aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Rename all structure definitions in the "typedef struct _SomeStruct" format to "typedef struct SomeStruct_" to make the Doxygen output more useful.

Browse Source 
Remove the Trie multi pattern matcher code. It wasn't used anymore.
remotes/origin/master-1.0.x
Victor Julien 17 years ago
parent ffa013b2d8
commit 689bbfdc45
62 changed files with 256 additions and 1766 deletions
Show Stats Download Patch File Download Diff File

1
src/Makefile.am
Unescape Escape View File

@ -60,7 +60,6 @@ detect-flow.c detect-flow.h \
detect-dsize.c detect-dsize.h \
detect-noalert.c detect-noalert.h \
util-print.c util-print.h \
util-mpm-trie.c util-mpm-trie.h \
util-mpm.c util-mpm.h \
util-binsearch.c util-binsearch.h \
util-mpm-wumanber.c util-mpm-wumanber.h \

2
src/alert-debuglog.c
Unescape Escape View File

@ -65,7 +65,7 @@ void TmModuleAlertDebuglogIPv6Register (void) {
tmm_modules[TMM_ALERTDEBUGLOG6].RegisterTests = NULL;
}
*/
typedef struct _AlertDebuglogThread {
typedef struct AlertDebuglogThread_ {
FILE *fp;
u_int32_t alerts;
} AlertDebuglogThread;

2
src/alert-fastlog.c
Unescape Escape View File

@ -65,7 +65,7 @@ void TmModuleAlertFastlogIPv6Register (void) {
tmm_modules[TMM_ALERTFASTLOG6].RegisterTests = NULL;
}
typedef struct _AlertFastlogThread {
typedef struct AlertFastlogThread_ {
FILE *fp;
u_int32_t alerts;
} AlertFastlogThread;

6
src/alert-unified-alert.c
Unescape Escape View File

@ -45,7 +45,7 @@ void TmModuleAlertUnifiedAlertRegister (void) {
tmm_modules[TMM_ALERTUNIFIEDALERT].RegisterTests = NULL;
}
typedef struct _AlertUnifiedAlertThread {
typedef struct AlertUnifiedAlertThread_ {
FILE *fp;
u_int32_t size_limit;
u_int32_t size_current;
@ -55,14 +55,14 @@ typedef struct _AlertUnifiedAlertThread {
#define ALERTUNIFIEDALERT_VERMAJOR 1 /* taken from Snort */
#define ALERTUNIFIEDALERT_VERMINOR 81 /* taken from Snort */
typedef struct _AlertUnifiedAlertFileHeader {
typedef struct AlertUnifiedAlertFileHeader_ {
u_int32_t magic;
u_int32_t ver_major;
u_int32_t ver_minor;
u_int32_t timezone;
} AlertUnifiedAlertFileHeader;
typedef struct _AlertUnifiedAlertPacketHeader {
typedef struct AlertUnifiedAlertPacketHeader_ {
/* Snort's 'Event' structure */
u_int32_t sig_gen;
u_int32_t sig_sid;

6
src/alert-unified-log.c
Unescape Escape View File

@ -45,7 +45,7 @@ void TmModuleAlertUnifiedLogRegister (void) {
tmm_modules[TMM_ALERTUNIFIEDLOG].RegisterTests = NULL;
}
typedef struct _AlertUnifiedLogThread {
typedef struct AlertUnifiedLogThread_ {
FILE *fp;
u_int32_t size_limit;
u_int32_t size_current;
@ -55,7 +55,7 @@ typedef struct _AlertUnifiedLogThread {
#define ALERTUNIFIEDLOG_VERMAJOR 1 /* taken from Snort */
#define ALERTUNIFIEDLOG_VERMINOR 2 /* taken from Snort */
typedef struct _AlertUnifiedLogFileHeader {
typedef struct AlertUnifiedLogFileHeader_ {
u_int32_t magic;
u_int16_t ver_major;
u_int16_t ver_minor;
@ -65,7 +65,7 @@ typedef struct _AlertUnifiedLogFileHeader {
u_int32_t linktype;
} AlertUnifiedLogFileHeader;
typedef struct _AlertUnifiedLogPacketHeader {
typedef struct AlertUnifiedLogPacketHeader_ {
/* Snort's 'Event' structure */
u_int32_t sig_gen;
u_int32_t sig_sid;

2
src/decode-ethernet.h
Unescape Escape View File

@ -17,7 +17,7 @@
#define ETHERNET_TYPE_8021Q 0x8100
#define ETHERNET_TYPE_LOOP 0x9000
typedef struct _EthernetHdr {
typedef struct EthernetHdr_ {
u_int8_t eth_dst[6];
u_int8_t eth_src[6];
u_int16_t eth_type;

2
src/decode-icmpv4.h
Unescape Escape View File

@ -124,7 +124,7 @@
#endif
/* ICMPv4 header structure */
typedef struct _ICMPV4Hdr
typedef struct ICMPV4Hdr_
{
u_int8_t type;
u_int8_t code;

2
src/decode-icmpv6.h
Unescape Escape View File

@ -64,7 +64,7 @@
#endif
typedef struct _ICMPV6Hdr
typedef struct ICMPV6Hdr_
{
u_int8_t type;
u_int8_t code;

12
src/decode-ipv4.h
Unescape Escape View File

@ -21,7 +21,7 @@
#define IPV4_OPT_SECURITY 0x82
#define IPV4_OPT_LSRR 0x83
typedef struct _IPV4Hdr
typedef struct IPV4Hdr_
{
u_int8_t ip_verhl; /* version & header length */
u_int8_t ip_tos;
@ -113,8 +113,12 @@ typedef struct _IPV4Hdr
#define IPV4_CACHE_IPTTL 0x0400 /* 1024*/
#define IPV4_CACHE_IPPROTO 0x0800 /* 2048 */
/* decoder cache */
typedef struct _IPV4Cache
/**
* IPv4 decoder cache
*
* Used for storing parsed values.
*/
typedef struct IPV4Cache_
{
u_int16_t flags;
@ -137,7 +141,7 @@ typedef struct _IPV4Cache
} IPV4Cache;
/* helper structure with parsed ipv4 info */
typedef struct _IPV4Vars
typedef struct IPV4Vars_
{
u_int8_t ip_opts_len;
} IPV4Vars;

30
src/decode-ipv6.h
Unescape Escape View File

@ -13,10 +13,10 @@
#define IPV6_MAXPACKET 65535 /* maximum packet size */
#define IPV6_MAX_OPT 40
typedef struct _IPV6Hdr
typedef struct IPV6Hdr_
{
union {
struct _ip6_un1 {
struct ip6_un1_ {
u_int32_t ip6_un1_flow; /* 20 bits of flow-ID */
u_int16_t ip6_un1_plen; /* payload length */
u_int8_t ip6_un1_nxt; /* next header */
@ -83,7 +83,7 @@ typedef struct _IPV6Hdr
#define IPV6_CACHE_HLIM 0x0020 /* 32 */
/* decoder cache */
typedef struct _IPV6Cache
typedef struct IPV6Cache_
{
u_int16_t flags;
u_int8_t ver;
@ -95,7 +95,7 @@ typedef struct _IPV6Cache
} IPV6Cache;
/* helper structure with parsed ipv6 info */
typedef struct _IPV6Vars
typedef struct IPV6Vars_
{
u_int8_t ip_opts_len;
u_int8_t l4proto; /* the proto after the extension headers
@ -104,7 +104,7 @@ typedef struct _IPV6Vars
} IPV6Vars;
/* Fragment header */
typedef struct _IPV6FragHdr
typedef struct IPV6FragHdr_
{
u_int8_t ip6fh_nxt; /* next header */
u_int8_t ip6fh_reserved; /* reserved field */
@ -125,7 +125,7 @@ typedef struct _IPV6FragHdr
#define IPV6_EXTHDR_GET_FH_ID(p) IPV6_EXTHDR_GET_RAW_FH_ID((p))
/* rfc 1826 */
typedef struct _IPV6AuthHdr
typedef struct IPV6AuthHdr_
{
u_int8_t ip6ah_nxt; /* next header */
u_int8_t ip6ah_len; /* header length in units of 8 bytes, not
@ -135,13 +135,13 @@ typedef struct _IPV6AuthHdr
u_int32_t ip6ah_seq; /* sequence number */
} IPV6AuthHdr;
typedef struct _IPV6EspHdr
typedef struct IPV6EspHdr_
{
u_int32_t ip6esph_spi; /* SECURITY PARAMETERS INDEX (SPI) */
u_int32_t ip6esph_seq; /* sequence number */
} IPV6EspHdr;
typedef struct _IPV6RouteHdr
typedef struct IPV6RouteHdr_
{
u_int8_t ip6rh_nxt; /* next header */
u_int8_t ip6rh_len; /* header length in units of 8 bytes, not
@ -174,7 +174,7 @@ typedef struct _IPV6RouteHdr
#define IPV6OPT_HAO 0xC9
/* Home Address Option */
typedef struct _IPV6OptHAO
typedef struct IPV6OptHAO_
{
u_int8_t ip6hao_type; /* Option type */
u_int8_t ip6hao_len; /* Option Data len (excludes type and len) */
@ -182,7 +182,7 @@ typedef struct _IPV6OptHAO
} IPV6OptHAO;
/* Router Alert Option */
typedef struct _IPV6OptRA
typedef struct IPV6OptRA_
{
u_int8_t ip6ra_type; /* Option type */
u_int8_t ip6ra_len; /* Option Data len (excludes type and len) */
@ -190,14 +190,14 @@ typedef struct _IPV6OptRA
} IPV6OptRA;
/* Jumbo Option */
typedef struct _IPV6OptJumbo
typedef struct IPV6OptJumbo_
{
u_int8_t ip6j_type; /* Option type */
u_int8_t ip6j_len; /* Option Data len (excludes type and len) */
u_int32_t ip6j_payload_len; /* Jumbo Payload Length */
} IPV6OptJumbo;
typedef struct _IPV6HopOptsHdr
typedef struct IPV6HopOptsHdr_
{
u_int8_t ip6hh_nxt; /* next header */
u_int8_t ip6hh_len; /* header length in units of 8 bytes, not
@ -212,7 +212,7 @@ typedef struct _IPV6HopOptsHdr
#define IPV6_EXTHDR_GET_HH_HDRLEN(p) IPV6_EXTHDR_GET_RAW_HH_HDRLEN((p))
/* XXX */
typedef struct _IPV6DstOptsHdr
typedef struct IPV6DstOptsHdr_
{
u_int8_t ip6dh_nxt; /* next header */
u_int8_t ip6dh_len; /* header length in units of 8 bytes, not
@ -235,7 +235,7 @@ typedef struct _IPV6DstOptsHdr
#define IPV6_EXTHDR_GET_DH2_HDRLEN(p) IPV6_EXTHDR_GET_RAW_DH2_HDRLEN((p))
/* XXX */
typedef struct _IPV6GenOptHdr
typedef struct IPV6GenOptHdr_
{
u_int8_t type;
u_int8_t next;
@ -243,7 +243,7 @@ typedef struct _IPV6GenOptHdr
u_int8_t *data;
} IPV6GenOptHdr;
typedef struct _IPV6ExtHdrs
typedef struct IPV6ExtHdrs_
{
IPV6FragHdr *ip6fh;
/* In fh_offset we store the offset of this extension into the packet past

70
src/decode-ppp.h
Unescape Escape View File

@ -6,49 +6,49 @@
/* Point to Point Protocol RFC1331 - Supported tyes */
#define PPP_IP 0x0021 /* Internet Protocol */
#define PPP_IPV6 0x0057 /* Internet Protocol version 6 */
#define PPP_VJ_UCOMP 0x002f /* VJ uncompressed TCP/IP */
#define PPP_IP 0x0021 /* Internet Protocol */
#define PPP_IPV6 0x0057 /* Internet Protocol version 6 */
#define PPP_VJ_UCOMP 0x002f /* VJ uncompressed TCP/IP */
/* Unsupported PPP types (libpcap source reference) */
#define PPP_IPX 0x002b /* Novell IPX Protocol */
#define PPP_VJ_COMP 0x002d /* VJ compressed TCP/IP */
#define PPP_IPX 0x002b /* Novell IPX Protocol */
#define PPP_OSI 0x0023 /* OSI Network Layer */
#define PPP_NS 0x0025 /* Xerox NS IDP */
#define PPP_DECNET 0x0027 /* DECnet Phase IV */
#define PPP_APPLE 0x0029 /* Appletalk */
#define PPP_BRPDU 0x0031 /* Bridging PDU */
#define PPP_STII 0x0033 /* Stream Protocol (ST-II) */
#define PPP_VINES 0x0035 /* Banyan Vines */
#define PPP_HELLO 0x0201 /* 802.1d Hello Packets */
#define PPP_LUXCOM 0x0231 /* Luxcom */
#define PPP_SNS 0x0233 /* Sigma Network Systems */
#define PPP_MPLS_UCAST 0x0281 /* rfc 3032 */
#define PPP_MPLS_MCAST 0x0283 /* rfc 3022 */
#define PPP_IPCP 0x8021 /* IP Control Protocol */
#define PPP_OSICP 0x8023 /* OSI Network Layer Control Protocol */
#define PPP_NSCP 0x8025 /* Xerox NS IDP Control Protocol */
#define PPP_DECNETCP 0x8027 /* DECnet Control Protocol */
#define PPP_APPLECP 0x8029 /* Appletalk Control Protocol */
#define PPP_IPXCP 0x802b /* Novell IPX Control Protocol */
#define PPP_STIICP 0x8033 /* Strean Protocol Control Protocol */
#define PPP_VINESCP 0x8035 /* Banyan Vines Control Protocol */
#define PPP_IPV6CP 0x8057 /* IPv6 Control Protocol */
#define PPP_MPLSCP 0x8281 /* rfc 3022 */
#define PPP_LCP 0xc021 /* Link Control Protocol */
#define PPP_PAP 0xc023 /* Password Authentication Protocol */
#define PPP_LQM 0xc025 /* Link Quality Monitoring */
#define PPP_CHAP 0xc223 /* Challenge Handshake Authentication Protocol */
typedef struct _PPPHdr {
#define PPP_IPX 0x002b /* Novell IPX Protocol */
#define PPP_VJ_COMP 0x002d /* VJ compressed TCP/IP */
#define PPP_IPX 0x002b /* Novell IPX Protocol */
#define PPP_OSI 0x0023 /* OSI Network Layer */
#define PPP_NS 0x0025 /* Xerox NS IDP */
#define PPP_DECNET 0x0027 /* DECnet Phase IV */
#define PPP_APPLE 0x0029 /* Appletalk */
#define PPP_BRPDU 0x0031 /* Bridging PDU */
#define PPP_STII 0x0033 /* Stream Protocol (ST-II) */
#define PPP_VINES 0x0035 /* Banyan Vines */
#define PPP_HELLO 0x0201 /* 802.1d Hello Packets */
#define PPP_LUXCOM 0x0231 /* Luxcom */
#define PPP_SNS 0x0233 /* Sigma Network Systems */
#define PPP_MPLS_UCAST 0x0281 /* rfc 3032 */
#define PPP_MPLS_MCAST 0x0283 /* rfc 3022 */
#define PPP_IPCP 0x8021 /* IP Control Protocol */
#define PPP_OSICP 0x8023 /* OSI Network Layer Control Protocol */
#define PPP_NSCP 0x8025 /* Xerox NS IDP Control Protocol */
#define PPP_DECNETCP 0x8027 /* DECnet Control Protocol */
#define PPP_APPLECP 0x8029 /* Appletalk Control Protocol */
#define PPP_IPXCP 0x802b /* Novell IPX Control Protocol */
#define PPP_STIICP 0x8033 /* Strean Protocol Control Protocol */
#define PPP_VINESCP 0x8035 /* Banyan Vines Control Protocol */
#define PPP_IPV6CP 0x8057 /* IPv6 Control Protocol */
#define PPP_MPLSCP 0x8281 /* rfc 3022 */
#define PPP_LCP 0xc021 /* Link Control Protocol */
#define PPP_PAP 0xc023 /* Password Authentication Protocol */
#define PPP_LQM 0xc025 /* Link Quality Monitoring */
#define PPP_CHAP 0xc223 /* Challenge Handshake Authentication Protocol */
typedef struct PPPHdr_ {
u_int8_t address;
u_int8_t control;
u_int16_t protocol;
} PPPHdr;
#define PPP_HEADER_LEN (sizeof(struct _PPPHdr))
#define PPP_HEADER_LEN 4
void DecodePPPRegisterTests(void);

6
src/decode-tcp.h
Unescape Escape View File

@ -71,13 +71,13 @@
#define TCP_ISSET_FLAG_RES2(p) ((p)->tcph->th_flags & TH_RES2)
#define TCP_ISSET_FLAG_RES1(p) ((p)->tcph->th_flags & TH_RES1)
typedef struct _TCPOpt {
typedef struct TCPOpt_ {
u_int8_t type;
u_int8_t len;
u_int8_t *data;
} TCPOpt;
typedef struct _TCPHdr
typedef struct TCPHdr_
{
u_int16_t th_sport; /* source port */
u_int16_t th_dport; /* destination port */
@ -90,7 +90,7 @@ typedef struct _TCPHdr
u_int16_t th_urp; /* urgent pointer */
} TCPHdr;
typedef struct _TCPVars
typedef struct TCPVars_
{
u_int8_t hlen;

4
src/decode-udp.h
Unescape Escape View File

@ -15,7 +15,7 @@
#define UDP_GET_DST_PORT(p) UDP_GET_RAW_DST_PORT(p->udph)
/* UDP header structure */
typedef struct _UDPHdr
typedef struct UDPHdr_
{
u_int16_t uh_sport; /* source port */
u_int16_t uh_dport; /* destination port */
@ -23,7 +23,7 @@ typedef struct _UDPHdr
u_int16_t uh_sum; /* checksum */
} UDPHdr;
typedef struct _UDPVars
typedef struct UDPVars_
{
u_int8_t hlen;
} UDPVars;

24
src/decode.h
Unescape Escape View File

@ -44,7 +44,7 @@
#include "decode-udp.h"
/* Address */
typedef struct _Address
typedef struct Address_
{
char family;
union {
@ -152,7 +152,7 @@ typedef u_int16_t Port;
/* structure to store the sids/gids/etc the detection engine
* found in this packet */
typedef struct _PacketAlert {
typedef struct PacketAlert_ {
u_int8_t gid;
u_int32_t sid;
u_int8_t rev;
@ -163,7 +163,7 @@ typedef struct _PacketAlert {
#define PACKET_ALERT_MAX 256
typedef struct _PacketAlerts {
typedef struct PacketAlerts_ {
u_int16_t cnt;
PacketAlert alerts[PACKET_ALERT_MAX];
} PacketAlerts;
@ -171,7 +171,7 @@ typedef struct _PacketAlerts {
#define HTTP_URI_MAXCNT 8
#define HTTP_URI_MAXLEN 1024
typedef struct _HttpUri {
typedef struct HttpUri_ {
/* the raw uri for the packet as set by pcre */
u_int8_t *raw[HTTP_URI_MAXCNT];
u_int16_t raw_size[HTTP_URI_MAXCNT];
@ -183,16 +183,16 @@ typedef struct _HttpUri {
u_int8_t cnt;
} HttpUri;
typedef struct _PktVar {
typedef struct PktVar_ {
char *name;
u_int8_t *value;
u_int16_t value_len;
struct _PktVar *next; /* right now just implement this as a list,
struct PktVar_ *next; /* right now just implement this as a list,
* in the long run we have thing of something
* faster. */
} PktVar;
typedef struct _Packet
typedef struct Packet_
{
/* Addresses, Ports and protocol
* these are on top so we can use
@ -232,7 +232,7 @@ typedef struct _Packet
u_int16_t pktlen;
/* flow */
struct _Flow *flow;
struct Flow_ *flow;
u_int8_t flowflags;
/* pkt vars */
@ -276,11 +276,11 @@ typedef struct _Packet
int action;
/* double linked list ptrs */
struct _Packet *next;
struct _Packet *prev;
struct Packet_ *next;
struct Packet_ *prev;
/* tunnel/encapsulation handling */
struct _Packet *root; /* in case of tunnel this is a ptr
struct Packet_ *root; /* in case of tunnel this is a ptr
* to the 'real' packet, the one we
* need to set the verdict on --
* It should always point to the lowest
@ -288,7 +288,7 @@ typedef struct _Packet
} Packet;
typedef struct _PacketQueue {
typedef struct PacketQueue_ {
Packet *top;
Packet *bot;
u_int16_t len;

2
src/detect-content.h
Unescape Escape View File

@ -10,7 +10,7 @@
#define DETECT_CONTENT_RAWBYTES 0x20
typedef struct _DetectContentData {
typedef struct DetectContentData_ {
u_int8_t *content;
u_int8_t content_len;
u_int32_t id;

2
src/detect-dsize.h
Unescape Escape View File

@ -6,7 +6,7 @@
#define DETECTDSIZE_GT 2
#define DETECTDSIZE_RA 3
typedef struct _DetectDsizeData {
typedef struct DetectDsizeData_ {
u_int16_t dsize;
u_int16_t dsize2;
u_int8_t mode;

2
src/detect-engine-mpm.c
Unescape Escape View File

@ -182,7 +182,7 @@ void SigGroupHeadSetMpmMaxlen(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
}
}
typedef struct _ContentHash {
typedef struct ContentHash_ {
DetectContentData *ptr;
u_int16_t cnt;
u_int8_t use; /* use no matter what */

2
src/detect-flow.h
Unescape Escape View File

@ -1,7 +1,7 @@
#ifndef __DETECT_FLOW_H__
#define __DETECT_FLOW_H__
typedef struct _DetectFlowData {
typedef struct DetectFlowData_ {
u_int8_t flags; /* flags to match */
u_int8_t match_cnt; /* number of matches we need */
} DetectFlowData;

2
src/detect-flowbits.h
Unescape Escape View File

@ -8,7 +8,7 @@
#define DETECT_FLOWBITS_CMD_TOGGLE 4
#define DETECT_FLOWBITS_CMD_NOALERT 5
typedef struct _DetectFlowbitsData {
typedef struct DetectFlowbitsData_ {
u_int16_t idx;
u_int8_t cmd;
} DetectFlowbitsData;

2
src/detect-flowvar.h
Unescape Escape View File

@ -3,7 +3,7 @@
#define DETECT_CONTENT_NOCASE 0x01
typedef struct _DetectFlowvarData {
typedef struct DetectFlowvarData_ {
char *name;
u_int16_t idx;
u_int8_t *content;

2
src/detect-pcre.h
Unescape Escape View File

@ -14,7 +14,7 @@
#define DETECT_PCRE_CAPTURE_PKT 0x0080
#define DETECT_PCRE_CAPTURE_FLOW 0x0100
typedef struct _DetectPcreData {
typedef struct DetectPcreData_ {
/* pcre options */
pcre *re;
pcre_extra *sd;

2
src/detect-pktvar.h
Unescape Escape View File

@ -3,7 +3,7 @@
#define DETECT_CONTENT_NOCASE 0x01
typedef struct _DetectPktvarData {
typedef struct DetectPktvarData_ {
char *name;
u_int8_t *content;
u_int8_t content_len;

2
src/detect-uricontent.h
Unescape Escape View File

@ -10,7 +10,7 @@
#define DETECT_URICONTENT_RAWBYTES 0x20
typedef struct _DetectUricontentData {
typedef struct DetectUricontentData_ {
u_int8_t *uricontent;
u_int8_t uricontent_len;
u_int32_t id;

38
src/detect.h
Unescape Escape View File

@ -43,12 +43,12 @@ typedef struct DetectAddressGroup_ {
DetectAddressData *ad;
/* XXX ptr to rules, or PortGroup or whatever */
union {
struct DetectAddressGroupsHead_ *dst_gh;
struct DetectPort_ *port;
};
union {
struct DetectAddressGroupsHead_ *dst_gh;
struct DetectPort_ *port;
};
/* signatures that belong in this group */
struct _SigGroupHead *sh;
struct SigGroupHead_ *sh;
u_int8_t flags;
/* double linked list */
@ -93,7 +93,7 @@ typedef struct DetectPort_ {
u_int16_t port2;
/* signatures that belong in this group */
struct _SigGroupHead *sh;
struct SigGroupHead_ *sh;
struct DetectPort_ *dst_ph;
@ -126,7 +126,11 @@ typedef struct DetectEngineIPOnlyThreadCtx_ {
u_int32_t sig_match_size; /* size in bytes of the array */
} DetectEngineIPOnlyThreadCtx;
typedef struct _PatternMatcherThread {
/**
* Detection engine thread data.
* XXX: we should rename this
*/
typedef struct PatternMatcherThread_ {
/* detection engine variables */
u_int8_t *pkt_ptr; /* ptr to the current position in the pkt */
u_int16_t pkt_off;
@ -142,7 +146,7 @@ typedef struct _PatternMatcherThread {
* or uricontent ctx. */
MpmThreadCtx mtc; /* thread ctx for the mpm */
MpmThreadCtx mtcu;
struct _SigGroupHead *sgh;
struct SigGroupHead_ *sgh;
PatternMatcherQueue pmq;
/* counters */
@ -174,7 +178,7 @@ typedef struct _PatternMatcherThread {
} PatternMatcherThread;
typedef struct _Signature {
typedef struct Signature_ {
u_int16_t flags;
u_int32_t num; /* signature number, internal id */
@ -188,8 +192,8 @@ typedef struct _Signature {
DetectProto proto;
DetectPort *sp, *dp;
struct _SigMatch *match;
struct _Signature *next;
struct SigMatch_ *match;
struct Signature_ *next;
} Signature;
typedef struct DetectEngineIPOnlyCtx_ {
@ -247,8 +251,6 @@ typedef struct DetectEngineCtx_ {
u_int32_t signum;
/* main sigs */
// DetectAddressGroupsHead *src_gh[256]; /* a head for each protocol */
// DetectAddressGroupsHead *tmp_gh[256];
DetectEngineLookupDsize dsize_gh[DSIZE_STATES];
u_int32_t mpm_unique, mpm_reuse, mpm_none,
@ -283,14 +285,14 @@ typedef struct DetectEngineCtx_ {
DetectEngineIPOnlyCtx io_ctx;
} DetectEngineCtx;
typedef struct _SigMatch {
typedef struct SigMatch_ {
u_int8_t type;
void *ctx;
struct _SigMatch *next;
struct _SigMatch *prev;
struct SigMatch_ *next;
struct SigMatch_ *prev;
} SigMatch;
typedef struct SigTableElmt {
typedef struct SigTableElmt_ {
int (*Match)(ThreadVars *, PatternMatcherThread *, Packet *, Signature *, SigMatch *);
int (*Setup)(DetectEngineCtx *, Signature *, SigMatch *, char *);
int (*Free)(SigMatch *);
@ -309,7 +311,7 @@ typedef struct SigTableElmt {
#define SIG_GROUP_HEAD_MPM_URI_NOSCAN 0x40
/* head of the list of containers. */
typedef struct _SigGroupHead {
typedef struct SigGroupHead_ {
u_int8_t flags;
/* pattern matcher instance */

2
src/flow-bit.h
Unescape Escape View File

@ -5,7 +5,7 @@
#include "flow.h"
#include "util-var.h"
typedef struct _FlowBit {
typedef struct FlowBit_ {
u_int8_t type; /* type, DETECT_FLOWBITS in this case */
u_int16_t idx; /* name idx */
GenericVar *next; /* right now just implement this as a list,

2
src/flow-hash.h
Unescape Escape View File

@ -7,7 +7,7 @@
* Each bucket contains a flow or list of flows. All these flows have
* the same hashkey (the hash is a chained hash). When doing modifications
* to the list, the entire bucket is locked. */
typedef struct _FlowBucket {
typedef struct FlowBucket_ {
Flow *f;
pthread_mutex_t m;
} FlowBucket;

2
src/flow-queue.h
Unescape Escape View File

@ -6,7 +6,7 @@
#include "flow.h"
/* Define a queue for storing flows */
typedef struct _FlowQueue
typedef struct FlowQueue_
{
Flow *top;
Flow *bot;

2
src/flow-var.h
Unescape Escape View File

@ -5,7 +5,7 @@
#include "flow.h"
#include "util-var.h"
typedef struct _FlowVar {
typedef struct FlowVar_ {
u_int8_t type; /* type, DETECT_FLOWVAR in this case */
u_int16_t idx; /* name idx */
GenericVar *next; /* right now just implement this as a list,

16
src/flow.h
Unescape Escape View File

@ -15,7 +15,7 @@
#define FLOW_PKT_TOCLIENT_IPONLY_SET 0x20
/* global flow config */
typedef struct _FlowCnf
typedef struct FlowCnf_
{
u_int32_t hash_rand;
u_int32_t hash_size;
@ -33,7 +33,7 @@ typedef struct _FlowCnf
} FlowConfig;
/* Hash key for the flow hash */
typedef struct _FlowKey
typedef struct FlowKey_
{
Address src, dst;
Port sp, dp;
@ -42,7 +42,7 @@ typedef struct _FlowKey
} FlowKey;
typedef struct _Flow
typedef struct Flow_
{
Address src, dst;
Port sp, dp;
@ -70,12 +70,12 @@ typedef struct _Flow
/* list flow ptrs
* NOTE!!! These are NOT protected by the
* above mutex, but by the FlowQ's */
struct _Flow *hnext; /* hash list */
struct _Flow *hprev;
struct _Flow *lnext; /* list */
struct _Flow *lprev;
struct Flow_ *hnext; /* hash list */
struct Flow_ *hprev;
struct Flow_ *lnext; /* list */
struct Flow_ *lprev;
struct _FlowBucket *fb;
struct FlowBucket_ *fb;
} Flow;
void FlowHandlePacket (ThreadVars *, Packet *);

4
src/host.h
Unescape Escape View File

@ -6,7 +6,7 @@
#include "util-hash.h"
#include "util-bloomfilter-counting.h"
typedef struct _HostTable {
typedef struct HostTable_ {
pthread_mutex_t m;
/* storage & lookup */
@ -16,7 +16,7 @@ typedef struct _HostTable {
u_int32_t cnt;
} HostTable;
typedef struct _Host {
typedef struct Host_ {
pthread_mutex_t m;
Address addr;

2
src/l7-app-detect.c
Unescape Escape View File

@ -20,7 +20,7 @@
static u_int8_t l7_proto_id = 0;
typedef struct _L7AppDetectDataProto {
typedef struct L7AppDetectDataProto_ {
u_int8_t proto;
} L7AppDetectDataProto;

2
src/log-httplog.c
Unescape Escape View File

@ -60,7 +60,7 @@ void TmModuleLogHttplogIPv6Register (void) {
tmm_modules[TMM_LOGHTTPLOG6].RegisterTests = NULL;
}
typedef struct _LogHttplogThread {
typedef struct LogHttplogThread_ {
FILE *fp;
u_int32_t uri_cnt;
} LogHttplogThread;

2
src/packet-queue.h
Unescape Escape View File

@ -8,7 +8,7 @@
/* XXX: moved to decode.h */
#if 0
typedef struct _PacketQueue {
typedef struct PacketQueue_ {
Packet *top;
Packet *bot;
u_int16_t len;

2
src/respond-reject-libnet11.c
Unescape Escape View File

@ -32,7 +32,7 @@
#include "respond-reject.h"
#include "respond-reject-libnet11.h"
typedef struct _Libnet11Packet
typedef struct Libnet11Packet_
{
u_int32_t ack, seq;
u_int16_t window, dsize;

6
src/source-nfq.h
Unescape Escape View File

@ -12,7 +12,7 @@
/* idea: set the recv-thread id in the packet to
* select an verdict-queue */
typedef struct _NFQPacketVars
typedef struct NFQPacketVars_
{
int id; /* this nfq packets id */
@ -22,7 +22,7 @@ typedef struct _NFQPacketVars
u_int16_t hw_protocol;
} NFQPacketVars;
typedef struct _NFQThreadVars
typedef struct NFQThreadVars_
{
struct nfq_handle *h;
struct nfnl_handle *nh;
@ -47,7 +47,7 @@ typedef struct _NFQThreadVars
ThreadVars *tv;
} NFQThreadVars;
typedef struct _NFQGlobalVars
typedef struct NFQGlobalVars_
{
char unbind;
} NFQGlobalVars;

2
src/source-pcap.h
Unescape Escape View File

@ -12,7 +12,7 @@ void TmModuleDecodePcapRegister (void);
#define LIBPCAP_PROMISC 1
/* per packet Pcap vars */
typedef struct _PcapPacketVars
typedef struct PcapPacketVars_
{
int datalink; /* datalink from libpcap */
} PcapPacketVars;

10
src/stream-tcp-private.h
Unescape Escape View File

@ -1,16 +1,16 @@
#ifndef __STREAM_TCP_PRIVATE_H__
#define __STREAM_TCP_PRIVATE_H__
typedef struct _TcpSegment {
typedef struct TcpSegment_ {
u_int8_t *payload;
u_int16_t payload_len; /* actual size of the payload */
u_int32_t seq;
u_int16_t pool_size; /* size of the memory */
struct _TcpSegment *next;
struct _TcpSegment *prev;
struct TcpSegment_ *next;
struct TcpSegment_ *prev;
} TcpSegment;
typedef struct _TcpStream {
typedef struct TcpStream_ {
u_int32_t isn; /* initial sequence number */
u_int32_t next_seq; /* next expected sequence number */
u_int32_t last_ack; /* last ack'd sequence number */
@ -47,7 +47,7 @@ enum
#define SEQ_GT(a,b) ((int)((a) - (b)) > 0)
#define SEQ_GEQ(a,b) ((int)((a) - (b)) >= 0)
typedef struct _TcpSession {
typedef struct TcpSession_ {
u_int8_t state;
TcpStream server;
TcpStream client;

2
src/stream-tcp.c
Unescape Escape View File

@ -65,7 +65,7 @@ void TmModuleStreamTcpRegister (void) {
pthread_mutex_init(&ssn_pool_mutex, NULL);
}
typedef struct _StreamTcpThread {
typedef struct StreamTcpThread_ {
u_int64_t pkts;
} StreamTcpThread;

8
src/stream.h
Unescape Escape View File

@ -13,7 +13,7 @@
#define MSG_DATA_SIZE 512
typedef struct _StreamMsg {
typedef struct StreamMsg_ {
u_int32_t id; /* unique stream id */
u_int8_t flags; /* msg flags */
Flow *flow; /* parent flow */
@ -32,11 +32,11 @@ typedef struct _StreamMsg {
} gap;
};
struct _StreamMsg *next;
struct _StreamMsg *prev;
struct StreamMsg_ *next;
struct StreamMsg_ *prev;
} StreamMsg;
typedef struct _StreamMsgQueue {
typedef struct StreamMsgQueue_ {
StreamMsg *top;
StreamMsg *bot;
u_int16_t len;

10
src/threadvars.h
Unescape Escape View File

@ -11,7 +11,7 @@
#define THV_KILL 0x02
#define THV_CLOSED 0x04 /* thread done, should be joinable */
typedef struct _ThreadVars {
typedef struct ThreadVars_ {
pthread_t t;
char *name;
u_int8_t flags;
@ -21,8 +21,8 @@ typedef struct _ThreadVars {
Tmq *outq;
/* queue handlers */
struct _Packet * (*tmqh_in)(struct _ThreadVars *);
void (*tmqh_out)(struct _ThreadVars *, struct _Packet *);
struct Packet_ * (*tmqh_in)(struct ThreadVars_ *);
void (*tmqh_out)(struct ThreadVars_ *, struct Packet_ *);
/* slot functions */
void *(*tm_func)(void *);
@ -31,8 +31,8 @@ typedef struct _ThreadVars {
char set_cpu_affinity; /* bool: 0 no, 1 yes */
int cpu_affinity; /* cpu or core to set affinity to */
struct _ThreadVars *next;
struct _ThreadVars *prev;
struct ThreadVars_ *next;
struct ThreadVars_ *prev;
} ThreadVars;
#endif /* __THREADVARS_H__ */

2
src/tm-modules.h
Unescape Escape View File

@ -1,7 +1,7 @@
#ifndef __TM_MODULES_H__
#define __TM_MODULES_H__
typedef struct _TmModule {
typedef struct TmModule_ {
char *name;
int (*Init)(ThreadVars *, void *, void **);
int (*Func)(ThreadVars *, Packet *, void *, PacketQueue *);

2
src/tm-queuehandlers.h
Unescape Escape View File

@ -11,7 +11,7 @@ enum {
TMQH_SIZE,
};
typedef struct _Tmqh {
typedef struct Tmqh_ {
char *name;
Packet *(*InHandler)(ThreadVars *);
void (*OutHandler)(ThreadVars *, Packet *);

2
src/tm-queues.h
Unescape Escape View File

@ -1,7 +1,7 @@
#ifndef __TM_QUEUES_H__
#define __TM_QUEUES_H__
typedef struct _Tmq {
typedef struct Tmq_ {
char *name;
u_int16_t id;
u_int16_t usecnt;

12
src/tm-threads.c
Unescape Escape View File

@ -19,7 +19,7 @@ static int SetCPUAffinity(int cpu);
/* root of the threadvars list */
static ThreadVars *tv_root;
typedef struct _TmSlot {
typedef struct TmSlot_ {
/* function pointers */
int (*SlotInit)(ThreadVars *, void *, void **);
int (*SlotFunc)(ThreadVars *, Packet *, void *, PacketQueue *);
@ -32,26 +32,26 @@ typedef struct _TmSlot {
PacketQueue slot_pq;
/* linked list, only used by TmVarSlot */
struct _TmSlot *slot_next;
struct TmSlot_ *slot_next;
} TmSlot;
/* 1 function slot */
typedef struct _Tm1Slot {
typedef struct Tm1Slot_ {
TmSlot s;
} Tm1Slot;
/* 2 function slot */
typedef struct _Tm2Slot {
typedef struct Tm2Slot_ {
TmSlot s1, s2;
} Tm2Slot;
/* 3 function slot */
typedef struct _Tm3Slot {
typedef struct Tm3Slot_ {
TmSlot s1, s2, s3;
} Tm3Slot;
/* Variable number of function slots */
typedef struct _TmVarSlot {
typedef struct TmVarSlot_ {
TmSlot *s;
} TmVarSlot;

2
src/util-bloomfilter-counting.h
Unescape Escape View File

@ -4,7 +4,7 @@
#define __BLOOMFILTERCOUNTING_H__
/* Bloom filter structure */
typedef struct _BloomFilterCounting {
typedef struct BloomFilterCounting_ {
u_int8_t *array;
u_int32_t array_size; /* size in buckets */
u_int8_t type; /* 1, 2 or 4 byte counters */

2
src/util-bloomfilter.h
Unescape Escape View File

@ -4,7 +4,7 @@
#define __BLOOMFILTER_H__
/* Bloom Filter structure */
typedef struct _BloomFilter {
typedef struct BloomFilter_ {
u_int8_t *bitarray;
u_int32_t bitarray_size;
u_int8_t hash_iterations;

2
src/util-hash.c
Unescape Escape View File

@ -14,7 +14,7 @@
#include "util-unittest.h"
HashTable* HashTableInit(u_int32_t size, u_int32_t (*Hash)(struct _HashTable *, void *, u_int16_t), char (*Compare)(void *, u_int16_t, void *, u_int16_t), void (*Free)(void *)) {
HashTable* HashTableInit(u_int32_t size, u_int32_t (*Hash)(struct HashTable_ *, void *, u_int16_t), char (*Compare)(void *, u_int16_t, void *, u_int16_t), void (*Free)(void *)) {
HashTable *ht = NULL;

10
src/util-hash.h
Unescape Escape View File

@ -4,23 +4,23 @@
#define __HASH_H__
/* hash bucket structure */
typedef struct _HashTableBucket {
typedef struct HashTableBucket_ {
void *data;
u_int16_t size;
struct _HashTableBucket *next;
struct HashTableBucket_ *next;
} HashTableBucket;
/* hash table structure */
typedef struct _HashTable {
typedef struct HashTable_ {
HashTableBucket **array;
u_int32_t array_size;
u_int32_t (*Hash)(struct _HashTable *, void *, u_int16_t);
u_int32_t (*Hash)(struct HashTable_ *, void *, u_int16_t);
char (*Compare)(void *, u_int16_t, void *, u_int16_t);
void (*Free)(void *);
} HashTable;
/* prototypes */
HashTable* HashTableInit(u_int32_t, u_int32_t (*Hash)(struct _HashTable *, void *, u_int16_t), char (*Compare)(void *, u_int16_t, void *, u_int16_t), void (*Free)(void *));
HashTable* HashTableInit(u_int32_t, u_int32_t (*Hash)(struct HashTable_ *, void *, u_int16_t), char (*Compare)(void *, u_int16_t, void *, u_int16_t), void (*Free)(void *));
void HashTableFree(HashTable *);
void HashTablePrint(HashTable *);
int HashTableAdd(HashTable *, void *, u_int16_t);

2
src/util-hashlist.c
Unescape Escape View File

@ -14,7 +14,7 @@
#include "util-unittest.h"
HashListTable* HashListTableInit(u_int32_t size, u_int32_t (*Hash)(struct _HashListTable *, void *, u_int16_t), char (*Compare)(void *, u_int16_t, void *, u_int16_t), void (*Free)(void *)) {
HashListTable* HashListTableInit(u_int32_t size, u_int32_t (*Hash)(struct HashListTable_ *, void *, u_int16_t), char (*Compare)(void *, u_int16_t, void *, u_int16_t), void (*Free)(void *)) {
HashListTable *ht = NULL;

14
src/util-hashlist.h
Unescape Escape View File

@ -4,27 +4,27 @@
#define __HASHLIST_H__
/* hash bucket structure */
typedef struct _HashListTableBucket {
typedef struct HashListTableBucket_ {
void *data;
u_int16_t size;
struct _HashListTableBucket *bucknext;
struct _HashListTableBucket *listnext;
struct _HashListTableBucket *listprev;
struct HashListTableBucket_ *bucknext;
struct HashListTableBucket_ *listnext;
struct HashListTableBucket_ *listprev;
} HashListTableBucket;
/* hash table structure */
typedef struct _HashListTable {
typedef struct HashListTable_ {
HashListTableBucket **array;
HashListTableBucket *listhead;
HashListTableBucket *listtail;
u_int32_t array_size;
u_int32_t (*Hash)(struct _HashListTable *, void *, u_int16_t);
u_int32_t (*Hash)(struct HashListTable_ *, void *, u_int16_t);
char (*Compare)(void *, u_int16_t, void *, u_int16_t);
void (*Free)(void *);
} HashListTable;
/* prototypes */
HashListTable* HashListTableInit(u_int32_t, u_int32_t (*Hash)(struct _HashListTable *, void *, u_int16_t), char (*Compare)(void *, u_int16_t, void *, u_int16_t), void (*Free)(void *));
HashListTable* HashListTableInit(u_int32_t, u_int32_t (*Hash)(struct HashListTable_ *, void *, u_int16_t), char (*Compare)(void *, u_int16_t, void *, u_int16_t), void (*Free)(void *));
void HashListTableFree(HashListTable *);
void HashListTablePrint(HashListTable *);
int HashListTableAdd(HashListTable *, void *, u_int16_t);

18
src/util-mpm-b2g.h
Unescape Escape View File

@ -44,22 +44,22 @@
//#define B2G_SCAN2
//#define B2G_COUNTERS
typedef struct _B2gPattern {
typedef struct B2gPattern_ {
u_int8_t flags;
u_int16_t len;
u_int8_t *cs; /* case sensitive */
u_int8_t *ci; /* case INsensitive */
struct _B2gPattern *next;
struct B2gPattern_ *next;
MpmEndMatch *em;
} B2gPattern;
typedef struct _B2gHashItem_ {
typedef struct B2gHashItem_ {
u_int16_t idx;
struct _B2gHashItem_ *nxt;
struct B2gHashItem_ *nxt;
u_int8_t flags;
} B2gHashItem;
typedef struct _B2gCtx {
typedef struct B2gCtx_ {
B2G_TYPE *scan_B2G;
B2G_TYPE scan_m;
BloomFilter **scan_bloom;
@ -99,14 +99,14 @@ typedef struct _B2gCtx {
u_int8_t search_s0;
/* we store our own multi byte scan ptr here for B2gSearch1 */
u_int32_t (*MBScan2)(struct _MpmCtx *, struct _MpmThreadCtx *, PatternMatcherQueue *, u_int8_t *, u_int16_t);
u_int32_t (*MBScan)(struct _MpmCtx *, struct _MpmThreadCtx *, PatternMatcherQueue *, u_int8_t *, u_int16_t);
u_int32_t (*MBScan2)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, u_int8_t *, u_int16_t);
u_int32_t (*MBScan)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, u_int8_t *, u_int16_t);
/* we store our own multi byte search ptr here for B2gSearch1 */
u_int32_t (*MBSearch)(struct _MpmCtx *, struct _MpmThreadCtx *, PatternMatcherQueue *, u_int8_t *, u_int16_t);
u_int32_t (*MBSearch)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, u_int8_t *, u_int16_t);
} B2gCtx;
typedef struct _B2gThreadCtx {
typedef struct B2gThreadCtx_ {
#ifdef B2G_COUNTERS
u_int32_t scan_stat_pminlen_calls;
u_int32_t scan_stat_pminlen_total;

20
src/util-mpm-b3g.h
Unescape Escape View File

@ -39,22 +39,22 @@
//#define B3G_COUNTERS
typedef struct _B3gPattern {
typedef struct B3gPattern_ {
u_int8_t *cs; /* case sensitive */
u_int8_t *ci; /* case INsensitive */
u_int16_t len;
struct _B3gPattern *next;
struct B3gPattern_ *next;
u_int8_t flags;
MpmEndMatch *em;
} B3gPattern;
typedef struct _B3gHashItem_ {
typedef struct B3gHashItem_ {
u_int8_t flags;
u_int16_t idx;
struct _B3gHashItem_ *nxt;
struct B3gHashItem_ *nxt;
} B3gHashItem;
typedef struct _B3gCtx {
typedef struct B3gCtx_ {
/* hash used during ctx initialization */
B3gPattern **init_hash;
@ -93,17 +93,17 @@ typedef struct _B3gCtx {
B3gHashItem **search_hash2;
/* we store our own multi byte scan ptr here for B3gSearch1 */
u_int32_t (*MBScan2)(struct _MpmCtx *, struct _MpmThreadCtx *, PatternMatcherQueue *, u_int8_t *, u_int16_t);
u_int32_t (*MBScan)(struct _MpmCtx *, struct _MpmThreadCtx *, PatternMatcherQueue *, u_int8_t *, u_int16_t);
u_int32_t (*MBScan2)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, u_int8_t *, u_int16_t);
u_int32_t (*MBScan)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, u_int8_t *, u_int16_t);
/* we store our own multi byte search ptr here for B3gSearch1 */
u_int32_t (*MBSearch2)(struct _MpmCtx *, struct _MpmThreadCtx *, PatternMatcherQueue *, u_int8_t *, u_int16_t);
u_int32_t (*MBSearch)(struct _MpmCtx *, struct _MpmThreadCtx *, PatternMatcherQueue *, u_int8_t *, u_int16_t);
u_int32_t (*MBSearch2)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, u_int8_t *, u_int16_t);
u_int32_t (*MBSearch)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, u_int8_t *, u_int16_t);
/* pattern arrays */
B3gPattern **parray;
} B3gCtx;
typedef struct _B3gThreadCtx {
typedef struct B3gThreadCtx_ {
#ifdef B3G_COUNTERS
u_int32_t scan_stat_pminlen_calls;
u_int32_t scan_stat_pminlen_total;

1426
src/util-mpm-trie.c
View File

File diff suppressed because it is too large Load Diff

86
src/util-mpm-trie.h
Unescape Escape View File

@ -1,86 +0,0 @@
/* Copyright (c) 2008 Victor Julien <victor@inliniac.net> */
#ifndef __UTIL_MPM_TRIE_H__
#define __UTIL_MPM_TRIE_H__
//#define MPM_DBG_PERF
#define MPM_ENDMATCH_SINGLE 0x01 /* A single match is sufficient */
#define MPM_ENDMATCH_OFFSET 0x02 /* has offset setting */
#define MPM_ENDMATCH_DEPTH 0x04 /* has depth setting */
typedef struct _TrieCharacter {
u_int16_t min_matchlen_left; /* minimum match length left from this
* character. Used for determining if this
* leaf can match at all */
struct _TrieCharacter *nc[256];
MpmEndMatch *em;
} TrieCharacter;
typedef struct _TriePartialMatch {
struct _TriePartialMatch *prev;
struct _TriePartialMatch *next;
TrieCharacter *c;
} TriePartialMatch;
typedef struct _TriePartialMatchList {
TriePartialMatch *top;
} TriePartialMatchList;
/* global ctx */
typedef struct _TrieCtx {
u_int32_t queuelen;
u_int32_t max_queuelen;
u_int32_t keywords;
u_int32_t nocase_keywords;
u_int32_t characters;
TrieCharacter root;
TrieCharacter nocase_root;
} TrieCtx;
/* thread ctx */
typedef struct _TrieThreadCtx {
#ifdef MPM_DBG_PERF
/* debug/performance counters */
u_int64_t mpmsearch;
u_int64_t mpmsearchoffsetdepth;
u_int64_t searchchar_cnt;
u_int64_t searchchar_pmloop_cnt;
u_int64_t searchchar_nocase_cnt;
u_int64_t searchchar_nocase_pmloop_cnt;
u_int64_t searchchar_nocase_matchroot_cnt;
u_int64_t searchchar_nocase_prepeek_cnt;
u_int64_t searchchar_nocase_prepeekmatch_cnt;
u_int64_t searchchar_nocase_prepeek_nomatchnobuf_cnt;
u_int64_t searchchar_nocase_prepeek_nomatchbuflen_cnt;
u_int64_t searchchar_nocase_pmcreate_cnt;
u_int64_t searchchar_matchroot_cnt;
u_int64_t searchchar_prepeek_cnt;
u_int64_t searchchar_prepeekmatch_cnt;
u_int64_t searchchar_prepeek_nomatchnobuf_cnt;
u_int64_t searchchar_prepeek_nomatchbuflen_cnt;
u_int64_t searchchar_pmcreate_cnt;
#endif /* MPM_DBG_PERF */
/* workspace for partial matches in TrieSearch */
TriePartialMatchList spare_queue;
TriePartialMatch *pmqueue;
TriePartialMatch *nocase_pmqueue;
u_int8_t *buf;
u_int8_t *bufmin;
u_int8_t *bufmax;
u_int8_t *buflast;
} TrieThreadCtx;
/* prototypes */
void MpmTrieRegister(void);
#endif /* __UTIL_MPM_TRIE_H__ */

16
src/util-mpm-wumanber.h
Unescape Escape View File

@ -13,24 +13,24 @@
//#define WUMANBER_COUNTERS
typedef struct _WmPattern {
typedef struct WmPattern_ {
u_int8_t *cs; /* case sensitive */
u_int8_t *ci; /* case INsensitive */
u_int16_t len;
struct _WmPattern *next;
struct WmPattern_ *next;
u_int16_t prefix_ci;
u_int16_t prefix_cs;
u_int8_t flags;
MpmEndMatch *em;
} WmPattern;
typedef struct _WmHashItem_ {
typedef struct WmHashItem_ {
u_int8_t flags;
u_int16_t idx;
struct _WmHashItem_ *nxt;
struct WmHashItem_ *nxt;
} WmHashItem;
typedef struct _WmCtx {
typedef struct WmCtx_ {
/* hash used during ctx initialization */
WmPattern **init_hash;
@ -49,9 +49,9 @@ typedef struct _WmCtx {
WmHashItem search_hash1[256];
/* we store our own multi byte scan ptr here for WmSearch1 */
u_int32_t (*MBScan)(struct _MpmCtx *, struct _MpmThreadCtx *, PatternMatcherQueue *, u_int8_t *, u_int16_t);
u_int32_t (*MBScan)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, u_int8_t *, u_int16_t);
/* we store our own multi byte search ptr here for WmSearch1 */
u_int32_t (*MBSearch)(struct _MpmCtx *, struct _MpmThreadCtx *, PatternMatcherQueue *, u_int8_t *, u_int16_t);
u_int32_t (*MBSearch)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, u_int8_t *, u_int16_t);
/* pattern arrays */
WmPattern **parray;
@ -61,7 +61,7 @@ typedef struct _WmCtx {
u_int16_t *search_shifttable;
} WmCtx;
typedef struct _WmThreadCtx {
typedef struct WmThreadCtx_ {
#ifdef WUMANBER_COUNTERS
u_int32_t scan_stat_pminlen_calls;
u_int32_t scan_stat_pminlen_total;

2
src/util-mpm.c
Unescape Escape View File

@ -8,7 +8,6 @@
#include "util-mpm.h"
/* include pattern matchers */
#include "util-mpm-trie.h"
#include "util-mpm-wumanber.h"
#include "util-mpm-b2g.h"
#include "util-mpm-b3g.h"
@ -226,7 +225,6 @@ void MpmInitCtx (MpmCtx *mpm_ctx, u_int16_t matcher) {
void MpmTableSetup(void) {
memset(mpm_table, 0, sizeof(mpm_table));
//MpmTrieRegister();
MpmWuManberRegister();
MpmB2gRegister();
MpmB3gRegister();

79
src/util-mpm.h
Unescape Escape View File

@ -9,7 +9,6 @@
#define MPM_ENDMATCH_NOSEARCH 0x08 /* if this matches, no search is required (for this pattern) */
enum {
MPM_TRIE,
MPM_WUMANBER,
MPM_B2G,
MPM_B3G,
@ -19,31 +18,31 @@ enum {
};
/* Data structures */
typedef struct _MpmEndMatch {
typedef struct MpmEndMatch_ {
u_int32_t id;
u_int16_t depth;
u_int16_t offset;
u_int8_t flags;
struct _MpmEndMatch *next;
struct MpmEndMatch_ *next;
u_int32_t sig_id; /* sig callback stuff -- internal id */
} MpmEndMatch;
typedef struct _MpmMatch {
typedef struct MpmMatch_ {
u_int16_t offset; /* offset of this match in the search buffer */
struct _MpmMatch *next; /* match list -- used to connect a match to a
struct MpmMatch_ *next; /* match list -- used to connect a match to a
* pattern id. */
struct _MpmMatch *qnext; /* queue list -- used to cleanup all matches after
struct MpmMatch_ *qnext; /* queue list -- used to cleanup all matches after
* the inspection. */
struct _MpmMatchBucket *mb; /* pointer back to the bucket */
struct MpmMatchBucket_ *mb; /* pointer back to the bucket */
} MpmMatch;
typedef struct _MpmMatchBucket {
typedef struct MpmMatchBucket_ {
MpmMatch *top;
MpmMatch *bot;
u_int32_t len;
} MpmMatchBucket;
typedef struct _MpmThreadCtx {
typedef struct MpmThreadCtx_ {
void *ctx;
u_int32_t memory_cnt;
@ -65,7 +64,7 @@ typedef struct _MpmThreadCtx {
/* helper structure for the detection engine. The Pattern Matcher thread
* has this and passes a pointer to it to the pattern matcher. The actual
* pattern matcher will fill the structure. */
typedef struct _PatternMatcherQueue {
typedef struct PatternMatcherQueue_ {
/* sig callback stuff XXX consider a separate struct for this*/
u_int32_t *sig_id_array; /* array with internal sig id's that had a
pattern match. These will be inspected
@ -77,23 +76,23 @@ typedef struct _PatternMatcherQueue {
require a search-followup */
} PatternMatcherQueue;
typedef struct _MpmCtx {
typedef struct MpmCtx_ {
void *ctx;
void (*InitCtx)(struct _MpmCtx *);
void (*InitThreadCtx)(struct _MpmCtx *, struct _MpmThreadCtx *, u_int32_t);
void (*DestroyCtx)(struct _MpmCtx *);
void (*DestroyThreadCtx)(struct _MpmCtx *, struct _MpmThreadCtx *);
int (*AddScanPattern)(struct _MpmCtx *, u_int8_t *, u_int16_t, u_int16_t, u_int16_t, u_int32_t, u_int32_t, u_int8_t);
int (*AddScanPatternNocase)(struct _MpmCtx *, u_int8_t *, u_int16_t, u_int16_t, u_int16_t, u_int32_t, u_int32_t, u_int8_t);
int (*AddPattern)(struct _MpmCtx *, u_int8_t *, u_int16_t, u_int16_t, u_int16_t, u_int32_t, u_int32_t);
int (*AddPatternNocase)(struct _MpmCtx *, u_int8_t *, u_int16_t, u_int16_t, u_int16_t, u_int32_t, u_int32_t);
int (*Prepare)(struct _MpmCtx *);
u_int32_t (*Scan)(struct _MpmCtx *, struct _MpmThreadCtx *, PatternMatcherQueue *, u_int8_t *, u_int16_t);
u_int32_t (*Search)(struct _MpmCtx *, struct _MpmThreadCtx *, PatternMatcherQueue *, u_int8_t *, u_int16_t);
void (*Cleanup)(struct _MpmThreadCtx *);
void (*PrintCtx)(struct _MpmCtx *);
void (*PrintThreadCtx)(struct _MpmThreadCtx *);
void (*InitCtx)(struct MpmCtx_ *);
void (*InitThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *, u_int32_t);
void (*DestroyCtx)(struct MpmCtx_ *);
void (*DestroyThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *);
int (*AddScanPattern)(struct MpmCtx_ *, u_int8_t *, u_int16_t, u_int16_t, u_int16_t, u_int32_t, u_int32_t, u_int8_t);
int (*AddScanPatternNocase)(struct MpmCtx_ *, u_int8_t *, u_int16_t, u_int16_t, u_int16_t, u_int32_t, u_int32_t, u_int8_t);
int (*AddPattern)(struct MpmCtx_ *, u_int8_t *, u_int16_t, u_int16_t, u_int16_t, u_int32_t, u_int32_t);
int (*AddPatternNocase)(struct MpmCtx_ *, u_int8_t *, u_int16_t, u_int16_t, u_int16_t, u_int32_t, u_int32_t);
int (*Prepare)(struct MpmCtx_ *);
u_int32_t (*Scan)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, u_int8_t *, u_int16_t);
u_int32_t (*Search)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, u_int8_t *, u_int16_t);
void (*Cleanup)(struct MpmThreadCtx_ *);
void (*PrintCtx)(struct MpmCtx_ *);
void (*PrintThreadCtx)(struct MpmThreadCtx_ *);
u_int32_t memory_cnt;
u_int32_t memory_size;
@ -115,22 +114,22 @@ typedef struct _MpmCtx {
} MpmCtx;
typedef struct MpmTableElmt {
typedef struct MpmTableElmt_ {
char *name;
void (*InitCtx)(struct _MpmCtx *);
void (*InitThreadCtx)(struct _MpmCtx *, struct _MpmThreadCtx *, u_int32_t);
void (*DestroyCtx)(struct _MpmCtx *);
void (*DestroyThreadCtx)(struct _MpmCtx *, struct _MpmThreadCtx *);
int (*AddScanPattern)(struct _MpmCtx *, u_int8_t *, u_int16_t, u_int16_t, u_int16_t, u_int32_t, u_int32_t, u_int8_t);
int (*AddScanPatternNocase)(struct _MpmCtx *, u_int8_t *, u_int16_t, u_int16_t, u_int16_t, u_int32_t, u_int32_t, u_int8_t);
int (*AddPattern)(struct _MpmCtx *, u_int8_t *, u_int16_t, u_int16_t, u_int16_t, u_int32_t, u_int32_t);
int (*AddPatternNocase)(struct _MpmCtx *, u_int8_t *, u_int16_t, u_int16_t, u_int16_t, u_int32_t, u_int32_t);
int (*Prepare)(struct _MpmCtx *);
u_int32_t (*Scan)(struct _MpmCtx *, struct _MpmThreadCtx *, PatternMatcherQueue *, u_int8_t *, u_int16_t);
u_int32_t (*Search)(struct _MpmCtx *, struct _MpmThreadCtx *, PatternMatcherQueue *, u_int8_t *, u_int16_t);
void (*Cleanup)(struct _MpmThreadCtx *);
void (*PrintCtx)(struct _MpmCtx *);
void (*PrintThreadCtx)(struct _MpmThreadCtx *);
void (*InitCtx)(struct MpmCtx_ *);
void (*InitThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *, u_int32_t);
void (*DestroyCtx)(struct MpmCtx_ *);
void (*DestroyThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *);
int (*AddScanPattern)(struct MpmCtx_ *, u_int8_t *, u_int16_t, u_int16_t, u_int16_t, u_int32_t, u_int32_t, u_int8_t);
int (*AddScanPatternNocase)(struct MpmCtx_ *, u_int8_t *, u_int16_t, u_int16_t, u_int16_t, u_int32_t, u_int32_t, u_int8_t);
int (*AddPattern)(struct MpmCtx_ *, u_int8_t *, u_int16_t, u_int16_t, u_int16_t, u_int32_t, u_int32_t);
int (*AddPatternNocase)(struct MpmCtx_ *, u_int8_t *, u_int16_t, u_int16_t, u_int16_t, u_int32_t, u_int32_t);
int (*Prepare)(struct MpmCtx_ *);
u_int32_t (*Scan)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, u_int8_t *, u_int16_t);
u_int32_t (*Search)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, u_int8_t *, u_int16_t);
void (*Cleanup)(struct MpmThreadCtx_ *);
void (*PrintCtx)(struct MpmCtx_ *);
void (*PrintThreadCtx)(struct MpmThreadCtx_ *);
void (*RegisterUnittests)(void);
u_int8_t flags;
} MpmTableElmt;

6
src/util-pool.h
Unescape Escape View File

@ -4,13 +4,13 @@
#define __UTIL_POOL_H__
/* pool bucket structure */
typedef struct _PoolBucket {
typedef struct PoolBucket_ {
void *data;
struct _PoolBucket *next;
struct PoolBucket_ *next;
} PoolBucket;
/* pool structure */
typedef struct _Pool {
typedef struct Pool_ {
u_int32_t max_buckets;
u_int32_t allocated;

6
src/util-unittest.c
Unescape Escape View File

@ -33,13 +33,13 @@ static int UtAppendTest(UtTest **list, UtTest *test) {
return 0;
}
void UtRegisterTest(char *name, int(*testfn)(void), int evalue) {
void UtRegisterTest(char *name, int(*TestFn)(void), int evalue) {
UtTest *ut = UtAllocTest();
if (ut == NULL)
return;
ut->name = name;
ut->testfn = testfn;
ut->TestFn = TestFn;
ut->evalue = evalue;
ut->next = NULL;
@ -55,7 +55,7 @@ int UtRunTests(void) {
for (ut = ut_list; ut != NULL; ut = ut->next) {
printf("Test %-60s : ", ut->name);
fflush(stdout); /* flush so in case of a segv we see the testname */
int ret = ut->testfn();
int ret = ut->TestFn();
printf("%s\n", (ret == ut->evalue) ? "pass" : "FAILED");
if (ret != ut->evalue) {
result = 1;

8
src/util-unittest.h
Unescape Escape View File

@ -3,18 +3,18 @@
#ifndef __UTIL_UNITTEST_H__
#define __UTIL_UNITTEST_H__
typedef struct _UtTest {
typedef struct UtTest_ {
char *name;
int(*testfn)(void);
int(*TestFn)(void);
int evalue;
struct _UtTest *next;
struct UtTest_ *next;
} UtTest;
void UtRegisterTest(char *name, int(*testfn)(void), int evalue);
void UtRegisterTest(char *name, int(*TestFn)(void), int evalue);
int UtRunTests(void);
void UtInitialize(void);
void UtCleanup(void);

2
src/util-var-name.c
Unescape Escape View File

@ -2,7 +2,7 @@
#include "detect.h"
#include "util-hashlist.h"
typedef struct _VariableName {
typedef struct VariableName_ {
char *name;
u_int8_t type; /* flowbit, pktvar, etc */
u_int16_t idx;

4
src/util-var.h
Unescape Escape View File

@ -1,10 +1,10 @@
#ifndef __UTIL_VAR_H__
#define __UTIL_VAR_H__
typedef struct _GenericVar {
typedef struct GenericVar_ {
u_int8_t type;
u_int16_t idx;
struct _GenericVar *next;
struct GenericVar_ *next;
} GenericVar;
void GenericVarFree(GenericVar *);

Write Preview
Loading…
Cancel
Save