aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Removed Signature->order_id and replaced it with Signature->num.

Browse Source
pull/363/merge
Anoop Saldanha 12 years ago committed by Victor Julien
parent 43d1229dfa
commit ab1f8afbc3
5 changed files with 13 additions and 186 deletions
Show Stats Download Patch File Download Diff File

6
src/detect-engine-alert.c
Unescape Escape View File

@ -164,24 +164,22 @@ int PacketAlertAppend(DetectEngineThreadCtx *det_ctx, Signature *s, Packet *p, u
/* It should be usually the last, so check it before iterating */
if (p->alerts.cnt == 0 || (p->alerts.cnt > 0 &&
p->alerts.alerts[p->alerts.cnt - 1].order_id < s->order_id)) {
p->alerts.alerts[p->alerts.cnt - 1].num < s->num)) {
/* We just add it */
p->alerts.alerts[p->alerts.cnt].num = s->num;
p->alerts.alerts[p->alerts.cnt].order_id = s->order_id;
p->alerts.alerts[p->alerts.cnt].action = s->action;
p->alerts.alerts[p->alerts.cnt].flags = flags;
p->alerts.alerts[p->alerts.cnt].s = s;
} else {
/* We need to make room for this s->num
(a bit ugly with memcpy but we are planning changes here)*/
for (i = p->alerts.cnt - 1; i >= 0 && p->alerts.alerts[i].order_id > s->order_id; i--) {
for (i = p->alerts.cnt - 1; i >= 0 && p->alerts.alerts[i].num > s->num; i--) {
memcpy(&p->alerts.alerts[i + 1], &p->alerts.alerts[i], sizeof(PacketAlert));
}
i++; /* The right place to store the alert */
p->alerts.alerts[i].num = s->num;
p->alerts.alerts[i].order_id = s->order_id;
p->alerts.alerts[i].action = s->action;
p->alerts.alerts[i].flags = flags;
p->alerts.alerts[i].s = s;

13
src/detect-engine-sigorder.c
Unescape Escape View File

@ -133,7 +133,9 @@ static inline int SCSigGetFlowbitsType(Signature *sig)
fb->cmd == DETECT_FLOWBITS_CMD_ISSET) {
read++;
} else {
#ifdef DEBUG
BUG_ON(1);
#endif
}
}
@ -149,7 +151,9 @@ static inline int SCSigGetFlowbitsType(Signature *sig)
fb->cmd == DETECT_FLOWBITS_CMD_TOGGLE) {
write++;
} else {
#ifdef DEBUG
BUG_ON(1);
#endif
}
}
@ -189,7 +193,9 @@ static inline int SCSigGetFlowintType(Signature *sig)
fi->modifier == FLOWINT_MODIFIER_ISSET) {
read++;
} else {
#ifdef DEBUG
BUG_ON(1);
#endif
}
}
@ -205,7 +211,9 @@ static inline int SCSigGetFlowintType(Signature *sig)
fi->modifier == FLOWINT_MODIFIER_SUB) {
write++;
} else {
#ifdef DEBUG
BUG_ON(1);
#endif
}
}
@ -1990,6 +1998,7 @@ static int SCSigOrderingTest12(void)
FLOW_INITIALIZE(&f);
f.flags |= FLOW_IPV4;
f.alproto = ALPROTO_UNKNOWN;
f.proto = IPPROTO_TCP;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
@ -2008,8 +2017,8 @@ static int SCSigOrderingTest12(void)
goto end;
if (sig->next->next != NULL)
goto end;
//if (de_ctx->signum != 2)
// goto end;
if (de_ctx->signum != 2)
goto end;
FlowInitConfig(FLOW_QUIET);
p = UTHBuildPacket(buf, sizeof(buf), IPPROTO_TCP);

2
src/detect.c
Unescape Escape View File

@ -4405,11 +4405,9 @@ int SigGroupBuild(DetectEngineCtx *de_ctx)
* reset the old signums and assign new signums. We would
* have experienced Sig reordering by now, hence the new
* signums. */
SigIntId sig_id = 0;
de_ctx->signum = 0;
while (s != NULL) {
s->num = de_ctx->signum++;
s->order_id = sig_id++;
s = s->next;
}

2
src/detect.h
Unescape Escape View File

@ -387,8 +387,6 @@ typedef struct Signature_ {
uint32_t hdr_copy3;
};
SigIntId order_id;
/** inline -- action */
uint8_t action;
uint8_t file_flags;

176
src/util-action.c
Unescape Escape View File

@ -468,17 +468,6 @@ int UtilActionTest08(void)
SCSigRegisterSignatureOrderingFuncs(de_ctx);
SCSigOrderSignatures(de_ctx);
Signature *s = de_ctx->sig_list;
uint16_t sig_id = 0;
/* Assing the internal id after sorting, so the IP Only engine
* process them in order too */
while (s != NULL) {
s->order_id = sig_id++;
s = s->next;
}
de_ctx->signum = sig_id;
res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
cleanup:
@ -551,17 +540,6 @@ int UtilActionTest09(void)
SCSigRegisterSignatureOrderingFuncs(de_ctx);
SCSigOrderSignatures(de_ctx);
Signature *s = de_ctx->sig_list;
uint16_t sig_id = 0;
/* Assing the internal id after sorting, so the IP Only engine
* process them in order too */
while (s != NULL) {
s->order_id = sig_id++;
s = s->next;
}
de_ctx->signum = sig_id;
res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
cleanup:
@ -633,17 +611,6 @@ int UtilActionTest10(void)
SCSigRegisterSignatureOrderingFuncs(de_ctx);
SCSigOrderSignatures(de_ctx);
Signature *s = de_ctx->sig_list;
uint16_t sig_id = 0;
/* Assing the internal id after sorting, so the IP Only engine
* process them in order too */
while (s != NULL) {
s->order_id = sig_id++;
s = s->next;
}
de_ctx->signum = sig_id;
res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
cleanup:
@ -718,17 +685,6 @@ int UtilActionTest11(void)
SCSigRegisterSignatureOrderingFuncs(de_ctx);
SCSigOrderSignatures(de_ctx);
Signature *s = de_ctx->sig_list;
uint16_t sig_id = 0;
/* Assing the internal id after sorting, so the IP Only engine
* process them in order too */
while (s != NULL) {
s->order_id = sig_id++;
s = s->next;
}
de_ctx->signum = sig_id;
res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
cleanup:
@ -796,17 +752,6 @@ int UtilActionTest12(void)
SCSigRegisterSignatureOrderingFuncs(de_ctx);
SCSigOrderSignatures(de_ctx);
Signature *s = de_ctx->sig_list;
uint16_t sig_id = 0;
/* Assing the internal id after sorting, so the IP Only engine
* process them in order too */
while (s != NULL) {
s->order_id = sig_id++;
s = s->next;
}
de_ctx->signum = sig_id;
res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
cleanup:
@ -877,17 +822,6 @@ int UtilActionTest13(void)
SCSigRegisterSignatureOrderingFuncs(de_ctx);
SCSigOrderSignatures(de_ctx);
Signature *s = de_ctx->sig_list;
uint16_t sig_id = 0;
/* Assing the internal id after sorting, so the IP Only engine
* process them in order too */
while (s != NULL) {
s->order_id = sig_id++;
s = s->next;
}
de_ctx->signum = sig_id;
res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
cleanup:
@ -964,17 +898,6 @@ int UtilActionTest14(void)
SCSigRegisterSignatureOrderingFuncs(de_ctx);
SCSigOrderSignatures(de_ctx);
Signature *s = de_ctx->sig_list;
uint16_t sig_id = 0;
/* Assing the internal id after sorting, so the IP Only engine
* process them in order too */
while (s != NULL) {
s->order_id = sig_id++;
s = s->next;
}
de_ctx->signum = sig_id;
res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
cleanup:
@ -1044,17 +967,6 @@ int UtilActionTest15(void)
SCSigRegisterSignatureOrderingFuncs(de_ctx);
SCSigOrderSignatures(de_ctx);
Signature *s = de_ctx->sig_list;
uint16_t sig_id = 0;
/* Assing the internal id after sorting, so the IP Only engine
* process them in order too */
while (s != NULL) {
s->order_id = sig_id++;
s = s->next;
}
de_ctx->signum = sig_id;
res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
cleanup:
@ -1119,17 +1031,6 @@ int UtilActionTest16(void)
SCSigRegisterSignatureOrderingFuncs(de_ctx);
SCSigOrderSignatures(de_ctx);
Signature *s = de_ctx->sig_list;
uint16_t sig_id = 0;
/* Assing the internal id after sorting, so the IP Only engine
* process them in order too */
while (s != NULL) {
s->order_id = sig_id++;
s = s->next;
}
de_ctx->signum = sig_id;
res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
cleanup:
@ -1194,17 +1095,6 @@ int UtilActionTest17(void)
SCSigRegisterSignatureOrderingFuncs(de_ctx);
SCSigOrderSignatures(de_ctx);
Signature *s = de_ctx->sig_list;
uint16_t sig_id = 0;
/* Assing the internal id after sorting, so the IP Only engine
* process them in order too */
while (s != NULL) {
s->order_id = sig_id++;
s = s->next;
}
de_ctx->signum = sig_id;
res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
cleanup:
@ -1274,17 +1164,6 @@ int UtilActionTest18(void)
SCSigRegisterSignatureOrderingFuncs(de_ctx);
SCSigOrderSignatures(de_ctx);
Signature *s = de_ctx->sig_list;
uint16_t sig_id = 0;
/* Assing the internal id after sorting, so the IP Only engine
* process them in order too */
while (s != NULL) {
s->order_id = sig_id++;
s = s->next;
}
de_ctx->signum = sig_id;
res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
cleanup:
@ -1360,17 +1239,6 @@ int UtilActionTest19(void)
SCSigRegisterSignatureOrderingFuncs(de_ctx);
SCSigOrderSignatures(de_ctx);
Signature *s = de_ctx->sig_list;
uint16_t sig_id = 0;
/* Assing the internal id after sorting, so the IP Only engine
* process them in order too */
while (s != NULL) {
s->order_id = sig_id++;
s = s->next;
}
de_ctx->signum = sig_id;
res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
cleanup:
@ -1446,17 +1314,6 @@ int UtilActionTest20(void)
SCSigRegisterSignatureOrderingFuncs(de_ctx);
SCSigOrderSignatures(de_ctx);
Signature *s = de_ctx->sig_list;
uint16_t sig_id = 0;
/* Assing the internal id after sorting, so the IP Only engine
* process them in order too */
while (s != NULL) {
s->order_id = sig_id++;
s = s->next;
}
de_ctx->signum = sig_id;
res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
cleanup:
@ -1526,17 +1383,6 @@ int UtilActionTest21(void)
SCSigRegisterSignatureOrderingFuncs(de_ctx);
SCSigOrderSignatures(de_ctx);
Signature *s = de_ctx->sig_list;
uint16_t sig_id = 0;
/* Assing the internal id after sorting, so the IP Only engine
* process them in order too */
while (s != NULL) {
s->order_id = sig_id++;
s = s->next;
}
de_ctx->signum = sig_id;
res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
cleanup:
@ -1612,17 +1458,6 @@ int UtilActionTest22(void)
SCSigRegisterSignatureOrderingFuncs(de_ctx);
SCSigOrderSignatures(de_ctx);
Signature *s = de_ctx->sig_list;
uint16_t sig_id = 0;
/* Assing the internal id after sorting, so the IP Only engine
* process them in order too */
while (s != NULL) {
s->order_id = sig_id++;
s = s->next;
}
de_ctx->signum = sig_id;
res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
cleanup:
@ -1698,17 +1533,6 @@ int UtilActionTest23(void)
SCSigRegisterSignatureOrderingFuncs(de_ctx);
SCSigOrderSignatures(de_ctx);
Signature *s = de_ctx->sig_list;
uint16_t sig_id = 0;
/* Assing the internal id after sorting, so the IP Only engine
* process them in order too */
while (s != NULL) {
s->order_id = sig_id++;
s = s->next;
}
de_ctx->signum = sig_id;
res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3);
cleanup:

Write Preview
Loading…
Cancel
Save