From cbf80de6fe6de423344a40597aca1891b192fed2 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Mon, 12 Oct 2015 21:48:41 +0200 Subject: [PATCH] detect-port: cleanup --- src/detect-engine-port.c | 41 ---------------------------------------- src/detect.h | 14 +++----------- 2 files changed, 3 insertions(+), 52 deletions(-) diff --git a/src/detect-engine-port.c b/src/detect-engine-port.c index ac530f1d98..f8c2e48f2f 100644 --- a/src/detect-engine-port.c +++ b/src/detect-engine-port.c @@ -99,13 +99,6 @@ void DetectPortFree(DetectPort *dp) } dp->sh = NULL; - if (dp->dst_ph != NULL && !(dp->flags & PORT_GROUP_PORTS_COPY)) { - DetectPortCleanupList(dp->dst_ph); - } - dp->dst_ph = NULL; - - //BUG_ON(dp->next != NULL); - detect_port_memory -= sizeof(DetectPort); detect_port_free_cnt++; SCFree(dp); @@ -289,7 +282,6 @@ int DetectPortInsert(DetectEngineCtx *de_ctx, DetectPort **head, /* exact overlap/match */ if (cur != new) { SigGroupHeadCopySigs(de_ctx, new->sh, &cur->sh); - cur->cnt += new->cnt; DetectPortFree(new); return 0; } @@ -421,9 +413,6 @@ static int DetectPortCut(DetectEngineCtx *de_ctx, DetectPort *a, SigGroupHeadCopySigs(de_ctx,b->sh,&tmp_c->sh); /* copy old b to c */ SigGroupHeadCopySigs(de_ctx,a->sh,&b->sh); /* copy a to b */ - tmp_c->cnt += b->cnt; - b->cnt += a->cnt; - /** * We have 3 parts: [bbb[baba]aaa] * part a: b_port1 <-> a_port1 - 1 @@ -461,13 +450,6 @@ static int DetectPortCut(DetectEngineCtx *de_ctx, DetectPort *a, SigGroupHeadClearSigs(tmp->sh); /* clean tmp list */ - tmp->cnt += a->cnt; - a->cnt = 0; - tmp_c->cnt += tmp->cnt; - a->cnt += b->cnt; - b->cnt += tmp->cnt; - tmp->cnt = 0; - /** * We have 2 or three parts: * @@ -497,7 +479,6 @@ static int DetectPortCut(DetectEngineCtx *de_ctx, DetectPort *a, /** 'b' overlaps 'a' so 'a' needs the 'b' sigs */ SigGroupHeadCopySigs(de_ctx,b->sh,&a->sh); - a->cnt += b->cnt; } else if (a_port2 == b_port2) { SCLogDebug("2"); @@ -514,12 +495,9 @@ static int DetectPortCut(DetectEngineCtx *de_ctx, DetectPort *a, * clear a * copy tmp to a */ SigGroupHeadCopySigs(de_ctx,b->sh,&tmp->sh); /* store old a list */ - tmp->cnt = b->cnt; SigGroupHeadCopySigs(de_ctx,a->sh,&b->sh); - b->cnt += a->cnt; SigGroupHeadClearSigs(a->sh); /* clean a list */ SigGroupHeadCopySigs(de_ctx,tmp->sh,&a->sh);/* merge old a with b */ - a->cnt = tmp->cnt; SigGroupHeadClearSigs(tmp->sh); /* clean tmp list */ } else { SCLogDebug("3"); @@ -551,13 +529,6 @@ static int DetectPortCut(DetectEngineCtx *de_ctx, DetectPort *a, SigGroupHeadCopySigs(de_ctx,tmp->sh,&b->sh);/* merge old a with b */ SigGroupHeadClearSigs(tmp->sh); /* clean tmp list */ - - tmp->cnt += a->cnt; - a->cnt = 0; - tmp_c->cnt += b->cnt; - a->cnt += b->cnt; - b->cnt += tmp->cnt; - tmp->cnt = 0; } /** * We have 2 or three parts: @@ -594,12 +565,6 @@ static int DetectPortCut(DetectEngineCtx *de_ctx, DetectPort *a, SigGroupHeadClearSigs(tmp->sh); - tmp->cnt += b->cnt; - b->cnt = 0; - b->cnt += a->cnt; - a->cnt += tmp->cnt; - tmp->cnt = 0; - } else if (a_port2 == b_port2) { SCLogDebug("2"); @@ -612,8 +577,6 @@ static int DetectPortCut(DetectEngineCtx *de_ctx, DetectPort *a, /** 'a' overlaps 'b' so 'b' needs the 'a' sigs */ SigGroupHeadCopySigs(de_ctx,a->sh,&b->sh); - b->cnt += a->cnt; - } else { SCLogDebug("3"); a->port = a_port1; @@ -634,9 +597,6 @@ static int DetectPortCut(DetectEngineCtx *de_ctx, DetectPort *a, SigGroupHeadCopySigs(de_ctx,a->sh,&b->sh); SigGroupHeadCopySigs(de_ctx,a->sh,&tmp_c->sh); - - b->cnt += a->cnt; - tmp_c->cnt += a->cnt; } } @@ -899,7 +859,6 @@ int DetectPortJoin(DetectEngineCtx *de_ctx, DetectPort *target, if (target == NULL || source == NULL) return -1; - target->cnt += source->cnt; SigGroupHeadCopySigs(de_ctx,source->sh,&target->sh); if (source->port < target->port) diff --git a/src/detect.h b/src/detect.h index 9ef5f18dd9..b5cba45460 100644 --- a/src/detect.h +++ b/src/detect.h @@ -237,27 +237,19 @@ enum { #define PORT_FLAG_ANY 0x01 /**< 'any' special port */ #define PORT_FLAG_NOT 0x02 /**< negated port */ #define PORT_SIGGROUPHEAD_COPY 0x04 /**< sgh is a ptr copy */ -#define PORT_GROUP_PORTS_COPY 0x08 /**< dst_ph is a ptr copy */ /** \brief Port structure for detection engine */ typedef struct DetectPort_ { uint16_t port; uint16_t port2; + uint8_t flags; /**< flags for this port */ + /* signatures that belong in this group */ struct SigGroupHead_ *sh; - struct DetectPort_ *dst_ph; - - /* double linked list */ - union { - struct DetectPort_ *prev; - struct DetectPort_ *hnext; /* hash next */ - }; + struct DetectPort_ *prev; struct DetectPort_ *next; - - uint32_t cnt; - uint8_t flags; /**< flags for this port */ } DetectPort; /* Signature flags */