From 18b4e3380f4efc55a69cbd95d20b582d05ca4980 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Fri, 24 Dec 2010 13:22:33 +0100 Subject: [PATCH] Make mpm-algo use the mpm_table that has the actual mpm's registered. Clean up dead code. --- src/detect-engine-mpm.c | 978 +--------------------------------- src/detect-http-client-body.c | 102 ---- src/detect.c | 153 ------ 3 files changed, 21 insertions(+), 1212 deletions(-) diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c index a78e7f2803..5844b07dd2 100644 --- a/src/detect-engine-mpm.c +++ b/src/detect-engine-mpm.c @@ -58,34 +58,16 @@ /** \todo make it possible to use multiple pattern matcher algorithms next to eachother. */ -//#define PM MPM_WUMANBER -//#define PM MPM_B2G #ifdef __SC_CUDA_SUPPORT__ #define PM MPM_B2G_CUDA #else #define PM MPM_B2G #endif -//#define PM MPM_B3G #define POPULATE_MPM_AVOID_PACKET_MPM_PATTERNS 0x01 #define POPULATE_MPM_AVOID_STREAM_MPM_PATTERNS 0x02 #define POPULATE_MPM_AVOID_URI_MPM_PATTERNS 0x04 -/* holds the string-enum mapping for the enums that define the different MPM - * algos in util-mpm.h */ -SCEnumCharMap sc_mpm_algo_map[] = { - { "b2g", MPM_B2G }, - { "b3g", MPM_B3G }, - { "wumanber", MPM_WUMANBER }, - { "ac", MPM_AC }, - { "ac-gfbs", MPM_AC_GFBS }, -#ifdef __SC_CUDA_SUPPORT__ - { "b2g_cuda", MPM_B2G_CUDA }, -#endif - { "b2gc", MPM_B2GC }, - { "b2gm", MPM_B2GM }, -}; - /** * \brief check if a signature has patterns that are to be inspected * against a packets payload (as opposed to the stream payload) @@ -168,22 +150,35 @@ int SignatureHasStreamContent(Signature *s) { } -/** \brief Function to return the default multi pattern matcher algorithm to be - * used by the engine +/** + * \brief Function to return the multi pattern matcher algorithm to be + * used by the engine, based on the mpm-algo setting in yaml + * Use the default mpm non is found in yaml. + * * \retval mpm algo value */ uint16_t PatternMatchDefaultMatcher(void) { char *mpm_algo; - int mpm_algo_val = PM; + uint16_t mpm_algo_val = PM; /* Get the mpm algo defined in config file by the user */ if ((ConfGet("mpm-algo", &mpm_algo)) == 1) { - mpm_algo_val = SCMapEnumNameToValue(mpm_algo, sc_mpm_algo_map); - if (mpm_algo_val == -1) { - SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Invalid mpm algo supplied " - "in the yaml conf file: \"%s\"", mpm_algo); - exit(EXIT_FAILURE); + uint16_t u; + + if (mpm_algo != NULL) { + for (u = 0; u < MPM_TABLE_SIZE; u++) { + if (mpm_table[u].name == NULL) + continue; + + if (strcmp(mpm_table[u].name, mpm_algo) == 0) { + return u; + } + } } + + SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Invalid mpm algo supplied " + "in the yaml conf file: \"%s\"", mpm_algo); + exit(EXIT_FAILURE); } return mpm_algo_val; @@ -1256,761 +1251,6 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx, return 0; } -///** \brief Setup the content portion of the sig group head */ -//static int PatternMatchPreprarePopulateMpmPacket(DetectEngineCtx *de_ctx, SigGroupHead *sgh) { -// uint32_t sig; -// uint32_t *fast_pattern = NULL; -// -// fast_pattern = (uint32_t *)SCMalloc(sgh->sig_cnt * sizeof(uint32_t)); -// if (fast_pattern == NULL) -// return -1; -// memset(fast_pattern, 0, sgh->sig_cnt * sizeof(uint32_t)); -// -// HashTable *ht = HashTableInit(4096, ContentHashFunc, ContentHashCompareFunc, ContentHashFree); -// if (ht == NULL) { -// SCFree(fast_pattern); -// return -1; -// } -// -// /* add all the contents to a counting hash */ -// for (sig = 0; sig < sgh->sig_cnt; sig++) { -// Signature *s = sgh->match_array[sig]; -// if (s == NULL) -// continue; -// -// if (SignatureHasPacketContent(s) == 0) { -// continue; -// } -// -// int cnt = 0; -// SigMatch *sm; -// -// /* get the total no of patterns in this Signature, as well as find out -// * if we have a fast_pattern set in this Signature */ -// for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) { -// if (sm->type != DETECT_CONTENT) -// continue; -// -// DetectContentData *co = (DetectContentData *)sm->ctx; -// if (co == NULL) -// continue; -// -// cnt++; -// -// /* special handling of fast pattern keyword */ -// if (co->flags & DETECT_CONTENT_FAST_PATTERN) { -// fast_pattern[sig] = 1; -// SCLogDebug("sig %"PRIu32" has a fast pattern, id %"PRIu32"", s->id, co->id); -// -// ContentHash *ch = ContentHashAlloc(co); -// if (ch == NULL) -// goto error; -// -// ContentHash *lookup_ch = (ContentHash *)HashTableLookup(ht, ch, 0); -// if (lookup_ch == NULL) { -// if (HashTableAdd(ht, ch, 0) < 0) -// printf("Add hash failed\n"); -// } else { -// lookup_ch->cnt++; -// ContentHashFree(ch); -// } -// } -// } -// -// if (fast_pattern[sig] == 1) { -// continue; -// } -// -// for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) { -// if (sm->type != DETECT_CONTENT) -// continue; -// -// DetectContentData *co = (DetectContentData *)sm->ctx; -// if (co == NULL) -// continue; -// -// if (co->content_len < sgh->mpm_content_maxlen) { -// continue; -// } -// -// ContentHash *ch = ContentHashAlloc(co); -// if (ch == NULL) -// goto error; -// -// if (cnt == 1) { -// SCLogDebug("sig has just one pattern, so we know we will " -// "use it in the mpm phase."); -// ch->use = 1; -// } -// -// ContentHash *lookup_ch = (ContentHash *)HashTableLookup(ht, ch, 0); -// if (lookup_ch == NULL) { -// int r = HashTableAdd(ht, ch, 0); -// if (r < 0) -// printf("Add hash failed\n"); -// } else { -// lookup_ch->use = ch->use; -// -// lookup_ch->cnt++; -// ContentHashFree(ch); -// } -// } -// } -// -// /* now determine which one to add to the mpm phase */ -// for (sig = 0; sig < sgh->sig_cnt; sig++) { -// Signature *s = sgh->match_array[sig]; -// if (s == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) -// continue; -// -// if (SignatureHasPacketContent(s) == 0) { -// continue; -// } -// -// ContentHash *mpm_ch = NULL; -// SigMatch *sm = NULL; -// -// for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) { -// if (sm->type != DETECT_CONTENT) -// continue; -// -// DetectContentData *co = (DetectContentData *)sm->ctx; -// if (co == NULL) -// continue; -// -// /* skip in case of: -// * 1. we expect a fastpattern but this isn't it -// * 2. we have a smaller content than mpm_content_maxlen */ -// if (fast_pattern[sig] == 1) { -// if (!(co->flags & DETECT_CONTENT_FAST_PATTERN)) { -// SCLogDebug("not a fast pattern %"PRIu32"", co->id); -// continue; -// } -// SCLogDebug("fast pattern %"PRIu32"", co->id); -// -// } else if (co->content_len < sgh->mpm_content_maxlen) { -// continue; -// } -// -// ContentHash *ch = ContentHashAlloc(co); -// if (ch == NULL) -// goto error; -// -// ContentHash *lookup_ch = (ContentHash *)HashTableLookup(ht, ch, 0); -// if (lookup_ch == NULL) { -// continue; -// } -// -// SCLogDebug("lookup_ch->use %u, cnt %u", lookup_ch->use, lookup_ch->cnt); -// -// if (mpm_ch == NULL) { -// SCLogDebug("mpm_ch == NULL, so selecting lookup_ch->ptr->id %"PRIu32"", lookup_ch->ptr->id); -// mpm_ch = lookup_ch; -// } else { -// uint32_t ls = PatternStrength(lookup_ch->ptr->content,lookup_ch->ptr->content_len); -// uint32_t ss = PatternStrength(mpm_ch->ptr->content,mpm_ch->ptr->content_len); -// if (ls > ss) { -// SCLogDebug("lookup_ch->ptr->id %"PRIu32" selected over %"PRIu32"", lookup_ch->ptr->id, mpm_ch->ptr->id); -// mpm_ch = lookup_ch; -// } -// else if (ls == ss) { -// /* if 2 patterns are of equal strength, we pick the longest */ -// if (lookup_ch->ptr->content_len > mpm_ch->ptr->content_len) { -// SCLogDebug("lookup_ch->ptr->id %"PRIu32" selected over %"PRIu32" as the first is longer", -// lookup_ch->ptr->id, mpm_ch->ptr->id); -// mpm_ch = lookup_ch; -// } -// } else { -// SCLogDebug("sticking with mpm_ch"); -// } -// } -// -// ContentHashFree(ch); -// } -// -// /* now add the mpm_ch to the mpm ctx */ -// if (mpm_ch != NULL) { -// DetectContentData *co = mpm_ch->ptr; -// uint16_t offset = s->flags & SIG_FLAG_RECURSIVE ? 0 : co->offset; -// uint16_t depth = s->flags & SIG_FLAG_RECURSIVE ? 0 : co->depth; -// offset = mpm_ch->cnt ? 0 : offset; -// depth = mpm_ch->cnt ? 0 : depth; -// uint8_t flags = 0; -// char scan_negated = 0; -// -// /* see if our content is actually negated */ -// SigMatch *tmpsm = s->sm_lists[DETECT_SM_LIST_PMATCH]; -// for ( ; tmpsm != NULL; tmpsm = tmpsm->next) { -// if (tmpsm->type != DETECT_CONTENT) -// continue; -// -// DetectContentData *tmp = (DetectContentData *)tmpsm->ctx; -// if (tmp == NULL) -// continue; -// -// if (co->id == tmp->id) { -// if (tmp->flags & DETECT_CONTENT_NEGATED) { -// scan_negated = 1; -// } -// break; -// } -// } -// -// if (co->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { -// /* add the content to the "packet" mpm */ -// if (co->flags & DETECT_CONTENT_NOCASE) { -// mpm_table[sgh->mpm_ctx->mpm_type]. -// AddPatternNocase(sgh->mpm_ctx, -// co->content + co->fp_chop_offset, -// co->fp_chop_len, -// 0, 0, co->id, s->num, flags); -// } else { -// mpm_table[sgh->mpm_ctx->mpm_type]. -// AddPattern(sgh->mpm_ctx, -// co->content + co->fp_chop_offset, -// co->fp_chop_len, -// 0, 0, co->id, s->num, flags); -// } -// } else { -// if (co->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { -// co->avoid_double_check = 1; -// /* see if we can bypass the match validation for this pattern */ -// } else { -// if (!(co->flags & DETECT_CONTENT_RELATIVE_NEXT)) { -// SigMatch *tmp_sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; -// for ( ; tmp_sm != NULL; tmp_sm = tmp_sm->next) { -// if (tmp_sm->type != DETECT_CONTENT) -// continue; -// -// DetectContentData *tmp_co = (DetectContentData *)tmpsm->ctx; -// if (tmp_co == NULL) -// continue; -// -// if (co->id == tmp_co->id) -// break; -// } -// -// SigMatch *prev_sm = SigMatchGetLastSMFromLists(s, 2, -// DETECT_CONTENT, tmp_sm->prev); -// if (prev_sm != NULL) { -// DetectContentData *prev_co = (DetectContentData *)prev_sm->ctx; -// if (!(prev_co->flags & DETECT_CONTENT_RELATIVE_NEXT)) { -// co->avoid_double_check = 1; -// } -// } -// } -// } /* else - if (co->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) */ -// -// /* add the content to the "packet" mpm */ -// if (co->flags & DETECT_CONTENT_NOCASE) { -// mpm_table[sgh->mpm_ctx->mpm_type]. -// AddPatternNocase(sgh->mpm_ctx, -// co->content, co->content_len, -// offset, depth, co->id, s->num, flags); -// } else { -// mpm_table[sgh->mpm_ctx->mpm_type]. -// AddPattern(sgh->mpm_ctx, -// co->content, co->content_len, -// offset, depth, co->id, s->num, flags); -// } -// } /* else - if (co->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) */ -// -// /* tell matcher we are inspecting packet */ -// s->flags |= SIG_FLAG_MPM_PACKET; -// -// s->mpm_pattern_id_mod_8 = 1<<(co->id%8); -// s->mpm_pattern_id_div_8 = co->id/8; -// if (scan_negated) { -// SCLogDebug("flagging sig %"PRIu32" to be looking for negated mpm", s->id); -// s->flags |= SIG_FLAG_MPM_NEGCONTENT; -// } -// -// SCLogDebug("%"PRIu32" adding co->id %"PRIu32" to the mpm phase (s->num %"PRIu32")", s->id, co->id, s->num); -// } else { -// SCLogDebug("%"PRIu32" no mpm pattern selected", s->id); -// } -// } -// -// if (fast_pattern != NULL) -// SCFree(fast_pattern); -// -// HashTableFree(ht); -// return 0; -//error: -// if (fast_pattern != NULL) -// SCFree(fast_pattern); -// -// if (ht != NULL) -// HashTableFree(ht); -// return -1; -//} -// -///** \brief Setup the content portion of the sig group head */ -//static int PatternMatchPreprarePopulateMpmStream(DetectEngineCtx *de_ctx, SigGroupHead *sgh) { -// uint32_t sig; -// uint32_t *fast_pattern = NULL; -// -// fast_pattern = (uint32_t *)SCMalloc(sgh->sig_cnt * sizeof(uint32_t)); -// if (fast_pattern == NULL) -// return -1; -// memset(fast_pattern, 0, sgh->sig_cnt * sizeof(uint32_t)); -// -// HashTable *ht = HashTableInit(4096, ContentHashFunc, ContentHashCompareFunc, ContentHashFree); -// if (ht == NULL) { -// SCFree(fast_pattern); -// return -1; -// } -// -// /* add all the contents to a counting hash */ -// for (sig = 0; sig < sgh->sig_cnt; sig++) { -// Signature *s = sgh->match_array[sig]; -// if (s == NULL) -// continue; -// -// if (SignatureHasStreamContent(s) == 0) { -// continue; -// } -// -// int cnt = 0; -// SigMatch *sm; -// -// /* get the total no of patterns in this Signature, as well as find out -// * if we have a fast_pattern set in this Signature */ -// for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) { -// if (sm->type != DETECT_CONTENT) -// continue; -// -// DetectContentData *co = (DetectContentData *)sm->ctx; -// if (co == NULL) -// continue; -// -// cnt++; -// -// /* special handling of fast pattern keyword */ -// if (co->flags & DETECT_CONTENT_FAST_PATTERN) { -// fast_pattern[sig] = 1; -// SCLogDebug("sig %"PRIu32" has a fast pattern, id %"PRIu32"", s->id, co->id); -// -// ContentHash *ch = ContentHashAlloc(co); -// if (ch == NULL) -// goto error; -// -// ContentHash *lookup_ch = (ContentHash *)HashTableLookup(ht, ch, 0); -// if (lookup_ch == NULL) { -// if (HashTableAdd(ht, ch, 0) < 0) -// printf("Add hash failed\n"); -// } else { -// lookup_ch->cnt++; -// ContentHashFree(ch); -// } -// } -// } -// -// if (fast_pattern[sig] == 1) { -// continue; -// } -// -// for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) { -// if (sm->type != DETECT_CONTENT) -// continue; -// -// DetectContentData *co = (DetectContentData *)sm->ctx; -// if (co == NULL) -// continue; -// -// if (co->content_len < sgh->mpm_content_maxlen) { -// continue; -// } -// -// ContentHash *ch = ContentHashAlloc(co); -// if (ch == NULL) -// goto error; -// -// if (cnt == 1) { -// SCLogDebug("sig has just one pattern, so we know we will " -// "use it in the mpm phase."); -// ch->use = 1; -// } -// -// ContentHash *lookup_ch = (ContentHash *)HashTableLookup(ht, ch, 0); -// if (lookup_ch == NULL) { -// int r = HashTableAdd(ht, ch, 0); -// if (r < 0) -// printf("Add hash failed\n"); -// } else { -// lookup_ch->use = ch->use; -// -// lookup_ch->cnt++; -// ContentHashFree(ch); -// } -// } -// } -// -// /* now determine which one to add to the mpm phase */ -// for (sig = 0; sig < sgh->sig_cnt; sig++) { -// Signature *s = sgh->match_array[sig]; -// if (s == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) -// continue; -// -// if (SignatureHasStreamContent(s) == 0) { -// continue; -// } -// -// ContentHash *mpm_ch = NULL; -// SigMatch *sm = NULL; -// -// for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) { -// if (sm->type != DETECT_CONTENT) -// continue; -// -// DetectContentData *co = (DetectContentData *)sm->ctx; -// if (co == NULL) -// continue; -// -// /* skip in case of: -// * 1. we expect a fastpattern but this isn't it -// * 2. we have a smaller content than mpm_content_maxlen */ -// if (fast_pattern[sig] == 1) { -// if (!(co->flags & DETECT_CONTENT_FAST_PATTERN)) { -// SCLogDebug("not a fast pattern %"PRIu32"", co->id); -// continue; -// } -// SCLogDebug("fast pattern %"PRIu32"", co->id); -// } else if (co->content_len < sgh->mpm_streamcontent_maxlen) { -// continue; -// } -// -// ContentHash *ch = ContentHashAlloc(co); -// if (ch == NULL) -// goto error; -// -// ContentHash *lookup_ch = (ContentHash *)HashTableLookup(ht, ch, 0); -// if (lookup_ch == NULL) { -// continue; -// } -// -// SCLogDebug("lookup_ch->use %u, cnt %u", lookup_ch->use, lookup_ch->cnt); -// -// if (mpm_ch == NULL) { -// SCLogDebug("mpm_ch == NULL, so selecting lookup_ch->ptr->id %"PRIu32"", lookup_ch->ptr->id); -// mpm_ch = lookup_ch; -// } else { -// uint32_t ls = PatternStrength(lookup_ch->ptr->content,lookup_ch->ptr->content_len); -// uint32_t ss = PatternStrength(mpm_ch->ptr->content,mpm_ch->ptr->content_len); -// if (ls > ss) { -// SCLogDebug("lookup_ch->ptr->id %"PRIu32" selected over %"PRIu32"", lookup_ch->ptr->id, mpm_ch->ptr->id); -// mpm_ch = lookup_ch; -// } -// else if (ls == ss) { -// /* if 2 patterns are of equal strength, we pick the longest */ -// if (lookup_ch->ptr->content_len > mpm_ch->ptr->content_len) { -// SCLogDebug("lookup_ch->ptr->id %"PRIu32" selected over %"PRIu32" as the first is longer", -// lookup_ch->ptr->id, mpm_ch->ptr->id); -// mpm_ch = lookup_ch; -// } -// } else { -// SCLogDebug("sticking with mpm_ch"); -// } -// } -// -// ContentHashFree(ch); -// } -// -// /* now add the mpm_ch to the mpm ctx */ -// if (mpm_ch != NULL) { -// DetectContentData *co = mpm_ch->ptr; -// uint16_t offset = s->flags & SIG_FLAG_RECURSIVE ? 0 : co->offset; -// uint16_t depth = s->flags & SIG_FLAG_RECURSIVE ? 0 : co->depth; -// offset = mpm_ch->cnt ? 0 : offset; -// depth = mpm_ch->cnt ? 0 : depth; -// uint8_t flags = 0; -// char scan_negated = 0; -// -// /* see if our content is actually negated */ -// SigMatch *tmpsm = s->sm_lists[DETECT_SM_LIST_PMATCH]; -// for ( ; tmpsm != NULL; tmpsm = tmpsm->next) { -// if (tmpsm->type != DETECT_CONTENT) -// continue; -// -// DetectContentData *tmp = (DetectContentData *)tmpsm->ctx; -// if (tmp == NULL) -// continue; -// -// if (co->id == tmp->id) { -// if (tmp->flags & DETECT_CONTENT_NEGATED) { -// scan_negated = 1; -// } -// break; -// } -// } -// -// SCLogDebug("mpm_stream_ctx %p", sgh->mpm_stream_ctx); -// /* add the content to the "stream" mpm */ -// if (co->flags & DETECT_CONTENT_NOCASE) { -// mpm_table[sgh->mpm_stream_ctx->mpm_type].AddPatternNocase(sgh->mpm_stream_ctx, -// co->content, co->content_len, offset, depth, co->id, s->num, flags); -// } else { -// mpm_table[sgh->mpm_stream_ctx->mpm_type].AddPattern(sgh->mpm_stream_ctx, -// co->content, co->content_len, offset, depth, co->id, s->num, flags); -// } -// -// /* tell matcher we are inspecting stream */ -// s->flags |= SIG_FLAG_MPM_STREAM; -// -// s->mpm_stream_pattern_id_div_8 = co->id/8; -// s->mpm_stream_pattern_id_mod_8 = 1<<(co->id%8); -// if (scan_negated) { -// SCLogDebug("flagging sig %"PRIu32" to be looking for negated mpm", s->id); -// s->flags |= SIG_FLAG_MPM_NEGCONTENT; -// } -// -// SCLogDebug("%"PRIu32" adding co->id %"PRIu32" to the mpm phase (s->num %"PRIu32")", s->id, co->id, s->num); -// } else { -// SCLogDebug("%"PRIu32" no mpm pattern selected", s->id); -// } -// } -// -// if (fast_pattern != NULL) -// SCFree(fast_pattern); -// -// HashTableFree(ht); -// return 0; -//error: -// if (fast_pattern != NULL) -// SCFree(fast_pattern); -// -// if (ht != NULL) -// HashTableFree(ht); -// return -1; -//} -// -///** \brief Setup the content portion of the sig group head */ -//static int PatternMatchPreprarePopulateMpmUri(DetectEngineCtx *de_ctx, SigGroupHead *sgh) { -// uint32_t sig; -//#if 0 -// uint32_t *fast_pattern = NULL; -// fast_pattern = (uint32_t *)SCMalloc(sgh->sig_cnt * sizeof(uint32_t)); -// if (fast_pattern == NULL) -// return -1; -// memset(fast_pattern, 0, sgh->sig_cnt * sizeof(uint32_t)); -//#endif -// HashTable *ht = HashTableInit(4096, UricontentHashFunc, UricontentHashCompareFunc, UricontentHashFree); -// if (ht == NULL) { -//#if 0 -// SCFree(fast_pattern); -//#endif -// return -1; -// } -// -// /* add all the contents to a counting hash */ -// for (sig = 0; sig < sgh->sig_cnt; sig++) { -// Signature *s = sgh->match_array[sig]; -// if (s == NULL) -// continue; -// -// int cnt = 0; -// SigMatch *sm; -// -// /* get the total no of patterns in this Signature, as well as find out -// * if we have a fast_pattern set in this Signature */ -// for (sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) { -// if (sm->type != DETECT_URICONTENT) -// continue; -// -// DetectContentData *ud = (DetectContentData *)sm->ctx; -// if (ud == NULL) -// continue; -// -// cnt++; -//#if 0 -// /* special handling of fast pattern keyword */ -// if (co->flags & DETECT_CONTENT_FAST_PATTERN) { -// fast_pattern[sig] = 1; -// SCLogDebug("sig %"PRIu32" has a fast pattern, id %"PRIu32"", s->id, co->id); -// -// ContentHash *ch = ContentHashAlloc(co); -// if (ch == NULL) -// goto error; -// -// ContentHash *lookup_ch = (ContentHash *)HashTableLookup(ht, ch, 0); -// if (lookup_ch == NULL) { -// if (HashTableAdd(ht, ch, 0) < 0) -// printf("Add hash failed\n"); -// } else { -// lookup_ch->cnt++; -// ContentHashFree(ch); -// } -// } -//#endif -// } -//#if 0 -// if (fast_pattern[sig] == 1) { -// continue; -// } -//#endif -// for (sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) { -// if (sm->type != DETECT_URICONTENT) -// continue; -// -// DetectContentData *ud = (DetectContentData *)sm->ctx; -// if (ud == NULL) -// continue; -// -// if (ud->content_len < sgh->mpm_uricontent_maxlen) { -// continue; -// } -// -// UricontentHash *ch = UricontentHashAlloc(ud); -// if (ch == NULL) -// goto error; -// -// if (cnt == 1) { -// SCLogDebug("sig has just one pattern, so we know we will " -// "use it in the mpm phase."); -// ch->use = 1; -// } -// -// UricontentHash *lookup_ch = (UricontentHash *)HashTableLookup(ht, ch, 0); -// if (lookup_ch == NULL) { -// int r = HashTableAdd(ht, ch, 0); -// if (r < 0) -// printf("Add hash failed\n"); -// } else { -// lookup_ch->use = ch->use; -// -// lookup_ch->cnt++; -// UricontentHashFree(ch); -// } -// } -// } -// -// /* now determine which one to add to the mpm phase */ -// for (sig = 0; sig < sgh->sig_cnt; sig++) { -// Signature *s = sgh->match_array[sig]; -// if (s == NULL || s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) -// continue; -// -// UricontentHash *mpm_ch = NULL; -// SigMatch *sm = NULL; -// -// for (sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) { -// if (sm->type != DETECT_URICONTENT) -// continue; -// -// DetectContentData *ud = (DetectContentData *)sm->ctx; -// if (ud == NULL) -// continue; -// -// /* skip in case of: -// * 1. we expect a fastpattern but this isn't it -// * 2. we have a smaller content than mpm_content_maxlen */ -//#if 0 -// if (fast_pattern[sig] == 1) { -// if (!(co->flags & DETECT_CONTENT_FAST_PATTERN)) { -// SCLogDebug("not a fast pattern %"PRIu32"", co->id); -// continue; -// } -// SCLogDebug("fast pattern %"PRIu32"", co->id); -// -// } else -//#endif -// if (ud->content_len < sgh->mpm_uricontent_maxlen) { -// continue; -// } -// -// UricontentHash *ch = UricontentHashAlloc(ud); -// if (ch == NULL) -// goto error; -// -// UricontentHash *lookup_ch = (UricontentHash *)HashTableLookup(ht, ch, 0); -// if (lookup_ch == NULL) { -// continue; -// } -// -// SCLogDebug("lookup_ch->use %u, cnt %u", lookup_ch->use, lookup_ch->cnt); -// -// if (mpm_ch == NULL) { -// SCLogDebug("mpm_ch == NULL, so selecting lookup_ch->ptr->id %"PRIu32"", lookup_ch->ptr->id); -// mpm_ch = lookup_ch; -// } else { -// uint32_t ls = PatternStrength(lookup_ch->ptr->content,lookup_ch->ptr->content_len); -// uint32_t ss = PatternStrength(mpm_ch->ptr->content,mpm_ch->ptr->content_len); -// if (ls > ss) { -// SCLogDebug("lookup_ch->ptr->id %"PRIu32" selected over %"PRIu32"", lookup_ch->ptr->id, mpm_ch->ptr->id); -// mpm_ch = lookup_ch; -// } -// else if (ls == ss) { -// /* if 2 patterns are of equal strength, we pick the longest */ -// if (lookup_ch->ptr->content_len > mpm_ch->ptr->content_len) { -// SCLogDebug("lookup_ch->ptr->id %"PRIu32" selected over %"PRIu32" as the first is longer", -// lookup_ch->ptr->id, mpm_ch->ptr->id); -// mpm_ch = lookup_ch; -// } -// } else { -// SCLogDebug("sticking with mpm_ch"); -// } -// } -// -// UricontentHashFree(ch); -// } -// -// /* now add the mpm_ch to the mpm ctx */ -// if (mpm_ch != NULL) { -// DetectContentData *ud = mpm_ch->ptr; -// uint8_t flags = 0; -//#if 0 -// /* see if our content is actually negated */ -// SigMatch *tmpsm = s->sm_lists[DETECT_SM_LIST_PMATCH]; -// for ( ; tmpsm != NULL; tmpsm = tmpsm->next) { -// if (tmpsm->type != DETECT_CONTENT) -// continue; -// -// DetectContentData *tmp = (DetectContentData *)tmpsm->ctx; -// if (tmp == NULL) -// continue; -// -// if (co->id == tmp->id) { -// if (tmp->flags & DETECT_CONTENT_NEGATED) { -// scan_negated = 1; -// } -// break; -// } -// } -//#endif -// /* add the content to the "packet" mpm */ -// if (ud->flags & DETECT_CONTENT_NOCASE) { -// mpm_table[sgh->mpm_uri_ctx->mpm_type].AddPatternNocase(sgh->mpm_uri_ctx, -// ud->content, ud->content_len, 0, 0, ud->id, s->num, flags); -// } else { -// mpm_table[sgh->mpm_uri_ctx->mpm_type].AddPattern(sgh->mpm_uri_ctx, -// ud->content, ud->content_len, 0, 0, ud->id, -// s->num, flags); -// } -// -// s->mpm_uripattern_id = ud->id; -// -// SCLogDebug("%"PRIu32" adding ud->id %"PRIu32" to the mpm phase (s->num %"PRIu32")", s->id, ud->id, s->num); -// } else { -// SCLogDebug("%"PRIu32" no mpm pattern selected", s->id); -// } -// } -// -//#if 0 -// if (fast_pattern != NULL) -// SCFree(fast_pattern); -//#endif -// HashTableFree(ht); -// return 0; -//error: -//#if 0 -// if (fast_pattern != NULL) -// SCFree(fast_pattern); -//#endif -// if (ht != NULL) -// HashTableFree(ht); -// return -1; -//} - /** \brief Prepare the pattern matcher ctx in a sig group head. * * \todo determine if a content match can set the 'single' flag @@ -2033,15 +1273,6 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh) //uint32_t cnt = 0; uint32_t sig = 0; - //if (!(sh->flags & SIG_GROUP_HEAD_MPM_COPY)) - // sh->mpm_content_maxlen = 0; - // - //if (!(sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY)) - // sh->mpm_uricontent_maxlen = 0; - // - //if (!(sh->flags & SIG_GROUP_HEAD_MPM_STREAM_COPY)) - // sh->mpm_streamcontent_maxlen = 0; - /* see if this head has content and/or uricontent */ for (sig = 0; sig < sh->sig_cnt; sig++) { s = sh->match_array[sig]; @@ -2203,135 +1434,6 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh) #endif } - /* for each signature in this group do */ - //for (sig = 0; sig < sh->sig_cnt; sig++) { - // s = sh->match_array[sig]; - // if (s == NULL) - // continue; - // - // cnt++; - // - // char content_added = 0; - // char uricontent_added = 0; - // char stream_content_added = 0; - // uint16_t content_maxlen = 0, stream_content_maxlen = 0; - // uint16_t content_minlen = 0, stream_content_minlen = 0; - // uint16_t uricontent_maxlen = 0; - // uint16_t uricontent_minlen = 0; - // - // SigMatch *sm; - // - // /* determine the length of the longest pattern */ - // if (sh->flags & SIG_GROUP_HAVECONTENT && - // !(sh->flags & SIG_GROUP_HEAD_MPM_COPY)) - // { - // if (SignatureHasPacketContent(s) == 1) { - // for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) { - // if (sm->type != DETECT_CONTENT) - // continue; - // - // DetectContentData *cd = (DetectContentData *)sm->ctx; - // if (cd == NULL) - // continue; - // - // if (cd->content_len > content_maxlen) - // content_maxlen = cd->content_len; - // - // if (content_minlen == 0) - // content_minlen = cd->content_len; - // else if (cd->content_len < content_minlen) - // content_minlen = cd->content_len; - // - // if (!content_added) { - // content_added = 1; - // } - // } - // - // if (content_added > 0) { - // if (sh->mpm_content_maxlen == 0) - // sh->mpm_content_maxlen = content_maxlen; - // if (sh->mpm_content_maxlen > content_maxlen) { - // SCLogDebug("sgh (%p) sh->mpm_content_maxlen %u set to %u", - // sh, sh->mpm_content_maxlen, content_maxlen); - // - // sh->mpm_content_maxlen = content_maxlen; - // } - // } - // } - // } - // - // if (sh->flags & SIG_GROUP_HAVESTREAMCONTENT && - // !(sh->flags & SIG_GROUP_HEAD_MPM_STREAM_COPY)) - // { - // if (SignatureHasStreamContent(s) == 1) { - // for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) { - // if (sm->type != DETECT_CONTENT) - // continue; - // - // DetectContentData *cd = (DetectContentData *)sm->ctx; - // if (cd == NULL) - // continue; - // - // if (cd->content_len > stream_content_maxlen) - // stream_content_maxlen = cd->content_len; - // - // if (stream_content_minlen == 0) - // stream_content_minlen = cd->content_len; - // else if (cd->content_len < stream_content_minlen) - // stream_content_minlen = cd->content_len; - // - // if (!stream_content_added) { - // stream_content_added = 1; - // } - // } - // - // if (stream_content_added > 0) { - // if (sh->mpm_streamcontent_maxlen == 0) - // sh->mpm_streamcontent_maxlen = stream_content_maxlen; - // if (sh->mpm_streamcontent_maxlen > stream_content_maxlen) { - // SCLogDebug("sgh (%p) sh->mpm_streamcontent_maxlen %u set to %u", - // sh, sh->mpm_streamcontent_maxlen, stream_content_maxlen); - // - // sh->mpm_streamcontent_maxlen = stream_content_maxlen; - // } - // } - // } - // } - // - // if (sh->flags & SIG_GROUP_HAVEURICONTENT && - // !(sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY)) - // { - // /* determine the length of the longest pattern */ - // for (sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) { - // if (sm->type != DETECT_URICONTENT) - // continue; - // - // DetectContentData *ud = (DetectContentData *)sm->ctx; - // if (ud == NULL) - // continue; - // - // if (ud->content_len > uricontent_maxlen) - // uricontent_maxlen = ud->content_len; - // - // if (uricontent_minlen == 0) - // uricontent_minlen = ud->content_len; - // else if (ud->content_len < uricontent_minlen) - // uricontent_minlen = ud->content_len; - // - // if (!uricontent_added) { - // uricontent_added = 1; - // } - // } - // - // if (uricontent_added) { - // if (sh->mpm_uricontent_maxlen == 0) - // sh->mpm_uricontent_maxlen = uricontent_maxlen; - // if (sh->mpm_uricontent_maxlen > uricontent_maxlen) - // sh->mpm_uricontent_maxlen = uricontent_maxlen; - // } - // } - //} - if (sh->flags & SIG_GROUP_HAVECONTENT || sh->flags & SIG_GROUP_HAVESTREAMCONTENT || sh->flags & SIG_GROUP_HAVEURICONTENT || @@ -2425,46 +1527,8 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh) sh->mpm_hrhd_ctx = NULL; } - ///* uricontent */ - //if (sh->flags & SIG_GROUP_HAVEURICONTENT && !(sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY)) { - // PatternMatchPreprarePopulateMpmUri(de_ctx, sh); - // - // if (mpm_table[sh->mpm_uri_ctx->mpm_type].Prepare != NULL) { - // if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) { - // mpm_table[sh->mpm_uri_ctx->mpm_type].Prepare(sh->mpm_uri_ctx); - // } - // } - // - // //sh->mpm_uri_ctx->PrintCtx(sh->mpm_uri_ctx); - // - //} - // - ///* content */ - //if (sh->flags & SIG_GROUP_HAVECONTENT && !(sh->flags & SIG_GROUP_HEAD_MPM_COPY)) { - // PatternMatchPreprarePopulateMpmPacket(de_ctx, sh); - // - // if (mpm_table[sh->mpm_ctx->mpm_type].Prepare != NULL) { - // if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) { - // mpm_table[sh->mpm_ctx->mpm_type].Prepare(sh->mpm_ctx); - // } - // } - //} - // - ///* stream content */ - //if (sh->flags & SIG_GROUP_HAVESTREAMCONTENT && !(sh->flags & SIG_GROUP_HEAD_MPM_STREAM_COPY)) { - // PatternMatchPreprarePopulateMpmStream(de_ctx, sh); - // SCLogDebug("preparing mpm_stream_ctx %p", sh->mpm_stream_ctx); - // if (mpm_table[sh->mpm_stream_ctx->mpm_type].Prepare != NULL) { - // if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) { - // mpm_table[sh->mpm_stream_ctx->mpm_type].Prepare(sh->mpm_stream_ctx); - // } - // } - //} return 0; - //error: - /* XXX */ - //return -1; } /** \brief Pattern ID Hash for sharing pattern id's diff --git a/src/detect-http-client-body.c b/src/detect-http-client-body.c index f98b098324..7a8dec3640 100644 --- a/src/detect-http-client-body.c +++ b/src/detect-http-client-body.c @@ -51,9 +51,6 @@ #include "detect-http-client-body.h" #include "stream-tcp.h" -int DetectHttpClientBodyMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, - Flow *f, uint8_t flags, void *state, Signature *s, - SigMatch *m); int DetectHttpClientBodySetup(DetectEngineCtx *, Signature *, char *); void DetectHttpClientBodyRegisterTests(void); void DetectHttpClientBodyFree(void *); @@ -74,105 +71,6 @@ void DetectHttpClientBodyRegister(void) sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].flags |= SIGMATCH_PAYLOAD ; } -/** - * \brief App layer match function for the "http_client_body" keyword. - * - * \param t Pointer to the ThreadVars instance. - * \param det_ctx Pointer to the DetectEngineThreadCtx. - * \param f Pointer to the flow. - * \param flags Pointer to the flags indicating the flow direction. - * \param state Pointer to the app layer state data. - * \param s Pointer to the Signature instance. - * \param m Pointer to the SigMatch. - * - * \retval 1 On Match. - * \retval 0 On no match. - */ -int DetectHttpClientBodyMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, - Flow *f, uint8_t flags, void *state, Signature *s, - SigMatch *m) -{ - int result = 0; - DetectContentData *hcbd = (DetectContentData *)m->ctx; - HtpState *htp_state = (HtpState *)state; - - SCMutexLock(&f->m); - - if (htp_state == NULL) { - SCLogDebug("No htp state, no match at http body data"); - goto end; - } - - htp_tx_t *tx = NULL; - size_t idx = 0; - - for (idx = 0;//hs->new_in_tx_index; - idx < list_size(htp_state->connp->conn->transactions); idx++) - { - tx = list_get(htp_state->connp->conn->transactions, idx); - if (tx == NULL) - continue; - - SCHtpTxUserData *htud = (SCHtpTxUserData *) htp_tx_get_user_data(tx); - if (htud == NULL) - continue; - - HtpBodyChunk *cur = htud->body.first; - - if (htud->body.nchunks == 0) { - SCLogDebug("No http chunks to inspect"); - goto end; - } else { - /* no chunks?!! get out of here */ - if (cur == NULL) { - SCLogDebug("No http chunks to inspect"); - goto end; - } - - /* this applies only for the client request body like the keyword name says */ - if (htud->body.operation != HTP_BODY_REQUEST) { - SCLogDebug("htp chunk not a request chunk"); - goto end; - } - - /* this is not how we do it now. We can rather hold the PM state from - * the previous chunk that was matched, and continue right from where - * we left off. We need to devise a scheme to do that, not just for - * this keyword, but other keywords need it as well */ - uint8_t *chunks_buffer = NULL; - uint32_t total_chunks_len = 0; - /* club all the chunks into one whole buffer and call the SPM on the buffer */ - while (cur != NULL) { - total_chunks_len += cur->len; - if ( (chunks_buffer = SCRealloc(chunks_buffer, total_chunks_len)) == NULL) { - return 0; - } - memcpy(chunks_buffer + total_chunks_len - cur->len, cur->data, cur->len); - cur = cur->next; - } - /* call the case insensitive version if nocase has been specified in the sig */ - if (hcbd->flags & DETECT_CONTENT_NOCASE) { - result = (BoyerMooreNocase(hcbd->content, hcbd->content_len, chunks_buffer, - total_chunks_len, hcbd->bm_ctx->bmGs, - hcbd->bm_ctx->bmBc) != NULL); - /* call the case sensitive version if nocase has been specified in the sig */ - } else { - result = (BoyerMoore(hcbd->content, hcbd->content_len, chunks_buffer, - total_chunks_len, hcbd->bm_ctx->bmGs, - hcbd->bm_ctx->bmBc) != NULL); - } - SCFree(chunks_buffer); - } - } - - SCMutexUnlock(&f->m); - return result ^ ((hcbd->flags & DETECT_CONTENT_NEGATED) ? 1 : 0); - - end: - SCMutexUnlock(&f->m); - return result; -} - /** * \brief The setup function for the http_client_body keyword for a signature. * diff --git a/src/detect.c b/src/detect.c index 705161789c..ffab3cb3d2 100644 --- a/src/detect.c +++ b/src/detect.c @@ -187,39 +187,6 @@ void DetectExitPrintStats(ThreadVars *tv, void *data) { DetectEngineThreadCtx *det_ctx = (DetectEngineThreadCtx *)data; if (det_ctx == NULL) return; -#if 0 - SCLogInfo("(%s) (1byte) Pkts %" PRIu32 ", Searched %" PRIu32 " (%02.1f).", - tv->name, det_ctx->pkts, det_ctx->pkts_searched1, - (float)(det_ctx->pkts_searched1/(float)(det_ctx->pkts)*100)); - SCLogInfo("(%s) (2byte) Pkts %" PRIu32 ", Searched %" PRIu32 " (%02.1f).", - tv->name, det_ctx->pkts, det_ctx->pkts_searched2, - (float)(det_ctx->pkts_searched2/(float)(det_ctx->pkts)*100)); - SCLogInfo("(%s) (3byte) Pkts %" PRIu32 ", Searched %" PRIu32 " (%02.1f).", - tv->name, det_ctx->pkts, det_ctx->pkts_searched3, - (float)(det_ctx->pkts_searched3/(float)(det_ctx->pkts)*100)); - SCLogInfo("(%s) (4byte) Pkts %" PRIu32 ", Searched %" PRIu32 " (%02.1f).", - tv->name, det_ctx->pkts, det_ctx->pkts_searched4, - (float)(det_ctx->pkts_searched4/(float)(det_ctx->pkts)*100)); - SCLogInfo("(%s) (+byte) Pkts %" PRIu32 ", Searched %" PRIu32 " (%02.1f).", - tv->name, det_ctx->pkts, det_ctx->pkts_searched, - (float)(det_ctx->pkts_searched/(float)(det_ctx->pkts)*100)); - - SCLogInfo("(%s) URI (1byte) Uri's %" PRIu32 ", Searched %" PRIu32 " (%02.1f).", - tv->name, det_ctx->uris, det_ctx->pkts_uri_searched1, - (float)(det_ctx->pkts_uri_searched1/(float)(det_ctx->uris)*100)); - SCLogInfo("(%s) URI (2byte) Uri's %" PRIu32 ", Searched %" PRIu32 " (%02.1f).", - tv->name, det_ctx->uris, det_ctx->pkts_uri_searched2, - (float)(det_ctx->pkts_uri_searched2/(float)(det_ctx->uris)*100)); - SCLogInfo("(%s) URI (3byte) Uri's %" PRIu32 ", Searched %" PRIu32 " (%02.1f).", - tv->name, det_ctx->uris, det_ctx->pkts_uri_searched3, - (float)(det_ctx->pkts_uri_searched3/(float)(det_ctx->uris)*100)); - SCLogInfo("(%s) URI (4byte) Uri's %" PRIu32 ", Searched %" PRIu32 " (%02.1f).", - tv->name, det_ctx->uris, det_ctx->pkts_uri_searched4, - (float)(det_ctx->pkts_uri_searched4/(float)(det_ctx->uris)*100)); - SCLogInfo("(%s) URI (+byte) Uri's %" PRIu32 ", Searched %" PRIu32 " (%02.1f).", - tv->name, det_ctx->uris, det_ctx->pkts_uri_searched, - (float)(det_ctx->pkts_uri_searched/(float)(det_ctx->uris)*100)); -#endif } /** \brief Create the path if default-rule-path was specified @@ -2815,65 +2782,6 @@ int BuildDestinationAddressHeads(DetectEngineCtx *de_ctx, DetectAddressHead *hea SigGroupHeadSetSigCnt(sgr->sh, max_idx); SigGroupHeadBuildMatchArray(de_ctx, sgr->sh, max_idx); - /* content */ - //SigGroupHeadLoadContent(de_ctx, sgr->sh); - //if (sgr->sh->init->content_size == 0) { - // de_ctx->mpm_none++; - //} else { - // /* now have a look if we can reuse a mpm ctx */ - // SigGroupHead *mpmsh = SigGroupHeadMpmHashLookup(de_ctx, sgr->sh); - // if (mpmsh == NULL) { - // SigGroupHeadMpmHashAdd(de_ctx, sgr->sh); - // - // de_ctx->mpm_unique++; - // } else { - // sgr->sh->mpm_ctx = mpmsh->mpm_ctx; - // sgr->sh->flags |= SIG_GROUP_HEAD_MPM_COPY; - // SigGroupHeadClearContent(sgr->sh); - // - // de_ctx->mpm_reuse++; - // } - //} - // - ///* content */ - //SigGroupHeadLoadStreamContent(de_ctx, sgr->sh); - //if (sgr->sh->init->stream_content_size == 0) { - // de_ctx->mpm_none++; - //} else { - // /* now have a look if we can reuse a mpm ctx */ - // SigGroupHead *mpmsh = SigGroupHeadMpmStreamHashLookup(de_ctx, sgr->sh); - // if (mpmsh == NULL) { - // SigGroupHeadMpmStreamHashAdd(de_ctx, sgr->sh); - // - // de_ctx->mpm_unique++; - // } else { - // sgr->sh->mpm_stream_ctx = mpmsh->mpm_stream_ctx; - // sgr->sh->flags |= SIG_GROUP_HEAD_MPM_STREAM_COPY; - // SigGroupHeadClearStreamContent(sgr->sh); - // - // de_ctx->mpm_reuse++; - // } - //} - // - ///* uricontent */ - //SigGroupHeadLoadUricontent(de_ctx, sgr->sh); - //if (sgr->sh->init->uri_content_size == 0) { - // de_ctx->mpm_uri_none++; - //} else { - // /* now have a look if we can reuse a uri mpm ctx */ - // SigGroupHead *mpmsh = SigGroupHeadMpmUriHashLookup(de_ctx, sgr->sh); - // if (mpmsh == NULL) { - // SigGroupHeadMpmUriHashAdd(de_ctx, sgr->sh); - // de_ctx->mpm_uri_unique++; - // } else { - // sgr->sh->mpm_uri_ctx = mpmsh->mpm_uri_ctx; - // sgr->sh->flags |= SIG_GROUP_HEAD_MPM_URI_COPY; - // SigGroupHeadClearUricontent(sgr->sh); - // - // de_ctx->mpm_uri_reuse++; - // } - //} - /* init the pattern matcher, this will respect the copy * setting */ if (PatternMatchPrepareGroup(de_ctx, sgr->sh) < 0) { @@ -3125,67 +3033,6 @@ int BuildDestinationAddressHeadsWithBothPorts(DetectEngineCtx *de_ctx, DetectAdd SigGroupHeadSetSigCnt(dp->sh, max_idx); SigGroupHeadBuildMatchArray(de_ctx,dp->sh, max_idx); - //SigGroupHeadLoadContent(de_ctx, dp->sh); - //if (dp->sh->init->content_size == 0) { - // de_ctx->mpm_none++; - //} else { - // /* now have a look if we can reuse a mpm ctx */ - // SigGroupHead *mpmsh = SigGroupHeadMpmHashLookup(de_ctx, dp->sh); - // if (mpmsh == NULL) { - // SigGroupHeadMpmHashAdd(de_ctx, dp->sh); - // - // de_ctx->mpm_unique++; - // } else { - // /* XXX write dedicated function for this */ - // dp->sh->mpm_ctx = mpmsh->mpm_ctx; - // //SCLogDebug("replacing dp->sh, so setting mpm_content_maxlen to %u (was %u)", mpmsh->mpm_content_maxlen, dp->sh->mpm_content_maxlen); - // //dp->sh->mpm_content_maxlen = mpmsh->mpm_content_maxlen; - // dp->sh->flags |= SIG_GROUP_HEAD_MPM_COPY; - // SigGroupHeadClearContent(dp->sh); - // - // de_ctx->mpm_reuse++; - // } - //} - // - ///* content */ - //SigGroupHeadLoadStreamContent(de_ctx, dp->sh); - //if (dp->sh->init->stream_content_size == 0) { - // de_ctx->mpm_none++; - //} else { - // /* now have a look if we can reuse a mpm ctx */ - // SigGroupHead *mpmsh = SigGroupHeadMpmStreamHashLookup(de_ctx, dp->sh); - // if (mpmsh == NULL) { - // SigGroupHeadMpmStreamHashAdd(de_ctx, dp->sh); - // - // de_ctx->mpm_unique++; - // } else { - // SCLogDebug("replacing mpm_stream_ctx %p by %p", dp->sh->mpm_stream_ctx, mpmsh->mpm_stream_ctx); - // dp->sh->mpm_stream_ctx = mpmsh->mpm_stream_ctx; - // dp->sh->flags |= SIG_GROUP_HEAD_MPM_STREAM_COPY; - // SigGroupHeadClearStreamContent(dp->sh); - // - // de_ctx->mpm_reuse++; - // } - //} - // - //SigGroupHeadLoadUricontent(de_ctx, dp->sh); - //if (dp->sh->init->uri_content_size == 0) { - // de_ctx->mpm_uri_none++; - //} else { - // /* now have a look if we can reuse a uri mpm ctx */ - // SigGroupHead *mpmsh = SigGroupHeadMpmUriHashLookup(de_ctx, dp->sh); - // if (mpmsh == NULL) { - // SigGroupHeadMpmUriHashAdd(de_ctx, dp->sh); - // - // de_ctx->mpm_uri_unique++; - // } else { - // dp->sh->mpm_uri_ctx = mpmsh->mpm_uri_ctx; - // dp->sh->flags |= SIG_GROUP_HEAD_MPM_URI_COPY; - // SigGroupHeadClearUricontent(dp->sh); - // - // de_ctx->mpm_uri_reuse++; - // } - //} /* init the pattern matcher, this will respect the copy * setting */ if (PatternMatchPrepareGroup(de_ctx, dp->sh) < 0) {