suricata

Commit Graph

Author	SHA1	Message	Date
Ken Steele	900def5caf	Create Specialized SCMemcmpNZ() when the length can't be zero.	12 years ago
Victor Julien	17dfd59bc3	memcmp: compare the first byte as well MemcmpLowercase would not compare the first byte of both input buffers leading to two non-identical buffers to be considered the same. Affects SSE_4_1 and SSE_4_2 implementations of SCMemcmpLowercase, as well as the non-SIMD implementation. SSE_3 and Tile version are not affected.	12 years ago
Ken Steele	8f1d75039a	Enforce function coding standard Functions should be defined as: int foo(void) { } Rather than: int food(void) { } All functions where changed by a script to match this standard.	12 years ago
Victor Julien	e1e2ebe2da	memcmp: convert all pointer arguments to be const pointers, like memcmp itself uses.	13 years ago
Anoop Saldanha	429c6388f6	App layer API rewritten. The main files in question are: app-layer.[ch], app-layer-detect-proto.[ch] and app-layer-parser.[ch]. Things addressed in this commit: - Brings out a proper separation between protocol detection phase and the parser phase. - The dns app layer now is registered such that we don't use "dnstcp" and "dnsudp" in the rules. A user who previously wrote a rule like this - "alert dnstcp....." or "alert dnsudp....." would now have to use, alert dns (ipproto:tcp;) or alert udp (app-layer-protocol:dns;) or alert ip (ipproto:udp; app-layer-protocol:dns;) The same rules extend to other another such protocol, dcerpc. - The app layer parser api now takes in the ipproto while registering callbacks. - The app inspection/detection engine also takes an ipproto. - All app layer parser functions now take direction as STREAM_TOSERVER or STREAM_TOCLIENT, as opposed to 0 or 1, which was taken by some of the functions. - FlowInitialize() and FlowRecycle() now resets proto to 0. This is needed by unittests, which would try to clean the flow, and that would call the api, AppLayerParserCleanupParserState(), which would try to clean the app state, but the app layer now needs an ipproto to figure out which api to internally call to clean the state, and if the ipproto is 0, it would return without trying to clean the state. - A lot of unittests are now updated where if they are using a flow and they need to use the app layer, we would set a flow ipproto. - The "app-layer" section in the yaml conf has also been updated as well.	13 years ago
Victor Julien	2ec57c36b4	SSE 4.2 memcmp: don't read beyond var boundary In the SSE 4.2 SCMemcmpLowercase implementation, there would be a _mm_load_si128 of a 2 byte array. However, _mm_load_si128 loads 16 bytes, causing it to read beyond the var. I don't think this lead to crashes, as it was a static var, but clangs ASAN complained about it.	13 years ago
Victor Julien	49a54713da	memcmp: don't use SSE intrinsics if less that 16 bytes are available in SSE_4_2 version.	13 years ago
Ken Steele	22225a7e99	Tile SIMD implementation of SCMemcmp and SCMemcmpLowercase Based on the SSE3 implementation, it checks 8 bytes at a time.	13 years ago
Victor Julien	d3f19a3851	Fix memcmp checks that prevent reading past buffer boundary.	15 years ago
Victor Julien	962462e470	Fix SSE memcmp functions reading beyond the buffer. Add tests to bench them.	15 years ago
Victor Julien	b963890de1	Reenable SSE3 memcmp and switch AC memcmp to use the SCMemcmp wrapper.	16 years ago
Anoop Saldanha	7ec0382774	support fast pattern for http raw header. Also support relative modifiers for http raw header	16 years ago
Victor Julien	091f53ce4e	Fix retval of SCMemcmp for non-SIMD implementation.	16 years ago
Victor Julien	a75556dfe5	Add memcmp functions for SSE4.1 and SSE4.2.	16 years ago
Victor Julien	1859ed54c7	Add memcmp api with a plain memcmp function and a SSE3 accelerated memcmp.	16 years ago

15 Commits (1a2ad059a12910120cd997e76ea75e688747ff7d)