aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

introduce separate mpm ctxs for tcp/udp/other_protos

Browse Source
remotes/origin/master-1.2.x
Anoop Saldanha 15 years ago committed by Victor Julien
parent a5dec3cb2e
commit 92643f6110
3 changed files with 293 additions and 70 deletions
Show Stats Download Patch File Download Diff File

254
src/detect-engine-mpm.c
Unescape Escape View File

@ -209,13 +209,26 @@ uint32_t PacketPatternSearch(DetectEngineThreadCtx *det_ctx, Packet *p)
SCEnter(); SCEnter();
uint32_t ret; uint32_t ret;
MpmCtx *mpm_ctx = NULL;
#ifndef __SC_CUDA_SUPPORT__ #ifndef __SC_CUDA_SUPPORT__
ret = mpm_table[det_ctx->sgh->mpm_ctx->mpm_type].Search(det_ctx->sgh->mpm_ctx, if (p->proto == IPPROTO_TCP) {
&det_ctx->mtc, mpm_ctx = det_ctx->sgh->mpm_proto_tcp_ctx;
&det_ctx->pmq, } else if (p->proto == IPPROTO_UDP) {
p->payload, mpm_ctx = det_ctx->sgh->mpm_proto_udp_ctx;
p->payload_len); } else {
mpm_ctx = det_ctx->sgh->mpm_proto_other_ctx;
}
if (mpm_ctx == NULL)
SCReturnInt(0);
ret = mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
&det_ctx->mtc,
&det_ctx->pmq,
p->payload,
p->payload_len);
#else #else
/* if the user has enabled cuda support, but is not using the cuda mpm /* if the user has enabled cuda support, but is not using the cuda mpm
* algo, then we shouldn't take the path of the dispatcher. Call the mpm * algo, then we shouldn't take the path of the dispatcher. Call the mpm
@ -489,8 +502,17 @@ void PacketPatternCleanup(ThreadVars *t, DetectEngineThreadCtx *det_ctx) {
return; return;
/* content */ /* content */
if (det_ctx->sgh->mpm_ctx != NULL && mpm_table[det_ctx->sgh->mpm_ctx->mpm_type].Cleanup != NULL) { if (det_ctx->sgh->mpm_proto_tcp_ctx != NULL &&
mpm_table[det_ctx->sgh->mpm_ctx->mpm_type].Cleanup(&det_ctx->mtc); mpm_table[det_ctx->sgh->mpm_proto_tcp_ctx->mpm_type].Cleanup != NULL) {
mpm_table[det_ctx->sgh->mpm_proto_tcp_ctx->mpm_type].Cleanup(&det_ctx->mtc);
}
if (det_ctx->sgh->mpm_proto_tcp_ctx != NULL &&
mpm_table[det_ctx->sgh->mpm_proto_tcp_ctx->mpm_type].Cleanup != NULL) {
mpm_table[det_ctx->sgh->mpm_proto_udp_ctx->mpm_type].Cleanup(&det_ctx->mtc);
}
if (det_ctx->sgh->mpm_proto_other_ctx != NULL &&
mpm_table[det_ctx->sgh->mpm_proto_other_ctx->mpm_type].Cleanup != NULL) {
mpm_table[det_ctx->sgh->mpm_proto_other_ctx->mpm_type].Cleanup(&det_ctx->mtc);
} }
/* uricontent */ /* uricontent */
if (det_ctx->sgh->mpm_uri_ctx != NULL && mpm_table[det_ctx->sgh->mpm_uri_ctx->mpm_type].Cleanup != NULL) { if (det_ctx->sgh->mpm_uri_ctx != NULL && mpm_table[det_ctx->sgh->mpm_uri_ctx->mpm_type].Cleanup != NULL) {
@ -540,16 +562,37 @@ void PatternMatchThreadPrepare(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matche
/* free the pattern matcher part of a SigGroupHead */ /* free the pattern matcher part of a SigGroupHead */
void PatternMatchDestroyGroup(SigGroupHead *sh) { void PatternMatchDestroyGroup(SigGroupHead *sh) {
/* content */ /* content */
if (sh->flags & SIG_GROUP_HAVECONTENT && sh->mpm_ctx != NULL && if (sh->flags & SIG_GROUP_HAVECONTENT &&
!(sh->flags & SIG_GROUP_HEAD_MPM_COPY)) { !(sh->flags & SIG_GROUP_HEAD_MPM_COPY)) {
SCLogDebug("destroying mpm_ctx %p (sh %p)", sh->mpm_ctx, sh); SCLogDebug("destroying mpm_ctx %p (sh %p)", sh->mpm_ctx, sh);
if (!MpmFactoryIsMpmCtxAvailable(sh->mpm_ctx)) {
mpm_table[sh->mpm_ctx->mpm_type].DestroyCtx(sh->mpm_ctx); if (sh->mpm_proto_tcp_ctx != NULL &&
SCFree(sh->mpm_ctx); !MpmFactoryIsMpmCtxAvailable(sh->mpm_proto_tcp_ctx)) {
mpm_table[sh->mpm_proto_tcp_ctx->mpm_type].
DestroyCtx(sh->mpm_proto_tcp_ctx);
SCFree(sh->mpm_proto_tcp_ctx);
}
/* ready for reuse */
sh->mpm_proto_tcp_ctx = NULL;
if (sh->mpm_proto_udp_ctx != NULL &&
!MpmFactoryIsMpmCtxAvailable(sh->mpm_proto_udp_ctx)) {
mpm_table[sh->mpm_proto_udp_ctx->mpm_type].
DestroyCtx(sh->mpm_proto_udp_ctx);
SCFree(sh->mpm_proto_udp_ctx);
} }
/* ready for reuse */
sh->mpm_proto_udp_ctx = NULL;
if (sh->mpm_proto_other_ctx != NULL &&
!MpmFactoryIsMpmCtxAvailable(sh->mpm_proto_other_ctx)) {
mpm_table[sh->mpm_proto_other_ctx->mpm_type].
DestroyCtx(sh->mpm_proto_other_ctx);
SCFree(sh->mpm_proto_other_ctx);
}
/* ready for reuse */ /* ready for reuse */
sh->mpm_ctx = NULL; sh->mpm_proto_other_ctx = NULL;
sh->flags &= ~SIG_GROUP_HAVECONTENT; sh->flags &= ~SIG_GROUP_HAVECONTENT;
} }
@ -722,6 +765,44 @@ uint32_t PatternStrength(uint8_t *pat, uint16_t patlen) {
return s; return s;
} }
static void PopulateMpmHelperAddPatternToPktCtx(MpmCtx *mpm_ctx,
DetectContentData *cd,
Signature *s, uint8_t flags,
int chop)
{
if (cd->flags & DETECT_CONTENT_NOCASE) {
if (chop) {
mpm_table[mpm_ctx->mpm_type].
AddPatternNocase(mpm_ctx,
cd->content + cd->fp_chop_offset,
cd->fp_chop_len,
0, 0, cd->id, s->num, flags);
} else {
mpm_table[mpm_ctx->mpm_type].
AddPatternNocase(mpm_ctx,
cd->content,
cd->content_len,
0, 0, cd->id, s->num, flags);
}
} else {
if (chop) {
mpm_table[mpm_ctx->mpm_type].
AddPattern(mpm_ctx,
cd->content + cd->fp_chop_offset,
cd->fp_chop_len,
0, 0, cd->id, s->num, flags);
} else {
mpm_table[mpm_ctx->mpm_type].
AddPattern(mpm_ctx,
cd->content,
cd->content_len,
0, 0, cd->id, s->num, flags);
}
}
return;
}
static void PopulateMpmAddPatternToMpm(DetectEngineCtx *de_ctx, static void PopulateMpmAddPatternToMpm(DetectEngineCtx *de_ctx,
SigGroupHead *sgh, Signature *s, SigGroupHead *sgh, Signature *s,
SigMatch *mpm_sm) SigMatch *mpm_sm)
@ -744,18 +825,23 @@ static void PopulateMpmAddPatternToMpm(DetectEngineCtx *de_ctx,
if (cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { if (cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) {
/* add the content to the "packet" mpm */ /* add the content to the "packet" mpm */
if (SignatureHasPacketContent(s)) { if (SignatureHasPacketContent(s)) {
if (cd->flags & DETECT_CONTENT_NOCASE) { if (s->proto.proto[6 / 8] & 1 << (6 % 8)) {
mpm_table[sgh->mpm_ctx->mpm_type]. PopulateMpmHelperAddPatternToPktCtx(sgh->mpm_proto_tcp_ctx,
AddPatternNocase(sgh->mpm_ctx, cd, s, flags, 1);
cd->content + cd->fp_chop_offset, }
cd->fp_chop_len, if (s->proto.proto[17 / 8] & 1 << (17 % 8)) {
0, 0, cd->id, s->num, flags); PopulateMpmHelperAddPatternToPktCtx(sgh->mpm_proto_udp_ctx,
} else { cd, s, flags, 1);
mpm_table[sgh->mpm_ctx->mpm_type]. }
AddPattern(sgh->mpm_ctx, int i;
cd->content + cd->fp_chop_offset, for (i = 0; i < 256; i++) {
cd->fp_chop_len, if (i == 6 || i == 17)
0, 0, cd->id, s->num, flags); continue;
if (s->proto.proto[i / 8] & (1 << (i % 8))) {
PopulateMpmHelperAddPatternToPktCtx(sgh->mpm_proto_other_ctx,
cd, s, flags, 1);
break;
}
} }
/* tell matcher we are inspecting packet */ /* tell matcher we are inspecting packet */
s->flags |= SIG_FLAG_MPM_PACKET; s->flags |= SIG_FLAG_MPM_PACKET;
@ -810,16 +896,23 @@ static void PopulateMpmAddPatternToMpm(DetectEngineCtx *de_ctx,
if (SignatureHasPacketContent(s)) { if (SignatureHasPacketContent(s)) {
/* add the content to the "packet" mpm */ /* add the content to the "packet" mpm */
if (cd->flags & DETECT_CONTENT_NOCASE) { if (s->proto.proto[6 / 8] & 1 << (6 % 8)) {
mpm_table[sgh->mpm_ctx->mpm_type]. PopulateMpmHelperAddPatternToPktCtx(sgh->mpm_proto_tcp_ctx,
AddPatternNocase(sgh->mpm_ctx, cd, s, flags, 0);
cd->content, cd->content_len, }
0, 0, cd->id, s->num, flags); if (s->proto.proto[17 / 8] & 1 << (17 % 8)) {
} else { PopulateMpmHelperAddPatternToPktCtx(sgh->mpm_proto_udp_ctx,
mpm_table[sgh->mpm_ctx->mpm_type]. cd, s, flags, 0);
AddPattern(sgh->mpm_ctx, }
cd->content, cd->content_len, int i;
0, 0, cd->id, s->num, flags); for (i = 0; i < 256; i++) {
if (i == 6 || i == 17)
continue;
if (s->proto.proto[i / 8] & (1 << (i % 8))) {
PopulateMpmHelperAddPatternToPktCtx(sgh->mpm_proto_other_ctx,
cd, s, flags, 0);
break;
}
} }
/* tell matcher we are inspecting packet */ /* tell matcher we are inspecting packet */
s->flags |= SIG_FLAG_MPM_PACKET; s->flags |= SIG_FLAG_MPM_PACKET;
@ -1251,21 +1344,52 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
/* intialize contexes */ /* intialize contexes */
if (sh->flags & SIG_GROUP_HAVECONTENT) { if (sh->flags & SIG_GROUP_HAVECONTENT) {
if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) {
sh->mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_packet); sh->mpm_proto_tcp_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_proto_tcp_packet);
} else { } else {
sh->mpm_ctx = MpmFactoryGetMpmCtxForProfile(MPM_CTX_FACTORY_UNIQUE_CONTEXT); sh->mpm_proto_tcp_ctx = MpmFactoryGetMpmCtxForProfile(MPM_CTX_FACTORY_UNIQUE_CONTEXT);
} }
if (sh->mpm_ctx == NULL) { if (sh->mpm_proto_tcp_ctx == NULL) {
SCLogDebug("sh->mpm_stream_ctx == NULL. This should never happen"); SCLogDebug("sh->mpm_proto_tcp_ctx == NULL. This should never happen");
exit(EXIT_FAILURE); exit(EXIT_FAILURE);
} }
#ifndef __SC_CUDA_SUPPORT__
MpmInitCtx(sh->mpm_proto_tcp_ctx, de_ctx->mpm_matcher, -1);
#else
MpmInitCtx(sh->mpm_proto_tcp_ctx, de_ctx->mpm_matcher, de_ctx->cuda_rc_mod_handle);
#endif
if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) {
sh->mpm_proto_udp_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_proto_udp_packet);
} else {
sh->mpm_proto_udp_ctx = MpmFactoryGetMpmCtxForProfile(MPM_CTX_FACTORY_UNIQUE_CONTEXT);
}
if (sh->mpm_proto_udp_ctx == NULL) {
SCLogDebug("sh->mpm_proto_udp_ctx == NULL. This should never happen");
exit(EXIT_FAILURE);
}
#ifndef __SC_CUDA_SUPPORT__ #ifndef __SC_CUDA_SUPPORT__
MpmInitCtx(sh->mpm_ctx, de_ctx->mpm_matcher, -1); MpmInitCtx(sh->mpm_proto_udp_ctx, de_ctx->mpm_matcher, -1);
#else #else
MpmInitCtx(sh->mpm_ctx, de_ctx->mpm_matcher, de_ctx->cuda_rc_mod_handle); MpmInitCtx(sh->mpm_proto_udp_ctx, de_ctx->mpm_matcher, de_ctx->cuda_rc_mod_handle);
#endif #endif
}
if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) {
sh->mpm_proto_other_ctx =
MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_proto_other_packet);
} else {
sh->mpm_proto_other_ctx =
MpmFactoryGetMpmCtxForProfile(MPM_CTX_FACTORY_UNIQUE_CONTEXT);
}
if (sh->mpm_proto_other_ctx == NULL) {
SCLogDebug("sh->mpm_proto_other_ctx == NULL. This should never happen");
exit(EXIT_FAILURE);
}
#ifndef __SC_CUDA_SUPPORT__
MpmInitCtx(sh->mpm_proto_other_ctx, de_ctx->mpm_matcher, -1);
#else
MpmInitCtx(sh->mpm_proto_other_ctx, de_ctx->mpm_matcher, de_ctx->cuda_rc_mod_handle);
#endif
} /* if (sh->flags & SIG_GROUP_HAVECONTENT) */
if (sh->flags & SIG_GROUP_HAVESTREAMCONTENT) { if (sh->flags & SIG_GROUP_HAVESTREAMCONTENT) {
if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) {
@ -1443,15 +1567,43 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
PatternMatchPreparePopulateMpm(de_ctx, sh); PatternMatchPreparePopulateMpm(de_ctx, sh);
if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) { if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) {
if (sh->mpm_ctx != NULL) { if (sh->mpm_proto_tcp_ctx != NULL) {
if (sh->mpm_ctx->pattern_cnt == 0) { if (sh->mpm_proto_tcp_ctx->pattern_cnt == 0) {
MpmFactoryReClaimMpmCtx(sh->mpm_ctx); MpmFactoryReClaimMpmCtx(sh->mpm_proto_tcp_ctx);
sh->mpm_ctx = NULL; sh->mpm_proto_tcp_ctx = NULL;
} else { } else {
if (sh->flags & SIG_GROUP_HAVECONTENT) { if (sh->flags & SIG_GROUP_HAVECONTENT) {
if (mpm_table[sh->mpm_ctx->mpm_type].Prepare != NULL) if (mpm_table[sh->mpm_proto_tcp_ctx->mpm_type].Prepare != NULL) {
mpm_table[sh->mpm_ctx->mpm_type].Prepare(sh->mpm_ctx); mpm_table[sh->mpm_proto_tcp_ctx->mpm_type].
Prepare(sh->mpm_proto_tcp_ctx);
} }
}
}
}
if (sh->mpm_proto_udp_ctx != NULL) {
if (sh->mpm_proto_udp_ctx->pattern_cnt == 0) {
MpmFactoryReClaimMpmCtx(sh->mpm_proto_udp_ctx);
sh->mpm_proto_udp_ctx = NULL;
} else {
if (sh->flags & SIG_GROUP_HAVECONTENT) {
if (mpm_table[sh->mpm_proto_udp_ctx->mpm_type].Prepare != NULL) {
mpm_table[sh->mpm_proto_udp_ctx->mpm_type].
Prepare(sh->mpm_proto_udp_ctx);
}
}
}
}
if (sh->mpm_proto_other_ctx != NULL) {
if (sh->mpm_proto_other_ctx->pattern_cnt == 0) {
MpmFactoryReClaimMpmCtx(sh->mpm_proto_other_ctx);
sh->mpm_proto_other_ctx = NULL;
} else {
if (sh->flags & SIG_GROUP_HAVECONTENT) {
if (mpm_table[sh->mpm_proto_other_ctx->mpm_type].Prepare != NULL) {
mpm_table[sh->mpm_proto_other_ctx->mpm_type].
Prepare(sh->mpm_proto_other_ctx);
}
}
} }
} }
if (sh->mpm_stream_ctx != NULL) { if (sh->mpm_stream_ctx != NULL) {
@ -1556,8 +1708,12 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
} /* if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) */ } /* if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) */
} else { } else {
MpmFactoryReClaimMpmCtx(sh->mpm_ctx); MpmFactoryReClaimMpmCtx(sh->mpm_proto_tcp_ctx);
sh->mpm_ctx = NULL; sh->mpm_proto_tcp_ctx = NULL;
MpmFactoryReClaimMpmCtx(sh->mpm_proto_udp_ctx);
sh->mpm_proto_udp_ctx = NULL;
MpmFactoryReClaimMpmCtx(sh->mpm_proto_other_ctx);
sh->mpm_proto_other_ctx = NULL;
MpmFactoryReClaimMpmCtx(sh->mpm_stream_ctx); MpmFactoryReClaimMpmCtx(sh->mpm_stream_ctx);
sh->mpm_stream_ctx = NULL; sh->mpm_stream_ctx = NULL;
MpmFactoryReClaimMpmCtx(sh->mpm_uri_ctx); MpmFactoryReClaimMpmCtx(sh->mpm_uri_ctx);

101
src/detect.c
Unescape Escape View File

@ -2285,8 +2285,14 @@ static int SignatureCreateMask(Signature *s) {
static void SigInitStandardMpmFactoryContexts(DetectEngineCtx *de_ctx) static void SigInitStandardMpmFactoryContexts(DetectEngineCtx *de_ctx)
{ {
de_ctx->sgh_mpm_context_packet = de_ctx->sgh_mpm_context_proto_tcp_packet =
MpmFactoryRegisterMpmCtxProfile("packet", MpmFactoryRegisterMpmCtxProfile("packet_proto_tcp",
MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD);
de_ctx->sgh_mpm_context_proto_udp_packet =
MpmFactoryRegisterMpmCtxProfile("packet_proto_udp",
MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD);
de_ctx->sgh_mpm_context_proto_other_packet =
MpmFactoryRegisterMpmCtxProfile("packet_proto_other",
MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD); MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD);
de_ctx->sgh_mpm_context_uri = de_ctx->sgh_mpm_context_uri =
MpmFactoryRegisterMpmCtxProfile("uri", MpmFactoryRegisterMpmCtxProfile("uri",
@ -3190,11 +3196,23 @@ int BuildDestinationAddressHeads(DetectEngineCtx *de_ctx, DetectAddressHead *hea
printf("PatternMatchPrepareGroup failed\n"); printf("PatternMatchPrepareGroup failed\n");
goto error; goto error;
} }
if (sgr->sh->mpm_ctx != NULL) { if (sgr->sh->mpm_proto_tcp_ctx != NULL) {
if (de_ctx->mpm_max_patcnt < sgr->sh->mpm_ctx->pattern_cnt) if (de_ctx->mpm_max_patcnt < sgr->sh->mpm_proto_tcp_ctx->pattern_cnt)
de_ctx->mpm_max_patcnt = sgr->sh->mpm_ctx->pattern_cnt; de_ctx->mpm_max_patcnt = sgr->sh->mpm_proto_tcp_ctx->pattern_cnt;
de_ctx->mpm_tot_patcnt += sgr->sh->mpm_proto_tcp_ctx->pattern_cnt;
}
if (sgr->sh->mpm_proto_udp_ctx != NULL) {
if (de_ctx->mpm_max_patcnt < sgr->sh->mpm_proto_udp_ctx->pattern_cnt)
de_ctx->mpm_max_patcnt = sgr->sh->mpm_proto_udp_ctx->pattern_cnt;
de_ctx->mpm_tot_patcnt += sgr->sh->mpm_proto_udp_ctx->pattern_cnt;
}
if (sgr->sh->mpm_proto_other_ctx != NULL) {
if (de_ctx->mpm_max_patcnt < sgr->sh->mpm_proto_other_ctx->pattern_cnt)
de_ctx->mpm_max_patcnt = sgr->sh->mpm_proto_other_ctx->pattern_cnt;
de_ctx->mpm_tot_patcnt += sgr->sh->mpm_ctx->pattern_cnt; de_ctx->mpm_tot_patcnt += sgr->sh->mpm_proto_other_ctx->pattern_cnt;
} }
if (sgr->sh->mpm_uri_ctx != NULL) { if (sgr->sh->mpm_uri_ctx != NULL) {
if (de_ctx->mpm_uri_max_patcnt < sgr->sh->mpm_uri_ctx->pattern_cnt) if (de_ctx->mpm_uri_max_patcnt < sgr->sh->mpm_uri_ctx->pattern_cnt)
@ -3203,8 +3221,14 @@ int BuildDestinationAddressHeads(DetectEngineCtx *de_ctx, DetectAddressHead *hea
de_ctx->mpm_uri_tot_patcnt += sgr->sh->mpm_uri_ctx->pattern_cnt; de_ctx->mpm_uri_tot_patcnt += sgr->sh->mpm_uri_ctx->pattern_cnt;
} }
/* dbg */ /* dbg */
if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && sgr->sh->mpm_ctx) { if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && sgr->sh->mpm_proto_tcp_ctx) {
de_ctx->mpm_memory_size += sgr->sh->mpm_ctx->memory_size; de_ctx->mpm_memory_size += sgr->sh->mpm_proto_tcp_ctx->memory_size;
}
if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && sgr->sh->mpm_proto_udp_ctx) {
de_ctx->mpm_memory_size += sgr->sh->mpm_proto_udp_ctx->memory_size;
}
if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && sgr->sh->mpm_proto_other_ctx) {
de_ctx->mpm_memory_size += sgr->sh->mpm_proto_other_ctx->memory_size;
} }
if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY) && sgr->sh->mpm_uri_ctx) { if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY) && sgr->sh->mpm_uri_ctx) {
de_ctx->mpm_memory_size += sgr->sh->mpm_uri_ctx->memory_size; de_ctx->mpm_memory_size += sgr->sh->mpm_uri_ctx->memory_size;
@ -3441,11 +3465,23 @@ int BuildDestinationAddressHeadsWithBothPorts(DetectEngineCtx *de_ctx, DetectAdd
printf("PatternMatchPrepareGroup failed\n"); printf("PatternMatchPrepareGroup failed\n");
goto error; goto error;
} }
if (dp->sh->mpm_ctx != NULL) { if (dp->sh->mpm_proto_tcp_ctx != NULL) {
if (de_ctx->mpm_max_patcnt < dp->sh->mpm_ctx->pattern_cnt) if (de_ctx->mpm_max_patcnt < dp->sh->mpm_proto_tcp_ctx->pattern_cnt)
de_ctx->mpm_max_patcnt = dp->sh->mpm_ctx->pattern_cnt; de_ctx->mpm_max_patcnt = dp->sh->mpm_proto_tcp_ctx->pattern_cnt;
de_ctx->mpm_tot_patcnt += dp->sh->mpm_proto_tcp_ctx->pattern_cnt;
}
if (dp->sh->mpm_proto_udp_ctx != NULL) {
if (de_ctx->mpm_max_patcnt < dp->sh->mpm_proto_udp_ctx->pattern_cnt)
de_ctx->mpm_max_patcnt = dp->sh->mpm_proto_udp_ctx->pattern_cnt;
de_ctx->mpm_tot_patcnt += dp->sh->mpm_proto_udp_ctx->pattern_cnt;
}
if (dp->sh->mpm_proto_other_ctx != NULL) {
if (de_ctx->mpm_max_patcnt < dp->sh->mpm_proto_other_ctx->pattern_cnt)
de_ctx->mpm_max_patcnt = dp->sh->mpm_proto_other_ctx->pattern_cnt;
de_ctx->mpm_tot_patcnt += dp->sh->mpm_ctx->pattern_cnt; de_ctx->mpm_tot_patcnt += dp->sh->mpm_proto_other_ctx->pattern_cnt;
} }
if (dp->sh->mpm_uri_ctx != NULL) { if (dp->sh->mpm_uri_ctx != NULL) {
if (de_ctx->mpm_uri_max_patcnt < dp->sh->mpm_uri_ctx->pattern_cnt) if (de_ctx->mpm_uri_max_patcnt < dp->sh->mpm_uri_ctx->pattern_cnt)
@ -3454,8 +3490,14 @@ int BuildDestinationAddressHeadsWithBothPorts(DetectEngineCtx *de_ctx, DetectAdd
de_ctx->mpm_uri_tot_patcnt += dp->sh->mpm_uri_ctx->pattern_cnt; de_ctx->mpm_uri_tot_patcnt += dp->sh->mpm_uri_ctx->pattern_cnt;
} }
/* dbg */ /* dbg */
if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && dp->sh->mpm_ctx) { if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && dp->sh->mpm_proto_tcp_ctx) {
de_ctx->mpm_memory_size += dp->sh->mpm_ctx->memory_size; de_ctx->mpm_memory_size += dp->sh->mpm_proto_tcp_ctx->memory_size;
}
if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && dp->sh->mpm_proto_udp_ctx) {
de_ctx->mpm_memory_size += dp->sh->mpm_proto_udp_ctx->memory_size;
}
if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && dp->sh->mpm_proto_other_ctx) {
de_ctx->mpm_memory_size += dp->sh->mpm_proto_other_ctx->memory_size;
} }
if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY) && dp->sh->mpm_uri_ctx) { if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY) && dp->sh->mpm_uri_ctx) {
de_ctx->mpm_memory_size += dp->sh->mpm_uri_ctx->memory_size; de_ctx->mpm_memory_size += dp->sh->mpm_uri_ctx->memory_size;
@ -3854,7 +3896,13 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) {
for ( ; dp != NULL; dp = dp->next) { for ( ; dp != NULL; dp = dp->next) {
printf(" 4 Dst port(range): "); DetectPortPrint(dp); printf(" 4 Dst port(range): "); DetectPortPrint(dp);
printf(" (sigs %" PRIu32 ", sgh %p, maxlen %" PRIu32 ")", dp->sh->sig_cnt, dp->sh, dp->sh->mpm_content_maxlen); printf(" (sigs %" PRIu32 ", sgh %p, maxlen %" PRIu32 ")", dp->sh->sig_cnt, dp->sh, dp->sh->mpm_content_maxlen);
printf(" mpm_ctx %p, mpm_stream_ctx %p", dp->sh->mpm_ctx, dp->sh->mpm_stream_ctx); printf(" mpm_proto_tcp_ctx %p, mpm_prooto_udp_ctx "
"%p, mpm_proto_other_ctx %p mpm_stream_ctx "
"%p",
dp->sh->mpm_proto_tcp_ctx,
dp->sh->mpm_proto_udp_ctx,
dp->sh->mpm_proto_other_ctx,
dp->sh->mpm_stream_ctx);
#ifdef PRINTSIGS #ifdef PRINTSIGS
printf(" - "); printf(" - ");
for (u = 0; u < dp->sh->sig_cnt; u++) { for (u = 0; u < dp->sh->sig_cnt; u++) {
@ -4171,7 +4219,19 @@ int SigGroupBuild (DetectEngineCtx *de_ctx) {
if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) {
MpmCtx *mpm_ctx = NULL; MpmCtx *mpm_ctx = NULL;
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_packet); mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_proto_tcp_packet);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
//printf("packet- %d\n", mpm_ctx->pattern_cnt);
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_proto_udp_packet);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
//printf("packet- %d\n", mpm_ctx->pattern_cnt);
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_proto_other_packet);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
} }
@ -9306,8 +9366,11 @@ static int SigTestSgh05 (void) {
goto end; goto end;
} }
if (sgh->mpm_ctx != NULL) { if (sgh->mpm_proto_tcp_ctx != NULL ||
printf("sgh->mpm_ctx != NULL: "); sgh->mpm_proto_udp_ctx != NULL || sgh->mpm_proto_other_ctx != NULL) {
printf("sgh->mpm_proto_tcp_ctx != NULL || "
"sgh->mpm_proto_udp_ctx != NULL || "
"sgh->mpm_proto_other_ctx != NULL: ");
goto end; goto end;
} }
@ -9317,7 +9380,7 @@ static int SigTestSgh05 (void) {
} }
if (sgh->mpm_stream_ctx->mpm_type != MPM_WUMANBER) { if (sgh->mpm_stream_ctx->mpm_type != MPM_WUMANBER) {
printf("sgh->mpm_type != MPM_WUMANBER, expected %d, got %d: ", MPM_WUMANBER, sgh->mpm_ctx->mpm_type); printf("sgh->mpm_type != MPM_WUMANBER, expected %d, got %d: ", MPM_WUMANBER, sgh->mpm_stream_ctx->mpm_type);
goto end; goto end;
} }

8
src/detect.h
Unescape Escape View File

@ -630,7 +630,9 @@ typedef struct DetectEngineCtx_ {
uint32_t sgh_array_cnt; uint32_t sgh_array_cnt;
uint32_t sgh_array_size; uint32_t sgh_array_size;
int32_t sgh_mpm_context_packet; int32_t sgh_mpm_context_proto_tcp_packet;
int32_t sgh_mpm_context_proto_udp_packet;
int32_t sgh_mpm_context_proto_other_packet;
int32_t sgh_mpm_context_stream; int32_t sgh_mpm_context_stream;
int32_t sgh_mpm_context_uri; int32_t sgh_mpm_context_uri;
int32_t sgh_mpm_context_hcbd; int32_t sgh_mpm_context_hcbd;
@ -869,7 +871,9 @@ typedef struct SigGroupHead_ {
SignatureHeader *head_array; SignatureHeader *head_array;
/* pattern matcher instances */ /* pattern matcher instances */
MpmCtx *mpm_ctx; MpmCtx *mpm_proto_other_ctx;
MpmCtx *mpm_proto_tcp_ctx;
MpmCtx *mpm_proto_udp_ctx;
MpmCtx *mpm_stream_ctx; MpmCtx *mpm_stream_ctx;
MpmCtx *mpm_uri_ctx; MpmCtx *mpm_uri_ctx;
MpmCtx *mpm_hcbd_ctx; MpmCtx *mpm_hcbd_ctx;

Write Preview
Loading…
Cancel
Save