Commit Graph

15 Commits (e00dcd52a0b3da1e39ba4d8d5d6043c0a97e03cc)

Author SHA1 Message Date
Ken Steele 900def5caf Create Specialized SCMemcmpNZ() when the length can't be zero. 11 years ago
Victor Julien 17dfd59bc3 memcmp: compare the first byte as well
MemcmpLowercase would not compare the first byte of both input buffers
leading to two non-identical buffers to be considered the same.

Affects SSE_4_1 and SSE_4_2 implementations of SCMemcmpLowercase, as well
as the non-SIMD implementation. SSE_3 and Tile version are not affected.
11 years ago
Ken Steele 8f1d75039a Enforce function coding standard
Functions should be defined as:

int foo(void)
{
}

Rather than:
int food(void) {
}

All functions where changed by a script to match this standard.
11 years ago
Victor Julien e1e2ebe2da memcmp: convert all pointer arguments to be const pointers, like memcmp itself uses. 12 years ago
Anoop Saldanha 429c6388f6 App layer API rewritten. The main files in question are:
app-layer.[ch], app-layer-detect-proto.[ch] and app-layer-parser.[ch].

Things addressed in this commit:
- Brings out a proper separation between protocol detection phase and the
  parser phase.
- The dns app layer now is registered such that we don't use "dnstcp" and
  "dnsudp" in the rules.  A user who previously wrote a rule like this -

  "alert dnstcp....." or
  "alert dnsudp....."

  would now have to use,

  alert dns (ipproto:tcp;) or
  alert udp (app-layer-protocol:dns;) or
  alert ip (ipproto:udp; app-layer-protocol:dns;)

  The same rules extend to other another such protocol, dcerpc.
- The app layer parser api now takes in the ipproto while registering
  callbacks.
- The app inspection/detection engine also takes an ipproto.
- All app layer parser functions now take direction as STREAM_TOSERVER or
  STREAM_TOCLIENT, as opposed to 0 or 1, which was taken by some of the
  functions.
- FlowInitialize() and FlowRecycle() now resets proto to 0.  This is
  needed by unittests, which would try to clean the flow, and that would
  call the api, AppLayerParserCleanupParserState(), which would try to
  clean the app state, but the app layer now needs an ipproto to figure
  out which api to internally call to clean the state, and if the ipproto
  is 0, it would return without trying to clean the state.
- A lot of unittests are now updated where if they are using a flow and
  they need to use the app layer, we would set a flow ipproto.
- The "app-layer" section in the yaml conf has also been updated as well.
12 years ago
Victor Julien 2ec57c36b4 SSE 4.2 memcmp: don't read beyond var boundary
In the SSE 4.2 SCMemcmpLowercase implementation, there would be a
_mm_load_si128 of a 2 byte array. However, _mm_load_si128 loads
16 bytes, causing it to read beyond the var. I don't think this lead
to crashes, as it was a static var, but clangs ASAN complained about
it.
12 years ago
Victor Julien 49a54713da memcmp: don't use SSE intrinsics if less that 16 bytes are available in SSE_4_2 version. 12 years ago
Ken Steele 22225a7e99 Tile SIMD implementation of SCMemcmp and SCMemcmpLowercase
Based on the SSE3 implementation, it checks 8 bytes at a time.
12 years ago
Victor Julien d3f19a3851 Fix memcmp checks that prevent reading past buffer boundary. 15 years ago
Victor Julien 962462e470 Fix SSE memcmp functions reading beyond the buffer. Add tests to bench them. 15 years ago
Victor Julien b963890de1 Reenable SSE3 memcmp and switch AC memcmp to use the SCMemcmp wrapper. 15 years ago
Anoop Saldanha 7ec0382774 support fast pattern for http raw header. Also support relative modifiers for http raw header 15 years ago
Victor Julien 091f53ce4e Fix retval of SCMemcmp for non-SIMD implementation. 15 years ago
Victor Julien a75556dfe5 Add memcmp functions for SSE4.1 and SSE4.2. 15 years ago
Victor Julien 1859ed54c7 Add memcmp api with a plain memcmp function and a SSE3 accelerated memcmp. 15 years ago