aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Use sm_list to differentiate between different content types while retrieving pattern ids instead of sm_type

Browse Source
remotes/origin/HEAD
Anoop Saldanha 14 years ago committed by Victor Julien
parent 83d9439877
commit dcb2afb02f
12 changed files with 23 additions and 23 deletions
Show Stats Download Patch File Download Diff File

4
src/detect-content.c
Unescape Escape View File

@ -501,14 +501,14 @@ static int DetectContentSetup (DetectEngineCtx *de_ctx, Signature *s, char *cont
sm->type = DETECT_CONTENT;
sm->ctx = (void *)cd;
cd->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, cd, DETECT_CONTENT);
cd->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, cd, DETECT_SM_LIST_PMATCH);
DetectContentPrint(cd);
SigMatchAppendPayload(s, sm);
if (s->init_flags & SIG_FLAG_INIT_FILE_DATA) {
cd->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, cd, DETECT_AL_HTTP_SERVER_BODY);
cd->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, cd, DETECT_SM_LIST_HSBDMATCH);
sm->type = DETECT_AL_HTTP_SERVER_BODY;
/* transfer the sm from the pmatch list to hsbdmatch list */

22
src/detect-engine-mpm.c
Unescape Escape View File

@ -2448,7 +2448,7 @@ typedef struct MpmPatternIdTableElmt_ {
uint16_t pattern_len; /**< pattern len */
PatIntId id; /**< pattern id */
uint16_t dup_count; /**< duplicate count */
uint8_t sm_type; /**< SigMatch type */
uint8_t sm_list; /**< SigMatch list */
} MpmPatternIdTableElmt;
/** \brief Hash compare func for MpmPatternId api
@ -2464,7 +2464,7 @@ static char MpmPatternIdCompare(void *p1, uint16_t len1, void *p2, uint16_t len2
MpmPatternIdTableElmt *e2 = (MpmPatternIdTableElmt *)p2;
if (e1->pattern_len != e2->pattern_len ||
e1->sm_type != e2->sm_type) {
e1->sm_list != e2->sm_list) {
SCReturnInt(0);
}
@ -2613,7 +2613,7 @@ uint32_t DetectUricontentGetId(MpmPatternIdStore *ht, DetectContentData *co) {
BUG_ON(e->pattern == NULL);
memcpy(e->pattern, co->content, co->content_len);
e->pattern_len = co->content_len;
e->sm_type = DETECT_URICONTENT;
e->sm_list = DETECT_SM_LIST_UMATCH;
e->dup_count = 1;
e->id = 0;
@ -2658,7 +2658,7 @@ uint32_t DetectUricontentGetId(MpmPatternIdStore *ht, DetectContentData *co) {
*
* \retval id Pattern id.
*/
uint32_t DetectPatternGetId(MpmPatternIdStore *ht, void *ctx, uint8_t sm_type)
uint32_t DetectPatternGetId(MpmPatternIdStore *ht, void *ctx, uint8_t sm_list)
{
SCEnter();
@ -2679,7 +2679,7 @@ uint32_t DetectPatternGetId(MpmPatternIdStore *ht, void *ctx, uint8_t sm_type)
memcpy(e->pattern, cd->content, cd->content_len);
e->pattern_len = cd->content_len;
e->dup_count = 1;
e->sm_type = sm_type;
e->sm_list = sm_list;
e->id = 0;
r = HashTableLookup(ht->hash, (void *)e, sizeof(MpmPatternIdTableElmt));
@ -2687,7 +2687,7 @@ uint32_t DetectPatternGetId(MpmPatternIdStore *ht, void *ctx, uint8_t sm_type)
/* we don't have a duplicate with this pattern + id type. If the id is
* for content, then it is the first entry for such a
* pattern + id combination. Let us create an entry for it */
if (sm_type == DETECT_CONTENT) {
if (sm_list == DETECT_SM_LIST_PMATCH) {
e->id = ht->max_id;
ht->max_id++;
id = e->id;
@ -2704,7 +2704,7 @@ uint32_t DetectPatternGetId(MpmPatternIdStore *ht, void *ctx, uint8_t sm_type)
* So we would have seen a content before coming across this http_
* modifier. Let's retrieve this content entry that has already
* been registered. */
e->sm_type = DETECT_CONTENT;
e->sm_list = DETECT_SM_LIST_PMATCH;
MpmPatternIdTableElmt *tmp_r = HashTableLookup(ht->hash, (void *)e, sizeof(MpmPatternIdTableElmt));
if (tmp_r == NULL) {
SCLogError(SC_ERR_FATAL, "How can this happen? We have to have "
@ -2717,7 +2717,7 @@ uint32_t DetectPatternGetId(MpmPatternIdStore *ht, void *ctx, uint8_t sm_type)
* first entry made(dup_count is 1) for that content. Let us just
* reset the sm_type to the http_ keyword's sm_type */
if (tmp_r->dup_count == 1) {
tmp_r->sm_type = sm_type;
tmp_r->sm_list = sm_list;
id = tmp_r->id;
/* interestingly we have more than one entry for this content.
@ -2727,7 +2727,7 @@ uint32_t DetectPatternGetId(MpmPatternIdStore *ht, void *ctx, uint8_t sm_type)
} else {
tmp_r->dup_count--;
/* reset the sm_type, since we changed it to DETECT_CONTENT prev */
e->sm_type = sm_type;
e->sm_list = sm_list;
e->id = ht->max_id;
ht->max_id++;
id = e->id;
@ -2743,7 +2743,7 @@ uint32_t DetectPatternGetId(MpmPatternIdStore *ht, void *ctx, uint8_t sm_type)
} else {
/* oh cool! It is a duplicate for content, uricontent types. Update the
* dup_count and get out */
if (sm_type == DETECT_CONTENT) {
if (sm_list == DETECT_SM_LIST_PMATCH) {
r->dup_count++;
id = r->id;
goto end;
@ -2756,7 +2756,7 @@ uint32_t DetectPatternGetId(MpmPatternIdStore *ht, void *ctx, uint8_t sm_type)
/* let's get the content entry associated with the http keyword we are
* currently operating on */
e->sm_type = DETECT_CONTENT;
e->sm_list = DETECT_SM_LIST_PMATCH;
MpmPatternIdTableElmt *tmp_r = HashTableLookup(ht->hash, (void *)e, sizeof(MpmPatternIdTableElmt));
if (tmp_r == NULL) {
SCLogError(SC_ERR_FATAL, "How can this happen? We have to have "

2
src/detect-http-client-body.c
Unescape Escape View File

@ -162,7 +162,7 @@ int DetectHttpClientBodySetup(DetectEngineCtx *de_ctx, Signature *s, char *arg)
tmp_cd->flags |= DETECT_CONTENT_RELATIVE_NEXT;
}
}
cd->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, cd, DETECT_AL_HTTP_CLIENT_BODY);
cd->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, cd, DETECT_SM_LIST_HCBDMATCH);
sm->type = DETECT_AL_HTTP_CLIENT_BODY;
/* transfer the sm from the pmatch list to hcbdmatch list */

2
src/detect-http-cookie.c
Unescape Escape View File

@ -180,7 +180,7 @@ static int DetectHttpCookieSetup (DetectEngineCtx *de_ctx, Signature *s, char *s
tmp_cd->flags |= DETECT_CONTENT_RELATIVE_NEXT;
}
}
cd->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, cd, DETECT_AL_HTTP_COOKIE);
cd->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, cd, DETECT_SM_LIST_HCDMATCH);
sm->type = DETECT_AL_HTTP_COOKIE;
/* transfer the sm from the pmatch list to hcdmatch list */

2
src/detect-http-header.c
Unescape Escape View File

@ -186,7 +186,7 @@ int DetectHttpHeaderSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg)
tmp_cd->flags |= DETECT_CONTENT_RELATIVE_NEXT;
}
}
cd->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, cd, DETECT_AL_HTTP_HEADER);
cd->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, cd, DETECT_SM_LIST_HHDMATCH);
sm->type = DETECT_AL_HTTP_HEADER;
/* transfer the sm from the pmatch list to hhdmatch list */

2
src/detect-http-method.c
Unescape Escape View File

@ -163,7 +163,7 @@ static int DetectHttpMethodSetup(DetectEngineCtx *de_ctx, Signature *s, char *st
tmp_cd->flags |= DETECT_CONTENT_RELATIVE_NEXT;
}
}
cd->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, cd, DETECT_AL_HTTP_METHOD);
cd->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, cd, DETECT_SM_LIST_HMDMATCH);
sm->type = DETECT_AL_HTTP_METHOD;
/* transfer the sm from the pmatch list to hmdmatch list */

2
src/detect-http-raw-header.c
Unescape Escape View File

@ -184,7 +184,7 @@ int DetectHttpRawHeaderSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg)
tmp_cd->flags |= DETECT_CONTENT_RELATIVE_NEXT;
}
}
cd->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, cd, DETECT_AL_HTTP_RAW_HEADER);
cd->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, cd, DETECT_SM_LIST_HRUDMATCH);
sm->type = DETECT_AL_HTTP_RAW_HEADER;
/* transfer the sm from the pmatch list to hrhdmatch list */

2
src/detect-http-raw-uri.c
Unescape Escape View File

@ -156,7 +156,7 @@ static int DetectHttpRawUriSetup(DetectEngineCtx *de_ctx, Signature *s, char *ar
tmp_cd->flags |= DETECT_CONTENT_RELATIVE_NEXT;
}
}
cd->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, cd, DETECT_AL_HTTP_RAW_URI);
cd->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, cd, DETECT_SM_LIST_HRUDMATCH);
sm->type = DETECT_AL_HTTP_RAW_URI;
/* transfer the sm from the pmatch list to hrudmatch list */

2
src/detect-http-server-body.c
Unescape Escape View File

@ -163,7 +163,7 @@ int DetectHttpServerBodySetup(DetectEngineCtx *de_ctx, Signature *s, char *arg)
tmp_cd->flags |= DETECT_CONTENT_RELATIVE_NEXT;
}
}
cd->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, cd, DETECT_AL_HTTP_SERVER_BODY);
cd->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, cd, DETECT_SM_LIST_HSBDMATCH);
sm->type = DETECT_AL_HTTP_SERVER_BODY;
/* transfer the sm from the pmatch list to hsbdmatch list */

2
src/detect-http-stat-code.c
Unescape Escape View File

@ -284,7 +284,7 @@ static int DetectHttpStatCodeSetup (DetectEngineCtx *de_ctx, Signature *s, char
tmp_cd->flags |= DETECT_CONTENT_RELATIVE_NEXT;
}
}
cd->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, cd, DETECT_AL_HTTP_STAT_CODE);
cd->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, cd, DETECT_SM_LIST_HSCDMATCH);
sm->type = DETECT_AL_HTTP_STAT_CODE;
/* transfer the sm from the pmatch list to hcbdmatch list */

2
src/detect-http-stat-msg.c
Unescape Escape View File

@ -278,7 +278,7 @@ static int DetectHttpStatMsgSetup (DetectEngineCtx *de_ctx, Signature *s, char *
tmp_cd->flags |= DETECT_CONTENT_RELATIVE_NEXT;
}
}
cd->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, cd, DETECT_AL_HTTP_STAT_MSG);
cd->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, cd, DETECT_SM_LIST_HSMDMATCH);
sm->type = DETECT_AL_HTTP_STAT_MSG;
/* transfer the sm from the pmatch list to hcbdmatch list */

2
src/detect-http-uri.c
Unescape Escape View File

@ -149,7 +149,7 @@ static int DetectHttpUriSetup (DetectEngineCtx *de_ctx, Signature *s, char *str)
DetectContentData *tmp_cd = (DetectContentData *)pm->ctx;
tmp_cd->flags |= DETECT_CONTENT_RELATIVE_NEXT;
}
cd->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, cd, DETECT_URICONTENT);
cd->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, cd, DETECT_SM_LIST_UMATCH);
sm->type = DETECT_URICONTENT;
/* transfer the sm from the pmatch list to hcbdmatch list */

Write Preview
Loading…
Cancel
Save