]> git.ipfire.org Git - thirdparty/snort3.git/commit
Pull request #3324: Ips bag
authorRuss Combs (rucombs) <rucombs@cisco.com>
Fri, 1 Apr 2022 20:39:13 +0000 (20:39 +0000)
committerRuss Combs (rucombs) <rucombs@cisco.com>
Fri, 1 Apr 2022 20:39:13 +0000 (20:39 +0000)
commit00aaedfc36c8449827cb15e077e93353f2e5ccd6
treea77ee1b6bd3d3ee38518b2c5ed913387e0719490
parent881f24e5a6d0f53908d5b82267e9159ee3638596
Pull request #3324: Ips bag

Merge in SNORT/snort3 from ~RUCOMBS/snort3:ips_bag to master

Squashed commit of the following:

commit 7f28f5c4cbda2834d6f50ba43eb45a0d34b57abd
Author: russ <rucombs@cisco.com>
Date:   Sun Mar 27 14:03:38 2022 -0400

    hyperscan: ensure adequate scratch when deserializing

commit 0d4f03134ec1d17101774a9080a3e86dc7cf7a3c
Author: russ <rucombs@cisco.com>
Date:   Sat Mar 26 22:26:31 2022 -0400

    detection: skip match deduplication for hyperscan

commit 2b5fb8dce61bb23cf190200d6b99419b24bea1f1
Author: russ <rucombs@cisco.com>
Date:   Sat Mar 26 15:55:18 2022 -0400

    search_engines: ensure SearchTool with hyperscan gets multi-match mode

commit f50810182e6f1c2900afa9bf7c9a5c1a11f0ec84
Author: russ <rucombs@cisco.com>
Date:   Sat Mar 26 14:39:10 2022 -0400

    search_engines: add and refactor unit tests

commit a7af03c532dce85a2d9eae6d3ec89e36f75e439a
Author: russ <rucombs@cisco.com>
Date:   Sat Mar 26 10:08:56 2022 -0400

    ac_full: refactor api access

commit 8c29afb0e0cac16aa360b659281b7dcaa012b090
Author: russ <rucombs@cisco.com>
Date:   Fri Mar 25 23:29:11 2022 -0400

    search_engine: always build ac_full since it is a hard default case

    SearchTool will use hyperscan if configured else ac_full since that
    is the only builtin MPSE that returns all matches.

commit 96f2c0943fc35638f2ee1e611c4e76ba994d0ceb
Author: russ <rucombs@cisco.com>
Date:   Fri Mar 25 21:08:59 2022 -0400

    search_engine: remove search_optimize parameter (always true)

    Also remove broken support for offload from SearchTool.

commit 01271621d4af3bc5dd97ce7fab38887774b7675e
Author: russ <rucombs@cisco.com>
Date:   Thu Mar 24 20:33:25 2022 -0400

    detection: do not check ips policy when builtin events are queued

    Builtin events are for now only checked for the current policy  when
    dequeued. This allows the policy to be changed after inspection, which
    is how Snort 2 does it. This is flawed however and can be fixed by
    pairing an ips policy with each nap or just including the builtin rules
    and state stubs directly in the nap.

commit 95e6beb3ff36ac35d481265b690bb19e88ea9f64
Author: russ <rucombs@cisco.com>
Date:   Thu Mar 24 12:55:54 2022 -0400

    detection: minor refactoring of rule header access

commit 676606491ee0f74675deb8df59a0986ffef1e25f
Author: russ <rucombs@cisco.com>
Date:   Thu Mar 24 10:21:36 2022 -0400

    rate_filter: move to inspection policy

commit 76716c997dadb485e3e2bf4d3011196c61db0821
Author: russ <rucombs@cisco.com>
Date:   Sat Mar 19 09:40:51 2022 -0400

    alerts: remove obsolete stateful parameter

commit 4bcc7ca6fa19963d21768deee31692453a844322
Author: russ <rucombs@cisco.com>
Date:   Fri Mar 18 10:17:31 2022 -0400

    ac_full: remove cruft

commit 4cb95706bd2e13085ee7fe4a158f33f1e35804e3
Author: russ <rucombs@cisco.com>
Date:   Fri Mar 18 10:00:48 2022 -0400

    search_engines: remove the legacy ac_sparse_bands algorithm

commit 57b19a41e7125701e75ea017630a5eeef9f6ecc5
Author: russ <rucombs@cisco.com>
Date:   Fri Mar 18 09:53:03 2022 -0400

    search_engines: remove the legacy ac_sparse algorithm

commit 36b258d99f0b32f7d46f782bce76ca740f320cfe
Author: russ <rucombs@cisco.com>
Date:   Fri Mar 18 09:44:09 2022 -0400

    search_engines: remove the legacy ac_banded algorithm

commit 29720b96a3b54702119dfa98bcc1d8b0b82b7c8f
Author: russ <rucombs@cisco.com>
Date:   Fri Mar 18 09:33:18 2022 -0400

    search_engines: remove the legacy ac_std algorithm

commit 5af3cd8074287bc865563f2e26be17df64fa4046
Author: russ <rucombs@cisco.com>
Date:   Sun Mar 13 00:12:12 2022 -0500

    detection: override match queue limit for offload

commit 00183d5cc1cb7802e3f2f9a5a9becc3319f76c0f
Author: russ <rucombs@cisco.com>
Date:   Sat Mar 12 12:47:59 2022 -0500

    ac_std: fix case translation buffer size

commit 20ceb4956bd6eaa2b6165723df7dd833a044f957
Author: russ <rucombs@cisco.com>
Date:   Fri Mar 11 19:49:22 2022 -0500

    search_engine: remove obsolete warning on max_pattern_len change

commit be971a82799a9da367f0867970b9a20615f327ee
Author: russ <rucombs@cisco.com>
Date:   Fri Mar 11 15:03:54 2022 -0500

    search_engine: fix .debug = true output

... and 7 more commits
75 files changed:
daqs/daq_hext.c
src/actions/actions.cc
src/detection/detection_engine.cc
src/detection/detection_options.cc
src/detection/fp_config.cc
src/detection/fp_config.h
src/detection/fp_create.cc
src/detection/fp_detect.cc
src/detection/fp_utils.cc
src/detection/rtn_checks.cc
src/detection/rtn_checks.h
src/detection/signature.cc
src/detection/signature.h
src/detection/tag.cc
src/detection/treenodes.cc
src/detection/treenodes.h
src/file_api/file_service.cc
src/file_api/file_service.h
src/filters/rate_filter.cc
src/filters/sfrf.cc
src/framework/cursor.cc
src/framework/mpse.h
src/framework/mpse_batch.h
src/main/modules.cc
src/main/snort.cc
src/main/snort_config.h
src/managers/inspector_manager.cc
src/managers/test/get_inspector_stubs.h
src/network_inspectors/appid/appid_config.cc
src/network_inspectors/appid/client_plugins/test/client_plugins_mock.h
src/network_inspectors/appid/detector_plugins/test/detector_sip_test.cc
src/network_inspectors/appid/detector_plugins/test/http_url_patterns_test.cc
src/network_inspectors/appid/service_plugins/test/service_plugin_mock.h
src/network_inspectors/appid/test/appid_discovery_test.cc
src/network_inspectors/appid/test/appid_mock_definitions.h
src/network_inspectors/appid/test/service_state_test.cc
src/network_inspectors/appid/test/tp_lib_handler_test.cc
src/network_inspectors/rna/rna_fingerprint_ua.cc
src/network_inspectors/rna/rna_fingerprint_ua.h
src/network_inspectors/rna/rna_inspector.cc
src/network_inspectors/rna/rna_module.cc
src/network_inspectors/rna/test/CMakeLists.txt
src/network_inspectors/rna/test/rna_module_stubs.h
src/network_inspectors/rna/test/rna_ua_fp_processor_test.cc [new file with mode: 0644]
src/network_inspectors/rna/test/ua_fp_stubs.cc [new file with mode: 0644]
src/parser/parse_rule.cc
src/parser/parser.h
src/search_engines/CMakeLists.txt
src/search_engines/ac_banded.cc [deleted file]
src/search_engines/ac_bnfa.cc
src/search_engines/ac_full.cc
src/search_engines/ac_sparse.cc [deleted file]
src/search_engines/ac_sparse_bands.cc [deleted file]
src/search_engines/ac_std.cc [deleted file]
src/search_engines/acsmx.cc [deleted file]
src/search_engines/acsmx.h [deleted file]
src/search_engines/acsmx2.cc
src/search_engines/acsmx2.h
src/search_engines/acsmx2_api.cc
src/search_engines/bnfa_search.cc
src/search_engines/bnfa_search.h
src/search_engines/hyperscan.cc
src/search_engines/search_engines.cc
src/search_engines/search_tool.cc
src/search_engines/search_tool.h
src/search_engines/test/CMakeLists.txt
src/search_engines/test/ac_bnfa_test.cc [new file with mode: 0644]
src/search_engines/test/hyper_tool_test.cc [new file with mode: 0644]
src/search_engines/test/hyperscan_test.cc
src/search_engines/test/mpse_test_stubs.cc [new file with mode: 0644]
src/search_engines/test/mpse_test_stubs.h [new file with mode: 0644]
src/search_engines/test/search_tool_test.cc
tools/snort2lua/config_states/config_deleted.cc
tools/snort2lua/config_states/config_detection.cc
tools/snort2lua/config_states/config_no_option.cc