine-proto.c

src/detect-engine-siggroup.c

src/detect-engine-sigorder.c

src/detect-engine-state.c

src/detect-engine-state.h

src/detect-engine-tag.c

src/detect-engine-threshold.c

src/detect-engine-threshold.h

src/detect-engine-uri.c

src/detect-engine.c

src/detect-engine.h

src/detect-fast-pattern.c

src/detect-fast-pattern.h

src/detect-flags.c

src/detect-flow.c

src/detect-flowbits.c

src/detect-flowint.c

src/detect-flowvar.c

src/detect-fragbits.c

src/detect-fragoffset.c

src/detect-ftpbounce.c

src/detect-gid.h

src/detect-http-client-body.c

src/detect-http-client-body.h

src/detect-http-cookie.c

src/detect-http-cookie.h

src/detect-http-header.c

src/detect-http-header.h

src/detect-http-method.c

src/detect-http-method.h

src/detect-http-uri.c

src/detect-icmp-id.c

src/detect-icmp-seq.c

src/detect-icode.c

src/detect-id.c

src/detect-ipopts.c

src/detect-ipproto.c

src/detect-ipproto.h

src/detect-isdataat.c

src/detect-isdataat.h

src/detect-itype.c

src/detect-msg.c

src/detect-nocase.c

src/detect-offset.c

src/detect-parse.c

src/detect-parse.h

src/detect-pcre.c

src/detect-pcre.h

src/detect-pktvar.c

src/detect-priority.c

src/detect-rawbytes.c

src/detect-reference.c

src/detect-reference.h

src/detect-rev.c

src/detect-rpc.c

src/detect-sameip.c

src/detect-seq.c

src/detect-sid.c

src/detect-ssh-proto-version.c

src/detect-ssh-software-version.c

src/detect-stream_size.c

src/detect-tag.c

src/detect-tag.h

src/detect-threshold.c

src/detect-threshold.h

src/detect-tls-version.c

src/detect-ttl.c

src/detect-uricontent.c

src/detect-uricontent.h

src/detect-urilen.c

src/detect-window.c

src/detect-within.c

src/detect.c

src/detect.h

src/flow-hash.c

src/flow-private.h

src/flow-queue.c

src/flow-queue.h

src/flow-util.c

src/flow-util.h

src/flow.c

src/flow.h

src/log-httplog.c

src/output.c

src/output.h

src/queue.h

src/respond-reject-libnet11.c

src/respond-reject.c

src/respond-reject.h

src/runmodes.c

src/runmodes.h

src/source-erf-dag.c

src/source-erf-file.c

src/source-ipfw.c

src/source-nfq.c

src/source-nfq.h

src/source-pcap-file.c

src/source-pcap.c

src/source-pcap.h

src/source-pfring.c

src/source-pfring.h

src/stream-tcp-private.h

src/stream-tcp-reassemble.c

src/stream-tcp-reassemble.h

src/stream-tcp.c

src/stream-tcp.h

src/stream.c

src/stream.h

src/suricata-common.h

src/suricata.c

src/suricata.h

src/threads.c

src/threads.h

src/threadvars.h

src/tm-modules.c

src/tm-modules.h

src/tm-queues.c

src/tm-threads.c

src/tm-threads.h

src/tmqh-flow.c

src/tmqh-packetpool.c

src/tmqh-packetpool.h

src/tmqh-ringbuffer.c

src/tmqh-simple.c

src/util-atomic.h

src/util-bloomfilter-counting.c

src/util-bloomfilter.h

src/util-byte.c

src/util-byte.h

src/util-classification-config.c

src/util-cpu.c

src/util-cuda-handlers.c

src/util-cuda-handlers.h

src/util-cuda.c

src/util-cuda.h

src/util-daemon.c

src/util-debug-filters.c

src/util-debug.c

src/util-debug.h

src/util-decode-asn1.c

src/util-error.c

src/util-error.h

src/util-fmemopen.c

src/util-fmemopen.h

src/util-hash.c

src/util-hashlist.c

src/util-mem.h

src/util-mpm-b2g-cuda.c

src/util-mpm-b2g-cuda.h

src/util-mpm-b2g.c

src/util-mpm-b2g.h

src/util-mpm-b3g.c

src/util-mpm-b3g.h

src/util-mpm-wumanber.c

src/util-mpm.c

src/util-mpm.h

src/util-pool.c

src/util-print.c

src/util-print.h

src/util-privs.c

src/util-profiling.c

src/util-profiling.h

src/util-radix-tree.c

src/util-radix-tree.h

src/util-ringbuffer.h

src/util-spm-bm.c

src/util-spm-bs.c

src/util-spm-bs2bm.c

src/util-spm.c

src/util-threshold-config.c

src/util-unittest-helper.c

src/util-unittest-helper.h

src/util-unittest.c

src/util-unittest.h

src/util-validate.h

src/util-var-name.c

src/win32-misc.c

src/win32-misc.h

src/win32-service.c

suricata.yaml

Show diffs side-by-side

added added

removed removed

src/detect-window.c

103

103

*/

104

104

int DetectWindowMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, SigMatch *m) {

105

105

DetectWindowData *wd = (DetectWindowData *)m->ctx;

106

if ( !(PKT_IS_TCP(p)) || wd == NULL) {

106

107

if ( !(PKT_IS_TCP(p)) || wd == NULL || PKT_IS_PSEUDOPKT(p)) {

107

108

return 0;

108

109

}

109

110

126

127

DetectWindowData *wd = NULL;

127

128

char *args[3] = {NULL,NULL,NULL}; /* PR: Why PCRE MAX_SUBSTRING must be multiple of 3? */

128

129

#define MAX_SUBSTRINGS 30

129

int i = 0;

130

130

131

int ret = 0, res = 0;

131

132

int ov[MAX_SUBSTRINGS];

132

133

134

133

135

ret = pcre_exec(parse_regex, parse_regex_study, windowstr, strlen(windowstr), 0, 0, ov, MAX_SUBSTRINGS);

134

136

135

137

if (ret < 1 || ret > 3) {

169

171

}

170

172

}

171

173

174

int i = 0;

172

175

for (i = 0; i < (ret -1); i++){

173

176

if (args[i] != NULL)

174

177

SCFree(args[i]);

176

179

return wd;

177

180

178

181

error:

179

for (i = 0; i < (ret - 1) && i < 3; i++){

182

for (i = 0; i < (ret -1) && i < 3; i++){

180

183

if (args[i] != NULL)

181

184

SCFree(args[i]);

182

185

}

214

217

sm->ctx = (void *)wd;

215

218

216

219

SigMatchAppendPacket(s, sm);

220

s->flags |= SIG_FLAG_REQUIRE_PACKET;

217

221

218

222

return 0;

219

223

Older »