aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove all references to the scan phase from the pattern matchers and it's api.

Browse Source
remotes/origin/master-1.0.x
Victor Julien 16 years ago
parent dd846c9b0e
commit 1e01fd613c
10 changed files with 1192 additions and 1202 deletions
Show Stats Download Patch File Download Diff File

8
src/app-layer-detect-proto.c
Unescape Escape View File

@ -126,7 +126,7 @@ void AlpProtoAdd(AlpProtoDetectCtx *ctx, uint16_t ip_proto, uint16_t al_proto, c
dir = &ctx->toserver;
}
mpm_table[dir->mpm_ctx.mpm_type].AddScanPattern(&dir->mpm_ctx, cd->content, cd->content_len,
mpm_table[dir->mpm_ctx.mpm_type].AddPattern(&dir->mpm_ctx, cd->content, cd->content_len,
cd->offset, cd->depth, dir->id, dir->id, 0);
dir->map[dir->id] = al_proto;
dir->id++;
@ -301,7 +301,7 @@ uint16_t AppLayerDetectGetProto(AlpProtoDetectCtx *ctx, AlpProtoDetectThreadCtx
uint16_t proto = ALPROTO_UNKNOWN;
uint32_t cnt = 0;
#ifndef __SC_CUDA_SUPPORT__
cnt = mpm_table[dir->mpm_ctx.mpm_type].Scan(&dir->mpm_ctx,
cnt = mpm_table[dir->mpm_ctx.mpm_type].Search(&dir->mpm_ctx,
&tdir->mpm_ctx,
&tdir->pmq, buf,
scanlen);
@ -666,7 +666,7 @@ int AlpDetectTest03(void) {
}
#endif
uint32_t cnt = mpm_table[ctx.toclient.mpm_ctx.mpm_type].Scan(&ctx.toclient.mpm_ctx, &tctx.toclient.mpm_ctx, NULL, l7data, sizeof(l7data));
uint32_t cnt = mpm_table[ctx.toclient.mpm_ctx.mpm_type].Search(&ctx.toclient.mpm_ctx, &tctx.toclient.mpm_ctx, NULL, l7data, sizeof(l7data));
if (cnt != 1) {
printf("cnt %u != 1: ", cnt);
r = 0;
@ -723,7 +723,7 @@ int AlpDetectTest04(void) {
}
#endif
uint32_t cnt = mpm_table[ctx.toclient.mpm_ctx.mpm_type].Scan(&ctx.toclient.mpm_ctx, &tctx.toclient.mpm_ctx, NULL, l7data, sizeof(l7data));
uint32_t cnt = mpm_table[ctx.toclient.mpm_ctx.mpm_type].Search(&ctx.toclient.mpm_ctx, &tctx.toclient.mpm_ctx, NULL, l7data, sizeof(l7data));
if (cnt != 0) {
printf("cnt %u != 0: ", cnt);
r = 0;

6
src/detect-content.c
Unescape Escape View File

@ -1088,6 +1088,8 @@ static uint32_t DetectContentTableHash(HashTable *ht, void *p, uint16_t len) {
}
static void DetectContentTableElmtFree(void *e) {
DetectContentTableElmt *c = (DetectContentTableElmt *)e;
free(c->pattern);
free(e);
}
@ -1125,7 +1127,9 @@ uint32_t DetectContentGetId(DetectEngineCtx *de_ctx, DetectContentData *co) {
e = malloc(sizeof(DetectContentTableElmt));
BUG_ON(e == NULL);
e->pattern = co->content;
e->pattern = SCMalloc(co->content_len);
BUG_ON(e->pattern == NULL);
memcpy(e->pattern, co->content, co->content_len);
e->pattern_len = co->content_len;
e->id = 0;

16
src/detect-engine-mpm.c
Unescape Escape View File

@ -81,7 +81,7 @@ uint32_t PacketPatternScan(ThreadVars *tv, DetectEngineThreadCtx *det_ctx,
uint32_t ret;
#ifndef __SC_CUDA_SUPPORT__
ret = mpm_table[det_ctx->sgh->mpm_ctx->mpm_type].Scan(det_ctx->sgh->mpm_ctx,
ret = mpm_table[det_ctx->sgh->mpm_ctx->mpm_type].Search(det_ctx->sgh->mpm_ctx,
&det_ctx->mtc,
&det_ctx->pmq,
p->payload,
@ -91,7 +91,7 @@ uint32_t PacketPatternScan(ThreadVars *tv, DetectEngineThreadCtx *det_ctx,
* algo, then we shouldn't take the path of the dispatcher. Call the mpm
* directly */
if (det_ctx->sgh->mpm_ctx->mpm_type != MPM_B2G_CUDA) {
ret = mpm_table[det_ctx->sgh->mpm_ctx->mpm_type].Scan(det_ctx->sgh->mpm_ctx,
ret = mpm_table[det_ctx->sgh->mpm_ctx->mpm_type].Search(det_ctx->sgh->mpm_ctx,
&det_ctx->mtc,
&det_ctx->pmq,
p->payload,
@ -121,7 +121,7 @@ uint32_t UriPatternScan(ThreadVars *tv, DetectEngineThreadCtx *det_ctx,
uint32_t ret;
#ifndef __SC_CUDA_SUPPORT__
ret = mpm_table[det_ctx->sgh->mpm_uri_ctx->mpm_type].Scan
ret = mpm_table[det_ctx->sgh->mpm_uri_ctx->mpm_type].Search
(det_ctx->sgh->mpm_uri_ctx, &det_ctx->mtcu, &det_ctx->pmq,
uri, uri_len);
#else
@ -129,7 +129,7 @@ uint32_t UriPatternScan(ThreadVars *tv, DetectEngineThreadCtx *det_ctx,
* algo, then we shouldn't take the path of the dispatcher. Call the mpm
* directly */
if (det_ctx->sgh->mpm_uri_ctx->mpm_type != MPM_B2G_CUDA) {
ret = mpm_table[det_ctx->sgh->mpm_uri_ctx->mpm_type].Scan
ret = mpm_table[det_ctx->sgh->mpm_uri_ctx->mpm_type].Search
(det_ctx->sgh->mpm_uri_ctx, &det_ctx->mtcu, &det_ctx->pmq,
uri, uri_len);
SCReturnUInt(ret);
@ -535,9 +535,9 @@ static int PatternMatchPreprarePopulateMpm(DetectEngineCtx *de_ctx, SigGroupHead
depth = scan_ch->cnt ? 0 : depth;
if (co->flags & DETECT_CONTENT_NOCASE) {
mpm_table[sgh->mpm_ctx->mpm_type].AddScanPatternNocase(sgh->mpm_ctx, co->content, co->content_len, offset, depth, co->id, s->num, scan_ch->nosearch);
mpm_table[sgh->mpm_ctx->mpm_type].AddPatternNocase(sgh->mpm_ctx, co->content, co->content_len, offset, depth, co->id, s->num, scan_ch->nosearch);
} else {
mpm_table[sgh->mpm_ctx->mpm_type].AddScanPattern(sgh->mpm_ctx, co->content, co->content_len, offset, depth, co->id, s->num, scan_ch->nosearch);
mpm_table[sgh->mpm_ctx->mpm_type].AddPattern(sgh->mpm_ctx, co->content, co->content_len, offset, depth, co->id, s->num, scan_ch->nosearch);
}
SCLogDebug("%"PRIu32" adding co->id %"PRIu32" to the scan phase (s->num %"PRIu32")", s->id, co->id, s->num);
@ -868,9 +868,9 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
* length is the same as maxlen (ie we only add the longest pattern) */
if (!uricontent_scanadded && uricontent_maxlen == ud->uricontent_len) {
if (ud->flags & DETECT_URICONTENT_NOCASE) {
mpm_table[sh->mpm_uri_ctx->mpm_type].AddScanPatternNocase(sh->mpm_uri_ctx, ud->uricontent, ud->uricontent_len, 0, 0, ud->id, s->num, 0);
mpm_table[sh->mpm_uri_ctx->mpm_type].AddPatternNocase(sh->mpm_uri_ctx, ud->uricontent, ud->uricontent_len, 0, 0, ud->id, s->num, 0);
} else {
mpm_table[sh->mpm_uri_ctx->mpm_type].AddScanPattern(sh->mpm_uri_ctx, ud->uricontent, ud->uricontent_len, 0, 0, ud->id, s->num, 0);
mpm_table[sh->mpm_uri_ctx->mpm_type].AddPattern(sh->mpm_uri_ctx, ud->uricontent, ud->uricontent_len, 0, 0, ud->id, s->num, 0);
}
uricontent_scanadded = 1;

669
src/util-mpm-b2g.c
View File

File diff suppressed because it is too large Load Diff

64
src/util-mpm-b2g.h
Unescape Escape View File

@ -25,10 +25,10 @@
#define B2G_HASH16(a,b) (((a)<<B2G_HASHSHIFT) | (b))
#define B2G_Q 2
#define B2G_SCANFUNC B2gScanBNDMq
//#define B2G_SCANFUNC B2gScan
#define B2G_SEARCHFUNC B2gSearchBNDMq
//#define B2G_SEARCHFUNC B2gSearch
//#define B2G_SCAN2
//#define B2G_SEARCH2
//#define B2G_COUNTERS
typedef struct B2gPattern_ {
@ -48,55 +48,55 @@ typedef struct B2gHashItem_ {
} B2gHashItem;
typedef struct B2gCtx_ {
B2G_TYPE *scan_B2G;
B2G_TYPE scan_m;
BloomFilter **scan_bloom;
uint8_t *scan_pminlen; /* array containing the minimal length
B2G_TYPE *B2G;
B2G_TYPE m;
BloomFilter **bloom;
uint8_t *pminlen; /* array containing the minimal length
of the patters in a hash bucket. Used
for the BloomFilter. */
/* pattern arrays */
B2gPattern **parray;
uint16_t scan_1_pat_cnt;
#ifdef B2G_SCAN2
uint16_t scan_2_pat_cnt;
uint16_t pat_1_cnt;
#ifdef B2G_SEARCH2
uint16_t pat_2_cnt;
#endif
uint16_t scan_x_pat_cnt;
uint16_t pat_x_cnt;
uint32_t scan_hash_size;
B2gHashItem **scan_hash;
B2gHashItem scan_hash1[256];
#ifdef B2G_SCAN2
B2gHashItem **scan_hash2;
uint32_t hash_size;
B2gHashItem **hash;
B2gHashItem hash1[256];
#ifdef B2G_SEARCH2
B2gHashItem **hash2;
#endif
/* hash used during ctx initialization */
B2gPattern **init_hash;
uint8_t scan_s0;
uint8_t s0;
/* we store our own multi byte scan ptr here for B2gSearch1 */
uint32_t (*Scan)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
uint32_t (*Search)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
/* we store our own multi byte scan ptr here for B2gSearch1 */
uint32_t (*MBScan2)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
uint32_t (*MBScan)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
uint32_t (*MBSearch2)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
uint32_t (*MBSearch)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
} B2gCtx;
typedef struct B2gThreadCtx_ {
#ifdef B2G_COUNTERS
uint32_t scan_stat_pminlen_calls;
uint32_t scan_stat_pminlen_total;
uint32_t scan_stat_bloom_calls;
uint32_t scan_stat_bloom_hits;
uint32_t scan_stat_calls;
uint32_t scan_stat_m_total;
uint32_t scan_stat_d0;
uint32_t scan_stat_d0_hashloop;
uint32_t scan_stat_loop_match;
uint32_t scan_stat_loop_no_match;
uint32_t scan_stat_num_shift;
uint32_t scan_stat_total_shift;
uint32_t stat_pminlen_calls;
uint32_t stat_pminlen_total;
uint32_t stat_bloom_calls;
uint32_t stat_bloom_hits;
uint32_t stat_calls;
uint32_t stat_m_total;
uint32_t stat_d0;
uint32_t stat_d0_hashloop;
uint32_t stat_loop_match;
uint32_t stat_loop_no_match;
uint32_t stat_num_shift;
uint32_t stat_total_shift;
#endif /* B2G_COUNTERS */
} B2gThreadCtx;

601
src/util-mpm-b3g.c
View File

File diff suppressed because it is too large Load Diff

58
src/util-mpm-b3g.h
Unescape Escape View File

@ -22,8 +22,8 @@
#define B3G_HASH(a,b,c) (((a)<<B3G_HASHSHIFT) | (b)<<(B3G_HASHSHIFT-3) |(c))
#define B3G_Q 3
//#define B3G_SCANFUNC B3gScan
#define B3G_SCANFUNC B3gScanBNDMq
//#define B3G_SEARCHFUNC B3gSearch
#define B3G_SEARCHFUNC B3gSearchBNDMq
//#define B3G_COUNTERS
@ -46,29 +46,29 @@ typedef struct B3gCtx_ {
/* hash used during ctx initialization */
B3gPattern **init_hash;
B3G_TYPE scan_m;
B3G_TYPE *scan_B3G;
B3G_TYPE m;
B3G_TYPE *B3G;
uint8_t scan_s0;
uint8_t s0;
uint16_t scan_1_pat_cnt;
uint16_t scan_2_pat_cnt;
uint16_t scan_x_pat_cnt;
uint16_t pat_1_cnt;
uint16_t pat_2_cnt;
uint16_t pat_x_cnt;
uint32_t scan_hash_size;
B3gHashItem **scan_hash;
BloomFilter **scan_bloom;
uint8_t *scan_pminlen; /* array containing the minimal length
uint32_t hash_size;
B3gHashItem **hash;
BloomFilter **bloom;
uint8_t *pminlen; /* array containing the minimal length
of the patters in a hash bucket. Used
for the BloomFilter. */
B3gHashItem scan_hash1[256];
B3gHashItem **scan_hash2;
B3gHashItem hash1[256];
B3gHashItem **hash2;
uint32_t (*Scan)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
uint32_t (*Search)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
/* we store our own multi byte scan ptr here for B3gSearch1 */
uint32_t (*MBScan2)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
uint32_t (*MBScan)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
uint32_t (*MBSearch2)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
uint32_t (*MBSearch)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
/* pattern arrays */
B3gPattern **parray;
@ -76,18 +76,18 @@ typedef struct B3gCtx_ {
typedef struct B3gThreadCtx_ {
#ifdef B3G_COUNTERS
uint32_t scan_stat_pminlen_calls;
uint32_t scan_stat_pminlen_total;
uint32_t scan_stat_bloom_calls;
uint32_t scan_stat_bloom_hits;
uint32_t scan_stat_calls;
uint32_t scan_stat_m_total;
uint32_t scan_stat_d0;
uint32_t scan_stat_d0_hashloop;
uint32_t scan_stat_loop_match;
uint32_t scan_stat_loop_no_match;
uint32_t scan_stat_num_shift;
uint32_t scan_stat_total_shift;
uint32_t stat_pminlen_calls;
uint32_t stat_pminlen_total;
uint32_t stat_bloom_calls;
uint32_t stat_bloom_hits;
uint32_t stat_calls;
uint32_t stat_m_total;
uint32_t stat_d0;
uint32_t stat_d0_hashloop;
uint32_t stat_loop_match;
uint32_t stat_loop_no_match;
uint32_t stat_num_shift;
uint32_t stat_total_shift;
#endif /* B3G_COUNTERS */
} B3gThreadCtx;

923
src/util-mpm-wumanber.c
View File

File diff suppressed because it is too large Load Diff

36
src/util-mpm-wumanber.h
Unescape Escape View File

@ -31,39 +31,39 @@ typedef struct WmCtx_ {
/* hash used during ctx initialization */
WmPattern **init_hash;
uint16_t scan_shiftlen;
uint16_t shiftlen;
uint32_t scan_hash_size;
WmHashItem **scan_hash;
BloomFilter **scan_bloom;
uint8_t *scan_pminlen; /* array containing the minimal length
uint32_t hash_size;
WmHashItem **hash;
BloomFilter **bloom;
uint8_t *pminlen; /* array containing the minimal length
of the patters in a hash bucket. Used
for the BloomFilter. */
WmHashItem scan_hash1[256];
WmHashItem hash1[256];
/* we store our own scan ptr here for WmSearch1 */
uint32_t (*Scan)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
uint32_t (*Search)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
/* we store our own multi byte scan ptr here for WmSearch1 */
uint32_t (*MBScan)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
uint32_t (*MBSearch)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
/* pattern arrays */
WmPattern **parray;
/* only used for multibyte pattern search */
uint16_t *scan_shifttable;
uint16_t *shifttable;
} WmCtx;
typedef struct WmThreadCtx_ {
#ifdef WUMANBER_COUNTERS
uint32_t scan_stat_pminlen_calls;
uint32_t scan_stat_pminlen_total;
uint32_t scan_stat_bloom_calls;
uint32_t scan_stat_bloom_hits;
uint32_t scan_stat_shift_null;
uint32_t scan_stat_loop_match;
uint32_t scan_stat_loop_no_match;
uint32_t scan_stat_num_shift;
uint32_t scan_stat_total_shift;
uint32_t stat_pminlen_calls;
uint32_t stat_pminlen_total;
uint32_t stat_bloom_calls;
uint32_t stat_bloom_hits;
uint32_t stat_shift_null;
uint32_t stat_loop_match;
uint32_t stat_loop_no_match;
uint32_t stat_num_shift;
uint32_t stat_total_shift;
#endif /* WUMANBER_COUNTERS */
} WmThreadCtx;

13
src/util-mpm.h
Unescape Escape View File

@ -89,8 +89,8 @@ typedef struct MpmCtx_ {
uint32_t pattern_cnt; /* unique patterns */
uint32_t total_pattern_cnt; /* total patterns added */
uint16_t scan_minlen;
uint16_t scan_maxlen;
uint16_t minlen;
uint16_t maxlen;
} MpmCtx;
typedef struct MpmTableElmt_ {
@ -100,13 +100,10 @@ typedef struct MpmTableElmt_ {
void (*InitThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *, uint32_t);
void (*DestroyCtx)(struct MpmCtx_ *);
void (*DestroyThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *);
int (*AddScanPattern)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, uint32_t, uint8_t);
int (*AddScanPatternNocase)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, uint32_t, uint8_t);
// int (*AddPattern)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, uint32_t);
// int (*AddPatternNocase)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, uint32_t);
int (*AddPattern)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, uint32_t, uint8_t);
int (*AddPatternNocase)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, uint32_t, uint8_t);
int (*Prepare)(struct MpmCtx_ *);
uint32_t (*Scan)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
// uint32_t (*Search)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
uint32_t (*Search)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
void (*Cleanup)(struct MpmThreadCtx_ *);
void (*PrintCtx)(struct MpmCtx_ *);
void (*PrintThreadCtx)(struct MpmThreadCtx_ *);

Write Preview
Loading…
Cancel
Save