77 Commits (e75a93b1256e604d2528baff76b9c236057dba64)

Author	SHA1	Message	Date
Victor Julien	0d3f671b55	detect: constify mpm/detect funcs	10 years ago
Victor Julien	6b2f831a70	mpm: SGH maxlen was actually minlen, so rename	10 years ago
Victor Julien	2716c78628	mpm: improve SGH content len tracking ... SGH's track content length for rule grouping. This patch changes the logic to only consider the pattern that is used in the mpm for a sig.	10 years ago
Victor Julien	e529ebb50e	mpm: redo uri maxlen logic ... The mpm_uricontent_maxlen logic was meant to track the shortest possible pattern in the MPM of a SGH. So a minlen more than a maxlen. This patch replaces the complicated tracking logic by a simpler scheme. When the SGH's are finalize, the minlen is calculated. It also fixes a small corner case where the calculated "maxlen" could be wrong. This would require a smaller pattern in a rule to be forced as fast pattern.	10 years ago
Victor Julien	6b2fb3fd5d	Fix minor format string issues	10 years ago
Victor Julien	a8c16405fb	detect: properly size det_ctx::non_mpm_id_array ... Track which sgh has the higest non-mpm sig count and use that value to size the det_ctx::non_mpm_id_array array.	11 years ago
Victor Julien	4c10635dc1	detect: optimize non-mpm mask checking ... Store id and mask in a single array of type SignatureNonMpmStore so that both are loaded into the same cache line.	11 years ago
Victor Julien	b5a3127151	detect: add mask check prefilter for non mpm list ... Add mask array for non_mpm sigs, so that we can exclude many sigs before we merge sort. Shows 50% less non mpm sigs inspected on average.	11 years ago
Victor Julien	ef6875d583	detect: Disable unused SignatureHeader code	11 years ago
Ken Steele	65af1f1c5e	Remove sgh->mask_array ... Not needed by new MPM opt.	11 years ago
Ken Steele	736ac6a459	Use SigIntId as the type for storing signature IDs (Internal) ... Previously using uint32_t, but SigIntId is currently uint16_t, so arrays will take less memory.	11 years ago
Victor Julien	1f57e25c03	detect: Add negated MPM to non-MPM array ... Treat negated MPM sigs as if non-MPM, so we consider them always. As MPM results and non-MPM rules lists are now merged and considered for further inspection, rules that need to be considerd when a pattern is absent are caught in the middle. As a HACK/workaround this patch adds them to the non-MPM list. This causes them to be inspected each time.	11 years ago
Victor Julien	f5df526f9b	Detect: create per sgh non-MPM rule array ... Array of rule id's that are not using MPM prefiltering. These will be merged with the MPM results array. Together these should lead to a list of all the rules that can possibly match.	11 years ago
Ken Steele	ff41c1c452	Correct size increase in SigGroupHeadStore() ... The code was increasing the size of the allocated memory by 16, but only increasing the stored size by 10. Now uses one variable for both places.	11 years ago
Ken Steele	8f1d75039a	Enforce function coding standard ... Functions should be defined as: int foo(void) { } Rather than: int food(void) { } All functions where changed by a script to match this standard.	11 years ago
Eric Leblond	1f07d1521e	Fix realloc error handling ... This patch is fixing realloc error handling. In case of a realloc failure, it free the initial memory and continue existing error handling. The patch has been obtained via the following semantic patch and a bit oh hand editing: @@ expression x, E; identifier f; @@ f(...) { + void *ptmp; <+... - x = SCRealloc(x, E); + ptmp = SCRealloc(x, E); ... when != x - if (x == NULL) + if (ptmp == NULL) { + SCFree(x); + x = NULL; ... - } + } else { + x = ptmp; + } ...+> } @@ expression x, E; identifier f; statement ES; @@ f(...) { + void *ptmp; <+... - x = SCRealloc(x, E); + ptmp = SCRealloc(x, E); ... when != x - if (x == NULL) ES + if (ptmp == NULL) { + SCFree(x); + x = NULL; + ES + } else { + x = ptmp; + } ...+> } @@ expression x, E; identifier f; @@ f(...) { + void *ptmp; <+... - x = SCRealloc(x, E); + ptmp = SCRealloc(x, E); ... when != x - if (unlikely(x == NULL)) + if (unlikely(ptmp == NULL)) { + SCFree(x); + x = NULL; ... - } + } else { + x = ptmp; + } ...+> } @@ expression x, E; identifier f; statement ES; @@ f(...) { + void *ptmp; <+... - x = SCRealloc(x, E); + ptmp = SCRealloc(x, E); ... when != x - if (unlikely(x == NULL)) ES + if (unlikely(ptmp == NULL)) { + SCFree(x); + x = NULL; + ES + } else { + x = ptmp; + } ...+> }	12 years ago
Victor Julien	ecd5c7573b	Coverity 1038135 fix ... Small cleanup in the error handling. The extra null check confused Coverity.	12 years ago
Ken Steele	784843b146	Use Tilera SIMD for Signature matching ala SSE3 ... Makes use of 8-wide byte compare instructions in signature matching. For allocating aligned memory, _mm_malloc() is SSE only, so added check for __tile__ to use memalign() instead. Shows a 13% speed up.	12 years ago
Victor Julien	d0c1410cf5	Fix sig grouping bug when certain sigs are mixed. Add tests.	13 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	13 years ago
Victor Julien	8f71333e12	file: implement filesize keyword. #489.	13 years ago
pi-rho	0df4c5838d	spelling corrections documented in redmine bug#533	13 years ago
Victor Julien	c9e93ec52c	filemd5: add support code for md5 handling for signatures.	13 years ago
Victor Julien	cdba2f50d1	Various fixes and improvements based on feedback by Coverity analyzer.	14 years ago
Anoop Saldanha	4810ee9c5f	All uricontent modified patterns now are DETECT_CONTENT and not DETECT_URICONTENT. Step towards unifying all content based patterns. Makes way for easier management of patterns	14 years ago
Victor Julien	d5ed28b065	Remove SIG_FLAG_MPM flag.	14 years ago
Victor Julien	4992f7c417	Remove SIG_FLAG_MPM_URI flag. It was checked but never set.	14 years ago
Victor Julien	9b62ec65ab	Make sure filemagic works properly regardless of filestore being in use for a flow.	14 years ago
Victor Julien	23e01d23d3	Implement filestore keyword, including a way for the stateful detection engine to conclude that a file will never have to be stored.	14 years ago
Anoop Saldanha	17f3f36d38	packet keywords only added for packet mpm. Rest in stream mpm. Update detection engine to handle the same	14 years ago
Anoop Saldanha	ed3b44b3b5	fix parsing content keywords. We are more strict now. All content keywords need to be enclosed in double quotes. Better validation for sid, priority and rev keywords	14 years ago
Victor Julien	4b52823ab6	Use 64 bit mask on 64-bit systems.	14 years ago
Victor Julien	e5b6c0f518	Check 32 masks per run instead of 16 in the SIMD code.	14 years ago
Victor Julien	2dbfdd40af	Clean up new SIMD mask checking code, improve non-SIMD checks.	14 years ago
Victor Julien	b421019cef	Match packet mask against 16 signature masks at once using SIMD instructions for SSE3 and up.	14 years ago
Gerardo Iglesias Galvan	91c001f93b	Fix potential crash in initialization cleanup code	14 years ago
Victor Julien	435d0fb327	Clean up signature flags creating room for merging flags and mpm_flags. Merge flags and mpm_flags. Move new mpm id's into signature header. Get rid of full signature access in signature prefiltering.	15 years ago
Anoop Saldanha	4883efd0f6	unifying content structure - uricontent now uses DetectContentData	15 years ago
Anoop Saldanha	e0476242c6	replace all Signature->umatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_UMATCH]	15 years ago
Anoop Saldanha	e54358a9e1	replace all Signature->pmatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_PMATCH]	15 years ago
Victor Julien	cbd4c298ed	Initial version of a new bitmask based signature pre-filtering method.	15 years ago
Victor Julien	1859ed54c7	Add memcmp api with a plain memcmp function and a SSE3 accelerated memcmp.	15 years ago
Victor Julien	fc248ca7a1	Many small performance updates.	15 years ago
Victor Julien	1071a53210	Fix unittests after ip_proto keyword change.	15 years ago
Victor Julien	9ba11dbfbd	Clean up detection engine mpm initialization phase.	15 years ago
Victor Julien	0219b767b8	Fix a content pattern matching bug related to signature grouping and mpm_ctx sharing. In certain conditions (signature combinations) the mpm_stream_ctx (the ctx that handles stream pattern scanning) wasn't properly setup.	15 years ago
Victor Julien	37442a8a84	Prefilter signatures before fully scanning them.	15 years ago
Victor Julien	83b2c8abdb	Improve stateful uri detection code.	15 years ago
Victor Julien	a24f288074	Moving the stream content scanning to have it's own mpm ctx.	15 years ago
Victor Julien	2fd31a1a11	Remove dsize grouping from detection engine grouping reducing memory usage. Store sgh in flow to reduce lookups. Reduce locking in alert handling. Increase default grouping values as we use less memory.	15 years ago