Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

next/222/20231211/v1 #10028

Merged
merged 5 commits into from
Dec 11, 2023
Merged

next/222/20231211/v1 #10028

merged 5 commits into from
Dec 11, 2023

Commits on Dec 11, 2023

  1. doc: clarify IP-only with iprep

    @inashivb @victorjulien
    inashivb authored and victorjulien committed Dec 11, 2023
    Configuration menu
    Copy the full SHA
    b9540df View commit details
    Browse the repository at this point in the history

  2. detect: rename SigAddressPrepare fns to SigPrepare 

    There is nothing Address specific going on in the preparations.
Stage 1: Preprocessing happens. Sigs classified as IP Only, Masks
applied, content specific limits applied, etc and sig array built.
Stage 2: Sigs grouped by IPOnly, ports and protocols.
Stage 3: Decoder Events SGH built.
Stage 4: File flags set, sig grouping done per prefilter, etc.
    @inashivb @victorjulien
    inashivb authored and victorjulien committed Dec 11, 2023
    Configuration menu
    Copy the full SHA
    bd41b31 View commit details
    Browse the repository at this point in the history

  3. detect-engine: use bool return type

    @inashivb @victorjulien
    inashivb authored and victorjulien committed Dec 11, 2023
    Configuration menu
    Copy the full SHA
    47c9a14 View commit details
    Browse the repository at this point in the history

  4. detect-engine: use flag SIG_FLAG_MPM_NEG 

    The flag SIG_FLAG_MPM_NEG is set before whitelisting the rules. Make it
better by checking for the flag in the beginning and return immediately.
    @inashivb @victorjulien
    inashivb authored and victorjulien committed Dec 11, 2023
    Configuration menu
    Copy the full SHA
    3485880 View commit details
    Browse the repository at this point in the history

  5. detect/flowbits: remove DETECT_FLOWBITS_CMD_NOALERT 

    DETECT_FLOWBITS_CMD_NOALERT is misleading as it gives an impression that
noalert is a flowbit specific command that'll be used and dealt with at
some point but as soon as noalert is found in the rule lang, signature
flag for noalert is set and control is returned. It never gets added to
cmd of the flowbits object.
    @inashivb @victorjulien
    inashivb authored and victorjulien committed Dec 11, 2023
    Configuration menu
    Copy the full SHA
    75471dd View commit details
    Browse the repository at this point in the history