diff --git a/src/detect.c b/src/detect.c index 535959c833..c08682e0d0 100644 --- a/src/detect.c +++ b/src/detect.c @@ -3609,16 +3609,19 @@ int SigGroupBuild (DetectEngineCtx *de_ctx) { if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); } + printf("packet- %d\n", mpm_ctx->pattern_cnt); mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_uri); if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); } + printf("uri- %d\n", mpm_ctx->pattern_cnt); mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_stream); if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); } + printf("stream- %d\n", mpm_ctx->pattern_cnt); } // SigAddressPrepareStage5(de_ctx); diff --git a/src/util-mpm-ac.c b/src/util-mpm-ac.c index 1078771abf..3db1a061d6 100644 --- a/src/util-mpm-ac.c +++ b/src/util-mpm-ac.c @@ -181,7 +181,8 @@ static inline uint32_t SCACInitHashRaw(uint8_t *pat, uint16_t patlen) * \retval hash A 32 bit unsigned hash. */ static inline SCACPattern *SCACInitHashLookup(SCACCtx *ctx, uint8_t *pat, - uint16_t patlen, char flags) + uint16_t patlen, char flags, + uint32_t pid) { uint32_t hash = SCACInitHashRaw(pat, patlen); @@ -191,7 +192,8 @@ static inline SCACPattern *SCACInitHashLookup(SCACCtx *ctx, uint8_t *pat, SCACPattern *t = ctx->init_hash[hash]; for ( ; t != NULL; t = t->next) { - if (SCACCmpPattern(t, pat, patlen, flags) == 1) + //if (SCACCmpPattern(t, pat, patlen, flags) == 1) + if (t->flags == flags && t->id == pid) return t; } @@ -268,9 +270,9 @@ static inline void memcpy_tolower(uint8_t *d, uint8_t *s, uint16_t len) static inline uint32_t SCACInitHash(SCACPattern *p) { - uint32_t hash = p->len * p->cs[0]; + uint32_t hash = p->len * p->original_pat[0]; if (p->len > 1) - hash += p->cs[1]; + hash += p->original_pat[1]; return (hash % INIT_HASH_SIZE); } @@ -327,7 +329,7 @@ static int SCACAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, } /* check if we have already inserted this pattern */ - SCACPattern *p = SCACInitHashLookup(ctx, pat, patlen, flags); + SCACPattern *p = SCACInitHashLookup(ctx, pat, patlen, flags, pid); if (p == NULL) { SCLogDebug("Allocing new pattern"); @@ -338,6 +340,13 @@ static int SCACAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, p->flags = flags; p->id = pid; + p->original_pat = SCMalloc(patlen); + if (p->original_pat == NULL) + goto error; + mpm_ctx->memory_cnt++; + mpm_ctx->memory_size += patlen; + memcpy(p->original_pat, pat, patlen); + p->ci = SCMalloc(patlen); if (p->ci == NULL) goto error; @@ -1994,6 +2003,37 @@ static int SCACTest24(void) return result; } +static int SCACTest25(void) +{ + int result = 0; + MpmCtx mpm_ctx; + MpmThreadCtx mpm_thread_ctx; + + memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); + memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); + MpmInitCtx(&mpm_ctx, MPM_AC, -1); + SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx, 0); + + SCACAddPatternCI(&mpm_ctx, (uint8_t *)"ABCD", 4, 0, 0, 0, 0, 0); + SCACAddPatternCI(&mpm_ctx, (uint8_t *)"bCdEfG", 6, 0, 0, 1, 0, 0); + SCACAddPatternCI(&mpm_ctx, (uint8_t *)"fghJikl", 7, 0, 0, 2, 0, 0); + + SCACPreparePatterns(&mpm_ctx); + + char *buf = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"; + uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, NULL, + (uint8_t *)buf, strlen(buf)); + + if (cnt == 3) + result = 1; + else + printf("3 != %" PRIu32 " ",cnt); + + SCACDestroyCtx(&mpm_ctx); + SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); + return result; +} + #endif /* UNITTESTS */ void SCACRegisterTests(void) @@ -2024,6 +2064,7 @@ void SCACRegisterTests(void) UtRegisterTest("SCACTest22", SCACTest22, 1); UtRegisterTest("SCACTest23", SCACTest23, 1); UtRegisterTest("SCACTest24", SCACTest24, 1); + UtRegisterTest("SCACTest25", SCACTest25, 1); #endif return; diff --git a/src/util-mpm-ac.h b/src/util-mpm-ac.h index ba60b832be..1161e02f68 100644 --- a/src/util-mpm-ac.h +++ b/src/util-mpm-ac.h @@ -30,6 +30,8 @@ typedef struct SCACPattern_ { uint16_t len; /* flags decribing the pattern */ uint8_t flags; + /* holds the original pattern that was added */ + uint8_t *original_pat; /* case sensitive */ uint8_t *cs; /* case INsensitive */ diff --git a/src/util-mpm-b2g.c b/src/util-mpm-b2g.c index 9f11598b36..ceb36c892e 100644 --- a/src/util-mpm-b2g.c +++ b/src/util-mpm-b2g.c @@ -177,9 +177,9 @@ static inline void memcpy_tolower(uint8_t *d, uint8_t *s, uint16_t len) { * INIT HASH START */ static inline uint32_t B2gInitHash(B2gPattern *p) { - uint32_t hash = p->len * p->cs[0]; + uint32_t hash = p->len * p->original_pat[0]; if (p->len > 1) - hash += p->cs[1]; + hash += p->original_pat[1]; return (hash % INIT_HASH_SIZE); } @@ -220,7 +220,8 @@ static inline int B2gInitHashAdd(B2gCtx *ctx, B2gPattern *p) { static inline int B2gCmpPattern(B2gPattern *p, uint8_t *pat, uint16_t patlen, char flags); -static inline B2gPattern *B2gInitHashLookup(B2gCtx *ctx, uint8_t *pat, uint16_t patlen, char flags) { +static inline B2gPattern *B2gInitHashLookup(B2gCtx *ctx, uint8_t *pat, uint16_t patlen, char flags, + uint32_t pid) { uint32_t hash = B2gInitHashRaw(pat,patlen); //printf("B2gInitHashLookup: %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]); @@ -231,7 +232,8 @@ static inline B2gPattern *B2gInitHashLookup(B2gCtx *ctx, uint8_t *pat, uint16_t B2gPattern *t = ctx->init_hash[hash]; for ( ; t != NULL; t = t->next) { - if (B2gCmpPattern(t,pat,patlen,flags) == 1) + //if (B2gCmpPattern(t,pat,patlen,flags) == 1) + if (t->flags == flags && t->id == pid) return t; } @@ -295,7 +297,7 @@ static int B2gAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_ return 0; /* get a memory piece */ - B2gPattern *p = B2gInitHashLookup(ctx, pat, patlen, flags); + B2gPattern *p = B2gInitHashLookup(ctx, pat, patlen, flags, pid); if (p == NULL) { SCLogDebug("allocing new pattern"); @@ -307,6 +309,13 @@ static int B2gAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_ p->flags = flags; p->id = pid; + p->original_pat = SCMalloc(patlen); + if (p->original_pat == NULL) + goto error; + mpm_ctx->memory_cnt++; + mpm_ctx->memory_size += patlen; + memcpy(p->original_pat, pat, patlen); + /* setup the case insensitive part of the pattern */ p->ci = SCMalloc(patlen); if (p->ci == NULL) @@ -752,7 +761,10 @@ static void B2gGetConfig() void B2gInitCtx (MpmCtx *mpm_ctx, int module_handle) { SCLogDebug("mpm_ctx %p, ctx %p", mpm_ctx, mpm_ctx->ctx); - BUG_ON(mpm_ctx->ctx != NULL); + if (mpm_ctx->ctx != NULL) + return; + + //BUG_ON(mpm_ctx->ctx != NULL); mpm_ctx->ctx = SCMalloc(sizeof(B2gCtx)); if (mpm_ctx->ctx == NULL) { diff --git a/src/util-mpm-b2g.h b/src/util-mpm-b2g.h index ab2bcad95a..ae78edadde 100644 --- a/src/util-mpm-b2g.h +++ b/src/util-mpm-b2g.h @@ -56,6 +56,7 @@ typedef struct B2gPattern_ { uint8_t flags; uint8_t pad0; uint32_t id; + uint8_t *original_pat; uint8_t *ci; /* case INsensitive */ uint8_t *cs; /* case sensitive */ struct B2gPattern_ *next; diff --git a/src/util-mpm-b2gc.c b/src/util-mpm-b2gc.c index d8fe002ee9..5c6ae39833 100644 --- a/src/util-mpm-b2gc.c +++ b/src/util-mpm-b2gc.c @@ -904,7 +904,10 @@ static void B2gcGetConfig() void B2gcInitCtx (MpmCtx *mpm_ctx, int module_handle) { SCLogDebug("mpm_ctx %p, ctx %p", mpm_ctx, mpm_ctx->ctx); - BUG_ON(mpm_ctx->ctx != NULL); + if (mpm_ctx->ctx != NULL) + return; + + //BUG_ON(mpm_ctx->ctx != NULL); mpm_ctx->ctx = SCMalloc(sizeof(B2gcCtx)); if (mpm_ctx->ctx == NULL) { diff --git a/src/util-mpm.c b/src/util-mpm.c index c243b93fad..baa2242a1a 100644 --- a/src/util-mpm.c +++ b/src/util-mpm.c @@ -110,12 +110,15 @@ int32_t MpmFactoryRegisterMpmCtxProfile(const char *name, uint8_t flags) } /* let's make the new entry */ - if ((items = realloc(items, (mpm_ctx_factory_container->no_of_items + 1) * - sizeof(MpmCtxFactoryItem))) == NULL) { + items = realloc(items, + (mpm_ctx_factory_container->no_of_items + 1) * sizeof(MpmCtxFactoryItem)); + if (items == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } + mpm_ctx_factory_container->items = items; + MpmCtxFactoryItem *new_item = &items[mpm_ctx_factory_container->no_of_items]; new_item[0].name = strdup(name); if (new_item[0].name == NULL) {