aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Sync alversion/appversion types

Browse Source 
The app layer state 'version' field is incremented with each update
to the state. It is used by the detection engine to see if the current
version of the state has already been inspected. Since app layer and
detect always run closely together there is no need for a big number
here. The detect code really only checks for equal/not-equal, so wrap
arounds are not an issue.
pull/1606/head
Victor Julien 10 years ago
parent 11d3f5f67a
commit 62fa9f09d4
4 changed files with 15 additions and 14 deletions
Show Stats Download Patch File Download Diff File

8
src/app-layer-parser.c
Unescape Escape View File

@ -128,7 +128,7 @@ struct AppLayerParserState_ {
uint8_t flags;
/* State version, incremented for each update. Can wrap around. */
uint16_t version;
uint8_t version;
/* Indicates the current transaction that is being inspected.
* We have a var per direction. */
uint64_t inspect_id[2];
@ -606,7 +606,7 @@ AppLayerDecoderEvents *AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alp
uint16_t AppLayerParserGetStateVersion(AppLayerParserState *pstate)
{
SCEnter();
SCReturnCT((pstate == NULL) ? 0 : pstate->version, "uint16_t");
SCReturnCT((pstate == NULL) ? 0 : pstate->version, "uint8_t");
}
FileContainer *AppLayerParserGetFiles(uint8_t ipproto, AppProto alproto,
@ -871,7 +871,7 @@ int AppLayerParserParse(AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alp
goto error;
}
pstate->version++;
SCLogDebug("app layer parser state version incremented to %"PRIu16,
SCLogDebug("app layer parser state version incremented to %"PRIu8,
pstate->version);
if (flags & STREAM_EOF)
@ -1166,7 +1166,7 @@ void AppLayerParserStatePrintDetails(AppLayerParserState *pstate)
"p->inspect_id[0](%"PRIu64"), "
"p->inspect_id[1](%"PRIu64"), "
"p->log_id(%"PRIu64"), "
"p->version(%"PRIu16"), "
"p->version(%"PRIu8"), "
"p->decoder_events(%p).",
pstate, p->inspect_id[0], p->inspect_id[1], p->log_id,
p->version, p->decoder_events);

13
src/detect-engine-state.c
Unescape Escape View File

@ -243,7 +243,7 @@ static void DeStateFlowRuleAppend(DetectEngineStateFlow *state, Signature *s,
}
static void DeStateStoreStateVersion(Flow *f,
uint16_t alversion, uint8_t direction)
const uint8_t alversion, uint8_t direction)
{
f->detect_alversion[direction & STREAM_TOSERVER ? 0 : 1] = alversion;
}
@ -373,7 +373,8 @@ static int HasStoredSigs(Flow *f, uint8_t flags)
* \retval 1 inspectable state
* \retval 2 inspectable state, but no update
*/
int DeStateFlowHasInspectableState(Flow *f, AppProto alproto, uint16_t alversion, uint8_t flags)
int DeStateFlowHasInspectableState(Flow *f, AppProto alproto,
const uint8_t alversion, uint8_t flags)
{
int r = 0;
@ -394,7 +395,7 @@ int DeStateFlowHasInspectableState(Flow *f, AppProto alproto, uint16_t alversion
}
static int StoreState(DetectEngineThreadCtx *det_ctx,
Flow *f, const uint8_t flags, const uint16_t alversion,
Flow *f, const uint8_t flags, const uint8_t alversion,
Signature *s, SigMatch *sm, const uint32_t inspect_flags,
const uint16_t file_no_match)
{
@ -445,7 +446,7 @@ static void StoreStateTxFileOnly(DetectEngineThreadCtx *det_ctx,
* \param check_before_add check for duplicates before adding the sig
*/
static void StoreStateTx(DetectEngineThreadCtx *det_ctx,
Flow *f, const uint8_t flags, const uint16_t alversion,
Flow *f, const uint8_t flags, const uint8_t alversion,
const uint64_t tx_id, void *tx,
Signature *s, SigMatch *sm,
const uint32_t inspect_flags, const uint16_t file_no_match, int check_before_add)
@ -475,7 +476,7 @@ static void StoreStateTx(DetectEngineThreadCtx *det_ctx,
int DeStateDetectStartDetection(ThreadVars *tv, DetectEngineCtx *de_ctx,
DetectEngineThreadCtx *det_ctx,
Signature *s, Packet *p, Flow *f, uint8_t flags,
AppProto alproto, uint16_t alversion)
AppProto alproto, const uint8_t alversion)
{
SigMatch *sm = NULL;
uint16_t file_no_match = 0;
@ -978,7 +979,7 @@ static int DoInspectFlowRule(ThreadVars *tv,
void DeStateDetectContinueDetection(ThreadVars *tv, DetectEngineCtx *de_ctx,
DetectEngineThreadCtx *det_ctx,
Packet *p, Flow *f, uint8_t flags,
AppProto alproto, uint16_t alversion)
AppProto alproto, const uint8_t alversion)
{
uint16_t file_no_match = 0;
SigIntId store_cnt = 0;

6
src/detect-engine-state.h
Unescape Escape View File

@ -178,7 +178,7 @@ void DetectEngineStateFlowFree(DetectEngineStateFlow *state);
* \retval 1 Has state.
* \retval 0 Has no state.
*/
int DeStateFlowHasInspectableState(Flow *f, AppProto alproto, uint16_t alversion, uint8_t flags);
int DeStateFlowHasInspectableState(Flow *f, AppProto alproto, uint8_t alversion, uint8_t flags);
/**
* \brief Match app layer sig list against app state and store relevant match
@ -198,7 +198,7 @@ int DeStateFlowHasInspectableState(Flow *f, AppProto alproto, uint16_t alversion
int DeStateDetectStartDetection(ThreadVars *tv, DetectEngineCtx *de_ctx,
DetectEngineThreadCtx *det_ctx,
Signature *s, Packet *p, Flow *f, uint8_t flags,
AppProto alproto, uint16_t alversion);
AppProto alproto, uint8_t alversion);
/**
* \brief Continue DeState detection of the signatures stored in the state.
@ -214,7 +214,7 @@ int DeStateDetectStartDetection(ThreadVars *tv, DetectEngineCtx *de_ctx,
void DeStateDetectContinueDetection(ThreadVars *tv, DetectEngineCtx *de_ctx,
DetectEngineThreadCtx *det_ctx,
Packet *p, Flow *f, uint8_t flags,
AppProto alproto, uint16_t alversion);
AppProto alproto, uint8_t alversion);
/**
* \brief Update the inspect id.

2
src/detect.c
Unescape Escape View File

@ -1236,7 +1236,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
StreamMsg *smsg = NULL;
Signature *s = NULL;
Signature *next_s = NULL;
uint16_t alversion = 0;
uint8_t alversion = 0;
int state_alert = 0;
int alerts = 0;
int app_decoder_events = 0;

Write Preview
Loading…
Cancel
Save