From 9e5e78104d6c1ee30d71ae7f8066f3b6b68a7ea9 Mon Sep 17 00:00:00 2001 From: Pablo Rincon Date: Fri, 12 Mar 2010 19:22:01 +0100 Subject: [PATCH] Inline functions --- src/counters.c | 209 ---------------- src/counters.h | 221 +++++++++++++++++- src/decode-icmpv4.c | 52 ---- src/decode-icmpv4.h | 56 +++++- src/decode-icmpv6.c | 71 ------ src/decode-icmpv6.h | 76 ++++++- src/decode-ipv4.c | 56 +----- src/decode-ipv4.h | 61 +++++- src/decode-tcp.c | 122 ---------- src/decode-tcp.h | 129 ++++++++++- src/decode-udp.c | 120 ---------- src/decode-udp.h | 127 ++++++++++- src/decode.c | 20 -- src/decode.h | 28 ++- src/detect-classtype.c | 80 +++---- src/detect-classtype.h | 31 +++ src/detect-content.c | 55 ----- src/detect-content.h | 59 +++++ src/detect-dce-iface.c | 94 +++----- src/detect-dce-iface.h | 30 +++ src/detect-dce-opnum.c | 98 +++----- src/detect-dce-opnum.h | 24 ++ src/detect-engine-address.h | 3 +- src/detect-engine-port.h | 4 + src/detect-engine-sigorder.c | 199 ---------------- src/detect-engine-sigorder.h | 224 ++++++++++++++++++ src/detect-fast-pattern.c | 5 - src/detect-fast-pattern.h | 1 - src/detect-stream_size.c | 44 ---- src/detect-stream_size.h | 47 ++++ src/detect-uricontent.c | 129 ---------- src/detect-uricontent.h | 132 +++++++++++ src/detect.c | 54 ----- src/detect.h | 100 +++++++-- src/flow.c | 36 --- src/flow.h | 38 +++ src/stream-tcp.c | 33 --- src/stream-tcp.h | 42 ++++ src/suricata-common.h | 31 +++ src/suricata.h | 4 - src/tm-threads.c | 100 -------- src/tm-threads.h | 113 +++++++++- src/util-byte.c | 335 -------------------------- src/util-byte.h | 365 +++++++++++++++++++++++++++- src/util-classification-config.c | 203 +--------------- src/util-classification-config.h | 197 +++++++++++++++ src/util-debug-filters.c | 289 +---------------------- src/util-debug-filters.h | 297 +++++++++++++++++++++++ src/util-debug.c | 472 +------------------------------------ src/util-debug.h | 485 +++++++++++++++++++++++++++++++++++++- src/util-mpm-b2g-cuda.c | 326 ------------------------- src/util-mpm-b2g-cuda.h | 321 +++++++++++++++++++++++++ src/util-mpm-b2g.c | 305 ------------------------ src/util-mpm-b2g.h | 291 +++++++++++++++++++++++ src/util-mpm-b3g.c | 275 --------------------- src/util-mpm-b3g.h | 285 ++++++++++++++++++++++ src/util-mpm-wumanber.c | 290 +---------------------- src/util-mpm-wumanber.h | 260 ++++++++++++++++++++ src/util-mpm.c | 105 -------- src/util-mpm.h | 111 +++++++++- src/util-radix-tree.c | 106 +-------- src/util-radix-tree.h | 111 +++++++++ src/util-spm-bm.c | 234 ------------------ src/util-spm-bm.h | 254 +++++++++++++++++++- src/util-spm-bs.c | 90 +------- src/util-spm-bs.h | 96 ++++++++- src/util-spm-bs2bm.c | 142 +----------- src/util-spm-bs2bm.h | 151 ++++++++++++- src/util-spm.c | 108 +-------- src/util-spm.h | 92 +++++++- 70 files changed, 4961 insertions(+), 4793 deletions(-) diff --git a/src/counters.c b/src/counters.c index 5fb41f7..56e4df1 100644 --- a/src/counters.c +++ b/src/counters.c @@ -1278,215 +1278,6 @@ int SCPerfCounterDisplay(uint16_t id, SCPerfContext *pctx, int disp) } /** - * \brief Increments the local counter - * - * \param id Index of the counter in the counter array - * \param pca Counter array that holds the local counters for this TM - */ -inline void SCPerfCounterIncr(uint16_t id, SCPerfCounterArray *pca) -{ - if (pca == NULL) { - SCLogDebug("counterarray is NULL"); - return; - } - if ((id < 1) || (id > pca->size)) { - SCLogDebug("counter doesn't exist"); - return; - } - - switch (pca->head[id].pc->value->type) { - case SC_PERF_TYPE_UINT64: - pca->head[id].ui64_cnt++; - break; - case SC_PERF_TYPE_DOUBLE: - pca->head[id].d_cnt++; - break; - } - - if (pca->head[id].syncs == ULONG_MAX) { - pca->head[id].syncs = 0; - pca->head[id].wrapped_syncs++; - } - pca->head[id].syncs++; - - return; -} - -/** - * \brief Adds a value of type uint64_t to the local counter. - * - * \param id ID of the counter as set by the API - * \param pca Counter array that holds the local counter for this TM - * \param x Value to add to this local counter - */ -inline void SCPerfCounterAddUI64(uint16_t id, SCPerfCounterArray *pca, uint64_t x) -{ - if (!pca) { - SCLogDebug("counterarray is NULL"); - return; - } - if ((id < 1) || (id > pca->size)) { - SCLogDebug("counter doesn't exist"); - return; - } - - switch (pca->head[id].pc->value->type) { - case SC_PERF_TYPE_UINT64: - pca->head[id].ui64_cnt += x; - break; - case SC_PERF_TYPE_DOUBLE: - pca->head[id].d_cnt += x; - break; - } - - if (pca->head[id].syncs == ULONG_MAX) { - pca->head[id].syncs = 0; - pca->head[id].wrapped_syncs++; - } - pca->head[id].syncs++; - - return; -} - -/** - * \brief Adds a value of type double to the local counter - * - * \param id ID of the counter as set by the API - * \param pca Counter array that holds the local counter for this TM - * \param x Value to add to this local counter - */ -inline void SCPerfCounterAddDouble(uint16_t id, SCPerfCounterArray *pca, double x) -{ - if (!pca) { - SCLogDebug("counterarray is NULL"); - return; - } - if ((id < 1) || (id > pca->size)) { - SCLogDebug("counter doesn't exist"); - return; - } - - /* incase you are trying to add a double to a counter of type SC_PERF_TYPE_UINT64 - * it will be truncated */ - switch (pca->head[id].pc->value->type) { - case SC_PERF_TYPE_UINT64: - pca->head[id].ui64_cnt += x; - break; - case SC_PERF_TYPE_DOUBLE: - pca->head[id].d_cnt += x; - break; - } - - if (pca->head[id].syncs == ULONG_MAX) { - pca->head[id].syncs = 0; - pca->head[id].wrapped_syncs++; - } - pca->head[id].syncs++; - - return; -} - -/** - * \brief Sets a value of type double to the local counter - * - * \param id Index of the local counter in the counter array - * \param pca Pointer to the SCPerfCounterArray - * \param x The value to set for the counter - */ -inline void SCPerfCounterSetUI64(uint16_t id, SCPerfCounterArray *pca, - uint64_t x) -{ - if (!pca) { - SCLogDebug("counterarray is NULL"); - return; - } - - if ((id < 1) || (id > pca->size)) { - SCLogDebug("counter doesn't exist"); - return; - } - - switch (pca->head[id].pc->value->type) { - case SC_PERF_TYPE_UINT64: - if ( (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_MAXIMUM) && - (x > pca->head[id].ui64_cnt)) { - pca->head[id].ui64_cnt = x; - } else if (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_NORMAL) { - pca->head[id].ui64_cnt = x; - } - - break; - case SC_PERF_TYPE_DOUBLE: - if ( (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_MAXIMUM) && - (x > pca->head[id].d_cnt)) { - pca->head[id].d_cnt = x; - } else if (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_NORMAL) { - pca->head[id].d_cnt = x; - } - - break; - } - - if (pca->head[id].syncs == ULONG_MAX) { - pca->head[id].syncs = 0; - pca->head[id].wrapped_syncs++; - } - pca->head[id].syncs++; - - return; -} - -/** - * \brief Sets a local counter to an arg of type double - * - * \param id Index of the local counter in the counter array - * \param pca Pointer to the SCPerfCounterArray - * \param x The value to set for the counter - */ -inline void SCPerfCounterSetDouble(uint16_t id, SCPerfCounterArray *pca, - double x) -{ - if (!pca) { - SCLogDebug("counterarray is NULL"); - return; - } - - if ((id < 1) || (id > pca->size)) { - SCLogDebug("counter doesn't exist"); - return; - } - - switch (pca->head[id].pc->value->type) { - case SC_PERF_TYPE_UINT64: - if ( (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_MAXIMUM) && - (x > pca->head[id].ui64_cnt)) { - pca->head[id].ui64_cnt = x; - } else if (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_NORMAL) { - pca->head[id].ui64_cnt = x; - } - - break; - case SC_PERF_TYPE_DOUBLE: - if ( (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_MAXIMUM) && - (x > pca->head[id].d_cnt)) { - pca->head[id].d_cnt = x; - } else if (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_NORMAL) { - pca->head[id].d_cnt = x; - } - - break; - } - - if (pca->head[id].syncs == ULONG_MAX) { - pca->head[id].syncs = 0; - pca->head[id].wrapped_syncs++; - } - pca->head[id].syncs++; - - return; -} - -/** * \brief Syncs the counter array with the global counter variables * * \param pca Pointer to the SCPerfCounterArray diff --git a/src/counters.h b/src/counters.h index ee6a908..e95dbf1 100644 --- a/src/counters.h +++ b/src/counters.h @@ -221,13 +221,6 @@ SCPerfCounterArray *SCPerfGetCounterArrayRange(uint16_t, uint16_t, SCPerfContext SCPerfCounterArray * SCPerfGetAllCountersArray(SCPerfContext *); int SCPerfCounterDisplay(uint16_t, SCPerfContext *, int); -/* functions used to update local counter values */ -inline void SCPerfCounterIncr(uint16_t, SCPerfCounterArray *); -inline void SCPerfCounterAddUI64(uint16_t, SCPerfCounterArray *, uint64_t); -inline void SCPerfCounterAddDouble(uint16_t, SCPerfCounterArray *, double); -inline void SCPerfCounterSetUI64(uint16_t, SCPerfCounterArray *, uint64_t); -inline void SCPerfCounterSetDouble(uint16_t, SCPerfCounterArray *, double); - int SCPerfUpdateCounterArray(SCPerfCounterArray *, SCPerfContext *, int); void SCPerfOutputCounters(void); @@ -239,4 +232,218 @@ void SCPerfReleasePCA(SCPerfCounterArray *); void SCPerfRegisterTests(void); +/** --------- Inline functions --------- */ + +/* functions used to update local counter values */ + +/** + * \brief Sets a local counter to an arg of type double + * + * \param id Index of the local counter in the counter array + * \param pca Pointer to the SCPerfCounterArray + * \param x The value to set for the counter + */ +static inline void SCPerfCounterSetDouble(uint16_t id, SCPerfCounterArray *pca, + double x) +{ + if (!pca) { + SCLogDebug("counterarray is NULL"); + return; + } + + if ((id < 1) || (id > pca->size)) { + SCLogDebug("counter doesn't exist"); + return; + } + + switch (pca->head[id].pc->value->type) { + case SC_PERF_TYPE_UINT64: + if ( (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_MAXIMUM) && + (x > pca->head[id].ui64_cnt)) { + pca->head[id].ui64_cnt = x; + } else if (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_NORMAL) { + pca->head[id].ui64_cnt = x; + } + + break; + case SC_PERF_TYPE_DOUBLE: + if ( (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_MAXIMUM) && + (x > pca->head[id].d_cnt)) { + pca->head[id].d_cnt = x; + } else if (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_NORMAL) { + pca->head[id].d_cnt = x; + } + + break; + } + + if (pca->head[id].syncs == ULONG_MAX) { + pca->head[id].syncs = 0; + pca->head[id].wrapped_syncs++; + } + pca->head[id].syncs++; + + return; +} + +/** + * \brief Sets a value of type double to the local counter + * + * \param id Index of the local counter in the counter array + * \param pca Pointer to the SCPerfCounterArray + * \param x The value to set for the counter + */ +static inline void SCPerfCounterSetUI64(uint16_t id, SCPerfCounterArray *pca, + uint64_t x) +{ + if (!pca) { + SCLogDebug("counterarray is NULL"); + return; + } + + if ((id < 1) || (id > pca->size)) { + SCLogDebug("counter doesn't exist"); + return; + } + + switch (pca->head[id].pc->value->type) { + case SC_PERF_TYPE_UINT64: + if ( (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_MAXIMUM) && + (x > pca->head[id].ui64_cnt)) { + pca->head[id].ui64_cnt = x; + } else if (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_NORMAL) { + pca->head[id].ui64_cnt = x; + } + + break; + case SC_PERF_TYPE_DOUBLE: + if ( (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_MAXIMUM) && + (x > pca->head[id].d_cnt)) { + pca->head[id].d_cnt = x; + } else if (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_NORMAL) { + pca->head[id].d_cnt = x; + } + + break; + } + + if (pca->head[id].syncs == ULONG_MAX) { + pca->head[id].syncs = 0; + pca->head[id].wrapped_syncs++; + } + pca->head[id].syncs++; + + return; +} + +/** + * \brief Adds a value of type double to the local counter + * + * \param id ID of the counter as set by the API + * \param pca Counter array that holds the local counter for this TM + * \param x Value to add to this local counter + */ +static inline void SCPerfCounterAddDouble(uint16_t id, SCPerfCounterArray *pca, double x) +{ + if (!pca) { + SCLogDebug("counterarray is NULL"); + return; + } + if ((id < 1) || (id > pca->size)) { + SCLogDebug("counter doesn't exist"); + return; + } + + /* incase you are trying to add a double to a counter of type SC_PERF_TYPE_UINT64 + * it will be truncated */ + switch (pca->head[id].pc->value->type) { + case SC_PERF_TYPE_UINT64: + pca->head[id].ui64_cnt += x; + break; + case SC_PERF_TYPE_DOUBLE: + pca->head[id].d_cnt += x; + break; + } + + if (pca->head[id].syncs == ULONG_MAX) { + pca->head[id].syncs = 0; + pca->head[id].wrapped_syncs++; + } + pca->head[id].syncs++; + + return; +} + +/** + * \brief Adds a value of type uint64_t to the local counter. + * + * \param id ID of the counter as set by the API + * \param pca Counter array that holds the local counter for this TM + * \param x Value to add to this local counter + */ +static inline void SCPerfCounterAddUI64(uint16_t id, SCPerfCounterArray *pca, uint64_t x) +{ + if (!pca) { + SCLogDebug("counterarray is NULL"); + return; + } + if ((id < 1) || (id > pca->size)) { + SCLogDebug("counter doesn't exist"); + return; + } + + switch (pca->head[id].pc->value->type) { + case SC_PERF_TYPE_UINT64: + pca->head[id].ui64_cnt += x; + break; + case SC_PERF_TYPE_DOUBLE: + pca->head[id].d_cnt += x; + break; + } + + if (pca->head[id].syncs == ULONG_MAX) { + pca->head[id].syncs = 0; + pca->head[id].wrapped_syncs++; + } + pca->head[id].syncs++; + + return; +} + +/** + * \brief Increments the local counter + * + * \param id Index of the counter in the counter array + * \param pca Counter array that holds the local counters for this TM + */ +static inline void SCPerfCounterIncr(uint16_t id, SCPerfCounterArray *pca) +{ + if (pca == NULL) { + SCLogDebug("counterarray is NULL"); + return; + } + if ((id < 1) || (id > pca->size)) { + SCLogDebug("counter doesn't exist"); + return; + } + + switch (pca->head[id].pc->value->type) { + case SC_PERF_TYPE_UINT64: + pca->head[id].ui64_cnt++; + break; + case SC_PERF_TYPE_DOUBLE: + pca->head[id].d_cnt++; + break; + } + + if (pca->head[id].syncs == ULONG_MAX) { + pca->head[id].syncs = 0; + pca->head[id].wrapped_syncs++; + } + pca->head[id].syncs++; + + return; +} + + #endif /* __COUNTERS_H__ */ diff --git a/src/decode-icmpv4.c b/src/decode-icmpv4.c index 43c1e80..07c53db 100644 --- a/src/decode-icmpv4.c +++ b/src/decode-icmpv4.c @@ -13,58 +13,6 @@ #include "util-debug.h" /** - * \brief Calculates the checksum for the ICMP packet - * - * \param pkt Pointer to the start of the ICMP packet - * \param hlen Total length of the ICMP packet(header + payload) - * - * \retval csum Checksum for the ICMP packet - */ -inline uint16_t ICMPV4CalculateChecksum(uint16_t *pkt, uint16_t tlen) -{ - uint16_t pad = 0; - uint32_t csum = pkt[0]; - - tlen -= 4; - pkt += 2; - - while (tlen >= 32) { - csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + - pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + - pkt[14] + pkt[15]; - tlen -= 32; - pkt += 16; - } - - while(tlen >= 8) { - csum += pkt[0] + pkt[1] + pkt[2] + pkt[3]; - tlen -= 8; - pkt += 4; - } - - while(tlen >= 4) { - csum += pkt[0] + pkt[1]; - tlen -= 4; - pkt += 2; - } - - while (tlen > 1) { - csum += pkt[0]; - tlen -= 2; - pkt += 1; - } - - if (tlen == 1) { - *(uint8_t *)(&pad) = (*(uint8_t *)pkt); - csum += pad; - } - - csum = (csum >> 16) + (csum & 0x0000FFFF); - - return (uint16_t) ~csum; -} - -/** * Note, this is the IP header, plus a bit of the original packet, not the whole thing! */ void DecodePartialIPV4( Packet* p, uint8_t* partial_packet, uint16_t len ) diff --git a/src/decode-icmpv4.h b/src/decode-icmpv4.h index a864aa6..7d72a73 100644 --- a/src/decode-icmpv4.h +++ b/src/decode-icmpv4.h @@ -222,9 +222,63 @@ typedef struct ICMPV4Cache_ { int32_t comp_csum; } ICMPV4Cache; -inline uint16_t ICMPV4CalculateChecksum(uint16_t *, uint16_t); +static inline uint16_t ICMPV4CalculateChecksum(uint16_t *, uint16_t); void DecodeICMPV4RegisterTests(void); +/** ------- inline functions ----- */ +/** + * \brief Calculates the checksum for the ICMP packet + * + * \param pkt Pointer to the start of the ICMP packet + * \param hlen Total length of the ICMP packet(header + payload) + * + * \retval csum Checksum for the ICMP packet + */ +static inline uint16_t ICMPV4CalculateChecksum(uint16_t *pkt, uint16_t tlen) +{ + uint16_t pad = 0; + uint32_t csum = pkt[0]; + + tlen -= 4; + pkt += 2; + + while (tlen >= 32) { + csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + + pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + + pkt[14] + pkt[15]; + tlen -= 32; + pkt += 16; + } + + while(tlen >= 8) { + csum += pkt[0] + pkt[1] + pkt[2] + pkt[3]; + tlen -= 8; + pkt += 4; + } + + while(tlen >= 4) { + csum += pkt[0] + pkt[1]; + tlen -= 4; + pkt += 2; + } + + while (tlen > 1) { + csum += pkt[0]; + tlen -= 2; + pkt += 1; + } + + if (tlen == 1) { + *(uint8_t *)(&pad) = (*(uint8_t *)pkt); + csum += pad; + } + + csum = (csum >> 16) + (csum & 0x0000FFFF); + + return (uint16_t) ~csum; +} + + #endif /* __DECODE_ICMPV4_H__ */ diff --git a/src/decode-icmpv6.c b/src/decode-icmpv6.c index 36512ae..8164f78 100644 --- a/src/decode-icmpv6.c +++ b/src/decode-icmpv6.c @@ -10,77 +10,6 @@ #include "flow.h" #include "util-debug.h" -/** - * \brief Calculates the checksum for the ICMPV6 packet - * - * \param shdr Pointer to source address field from the IPV6 packet. Used as a - * part of the psuedoheader for computing the checksum - * \param pkt Pointer to the start of the ICMPV6 packet - * \param tlen Total length of the ICMPV6 packet(header + payload) - * - * \retval csum Checksum for the ICMPV6 packet - */ -inline uint16_t ICMPV6CalculateChecksum(uint16_t *shdr, uint16_t *pkt, - uint16_t tlen) -{ - uint16_t pad = 0; - uint32_t csum = shdr[0]; - - csum += shdr[1] + shdr[2] + shdr[3] + shdr[4] + shdr[5] + shdr[6] + - shdr[7] + shdr[8] + shdr[9] + shdr[10] + shdr[11] + shdr[12] + - shdr[13] + shdr[14] + shdr[15] + htons(58 + tlen); - - csum += pkt[0]; - - tlen -= 4; - pkt += 2; - - while (tlen >= 64) { - csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + - pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + - pkt[14] + pkt[15] + pkt[16] + pkt[17] + pkt[18] + pkt[19] + - pkt[20] + pkt[21] + pkt[22] + pkt[23] + pkt[24] + pkt[25] + - pkt[26] + pkt[27] + pkt[28] + pkt[29] + pkt[30] + pkt[31]; - tlen -= 64; - pkt += 32; - } - - while (tlen >= 32) { - csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + - pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + - pkt[14] + pkt[15]; - tlen -= 32; - pkt += 16; - } - - while(tlen >= 8) { - csum += pkt[0] + pkt[1] + pkt[2] + pkt[3]; - tlen -= 8; - pkt += 4; - } - - while(tlen >= 4) { - csum += pkt[0] + pkt[1]; - tlen -= 4; - pkt += 2; - } - - while (tlen > 1) { - csum += pkt[0]; - tlen -= 2; - pkt += 1; - } - - if (tlen == 1) { - *(uint8_t *)(&pad) = (*(uint8_t *)pkt); - csum += pad; - } - - csum = (csum >> 16) + (csum & 0x0000FFFF); - - return (uint16_t) ~csum; -} - /** * \brief Get variables and do some checks of the embedded IPV6 packet diff --git a/src/decode-icmpv6.h b/src/decode-icmpv6.h index f453742..f287b18 100644 --- a/src/decode-icmpv6.h +++ b/src/decode-icmpv6.h @@ -139,8 +139,82 @@ typedef struct ICMPV6Vars_ { } ICMPV6Vars; -inline uint16_t ICMPV6CalculateChecksum(uint16_t *, uint16_t *, uint16_t); +static inline uint16_t ICMPV6CalculateChecksum(uint16_t *, uint16_t *, uint16_t); void DecodeICMPV6RegisterTests(void); +/** ------ inline functions ------ */ + +/** + * \brief Calculates the checksum for the ICMPV6 packet + * + * \param shdr Pointer to source address field from the IPV6 packet. Used as a + * part of the psuedoheader for computing the checksum + * \param pkt Pointer to the start of the ICMPV6 packet + * \param tlen Total length of the ICMPV6 packet(header + payload) + * + * \retval csum Checksum for the ICMPV6 packet + */ +static inline uint16_t ICMPV6CalculateChecksum(uint16_t *shdr, uint16_t *pkt, + uint16_t tlen) +{ + uint16_t pad = 0; + uint32_t csum = shdr[0]; + + csum += shdr[1] + shdr[2] + shdr[3] + shdr[4] + shdr[5] + shdr[6] + + shdr[7] + shdr[8] + shdr[9] + shdr[10] + shdr[11] + shdr[12] + + shdr[13] + shdr[14] + shdr[15] + htons(58 + tlen); + + csum += pkt[0]; + + tlen -= 4; + pkt += 2; + + while (tlen >= 64) { + csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + + pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + + pkt[14] + pkt[15] + pkt[16] + pkt[17] + pkt[18] + pkt[19] + + pkt[20] + pkt[21] + pkt[22] + pkt[23] + pkt[24] + pkt[25] + + pkt[26] + pkt[27] + pkt[28] + pkt[29] + pkt[30] + pkt[31]; + tlen -= 64; + pkt += 32; + } + + while (tlen >= 32) { + csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + + pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + + pkt[14] + pkt[15]; + tlen -= 32; + pkt += 16; + } + + while(tlen >= 8) { + csum += pkt[0] + pkt[1] + pkt[2] + pkt[3]; + tlen -= 8; + pkt += 4; + } + + while(tlen >= 4) { + csum += pkt[0] + pkt[1]; + tlen -= 4; + pkt += 2; + } + + while (tlen > 1) { + csum += pkt[0]; + tlen -= 2; + pkt += 1; + } + + if (tlen == 1) { + *(uint8_t *)(&pad) = (*(uint8_t *)pkt); + csum += pad; + } + + csum = (csum >> 16) + (csum & 0x0000FFFF); + + return (uint16_t) ~csum; +} + + #endif /* __DECODE_ICMPV6_H__ */ diff --git a/src/decode-ipv4.c b/src/decode-ipv4.c index f08c7f6..c716d97 100644 --- a/src/decode-ipv4.c +++ b/src/decode-ipv4.c @@ -13,62 +13,8 @@ #include "util-unittest.h" #include "util-debug.h" -/** - * \brief Calculates the checksum for the IP packet - * - * \param pkt Pointer to the start of the IP packet - * \param hlen Length of the IP header - * - * \retval csum Checksum for the IP packet - */ -inline uint16_t IPV4CalculateChecksum(uint16_t *pkt, uint16_t hlen) -{ - uint32_t csum = pkt[0]; +static uint16_t IPV4CalculateChecksum(uint16_t *pkt, uint16_t hlen); - csum += pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[6] + pkt[7] + pkt[8] + - pkt[9]; - - hlen -= 20; - pkt += 10; - - if (hlen == 0) { - ; - } - if (hlen == 4) - csum += pkt[0] + pkt[1]; - else if (hlen == 8) - csum += pkt[0] + pkt[1] + pkt[2] + pkt[3]; - else if (hlen == 12) - csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5]; - else if (hlen == 16) - csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + - pkt[7]; - else if (hlen == 20) - csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + - pkt[7] + pkt[8] + pkt[9]; - else if (hlen == 24) - csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + - pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11]; - else if (hlen == 28) - csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + - pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13]; - else if (hlen == 32) - csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + - pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + - pkt[14] + pkt[15]; - if (hlen == 36) - csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + - pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + - pkt[14] + pkt[15] + pkt[16] + pkt[17]; - if (hlen == 40) - csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + - pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + - pkt[14] + pkt[15] + pkt[16] + pkt[17] + pkt[18] + pkt[19]; - - csum = (csum >> 16) + (csum & 0x0000FFFF); - - return (uint16_t) ~csum; -} /* Generic validation * diff --git a/src/decode-ipv4.h b/src/decode-ipv4.h index d72b036..8fda864 100644 --- a/src/decode-ipv4.h +++ b/src/decode-ipv4.h @@ -186,8 +186,67 @@ typedef struct IPV4Vars_ IPV4Opt *o_rtralt; } IPV4Vars; -inline uint16_t IPV4CalculateChecksum(uint16_t *, uint16_t); void DecodeIPV4RegisterTests(void); +/** ------ inline functions ------ */ + +/** + * \brief Calculates the checksum for the IP packet + * + * \param pkt Pointer to the start of the IP packet + * \param hlen Length of the IP header + * + * \retval csum Checksum for the IP packet + */ +static inline uint16_t IPV4CalculateChecksum(uint16_t *pkt, uint16_t hlen) +{ + uint32_t csum = pkt[0]; + + csum += pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[6] + pkt[7] + pkt[8] + + pkt[9]; + + hlen -= 20; + pkt += 10; + + if (hlen == 0) { + ; + } + if (hlen == 4) + csum += pkt[0] + pkt[1]; + else if (hlen == 8) + csum += pkt[0] + pkt[1] + pkt[2] + pkt[3]; + else if (hlen == 12) + csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5]; + else if (hlen == 16) + csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + + pkt[7]; + else if (hlen == 20) + csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + + pkt[7] + pkt[8] + pkt[9]; + else if (hlen == 24) + csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + + pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11]; + else if (hlen == 28) + csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + + pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13]; + else if (hlen == 32) + csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + + pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + + pkt[14] + pkt[15]; + if (hlen == 36) + csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + + pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + + pkt[14] + pkt[15] + pkt[16] + pkt[17]; + if (hlen == 40) + csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + + pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + + pkt[14] + pkt[15] + pkt[16] + pkt[17] + pkt[18] + pkt[19]; + + csum = (csum >> 16) + (csum & 0x0000FFFF); + + return (uint16_t) ~csum; +} + + #endif /* __DECODE_IPV4_H__ */ diff --git a/src/decode-tcp.c b/src/decode-tcp.c index 46ec32e..e132cab 100644 --- a/src/decode-tcp.c +++ b/src/decode-tcp.c @@ -8,128 +8,6 @@ #include "util-debug.h" #include "flow.h" -/** - * \brief Calculates the checksum for the TCP packet - * - * \param shdr Pointer to source address field from the IP packet. Used as a - * part of the psuedoheader for computing the checksum - * \param pkt Pointer to the start of the TCP packet - * \param hlen Total length of the TCP packet(header + payload) - * - * \retval csum Checksum for the TCP packet - */ -inline uint16_t TCPCalculateChecksum(uint16_t *shdr, uint16_t *pkt, - uint16_t tlen) -{ - uint16_t pad = 0; - uint32_t csum = shdr[0]; - - csum += shdr[1] + shdr[2] + shdr[3] + htons(6 + tlen); - - csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + - pkt[7] + pkt[9]; - - tlen -= 20; - pkt += 10; - - while (tlen >= 32) { - csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + - pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + - pkt[14] + pkt[15]; - tlen -= 32; - pkt += 16; - } - - while(tlen >= 8) { - csum += pkt[0] + pkt[1] + pkt[2] + pkt[3]; - tlen -= 8; - pkt += 4; - } - - while(tlen >= 4) { - csum += pkt[0] + pkt[1]; - tlen -= 4; - pkt += 2; - } - - while (tlen > 1) { - csum += pkt[0]; - pkt += 1; - tlen -= 2; - } - - if (tlen == 1) { - *(uint8_t *)(&pad) = (*(uint8_t *)pkt); - csum += pad; - } - - csum = (csum >> 16) + (csum & 0x0000FFFF); - - return (uint16_t) ~csum; -} - -/** - * \brief Calculates the checksum for the TCP packet - * - * \param shdr Pointer to source address field from the IPV6 packet. Used as a - * part of the psuedoheader for computing the checksum - * \param pkt Pointer to the start of the TCP packet - * \param tlen Total length of the TCP packet(header + payload) - * - * \retval csum Checksum for the TCP packet - */ -inline uint16_t TCPV6CalculateChecksum(uint16_t *shdr, uint16_t *pkt, - uint16_t tlen) -{ - uint16_t pad = 0; - uint32_t csum = shdr[0]; - - csum += shdr[1] + shdr[2] + shdr[3] + shdr[4] + shdr[5] + shdr[6] + - shdr[7] + shdr[8] + shdr[9] + shdr[10] + shdr[11] + shdr[12] + - shdr[13] + shdr[14] + shdr[15] + htons(6 + tlen); - - csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + - pkt[7] + pkt[9]; - - tlen -= 20; - pkt += 10; - - while (tlen >= 32) { - csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + - pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + - pkt[14] + pkt[15]; - tlen -= 32; - pkt += 16; - } - - while(tlen >= 8) { - csum += pkt[0] + pkt[1] + pkt[2] + pkt[3]; - tlen -= 8; - pkt += 4; - } - - while(tlen >= 4) { - csum += pkt[0] + pkt[1]; - tlen -= 4; - pkt += 2; - } - - while (tlen > 1) { - csum += pkt[0]; - pkt += 1; - tlen -= 2; - } - - if (tlen == 1) { - *(uint8_t *)(&pad) = (*(uint8_t *)pkt); - csum += pad; - } - - csum = (csum >> 16) + (csum & 0x0000FFFF); - - return (uint16_t) ~csum; -} - static int DecodeTCPOptions(ThreadVars *tv, Packet *p, uint8_t *pkt, uint16_t len) { uint16_t plen = len; diff --git a/src/decode-tcp.h b/src/decode-tcp.h index 413de1b..9195dfe 100644 --- a/src/decode-tcp.h +++ b/src/decode-tcp.h @@ -137,9 +137,134 @@ typedef struct TCPCache_ { (p)->tcpc.ts2 = 0; \ } -inline uint16_t TCPCalculateChecksum(uint16_t *, uint16_t *, uint16_t); -inline uint16_t TCPV6CalculateChecksum(uint16_t *, uint16_t *, uint16_t); +static inline uint16_t TCPCalculateChecksum(uint16_t *, uint16_t *, uint16_t); +static inline uint16_t TCPV6CalculateChecksum(uint16_t *, uint16_t *, uint16_t); void DecodeTCPRegisterTests(void); +/** ------ inline functions ------ */ + +/** + * \brief Calculates the checksum for the TCP packet + * + * \param shdr Pointer to source address field from the IP packet. Used as a + * part of the psuedoheader for computing the checksum + * \param pkt Pointer to the start of the TCP packet + * \param hlen Total length of the TCP packet(header + payload) + * + * \retval csum Checksum for the TCP packet + */ +static inline uint16_t TCPCalculateChecksum(uint16_t *shdr, uint16_t *pkt, + uint16_t tlen) +{ + uint16_t pad = 0; + uint32_t csum = shdr[0]; + + csum += shdr[1] + shdr[2] + shdr[3] + htons(6 + tlen); + + csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + + pkt[7] + pkt[9]; + + tlen -= 20; + pkt += 10; + + while (tlen >= 32) { + csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + + pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + + pkt[14] + pkt[15]; + tlen -= 32; + pkt += 16; + } + + while(tlen >= 8) { + csum += pkt[0] + pkt[1] + pkt[2] + pkt[3]; + tlen -= 8; + pkt += 4; + } + + while(tlen >= 4) { + csum += pkt[0] + pkt[1]; + tlen -= 4; + pkt += 2; + } + + while (tlen > 1) { + csum += pkt[0]; + pkt += 1; + tlen -= 2; + } + + if (tlen == 1) { + *(uint8_t *)(&pad) = (*(uint8_t *)pkt); + csum += pad; + } + + csum = (csum >> 16) + (csum & 0x0000FFFF); + + return (uint16_t) ~csum; +} + +/** + * \brief Calculates the checksum for the TCP packet + * + * \param shdr Pointer to source address field from the IPV6 packet. Used as a + * part of the psuedoheader for computing the checksum + * \param pkt Pointer to the start of the TCP packet + * \param tlen Total length of the TCP packet(header + payload) + * + * \retval csum Checksum for the TCP packet + */ +static inline uint16_t TCPV6CalculateChecksum(uint16_t *shdr, uint16_t *pkt, + uint16_t tlen) +{ + uint16_t pad = 0; + uint32_t csum = shdr[0]; + + csum += shdr[1] + shdr[2] + shdr[3] + shdr[4] + shdr[5] + shdr[6] + + shdr[7] + shdr[8] + shdr[9] + shdr[10] + shdr[11] + shdr[12] + + shdr[13] + shdr[14] + shdr[15] + htons(6 + tlen); + + csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + + pkt[7] + pkt[9]; + + tlen -= 20; + pkt += 10; + + while (tlen >= 32) { + csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + + pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + + pkt[14] + pkt[15]; + tlen -= 32; + pkt += 16; + } + + while(tlen >= 8) { + csum += pkt[0] + pkt[1] + pkt[2] + pkt[3]; + tlen -= 8; + pkt += 4; + } + + while(tlen >= 4) { + csum += pkt[0] + pkt[1]; + tlen -= 4; + pkt += 2; + } + + while (tlen > 1) { + csum += pkt[0]; + pkt += 1; + tlen -= 2; + } + + if (tlen == 1) { + *(uint8_t *)(&pad) = (*(uint8_t *)pkt); + csum += pad; + } + + csum = (csum >> 16) + (csum & 0x0000FFFF); + + return (uint16_t) ~csum; +} + + #endif /* __DECODE_TCP_H__ */ diff --git a/src/decode-udp.c b/src/decode-udp.c index 7753e9b..12b093f 100644 --- a/src/decode-udp.c +++ b/src/decode-udp.c @@ -8,126 +8,6 @@ #include "util-debug.h" #include "flow.h" -/** - * \brief Calculates the checksum for the UDP packet - * - * \param shdr Pointer to source address field from the IP packet. Used as a - * part of the psuedoheader for computing the checksum - * \param pkt Pointer to the start of the UDP packet - * \param hlen Total length of the UDP packet(header + payload) - * - * \retval csum Checksum for the UDP packet - */ -inline uint16_t UDPV4CalculateChecksum(uint16_t *shdr, uint16_t *pkt, - uint16_t tlen) -{ - uint16_t pad = 0; - uint32_t csum = shdr[0]; - - csum += shdr[1] + shdr[2] + shdr[3] + htons(17 + tlen); - - csum += pkt[0] + pkt[1] + pkt[2]; - - tlen -= 8; - pkt += 4; - - while (tlen >= 32) { - csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + - pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + - pkt[14] + pkt[15]; - tlen -= 32; - pkt += 16; - } - - while(tlen >= 8) { - csum += pkt[0] + pkt[1] + pkt[2] + pkt[3]; - tlen -= 8; - pkt += 4; - } - - while(tlen >= 4) { - csum += pkt[0] + pkt[1]; - tlen -= 4; - pkt += 2; - } - - while (tlen > 1) { - csum += pkt[0]; - pkt += 1; - tlen -= 2; - } - - if (tlen == 1) { - *(uint8_t *)(&pad) = (*(uint8_t *)pkt); - csum += pad; - } - - csum = (csum >> 16) + (csum & 0x0000FFFF); - - return (uint16_t) ~csum; -} - -/** - * \brief Calculates the checksum for the UDP packet - * - * \param shdr Pointer to source address field from the IPV6 packet. Used as a - * part of the psuedoheader for computing the checksum - * \param pkt Pointer to the start of the UDP packet - * \param tlen Total length of the UDP packet(header + payload) - * - * \retval csum Checksum for the UDP packet - */ -inline uint16_t UDPV6CalculateChecksum(uint16_t *shdr, uint16_t *pkt, - uint16_t tlen) -{ - uint16_t pad = 0; - uint32_t csum = shdr[0]; - - csum += shdr[1] + shdr[2] + shdr[3] + shdr[4] + shdr[5] + shdr[6] + - shdr[7] + shdr[8] + shdr[9] + shdr[10] + shdr[11] + shdr[12] + - shdr[13] + shdr[14] + shdr[15] + htons(17 + tlen); - - csum += pkt[0] + pkt[1] + pkt[2]; - - tlen -= 8; - pkt += 4; - - while (tlen >= 32) { - csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + - pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + - pkt[14] + pkt[15]; - tlen -= 32; - pkt += 16; - } - - while(tlen >= 8) { - csum += pkt[0] + pkt[1] + pkt[2] + pkt[3]; - tlen -= 8; - pkt += 4; - } - - while(tlen >= 4) { - csum += pkt[0] + pkt[1]; - tlen -= 4; - pkt += 2; - } - - while (tlen > 1) { - csum += pkt[0]; - pkt += 1; - tlen -= 2; - } - - if (tlen == 1) { - *(uint8_t *)(&pad) = (*(uint8_t *)pkt); - csum += pad; - } - - csum = (csum >> 16) + (csum & 0x0000FFFF); - - return (uint16_t) ~csum; -} - static int DecodeUDPPacket(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len) { if (len < UDP_HEADER_LEN) { diff --git a/src/decode-udp.h b/src/decode-udp.h index 691f2f8..833fb8c 100644 --- a/src/decode-udp.h +++ b/src/decode-udp.h @@ -33,8 +33,131 @@ typedef struct UDPCache_ { int32_t comp_csum; } UDPCache; -inline uint16_t UDPV4CalculateChecksum(uint16_t *, uint16_t *, uint16_t); -inline uint16_t UDPV6CalculateChecksum(uint16_t *, uint16_t *, uint16_t); +static inline uint16_t UDPV4CalculateChecksum(uint16_t *, uint16_t *, uint16_t); +static inline uint16_t UDPV6CalculateChecksum(uint16_t *, uint16_t *, uint16_t); void DecodeUDPV4RegisterTests(void); +/** ------ inline functions ------ */ + +/** + * \brief Calculates the checksum for the UDP packet + * + * \param shdr Pointer to source address field from the IP packet. Used as a + * part of the psuedoheader for computing the checksum + * \param pkt Pointer to the start of the UDP packet + * \param hlen Total length of the UDP packet(header + payload) + * + * \retval csum Checksum for the UDP packet + */ +static inline uint16_t UDPV4CalculateChecksum(uint16_t *shdr, uint16_t *pkt, + uint16_t tlen) +{ + uint16_t pad = 0; + uint32_t csum = shdr[0]; + + csum += shdr[1] + shdr[2] + shdr[3] + htons(17 + tlen); + + csum += pkt[0] + pkt[1] + pkt[2]; + + tlen -= 8; + pkt += 4; + + while (tlen >= 32) { + csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + + pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + + pkt[14] + pkt[15]; + tlen -= 32; + pkt += 16; + } + + while(tlen >= 8) { + csum += pkt[0] + pkt[1] + pkt[2] + pkt[3]; + tlen -= 8; + pkt += 4; + } + + while(tlen >= 4) { + csum += pkt[0] + pkt[1]; + tlen -= 4; + pkt += 2; + } + + while (tlen > 1) { + csum += pkt[0]; + pkt += 1; + tlen -= 2; + } + + if (tlen == 1) { + *(uint8_t *)(&pad) = (*(uint8_t *)pkt); + csum += pad; + } + + csum = (csum >> 16) + (csum & 0x0000FFFF); + + return (uint16_t) ~csum; +} + +/** + * \brief Calculates the checksum for the UDP packet + * + * \param shdr Pointer to source address field from the IPV6 packet. Used as a + * part of the psuedoheader for computing the checksum + * \param pkt Pointer to the start of the UDP packet + * \param tlen Total length of the UDP packet(header + payload) + * + * \retval csum Checksum for the UDP packet + */ +static inline uint16_t UDPV6CalculateChecksum(uint16_t *shdr, uint16_t *pkt, + uint16_t tlen) +{ + uint16_t pad = 0; + uint32_t csum = shdr[0]; + + csum += shdr[1] + shdr[2] + shdr[3] + shdr[4] + shdr[5] + shdr[6] + + shdr[7] + shdr[8] + shdr[9] + shdr[10] + shdr[11] + shdr[12] + + shdr[13] + shdr[14] + shdr[15] + htons(17 + tlen); + + csum += pkt[0] + pkt[1] + pkt[2]; + + tlen -= 8; + pkt += 4; + + while (tlen >= 32) { + csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + + pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + + pkt[14] + pkt[15]; + tlen -= 32; + pkt += 16; + } + + while(tlen >= 8) { + csum += pkt[0] + pkt[1] + pkt[2] + pkt[3]; + tlen -= 8; + pkt += 4; + } + + while(tlen >= 4) { + csum += pkt[0] + pkt[1]; + tlen -= 4; + pkt += 2; + } + + while (tlen > 1) { + csum += pkt[0]; + pkt += 1; + tlen -= 2; + } + + if (tlen == 1) { + *(uint8_t *)(&pad) = (*(uint8_t *)pkt); + csum += pad; + } + + csum = (csum >> 16) + (csum & 0x0000FFFF); + + return (uint16_t) ~csum; +} + + #endif /* __DECODE_UDP_H__ */ diff --git a/src/decode.c b/src/decode.c index 26a6858..7112704 100644 --- a/src/decode.c +++ b/src/decode.c @@ -23,26 +23,6 @@ void DecodeTunnel(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt } } -/** \brief Set the No payload inspection Flag for the packet. - * - * \param p Packet to set the flag in - */ -inline void DecodeSetNoPayloadInspectionFlag(Packet *p) { - SCEnter(); - p->flags |= PKT_NOPAYLOAD_INSPECTION; - SCReturn; -} - -/** \brief Set the No packet inspection Flag for the packet. - * - * \param p Packet to set the flag in - */ -inline void DecodeSetNoPacketInspectionFlag(Packet *p) { - SCEnter(); - p->flags |= PKT_NOPACKET_INSPECTION; - SCReturn; -} - void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv) { /* register counters */ diff --git a/src/decode.h b/src/decode.h index ee245aa..0aa2af2 100644 --- a/src/decode.h +++ b/src/decode.h @@ -499,9 +499,6 @@ void DecodeVLAN(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, Packet *SetupPkt (void); Packet *TunnelPktSetup(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, uint8_t); -inline void DecodeSetNoPayloadInspectionFlag(Packet *); -inline void DecodeSetNoPacketInspectionFlag(Packet *); - #define DECODER_SET_EVENT(p, e) ((p)->events[(e/8)] |= (1<<(e%8))) #define DECODER_ISSET_EVENT(p, e) ((p)->events[(e/8)] & (1<<(e%8))) @@ -541,5 +538,30 @@ inline void DecodeSetNoPacketInspectionFlag(Packet *); #define PKT_NOPACKET_INSPECTION 0x01 /**< Flag to indicate that packet header or contents should not be inspected*/ #define PKT_NOPAYLOAD_INSPECTION 0x02 /**< Flag to indicate that packet contents should not be inspected*/ +/** ------ inline functions ------ */ +static inline void DecodeSetNoPayloadInspectionFlag(Packet *); +static inline void DecodeSetNoPacketInspectionFlag(Packet *); + +/** \brief Set the No payload inspection Flag for the packet. + * + * \param p Packet to set the flag in + */ +static inline void DecodeSetNoPayloadInspectionFlag(Packet *p) { + SCEnter(); + p->flags |= PKT_NOPAYLOAD_INSPECTION; + SCReturn; +} + +/** \brief Set the No packet inspection Flag for the packet. + * + * \param p Packet to set the flag in + */ +static inline void DecodeSetNoPacketInspectionFlag(Packet *p) { + SCEnter(); + p->flags |= PKT_NOPACKET_INSPECTION; + SCReturn; +} + + #endif /* __DECODE_H__ */ diff --git a/src/detect-classtype.c b/src/detect-classtype.c index 685fd96..3e77995 100644 --- a/src/detect-classtype.c +++ b/src/detect-classtype.c @@ -25,47 +25,13 @@ int DetectClasstypeSetup(DetectEngineCtx *, Signature *, SigMatch *, char *); void DetectClasstypeRegisterTests(void); /** - * \brief Registers the handler functions for the "Classtype" keyword. - */ -void DetectClasstypeRegister(void) -{ - const char *eb = NULL; - int eo; - int opts = 0; - - SCLogDebug("Registering the Classtype keyword handler"); - - sigmatch_table[DETECT_CLASSTYPE].name = "classtype"; - sigmatch_table[DETECT_CLASSTYPE].Match = NULL; - sigmatch_table[DETECT_CLASSTYPE].Setup = DetectClasstypeSetup; - sigmatch_table[DETECT_CLASSTYPE].Free = NULL; - sigmatch_table[DETECT_CLASSTYPE].RegisterTests = DetectClasstypeRegisterTests; - - regex = pcre_compile(DETECT_CLASSTYPE_REGEX, opts, &eb, &eo, NULL); - if (regex == NULL) { - SCLogError(SC_ERR_PCRE_COMPILE, "Compile of \"%s\" failed at offset %" PRId32 ": %s", - DETECT_CLASSTYPE_REGEX, eo, eb); - goto end; - } - - regex_study = pcre_study(regex, 0, &eb); - if (eb != NULL) { - SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb); - goto end; - } - - end: - return; -} - -/** * \brief Parses the raw string supplied with the "Classtype" keyword. * * \param Pointer to the string to be parsed. * * \retval ct_name Pointer to the parsed string on Success; NULL on failure. */ -static inline const char *DetectClasstypeParseRawString(char *rawstr) +static const char *DetectClasstypeParseRawString(char *rawstr) { const char *ct_name = NULL; #define MAX_SUBSTRINGS 30 @@ -98,25 +64,37 @@ static inline const char *DetectClasstypeParseRawString(char *rawstr) } /** - * \brief Gets the classtype from the corresponding hash table stored - * in the Detection Engine Context, given the classtype name. - * - * \param ct_name Pointer to the classtype name that has to be looked up. - * \param de_ctx Pointer to the Detection Engine Context. - * - * \retval lookup_ct_info Pointer to the SCClassConfClasstype instance from - * the hash table on success; NULL on failure. + * \brief Registers the handler functions for the "Classtype" keyword. */ -static inline SCClassConfClasstype *DetectClasstypeGetClasstypeInfo(const char *ct_name, - DetectEngineCtx *de_ctx) +void DetectClasstypeRegister(void) { - SCClassConfClasstype *ct_info = SCClassConfAllocClasstype(ct_name, NULL, - 0); - SCClassConfClasstype *lookup_ct_info = HashTableLookup(de_ctx->class_conf_ht, - ct_info, 0); + const char *eb = NULL; + int eo; + int opts = 0; + + SCLogDebug("Registering the Classtype keyword handler"); + + sigmatch_table[DETECT_CLASSTYPE].name = "classtype"; + sigmatch_table[DETECT_CLASSTYPE].Match = NULL; + sigmatch_table[DETECT_CLASSTYPE].Setup = DetectClasstypeSetup; + sigmatch_table[DETECT_CLASSTYPE].Free = NULL; + sigmatch_table[DETECT_CLASSTYPE].RegisterTests = DetectClasstypeRegisterTests; + + regex = pcre_compile(DETECT_CLASSTYPE_REGEX, opts, &eb, &eo, NULL); + if (regex == NULL) { + SCLogError(SC_ERR_PCRE_COMPILE, "Compile of \"%s\" failed at offset %" PRId32 ": %s", + DETECT_CLASSTYPE_REGEX, eo, eb); + goto end; + } - SCClassConfDeAllocClasstype(ct_info); - return lookup_ct_info; + regex_study = pcre_study(regex, 0, &eb); + if (eb != NULL) { + SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb); + goto end; + } + + end: + return; } /** diff --git a/src/detect-classtype.h b/src/detect-classtype.h index 5c11e3b..fd410c2 100644 --- a/src/detect-classtype.h +++ b/src/detect-classtype.h @@ -5,8 +5,39 @@ #ifndef __DETECT_CLASSTYPE_H__ #define __DETECT_CLASSTYPE_H__ +#include +#include "suricata-common.h" +#include "detect.h" +#include "util-classification-config.h" + /* prototypes */ void DetectClasstypeRegister(void); +/** ------ inline functions ------ */ + +/** + * \brief Gets the classtype from the corresponding hash table stored + * in the Detection Engine Context, given the classtype name. + * + * \param ct_name Pointer to the classtype name that has to be looked up. + * \param de_ctx Pointer to the Detection Engine Context. + * + * \retval lookup_ct_info Pointer to the SCClassConfClasstype instance from + * the hash table on success; NULL on failure. + */ +static inline SCClassConfClasstype *DetectClasstypeGetClasstypeInfo(const char *ct_name, + DetectEngineCtx *de_ctx) +{ + SCClassConfClasstype *ct_info = SCClassConfAllocClasstype(ct_name, NULL, + 0); + SCClassConfClasstype *lookup_ct_info = HashTableLookup(de_ctx->class_conf_ht, + ct_info, 0); + + SCClassConfDeAllocClasstype(ct_info); + return lookup_ct_info; +} + + + #endif /* __DETECT_CLASSTYPE_H__ */ diff --git a/src/detect-content.c b/src/detect-content.c index c924679..8e925fb 100644 --- a/src/detect-content.c +++ b/src/detect-content.c @@ -103,61 +103,6 @@ static void DetectContentPrintMatches(DetectEngineThreadCtx *det_ctx, DetectCont } #endif -static inline int -TestOffsetDepth(MpmMatch *m, DetectContentData *co, uint16_t pktoff) { - SCEnter(); - - if (m->offset >= pktoff) { - if (co->offset == 0 || (m->offset >= co->offset)) { - if (co->depth == 0 || ((m->offset + co->content_len) <= co->depth)) { - SCLogDebug("depth %" PRIu32 ", offset %" PRIu32 ", m->offset " - "%" PRIu32 ", return 1", co->depth, co->offset, - m->offset); - - /* If we reach this point, it means we have obtained a depth and - * offset match, which indicates that we have a FAILURE if the - * content is negated, and SUCCESS if the content is not negated */ - if (co->negated == 1) - SCReturnInt(0); - else - SCReturnInt(1); - } else { - /* We have success so far with offset, but a failure with - * depth. We can return a match at the bottom of this function - * for negated_content, provided offset is 0. If offset - * isn't 0 for negated_content, we have a failure and we return - * a no match here. If the content is not negated, we have a no - * match, which we return at the end of this function. */ - if (co->offset && co->negated == 1) - SCReturnInt(0); - } - } else { - /* If offset fails, and if the content is negated, we check if depth - * succeeds. If it succeeds, we have a no match for negated content. - * Else we have a success for negated content. If the content is - * not negated, we go down till the end and return a no match. */ - if (co->negated == 1) { - if (co->offset != 0) { - SCReturnInt(1); - } else if (co->depth && (m->offset+co->content_len) <= co->depth) { - SCLogDebug("depth %" PRIu32 ", offset %" PRIu32 ", m->offset %" PRIu32 ", " - "return 0", co->depth, co->offset, m->offset); - SCReturnInt(0); - } - } - } - } - SCLogDebug("depth %" PRIu32 ", offset %" PRIu32 ", m->offset %" PRIu32 ", " - "return 0 (or 1 if negated)", co->depth, co->offset, m->offset); - - /* If we reach this point, we have a match for negated content and no match - * otherwise */ - if (co->negated == 1) - SCReturnInt(1); - else - SCReturnInt(0); -} - /** * \brief test the within, distance, offset and depth of a match * diff --git a/src/detect-content.h b/src/detect-content.h index 63f8208..8efa3a6 100644 --- a/src/detect-content.h +++ b/src/detect-content.h @@ -84,4 +84,63 @@ int DetectContentPropagateModifiers(SigMatch *); void DetectContentFree(void *); +/** ------ inline functions ------ */ + +static inline int +TestOffsetDepth(MpmMatch *m, DetectContentData *co, uint16_t pktoff) { + SCEnter(); + + if (m->offset >= pktoff) { + if (co->offset == 0 || (m->offset >= co->offset)) { + if (co->depth == 0 || ((m->offset + co->content_len) <= co->depth)) { + SCLogDebug("depth %" PRIu32 ", offset %" PRIu32 ", m->offset " + "%" PRIu32 ", return 1", co->depth, co->offset, + m->offset); + + /* If we reach this point, it means we have obtained a depth and + * offset match, which indicates that we have a FAILURE if the + * content is negated, and SUCCESS if the content is not negated */ + if (co->negated == 1) + SCReturnInt(0); + else + SCReturnInt(1); + } else { + /* We have success so far with offset, but a failure with + * depth. We can return a match at the bottom of this function + * for negated_content, provided offset is 0. If offset + * isn't 0 for negated_content, we have a failure and we return + * a no match here. If the content is not negated, we have a no + * match, which we return at the end of this function. */ + if (co->offset && co->negated == 1) + SCReturnInt(0); + } + } else { + /* If offset fails, and if the content is negated, we check if depth + * succeeds. If it succeeds, we have a no match for negated content. + * Else we have a success for negated content. If the content is + * not negated, we go down till the end and return a no match. */ + if (co->negated == 1) { + if (co->offset != 0) { + SCReturnInt(1); + } else if (co->depth && (m->offset+co->content_len) <= co->depth) { + SCLogDebug("depth %" PRIu32 ", offset %" PRIu32 ", m->offset %" PRIu32 ", " + "return 0", co->depth, co->offset, m->offset); + SCReturnInt(0); + } + } + } + } + SCLogDebug("depth %" PRIu32 ", offset %" PRIu32 ", m->offset %" PRIu32 ", " + "return 0 (or 1 if negated)", co->depth, co->offset, m->offset); + + /* If we reach this point, we have a match for negated content and no match + * otherwise */ + if (co->negated == 1) + SCReturnInt(1); + else + SCReturnInt(0); +} + + + #endif /* __DETECT_CONTENT_H__ */ diff --git a/src/detect-dce-iface.c b/src/detect-dce-iface.c index 76b6c00..9255a38 100644 --- a/src/detect-dce-iface.c +++ b/src/detect-dce-iface.c @@ -32,44 +32,6 @@ int DetectDceIfaceSetup(DetectEngineCtx *, Signature *s, SigMatch *m, char *arg) void DetectDceIfaceFree(void *); /** - * \brief Registers the keyword handlers for the "dce_iface" keyword. - */ -void DetectDceIfaceRegister(void) -{ - const char *eb; - int eo; - int opts = 0; - - sigmatch_table[DETECT_DCE_IFACE].name = "dce_iface"; - sigmatch_table[DETECT_DCE_IFACE].alproto = ALPROTO_DCERPC; - sigmatch_table[DETECT_DCE_IFACE].Match = NULL; - sigmatch_table[DETECT_DCE_IFACE].AppLayerMatch = DetectDceIfaceMatch; - sigmatch_table[DETECT_DCE_IFACE].Setup = DetectDceIfaceSetup; - sigmatch_table[DETECT_DCE_IFACE].Free = DetectDceIfaceFree; - sigmatch_table[DETECT_DCE_IFACE].RegisterTests = DetectDceIfaceRegisterTests; - - parse_regex = pcre_compile(DETECT_DCE_IFACE_PCRE_PARSE_ARGS, opts, &eb, - &eo, NULL); - if (parse_regex == NULL) { - SCLogDebug("pcre compile of \"%s\" failed at offset %" PRId32 ": %s", - DETECT_DCE_IFACE_PCRE_PARSE_ARGS, eo, eb); - goto error; - } - - parse_regex_study = pcre_study(parse_regex, 0, &eb); - if (eb != NULL) { - SCLogDebug("pcre study failed: %s", eb); - goto error; - } - - return; - - error: - /* we need to handle error?! */ - return; -} - -/** * \internal * \brief Parses the argument sent along with the "dce_iface" keyword. * @@ -78,7 +40,7 @@ void DetectDceIfaceRegister(void) * \retval did Pointer to a DetectDceIfaceData instance that holds the data * from the parsed arg. */ -static inline DetectDceIfaceData *DetectDceIfaceArgParse(const char *arg) +static DetectDceIfaceData *DetectDceIfaceArgParse(const char *arg) { DetectDceIfaceData *did = NULL; #define MAX_SUBSTRINGS 30 @@ -204,31 +166,43 @@ static inline DetectDceIfaceData *DetectDceIfaceArgParse(const char *arg) return NULL; } + /** - * \internal - * \brief Internal function that compares the dce interface version for this - * flow, to the signature's interface version specified using the - * dce_iface keyword. - * - * \param version The dce interface version for this flow. - * \param dce_data Pointer to the Signature's dce_iface keyword - * state(DetectDceIfaceData *). + * \brief Registers the keyword handlers for the "dce_iface" keyword. */ -static inline int DetectDceIfaceMatchIfaceVersion(uint16_t version, - DetectDceIfaceData *dce_data) +void DetectDceIfaceRegister(void) { - switch (dce_data->op) { - case DETECT_DCE_IFACE_OP_LT: - return (version < dce_data->version); - case DETECT_DCE_IFACE_OP_GT: - return (version > dce_data->version); - case DETECT_DCE_IFACE_OP_EQ: - return (version == dce_data->version); - case DETECT_DCE_IFACE_OP_NE: - return (version != dce_data->version); - default: - return 1; + const char *eb; + int eo; + int opts = 0; + + sigmatch_table[DETECT_DCE_IFACE].name = "dce_iface"; + sigmatch_table[DETECT_DCE_IFACE].alproto = ALPROTO_DCERPC; + sigmatch_table[DETECT_DCE_IFACE].Match = NULL; + sigmatch_table[DETECT_DCE_IFACE].AppLayerMatch = DetectDceIfaceMatch; + sigmatch_table[DETECT_DCE_IFACE].Setup = DetectDceIfaceSetup; + sigmatch_table[DETECT_DCE_IFACE].Free = DetectDceIfaceFree; + sigmatch_table[DETECT_DCE_IFACE].RegisterTests = DetectDceIfaceRegisterTests; + + parse_regex = pcre_compile(DETECT_DCE_IFACE_PCRE_PARSE_ARGS, opts, &eb, + &eo, NULL); + if (parse_regex == NULL) { + SCLogDebug("pcre compile of \"%s\" failed at offset %" PRId32 ": %s", + DETECT_DCE_IFACE_PCRE_PARSE_ARGS, eo, eb); + goto error; + } + + parse_regex_study = pcre_study(parse_regex, 0, &eb); + if (eb != NULL) { + SCLogDebug("pcre study failed: %s", eb); + goto error; } + + return; + + error: + /* we need to handle error?! */ + return; } /** diff --git a/src/detect-dce-iface.h b/src/detect-dce-iface.h index 91f8836..cec67cd 100644 --- a/src/detect-dce-iface.h +++ b/src/detect-dce-iface.h @@ -23,4 +23,34 @@ typedef struct DetectDceIfaceData_ { void DetectDceIfaceRegister(void); void DetectDceIfaceRegisterTests(void); +/** ------ inline functions ------ */ + +/** + * \internal + * \brief Internal function that compares the dce interface version for this + * flow, to the signature's interface version specified using the + * dce_iface keyword. + * + * \param version The dce interface version for this flow. + * \param dce_data Pointer to the Signature's dce_iface keyword + * state(DetectDceIfaceData *). + */ +static inline int DetectDceIfaceMatchIfaceVersion(uint16_t version, + DetectDceIfaceData *dce_data) +{ + switch (dce_data->op) { + case DETECT_DCE_IFACE_OP_LT: + return (version < dce_data->version); + case DETECT_DCE_IFACE_OP_GT: + return (version > dce_data->version); + case DETECT_DCE_IFACE_OP_EQ: + return (version == dce_data->version); + case DETECT_DCE_IFACE_OP_NE: + return (version != dce_data->version); + default: + return 1; + } +} + + #endif /* __DETECT_DCE_IFACE_H__ */ diff --git a/src/detect-dce-opnum.c b/src/detect-dce-opnum.c index 2d13ce2..d620e3c 100644 --- a/src/detect-dce-opnum.c +++ b/src/detect-dce-opnum.c @@ -32,64 +32,6 @@ int DetectDceOpnumSetup(DetectEngineCtx *, Signature *s, SigMatch *m, char *arg) void DetectDceOpnumFree(void *); /** - * \brief Registers the keyword handlers for the "dce_opnum" keyword. - */ -void DetectDceOpnumRegister(void) -{ - const char *eb; - int eo; - int opts = 0; - - sigmatch_table[DETECT_DCE_OPNUM].name = "dce_opnum"; - sigmatch_table[DETECT_DCE_OPNUM].alproto = ALPROTO_DCERPC; - sigmatch_table[DETECT_DCE_OPNUM].Match = NULL; - sigmatch_table[DETECT_DCE_OPNUM].AppLayerMatch = DetectDceOpnumMatch; - sigmatch_table[DETECT_DCE_OPNUM].Setup = DetectDceOpnumSetup; - sigmatch_table[DETECT_DCE_OPNUM].Free = DetectDceOpnumFree; - sigmatch_table[DETECT_DCE_OPNUM].RegisterTests = DetectDceOpnumRegisterTests; - - parse_regex = pcre_compile(DETECT_DCE_OPNUM_PCRE_PARSE_ARGS, opts, &eb, - &eo, NULL); - if (parse_regex == NULL) { - SCLogError(SC_ERR_PCRE_COMPILE, "pcre compile of \"%s\" failed at offset %" PRId32 ": %s", - DETECT_DCE_OPNUM_PCRE_PARSE_ARGS, eo, eb); - goto error; - } - - parse_regex_study = pcre_study(parse_regex, 0, &eb); - if (eb != NULL) { - SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb); - goto error; - } - - return; - - error: - /* we need to handle error?! */ - return; -} - -/** - * \internal - * \brief Creates and returns a new instance of DetectDceOpnumRange. - * - * \retval dor Pointer to the new instance DetectDceOpnumRange. - */ -static inline DetectDceOpnumRange *DetectDceOpnumAllocDetectDceOpnumRange(void) -{ - DetectDceOpnumRange *dor = NULL; - - if ( (dor = SCMalloc(sizeof(DetectDceOpnumRange))) == NULL) { - SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); - exit(EXIT_FAILURE); - } - memset(dor, 0, sizeof(DetectDceOpnumRange)); - dor->range1 = dor->range2 = DCE_OPNUM_RANGE_UNINITIALIZED; - - return dor; -} - -/** * \internal * \brief Parses the argument sent along with the "dce_opnum" keyword. * @@ -98,7 +40,7 @@ static inline DetectDceOpnumRange *DetectDceOpnumAllocDetectDceOpnumRange(void) * \retval did Pointer to a DetectDceIfaceData instance that holds the data * from the parsed arg. */ -static inline DetectDceOpnumData *DetectDceOpnumArgParse(const char *arg) +static DetectDceOpnumData *DetectDceOpnumArgParse(const char *arg) { DetectDceOpnumData *dod = NULL; @@ -219,6 +161,44 @@ static inline DetectDceOpnumData *DetectDceOpnumArgParse(const char *arg) } /** + * \brief Registers the keyword handlers for the "dce_opnum" keyword. + */ +void DetectDceOpnumRegister(void) +{ + const char *eb; + int eo; + int opts = 0; + + sigmatch_table[DETECT_DCE_OPNUM].name = "dce_opnum"; + sigmatch_table[DETECT_DCE_OPNUM].alproto = ALPROTO_DCERPC; + sigmatch_table[DETECT_DCE_OPNUM].Match = NULL; + sigmatch_table[DETECT_DCE_OPNUM].AppLayerMatch = DetectDceOpnumMatch; + sigmatch_table[DETECT_DCE_OPNUM].Setup = DetectDceOpnumSetup; + sigmatch_table[DETECT_DCE_OPNUM].Free = DetectDceOpnumFree; + sigmatch_table[DETECT_DCE_OPNUM].RegisterTests = DetectDceOpnumRegisterTests; + + parse_regex = pcre_compile(DETECT_DCE_OPNUM_PCRE_PARSE_ARGS, opts, &eb, + &eo, NULL); + if (parse_regex == NULL) { + SCLogError(SC_ERR_PCRE_COMPILE, "pcre compile of \"%s\" failed at offset %" PRId32 ": %s", + DETECT_DCE_OPNUM_PCRE_PARSE_ARGS, eo, eb); + goto error; + } + + parse_regex_study = pcre_study(parse_regex, 0, &eb); + if (eb != NULL) { + SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb); + goto error; + } + + return; + + error: + /* we need to handle error?! */ + return; +} + +/** * \brief App layer match function for the "dce_opnum" keyword. * * \param t Pointer to the ThreadVars instance. diff --git a/src/detect-dce-opnum.h b/src/detect-dce-opnum.h index 4ae1e73..504f47d 100644 --- a/src/detect-dce-opnum.h +++ b/src/detect-dce-opnum.h @@ -21,4 +21,28 @@ typedef struct DetectDceOpnumData_ { void DetectDceOpnumRegister(void); void DetectDceOpnumRegisterTests(void); +/** ------ inline functions ------ */ + +/** + * \internal + * \brief Creates and returns a new instance of DetectDceOpnumRange. + * + * \retval dor Pointer to the new instance DetectDceOpnumRange. + */ +static inline DetectDceOpnumRange *DetectDceOpnumAllocDetectDceOpnumRange(void) +{ + DetectDceOpnumRange *dor = NULL; + + if ( (dor = SCMalloc(sizeof(DetectDceOpnumRange))) == NULL) { + SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); + exit(EXIT_FAILURE); + } + memset(dor, 0, sizeof(DetectDceOpnumRange)); + dor->range1 = dor->range2 = DCE_OPNUM_RANGE_UNINITIALIZED; + + return dor; +} + + + #endif /* __DETECT_DCE_OPNUM_H__ */ diff --git a/src/detect-engine-address.h b/src/detect-engine-address.h index 70f3b54..e8e945c 100644 --- a/src/detect-engine-address.h +++ b/src/detect-engine-address.h @@ -4,10 +4,11 @@ * \author Victor Julien */ - #ifndef __DETECT_ADDRESS_H__ #define __DETECT_ADDRESS_H__ +#include "detect.h" + /* prototypes */ void DetectAddressRegister (void); void DetectAddressPrintMemory(void); diff --git a/src/detect-engine-port.h b/src/detect-engine-port.h index cbf3908..0aa93fe 100644 --- a/src/detect-engine-port.h +++ b/src/detect-engine-port.h @@ -1,6 +1,10 @@ #ifndef __DETECT_PORT_H__ #define __DETECT_PORT_H__ +/** \brief Port structure for detection engine */ + +#include "detect.h" + /* prototypes */ void DetectPortRegister (void); diff --git a/src/detect-engine-sigorder.c b/src/detect-engine-sigorder.c index 48ca5e9..54b18fb 100644 --- a/src/detect-engine-sigorder.c +++ b/src/detect-engine-sigorder.c @@ -16,15 +16,6 @@ #include "util-unittest.h" #include "util-debug.h" -#define DETECT_FLOWVAR_NOT_USED 1 -#define DETECT_FLOWVAR_TYPE_READ 2 -#define DETECT_FLOWVAR_TYPE_SET 3 - -#define DETECT_PKTVAR_NOT_USED 1 -#define DETECT_PKTVAR_TYPE_READ 2 -#define DETECT_PKTVAR_TYPE_SET 3 - - /** * \brief Registers a keyword-based, signature ordering function * @@ -72,153 +63,6 @@ static void SCSigRegisterSignatureOrderingFunc(DetectEngineCtx *de_ctx, } /** - * \brief Returns the flowbit type set for this signature. If more than one - * flowbit has been set for the same rule, we return the flowbit type of - * the maximum priority/value, where priority/value is maximum for the - * ones that set the value and the lowest for ones that read the value. - * If no flowbit has been set for the rule, we return 0, which indicates - * the least value amongst flowbit types. - * - * \param sig Pointer to the Signature from which the flowbit value has to be - * returned. - * - * \retval flowbits The flowbits type for this signature if it is set; if it is - * not set, return 0 - */ -static inline int SCSigGetFlowbitsType(Signature *sig) -{ - SigMatch *sm = sig->match; - DetectFlowbitsData *fb = NULL; - int flowbits = 0; - - while (sm != NULL) { - if (sm->type == DETECT_FLOWBITS) { - fb = (DetectFlowbitsData *)sm->ctx; - if (flowbits < fb->cmd) - flowbits = fb->cmd; - } - - sm = sm->next; - } - - return flowbits; -} - -/** - * \brief Returns whether the flowvar set for this rule, sets the flowvar or - * reads the flowvar. If the rule sets the flowvar the function returns - * DETECT_FLOWVAR_TYPE_SET(3), if it reads the flowvar the function - * returns DETECT_FLOWVAR_TYPE_READ(2), and if flowvar is not used in this - * rule the function returns DETECT_FLOWVAR_NOT_USED(1) - * - * \param sig Pointer to the Signature from which the flowvar type has to be - * returned. - * - * \retval type DETECT_FLOWVAR_TYPE_SET(3) if the rule sets the flowvar, - * DETECT_FLOWVAR_TYPE_READ(2) if it reads, and - * DETECT_FLOWVAR_NOT_USED(1) if flowvar is not used. - */ -static inline int SCSigGetFlowvarType(Signature *sig) -{ - SigMatch *sm = sig->match; - DetectPcreData *pd = NULL; - int type = DETECT_FLOWVAR_NOT_USED; - - while (sm != NULL) { - pd = (DetectPcreData *)sm->ctx; - if (sm->type == DETECT_PCRE && pd->flags & DETECT_PCRE_CAPTURE_FLOW) { - type = DETECT_FLOWVAR_TYPE_SET; - return type; - } - - if (sm->type == DETECT_FLOWVAR) - type = DETECT_FLOWVAR_TYPE_READ; - - sm = sm->next; - } - - return type; -} - -/** - * \brief Returns whether the pktvar set for this rule, sets the flowvar or - * reads the pktvar. If the rule sets the pktvar the function returns - * DETECT_PKTVAR_TYPE_SET(3), if it reads the pktvar the function - * returns DETECT_PKTVAR_TYPE_READ(2), and if pktvar is not used in this - * rule the function returns DETECT_PKTVAR_NOT_USED(1) - * - * \param sig Pointer to the Signature from which the pktvar type has to be - * returned. - * - * \retval type DETECT_PKTVAR_TYPE_SET(3) if the rule sets the flowvar, - * DETECT_PKTVAR_TYPE_READ(2) if it reads, and - * DETECT_PKTVAR_NOT_USED(1) if pktvar is not used. - */ -static inline int SCSigGetPktvarType(Signature *sig) -{ - SigMatch *sm = sig->match; - DetectPcreData *pd = NULL; - int type = DETECT_PKTVAR_NOT_USED; - - while (sm != NULL) { - pd = (DetectPcreData *)sm->ctx; - if (sm->type == DETECT_PCRE && pd->flags & DETECT_PCRE_CAPTURE_PKT) { - type = DETECT_PKTVAR_TYPE_SET; - return type; - } - - if (sm->type == DETECT_PKTVAR) - type = DETECT_PKTVAR_TYPE_READ; - - sm = sm->next; - } - - return type; -} - -/** - * \brief Processes the flowbits data for this signature and caches it for - * future use. This is needed to optimize the sig_ordering module. - * - * \param sw The sigwrapper/signature for which the flowbits data has to be - * cached - */ -static inline void SCSigProcessUserDataForFlowbits(SCSigSignatureWrapper *sw) -{ - *((int *)(sw->user[SC_RADIX_USER_DATA_FLOWBITS])) = SCSigGetFlowbitsType(sw->sig); - - return; -} - -/** - * \brief Processes the flowvar data for this signature and caches it for - * future use. This is needed to optimize the sig_ordering module. - * - * \param sw The sigwrapper/signature for which the flowvar data has to be - * cached - */ -static inline void SCSigProcessUserDataForFlowvar(SCSigSignatureWrapper *sw) -{ - *((int *)(sw->user[SC_RADIX_USER_DATA_FLOWVAR])) = SCSigGetFlowvarType(sw->sig); - - return; -} - -/** - * \brief Processes the pktvar data for this signature and caches it for - * future use. This is needed to optimize the sig_ordering module. - * - * \param sw The sigwrapper/signature for which the pktvar data has to be - * cached - */ -static inline void SCSigProcessUserDataForPktvar(SCSigSignatureWrapper *sw) -{ - *((int *)(sw->user[SC_RADIX_USER_DATA_PKTVAR])) = SCSigGetPktvarType(sw->sig); - - return; -} - -/** * \brief Orders an incoming Signature based on its action * * \param de_ctx Pointer to the detection engine context from which the @@ -728,49 +572,6 @@ static void SCSigOrderByPriority(DetectEngineCtx *de_ctx, } /** - * \brief Creates a Wrapper around the Signature - * - * \param Pointer to the Signature to be wrapped - * - * \retval sw Pointer to the wrapper that holds the signature - */ -static inline SCSigSignatureWrapper *SCSigAllocSignatureWrapper(Signature *sig) -{ - SCSigSignatureWrapper *sw = NULL; - int i = 0; - - if ( (sw = SCMalloc(sizeof(SCSigSignatureWrapper))) == NULL) { - printf("Error allocating memory\n"); - exit(EXIT_FAILURE); - } - memset(sw, 0, sizeof(SCSigSignatureWrapper)); - - sw->sig = sig; - - if ( (sw->user = SCMalloc(SC_RADIX_USER_DATA_MAX * sizeof(int *))) == NULL) { - printf("Error allocating memory\n"); - exit(EXIT_FAILURE); - } - memset(sw->user, 0, SC_RADIX_USER_DATA_MAX * sizeof(int *)); - - for (i = 0; i < SC_RADIX_USER_DATA_MAX; i++) { - if ( (sw->user[i] = SCMalloc(sizeof(int))) == NULL) { - printf("Error allocating memory\n"); - exit(EXIT_FAILURE); - } - memset(sw->user[i], 0, sizeof(int)); - } - - /* Process data from the signature into a cache for further use by the - * sig_ordering module */ - SCSigProcessUserDataForFlowbits(sw); - SCSigProcessUserDataForFlowvar(sw); - SCSigProcessUserDataForPktvar(sw); - - return sw; -} - -/** * \brief Orders the signatures * * \param de_ctx Pointer to the Detection Engine Context that holds the diff --git a/src/detect-engine-sigorder.h b/src/detect-engine-sigorder.h index c79e040..7611d7f 100644 --- a/src/detect-engine-sigorder.h +++ b/src/detect-engine-sigorder.h @@ -5,6 +5,29 @@ #ifndef __DETECT_ENGINE_SIGORDER_H__ #define __DETECT_ENGINE_SIGORDER_H__ +#include +#include +#include +#include + +#include "suricata-common.h" +#include "detect.h" +#include "detect-flowbits.h" +#include "detect-engine-sigorder.h" +#include "detect-pcre.h" + +#include "util-unittest.h" +#include "util-debug.h" + +#define DETECT_FLOWVAR_NOT_USED 1 +#define DETECT_FLOWVAR_TYPE_READ 2 +#define DETECT_FLOWVAR_TYPE_SET 3 + +#define DETECT_PKTVAR_NOT_USED 1 +#define DETECT_PKTVAR_TYPE_READ 2 +#define DETECT_PKTVAR_TYPE_SET 3 + + /** * \brief Different kinds of helper data that can be used by the signature * ordering module. Used by the "user" field in SCSigSignatureWrapper @@ -56,4 +79,205 @@ void SCSigRegisterSignatureOrderingFuncs(DetectEngineCtx *); void SCSigRegisterSignatureOrderingTests(void); void SCSigSignatureOrderingModuleCleanup(DetectEngineCtx *); +/** ------ inline functions ------ */ +static inline SCSigSignatureWrapper *SCSigAllocSignatureWrapper(Signature *); +static inline int SCSigGetFlowbitsType(Signature *); +static inline int SCSigGetFlowvarType(Signature *); +static inline int SCSigGetPktvarType(Signature *); +static inline void SCSigProcessUserDataForFlowbits(SCSigSignatureWrapper *); +static inline void SCSigProcessUserDataForFlowvar(SCSigSignatureWrapper *); +static inline void SCSigProcessUserDataForPktvar(SCSigSignatureWrapper *); + +/** + * \brief Creates a Wrapper around the Signature + * + * \param Pointer to the Signature to be wrapped + * + * \retval sw Pointer to the wrapper that holds the signature + */ +static inline SCSigSignatureWrapper *SCSigAllocSignatureWrapper(Signature *sig) +{ + SCSigSignatureWrapper *sw = NULL; + int i = 0; + + if ( (sw = SCMalloc(sizeof(SCSigSignatureWrapper))) == NULL) { + printf("Error allocating memory\n"); + exit(EXIT_FAILURE); + } + memset(sw, 0, sizeof(SCSigSignatureWrapper)); + + sw->sig = sig; + + if ( (sw->user = SCMalloc(SC_RADIX_USER_DATA_MAX * sizeof(int *))) == NULL) { + printf("Error allocating memory\n"); + exit(EXIT_FAILURE); + } + memset(sw->user, 0, SC_RADIX_USER_DATA_MAX * sizeof(int *)); + + for (i = 0; i < SC_RADIX_USER_DATA_MAX; i++) { + if ( (sw->user[i] = SCMalloc(sizeof(int))) == NULL) { + printf("Error allocating memory\n"); + exit(EXIT_FAILURE); + } + memset(sw->user[i], 0, sizeof(int)); + } + + /* Process data from the signature into a cache for further use by the + * sig_ordering module */ + SCSigProcessUserDataForFlowbits(sw); + SCSigProcessUserDataForFlowvar(sw); + SCSigProcessUserDataForPktvar(sw); + + return sw; +} + +/** + * \brief Returns the flowbit type set for this signature. If more than one + * flowbit has been set for the same rule, we return the flowbit type of + * the maximum priority/value, where priority/value is maximum for the + * ones that set the value and the lowest for ones that read the value. + * If no flowbit has been set for the rule, we return 0, which indicates + * the least value amongst flowbit types. + * + * \param sig Pointer to the Signature from which the flowbit value has to be + * returned. + * + * \retval flowbits The flowbits type for this signature if it is set; if it is + * not set, return 0 + */ +static inline int SCSigGetFlowbitsType(Signature *sig) +{ + SigMatch *sm = sig->match; + DetectFlowbitsData *fb = NULL; + int flowbits = 0; + + while (sm != NULL) { + if (sm->type == DETECT_FLOWBITS) { + fb = (DetectFlowbitsData *)sm->ctx; + if (flowbits < fb->cmd) + flowbits = fb->cmd; + } + + sm = sm->next; + } + + return flowbits; +} + +/** + * \brief Returns whether the flowvar set for this rule, sets the flowvar or + * reads the flowvar. If the rule sets the flowvar the function returns + * DETECT_FLOWVAR_TYPE_SET(3), if it reads the flowvar the function + * returns DETECT_FLOWVAR_TYPE_READ(2), and if flowvar is not used in this + * rule the function returns DETECT_FLOWVAR_NOT_USED(1) + * + * \param sig Pointer to the Signature from which the flowvar type has to be + * returned. + * + * \retval type DETECT_FLOWVAR_TYPE_SET(3) if the rule sets the flowvar, + * DETECT_FLOWVAR_TYPE_READ(2) if it reads, and + * DETECT_FLOWVAR_NOT_USED(1) if flowvar is not used. + */ +static inline int SCSigGetFlowvarType(Signature *sig) +{ + SigMatch *sm = sig->match; + DetectPcreData *pd = NULL; + int type = DETECT_FLOWVAR_NOT_USED; + + while (sm != NULL) { + pd = (DetectPcreData *)sm->ctx; + if (sm->type == DETECT_PCRE && pd->flags & DETECT_PCRE_CAPTURE_FLOW) { + type = DETECT_FLOWVAR_TYPE_SET; + return type; + } + + if (sm->type == DETECT_FLOWVAR) + type = DETECT_FLOWVAR_TYPE_READ; + + sm = sm->next; + } + + return type; +} + +/** + * \brief Returns whether the pktvar set for this rule, sets the flowvar or + * reads the pktvar. If the rule sets the pktvar the function returns + * DETECT_PKTVAR_TYPE_SET(3), if it reads the pktvar the function + * returns DETECT_PKTVAR_TYPE_READ(2), and if pktvar is not used in this + * rule the function returns DETECT_PKTVAR_NOT_USED(1) + * + * \param sig Pointer to the Signature from which the pktvar type has to be + * returned. + * + * \retval type DETECT_PKTVAR_TYPE_SET(3) if the rule sets the flowvar, + * DETECT_PKTVAR_TYPE_READ(2) if it reads, and + * DETECT_PKTVAR_NOT_USED(1) if pktvar is not used. + */ +static inline int SCSigGetPktvarType(Signature *sig) +{ + SigMatch *sm = sig->match; + DetectPcreData *pd = NULL; + int type = DETECT_PKTVAR_NOT_USED; + + while (sm != NULL) { + pd = (DetectPcreData *)sm->ctx; + if (sm->type == DETECT_PCRE && pd->flags & DETECT_PCRE_CAPTURE_PKT) { + type = DETECT_PKTVAR_TYPE_SET; + return type; + } + + if (sm->type == DETECT_PKTVAR) + type = DETECT_PKTVAR_TYPE_READ; + + sm = sm->next; + } + + return type; +} + +/** + * \brief Processes the flowbits data for this signature and caches it for + * future use. This is needed to optimize the sig_ordering module. + * + * \param sw The sigwrapper/signature for which the flowbits data has to be + * cached + */ +static inline void SCSigProcessUserDataForFlowbits(SCSigSignatureWrapper *sw) +{ + *((int *)(sw->user[SC_RADIX_USER_DATA_FLOWBITS])) = SCSigGetFlowbitsType(sw->sig); + + return; +} + +/** + * \brief Processes the flowvar data for this signature and caches it for + * future use. This is needed to optimize the sig_ordering module. + * + * \param sw The sigwrapper/signature for which the flowvar data has to be + * cached + */ +static inline void SCSigProcessUserDataForFlowvar(SCSigSignatureWrapper *sw) +{ + *((int *)(sw->user[SC_RADIX_USER_DATA_FLOWVAR])) = SCSigGetFlowvarType(sw->sig); + + return; +} + +/** + * \brief Processes the pktvar data for this signature and caches it for + * future use. This is needed to optimize the sig_ordering module. + * + * \param sw The sigwrapper/signature for which the pktvar data has to be + * cached + */ +static inline void SCSigProcessUserDataForPktvar(SCSigSignatureWrapper *sw) +{ + *((int *)(sw->user[SC_RADIX_USER_DATA_PKTVAR])) = SCSigGetPktvarType(sw->sig); + + return; +} + + + #endif /* __DETECT_ENGINE_SIGORDER_H__ */ diff --git a/src/detect-fast-pattern.c b/src/detect-fast-pattern.c index 86cca74..9201710 100644 --- a/src/detect-fast-pattern.c +++ b/src/detect-fast-pattern.c @@ -78,11 +78,6 @@ int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, #ifdef UNITTESTS -inline SigGroupHead *SigMatchSignaturesGetSgh(ThreadVars *, - DetectEngineCtx *, - DetectEngineThreadCtx *, - Packet *); - /** * \test Checks if a fast_pattern is registered in a Signature */ diff --git a/src/detect-fast-pattern.h b/src/detect-fast-pattern.h index bc12498..cece5e5 100644 --- a/src/detect-fast-pattern.h +++ b/src/detect-fast-pattern.h @@ -6,6 +6,5 @@ #define __DETECT_FAST_PATTERN_H__ void DetectFastPatternRegister(void); - #endif /* __DETECT_FAST_PATTERN_H__ */ diff --git a/src/detect-stream_size.c b/src/detect-stream_size.c index b73526b..f9b4946 100644 --- a/src/detect-stream_size.c +++ b/src/detect-stream_size.c @@ -63,50 +63,6 @@ error: } /** - * \brief Function to comapre the stream size against defined size in the user - * options. - * - * \param diff The stream size of server or client stream. - * \param stream_size User defined stream size - * \param mode The mode defined by user. - * - * \retval 1 on success and 0 on failure. - */ - -static inline int DetectStreamSizeCompare (uint32_t diff, uint32_t stream_size, uint8_t mode) { - - int ret = 0; - switch (mode) { - case DETECTSSIZE_LT: - if (diff < stream_size) - ret = 1; - break; - case DETECTSSIZE_LEQ: - if (diff <= stream_size) - ret = 1; - break; - case DETECTSSIZE_EQ: - if (diff == stream_size) - ret = 1; - break; - case DETECTSSIZE_NEQ: - if (diff != stream_size) - ret = 1; - break; - case DETECTSSIZE_GEQ: - if (diff >= stream_size) - ret = 1; - break; - case DETECTSSIZE_GT: - if (diff > stream_size) - ret = 1; - break; - } - - return ret; -} - -/** * \brief This function is used to match Stream size rule option on a packet with those passed via stream_size: * * \param t pointer to thread vars diff --git a/src/detect-stream_size.h b/src/detect-stream_size.h index 61e67a9..1201830 100644 --- a/src/detect-stream_size.h +++ b/src/detect-stream_size.h @@ -28,5 +28,52 @@ typedef struct DetectStreamSizeData_ { void DetectStreamSizeRegister(void); +/** ------ inline functions ------ */ + +/** + * \brief Function to comapre the stream size against defined size in the user + * options. + * + * \param diff The stream size of server or client stream. + * \param stream_size User defined stream size + * \param mode The mode defined by user. + * + * \retval 1 on success and 0 on failure. + */ + +static inline int DetectStreamSizeCompare (uint32_t diff, uint32_t stream_size, uint8_t mode) { + + int ret = 0; + switch (mode) { + case DETECTSSIZE_LT: + if (diff < stream_size) + ret = 1; + break; + case DETECTSSIZE_LEQ: + if (diff <= stream_size) + ret = 1; + break; + case DETECTSSIZE_EQ: + if (diff == stream_size) + ret = 1; + break; + case DETECTSSIZE_NEQ: + if (diff != stream_size) + ret = 1; + break; + case DETECTSSIZE_GEQ: + if (diff >= stream_size) + ret = 1; + break; + case DETECTSSIZE_GT: + if (diff > stream_size) + ret = 1; + break; + } + + return ret; +} + + #endif /* _DETECT_STREAM_SIZE_H */ diff --git a/src/detect-uricontent.c b/src/detect-uricontent.c index 89d50e1..ac366e8 100644 --- a/src/detect-uricontent.c +++ b/src/detect-uricontent.c @@ -85,135 +85,6 @@ void PktHttpUriFree(Packet *p) p->http_uri.cnt = 0; } -static inline int TestOffsetDepth(MpmMatch *m, DetectUricontentData *co) -{ - if (co->offset == 0 || - (co->offset && ((m->offset+1) - co->uricontent_len) >= co->offset)) - { - if (co->depth == 0 || - (co->depth && (m->offset+1) <= co->depth)) - { - return 1; - } - } - - return 0; -} - -/* This function is called recursively (if necessary) to be able - * to determite whether or not a chain of content matches connected - * with 'within' and 'distance' options fully matches. The reason it - * was done like this is to make sure we can handle partial matches - * that turn out to fail being followed by full matches later in the - * packet. This adds some runtime complexity however. */ -static inline int TestWithinDistanceOffsetDepth(ThreadVars *t, - DetectEngineThreadCtx *det_ctx, - MpmMatch *m, SigMatch *nsm) -{ - //printf("test_nextsigmatch m:%p, nsm:%p\n", m,nsm); - if (nsm == NULL) - return 1; - - DetectUricontentData *co = (DetectUricontentData *)nsm->ctx; - MpmMatch *nm = det_ctx->mtcu.match[co->id].top; - - for (; nm; nm = nm->next) { - SCLogDebug("(nm->offset+1) %" PRIu32 ", (m->offset+1) %" PRIu32 "", - (nm->offset+1), (m->offset+1)); - - if ((co->within == 0 || (co->within && - ((nm->offset+1) > (m->offset+1)) && - ((nm->offset+1) - (m->offset+1) <= co->within)))) - { - SCLogDebug("WITHIN (nm->offset+1) %" PRIu32 ", (m->offset+1) " - "%" PRIu32 "", (nm->offset+1), (m->offset+1)); - - if (co->distance == 0 || (co->distance && - ((nm->offset+1) > (m->offset+1)) && - ((nm->offset+1) - (m->offset+1) >= co->distance))) - { - if (TestOffsetDepth(nm, co) == 1) { - SCLogDebug("DISTANCE (nm->offset+1) %" PRIu32 ", " - "(m->offset+1) %" PRIu32 "", (nm->offset+1), - (m->offset+1)); - return TestWithinDistanceOffsetDepth(t, det_ctx, nm, - nsm->next); - } - } - } - } - return 0; -} - -static inline int DoDetectUricontent(ThreadVars *t, DetectEngineThreadCtx *det_ctx, - Packet *p, SigMatch *sm, - DetectUricontentData *co) -{ - int ret = 0; - char match = 0; - - /* Get the top match, we already know we have one. */ - MpmMatch *m = det_ctx->mtcu.match[co->id].top; - - /* if we have within or distance coming up next, check this match - * for distance and/or within and check the rest of this match - * chain as well. */ - if ((co->flags & DETECT_URICONTENT_WITHIN_NEXT || - co->flags & DETECT_URICONTENT_DISTANCE_NEXT) && - det_ctx->de_checking_distancewithin == 0) - { - /* indicate to the detection engine the next sigmatch(es) - * are part of this match chain */ - det_ctx->de_checking_distancewithin = 1; - - for (; m != NULL; m = m->next) { - /* first check our match for offset and depth */ - if (TestOffsetDepth(m, co) == 1) { - ret = TestWithinDistanceOffsetDepth(t, det_ctx, m, sm->next); - if (ret == 1) { - /* update pkt ptrs, content doesn't use this, - * but pcre does */ - det_ctx->pkt_ptr = p->payload + m->offset; - det_ctx->pkt_off = m->offset; - match = 1; - break; - } - } - } - /* Okay, this is complicated... on the first match of a match chain, - * we do the whole match of that chain (a chain here means a number - * of consecutive content matches that relate to each other with - * 'within and/or 'distance options'). But we still get to the next - * sigmatches. We have already inspected this sigmatch, even for - * offset and depth. Since the fact that we get there means we have - * had a match, we return match here too. - */ - } else if (co->flags & DETECT_URICONTENT_WITHIN || - co->flags & DETECT_URICONTENT_DISTANCE) - { - det_ctx->de_checking_distancewithin = 0; - match = 1; - /* Getting here means we are not in checking an within/distance chain. - * This means we can just inspect this content match on it's own. So - * Let's see if at least one of the matches within the offset and depth - * settings. If so, return a match. - */ - } else { - for (; m != NULL; m = m->next) { - ret = TestOffsetDepth(m,co); - if (ret == 1) { - /* update pkt ptrs, content doesn't use this, - * but pcre does */ - det_ctx->pkt_ptr = p->payload + m->offset; - det_ctx->pkt_off = m->offset; - match = 1; - break; - } - } - } - return match; -} - /** * \brief Checks if the packet sent as the argument, has a uricontent which diff --git a/src/detect-uricontent.h b/src/detect-uricontent.h index 063fd0a..67c117e 100644 --- a/src/detect-uricontent.h +++ b/src/detect-uricontent.h @@ -28,5 +28,137 @@ uint32_t DetectUricontentMaxId(DetectEngineCtx *); void PktHttpUriFree(Packet *p); uint32_t DetectUricontentInspectMpm(ThreadVars *th_v, DetectEngineThreadCtx *det_ctx, void *alstate); +/** ------ inline functions ------ */ + +static inline int TestOffsetDepthUri(MpmMatch *m, DetectUricontentData *co) +{ + if (co->offset == 0 || + (co->offset && ((m->offset+1) - co->uricontent_len) >= co->offset)) + { + if (co->depth == 0 || + (co->depth && (m->offset+1) <= co->depth)) + { + return 1; + } + } + + return 0; +} + +/* This function is called recursively (if necessary) to be able + * to determite whether or not a chain of content matches connected + * with 'within' and 'distance' options fully matches. The reason it + * was done like this is to make sure we can handle partial matches + * that turn out to fail being followed by full matches later in the + * packet. This adds some runtime complexity however. */ +static inline int TestWithinDistanceOffsetDepthUri(ThreadVars *t, + DetectEngineThreadCtx *det_ctx, + MpmMatch *m, SigMatch *nsm) +{ + //printf("test_nextsigmatch m:%p, nsm:%p\n", m,nsm); + if (nsm == NULL) + return 1; + + DetectUricontentData *co = (DetectUricontentData *)nsm->ctx; + MpmMatch *nm = det_ctx->mtcu.match[co->id].top; + + for (; nm; nm = nm->next) { + SCLogDebug("(nm->offset+1) %" PRIu32 ", (m->offset+1) %" PRIu32 "", + (nm->offset+1), (m->offset+1)); + + if ((co->within == 0 || (co->within && + ((nm->offset+1) > (m->offset+1)) && + ((nm->offset+1) - (m->offset+1) <= co->within)))) + { + SCLogDebug("WITHIN (nm->offset+1) %" PRIu32 ", (m->offset+1) " + "%" PRIu32 "", (nm->offset+1), (m->offset+1)); + + if (co->distance == 0 || (co->distance && + ((nm->offset+1) > (m->offset+1)) && + ((nm->offset+1) - (m->offset+1) >= co->distance))) + { + if (TestOffsetDepthUri(nm, co) == 1) { + SCLogDebug("DISTANCE (nm->offset+1) %" PRIu32 ", " + "(m->offset+1) %" PRIu32 "", (nm->offset+1), + (m->offset+1)); + return TestWithinDistanceOffsetDepthUri(t, det_ctx, nm, + nsm->next); + } + } + } + } + return 0; +} + +static inline int DoDetectUricontent(ThreadVars *t, DetectEngineThreadCtx *det_ctx, + Packet *p, SigMatch *sm, + DetectUricontentData *co) +{ + int ret = 0; + char match = 0; + + /* Get the top match, we already know we have one. */ + MpmMatch *m = det_ctx->mtcu.match[co->id].top; + + /* if we have within or distance coming up next, check this match + * for distance and/or within and check the rest of this match + * chain as well. */ + if ((co->flags & DETECT_URICONTENT_WITHIN_NEXT || + co->flags & DETECT_URICONTENT_DISTANCE_NEXT) && + det_ctx->de_checking_distancewithin == 0) + { + /* indicate to the detection engine the next sigmatch(es) + * are part of this match chain */ + det_ctx->de_checking_distancewithin = 1; + + for (; m != NULL; m = m->next) { + /* first check our match for offset and depth */ + if (TestOffsetDepthUri(m, co) == 1) { + ret = TestWithinDistanceOffsetDepthUri(t, det_ctx, m, sm->next); + if (ret == 1) { + /* update pkt ptrs, content doesn't use this, + * but pcre does */ + det_ctx->pkt_ptr = p->payload + m->offset; + det_ctx->pkt_off = m->offset; + match = 1; + break; + } + } + } + /* Okay, this is complicated... on the first match of a match chain, + * we do the whole match of that chain (a chain here means a number + * of consecutive content matches that relate to each other with + * 'within and/or 'distance options'). But we still get to the next + * sigmatches. We have already inspected this sigmatch, even for + * offset and depth. Since the fact that we get there means we have + * had a match, we return match here too. + */ + } else if (co->flags & DETECT_URICONTENT_WITHIN || + co->flags & DETECT_URICONTENT_DISTANCE) + { + det_ctx->de_checking_distancewithin = 0; + match = 1; + /* Getting here means we are not in checking an within/distance chain. + * This means we can just inspect this content match on it's own. So + * Let's see if at least one of the matches within the offset and depth + * settings. If so, return a match. + */ + } else { + for (; m != NULL; m = m->next) { + ret = TestOffsetDepthUri(m,co); + if (ret == 1) { + /* update pkt ptrs, content doesn't use this, + * but pcre does */ + det_ctx->pkt_ptr = p->payload + m->offset; + det_ctx->pkt_off = m->offset; + match = 1; + break; + } + } + } + return match; +} + + #endif /* __DETECT_URICONTENT_H__ */ diff --git a/src/detect.c b/src/detect.c index c4bb56b..8770174 100644 --- a/src/detect.c +++ b/src/detect.c @@ -433,60 +433,6 @@ int PacketAlertAppend(Packet *p, uint32_t gid, uint32_t sid, uint8_t rev, return 0; } -inline SigGroupHead *SigMatchSignaturesGetSgh(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p) { - SCEnter(); - - int ds,f; - SigGroupHead *sgh = NULL; - - /* select the dsize_gh */ - if (p->payload_len <= 100) - ds = 0; - else - ds = 1; - - /* select the flow_gh */ - if (p->flowflags & FLOW_PKT_TOCLIENT) - f = 0; - else - f = 1; - - SCLogDebug("ds %d, f %d", ds, f); - - /* find the right mpm instance */ - DetectAddress *ag = DetectAddressLookupInHead(de_ctx->dsize_gh[ds].flow_gh[f].src_gh[p->proto],&p->src); - if (ag != NULL) { - /* source group found, lets try a dst group */ - ag = DetectAddressLookupInHead(ag->dst_gh,&p->dst); - if (ag != NULL) { - if (ag->port == NULL) { - SCLogDebug("we don't have ports"); - sgh = ag->sh; - } else { - SCLogDebug("we have ports"); - - DetectPort *sport = DetectPortLookupGroup(ag->port,p->sp); - if (sport != NULL) { - DetectPort *dport = DetectPortLookupGroup(sport->dst_ph,p->dp); - if (dport != NULL) { - sgh = dport->sh; - } else { - SCLogDebug("no dst port group found for the packet"); - } - } else { - SCLogDebug("no src port group found for the packet"); - } - } - } else { - SCLogDebug("no dst address group found for the packet"); - } - } else { - SCLogDebug("no src address group found for the packet"); - } - - SCReturnPtr(sgh, "SigGroupHead"); -} - int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p) { int match = 0, fmatch = 0; diff --git a/src/detect.h b/src/detect.h index 8de84a9..12d4099 100644 --- a/src/detect.h +++ b/src/detect.h @@ -5,8 +5,6 @@ #include "flow.h" -#include "detect-engine-proto.h" - #include "packet-queue.h" #include "util-mpm.h" #include "util-hash.h" @@ -21,6 +19,7 @@ /* forward declarations for the structures from detect-engine-sigorder.h */ struct SCSigOrderFunc_; struct SCSigSignatureWrapper_; +typedef struct DetectEngineCtx_ DetectEngineCtx; /* * DETECT ADDRESS @@ -46,6 +45,22 @@ enum { #define ADDRESS_PORTS_NOTUNIQ 0x10 #define ADDRESS_HAVEPORT 0x20 +/* + * DETECT PORT + */ + +/* a is ... than b */ +enum { + PORT_ER = -1, /* error e.g. compare ipv4 and ipv6 */ + PORT_LT, /* smaller [aaa] [bbb] */ + PORT_LE, /* smaller with overlap [aa[bab]bb] */ + PORT_EQ, /* exactly equal [abababab] */ + PORT_ES, /* within [bb[aaa]bb] and [[abab]bbb] and [bbb[abab]] */ + PORT_EB, /* completely overlaps [aa[bbb]aa] and [[baba]aaa] and [aaa[baba]] */ + PORT_GE, /* bigger with overlap [bb[aba]aa] */ + PORT_GT, /* bigger [bbb] [aaa] */ +}; + typedef struct DetectAddress_ { /* address data for this group */ uint8_t family; @@ -68,28 +83,12 @@ typedef struct DetectAddress_ { uint32_t cnt; } DetectAddress; -/** Signature grouping head. Here 'any', ipv4 and ipv6 are split out */ typedef struct DetectAddressHead_ { DetectAddress *any_head; DetectAddress *ipv4_head; DetectAddress *ipv6_head; } DetectAddressHead; -/* - * DETECT PORT - */ - -/* a is ... than b */ -enum { - PORT_ER = -1, /* error e.g. compare ipv4 and ipv6 */ - PORT_LT, /* smaller [aaa] [bbb] */ - PORT_LE, /* smaller with overlap [aa[bab]bb] */ - PORT_EQ, /* exactly equal [abababab] */ - PORT_ES, /* within [bb[aaa]bb] and [[abab]bbb] and [bbb[abab]] */ - PORT_EB, /* completely overlaps [aa[bbb]aa] and [[baba]aaa] and [aaa[baba]] */ - PORT_GE, /* bigger with overlap [bb[aba]aa] */ - PORT_GT, /* bigger [bbb] [aaa] */ -}; #define PORT_FLAG_ANY 0x01 /**< 'any' special port */ #define PORT_FLAG_NOT 0x02 /**< negated port */ @@ -117,6 +116,11 @@ typedef struct DetectPort_ { uint8_t flags; /**< flags for this port */ } DetectPort; +#include "detect-engine-proto.h" +#include "detect-engine-address.h" +#include "detect-engine-port.h" + + /* Signature flags */ #define SIG_FLAG_RECURSIVE 0x0001 /**< recursive capturing enabled */ #define SIG_FLAG_SRC_ANY 0x0002 /**< source is any */ @@ -238,7 +242,7 @@ typedef struct ThresholdCtx_ { } ThresholdCtx; /** \brief main detection engine ctx */ -typedef struct DetectEngineCtx_ { +struct DetectEngineCtx_ { uint8_t flags; uint8_t failure_fatal; @@ -323,7 +327,7 @@ typedef struct DetectEngineCtx_ { uint16_t max_uniq_small_toserver_dst_groups; uint16_t max_uniq_small_toserver_sp_groups; uint16_t max_uniq_small_toserver_dp_groups; -} DetectEngineCtx; +}; /* Engine groups profiles (low, medium, high, custom) */ enum { @@ -588,5 +592,61 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p); int SignatureIsIPOnly(DetectEngineCtx *de_ctx, Signature *s); +/** ------ inline functions ------ */ + +static inline SigGroupHead *SigMatchSignaturesGetSgh(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p) { + SCEnter(); + + int ds,f; + SigGroupHead *sgh = NULL; + + /* select the dsize_gh */ + if (p->payload_len <= 100) + ds = 0; + else + ds = 1; + + /* select the flow_gh */ + if (p->flowflags & FLOW_PKT_TOCLIENT) + f = 0; + else + f = 1; + + SCLogDebug("ds %d, f %d", ds, f); + + /* find the right mpm instance */ + DetectAddress *ag = DetectAddressLookupInHead(de_ctx->dsize_gh[ds].flow_gh[f].src_gh[p->proto],&p->src); + if (ag != NULL) { + /* source group found, lets try a dst group */ + ag = DetectAddressLookupInHead(ag->dst_gh,&p->dst); + if (ag != NULL) { + if (ag->port == NULL) { + SCLogDebug("we don't have ports"); + sgh = ag->sh; + } else { + SCLogDebug("we have ports"); + + DetectPort *sport = DetectPortLookupGroup(ag->port,p->sp); + if (sport != NULL) { + DetectPort *dport = DetectPortLookupGroup(sport->dst_ph,p->dp); + if (dport != NULL) { + sgh = dport->sh; + } else { + SCLogDebug("no dst port group found for the packet"); + } + } else { + SCLogDebug("no src port group found for the packet"); + } + } + } else { + SCLogDebug("no dst address group found for the packet"); + } + } else { + SCLogDebug("no src address group found for the packet"); + } + + SCReturnPtr(sgh, "SigGroupHead"); +} + #endif /* __DETECT_H__ */ diff --git a/src/flow.c b/src/flow.c index fcf90d9..9f2933c 100644 --- a/src/flow.c +++ b/src/flow.c @@ -327,42 +327,6 @@ void FlowDecrUsecnt(ThreadVars *tv, Packet *p) { SCMutexUnlock(&p->flow->m); } -#define TOSERVER 0 -#define TOCLIENT 1 - -/** - * \brief determine the direction of the packet compared to the flow - * \retval 0 to_server - * \retval 1 to_client - */ -static inline int FlowGetPacketDirection(Flow *f, Packet *p) { - if (p->proto == IPPROTO_TCP || p->proto == IPPROTO_UDP) { - if (!(CMP_PORT(p->sp,p->dp))) { - /* update flags and counters */ - if (CMP_PORT(f->sp,p->sp)) { - return TOSERVER; - } else { - return TOCLIENT; - } - } else { - if (CMP_ADDR(&f->src,&p->src)) { - return TOSERVER; - } else { - return TOCLIENT; - } - } - } else if (p->proto == IPPROTO_ICMP || p->proto == IPPROTO_ICMPV6) { - if (CMP_ADDR(&f->src,&p->src)) { - return TOSERVER; - } else { - return TOCLIENT; - } - } - - /* default to toserver */ - return TOSERVER; -} - /** \brief Entry point for packet flow handling * * This is called for every packet. diff --git a/src/flow.h b/src/flow.h index 842e8d7..4953484 100644 --- a/src/flow.h +++ b/src/flow.h @@ -137,5 +137,43 @@ void FlowSetNoPacketInspectionFlag(Flow *); void FlowLockSetNoPayloadInspectionFlag(Flow *); void FlowSetNoPayloadInspectionFlag(Flow *); +/** ------ inline functions ------ */ + +#define TOSERVER 0 +#define TOCLIENT 1 + +/** + * \brief determine the direction of the packet compared to the flow + * \retval 0 to_server + * \retval 1 to_client + */ +static inline int FlowGetPacketDirection(Flow *f, Packet *p) { + if (p->proto == IPPROTO_TCP || p->proto == IPPROTO_UDP) { + if (!(CMP_PORT(p->sp,p->dp))) { + /* update flags and counters */ + if (CMP_PORT(f->sp,p->sp)) { + return TOSERVER; + } else { + return TOCLIENT; + } + } else { + if (CMP_ADDR(&f->src,&p->src)) { + return TOSERVER; + } else { + return TOCLIENT; + } + } + } else if (p->proto == IPPROTO_ICMP || p->proto == IPPROTO_ICMPV6) { + if (CMP_ADDR(&f->src,&p->src)) { + return TOSERVER; + } else { + return TOCLIENT; + } + } + + /* default to toserver */ + return TOSERVER; +} + #endif /* __FLOW_H__ */ diff --git a/src/stream-tcp.c b/src/stream-tcp.c index 8ba3e5d..7854f96 100644 --- a/src/stream-tcp.c +++ b/src/stream-tcp.c @@ -382,39 +382,6 @@ TcpSession *StreamTcpNewSession (Packet *p) return ssn; } -static inline void StreamTcpPacketSetState(Packet *p, TcpSession *ssn, - uint8_t state) -{ - if (state == ssn->state) - return; - - ssn->state = state; - - FlowUpdateQueue(p->flow); -} - -/** - * \brief Function to flip the direction When we missed the SYN packet, - * SYN/ACK is considered as sent by server, but our engine flagged the - * packet as from client for the host whose packet is received first in - * the session. - * - * \param ssn TcpSession to whom this packet belongs - * \param p Packet whose flag has to be changed - */ -static inline void StreamTcpPacketSwitchDir(TcpSession *ssn, Packet *p) -{ - SCLogDebug("ssn %p: switching pkt direction", ssn); - - if (PKT_IS_TOSERVER(p)) { - p->flowflags &= ~FLOW_PKT_TOSERVER; - p->flowflags |= FLOW_PKT_TOCLIENT; - } else { - p->flowflags &= ~FLOW_PKT_TOCLIENT; - p->flowflags |= FLOW_PKT_TOSERVER; - } -} - /** * \brief Function to set the OS policy for the given stream based on the * destination of the received packet. diff --git a/src/stream-tcp.h b/src/stream-tcp.h index f817038..ca666eb 100644 --- a/src/stream-tcp.h +++ b/src/stream-tcp.h @@ -3,6 +3,11 @@ #ifndef __STREAM_TCP_H__ #define __STREAM_TCP_H__ +#include "stream-tcp-private.h" +#include "stream-tcp-reassemble.h" +#include "stream-tcp.h" +#include "stream.h" + #define COUNTER_STREAMTCP_STREAMS 1 #define STREAM_VERBOSE FALSE @@ -25,5 +30,42 @@ void StreamTcpIncrMemuse(uint32_t); void StreamTcpDecrMemuse(uint32_t); int StreamTcpCheckMemcap(uint32_t); +/** ------ inline functions ------ */ + +static inline void StreamTcpPacketSetState(Packet *p, TcpSession *ssn, + uint8_t state) +{ + if (state == ssn->state) + return; + + ssn->state = state; + + FlowUpdateQueue(p->flow); +} + +/** + * \brief Function to flip the direction When we missed the SYN packet, + * SYN/ACK is considered as sent by server, but our engine flagged the + * packet as from client for the host whose packet is received first in + * the session. + * + * \param ssn TcpSession to whom this packet belongs + * \param p Packet whose flag has to be changed + */ +static inline void StreamTcpPacketSwitchDir(TcpSession *ssn, Packet *p) +{ + SCLogDebug("ssn %p: switching pkt direction", ssn); + + if (PKT_IS_TOSERVER(p)) { + p->flowflags &= ~FLOW_PKT_TOSERVER; + p->flowflags |= FLOW_PKT_TOCLIENT; + } else { + p->flowflags &= ~FLOW_PKT_TOCLIENT; + p->flowflags |= FLOW_PKT_TOSERVER; + } +} + + + #endif /* __STREAM_TCP_H__ */ diff --git a/src/suricata-common.h b/src/suricata-common.h index 278a928..0171468 100644 --- a/src/suricata-common.h +++ b/src/suricata-common.h @@ -118,5 +118,36 @@ size_t strlcat(char *, const char *src, size_t siz); size_t strlcpy(char *dst, const char *src, size_t siz); +/* uppercase to lowercase conversion lookup table */ +uint8_t g_u8_lowercasetable[256]; +/* marco to do the actual lookup */ +#define u8_tolower(c) g_u8_lowercasetable[(c)] + +/** ---- Inline functions ---- */ +static inline void memcpy_tolower(uint8_t *d, uint8_t *s, uint16_t len) +{ + uint16_t i; + for (i = 0; i < len; i++) + d[i] = u8_tolower(s[i]); + + return; +} + +static inline int +memcmp_lowercase(uint8_t *s1, uint8_t *s2, uint16_t n) { + size_t i; + + /* check backwards because we already tested the first + * 2 to 4 chars. This way we are more likely to detect + * a miss and thus speed up a little... */ + for (i = n - 1; i; i--) { + if (u8_tolower(*(s2+i)) != s1[i]) + return 1; + } + + return 0; +} + + #endif /* __SURICATA_COMMON_H__ */ diff --git a/src/suricata.h b/src/suricata.h index 4426786..abb549b 100644 --- a/src/suricata.h +++ b/src/suricata.h @@ -52,10 +52,6 @@ PacketQueue trans_q[256]; /* memset to zeros, and mutex init! */ void GlobalInits(); -/* uppercase to lowercase conversion lookup table */ -uint8_t g_u8_lowercasetable[256]; -/* marco to do the actual lookup */ -#define u8_tolower(c) g_u8_lowercasetable[(c)] // these 2 are slower: //#define u8_tolower(c) ((c) >= 'A' && (c) <= 'Z') ? g_u8_lowercasetable[(c)] : (c) //#define u8_tolower(c) ((c) >= 'A' && (c) <= 'Z') ? ((c) + ('a' - 'A')) : (c) diff --git a/src/tm-threads.c b/src/tm-threads.c index f4233c0..926623b 100644 --- a/src/tm-threads.c +++ b/src/tm-threads.c @@ -47,68 +47,6 @@ SCMutex tv_root_lock = PTHREAD_MUTEX_INITIALIZER; thread encounters a failure. Defaults to restart the failed thread */ uint8_t tv_aof = THV_RESTART_THREAD; -typedef struct TmSlot_ { - /* function pointers */ - TmEcode (*SlotFunc)(ThreadVars *, Packet *, void *, PacketQueue *); - - TmEcode (*SlotThreadInit)(ThreadVars *, void *, void **); - void (*SlotThreadExitPrintStats)(ThreadVars *, void *); - TmEcode (*SlotThreadDeinit)(ThreadVars *, void *); - - /* data storage */ - void *slot_initdata; - void *slot_data; - PacketQueue slot_pq; - - /* linked list, only used by TmVarSlot */ - struct TmSlot_ *slot_next; -} TmSlot; - -/* 1 function slot */ -typedef struct Tm1Slot_ { - TmSlot s; -} Tm1Slot; - -/* Variable number of function slots */ -typedef struct TmVarSlot_ { - TmSlot *s; -} TmVarSlot; - -/** \retval 1 flag is set - * \retval 0 flag is not set - */ -inline int TmThreadsCheckFlag(ThreadVars *tv, uint8_t flag) { - int r; - if (SCSpinLock(&tv->flags_spinlock) != 0) { - SCLogError(SC_ERR_SPINLOCK,"spin lock errno=%d",errno); - return 0; - } - - r = (tv->flags & flag); - SCSpinUnlock(&tv->flags_spinlock); - return r; -} - -inline void TmThreadsSetFlag(ThreadVars *tv, uint8_t flag) { - if (SCSpinLock(&tv->flags_spinlock) != 0) { - SCLogError(SC_ERR_SPINLOCK,"spin lock errno=%d",errno); - return; - } - - tv->flags |= flag; - SCSpinUnlock(&tv->flags_spinlock); -} - -inline void TmThreadsUnsetFlag(ThreadVars *tv, uint8_t flag) { - if (SCSpinLock(&tv->flags_spinlock) != 0) { - SCLogError(SC_ERR_SPINLOCK,"spin lock errno=%d",errno); - return; - } - - tv->flags &= ~flag; - SCSpinUnlock(&tv->flags_spinlock); -} - /* 1 slot functions */ void *TmThreadsSlot1NoIn(void *td) { @@ -371,44 +309,6 @@ void *TmThreadsSlot1(void *td) { pthread_exit((void *) 0); } -/* separate run function so we can call it recursively */ -static inline TmEcode TmThreadsSlotVarRun (ThreadVars *tv, Packet *p, TmSlot *slot) { - TmEcode r = TM_ECODE_OK; - TmSlot *s = NULL; - - for (s = slot; s != NULL; s = s->slot_next) { - r = s->SlotFunc(tv, p, s->slot_data, &s->slot_pq); - /* handle error */ - if (r == TM_ECODE_FAILED) { - /* Encountered error. Return packets to packetpool and return */ - TmqhReleasePacketsToPacketPool(&s->slot_pq); - TmThreadsSetFlag(tv, THV_FAILED); - return TM_ECODE_FAILED; - } - - /* handle new packets */ - while (s->slot_pq.len > 0) { - Packet *extra_p = PacketDequeue(&s->slot_pq); - - /* see if we need to process the packet */ - if (s->slot_next != NULL) { - r = TmThreadsSlotVarRun(tv, extra_p, s->slot_next); - /* XXX handle error */ - if (r == TM_ECODE_FAILED) { - //printf("TmThreadsSlotVarRun: recursive TmThreadsSlotVarRun returned 1\n"); - TmqhReleasePacketsToPacketPool(&s->slot_pq); - TmqhOutputPacketpool(tv, extra_p); - TmThreadsSetFlag(tv, THV_FAILED); - return TM_ECODE_FAILED; - } - } - tv->tmqh_out(tv, extra_p); - } - } - - return TM_ECODE_OK; -} - void *TmThreadsSlotVar(void *td) { ThreadVars *tv = (ThreadVars *)td; TmVarSlot *s = (TmVarSlot *)tv->tm_slots; diff --git a/src/tm-threads.h b/src/tm-threads.h index ff3d956..c5b186f 100644 --- a/src/tm-threads.h +++ b/src/tm-threads.h @@ -2,6 +2,7 @@ #define __TM_THREADS_H__ #include "tm-modules.h" +#include "packet-queue.h" /* ThreadVars type */ enum { @@ -10,10 +11,41 @@ enum { TVT_MAX, }; +typedef struct TmSlot_ { + /* function pointers */ + TmEcode (*SlotFunc)(ThreadVars *, Packet *, void *, PacketQueue *); + + TmEcode (*SlotThreadInit)(ThreadVars *, void *, void **); + void (*SlotThreadExitPrintStats)(ThreadVars *, void *); + TmEcode (*SlotThreadDeinit)(ThreadVars *, void *); + + /* data storage */ + void *slot_initdata; + void *slot_data; + PacketQueue slot_pq; + + /* linked list, only used by TmVarSlot */ + struct TmSlot_ *slot_next; +} TmSlot; + +/* 1 function slot */ +typedef struct Tm1Slot_ { + TmSlot s; +} Tm1Slot; + +/* Variable number of function slots */ +typedef struct TmVarSlot_ { + TmSlot *s; +} TmVarSlot; + + extern ThreadVars *tv_root[TVT_MAX]; extern SCMutex tv_root_lock; +void TmqhReleasePacketsToPacketPool(PacketQueue *); +void TmqhOutputPacketpool(ThreadVars *, Packet *); + void Tm1SlotSetFunc(ThreadVars *, TmModule *, void *); void TmVarSlotSetFuncAppend(ThreadVars *, TmModule *, void *); ThreadVars *TmThreadCreate(char *, char *, char *, char *, char *, char *, @@ -42,9 +74,86 @@ void TmThreadPause(ThreadVars *); void TmThreadPauseThreads(void); void TmThreadCheckThreadState(void); TmEcode TmThreadWaitOnThreadInit(void); -inline int TmThreadsCheckFlag(ThreadVars *, uint8_t); -inline void TmThreadsSetFlag(ThreadVars *, uint8_t); +static inline int TmThreadsCheckFlag(ThreadVars *, uint8_t); +static inline void TmThreadsSetFlag(ThreadVars *, uint8_t); ThreadVars *TmThreadsGetCallingThread(void); +/** ------ inline functions ------ */ + +static inline TmEcode TmThreadsSlotVarRun (ThreadVars *, Packet *, TmSlot *); + +/** \retval 1 flag is set + * \retval 0 flag is not set + */ +static inline int TmThreadsCheckFlag(ThreadVars *tv, uint8_t flag) { + int r; + if (SCSpinLock(&tv->flags_spinlock) != 0) { + SCLogError(SC_ERR_SPINLOCK,"spin lock errno=%d",errno); + return 0; + } + + r = (tv->flags & flag); + SCSpinUnlock(&tv->flags_spinlock); + return r; +} + +static inline void TmThreadsSetFlag(ThreadVars *tv, uint8_t flag) { + if (SCSpinLock(&tv->flags_spinlock) != 0) { + SCLogError(SC_ERR_SPINLOCK,"spin lock errno=%d",errno); + return; + } + + tv->flags |= flag; + SCSpinUnlock(&tv->flags_spinlock); +} + +static inline void TmThreadsUnsetFlag(ThreadVars *tv, uint8_t flag) { + if (SCSpinLock(&tv->flags_spinlock) != 0) { + SCLogError(SC_ERR_SPINLOCK,"spin lock errno=%d",errno); + return; + } + + tv->flags &= ~flag; + SCSpinUnlock(&tv->flags_spinlock); +} + +/* separate run function so we can call it recursively */ +static inline TmEcode TmThreadsSlotVarRun (ThreadVars *tv, Packet *p, TmSlot *slot) { + TmEcode r = TM_ECODE_OK; + TmSlot *s = NULL; + + for (s = slot; s != NULL; s = s->slot_next) { + r = s->SlotFunc(tv, p, s->slot_data, &s->slot_pq); + /* handle error */ + if (r == TM_ECODE_FAILED) { + /* Encountered error. Return packets to packetpool and return */ + TmqhReleasePacketsToPacketPool(&s->slot_pq); + TmThreadsSetFlag(tv, THV_FAILED); + return TM_ECODE_FAILED; + } + + /* handle new packets */ + while (s->slot_pq.len > 0) { + Packet *extra_p = PacketDequeue(&s->slot_pq); + + /* see if we need to process the packet */ + if (s->slot_next != NULL) { + r = TmThreadsSlotVarRun(tv, extra_p, s->slot_next); + /* XXX handle error */ + if (r == TM_ECODE_FAILED) { + //printf("TmThreadsSlotVarRun: recursive TmThreadsSlotVarRun returned 1\n"); + TmqhReleasePacketsToPacketPool(&s->slot_pq); + TmqhOutputPacketpool(tv, extra_p); + TmThreadsSetFlag(tv, THV_FAILED); + return TM_ECODE_FAILED; + } + } + tv->tmqh_out(tv, extra_p); + } + } + + return TM_ECODE_OK; +} + #endif /* __TM_THREADS_H__ */ diff --git a/src/util-byte.c b/src/util-byte.c index 121d822..4cfdf22 100644 --- a/src/util-byte.c +++ b/src/util-byte.c @@ -5,341 +5,6 @@ /** \todo: Remove the fprintf errors in favor of logging */ -int ByteExtract(uint64_t *res, int e, uint16_t len, const uint8_t *bytes) -{ - uint64_t b = 0; - int i; - - if ((e != BYTE_BIG_ENDIAN) && (e != BYTE_LITTLE_ENDIAN)) { - /** \todo Need standard return values */ - return -1; - } - - *res = 0; - - /* Go through each byte and merge it into the result in the correct order */ - /** \todo Probably a more efficient way to do this. */ - for (i = 0; i < len; i++) { - - if (e == BYTE_LITTLE_ENDIAN) { - b = bytes[i]; - } - else { - b = bytes[len - i - 1]; - } - - *res |= (b << ((i & 7) << 3)); - - } - - return len; -} - -inline int ByteExtractUint64(uint64_t *res, int e, uint16_t len, const uint8_t *bytes) -{ - uint64_t i64; - int ret; - - /* Uint64 is limited to 8 bytes */ - if (len > 8) { - /** \todo Need standard return values */ - return -1; - } - - ret = ByteExtract(&i64, e, len, bytes); - if (ret <= 0) { - return ret; - } - - *res = (uint64_t)i64; - - return ret; -} - -inline int ByteExtractUint32(uint32_t *res, int e, uint16_t len, const uint8_t *bytes) -{ - uint64_t i64; - int ret; - - /* Uint32 is limited to 4 bytes */ - if (len > 4) { - /** \todo Need standard return values */ - return -1; - } - - ret = ByteExtract(&i64, e, len, bytes); - if (ret <= 0) { - return ret; - } - - *res = (uint32_t)i64; - - return ret; -} - -inline int ByteExtractUint16(uint16_t *res, int e, uint16_t len, const uint8_t *bytes) -{ - uint64_t i64; - int ret; - - /* Uint16 is limited to 2 bytes */ - if (len > 2) { - /** \todo Need standard return values */ - return -1; - } - - ret = ByteExtract(&i64, e, len, bytes); - if (ret <= 0) { - return ret; - } - - *res = (uint16_t)i64; - - return ret; -} - -int ByteExtractString(uint64_t *res, int base, uint16_t len, const char *str) -{ - const char *ptr = str; - char *endptr = NULL; - - /* 23 - This is the largest string (octal, with a zero prefix) that - * will not overflow uint64_t. The only way this length - * could be over 23 and still not overflow is if it were zero - * prefixed and we only support 1 byte of zero prefix for octal. - * - * "01777777777777777777777" = 0xffffffffffffffff - */ - char strbuf[24]; - - if (len > 23) { - SCLogError(SC_ERR_ARG_LEN_LONG, "len too large (23 max)"); - return -1; - } - - if (len) { - /* Extract out the string so it can be null terminated */ - memcpy(strbuf, str, len); - strbuf[len] = '\0'; - ptr = strbuf; - } - - errno = 0; - *res = strtoull(ptr, &endptr, base); - - if (errno == ERANGE) { - SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range"); - return -1; - } else if (endptr == str) { - SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "Invalid numeric value"); - return -1; - /* If there is no numeric value in the given string then strtoull(), makes - endptr equals to ptr and return 0 as result */ - } else if (endptr == ptr && *res == 0) { - SCLogDebug("No numeric value"); - return -1; - } - /* This will interfere with some rules that do not know the length - * in advance and instead are just using the max. - */ -#if 0 - else if (len && *endptr != '\0') { - fprintf(stderr, "ByteExtractString: Extra characters following numeric value\n"); - return -1; - } -#endif - - return (endptr - ptr); -} - -inline int ByteExtractStringUint64(uint64_t *res, int base, uint16_t len, const char *str) -{ - return ByteExtractString(res, base, len, str); -} - -inline int ByteExtractStringUint32(uint32_t *res, int base, uint16_t len, const char *str) -{ - uint64_t i64; - int ret; - - ret = ByteExtractString(&i64, base, len, str); - if (ret <= 0) { - return ret; - } - - *res = (uint32_t)i64; - - if ((uint64_t)(*res) != i64) { - SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " - "(%" PRIx64 " != %" PRIx64 ")", (uint64_t)(*res), i64); - return -1; - } - - return ret; -} - -inline int ByteExtractStringUint16(uint16_t *res, int base, uint16_t len, const char *str) -{ - uint64_t i64; - int ret; - - ret = ByteExtractString(&i64, base, len, str); - if (ret <= 0) { - return ret; - } - - *res = (uint16_t)i64; - - if ((uint64_t)(*res) != i64) { - SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " - "(%" PRIx64 " != %" PRIx64 ")", (uint64_t)(*res), i64); - return -1; - } - - return ret; -} - -inline int ByteExtractStringUint8(uint8_t *res, int base, uint16_t len, const char *str) -{ - uint64_t i64; - int ret; - - ret = ByteExtractString(&i64, base, len, str); - if (ret <= 0) { - return ret; - } - - *res = (uint8_t)i64; - - if ((uint64_t)(*res) != i64) { - SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " - "(%" PRIx64 " != %" PRIx64 ")", (uint64_t)(*res), i64); - return -1; - } - - return ret; -} - -int ByteExtractStringSigned(int64_t *res, int base, uint16_t len, const char *str) -{ - const char *ptr = str; - char *endptr; - - /* 23 - This is the largest string (octal, with a zero prefix) that - * will not overflow int64_t. The only way this length - * could be over 23 and still not overflow is if it were zero - * prefixed and we only support 1 byte of zero prefix for octal. - * - * "-0777777777777777777777" = 0xffffffffffffffff - */ - char strbuf[24]; - - if (len > 23) { - SCLogError(SC_ERR_ARG_LEN_LONG, "len too large (23 max)"); - return -1; - } - - if (len) { - /* Extract out the string so it can be null terminated */ - memcpy(strbuf, str, len); - strbuf[len] = '\0'; - ptr = strbuf; - } - - errno = 0; - *res = strtoll(ptr, &endptr, base); - - if (errno == ERANGE) { - SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range"); - return -1; - } else if (endptr == str) { - SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "Invalid numeric value"); - return -1; - } - /* This will interfere with some rules that do not know the length - * in advance and instead are just using the max. - */ -#if 0 - else if (len && *endptr != '\0') { - fprintf(stderr, "ByteExtractStringSigned: Extra characters following numeric value\n"); - return -1; - } -#endif - - //fprintf(stderr, "ByteExtractStringSigned: Extracted base %d: 0x%" PRIx64 "\n", base, *res); - - return (endptr - ptr); -} - -inline int ByteExtractStringInt64(int64_t *res, int base, uint16_t len, const char *str) -{ - return ByteExtractStringSigned(res, base, len, str); -} - -inline int ByteExtractStringInt32(int32_t *res, int base, uint16_t len, const char *str) -{ - int64_t i64; - int ret; - - ret = ByteExtractStringSigned(&i64, base, len, str); - if (ret <= 0) { - return ret; - } - - *res = (int32_t)i64; - - if ((int64_t)(*res) != i64) { - SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " - "(%" PRIx64 " != %" PRIx64 ")\n", (int64_t)(*res), i64); - return -1; - } - - return ret; -} - -inline int ByteExtractStringInt16(int16_t *res, int base, uint16_t len, const char *str) -{ - int64_t i64; - int ret; - - ret = ByteExtractStringSigned(&i64, base, len, str); - if (ret <= 0) { - return ret; - } - - *res = (int16_t)i64; - - if ((int64_t)(*res) != i64) { - SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " - "(%" PRIx64 " != %" PRIx64 ")\n", (int64_t)(*res), i64); - return -1; - } - - return ret; -} - -inline int ByteExtractStringInt8(int8_t *res, int base, uint16_t len, const char *str) -{ - int64_t i64; - int ret; - - ret = ByteExtractStringSigned(&i64, base, len, str); - if (ret <= 0) { - return ret; - } - - *res = (int8_t)i64; - - if ((int64_t)(*res) != i64) { - SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " - "(%" PRIx64 " != %" PRIx64 ")\n", (int64_t)(*res), i64); - return -1; - } - - return ret; -} - -/* UNITTESTS */ #ifdef UNITTESTS static int ByteTest01 (void) { diff --git a/src/util-byte.h b/src/util-byte.h index ee54ffb..704fd90 100644 --- a/src/util-byte.h +++ b/src/util-byte.h @@ -59,7 +59,7 @@ * \return n Number of bytes extracted on success * \return -1 On error */ -int ByteExtractUint64(uint64_t *res, int e, uint16_t len, const uint8_t *bytes); +static inline int ByteExtractUint64(uint64_t *res, int e, uint16_t len, const uint8_t *bytes); /** * Extract bytes from a byte string and convert to a unint32_t. @@ -72,7 +72,7 @@ int ByteExtractUint64(uint64_t *res, int e, uint16_t len, const uint8_t *bytes); * \return n Number of bytes extracted on success * \return -1 On error */ -inline int ByteExtractUint32(uint32_t *res, int e, uint16_t len, const uint8_t *bytes); +static inline int ByteExtractUint32(uint32_t *res, int e, uint16_t len, const uint8_t *bytes); /** * Extract bytes from a byte string and convert to a unint16_t. @@ -85,7 +85,7 @@ inline int ByteExtractUint32(uint32_t *res, int e, uint16_t len, const uint8_t * * \return n Number of bytes extracted on success * \return -1 On error */ -inline int ByteExtractUint16(uint16_t *res, int e, uint16_t len, const uint8_t *bytes); +static inline int ByteExtractUint16(uint16_t *res, int e, uint16_t len, const uint8_t *bytes); /** * Extract unsigned integer value from a string. @@ -98,7 +98,7 @@ inline int ByteExtractUint16(uint16_t *res, int e, uint16_t len, const uint8_t * * \return n Number of bytes extracted on success * \return -1 On error */ -inline int ByteExtractString(uint64_t *res, int base, uint16_t len, const char *str); +static inline int ByteExtractString(uint64_t *res, int base, uint16_t len, const char *str); /** * Extract unsigned integer value from a string as uint64_t. @@ -112,7 +112,7 @@ inline int ByteExtractString(uint64_t *res, int base, uint16_t len, const char * * \return n Number of bytes extracted on success * \return -1 On error */ -inline int ByteExtractStringUint64(uint64_t *res, int base, uint16_t len, const char *str); +static inline int ByteExtractStringUint64(uint64_t *res, int base, uint16_t len, const char *str); /** * Extract unsigned integer value from a string as uint32_t. @@ -125,7 +125,7 @@ inline int ByteExtractStringUint64(uint64_t *res, int base, uint16_t len, const * \return n Number of bytes extracted on success * \return -1 On error */ -inline int ByteExtractStringUint32(uint32_t *res, int base, uint16_t len, const char *str); +static inline int ByteExtractStringUint32(uint32_t *res, int base, uint16_t len, const char *str); /** * Extract unsigned integer value from a string as uint16_t. @@ -138,7 +138,7 @@ inline int ByteExtractStringUint32(uint32_t *res, int base, uint16_t len, const * \return n Number of bytes extracted on success * \return -1 On error */ -inline int ByteExtractStringUint16(uint16_t *res, int base, uint16_t len, const char *str); +static inline int ByteExtractStringUint16(uint16_t *res, int base, uint16_t len, const char *str); /** * Extract unsigned integer value from a string as uint8_t. @@ -151,7 +151,7 @@ inline int ByteExtractStringUint16(uint16_t *res, int base, uint16_t len, const * \return n Number of bytes extracted on success * \return -1 On error */ -inline int ByteExtractStringUint8(uint8_t *res, int base, uint16_t len, const char *str); +static inline int ByteExtractStringUint8(uint8_t *res, int base, uint16_t len, const char *str); /** * Extract signed integer value from a string. @@ -164,7 +164,7 @@ inline int ByteExtractStringUint8(uint8_t *res, int base, uint16_t len, const ch * \return n Number of bytes extracted on success * \return -1 On error */ -inline int ByteExtractStringSigned(int64_t *res, int base, uint16_t len, const char *str); +static inline int ByteExtractStringSigned(int64_t *res, int base, uint16_t len, const char *str); /** * Extract signed integer value from a string as uint64_t. @@ -177,7 +177,7 @@ inline int ByteExtractStringSigned(int64_t *res, int base, uint16_t len, const c * \return n Number of bytes extracted on success * \return -1 On error */ -inline int ByteExtractStringInt64(int64_t *res, int base, uint16_t len, const char *str); +static inline int ByteExtractStringInt64(int64_t *res, int base, uint16_t len, const char *str); /** * Extract signed integer value from a string as uint32_t. @@ -190,7 +190,7 @@ inline int ByteExtractStringInt64(int64_t *res, int base, uint16_t len, const ch * \return n Number of bytes extracted on success * \return -1 On error */ -inline int ByteExtractStringInt32(int32_t *res, int base, uint16_t len, const char *str); +static inline int ByteExtractStringInt32(int32_t *res, int base, uint16_t len, const char *str); /** * Extract signed integer value from a string as uint16_t. @@ -203,7 +203,7 @@ inline int ByteExtractStringInt32(int32_t *res, int base, uint16_t len, const ch * \return n Number of bytes extracted on success * \return -1 On error */ -inline int ByteExtractStringInt16(int16_t *res, int base, uint16_t len, const char *str); +static inline int ByteExtractStringInt16(int16_t *res, int base, uint16_t len, const char *str); /** * Extract signed integer value from a string as uint8_t. @@ -216,7 +216,346 @@ inline int ByteExtractStringInt16(int16_t *res, int base, uint16_t len, const ch * \return n Number of bytes extracted on success * \return -1 On error */ -inline int ByteExtractStringInt8(int8_t *res, int base, uint16_t len, const char *str); +static inline int ByteExtractStringInt8(int8_t *res, int base, uint16_t len, const char *str); + +/** ------ Definitions of Inline functions ------ */ + + +static inline int ByteExtract(uint64_t *res, int e, uint16_t len, const uint8_t *bytes) +{ + uint64_t b = 0; + int i; + + if ((e != BYTE_BIG_ENDIAN) && (e != BYTE_LITTLE_ENDIAN)) { + /** \todo Need standard return values */ + return -1; + } + + *res = 0; + + /* Go through each byte and merge it into the result in the correct order */ + /** \todo Probably a more efficient way to do this. */ + for (i = 0; i < len; i++) { + + if (e == BYTE_LITTLE_ENDIAN) { + b = bytes[i]; + } + else { + b = bytes[len - i - 1]; + } + + *res |= (b << ((i & 7) << 3)); + + } + + return len; +} + +static inline int ByteExtractString(uint64_t *res, int base, uint16_t len, const char *str) +{ + const char *ptr = str; + char *endptr = NULL; + + /* 23 - This is the largest string (octal, with a zero prefix) that + * will not overflow uint64_t. The only way this length + * could be over 23 and still not overflow is if it were zero + * prefixed and we only support 1 byte of zero prefix for octal. + * + * "01777777777777777777777" = 0xffffffffffffffff + */ + char strbuf[24]; + + if (len > 23) { + SCLogError(SC_ERR_ARG_LEN_LONG, "len too large (23 max)"); + return -1; + } + + if (len) { + /* Extract out the string so it can be null terminated */ + memcpy(strbuf, str, len); + strbuf[len] = '\0'; + ptr = strbuf; + } + + errno = 0; + *res = strtoull(ptr, &endptr, base); + + if (errno == ERANGE) { + SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range"); + return -1; + } else if (endptr == str) { + SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "Invalid numeric value"); + return -1; + /* If there is no numeric value in the given string then strtoull(), makes + endptr equals to ptr and return 0 as result */ + } else if (endptr == ptr && *res == 0) { + SCLogDebug("No numeric value"); + return -1; + } + /* This will interfere with some rules that do not know the length + * in advance and instead are just using the max. + */ +#if 0 + else if (len && *endptr != '\0') { + fprintf(stderr, "ByteExtractString: Extra characters following numeric value\n"); + return -1; + } +#endif + + return (endptr - ptr); +} + +static inline int ByteExtractUint64(uint64_t *res, int e, uint16_t len, const uint8_t *bytes) +{ + uint64_t i64; + int ret; + + /* Uint64 is limited to 8 bytes */ + if (len > 8) { + /** \todo Need standard return values */ + return -1; + } + + ret = ByteExtract(&i64, e, len, bytes); + if (ret <= 0) { + return ret; + } + + *res = (uint64_t)i64; + + return ret; +} + +static inline int ByteExtractUint32(uint32_t *res, int e, uint16_t len, const uint8_t *bytes) +{ + uint64_t i64; + int ret; + + /* Uint32 is limited to 4 bytes */ + if (len > 4) { + /** \todo Need standard return values */ + return -1; + } + + ret = ByteExtract(&i64, e, len, bytes); + if (ret <= 0) { + return ret; + } + + *res = (uint32_t)i64; + + return ret; +} + +static inline int ByteExtractUint16(uint16_t *res, int e, uint16_t len, const uint8_t *bytes) +{ + uint64_t i64; + int ret; + + /* Uint16 is limited to 2 bytes */ + if (len > 2) { + /** \todo Need standard return values */ + return -1; + } + + ret = ByteExtract(&i64, e, len, bytes); + if (ret <= 0) { + return ret; + } + + *res = (uint16_t)i64; + + return ret; +} + + +static inline int ByteExtractStringInt64(int64_t *res, int base, uint16_t len, const char *str) +{ + return ByteExtractStringSigned(res, base, len, str); +} + +static inline int ByteExtractStringInt32(int32_t *res, int base, uint16_t len, const char *str) +{ + int64_t i64; + int ret; + + ret = ByteExtractStringSigned(&i64, base, len, str); + if (ret <= 0) { + return ret; + } + + *res = (int32_t)i64; + + if ((int64_t)(*res) != i64) { + SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " + "(%" PRIx64 " != %" PRIx64 ")\n", (int64_t)(*res), i64); + return -1; + } + + return ret; +} + +static inline int ByteExtractStringInt16(int16_t *res, int base, uint16_t len, const char *str) +{ + int64_t i64; + int ret; + + ret = ByteExtractStringSigned(&i64, base, len, str); + if (ret <= 0) { + return ret; + } + + *res = (int16_t)i64; + + if ((int64_t)(*res) != i64) { + SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " + "(%" PRIx64 " != %" PRIx64 ")\n", (int64_t)(*res), i64); + return -1; + } + + return ret; +} + +static inline int ByteExtractStringInt8(int8_t *res, int base, uint16_t len, const char *str) +{ + int64_t i64; + int ret; + + ret = ByteExtractStringSigned(&i64, base, len, str); + if (ret <= 0) { + return ret; + } + + *res = (int8_t)i64; + + if ((int64_t)(*res) != i64) { + SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " + "(%" PRIx64 " != %" PRIx64 ")\n", (int64_t)(*res), i64); + return -1; + } + + return ret; +} + +static inline int ByteExtractStringUint64(uint64_t *res, int base, uint16_t len, const char *str) +{ + return ByteExtractString(res, base, len, str); +} + +static inline int ByteExtractStringUint32(uint32_t *res, int base, uint16_t len, const char *str) +{ + uint64_t i64; + int ret; + + ret = ByteExtractString(&i64, base, len, str); + if (ret <= 0) { + return ret; + } + + *res = (uint32_t)i64; + + if ((uint64_t)(*res) != i64) { + SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " + "(%" PRIx64 " != %" PRIx64 ")", (uint64_t)(*res), i64); + return -1; + } + + return ret; +} + +static inline int ByteExtractStringUint16(uint16_t *res, int base, uint16_t len, const char *str) +{ + uint64_t i64; + int ret; + + ret = ByteExtractString(&i64, base, len, str); + if (ret <= 0) { + return ret; + } + + *res = (uint16_t)i64; + + if ((uint64_t)(*res) != i64) { + SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " + "(%" PRIx64 " != %" PRIx64 ")", (uint64_t)(*res), i64); + return -1; + } + + return ret; +} + +static inline int ByteExtractStringUint8(uint8_t *res, int base, uint16_t len, const char *str) +{ + uint64_t i64; + int ret; + + ret = ByteExtractString(&i64, base, len, str); + if (ret <= 0) { + return ret; + } + + *res = (uint8_t)i64; + + if ((uint64_t)(*res) != i64) { + SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " + "(%" PRIx64 " != %" PRIx64 ")", (uint64_t)(*res), i64); + return -1; + } + + return ret; +} + +static inline int ByteExtractStringSigned(int64_t *res, int base, uint16_t len, const char *str) +{ + const char *ptr = str; + char *endptr; + + /* 23 - This is the largest string (octal, with a zero prefix) that + * will not overflow int64_t. The only way this length + * could be over 23 and still not overflow is if it were zero + * prefixed and we only support 1 byte of zero prefix for octal. + * + * "-0777777777777777777777" = 0xffffffffffffffff + */ + char strbuf[24]; + + if (len > 23) { + SCLogError(SC_ERR_ARG_LEN_LONG, "len too large (23 max)"); + return -1; + } + + if (len) { + /* Extract out the string so it can be null terminated */ + memcpy(strbuf, str, len); + strbuf[len] = '\0'; + ptr = strbuf; + } + + errno = 0; + *res = strtoll(ptr, &endptr, base); + + if (errno == ERANGE) { + SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range"); + return -1; + } else if (endptr == str) { + SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "Invalid numeric value"); + return -1; + } + /* This will interfere with some rules that do not know the length + * in advance and instead are just using the max. + */ +#if 0 + else if (len && *endptr != '\0') { + fprintf(stderr, "ByteExtractStringSigned: Extra characters following numeric value\n"); + return -1; + } +#endif + + //fprintf(stderr, "ByteExtractStringSigned: Extracted base %d: 0x%" PRIx64 "\n", base, *res); + + return (endptr - ptr); +} +/* UNITTESTS */ #ifdef UNITTESTS void ByteRegisterTests(void); diff --git a/src/util-classification-config.c b/src/util-classification-config.c index b25e03a..19169f8 100644 --- a/src/util-classification-config.c +++ b/src/util-classification-config.c @@ -14,24 +14,8 @@ #include "util-debug.h" #include "util-fmemopen.h" -/* Regex to parse the classtype argument from a Signature. The first substring - * holds the classtype name, the second substring holds the classtype the - * classtype description, and the third argument holds the priority */ -#define DETECT_CLASSCONFIG_REGEX "^\\s*config\\s*classification\\s*:\\s*([a-zA-Z][a-zA-Z0-9-_]*)\\s*,\\s*(.+)\\s*,\\s*(\\d+)\\s*$" - -/* Default path for the classification.config file */ -#define SC_CLASS_CONF_DEF_CONF_FILEPATH "classification.config" - /* Holds a pointer to the default path for the classification.config file */ -static const char *default_file_path = SC_CLASS_CONF_DEF_CONF_FILEPATH; -static FILE *fd = NULL; -static pcre *regex = NULL; -static pcre_extra *regex_study = NULL; - -uint32_t SCClassConfClasstypeHashFunc(HashTable *ht, void *data, uint16_t datalen); -char SCClassConfClasstypeHashCompareFunc(void *data1, uint16_t datalen1, - void *data2, uint16_t datalen2); -void SCClassConfClasstypeHashFree(void *ch); +static const char *classification_default_file_path = SC_CLASS_CONF_DEF_CONF_FILEPATH; /** * \brief Returns the path for the Classification Config file. We check if we @@ -42,9 +26,9 @@ void SCClassConfClasstypeHashFree(void *ch); * \retval log_filename Pointer to a string containing the path for the * Classification Config file. */ -static char *SCClassConfGetConfFilename(void) +char *SCClassConfGetConfFilename(void) { - char *log_filename = (char *)default_file_path; + char *log_filename = (char *)classification_default_file_path; ConfGet("classification-file", &log_filename); @@ -52,86 +36,13 @@ static char *SCClassConfGetConfFilename(void) } /** - * \brief Inits the context to be used by the Classification Config parsing API. - * - * This function initializes the hash table to be used by the Detection - * Engine Context to hold the data from the classification.config file, - * obtains the file desc to parse the classification.config file, and - * inits the regex used to parse the lines from classification.config - * file. - * - * \param de_ctx Pointer to the Detection Engine Context. - * - * \retval 0 On success. - * \retval -1 On failure. - */ -static inline int SCClassConfInitContext(DetectEngineCtx *de_ctx) -{ - char *filename = NULL; - const char *eb = NULL; - int eo; - int opts = 0; - - /* init the hash table to be used by the classification config Classtypes */ - de_ctx->class_conf_ht = HashTableInit(4096, SCClassConfClasstypeHashFunc, - SCClassConfClasstypeHashCompareFunc, - SCClassConfClasstypeHashFree); - if (de_ctx->class_conf_ht == NULL) { - SCLogError(SC_ERR_HASH_TABLE_INIT, "Error initializing the hash " - "table"); - return -1; - } - - /* if it is not NULL, use the file descriptor. The hack so that we can - * avoid using a dummy classification file for testing purposes and - * instead use an input stream against a buffer containing the - * classification strings */ - if (fd == NULL) { - filename = SCClassConfGetConfFilename(); - if ( (fd = fopen(filename, "r")) == NULL) { - SCLogError(SC_ERR_FOPEN, "Error opening file: \"%s\": %s", filename, strerror(errno)); - goto error; - } - } - - regex = pcre_compile(DETECT_CLASSCONFIG_REGEX, opts, &eb, &eo, NULL); - if (regex == NULL) { - SCLogDebug("Compile of \"%s\" failed at offset %" PRId32 ": %s", - DETECT_CLASSCONFIG_REGEX, eo, eb); - goto error; - } - - regex_study = pcre_study(regex, 0, &eb); - if (eb != NULL) { - SCLogDebug("pcre study failed: %s", eb); - goto error; - } - - return 0; - - error: - if (de_ctx->class_conf_ht != NULL) { - HashTableFree(de_ctx->class_conf_ht); - de_ctx->class_conf_ht = NULL; - } - if (fd != NULL) { - fclose(fd); - fd = NULL; - } - - printf("\nPlease check the \"classification-file\" option in your suricata.yaml file.\n"); - exit(EXIT_FAILURE); -// return -1; -} - -/** * \brief Releases resources used by the Classification Config API. */ -static void SCClassConfDeInitContext(DetectEngineCtx *de_ctx) +void SCClassConfDeInitContext(DetectEngineCtx *de_ctx) { fclose(fd); - default_file_path = SC_CLASS_CONF_DEF_CONF_FILEPATH; + classification_default_file_path = SC_CLASS_CONF_DEF_CONF_FILEPATH; fd = NULL; return; } @@ -141,7 +52,7 @@ static void SCClassConfDeInitContext(DetectEngineCtx *de_ctx) * * \param str Pointer to the string to be converted. */ -static char *SCClassConfStringToLowercase(const char *str) +char *SCClassConfStringToLowercase(const char *str) { char *new_str = NULL; char *temp_str = NULL; @@ -161,81 +72,6 @@ static char *SCClassConfStringToLowercase(const char *str) } /** - * \brief Parses a line from the classification file and adds it to Classtype - * hash table in DetectEngineCtx, i.e. DetectEngineCtx->class_conf_ht. - * - * \param rawstr Pointer to the string to be parsed. - * \param de_ctx Pointer to the Detection Engine Context. - * - * \retval 0 On success. - * \retval -1 On failure. - */ -static inline int SCClassConfAddClasstype(char *rawstr, DetectEngineCtx *de_ctx) -{ - const char *ct_name = NULL; - const char *ct_desc = NULL; - const char *ct_priority_str = NULL; - int ct_priority = 0; - - SCClassConfClasstype *ct_new = NULL; - SCClassConfClasstype *ct_lookup = NULL; - -#define MAX_SUBSTRINGS 30 - int ret = 0; - int ov[MAX_SUBSTRINGS]; - - ret = pcre_exec(regex, regex_study, rawstr, strlen(rawstr), 0, 0, ov, 30); - if (ret < 0) { - SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid Classtype in " - "classification.config file"); - goto error; - } - - /* retrieve the classtype name */ - ret = pcre_get_substring((char *)rawstr, ov, 30, 1, &ct_name); - if (ret < 0) { - SCLogInfo("pcre_get_substring() failed"); - goto error; - } - - /* retrieve the classtype description */ - ret = pcre_get_substring((char *)rawstr, ov, 30, 2, &ct_desc); - if (ret < 0) { - SCLogInfo("pcre_get_substring() failed"); - goto error; - } - - /* retrieve the classtype priority */ - ret = pcre_get_substring((char *)rawstr, ov, 30, 3, &ct_priority_str); - if (ret < 0) { - SCLogInfo("pcre_get_substring() failed"); - goto error; - } - - ct_priority = atoi(ct_priority_str); - - /* Create a new instance of the parsed Classtype string */ - ct_new = SCClassConfAllocClasstype(ct_name, ct_desc, ct_priority); - if (ct_new == NULL) - goto error; - - /* Check if the Classtype is present in the HashTable. In case it's present - * ignore it, as it is a duplicate. If not present, add it to the table */ - ct_lookup = HashTableLookup(de_ctx->class_conf_ht, ct_new, 0); - if (ct_lookup == NULL) { - if (HashTableAdd(de_ctx->class_conf_ht, ct_new, 0) < 0) - SCLogDebug("HashTable Add failed"); - } else { - SCLogDebug("Duplicate classtype found inside classification.config"); - } - - return 0; - - error: - return -1; -} - -/** * \brief Checks if a string is a comment or a blank line. * * Comments lines are lines of the following format - @@ -247,7 +83,7 @@ static inline int SCClassConfAddClasstype(char *rawstr, DetectEngineCtx *de_ctx) * \retval 1 On the argument string being a comment or blank line * \retval 0 Otherwise */ -static int SCClassConfIsLineBlankOrComment(char *line) +int SCClassConfIsLineBlankOrComment(char *line) { while (*line != '\0') { /* we have a comment */ @@ -266,31 +102,6 @@ static int SCClassConfIsLineBlankOrComment(char *line) } /** - * \brief Parses the Classification Config file and updates the - * DetectionEngineCtx->class_conf_ht with the Classtype information. - * - * \param de_ctx Pointer to the Detection Engine Context. - */ -static inline void SCClassConfParseFile(DetectEngineCtx *de_ctx) -{ - char line[1024]; - - while (fgets(line, sizeof(line), fd) != NULL) { - if (SCClassConfIsLineBlankOrComment(line)) - continue; - - SCClassConfAddClasstype(line, de_ctx); - } - -#ifdef UNITTESTS - SCLogInfo("Added \"%d\" classification types from the classification file", - de_ctx->class_conf_ht->count); -#endif - - return; -} - -/** * \brief Returns a new SCClassConfClasstype instance. The classtype string * is converted into lowercase, before being assigned to the instance. * diff --git a/src/util-classification-config.h b/src/util-classification-config.h index effca75..b4ab75e 100644 --- a/src/util-classification-config.h +++ b/src/util-classification-config.h @@ -5,6 +5,18 @@ #ifndef __UTIL_CLASSIFICATION_CONFIG_H__ #define __UTIL_CLASSIFICATION_CONFIG_H__ +/* Regex to parse the classtype argument from a Signature. The first substring + * holds the classtype name, the second substring holds the classtype the + * classtype description, and the third argument holds the priority */ +#define DETECT_CLASSCONFIG_REGEX "^\\s*config\\s*classification\\s*:\\s*([a-zA-Z][a-zA-Z0-9-_]*)\\s*,\\s*(.+)\\s*,\\s*(\\d+)\\s*$" + +/* Default path for the classification.config file */ +#define SC_CLASS_CONF_DEF_CONF_FILEPATH "classification.config" + +static FILE *fd = NULL; +static pcre *classification_regex = NULL; +static pcre_extra *classification_regex_study = NULL; + /** * \brief Container for a Classtype from the Classification.config file. */ @@ -31,4 +43,189 @@ void SCClassConfGenerateInValidDummyClassConfigFD02(void); void SCClassConfGenerateInValidDummyClassConfigFD03(void); void SCClassConfDeleteDummyClassificationConfigFD(void); +uint32_t SCClassConfClasstypeHashFunc(HashTable *ht, void *data, uint16_t datalen); +char SCClassConfClasstypeHashCompareFunc(void *data1, uint16_t datalen1, + void *data2, uint16_t datalen2); +void SCClassConfClasstypeHashFree(void *ch); + +char* SCClassConfGetConfFilename(void); +int SCClassConfIsLineBlankOrComment(char *); + +/** ------- Inline functions ------ */ + + +/** + * \brief Inits the context to be used by the Classification Config parsing API. + * + * This function initializes the hash table to be used by the Detection + * Engine Context to hold the data from the classification.config file, + * obtains the file desc to parse the classification.config file, and + * inits the classification_regex used to parse the lines from classification.config + * file. + * + * \param de_ctx Pointer to the Detection Engine Context. + * + * \retval 0 On success. + * \retval -1 On failure. + */ +static inline int SCClassConfInitContext(DetectEngineCtx *de_ctx) +{ + char *filename = NULL; + const char *eb = NULL; + int eo; + int opts = 0; + + /* init the hash table to be used by the classification config Classtypes */ + de_ctx->class_conf_ht = HashTableInit(4096, SCClassConfClasstypeHashFunc, + SCClassConfClasstypeHashCompareFunc, + SCClassConfClasstypeHashFree); + if (de_ctx->class_conf_ht == NULL) { + SCLogError(SC_ERR_HASH_TABLE_INIT, "Error initializing the hash " + "table"); + return -1; + } + + /* if it is not NULL, use the file descriptor. The hack so that we can + * avoid using a dummy classification file for testing purposes and + * instead use an input stream against a buffer containing the + * classification strings */ + if (fd == NULL) { + filename = SCClassConfGetConfFilename(); + if ( (fd = fopen(filename, "r")) == NULL) { + SCLogError(SC_ERR_FOPEN, "Error opening file: \"%s\": %s", filename, strerror(errno)); + goto error; + } + } + + classification_regex = pcre_compile(DETECT_CLASSCONFIG_REGEX, opts, &eb, &eo, NULL); + if (classification_regex == NULL) { + SCLogDebug("Compile of \"%s\" failed at offset %" PRId32 ": %s", + DETECT_CLASSCONFIG_REGEX, eo, eb); + goto error; + } + + classification_regex_study = pcre_study(classification_regex, 0, &eb); + if (eb != NULL) { + SCLogDebug("pcre study failed: %s", eb); + goto error; + } + + return 0; + + error: + if (de_ctx->class_conf_ht != NULL) { + HashTableFree(de_ctx->class_conf_ht); + de_ctx->class_conf_ht = NULL; + } + if (fd != NULL) { + fclose(fd); + fd = NULL; + } + + printf("\nPlease check the \"classification-file\" option in your suricata.yaml file.\n"); + exit(EXIT_FAILURE); +// return -1; +} + +/** + * \brief Parses a line from the classification file and adds it to Classtype + * hash table in DetectEngineCtx, i.e. DetectEngineCtx->class_conf_ht. + * + * \param rawstr Pointer to the string to be parsed. + * \param de_ctx Pointer to the Detection Engine Context. + * + * \retval 0 On success. + * \retval -1 On failure. + */ +static inline int SCClassConfAddClasstype(char *rawstr, DetectEngineCtx *de_ctx) +{ + const char *ct_name = NULL; + const char *ct_desc = NULL; + const char *ct_priority_str = NULL; + int ct_priority = 0; + + SCClassConfClasstype *ct_new = NULL; + SCClassConfClasstype *ct_lookup = NULL; + +#define MAX_SUBSTRINGS 30 + int ret = 0; + int ov[MAX_SUBSTRINGS]; + + ret = pcre_exec(classification_regex, classification_regex_study, rawstr, strlen(rawstr), 0, 0, ov, 30); + if (ret < 0) { + SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid Classtype in " + "classification.config file"); + goto error; + } + + /* retrieve the classtype name */ + ret = pcre_get_substring((char *)rawstr, ov, 30, 1, &ct_name); + if (ret < 0) { + SCLogInfo("pcre_get_substring() failed"); + goto error; + } + + /* retrieve the classtype description */ + ret = pcre_get_substring((char *)rawstr, ov, 30, 2, &ct_desc); + if (ret < 0) { + SCLogInfo("pcre_get_substring() failed"); + goto error; + } + + /* retrieve the classtype priority */ + ret = pcre_get_substring((char *)rawstr, ov, 30, 3, &ct_priority_str); + if (ret < 0) { + SCLogInfo("pcre_get_substring() failed"); + goto error; + } + + ct_priority = atoi(ct_priority_str); + + /* Create a new instance of the parsed Classtype string */ + ct_new = SCClassConfAllocClasstype(ct_name, ct_desc, ct_priority); + if (ct_new == NULL) + goto error; + + /* Check if the Classtype is present in the HashTable. In case it's present + * ignore it, as it is a duplicate. If not present, add it to the table */ + ct_lookup = HashTableLookup(de_ctx->class_conf_ht, ct_new, 0); + if (ct_lookup == NULL) { + if (HashTableAdd(de_ctx->class_conf_ht, ct_new, 0) < 0) + SCLogDebug("HashTable Add failed"); + } else { + SCLogDebug("Duplicate classtype found inside classification.config"); + } + + return 0; + + error: + return -1; +} + +/** + * \brief Parses the Classification Config file and updates the + * DetectionEngineCtx->class_conf_ht with the Classtype information. + * + * \param de_ctx Pointer to the Detection Engine Context. + */ +static inline void SCClassConfParseFile(DetectEngineCtx *de_ctx) +{ + char line[1024]; + + while (fgets(line, sizeof(line), fd) != NULL) { + if (SCClassConfIsLineBlankOrComment(line)) + continue; + + SCClassConfAddClasstype(line, de_ctx); + } + +#ifdef UNITTESTS + SCLogInfo("Added \"%d\" classification types from the classification file", + de_ctx->class_conf_ht->count); +#endif + + return; +} + + #endif /* __UTIL_CLASSIFICATION_CONFIG_H__ */ diff --git a/src/util-debug-filters.c b/src/util-debug-filters.c index d9906ce..dbdf4bf 100644 --- a/src/util-debug-filters.c +++ b/src/util-debug-filters.c @@ -27,23 +27,23 @@ int sc_log_fd_filters_present = 0; /** * \brief Holds the fine-grained filters */ -static SCLogFGFilterFile *sc_log_fg_filters[SC_LOG_FILTER_MAX] = { NULL, NULL }; +SCLogFGFilterFile *sc_log_fg_filters[SC_LOG_FILTER_MAX] = { NULL, NULL }; /** * \brief Mutex for accessing the fine-grained fiters sc_log_fg_filters */ -static SCMutex sc_log_fg_filters_m[SC_LOG_FILTER_MAX] = { PTHREAD_MUTEX_INITIALIZER, +SCMutex sc_log_fg_filters_m[SC_LOG_FILTER_MAX] = { PTHREAD_MUTEX_INITIALIZER, PTHREAD_MUTEX_INITIALIZER }; /** * \brief Holds the function-dependent filters */ -static SCLogFDFilter *sc_log_fd_filters = NULL; +SCLogFDFilter *sc_log_fd_filters = NULL; /** * \brief Mutex for accessing the function-dependent filters sc_log_fd_filters */ -static SCMutex sc_log_fd_filters_m = PTHREAD_MUTEX_INITIALIZER; +SCMutex sc_log_fd_filters_m = PTHREAD_MUTEX_INITIALIZER; /** * \brief Holds the thread_list required by function-dependent filters @@ -55,271 +55,6 @@ static SCLogFDFilterThreadList *sc_log_fd_filters_tl = NULL; */ static SCMutex sc_log_fd_filters_tl_m = PTHREAD_MUTEX_INITIALIZER; - -/** - * \brief Helper function used internally to add a FG filter. This function is - * called when the file component of the incoming filter has no entry - * in the filter list. - * - * \param fgf_file The file component(basically the position in the list) from - * the filter list, after which the new filter has to be added - * \param file File_name of the filter - * \param function Function_name of the filter - * \param line Line number of the filter - * \param listtype The filter listtype. Can be either a blacklist or whitelist - * filter listtype(SC_LOG_FILTER_BL or SC_LOG_FILTER_WL) - */ -static inline void SCLogAddToFGFFileList(SCLogFGFilterFile *fgf_file, - const char *file, - const char *function, int line, - int listtype) -{ - SCLogFGFilterFile *fgf_file_temp = NULL; - SCLogFGFilterFunc *fgf_func_temp = NULL; - SCLogFGFilterLine *fgf_line_temp = NULL; - - if ( (fgf_file_temp = SCMalloc(sizeof(SCLogFGFilterFile))) == NULL) { - printf("Error Allocating memory\n"); - exit(EXIT_FAILURE); - } - memset(fgf_file_temp, 0, sizeof(SCLogFGFilterFile)); - - if ( file != NULL && (fgf_file_temp->file = SCStrdup(file)) == NULL) { - printf("Error Allocating memory\n"); - exit(EXIT_FAILURE); - } - - if ( (fgf_func_temp = SCMalloc(sizeof(SCLogFGFilterFunc))) == NULL) { - printf("Error Allocating memory\n"); - exit(EXIT_FAILURE); - } - memset(fgf_func_temp, 0, sizeof(SCLogFGFilterFunc)); - - if ( function != NULL && (fgf_func_temp->func = SCStrdup(function)) == NULL) { - printf("Error Allocating memory\n"); - exit(EXIT_FAILURE); - } - - if ( (fgf_line_temp = SCMalloc(sizeof(SCLogFGFilterLine))) == NULL) { - printf("Error Allocating memory\n"); - exit(EXIT_FAILURE); - } - memset(fgf_line_temp, 0, sizeof(SCLogFGFilterLine)); - - fgf_line_temp->line = line; - - /* add to the lists */ - fgf_func_temp->line = fgf_line_temp; - - fgf_file_temp->func = fgf_func_temp; - - if (fgf_file == NULL) - sc_log_fg_filters[listtype] = fgf_file_temp; - else - fgf_file->next = fgf_file_temp; - - return; -} - -/** - * \brief Helper function used internally to add a FG filter. This function is - * called when the file component of the incoming filter has an entry - * in the filter list, but the function component doesn't have an entry - * for the corresponding file component - * - * \param fgf_file The file component from the filter list to which the new - * filter has to be added - * \param fgf_func The function component(basically the position in the list), - * from the filter list, after which the new filter has to be - * added - * \param function Function_name of the filter - * \param line Line number of the filter - */ -static inline void SCLogAddToFGFFuncList(SCLogFGFilterFile *fgf_file, - SCLogFGFilterFunc *fgf_func, - const char *function, int line) -{ - SCLogFGFilterFunc *fgf_func_temp = NULL; - SCLogFGFilterLine *fgf_line_temp = NULL; - - if ( (fgf_func_temp = SCMalloc(sizeof(SCLogFGFilterFunc))) == NULL) { - printf("Error Allocating memory\n"); - exit(EXIT_FAILURE); - } - memset(fgf_func_temp, 0, sizeof(SCLogFGFilterFunc)); - - if ( function != NULL && (fgf_func_temp->func = SCStrdup(function)) == NULL) { - printf("Error Allocating memory\n"); - exit(EXIT_FAILURE); - } - - if ( (fgf_line_temp = SCMalloc(sizeof(SCLogFGFilterLine))) == NULL) { - printf("Error Allocating memory\n"); - exit(EXIT_FAILURE); - } - memset(fgf_line_temp, 0, sizeof(SCLogFGFilterLine)); - - fgf_line_temp->line = line; - - /* add to the lists */ - fgf_func_temp->line = fgf_line_temp; - - if (fgf_func == NULL) - fgf_file->func = fgf_func_temp; - else - fgf_func->next = fgf_func_temp; - - return; -} - -/** - * \brief Helper function used internally to add a FG filter. This function is - * called when the file and function components of the incoming filter - * have an entry in the filter list, but the line component doesn't have - * an entry for the corresponding function component - * - * \param fgf_func The function component from the filter list to which the new - * filter has to be added - * \param fgf_line The function component(basically the position in the list), - * from the filter list, after which the new filter has to be - * added - * \param line Line number of the filter - */ -static inline void SCLogAddToFGFLineList(SCLogFGFilterFunc *fgf_func, - SCLogFGFilterLine *fgf_line, - int line) -{ - SCLogFGFilterLine *fgf_line_temp = NULL; - - if ( (fgf_line_temp = SCMalloc(sizeof(SCLogFGFilterLine))) == NULL) { - printf("Error Allocating memory\n"); - exit(EXIT_FAILURE); - } - memset(fgf_line_temp, 0, sizeof(SCLogFGFilterLine)); - - fgf_line_temp->line = line; - - /* add to the lists */ - if (fgf_line == NULL) - fgf_func->line = fgf_line_temp; - else - fgf_line->next = fgf_line_temp; - - return; -} - -/** - * \brief Helper function used internally to add a FG filter - * - * \param file File_name of the filter - * \param function Function_name of the filter - * \param line Line number of the filter - * \param listtype The filter listtype. Can be either a blacklist or whitelist - * filter listtype(SC_LOG_FILTER_BL or SC_LOG_FILTER_WL) - * - * \retval 0 on successfully adding the filter; - * \retval -1 on failure - */ -static inline int SCLogAddFGFilter(const char *file, const char *function, - int line, int listtype) -{ - SCLogFGFilterFile *fgf_file = NULL; - SCLogFGFilterFile *prev_fgf_file = NULL; - - SCLogFGFilterFunc *fgf_func = NULL; - SCLogFGFilterFunc *prev_fgf_func = NULL; - - SCLogFGFilterLine *fgf_line = NULL; - SCLogFGFilterLine *prev_fgf_line = NULL; - - int found = 0; - - if (sc_log_module_initialized != 1) { - printf("Logging module not initialized. Call SCLogInitLogModule() " - "first before using the debug API\n"); - return -1 ; - } - - if (file == NULL && function == NULL && line < 0) { - printf("Error: Invalid arguments supplied to SCLogAddFGFilter\n"); - return -1; - } - - SCMutex *m = &sc_log_fg_filters_m[listtype]; - - SCMutexLock(m); - - fgf_file = sc_log_fg_filters[listtype]; - - prev_fgf_file = fgf_file; - while (fgf_file != NULL) { - prev_fgf_file = fgf_file; - if (file == NULL && fgf_file->file == NULL) - found = 1; - else if (file != NULL && fgf_file->file != NULL) - found = (strcmp(file, fgf_file->file) == 0); - else - found = 0; - - if (found == 1) - break; - - fgf_file = fgf_file->next; - } - - if (found == 0) { - SCLogAddToFGFFileList(prev_fgf_file, file, function, line, listtype); - goto done; - } - - found = 0; - fgf_func = fgf_file->func; - prev_fgf_func = fgf_func; - while (fgf_func != NULL) { - prev_fgf_func = fgf_func; - if (function == NULL && fgf_func->func == NULL) - found = 1; - else if (function != NULL && fgf_func->func != NULL) - found = (strcmp(function, fgf_func->func) == 0); - else - found = 0; - - if (found == 1) - break; - - fgf_func = fgf_func->next; - } - - if (found == 0) { - SCLogAddToFGFFuncList(fgf_file, prev_fgf_func, function, line); - goto done; - } - - found = 0; - fgf_line = fgf_func->line; - prev_fgf_line = fgf_line; - while(fgf_line != NULL) { - prev_fgf_line = fgf_line; - if (line == fgf_line->line) { - found = 1; - break; - } - - fgf_line = fgf_line->next; - } - - if (found == 0) { - SCLogAddToFGFLineList(fgf_func, prev_fgf_line, line); - goto done; - } - - done: - SCMutexUnlock(&sc_log_fg_filters_m[listtype]); - sc_log_fg_filters_present = 1; - - return 0; -} - /** * \brief Internal function used to check for matches against registered FG * filters. Checks if there is a match for the incoming log_message with @@ -607,22 +342,6 @@ int SCLogPrintFGFilters() */ /** - * \brief Releases the memory alloted to a FD filter - * - * \param Pointer to the FD filter that has to be freed - */ -static inline void SCLogReleaseFDFilter(SCLogFDFilter *fdf) -{ - if (fdf != NULL) { - if (fdf->func != NULL) - SCFree(fdf->func); - SCFree(fdf); - } - - return; -} - -/** * \brief Checks if there is a match for the incoming log_message with any * of the FD filters * diff --git a/src/util-debug-filters.h b/src/util-debug-filters.h index 0bd1661..f76a722 100644 --- a/src/util-debug-filters.h +++ b/src/util-debug-filters.h @@ -7,6 +7,9 @@ #include #include "threads.h" +#include "suricata-common.h" +#include "util-mem.h" +#include "util-debug.h" /** * \brief Enum that holds the different kinds of filters available @@ -99,4 +102,298 @@ int SCLogMatchFDFilter(const char *); int SCLogPrintFGFilters(void); +/** ------- Inline funcionts ------ */ + +extern int sc_log_module_initialized; +extern int sc_log_module_cleaned; +extern SCMutex sc_log_fg_filters_m[2]; +extern SCLogFGFilterFile *sc_log_fg_filters[2]; + +static inline void SCLogAddToFGFFileList(SCLogFGFilterFile *, + const char *, + const char *, + int, int); + +/** + * \brief Helper function used internally to add a FG filter. This function is + * called when the file component of the incoming filter has an entry + * in the filter list, but the function component doesn't have an entry + * for the corresponding file component + * + * \param fgf_file The file component from the filter list to which the new + * filter has to be added + * \param fgf_func The function component(basically the position in the list), + * from the filter list, after which the new filter has to be + * added + * \param function Function_name of the filter + * \param line Line number of the filter + */ +static inline void SCLogAddToFGFFuncList(SCLogFGFilterFile *fgf_file, + SCLogFGFilterFunc *fgf_func, + const char *function, int line) +{ + SCLogFGFilterFunc *fgf_func_temp = NULL; + SCLogFGFilterLine *fgf_line_temp = NULL; + + if ( (fgf_func_temp = SCMalloc(sizeof(SCLogFGFilterFunc))) == NULL) { + printf("Error Allocating memory\n"); + exit(EXIT_FAILURE); + } + memset(fgf_func_temp, 0, sizeof(SCLogFGFilterFunc)); + + if ( function != NULL && (fgf_func_temp->func = SCStrdup(function)) == NULL) { + printf("Error Allocating memory\n"); + exit(EXIT_FAILURE); + } + + if ( (fgf_line_temp = SCMalloc(sizeof(SCLogFGFilterLine))) == NULL) { + printf("Error Allocating memory\n"); + exit(EXIT_FAILURE); + } + memset(fgf_line_temp, 0, sizeof(SCLogFGFilterLine)); + + fgf_line_temp->line = line; + + /* add to the lists */ + fgf_func_temp->line = fgf_line_temp; + + if (fgf_func == NULL) + fgf_file->func = fgf_func_temp; + else + fgf_func->next = fgf_func_temp; + + return; +} + +/** + * \brief Helper function used internally to add a FG filter. This function is + * called when the file and function components of the incoming filter + * have an entry in the filter list, but the line component doesn't have + * an entry for the corresponding function component + * + * \param fgf_func The function component from the filter list to which the new + * filter has to be added + * \param fgf_line The function component(basically the position in the list), + * from the filter list, after which the new filter has to be + * added + * \param line Line number of the filter + */ +static inline void SCLogAddToFGFLineList(SCLogFGFilterFunc *fgf_func, + SCLogFGFilterLine *fgf_line, + int line) +{ + SCLogFGFilterLine *fgf_line_temp = NULL; + + if ( (fgf_line_temp = SCMalloc(sizeof(SCLogFGFilterLine))) == NULL) { + printf("Error Allocating memory\n"); + exit(EXIT_FAILURE); + } + memset(fgf_line_temp, 0, sizeof(SCLogFGFilterLine)); + + fgf_line_temp->line = line; + + /* add to the lists */ + if (fgf_line == NULL) + fgf_func->line = fgf_line_temp; + else + fgf_line->next = fgf_line_temp; + + return; +} + +/** + * \brief Helper function used internally to add a FG filter + * + * \param file File_name of the filter + * \param function Function_name of the filter + * \param line Line number of the filter + * \param listtype The filter listtype. Can be either a blacklist or whitelist + * filter listtype(SC_LOG_FILTER_BL or SC_LOG_FILTER_WL) + * + * \retval 0 on successfully adding the filter; + * \retval -1 on failure + */ +static inline int SCLogAddFGFilter(const char *file, const char *function, + int line, int listtype) +{ + SCLogFGFilterFile *fgf_file = NULL; + SCLogFGFilterFile *prev_fgf_file = NULL; + + SCLogFGFilterFunc *fgf_func = NULL; + SCLogFGFilterFunc *prev_fgf_func = NULL; + + SCLogFGFilterLine *fgf_line = NULL; + SCLogFGFilterLine *prev_fgf_line = NULL; + + int found = 0; + + if (sc_log_module_initialized != 1) { + printf("Logging module not initialized. Call SCLogInitLogModule() " + "first before using the debug API\n"); + return -1 ; + } + + if (file == NULL && function == NULL && line < 0) { + printf("Error: Invalid arguments supplied to SCLogAddFGFilter\n"); + return -1; + } + + SCMutex *m = &sc_log_fg_filters_m[listtype]; + + SCMutexLock(m); + + fgf_file = sc_log_fg_filters[listtype]; + + prev_fgf_file = fgf_file; + while (fgf_file != NULL) { + prev_fgf_file = fgf_file; + if (file == NULL && fgf_file->file == NULL) + found = 1; + else if (file != NULL && fgf_file->file != NULL) + found = (strcmp(file, fgf_file->file) == 0); + else + found = 0; + + if (found == 1) + break; + + fgf_file = fgf_file->next; + } + + if (found == 0) { + SCLogAddToFGFFileList(prev_fgf_file, file, function, line, listtype); + goto done; + } + + found = 0; + fgf_func = fgf_file->func; + prev_fgf_func = fgf_func; + while (fgf_func != NULL) { + prev_fgf_func = fgf_func; + if (function == NULL && fgf_func->func == NULL) + found = 1; + else if (function != NULL && fgf_func->func != NULL) + found = (strcmp(function, fgf_func->func) == 0); + else + found = 0; + + if (found == 1) + break; + + fgf_func = fgf_func->next; + } + + if (found == 0) { + SCLogAddToFGFFuncList(fgf_file, prev_fgf_func, function, line); + goto done; + } + + found = 0; + fgf_line = fgf_func->line; + prev_fgf_line = fgf_line; + while(fgf_line != NULL) { + prev_fgf_line = fgf_line; + if (line == fgf_line->line) { + found = 1; + break; + } + + fgf_line = fgf_line->next; + } + + if (found == 0) { + SCLogAddToFGFLineList(fgf_func, prev_fgf_line, line); + goto done; + } + + done: + SCMutexUnlock(&sc_log_fg_filters_m[listtype]); + sc_log_fg_filters_present = 1; + + return 0; +} + + +/** + * \brief Helper function used internally to add a FG filter. This function is + * called when the file component of the incoming filter has no entry + * in the filter list. + * + * \param fgf_file The file component(basically the position in the list) from + * the filter list, after which the new filter has to be added + * \param file File_name of the filter + * \param function Function_name of the filter + * \param line Line number of the filter + * \param listtype The filter listtype. Can be either a blacklist or whitelist + * filter listtype(SC_LOG_FILTER_BL or SC_LOG_FILTER_WL) + */ +static inline void SCLogAddToFGFFileList(SCLogFGFilterFile *fgf_file, + const char *file, + const char *function, int line, + int listtype) +{ + SCLogFGFilterFile *fgf_file_temp = NULL; + SCLogFGFilterFunc *fgf_func_temp = NULL; + SCLogFGFilterLine *fgf_line_temp = NULL; + + if ( (fgf_file_temp = SCMalloc(sizeof(SCLogFGFilterFile))) == NULL) { + printf("Error Allocating memory\n"); + exit(EXIT_FAILURE); + } + memset(fgf_file_temp, 0, sizeof(SCLogFGFilterFile)); + + if ( file != NULL && (fgf_file_temp->file = SCStrdup(file)) == NULL) { + printf("Error Allocating memory\n"); + exit(EXIT_FAILURE); + } + + if ( (fgf_func_temp = SCMalloc(sizeof(SCLogFGFilterFunc))) == NULL) { + printf("Error Allocating memory\n"); + exit(EXIT_FAILURE); + } + memset(fgf_func_temp, 0, sizeof(SCLogFGFilterFunc)); + + if ( function != NULL && (fgf_func_temp->func = SCStrdup(function)) == NULL) { + printf("Error Allocating memory\n"); + exit(EXIT_FAILURE); + } + + if ( (fgf_line_temp = SCMalloc(sizeof(SCLogFGFilterLine))) == NULL) { + printf("Error Allocating memory\n"); + exit(EXIT_FAILURE); + } + memset(fgf_line_temp, 0, sizeof(SCLogFGFilterLine)); + + fgf_line_temp->line = line; + + /* add to the lists */ + fgf_func_temp->line = fgf_line_temp; + + fgf_file_temp->func = fgf_func_temp; + + if (fgf_file == NULL) + sc_log_fg_filters[listtype] = fgf_file_temp; + else + fgf_file->next = fgf_file_temp; + + return; +} + +/** + * \brief Releases the memory alloted to a FD filter + * + * \param Pointer to the FD filter that has to be freed + */ +static inline void SCLogReleaseFDFilter(SCLogFDFilter *fdf) +{ + if (fdf != NULL) { + if (fdf->func != NULL) + SCFree(fdf->func); + SCFree(fdf); + } + + return; +} + + #endif /* __DEBUG_H__ */ diff --git a/src/util-debug.c b/src/util-debug.c index d72cc15..e22c00f 100644 --- a/src/util-debug.c +++ b/src/util-debug.c @@ -4,8 +4,8 @@ #include "suricata-common.h" #include "threads.h" -#include "util-debug.h" #include "util-error.h" +#include "util-debug.h" #include "util-enum.h" #include "util-debug-filters.h" @@ -23,8 +23,13 @@ #include "conf.h" +/** + * \brief Holds the config state for the logging module + */ +static SCLogConfig *sc_log_config = NULL; + /* holds the string-enum mapping for the enums held in the table SCLogLevel */ -SCEnumCharMap sc_log_level_map[ ] = { +SCEnumCharMap sc_log_level_map[11] = { { "Not set", SC_LOG_NOTSET}, { "None", SC_LOG_NONE }, { "Emergency", SC_LOG_EMERGENCY }, @@ -39,7 +44,7 @@ SCEnumCharMap sc_log_level_map[ ] = { }; /* holds the string-enum mapping for the enums held in the table SCLogOPIface */ -SCEnumCharMap sc_log_op_iface_map[ ] = { +SCEnumCharMap sc_log_op_iface_map[4] = { { "Console", SC_LOG_OP_IFACE_CONSOLE }, { "File", SC_LOG_OP_IFACE_FILE }, { "Syslog", SC_LOG_OP_IFACE_SYSLOG }, @@ -47,7 +52,7 @@ SCEnumCharMap sc_log_op_iface_map[ ] = { }; /* holds the string-enum mapping for the syslog facility in SCLogOPIfaceCtx */ -SCEnumCharMap sc_syslog_facility_map[] = { +SCEnumCharMap sc_syslog_facility_map[22] = { { "auth", LOG_AUTH }, { "authpriv", LOG_AUTHPRIV }, { "cron", LOG_CRON }, @@ -72,15 +77,6 @@ SCEnumCharMap sc_syslog_facility_map[] = { { NULL, -1 } }; -/** - * \brief Holds the config state for the logging module - */ -static SCLogConfig *sc_log_config = NULL; - -/** - * \brief Returns the full path given a file and configured log dir - */ -static char *SCLogGetLogFilename(char *); /** * \brief Holds the global log level. Is the same as sc_log_config->log_level @@ -98,77 +94,6 @@ int sc_log_module_initialized = 0; int sc_log_module_cleaned = 0; /** - * \brief Maps the SC logging level to the syslog logging level - * - * \param The SC logging level that has to be mapped to the syslog_log_level - * - * \retval syslog_log_level The mapped syslog_api_log_level, for the logging - * module api's internal log_level - */ -static inline int SCLogMapLogLevelToSyslogLevel(int log_level) -{ - int syslog_log_level = 0; - - switch (log_level) { - case SC_LOG_EMERGENCY: - syslog_log_level = LOG_EMERG; - case SC_LOG_ALERT: - syslog_log_level = LOG_ALERT; - case SC_LOG_CRITICAL: - syslog_log_level = LOG_CRIT; - case SC_LOG_ERROR: - syslog_log_level = LOG_ERR; - case SC_LOG_WARNING: - syslog_log_level = LOG_WARNING; - case SC_LOG_NOTICE: - syslog_log_level = LOG_NOTICE; - case SC_LOG_INFO: - syslog_log_level = LOG_INFO; - case SC_LOG_DEBUG: - syslog_log_level = LOG_DEBUG; - default: - syslog_log_level = LOG_EMERG; - } - - return syslog_log_level; -} - -/** - * \brief Output function that logs a character string out to a file descriptor - * - * \param fd Pointer to the file descriptor - * \param msg Pointer to the character string that should be logged - */ -static inline void SCLogPrintToStream(FILE *fd, char *msg) -{ - if (fprintf(fd, "%s", msg) < 0) - printf("Error writing to stream using fprintf\n"); - - fflush(fd); - return; -} - -/** - * \brief Output function that logs a character string throught the syslog iface - * - * \param syslog_log_level Holds the syslog_log_level that the message should be - * logged as - * \param msg Pointer to the char string, that should be logged - * - * \todo syslog is thread-safe according to POSIX manual and glibc code, but we - * we will have to look into non POSIX compliant boxes like freeBSD - */ -static inline void SCLogPrintToSyslog(int syslog_log_level, const char *msg) -{ - //static struct syslog_data data = SYSLOG_DATA_INIT; - //syslog_r(syslog_log_level, NULL, "%s", msg); - - syslog(syslog_log_level, "%s", msg); - - return; -} - -/** * \brief Outputs the message sent as the argument * * \param msg Pointer to the message that has to be logged @@ -468,365 +393,6 @@ SCLogOPBuffer *SCLogAllocLogOPBuffer(void) /*----------------------The logging module initialization code--------------- */ /** - * \brief Returns a new output_interface_context - * - * \retval iface_ctx Pointer to a newly allocated output_interface_context - */ -static inline SCLogOPIfaceCtx *SCLogAllocLogOPIfaceCtx() -{ - SCLogOPIfaceCtx *iface_ctx = NULL; - - if ( (iface_ctx = malloc(sizeof(SCLogOPIfaceCtx))) == NULL) { - printf("Error allocating memory\n"); - exit(EXIT_FAILURE); - } - memset(iface_ctx, 0, sizeof(SCLogOPIfaceCtx)); - - return iface_ctx; -} - -/** - * \brief Initializes the file output interface - * - * \param file Path to the file used for logging purposes - * \param log_format Pointer to the log_format for this op interface, that - * overrides the global_log_format - * \param log_level Override of the global_log_level by this interface - * - * \retval iface_ctx Pointer to the file output interface context created - */ -static inline SCLogOPIfaceCtx *SCLogInitFileOPIface(const char *file, - const char *log_format, - int log_level) -{ - SCLogOPIfaceCtx *iface_ctx = SCLogAllocLogOPIfaceCtx(); - - iface_ctx->iface = SC_LOG_OP_IFACE_FILE; - - if (file != NULL && - (iface_ctx->file = strdup(file)) == NULL) { - printf("Error allocating memory\n"); - exit(EXIT_FAILURE); - } - - if ( (iface_ctx->file_d = fopen(file, "w+")) == NULL) { - printf("Error opening file %s\n", file); - return NULL; - } - - if (log_format != NULL && - (iface_ctx->log_format = strdup(log_format)) == NULL) { - printf("Error allocating memory\n"); - exit(EXIT_FAILURE); - } - - iface_ctx->log_level = log_level; - - return iface_ctx; -} - -/** - * \brief Initializes the console output interface - * - * \param log_format Pointer to the log_format for this op interface, that - * overrides the global_log_format - * \param log_level Override of the global_log_level by this interface - * - * \retval iface_ctx Pointer to the console output interface context created - */ -static inline SCLogOPIfaceCtx *SCLogInitConsoleOPIface(const char *log_format, - SCLogLevel log_level) -{ - SCLogOPIfaceCtx *iface_ctx = SCLogAllocLogOPIfaceCtx(); - - if ( (iface_ctx = malloc(sizeof(SCLogOPIfaceCtx))) == NULL) { - printf("Error allocating memory\n"); - exit(EXIT_FAILURE); - } - memset(iface_ctx, 0, sizeof(SCLogOPIfaceCtx)); - - iface_ctx->iface = SC_LOG_OP_IFACE_CONSOLE; - - if (log_format != NULL && - (iface_ctx->log_format = strdup(log_format)) == NULL) { - printf("Error allocating memory\n"); - exit(EXIT_FAILURE); - } - - iface_ctx->log_level = log_level; - - return iface_ctx; -} - -/** - * \brief Initializes the syslog output interface - * - * \param facility The facility code for syslog - * \param log_format Pointer to the log_format for this op interface, that - * overrides the global_log_format - * \param log_level Override of the global_log_level by this interface - * - * \retval iface_ctx Pointer to the syslog output interface context created - */ -static inline SCLogOPIfaceCtx *SCLogInitSyslogOPIface(int facility, - const char *log_format, - SCLogLevel log_level) -{ - SCLogOPIfaceCtx *iface_ctx = SCLogAllocLogOPIfaceCtx(); - - if ( (iface_ctx = malloc(sizeof(SCLogOPIfaceCtx))) == NULL) { - printf("Error allocating memory\n"); - exit(EXIT_FAILURE); - } - memset(iface_ctx, 0, sizeof(SCLogOPIfaceCtx)); - - iface_ctx->iface = SC_LOG_OP_IFACE_SYSLOG; - - if (facility == -1) - facility = SC_LOG_DEF_SYSLOG_FACILITY; - iface_ctx->facility = facility; - - if (log_format != NULL && - (iface_ctx->log_format = strdup(log_format)) == NULL) { - printf("Error allocating memory\n"); - exit(EXIT_FAILURE); - } - - iface_ctx->log_level = log_level; - - openlog(NULL, LOG_NDELAY, iface_ctx->facility); - - return iface_ctx; -} - -/** - * \brief Frees the output_interface context supplied as an argument - * - * \param iface_ctx Pointer to the op_interface_context to be freed - */ -static inline void SCLogFreeLogOPIfaceCtx(SCLogOPIfaceCtx *iface_ctx) -{ - SCLogOPIfaceCtx *temp = NULL; - - while (iface_ctx != NULL) { - temp = iface_ctx; - - if (iface_ctx->file_d != NULL) - fclose(iface_ctx->file_d); - - if (iface_ctx->file != NULL) - free((void *)iface_ctx->file); - - if (iface_ctx->log_format != NULL) - free((void *)iface_ctx->log_format); - - if (iface_ctx->iface == SC_LOG_OP_IFACE_SYSLOG) { - closelog(); - } - - iface_ctx = iface_ctx->next; - - free(temp); - } - - return; -} - -/** - * \brief Internal function used to set the logging module global_log_level - * during the initialization phase - * - * \param sc_lid The initialization data supplied. - * \param sc_lc The logging module context which has to be updated. - */ -static inline void SCLogSetLogLevel(SCLogInitData *sc_lid, SCLogConfig *sc_lc) -{ - SCLogLevel log_level = SC_LOG_NOTSET; - const char *s = NULL; - - if (sc_lid != NULL) - log_level = sc_lid->global_log_level; - else { - s = getenv(SC_LOG_ENV_LOG_LEVEL); - if (s != NULL) - log_level = SCMapEnumNameToValue(s, sc_log_level_map); - } - - /* deal with the global_log_level to be used */ - if (log_level > SC_LOG_NOTSET && log_level < SC_LOG_LEVEL_MAX) - sc_lc->log_level = log_level; - else { - sc_lc->log_level = SC_LOG_DEF_LOG_LEVEL; -#ifndef UNITTESTS - printf("Warning: Invalid global_log_level assigned by user. Falling " - "back on the default_log_level \"%s\"\n", - SCMapEnumValueToName(sc_lc->log_level, sc_log_level_map)); -#endif - } - - /* we also set it to a global var, as it is easier to access it */ - sc_log_global_log_level = sc_lc->log_level; - -#ifdef DEBUG - printf("sc_log_global_log_level: %d\n", sc_log_global_log_level); -#endif - - return; -} - -/** - * \brief Internal function used to set the logging module global_log_format - * during the initialization phase - * - * \param sc_lid The initialization data supplied. - * \param sc_lc The logging module context which has to be updated. - */ -static inline void SCLogSetLogFormat(SCLogInitData *sc_lid, SCLogConfig *sc_lc) -{ - char *format = NULL; - - if (sc_lid != NULL) - format = sc_lid->global_log_format; - else - format = getenv(SC_LOG_ENV_LOG_FORMAT); - - /* deal with the global log format to be used */ - if (format == NULL || strlen(format) > SC_LOG_MAX_LOG_FORMAT_LEN) { - format = SC_LOG_DEF_LOG_FORMAT; -#ifndef UNITTESTS - printf("Warning: Invalid global_log_format supplied by user or format " - "length exceeded limit of \"%d\" characters. Falling back on " - "default log_format \"%s\"\n", SC_LOG_MAX_LOG_FORMAT_LEN, - format); -#endif - } - - if (format != NULL && - (sc_lc->log_format = strdup(format)) == NULL) { - printf("Error allocating memory\n"); - exit(EXIT_FAILURE); - } - -#ifdef DEBUG - printf("sc_lc->log_format: %s\n", sc_lc->log_format); -#endif - - return; -} - -/** - * \brief Internal function used to set the logging module global_op_ifaces - * during the initialization phase - * - * \param sc_lid The initialization data supplied. - * \param sc_lc The logging module context which has to be updated. - */ -static inline void SCLogSetOPIface(SCLogInitData *sc_lid, SCLogConfig *sc_lc) -{ - SCLogOPIfaceCtx *op_ifaces_ctx = NULL; - int op_iface = 0; - const char *s = NULL; - - if (sc_lid != NULL && sc_lid->op_ifaces != NULL) { - sc_lc->op_ifaces = sc_lid->op_ifaces; - sc_lid->op_ifaces = NULL; - sc_lc->op_ifaces_cnt = sc_lid->op_ifaces_cnt; - } - else { - s = getenv(SC_LOG_ENV_LOG_OP_IFACE); - if (s != NULL) { - op_iface = SCMapEnumNameToValue(s, sc_log_op_iface_map); - - if(op_iface < 0 || op_iface >= SC_LOG_OP_IFACE_MAX) { - op_iface = SC_LOG_DEF_LOG_OP_IFACE; -#ifndef UNITTESTS - printf("Warning: Invalid output interface supplied by user. " - "Falling back on default_output_interface \"%s\"\n", - SCMapEnumValueToName(op_iface, sc_log_op_iface_map)); -#endif - } - } - else { - op_iface = SC_LOG_DEF_LOG_OP_IFACE; -#ifndef UNITTESTS - printf("Warning: Output_interface not supplied by user. Falling " - "back on default_output_interface \"%s\"\n", - SCMapEnumValueToName(op_iface, sc_log_op_iface_map)); -#endif - } - - switch (op_iface) { - case SC_LOG_OP_IFACE_CONSOLE: - op_ifaces_ctx = SCLogInitConsoleOPIface(NULL, SC_LOG_LEVEL_MAX); - break; - case SC_LOG_OP_IFACE_FILE: - s = getenv(SC_LOG_ENV_LOG_FILE); - if (s == NULL) - s = SCLogGetLogFilename(SC_LOG_DEF_LOG_FILE); - - op_ifaces_ctx = SCLogInitFileOPIface(s, NULL, SC_LOG_LEVEL_MAX); - break; - case SC_LOG_OP_IFACE_SYSLOG: - s = getenv(SC_LOG_ENV_LOG_FACILITY); - if (s == NULL) - s = SC_LOG_DEF_SYSLOG_FACILITY_STR; - - op_ifaces_ctx = SCLogInitSyslogOPIface(SCMapEnumNameToValue(s, sc_syslog_facility_map), NULL, -1); - break; - default: - break; - } - sc_lc->op_ifaces = op_ifaces_ctx; - sc_lc->op_ifaces_cnt++; - } - - return; -} - -/** - * \brief Internal function used to set the logging module op_filter - * during the initialization phase - * - * \param sc_lid The initialization data supplied. - * \param sc_lc The logging module context which has to be updated. - */ -static inline void SCLogSetOPFilter(SCLogInitData *sc_lid, SCLogConfig *sc_lc) -{ - const char *filter = NULL; - - int opts = 0; - const char *ep; - int eo = 0; - - if (sc_lid != NULL) - filter = sc_lid->op_filter; - else - filter = getenv(SC_LOG_ENV_LOG_OP_FILTER); - - if (filter != NULL && strcmp(filter, "") != 0) { - sc_lc->op_filter_regex = pcre_compile(filter, opts, &ep, &eo, NULL); - if (sc_lc->op_filter_regex == NULL) { - printf("pcre compile of \"%s\" failed at offset %d : %s\n", filter, - eo, ep); - return; - } - - sc_lc->op_filter_regex_study = pcre_study(sc_lc->op_filter_regex, 0, - &ep); - if (ep != NULL) { - printf("pcre study failed: %s\n", ep); - return; - } - } - -#ifdef DEBUG - printf("SCLogSetOPFilter: filter: %s\n", filter ? filter : ""); -#endif - - return; -} - -/** * \brief Returns a pointer to a new SCLogInitData. This is a public interface * intended to be used after the logging paramters are read from the * conf file @@ -868,24 +434,6 @@ void SCLogFreeLogInitData(SCLogInitData *sc_lid) } /** - * \brief Frees the logging module context - */ -static inline void SCLogFreeLogConfig(SCLogConfig *sc_lc) -{ - if (sc_lc != NULL) { - if (sc_lc->startup_message != NULL) - free(sc_lc->startup_message); - if (sc_lc->log_format != NULL) - free(sc_lc->log_format); - - SCLogFreeLogOPIfaceCtx(sc_lc->op_ifaces); - free(sc_lc); - } - - return; -} - -/** * \brief Appends an output_interface to the output_interface list sent in head * * \param iface_ctx Pointer to the output_interface that has to be added to head @@ -1240,7 +788,7 @@ void SCLogInitLogModuleIfEnvSet(void) * * \retval log_filename The fullpath of the logfile to open */ -static char *SCLogGetLogFilename(char *filearg) +char *SCLogGetLogFilename(char *filearg) { char *log_dir; char *log_filename; diff --git a/src/util-debug.h b/src/util-debug.h index 18cb93b..959dc2a 100644 --- a/src/util-debug.h +++ b/src/util-debug.h @@ -2,7 +2,10 @@ * \author Anoop Saldanha */ -#include +#ifndef __UTIL_DEBUG_H__ +#define __UTIL_DEBUG_H__ + +#include "suricata-common.h" #include "threads.h" #include @@ -11,8 +14,14 @@ #include "pcre.h" #include "util-debug-filters.h" -#ifndef __UTIL_DEBUG_H__ -#define __UTIL_DEBUG_H__ +extern SCEnumCharMap sc_log_level_map[11]; +extern SCEnumCharMap sc_log_op_iface_map[4]; +extern SCEnumCharMap sc_syslog_facility_map[22]; + +/** + * \brief Returns the full path given a file and configured log dir + */ +char *SCLogGetLogFilename(char *); /** * \brief ENV vars that can be used to set the properties for the logging module @@ -73,6 +82,7 @@ typedef enum { #define SC_LOG_DEF_SYSLOG_FACILITY_STR "local0" #define SC_LOG_DEF_SYSLOG_FACILITY LOG_LOCAL0 + /** * \brief Structure to be used when log_level override support would be provided * by the logging module @@ -520,4 +530,473 @@ void SCLogRegisterTests(void); void SCLogLoadConfig(void); +/** --------- Inline functions -------- */ + +#if 0 +static inline void SCLogFreeLogConfig(SCLogConfig *); +static inline SCLogOPIfaceCtx *SCLogAllocLogOPIfaceCtx(); +static inline SCLogOPIfaceCtx *SCLogInitFileOPIface(const char *, const char *, int ); +static inline SCLogOPIfaceCtx *SCLogInitConsoleOPIface(const char *, SCLogLevel ); +static inline SCLogOPIfaceCtx *SCLogInitSyslogOPIface(int, const char *, SCLogLevel ); +static inline void SCLogFreeLogOPIfaceCtx(SCLogOPIfaceCtx *); +static inline void SCLogSetLogLevel(SCLogInitData *, SCLogConfig *); +static inline void SCLogSetLogFormat(SCLogInitData *, SCLogConfig *); +static inline void SCLogSetOPIface(SCLogInitData *, SCLogConfig *); +static inline void SCLogSetOPFilter(SCLogInitData *, SCLogConfig *); +static inline int SCLogMapLogLevelToSyslogLevel(int ); +static inline void SCLogPrintToStream(FILE *, char *); +static inline void SCLogPrintToSyslog(int , const char *); +#endif + +/** + * \brief Frees the output_interface context supplied as an argument + * + * \param iface_ctx Pointer to the op_interface_context to be freed + */ +static inline void SCLogFreeLogOPIfaceCtx(SCLogOPIfaceCtx *iface_ctx) +{ + SCLogOPIfaceCtx *temp = NULL; + + while (iface_ctx != NULL) { + temp = iface_ctx; + + if (iface_ctx->file_d != NULL) + fclose(iface_ctx->file_d); + + if (iface_ctx->file != NULL) + free((void *)iface_ctx->file); + + if (iface_ctx->log_format != NULL) + free((void *)iface_ctx->log_format); + + if (iface_ctx->iface == SC_LOG_OP_IFACE_SYSLOG) { + closelog(); + } + + iface_ctx = iface_ctx->next; + + free(temp); + } + + return; +} + + +/** + * \brief Frees the logging module context + */ +static inline void SCLogFreeLogConfig(SCLogConfig *sc_lc) +{ + if (sc_lc != NULL) { + if (sc_lc->startup_message != NULL) + free(sc_lc->startup_message); + if (sc_lc->log_format != NULL) + free(sc_lc->log_format); + + SCLogFreeLogOPIfaceCtx(sc_lc->op_ifaces); + free(sc_lc); + } + + return; +} + +/** + * \brief Returns a new output_interface_context + * + * \retval iface_ctx Pointer to a newly allocated output_interface_context + */ +static inline SCLogOPIfaceCtx *SCLogAllocLogOPIfaceCtx() +{ + SCLogOPIfaceCtx *iface_ctx = NULL; + + if ( (iface_ctx = malloc(sizeof(SCLogOPIfaceCtx))) == NULL) { + printf("Error allocating memory\n"); + exit(EXIT_FAILURE); + } + memset(iface_ctx, 0, sizeof(SCLogOPIfaceCtx)); + + return iface_ctx; +} + +/** + * \brief Initializes the file output interface + * + * \param file Path to the file used for logging purposes + * \param log_format Pointer to the log_format for this op interface, that + * overrides the global_log_format + * \param log_level Override of the global_log_level by this interface + * + * \retval iface_ctx Pointer to the file output interface context created + */ +static inline SCLogOPIfaceCtx *SCLogInitFileOPIface(const char *file, + const char *log_format, + int log_level) +{ + SCLogOPIfaceCtx *iface_ctx = SCLogAllocLogOPIfaceCtx(); + + iface_ctx->iface = SC_LOG_OP_IFACE_FILE; + + if (file != NULL && + (iface_ctx->file = strdup(file)) == NULL) { + printf("Error allocating memory\n"); + exit(EXIT_FAILURE); + } + + if ( (iface_ctx->file_d = fopen(file, "w+")) == NULL) { + printf("Error opening file %s\n", file); + return NULL; + } + + if (log_format != NULL && + (iface_ctx->log_format = strdup(log_format)) == NULL) { + printf("Error allocating memory\n"); + exit(EXIT_FAILURE); + } + + iface_ctx->log_level = log_level; + + return iface_ctx; +} + +/** + * \brief Initializes the console output interface + * + * \param log_format Pointer to the log_format for this op interface, that + * overrides the global_log_format + * \param log_level Override of the global_log_level by this interface + * + * \retval iface_ctx Pointer to the console output interface context created + */ +static inline SCLogOPIfaceCtx *SCLogInitConsoleOPIface(const char *log_format, + SCLogLevel log_level) +{ + SCLogOPIfaceCtx *iface_ctx = SCLogAllocLogOPIfaceCtx(); + + if ( (iface_ctx = malloc(sizeof(SCLogOPIfaceCtx))) == NULL) { + printf("Error allocating memory\n"); + exit(EXIT_FAILURE); + } + memset(iface_ctx, 0, sizeof(SCLogOPIfaceCtx)); + + iface_ctx->iface = SC_LOG_OP_IFACE_CONSOLE; + + if (log_format != NULL && + (iface_ctx->log_format = strdup(log_format)) == NULL) { + printf("Error allocating memory\n"); + exit(EXIT_FAILURE); + } + + iface_ctx->log_level = log_level; + + return iface_ctx; +} + +/** + * \brief Initializes the syslog output interface + * + * \param facility The facility code for syslog + * \param log_format Pointer to the log_format for this op interface, that + * overrides the global_log_format + * \param log_level Override of the global_log_level by this interface + * + * \retval iface_ctx Pointer to the syslog output interface context created + */ +static inline SCLogOPIfaceCtx *SCLogInitSyslogOPIface(int facility, + const char *log_format, + SCLogLevel log_level) +{ + SCLogOPIfaceCtx *iface_ctx = SCLogAllocLogOPIfaceCtx(); + + if ( (iface_ctx = malloc(sizeof(SCLogOPIfaceCtx))) == NULL) { + printf("Error allocating memory\n"); + exit(EXIT_FAILURE); + } + memset(iface_ctx, 0, sizeof(SCLogOPIfaceCtx)); + + iface_ctx->iface = SC_LOG_OP_IFACE_SYSLOG; + + if (facility == -1) + facility = SC_LOG_DEF_SYSLOG_FACILITY; + iface_ctx->facility = facility; + + if (log_format != NULL && + (iface_ctx->log_format = strdup(log_format)) == NULL) { + printf("Error allocating memory\n"); + exit(EXIT_FAILURE); + } + + iface_ctx->log_level = log_level; + + openlog(NULL, LOG_NDELAY, iface_ctx->facility); + + return iface_ctx; +} + +/** + * \brief Internal function used to set the logging module global_log_level + * during the initialization phase + * + * \param sc_lid The initialization data supplied. + * \param sc_lc The logging module context which has to be updated. + */ +static inline void SCLogSetLogLevel(SCLogInitData *sc_lid, SCLogConfig *sc_lc) +{ + SCLogLevel log_level = SC_LOG_NOTSET; + const char *s = NULL; + + if (sc_lid != NULL) + log_level = sc_lid->global_log_level; + else { + s = getenv(SC_LOG_ENV_LOG_LEVEL); + if (s != NULL) + log_level = SCMapEnumNameToValue(s, sc_log_level_map); + } + + /* deal with the global_log_level to be used */ + if (log_level > SC_LOG_NOTSET && log_level < SC_LOG_LEVEL_MAX) + sc_lc->log_level = log_level; + else { + sc_lc->log_level = SC_LOG_DEF_LOG_LEVEL; +#ifndef UNITTESTS + printf("Warning: Invalid global_log_level assigned by user. Falling " + "back on the default_log_level \"%s\"\n", + SCMapEnumValueToName(sc_lc->log_level, sc_log_level_map)); +#endif + } + + /* we also set it to a global var, as it is easier to access it */ + sc_log_global_log_level = sc_lc->log_level; + +#ifdef DEBUG + printf("sc_log_global_log_level: %d\n", sc_log_global_log_level); +#endif + + return; +} + +/** + * \brief Internal function used to set the logging module global_log_format + * during the initialization phase + * + * \param sc_lid The initialization data supplied. + * \param sc_lc The logging module context which has to be updated. + */ +static inline void SCLogSetLogFormat(SCLogInitData *sc_lid, SCLogConfig *sc_lc) +{ + char *format = NULL; + + if (sc_lid != NULL) + format = sc_lid->global_log_format; + else + format = getenv(SC_LOG_ENV_LOG_FORMAT); + + /* deal with the global log format to be used */ + if (format == NULL || strlen(format) > SC_LOG_MAX_LOG_FORMAT_LEN) { + format = SC_LOG_DEF_LOG_FORMAT; +#ifndef UNITTESTS + printf("Warning: Invalid global_log_format supplied by user or format " + "length exceeded limit of \"%d\" characters. Falling back on " + "default log_format \"%s\"\n", SC_LOG_MAX_LOG_FORMAT_LEN, + format); +#endif + } + + if (format != NULL && + (sc_lc->log_format = strdup(format)) == NULL) { + printf("Error allocating memory\n"); + exit(EXIT_FAILURE); + } + +#ifdef DEBUG + printf("sc_lc->log_format: %s\n", sc_lc->log_format); +#endif + + return; +} + +/** + * \brief Internal function used to set the logging module global_op_ifaces + * during the initialization phase + * + * \param sc_lid The initialization data supplied. + * \param sc_lc The logging module context which has to be updated. + */ +static inline void SCLogSetOPIface(SCLogInitData *sc_lid, SCLogConfig *sc_lc) +{ + SCLogOPIfaceCtx *op_ifaces_ctx = NULL; + int op_iface = 0; + const char *s = NULL; + + if (sc_lid != NULL && sc_lid->op_ifaces != NULL) { + sc_lc->op_ifaces = sc_lid->op_ifaces; + sc_lid->op_ifaces = NULL; + sc_lc->op_ifaces_cnt = sc_lid->op_ifaces_cnt; + } + else { + s = getenv(SC_LOG_ENV_LOG_OP_IFACE); + if (s != NULL) { + op_iface = SCMapEnumNameToValue(s, sc_log_op_iface_map); + + if(op_iface < 0 || op_iface >= SC_LOG_OP_IFACE_MAX) { + op_iface = SC_LOG_DEF_LOG_OP_IFACE; +#ifndef UNITTESTS + printf("Warning: Invalid output interface supplied by user. " + "Falling back on default_output_interface \"%s\"\n", + SCMapEnumValueToName(op_iface, sc_log_op_iface_map)); +#endif + } + } + else { + op_iface = SC_LOG_DEF_LOG_OP_IFACE; +#ifndef UNITTESTS + printf("Warning: Output_interface not supplied by user. Falling " + "back on default_output_interface \"%s\"\n", + SCMapEnumValueToName(op_iface, sc_log_op_iface_map)); +#endif + } + + switch (op_iface) { + case SC_LOG_OP_IFACE_CONSOLE: + op_ifaces_ctx = SCLogInitConsoleOPIface(NULL, SC_LOG_LEVEL_MAX); + break; + case SC_LOG_OP_IFACE_FILE: + s = getenv(SC_LOG_ENV_LOG_FILE); + if (s == NULL) + s = SCLogGetLogFilename(SC_LOG_DEF_LOG_FILE); + + op_ifaces_ctx = SCLogInitFileOPIface(s, NULL, SC_LOG_LEVEL_MAX); + break; + case SC_LOG_OP_IFACE_SYSLOG: + s = getenv(SC_LOG_ENV_LOG_FACILITY); + if (s == NULL) + s = SC_LOG_DEF_SYSLOG_FACILITY_STR; + + op_ifaces_ctx = SCLogInitSyslogOPIface(SCMapEnumNameToValue(s, sc_syslog_facility_map), NULL, -1); + break; + default: + break; + } + sc_lc->op_ifaces = op_ifaces_ctx; + sc_lc->op_ifaces_cnt++; + } + + return; +} + +/** + * \brief Internal function used to set the logging module op_filter + * during the initialization phase + * + * \param sc_lid The initialization data supplied. + * \param sc_lc The logging module context which has to be updated. + */ +static inline void SCLogSetOPFilter(SCLogInitData *sc_lid, SCLogConfig *sc_lc) +{ + const char *filter = NULL; + + int opts = 0; + const char *ep; + int eo = 0; + + if (sc_lid != NULL) + filter = sc_lid->op_filter; + else + filter = getenv(SC_LOG_ENV_LOG_OP_FILTER); + + if (filter != NULL && strcmp(filter, "") != 0) { + sc_lc->op_filter_regex = pcre_compile(filter, opts, &ep, &eo, NULL); + if (sc_lc->op_filter_regex == NULL) { + printf("pcre compile of \"%s\" failed at offset %d : %s\n", filter, + eo, ep); + return; + } + + sc_lc->op_filter_regex_study = pcre_study(sc_lc->op_filter_regex, 0, + &ep); + if (ep != NULL) { + printf("pcre study failed: %s\n", ep); + return; + } + } + +#ifdef DEBUG + printf("SCLogSetOPFilter: filter: %s\n", filter ? filter : ""); +#endif + + return; +} + + +/** + * \brief Maps the SC logging level to the syslog logging level + * + * \param The SC logging level that has to be mapped to the syslog_log_level + * + * \retval syslog_log_level The mapped syslog_api_log_level, for the logging + * module api's internal log_level + */ +static inline int SCLogMapLogLevelToSyslogLevel(int log_level) +{ + int syslog_log_level = 0; + + switch (log_level) { + case SC_LOG_EMERGENCY: + syslog_log_level = LOG_EMERG; + case SC_LOG_ALERT: + syslog_log_level = LOG_ALERT; + case SC_LOG_CRITICAL: + syslog_log_level = LOG_CRIT; + case SC_LOG_ERROR: + syslog_log_level = LOG_ERR; + case SC_LOG_WARNING: + syslog_log_level = LOG_WARNING; + case SC_LOG_NOTICE: + syslog_log_level = LOG_NOTICE; + case SC_LOG_INFO: + syslog_log_level = LOG_INFO; + case SC_LOG_DEBUG: + syslog_log_level = LOG_DEBUG; + default: + syslog_log_level = LOG_EMERG; + } + + return syslog_log_level; +} + +/** + * \brief Output function that logs a character string out to a file descriptor + * + * \param fd Pointer to the file descriptor + * \param msg Pointer to the character string that should be logged + */ +static inline void SCLogPrintToStream(FILE *fd, char *msg) +{ + if (fprintf(fd, "%s", msg) < 0) + printf("Error writing to stream using fprintf\n"); + + fflush(fd); + return; +} + +/** + * \brief Output function that logs a character string throught the syslog iface + * + * \param syslog_log_level Holds the syslog_log_level that the message should be + * logged as + * \param msg Pointer to the char string, that should be logged + * + * \todo syslog is thread-safe according to POSIX manual and glibc code, but we + * we will have to look into non POSIX compliant boxes like freeBSD + */ +static inline void SCLogPrintToSyslog(int syslog_log_level, const char *msg) +{ + //static struct syslog_data data = SYSLOG_DATA_INIT; + //syslog_r(syslog_log_level, NULL, "%s", msg); + + syslog(syslog_log_level, "%s", msg); + + return; +} + + #endif /* __UTIL_DEBUG_H__ */ diff --git a/src/util-mpm-b2g-cuda.c b/src/util-mpm-b2g-cuda.c index ff8dc3a..b70a147 100644 --- a/src/util-mpm-b2g-cuda.c +++ b/src/util-mpm-b2g-cuda.c @@ -74,12 +74,6 @@ int B2gCudaAddPatternCS(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid); int B2gCudaPreparePatterns(MpmCtx *mpm_ctx); -inline uint32_t B2gCudaScanWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, - PatternMatcherQueue *, uint8_t *buf, - uint16_t buflen); -inline uint32_t B2gCudaSearchWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, - PatternMatcherQueue *, uint8_t *buf, - uint16_t buflen); uint32_t B2gCudaScan1(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen); @@ -484,48 +478,6 @@ void MpmB2gCudaRegister(void) mpm_table[MPM_B2G_CUDA].RegisterUnittests = B2gCudaRegisterTests; } -static inline void B2gCudaEndMatchAppend(MpmCtx *mpm_ctx, B2gCudaPattern *p, - uint16_t offset, uint16_t depth, - uint32_t pid, uint32_t sid, - uint8_t nosearch) -{ - MpmEndMatch *em = MpmAllocEndMatch(mpm_ctx); - if (em == NULL) { - SCLogDebug("ERROR: B2gAllocEndMatch failed"); - return; - } - - SCLogDebug("em alloced at %p", em); - - em->id = pid; - em->sig_id = sid; - em->depth = depth; - em->offset = offset; - - if (nosearch) - em->flags |= MPM_ENDMATCH_NOSEARCH; - - if (p->em == NULL) { - p->em = em; - SCLogDebug("m %p m->sig_id %"PRIu32"", em, em->sig_id); - return; - } - - MpmEndMatch *m = p->em; - while (m->next) - m = m->next; - m->next = em; - - m = p->em; - SCLogDebug("m %p m->sig_id %" PRIu32, m, m->sig_id); - while (m->next) { - m = m->next; - SCLogDebug("m %p m->sig_id %" PRIu32, m, m->sig_id); - } - - return; -} - void B2gCudaPrintInfo(MpmCtx *mpm_ctx) { B2gCudaCtx *ctx = (B2gCudaCtx *)mpm_ctx->ctx; @@ -548,36 +500,6 @@ void B2gCudaPrintInfo(MpmCtx *mpm_ctx) return; } -static inline B2gCudaPattern *B2gCudaAllocPattern(MpmCtx *mpm_ctx) -{ - B2gCudaPattern *p = SCMalloc(sizeof(B2gCudaPattern)); - if (p == NULL) { - printf("ERROR: B2gAllocPattern: malloc failed\n"); - exit(EXIT_FAILURE); - } - memset(p, 0, sizeof(B2gCudaPattern)); - - mpm_ctx->memory_cnt++; - mpm_ctx->memory_size += sizeof(B2gCudaPattern); - - return p; -} - -static inline B2gCudaHashItem *B2gCudaAllocHashItem(MpmCtx *mpm_ctx) -{ - B2gCudaHashItem *hi = SCMalloc(sizeof(B2gCudaHashItem)); - if (hi == NULL) { - printf("ERROR: B2gCudaAllocHashItem: malloc failed\n"); - exit(EXIT_FAILURE); - } - memset(hi, 0, sizeof(B2gCudaHashItem)); - - mpm_ctx->memory_cnt++; - mpm_ctx->memory_size += sizeof(B2gCudaHashItem); - - return hi; -} - static void B2gCudaHashFree(MpmCtx *mpm_ctx, B2gCudaHashItem *hi) { if (hi == NULL) @@ -593,93 +515,6 @@ static void B2gCudaHashFree(MpmCtx *mpm_ctx, B2gCudaHashItem *hi) return; } -static inline void memcpy_tolower(uint8_t *d, uint8_t *s, uint16_t len) -{ - uint16_t i; - for (i = 0; i < len; i++) - d[i] = u8_tolower(s[i]); - - return; -} - -static inline uint32_t B2gCudaInitHash(B2gCudaPattern *p) -{ - uint32_t hash = p->len * p->cs[0]; - if (p->len > 1) - hash += p->cs[1]; - - return (hash % INIT_HASH_SIZE); -} - -static inline uint32_t B2gCudaInitHashRaw(uint8_t *pat, uint16_t patlen) -{ - uint32_t hash = patlen * pat[0]; - if (patlen > 1) - hash += pat[1]; - - return (hash % INIT_HASH_SIZE); -} - -static inline int B2gCudaInitHashAdd(B2gCudaCtx *ctx, B2gCudaPattern *p) -{ - uint32_t hash = B2gCudaInitHash(p); - - if (ctx->init_hash[hash] == NULL) { - ctx->init_hash[hash] = p; - return 0; - } - - B2gCudaPattern *tt = NULL; - B2gCudaPattern *t = ctx->init_hash[hash]; - - /* get the list tail */ - do { - tt = t; - t = t->next; - } while (t != NULL); - - tt->next = p; - - return 0; -} - -static inline int B2gCudaCmpPattern(B2gCudaPattern *p, uint8_t *pat, - uint16_t patlen, char nocase); - -static inline B2gCudaPattern *B2gCudaInitHashLookup(B2gCudaCtx *ctx, uint8_t *pat, - uint16_t patlen, char nocase) -{ - uint32_t hash = B2gCudaInitHashRaw(pat, patlen); - - if (ctx->init_hash[hash] == NULL) - return NULL; - - B2gCudaPattern *t = ctx->init_hash[hash]; - for ( ; t != NULL; t = t->next) { - if (B2gCudaCmpPattern(t, pat, patlen, nocase) == 1) - return t; - } - - return NULL; -} - -static inline int B2gCudaCmpPattern(B2gCudaPattern *p, uint8_t *pat, - uint16_t patlen, char nocase) -{ - if (p->len != patlen) - return 0; - - if (!((nocase && p->flags & B2G_CUDA_NOCASE) || - (!nocase && !(p->flags & B2G_CUDA_NOCASE)))) { - return 0; - } - - if (memcmp(p->cs, pat, patlen) != 0) - return 0; - - return 1; -} - void B2gCudaFreePattern(MpmCtx *mpm_ctx, B2gCudaPattern *p) { if (p && p->em) @@ -706,119 +541,6 @@ void B2gCudaFreePattern(MpmCtx *mpm_ctx, B2gCudaPattern *p) return; } -static inline int B2gCudaAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, - uint16_t patlen, uint16_t offset, - uint16_t depth, char nocase, char scan, - uint32_t pid, uint32_t sid, - uint8_t nosearch) -{ - B2gCudaCtx *ctx = (B2gCudaCtx *)mpm_ctx->ctx; - - SCLogDebug("ctx %p len %"PRIu16" pid %" PRIu32 ", nocase %s", - ctx, patlen, pid, nocase ? "true" : "false"); - - if (patlen == 0) - return 0; - - /* get a memory piece */ - B2gCudaPattern *p = B2gCudaInitHashLookup(ctx, pat, patlen, nocase); - if (p == NULL) { - SCLogDebug("allocing new pattern"); - - p = B2gCudaAllocPattern(mpm_ctx); - if (p == NULL) - goto error; - - p->len = patlen; - - if (nocase) - p->flags |= B2G_CUDA_NOCASE; - - /* setup the case insensitive part of the pattern */ - p->ci = SCMalloc(patlen); - if (p->ci == NULL) - goto error; - mpm_ctx->memory_cnt++; - mpm_ctx->memory_size += patlen; - memcpy_tolower(p->ci, pat, patlen); - - /* setup the case sensitive part of the pattern */ - if (p->flags & B2G_CUDA_NOCASE) { - /* nocase means no difference between cs and ci */ - p->cs = p->ci; - } else { - if (memcmp(p->ci,pat,p->len) == 0) { - /* no diff between cs and ci: pat is lowercase */ - p->cs = p->ci; - } else { - p->cs = SCMalloc(patlen); - if (p->cs == NULL) - goto error; - mpm_ctx->memory_cnt++; - mpm_ctx->memory_size += patlen; - memcpy(p->cs, pat, patlen); - } - } - - /* put in the pattern hash */ - B2gCudaInitHashAdd(ctx, p); - - if (mpm_ctx->pattern_cnt == 65535) { - printf("Max search words reached\n"); - exit(1); - } - if (scan) - mpm_ctx->scan_pattern_cnt++; - mpm_ctx->pattern_cnt++; - - if (scan) { /* SCAN */ - if (mpm_ctx->scan_maxlen < patlen) - mpm_ctx->scan_maxlen = patlen; - - if (mpm_ctx->scan_minlen == 0) - mpm_ctx->scan_minlen = patlen; - else if (mpm_ctx->scan_minlen > patlen) - mpm_ctx->scan_minlen = patlen; - - p->flags |= B2G_CUDA_SCAN; - } else { /* SEARCH */ - if (mpm_ctx->search_maxlen < patlen) - mpm_ctx->search_maxlen = patlen; - - if (mpm_ctx->search_minlen == 0) - mpm_ctx->search_minlen = patlen; - else if (mpm_ctx->search_minlen > patlen) - mpm_ctx->search_minlen = patlen; - } - } else { - /* if we're reusing a pattern, check we need to check that it is a - * scan pattern if that is what we're adding. If so we set the pattern - * to be a scan pattern. */ - if (scan) { - p->flags |= B2G_CUDA_SCAN; - - if (mpm_ctx->scan_maxlen < patlen) - mpm_ctx->scan_maxlen = patlen; - - if (mpm_ctx->scan_minlen == 0) - mpm_ctx->scan_minlen = patlen; - else if (mpm_ctx->scan_minlen > patlen) - mpm_ctx->scan_minlen = patlen; - } - } - - /* we need a match */ - B2gCudaEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch); - - mpm_ctx->total_pattern_cnt++; - - return 0; - -error: - B2gCudaFreePattern(mpm_ctx, p); - return -1; -} - int B2gCudaAddScanPatternCI(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid, uint8_t nosearch) @@ -851,23 +573,6 @@ int B2gCudaAddPatternCS(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, /* scan */0, pid, sid, 0); } -static inline uint32_t B2gCudaBloomHash(void *data, uint16_t datalen, uint8_t iter, - uint32_t hash_size) -{ - uint8_t *d = (uint8_t *)data; - uint16_t i; - uint32_t hash = (uint32_t)u8_tolower(*d); - - for (i = 1; i < datalen; i++) { - d++; - hash += (u8_tolower(*d)) ^ i; - } - hash <<= (iter+1); - hash %= hash_size; - - return hash; -} - static void B2gCudaPrepareScanHash(MpmCtx *mpm_ctx) { B2gCudaCtx *ctx = (B2gCudaCtx *)mpm_ctx->ctx; @@ -1411,21 +1116,6 @@ void B2gCudaPrintSearchStats(MpmThreadCtx *mpm_thread_ctx) return; } -static inline int memcmp_lowercase(uint8_t *s1, uint8_t *s2, uint16_t n) -{ - size_t i; - - /* check backwards because we already tested the first - * 2 to 4 chars. This way we are more likely to detect - * a miss and thus speed up a little... */ - for (i = n - 1; i; i--) { - if (u8_tolower(*(s2+i)) != s1[i]) - return 1; - } - - return 0; -} - void B2gCudaInitCtx(MpmCtx *mpm_ctx, int module_handle) { SCLogDebug("mpm_ctx %p, ctx %p", mpm_ctx, mpm_ctx->ctx); @@ -1718,22 +1408,6 @@ void B2gCudaThreadDestroyCtx(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx) return; } -inline uint32_t B2gCudaScanWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, - PatternMatcherQueue *pmq, uint8_t *buf, - uint16_t buflen) -{ - B2gCudaCtx *ctx = (B2gCudaCtx *)mpm_ctx->ctx; - return ctx ? ctx->Scan(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen) : 0; -} - -inline uint32_t B2gCudaSearchWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, - PatternMatcherQueue *pmq, uint8_t *buf, - uint16_t buflen) -{ - B2gCudaCtx *ctx = (B2gCudaCtx *)mpm_ctx->ctx; - return ctx ? ctx->Search(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen) : 0; -} - uint32_t B2gCudaScanBNDMq(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) diff --git a/src/util-mpm-b2g-cuda.h b/src/util-mpm-b2g-cuda.h index 0d832f3..c04322c 100644 --- a/src/util-mpm-b2g-cuda.h +++ b/src/util-mpm-b2g-cuda.h @@ -156,5 +156,326 @@ void B2gCudaKillDispatcherThreadAPC(void); void B2gCudaPushPacketTo_tv_CMB2_RC(Packet *); void B2gCudaPushPacketTo_tv_CMB2_APC(Packet *); +/** ---- Inline functions ---- */ + +static inline uint32_t B2gCudaScanWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, + PatternMatcherQueue *, uint8_t *buf, + uint16_t buflen); +static inline uint32_t B2gCudaSearchWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, + PatternMatcherQueue *, uint8_t *buf, + uint16_t buflen); + +static inline void B2gCudaEndMatchAppend(MpmCtx *mpm_ctx, B2gCudaPattern *p, + uint16_t offset, uint16_t depth, + uint32_t pid, uint32_t sid, + uint8_t nosearch) +{ + MpmEndMatch *em = MpmAllocEndMatch(mpm_ctx); + if (em == NULL) { + SCLogDebug("ERROR: B2gAllocEndMatch failed"); + return; + } + + SCLogDebug("em alloced at %p", em); + + em->id = pid; + em->sig_id = sid; + em->depth = depth; + em->offset = offset; + + if (nosearch) + em->flags |= MPM_ENDMATCH_NOSEARCH; + + if (p->em == NULL) { + p->em = em; + SCLogDebug("m %p m->sig_id %"PRIu32"", em, em->sig_id); + return; + } + + MpmEndMatch *m = p->em; + while (m->next) + m = m->next; + m->next = em; + + m = p->em; + SCLogDebug("m %p m->sig_id %" PRIu32, m, m->sig_id); + while (m->next) { + m = m->next; + SCLogDebug("m %p m->sig_id %" PRIu32, m, m->sig_id); + } + + return; +} + +static inline B2gCudaPattern *B2gCudaAllocPattern(MpmCtx *mpm_ctx) +{ + B2gCudaPattern *p = SCMalloc(sizeof(B2gCudaPattern)); + if (p == NULL) { + printf("ERROR: B2gAllocPattern: malloc failed\n"); + exit(EXIT_FAILURE); + } + memset(p, 0, sizeof(B2gCudaPattern)); + + mpm_ctx->memory_cnt++; + mpm_ctx->memory_size += sizeof(B2gCudaPattern); + + return p; +} + +static inline B2gCudaHashItem *B2gCudaAllocHashItem(MpmCtx *mpm_ctx) +{ + B2gCudaHashItem *hi = SCMalloc(sizeof(B2gCudaHashItem)); + if (hi == NULL) { + printf("ERROR: B2gCudaAllocHashItem: malloc failed\n"); + exit(EXIT_FAILURE); + } + memset(hi, 0, sizeof(B2gCudaHashItem)); + + mpm_ctx->memory_cnt++; + mpm_ctx->memory_size += sizeof(B2gCudaHashItem); + + return hi; +} + +static inline uint32_t B2gCudaInitHash(B2gCudaPattern *p) +{ + uint32_t hash = p->len * p->cs[0]; + if (p->len > 1) + hash += p->cs[1]; + + return (hash % INIT_HASH_SIZE); +} + +static inline uint32_t B2gCudaInitHashRaw(uint8_t *pat, uint16_t patlen) +{ + uint32_t hash = patlen * pat[0]; + if (patlen > 1) + hash += pat[1]; + + return (hash % INIT_HASH_SIZE); +} + +static inline int B2gCudaInitHashAdd(B2gCudaCtx *ctx, B2gCudaPattern *p) +{ + uint32_t hash = B2gCudaInitHash(p); + + if (ctx->init_hash[hash] == NULL) { + ctx->init_hash[hash] = p; + return 0; + } + + B2gCudaPattern *tt = NULL; + B2gCudaPattern *t = ctx->init_hash[hash]; + + /* get the list tail */ + do { + tt = t; + t = t->next; + } while (t != NULL); + + tt->next = p; + + return 0; +} + +static inline int B2gCudaCmpPattern(B2gCudaPattern *p, uint8_t *pat, + uint16_t patlen, char nocase); + +static inline B2gCudaPattern *B2gCudaInitHashLookup(B2gCudaCtx *ctx, uint8_t *pat, + uint16_t patlen, char nocase) +{ + uint32_t hash = B2gCudaInitHashRaw(pat, patlen); + + if (ctx->init_hash[hash] == NULL) + return NULL; + + B2gCudaPattern *t = ctx->init_hash[hash]; + for ( ; t != NULL; t = t->next) { + if (B2gCudaCmpPattern(t, pat, patlen, nocase) == 1) + return t; + } + + return NULL; +} + +static inline int B2gCudaCmpPattern(B2gCudaPattern *p, uint8_t *pat, + uint16_t patlen, char nocase) +{ + if (p->len != patlen) + return 0; + + if (!((nocase && p->flags & B2G_CUDA_NOCASE) || + (!nocase && !(p->flags & B2G_CUDA_NOCASE)))) { + return 0; + } + + if (memcmp(p->cs, pat, patlen) != 0) + return 0; + + return 1; +} + +static inline int B2gCudaAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, + uint16_t patlen, uint16_t offset, + uint16_t depth, char nocase, char scan, + uint32_t pid, uint32_t sid, + uint8_t nosearch) +{ + B2gCudaCtx *ctx = (B2gCudaCtx *)mpm_ctx->ctx; + + SCLogDebug("ctx %p len %"PRIu16" pid %" PRIu32 ", nocase %s", + ctx, patlen, pid, nocase ? "true" : "false"); + + if (patlen == 0) + return 0; + + /* get a memory piece */ + B2gCudaPattern *p = B2gCudaInitHashLookup(ctx, pat, patlen, nocase); + if (p == NULL) { + SCLogDebug("allocing new pattern"); + + p = B2gCudaAllocPattern(mpm_ctx); + if (p == NULL) + goto error; + + p->len = patlen; + + if (nocase) + p->flags |= B2G_CUDA_NOCASE; + + /* setup the case insensitive part of the pattern */ + p->ci = SCMalloc(patlen); + if (p->ci == NULL) + goto error; + mpm_ctx->memory_cnt++; + mpm_ctx->memory_size += patlen; + memcpy_tolower(p->ci, pat, patlen); + + /* setup the case sensitive part of the pattern */ + if (p->flags & B2G_CUDA_NOCASE) { + /* nocase means no difference between cs and ci */ + p->cs = p->ci; + } else { + if (memcmp(p->ci,pat,p->len) == 0) { + /* no diff between cs and ci: pat is lowercase */ + p->cs = p->ci; + } else { + p->cs = SCMalloc(patlen); + if (p->cs == NULL) + goto error; + mpm_ctx->memory_cnt++; + mpm_ctx->memory_size += patlen; + memcpy(p->cs, pat, patlen); + } + } + + /* put in the pattern hash */ + B2gCudaInitHashAdd(ctx, p); + + if (mpm_ctx->pattern_cnt == 65535) { + printf("Max search words reached\n"); + exit(1); + } + if (scan) + mpm_ctx->scan_pattern_cnt++; + mpm_ctx->pattern_cnt++; + + if (scan) { /* SCAN */ + if (mpm_ctx->scan_maxlen < patlen) + mpm_ctx->scan_maxlen = patlen; + + if (mpm_ctx->scan_minlen == 0) + mpm_ctx->scan_minlen = patlen; + else if (mpm_ctx->scan_minlen > patlen) + mpm_ctx->scan_minlen = patlen; + + p->flags |= B2G_CUDA_SCAN; + } else { /* SEARCH */ + if (mpm_ctx->search_maxlen < patlen) + mpm_ctx->search_maxlen = patlen; + + if (mpm_ctx->search_minlen == 0) + mpm_ctx->search_minlen = patlen; + else if (mpm_ctx->search_minlen > patlen) + mpm_ctx->search_minlen = patlen; + } + } else { + /* if we're reusing a pattern, check we need to check that it is a + * scan pattern if that is what we're adding. If so we set the pattern + * to be a scan pattern. */ + if (scan) { + p->flags |= B2G_CUDA_SCAN; + + if (mpm_ctx->scan_maxlen < patlen) + mpm_ctx->scan_maxlen = patlen; + + if (mpm_ctx->scan_minlen == 0) + mpm_ctx->scan_minlen = patlen; + else if (mpm_ctx->scan_minlen > patlen) + mpm_ctx->scan_minlen = patlen; + } + } + + /* we need a match */ + B2gCudaEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch); + + mpm_ctx->total_pattern_cnt++; + + return 0; + +error: + B2gCudaFreePattern(mpm_ctx, p); + return -1; +} + +static inline uint32_t B2gCudaBloomHash(void *data, uint16_t datalen, uint8_t iter, + uint32_t hash_size) +{ + uint8_t *d = (uint8_t *)data; + uint16_t i; + uint32_t hash = (uint32_t)u8_tolower(*d); + + for (i = 1; i < datalen; i++) { + d++; + hash += (u8_tolower(*d)) ^ i; + } + hash <<= (iter+1); + hash %= hash_size; + + return hash; +} + +static inline int memcmp_lowercase(uint8_t *s1, uint8_t *s2, uint16_t n) +{ + size_t i; + + /* check backwards because we already tested the first + * 2 to 4 chars. This way we are more likely to detect + * a miss and thus speed up a little... */ + for (i = n - 1; i; i--) { + if (u8_tolower(*(s2+i)) != s1[i]) + return 1; + } + + return 0; +} + +static inline uint32_t B2gCudaScanWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, + PatternMatcherQueue *pmq, uint8_t *buf, + uint16_t buflen) +{ + B2gCudaCtx *ctx = (B2gCudaCtx *)mpm_ctx->ctx; + return ctx ? ctx->Scan(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen) : 0; +} + +static inline uint32_t B2gCudaSearchWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, + PatternMatcherQueue *pmq, uint8_t *buf, + uint16_t buflen) +{ + B2gCudaCtx *ctx = (B2gCudaCtx *)mpm_ctx->ctx; + return ctx ? ctx->Search(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen) : 0; +} + + #endif /* __SC_CUDA_SUPPORT__ */ #endif /* __UTIL_MPM_B2G_CUDA_H__ */ diff --git a/src/util-mpm-b2g.c b/src/util-mpm-b2g.c index d551535..da9f1d1 100644 --- a/src/util-mpm-b2g.c +++ b/src/util-mpm-b2g.c @@ -48,8 +48,6 @@ int B2gAddScanPatternCS(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, uint3 int B2gAddPatternCI(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid); int B2gAddPatternCS(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid); int B2gPreparePatterns(MpmCtx *mpm_ctx); -inline uint32_t B2gScanWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen); -inline uint32_t B2gSearchWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen); uint32_t B2gScan1(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen); #ifdef B2G_SCAN2 uint32_t B2gScan2(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen); @@ -83,51 +81,6 @@ void MpmB2gRegister (void) { mpm_table[MPM_B2G].RegisterUnittests = B2gRegisterTests; } -/* append an endmatch to a pattern - * - * Only used in the initialization phase */ -static inline void B2gEndMatchAppend(MpmCtx *mpm_ctx, B2gPattern *p, - uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid, - uint8_t nosearch) -{ - SCLogDebug("pid %"PRIu32", sid %"PRIu32"", pid, sid); - - MpmEndMatch *em = MpmAllocEndMatch(mpm_ctx); - if (em == NULL) { - printf("ERROR: B2gAllocEndMatch failed\n"); - return; - } - - SCLogDebug("em alloced at %p", em); - - em->id = pid; - em->sig_id = sid; - em->depth = depth; - em->offset = offset; - - if (nosearch) - em->flags |= MPM_ENDMATCH_NOSEARCH; - - if (p->em == NULL) { - p->em = em; - SCLogDebug("m %p m->sig_id %"PRIu32"", em, em->sig_id); - return; - } - - MpmEndMatch *m = p->em; - while (m->next) { - m = m->next; - } - m->next = em; - - m = p->em; - SCLogDebug("m %p m->sig_id %"PRIu32"", m, m->sig_id); - while (m->next) { - m = m->next; - SCLogDebug("m %p m->sig_id %"PRIu32"", m, m->sig_id); - } -} - #ifdef PRINTMATCH static void prt (uint8_t *buf, uint16_t buflen) { uint16_t i; @@ -160,33 +113,6 @@ void B2gPrintInfo(MpmCtx *mpm_ctx) { printf("\n"); } -static inline B2gPattern *B2gAllocPattern(MpmCtx *mpm_ctx) { - B2gPattern *p = SCMalloc(sizeof(B2gPattern)); - if (p == NULL) { - printf("ERROR: B2gAllocPattern: SCMalloc failed\n"); - exit(EXIT_FAILURE); - } - memset(p,0,sizeof(B2gPattern)); - - mpm_ctx->memory_cnt++; - mpm_ctx->memory_size += sizeof(B2gPattern); - return p; -} - -static inline B2gHashItem * -B2gAllocHashItem(MpmCtx *mpm_ctx) { - B2gHashItem *hi = SCMalloc(sizeof(B2gHashItem)); - if (hi == NULL) { - printf("ERROR: B2gAllocHashItem: SCMalloc failed\n"); - exit(EXIT_FAILURE); - } - memset(hi,0,sizeof(B2gHashItem)); - - mpm_ctx->memory_cnt++; - mpm_ctx->memory_size += sizeof(B2gHashItem); - return hi; -} - static void B2gHashFree(MpmCtx *mpm_ctx, B2gHashItem *hi) { if (hi == NULL) return; @@ -199,91 +125,6 @@ static void B2gHashFree(MpmCtx *mpm_ctx, B2gHashItem *hi) { SCFree(hi); } -static inline void memcpy_tolower(uint8_t *d, uint8_t *s, uint16_t len) { - uint16_t i; - for (i = 0; i < len; i++) { - d[i] = u8_tolower(s[i]); - } -} - -/* - * INIT HASH START - */ -static inline uint32_t B2gInitHash(B2gPattern *p) { - uint32_t hash = p->len * p->cs[0]; - if (p->len > 1) - hash += p->cs[1]; - - return (hash % INIT_HASH_SIZE); -} - -static inline uint32_t B2gInitHashRaw(uint8_t *pat, uint16_t patlen) { - uint32_t hash = patlen * pat[0]; - if (patlen > 1) - hash += pat[1]; - - return (hash % INIT_HASH_SIZE); -} - -static inline int B2gInitHashAdd(B2gCtx *ctx, B2gPattern *p) { - uint32_t hash = B2gInitHash(p); - - //printf("B2gInitHashAdd: %" PRIu32 "\n", hash); - - if (ctx->init_hash[hash] == NULL) { - ctx->init_hash[hash] = p; - //printf("B2gInitHashAdd: hash %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]); - return 0; - } - - B2gPattern *tt = NULL; - B2gPattern *t = ctx->init_hash[hash]; - - /* get the list tail */ - do { - tt = t; - t = t->next; - } while (t != NULL); - - tt->next = p; - - //printf("B2gInitHashAdd: hash %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]); - return 0; -} - -static inline int B2gCmpPattern(B2gPattern *p, uint8_t *pat, uint16_t patlen, char nocase); - -static inline B2gPattern *B2gInitHashLookup(B2gCtx *ctx, uint8_t *pat, uint16_t patlen, char nocase) { - uint32_t hash = B2gInitHashRaw(pat,patlen); - - //printf("B2gInitHashLookup: %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]); - - if (ctx->init_hash[hash] == NULL) { - return NULL; - } - - B2gPattern *t = ctx->init_hash[hash]; - for ( ; t != NULL; t = t->next) { - if (B2gCmpPattern(t,pat,patlen,nocase) == 1) - return t; - } - - return NULL; -} - -static inline int B2gCmpPattern(B2gPattern *p, uint8_t *pat, uint16_t patlen, char nocase) { - if (p->len != patlen) - return 0; - - if (!((nocase && p->flags & B2G_NOCASE) || (!nocase && !(p->flags & B2G_NOCASE)))) - return 0; - - if (memcmp(p->cs, pat, patlen) != 0) - return 0; - - return 1; -} - /* * INIT HASH END */ @@ -312,112 +153,6 @@ void B2gFreePattern(MpmCtx *mpm_ctx, B2gPattern *p) { } } -/* B2gAddPattern - * - * pat: ptr to the pattern - * patlen: length of the pattern - * nocase: nocase flag: 1 enabled, 0 disable - * pid: pattern id - * sid: signature id (internal id) - */ -static inline int B2gAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, char nocase, char scan, uint32_t pid, uint32_t sid, uint8_t nosearch) { - B2gCtx *ctx = (B2gCtx *)mpm_ctx->ctx; - - SCLogDebug("ctx %p len %"PRIu16" pid %" PRIu32 ", nocase %s", ctx, patlen, pid, nocase ? "true" : "false"); - - if (patlen == 0) - return 0; - - /* get a memory piece */ - B2gPattern *p = B2gInitHashLookup(ctx, pat, patlen, nocase); - if (p == NULL) { - SCLogDebug("allocing new pattern"); - - p = B2gAllocPattern(mpm_ctx); - if (p == NULL) - goto error; - - p->len = patlen; - - if (nocase) p->flags |= B2G_NOCASE; - - /* setup the case insensitive part of the pattern */ - p->ci = SCMalloc(patlen); - if (p->ci == NULL) goto error; - mpm_ctx->memory_cnt++; - mpm_ctx->memory_size += patlen; - memcpy_tolower(p->ci, pat, patlen); - - /* setup the case sensitive part of the pattern */ - if (p->flags & B2G_NOCASE) { - /* nocase means no difference between cs and ci */ - p->cs = p->ci; - } else { - if (memcmp(p->ci,pat,p->len) == 0) { - /* no diff between cs and ci: pat is lowercase */ - p->cs = p->ci; - } else { - p->cs = SCMalloc(patlen); - if (p->cs == NULL) goto error; - mpm_ctx->memory_cnt++; - mpm_ctx->memory_size += patlen; - memcpy(p->cs, pat, patlen); - } - } - - //printf("B2gAddPattern: ci \""); prt(p->ci,p->len); - //printf("\" cs \""); prt(p->cs,p->len); - //printf("\"\n"); - - /* put in the pattern hash */ - B2gInitHashAdd(ctx, p); - - if (mpm_ctx->pattern_cnt == 65535) { - printf("Max search words reached\n"); - exit(1); - } - if (scan) mpm_ctx->scan_pattern_cnt++; - mpm_ctx->pattern_cnt++; - - if (scan) { /* SCAN */ - if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen; - if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen; - else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen; - p->flags |= B2G_SCAN; - } else { /* SEARCH */ - if (mpm_ctx->search_maxlen < patlen) mpm_ctx->search_maxlen = patlen; - if (mpm_ctx->search_minlen == 0) mpm_ctx->search_minlen = patlen; - else if (mpm_ctx->search_minlen > patlen) mpm_ctx->search_minlen = patlen; - } - } else { - /* if we're reusing a pattern, check we need to check that it is a - * scan pattern if that is what we're adding. If so we set the pattern - * to be a scan pattern. */ - - //printf("reusing B2gAddPattern: ci \""); prt(p->ci,p->len); - //printf("\" cs \""); prt(p->cs,p->len); - //printf("\"\n"); - - if (scan) { - p->flags |= B2G_SCAN; - - if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen; - if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen; - else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen; - } - } - - /* we need a match */ - B2gEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch); - - mpm_ctx->total_pattern_cnt++; - return 0; - -error: - B2gFreePattern(mpm_ctx, p); - return -1; -} - int B2gAddScanPatternCI(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid, uint8_t nosearch) { @@ -442,21 +177,6 @@ int B2gAddPatternCS(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, return B2gAddPattern(mpm_ctx, pat, patlen, offset, depth, /* nocase */0, /* scan */0, pid, sid, 0); } -static inline uint32_t B2gBloomHash(void *data, uint16_t datalen, uint8_t iter, uint32_t hash_size) { - uint8_t *d = (uint8_t *)data; - uint16_t i; - uint32_t hash = (uint32_t)u8_tolower(*d); - - for (i = 1; i < datalen; i++) { - d++; - hash += (u8_tolower(*d)) ^ i; - } - hash <<= (iter+1); - - hash %= hash_size; - return hash; -} - static void B2gPrepareScanHash(MpmCtx *mpm_ctx) { B2gCtx *ctx = (B2gCtx *)mpm_ctx->ctx; uint16_t i; @@ -909,21 +629,6 @@ void B2gPrintSearchStats(MpmThreadCtx *mpm_thread_ctx) { #endif /* B2G_COUNTERS */ } -static inline int -memcmp_lowercase(uint8_t *s1, uint8_t *s2, uint16_t n) { - size_t i; - - /* check backwards because we already tested the first - * 2 to 4 chars. This way we are more likely to detect - * a miss and thus speed up a little... */ - for (i = n - 1; i; i--) { - if (u8_tolower(*(s2+i)) != s1[i]) - return 1; - } - - return 0; -} - /** * \brief Function to get the user defined values for b2g algorithm from the * config file 'suricata.yaml' @@ -1195,16 +900,6 @@ void B2gThreadDestroyCtx(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx) { MpmMatchFreeSpares(mpm_thread_ctx, mpm_thread_ctx->qlist); } -inline uint32_t B2gScanWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) { - B2gCtx *ctx = (B2gCtx *)mpm_ctx->ctx; - return ctx ? ctx->Scan(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen) : 0; -} - -inline uint32_t B2gSearchWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) { - B2gCtx *ctx = (B2gCtx *)mpm_ctx->ctx; - return ctx ? ctx->Search(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen) : 0; -} - uint32_t B2gScanBNDMq(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) { B2gCtx *ctx = (B2gCtx *)mpm_ctx->ctx; #ifdef B2G_COUNTERS diff --git a/src/util-mpm-b2g.h b/src/util-mpm-b2g.h index c1a5520..b114482 100644 --- a/src/util-mpm-b2g.h +++ b/src/util-mpm-b2g.h @@ -3,6 +3,8 @@ #include "util-mpm.h" #include "util-bloomfilter.h" +#include "suricata-common.h" +#include "suricata.h" #define B2G_NOCASE 0x01 #define B2G_SCAN 0x02 @@ -23,6 +25,8 @@ //#define B2G_WORD_SIZE 16 //#define B2G_WORD_SIZE 8 +#define INIT_HASH_SIZE 65536 + #define B2G_HASH16(a,b) (((a)<id = pid; + em->sig_id = sid; + em->depth = depth; + em->offset = offset; + + if (nosearch) + em->flags |= MPM_ENDMATCH_NOSEARCH; + + if (p->em == NULL) { + p->em = em; + SCLogDebug("m %p m->sig_id %"PRIu32"", em, em->sig_id); + return; + } + + MpmEndMatch *m = p->em; + while (m->next) { + m = m->next; + } + m->next = em; + + m = p->em; + SCLogDebug("m %p m->sig_id %"PRIu32"", m, m->sig_id); + while (m->next) { + m = m->next; + SCLogDebug("m %p m->sig_id %"PRIu32"", m, m->sig_id); + } +} + +static inline uint32_t B2gScanWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) { + B2gCtx *ctx = (B2gCtx *)mpm_ctx->ctx; + return ctx ? ctx->Scan(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen) : 0; +} + +static inline uint32_t B2gSearchWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) { + B2gCtx *ctx = (B2gCtx *)mpm_ctx->ctx; + return ctx ? ctx->Search(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen) : 0; +} + +static inline B2gPattern *B2gAllocPattern(MpmCtx *mpm_ctx) { + B2gPattern *p = SCMalloc(sizeof(B2gPattern)); + if (p == NULL) { + printf("ERROR: B2gAllocPattern: SCMalloc failed\n"); + exit(EXIT_FAILURE); + } + memset(p,0,sizeof(B2gPattern)); + + mpm_ctx->memory_cnt++; + mpm_ctx->memory_size += sizeof(B2gPattern); + return p; +} + +static inline B2gHashItem * +B2gAllocHashItem(MpmCtx *mpm_ctx) { + B2gHashItem *hi = SCMalloc(sizeof(B2gHashItem)); + if (hi == NULL) { + printf("ERROR: B2gAllocHashItem: SCMalloc failed\n"); + exit(EXIT_FAILURE); + } + memset(hi,0,sizeof(B2gHashItem)); + + mpm_ctx->memory_cnt++; + mpm_ctx->memory_size += sizeof(B2gHashItem); + return hi; +} + +/* + * INIT HASH START + */ +static inline uint32_t B2gInitHash(B2gPattern *p) { + uint32_t hash = p->len * p->cs[0]; + if (p->len > 1) + hash += p->cs[1]; + + return (hash % INIT_HASH_SIZE); +} + +static inline uint32_t B2gInitHashRaw(uint8_t *pat, uint16_t patlen) { + uint32_t hash = patlen * pat[0]; + if (patlen > 1) + hash += pat[1]; + + return (hash % INIT_HASH_SIZE); +} + +static inline int B2gInitHashAdd(B2gCtx *ctx, B2gPattern *p) { + uint32_t hash = B2gInitHash(p); + + //printf("B2gInitHashAdd: %" PRIu32 "\n", hash); + + if (ctx->init_hash[hash] == NULL) { + ctx->init_hash[hash] = p; + //printf("B2gInitHashAdd: hash %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]); + return 0; + } + + B2gPattern *tt = NULL; + B2gPattern *t = ctx->init_hash[hash]; + + /* get the list tail */ + do { + tt = t; + t = t->next; + } while (t != NULL); + + tt->next = p; + + //printf("B2gInitHashAdd: hash %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]); + return 0; +} + +static inline int B2gCmpPattern(B2gPattern *p, uint8_t *pat, uint16_t patlen, char nocase); + +static inline B2gPattern *B2gInitHashLookup(B2gCtx *ctx, uint8_t *pat, uint16_t patlen, char nocase) { + uint32_t hash = B2gInitHashRaw(pat,patlen); + + //printf("B2gInitHashLookup: %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]); + + if (ctx->init_hash[hash] == NULL) { + return NULL; + } + + B2gPattern *t = ctx->init_hash[hash]; + for ( ; t != NULL; t = t->next) { + if (B2gCmpPattern(t,pat,patlen,nocase) == 1) + return t; + } + + return NULL; +} + +static inline int B2gCmpPattern(B2gPattern *p, uint8_t *pat, uint16_t patlen, char nocase) { + if (p->len != patlen) + return 0; + + if (!((nocase && p->flags & B2G_NOCASE) || (!nocase && !(p->flags & B2G_NOCASE)))) + return 0; + + if (memcmp(p->cs, pat, patlen) != 0) + return 0; + + return 1; +} + +/* B2gAddPattern + * + * pat: ptr to the pattern + * patlen: length of the pattern + * nocase: nocase flag: 1 enabled, 0 disable + * pid: pattern id + * sid: signature id (internal id) + */ +static inline int B2gAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, char nocase, char scan, uint32_t pid, uint32_t sid, uint8_t nosearch) { + B2gCtx *ctx = (B2gCtx *)mpm_ctx->ctx; + + SCLogDebug("ctx %p len %"PRIu16" pid %" PRIu32 ", nocase %s", ctx, patlen, pid, nocase ? "true" : "false"); + + if (patlen == 0) + return 0; + + /* get a memory piece */ + B2gPattern *p = B2gInitHashLookup(ctx, pat, patlen, nocase); + if (p == NULL) { + SCLogDebug("allocing new pattern"); + + p = B2gAllocPattern(mpm_ctx); + if (p == NULL) + goto error; + + p->len = patlen; + + if (nocase) p->flags |= B2G_NOCASE; + + /* setup the case insensitive part of the pattern */ + p->ci = SCMalloc(patlen); + if (p->ci == NULL) goto error; + mpm_ctx->memory_cnt++; + mpm_ctx->memory_size += patlen; + memcpy_tolower(p->ci, pat, patlen); + + /* setup the case sensitive part of the pattern */ + if (p->flags & B2G_NOCASE) { + /* nocase means no difference between cs and ci */ + p->cs = p->ci; + } else { + if (memcmp(p->ci,pat,p->len) == 0) { + /* no diff between cs and ci: pat is lowercase */ + p->cs = p->ci; + } else { + p->cs = SCMalloc(patlen); + if (p->cs == NULL) goto error; + mpm_ctx->memory_cnt++; + mpm_ctx->memory_size += patlen; + memcpy(p->cs, pat, patlen); + } + } + + //printf("B2gAddPattern: ci \""); prt(p->ci,p->len); + //printf("\" cs \""); prt(p->cs,p->len); + //printf("\"\n"); + + /* put in the pattern hash */ + B2gInitHashAdd(ctx, p); + + if (mpm_ctx->pattern_cnt == 65535) { + printf("Max search words reached\n"); + exit(1); + } + if (scan) mpm_ctx->scan_pattern_cnt++; + mpm_ctx->pattern_cnt++; + + if (scan) { /* SCAN */ + if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen; + if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen; + else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen; + p->flags |= B2G_SCAN; + } else { /* SEARCH */ + if (mpm_ctx->search_maxlen < patlen) mpm_ctx->search_maxlen = patlen; + if (mpm_ctx->search_minlen == 0) mpm_ctx->search_minlen = patlen; + else if (mpm_ctx->search_minlen > patlen) mpm_ctx->search_minlen = patlen; + } + } else { + /* if we're reusing a pattern, check we need to check that it is a + * scan pattern if that is what we're adding. If so we set the pattern + * to be a scan pattern. */ + + //printf("reusing B2gAddPattern: ci \""); prt(p->ci,p->len); + //printf("\" cs \""); prt(p->cs,p->len); + //printf("\"\n"); + + if (scan) { + p->flags |= B2G_SCAN; + + if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen; + if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen; + else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen; + } + } + + /* we need a match */ + B2gEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch); + + mpm_ctx->total_pattern_cnt++; + return 0; + +error: + B2gFreePattern(mpm_ctx, p); + return -1; +} + +static inline uint32_t B2gBloomHash(void *data, uint16_t datalen, uint8_t iter, uint32_t hash_size) { + uint8_t *d = (uint8_t *)data; + uint16_t i; + uint32_t hash = (uint32_t)u8_tolower(*d); + + for (i = 1; i < datalen; i++) { + d++; + hash += (u8_tolower(*d)) ^ i; + } + hash <<= (iter+1); + + hash %= hash_size; + return hash; +} + #endif diff --git a/src/util-mpm-b3g.c b/src/util-mpm-b3g.c index 2d532d4..12d046a 100644 --- a/src/util-mpm-b3g.c +++ b/src/util-mpm-b3g.c @@ -20,8 +20,6 @@ #include "conf.h" #include "util-debug.h" -#define INIT_HASH_SIZE 65536 - #ifdef B3G_COUNTERS #define COUNT(counter) \ (counter) @@ -43,8 +41,6 @@ int B3gAddScanPatternCS(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, uint3 int B3gAddPatternCI(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, uint32_t); int B3gAddPatternCS(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, uint32_t); int B3gPreparePatterns(MpmCtx *); -inline uint32_t B3gScanWrap(MpmCtx *, MpmThreadCtx *, PatternMatcherQueue *, uint8_t *, uint16_t); -inline uint32_t B3gSearchWrap(MpmCtx *, MpmThreadCtx *, PatternMatcherQueue *, uint8_t *, uint16_t); uint32_t B3gScan1(MpmCtx *, MpmThreadCtx *, PatternMatcherQueue *, uint8_t *, uint16_t); uint32_t B3gScan2(MpmCtx *, MpmThreadCtx *, PatternMatcherQueue *, uint8_t *, uint16_t); uint32_t B3gScan12(MpmCtx *, MpmThreadCtx *, PatternMatcherQueue *, uint8_t *, uint16_t); @@ -79,39 +75,6 @@ void MpmB3gRegister (void) { mpm_table[MPM_B3G].RegisterUnittests = B3gRegisterTests; } -/* append an endmatch to a pattern - * - * Only used in the initialization phase */ -static inline void B3gEndMatchAppend(MpmCtx *mpm_ctx, B3gPattern *p, - uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid, - uint8_t nosearch) -{ - MpmEndMatch *em = MpmAllocEndMatch(mpm_ctx); - if (em == NULL) { - printf("ERROR: B3gAllocEndMatch failed\n"); - return; - } - - em->id = pid; - em->sig_id = sid; - em->depth = depth; - em->offset = offset; - - if (nosearch) - em->flags |= MPM_ENDMATCH_NOSEARCH; - - if (p->em == NULL) { - p->em = em; - return; - } - - MpmEndMatch *m = p->em; - while (m->next) { - m = m->next; - } - m->next = em; -} - /** \todo XXX Unused??? */ #if 0 static void prt (uint8_t *buf, uint16_t buflen) { @@ -145,33 +108,6 @@ void B3gPrintInfo(MpmCtx *mpm_ctx) { printf("\n"); } -static inline B3gPattern *B3gAllocPattern(MpmCtx *mpm_ctx) { - B3gPattern *p = SCMalloc(sizeof(B3gPattern)); - if (p == NULL) { - printf("ERROR: B3gAllocPattern: SCMalloc failed\n"); - exit(EXIT_FAILURE); - } - memset(p,0,sizeof(B3gPattern)); - - mpm_ctx->memory_cnt++; - mpm_ctx->memory_size += sizeof(B3gPattern); - return p; -} - -static inline B3gHashItem * -B3gAllocHashItem(MpmCtx *mpm_ctx) { - B3gHashItem *hi = SCMalloc(sizeof(B3gHashItem)); - if (hi == NULL) { - printf("ERROR: B3gAllocHashItem: SCMalloc failed\n"); - exit(EXIT_FAILURE); - } - memset(hi,0,sizeof(B3gHashItem)); - - mpm_ctx->memory_cnt++; - mpm_ctx->memory_size += sizeof(B3gHashItem); - return hi; -} - static void B3gHashFree(MpmCtx *mpm_ctx, B3gHashItem *hi) { if (hi == NULL) return; @@ -184,91 +120,6 @@ static void B3gHashFree(MpmCtx *mpm_ctx, B3gHashItem *hi) { SCFree(hi); } -static inline void memcpy_tolower(uint8_t *d, uint8_t *s, uint16_t len) { - uint16_t i; - for (i = 0; i < len; i++) { - d[i] = u8_tolower(s[i]); - } -} - -/* - * INIT HASH START - */ -static inline uint32_t B3gInitHash(B3gPattern *p) { - uint32_t hash = p->len * p->cs[0]; - if (p->len > 1) - hash += p->cs[1]; - - return (hash % INIT_HASH_SIZE); -} - -static inline uint32_t B3gInitHashRaw(uint8_t *pat, uint16_t patlen) { - uint32_t hash = patlen * pat[0]; - if (patlen > 1) - hash += pat[1]; - - return (hash % INIT_HASH_SIZE); -} - -static inline int B3gInitHashAdd(B3gCtx *ctx, B3gPattern *p) { - uint32_t hash = B3gInitHash(p); - - //printf("B3gInitHashAdd: %" PRIu32 "\n", hash); - - if (ctx->init_hash[hash] == NULL) { - ctx->init_hash[hash] = p; - //printf("B3gInitHashAdd: hash %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]); - return 0; - } - - B3gPattern *tt = NULL; - B3gPattern *t = ctx->init_hash[hash]; - - /* get the list tail */ - do { - tt = t; - t = t->next; - } while (t != NULL); - - tt->next = p; - //printf("B3gInitHashAdd: hash %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]); - - return 0; -} - -static inline int B3gCmpPattern(B3gPattern *p, uint8_t *pat, uint16_t patlen, char nocase); - -static inline B3gPattern *B3gInitHashLookup(B3gCtx *ctx, uint8_t *pat, uint16_t patlen, char nocase) { - uint32_t hash = B3gInitHashRaw(pat,patlen); - - //printf("B3gInitHashLookup: %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]); - - if (ctx->init_hash[hash] == NULL) { - return NULL; - } - - B3gPattern *t = ctx->init_hash[hash]; - for ( ; t != NULL; t = t->next) { - if (B3gCmpPattern(t,pat,patlen,nocase) == 1) - return t; - } - - return NULL; -} - -static inline int B3gCmpPattern(B3gPattern *p, uint8_t *pat, uint16_t patlen, char nocase) { - if (p->len != patlen) - return 0; - - if (!((nocase && p->flags & B3G_NOCASE) || (!nocase && !(p->flags & B3G_NOCASE)))) - return 0; - - if (memcmp(p->cs, pat, patlen) != 0) - return 0; - - return 1; -} - /* * INIT HASH END */ @@ -297,107 +148,6 @@ void B3gFreePattern(MpmCtx *mpm_ctx, B3gPattern *p) { } } -/* B3gAddPattern - * - * pat: ptr to the pattern - * patlen: length of the pattern - * nocase: nocase flag: 1 enabled, 0 disable - * pid: pattern id - * sid: signature id (internal id) - */ -static inline int B3gAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, char nocase, char scan, uint32_t pid, uint32_t sid, uint8_t nosearch) { - B3gCtx *ctx = (B3gCtx *)mpm_ctx->ctx; - -// printf("B3gAddPattern: ctx %p \"", mpm_ctx); prt(pat, patlen); -// printf("\" id %" PRIu32 ", nocase %s\n", id, nocase ? "true" : "false"); - - if (patlen == 0) - return 0; - - /* get a memory piece */ - B3gPattern *p = B3gInitHashLookup(ctx, pat, patlen, nocase); - if (p == NULL) { -// printf("B3gAddPattern: allocing new pattern\n"); - p = B3gAllocPattern(mpm_ctx); - if (p == NULL) - goto error; - - p->len = patlen; - - if (nocase) p->flags |= B3G_NOCASE; - - /* setup the case insensitive part of the pattern */ - p->ci = SCMalloc(patlen); - if (p->ci == NULL) goto error; - mpm_ctx->memory_cnt++; - mpm_ctx->memory_size += patlen; - memcpy_tolower(p->ci, pat, patlen); - - /* setup the case sensitive part of the pattern */ - if (p->flags & B3G_NOCASE) { - /* nocase means no difference between cs and ci */ - p->cs = p->ci; - } else { - if (memcmp(p->ci,pat,p->len) == 0) { - /* no diff between cs and ci: pat is lowercase */ - p->cs = p->ci; - } else { - p->cs = SCMalloc(patlen); - if (p->cs == NULL) goto error; - mpm_ctx->memory_cnt++; - mpm_ctx->memory_size += patlen; - memcpy(p->cs, pat, patlen); - } - } - - //printf("B3gAddPattern: ci \""); prt(p->ci,p->len); - //printf("\" cs \""); prt(p->cs,p->len); - //printf("\" prefix_ci %" PRIu32 ", prefix_cs %" PRIu32 "\n", p->prefix_ci, p->prefix_cs); - - /* put in the pattern hash */ - B3gInitHashAdd(ctx, p); - - if (mpm_ctx->pattern_cnt == 65535) { - printf("Max search words reached\n"); - exit(1); - } - if (scan) mpm_ctx->scan_pattern_cnt++; - mpm_ctx->pattern_cnt++; - - if (scan) { /* SCAN */ - if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen; - if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen; - else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen; - p->flags |= B3G_SCAN; - } else { /* SEARCH */ - if (mpm_ctx->search_maxlen < patlen) mpm_ctx->search_maxlen = patlen; - if (mpm_ctx->search_minlen == 0) mpm_ctx->search_minlen = patlen; - else if (mpm_ctx->search_minlen > patlen) mpm_ctx->search_minlen = patlen; - } - } else { - /* if we're reusing a pattern, check we need to check that it is a - * scan pattern if that is what we're adding. If so we set the pattern - * to be a scan pattern. */ - if (scan) { - p->flags |= B3G_SCAN; - - if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen; - if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen; - else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen; - } - } - - /* we need a match */ - B3gEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch); - - mpm_ctx->total_pattern_cnt++; - return 0; - -error: - B3gFreePattern(mpm_ctx, p); - return -1; -} - int B3gAddScanPatternCI(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid, uint8_t nosearch) { @@ -916,21 +666,6 @@ void B3gPrintSearchStats(MpmThreadCtx *mpm_thread_ctx) { #endif /* B3G_COUNTERS */ } -static inline int -memcmp_lowercase(uint8_t *s1, uint8_t *s2, uint16_t n) { - size_t i; - - /* check backwards because we already tested the first - * 2 to 4 chars. This way we are more likely to detect - * a miss and thus speed up a little... */ - for (i = n - 1; i; i--) { - if (u8_tolower(*(s2+i)) != s1[i]) - return 1; - } - - return 0; -} - /** * \brief Function to get the user defined values for b3g algorithm from the * config file 'suricata.yaml' @@ -1221,16 +956,6 @@ void B3gThreadDestroyCtx(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx) { MpmMatchFreeSpares(mpm_thread_ctx, mpm_thread_ctx->qlist); } -inline uint32_t B3gScanWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) { - B3gCtx *ctx = (B3gCtx *)mpm_ctx->ctx; - return ctx->Scan(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen); -} - -inline uint32_t B3gSearchWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) { - B3gCtx *ctx = (B3gCtx *)mpm_ctx->ctx; - return ctx->Search(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen); -} - uint32_t B3gScanBNDMq(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) { B3gCtx *ctx = (B3gCtx *)mpm_ctx->ctx; #ifdef B3G_COUNTERS diff --git a/src/util-mpm-b3g.h b/src/util-mpm-b3g.h index 20eed69..4eccdeb 100644 --- a/src/util-mpm-b3g.h +++ b/src/util-mpm-b3g.h @@ -3,10 +3,14 @@ #include "util-mpm.h" #include "util-bloomfilter.h" +#include "suricata.h" +#include "suricata-common.h" #define B3G_NOCASE 0x01 #define B3G_SCAN 0x02 +#define INIT_HASH_SIZE 65536 + //#define B3G_HASHSHIFT 8 //#define B3G_HASHSHIFT 7 //#define B3G_HASHSHIFT 6 @@ -123,6 +127,287 @@ typedef struct B3gThreadCtx_ { void MpmB3gRegister(void); +/** ---- Inline functions ---- */ + +static inline uint32_t B3gScanWrap(MpmCtx *, MpmThreadCtx *, PatternMatcherQueue *, uint8_t *, uint16_t); +static inline uint32_t B3gSearchWrap(MpmCtx *, MpmThreadCtx *, PatternMatcherQueue *, uint8_t *, uint16_t); +void B3gFreePattern(MpmCtx *, B3gPattern *); + +/* append an endmatch to a pattern + * + * Only used in the initialization phase */ +static inline void B3gEndMatchAppend(MpmCtx *mpm_ctx, B3gPattern *p, + uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid, + uint8_t nosearch) +{ + MpmEndMatch *em = MpmAllocEndMatch(mpm_ctx); + if (em == NULL) { + printf("ERROR: B3gAllocEndMatch failed\n"); + return; + } + + em->id = pid; + em->sig_id = sid; + em->depth = depth; + em->offset = offset; + + if (nosearch) + em->flags |= MPM_ENDMATCH_NOSEARCH; + + if (p->em == NULL) { + p->em = em; + return; + } + + MpmEndMatch *m = p->em; + while (m->next) { + m = m->next; + } + m->next = em; +} + +static inline B3gPattern *B3gAllocPattern(MpmCtx *mpm_ctx) { + B3gPattern *p = SCMalloc(sizeof(B3gPattern)); + if (p == NULL) { + printf("ERROR: B3gAllocPattern: SCMalloc failed\n"); + exit(EXIT_FAILURE); + } + memset(p,0,sizeof(B3gPattern)); + + mpm_ctx->memory_cnt++; + mpm_ctx->memory_size += sizeof(B3gPattern); + return p; +} + +static inline B3gHashItem * +B3gAllocHashItem(MpmCtx *mpm_ctx) { + B3gHashItem *hi = SCMalloc(sizeof(B3gHashItem)); + if (hi == NULL) { + printf("ERROR: B3gAllocHashItem: SCMalloc failed\n"); + exit(EXIT_FAILURE); + } + memset(hi,0,sizeof(B3gHashItem)); + + mpm_ctx->memory_cnt++; + mpm_ctx->memory_size += sizeof(B3gHashItem); + return hi; +} + +/* +static inline void memcpy_tolower(uint8_t *d, uint8_t *s, uint16_t len) { + uint16_t i; + for (i = 0; i < len; i++) { + d[i] = u8_tolower(s[i]); + } +} +*/ + +/* + * INIT HASH START + */ +static inline uint32_t B3gInitHash(B3gPattern *p) { + uint32_t hash = p->len * p->cs[0]; + if (p->len > 1) + hash += p->cs[1]; + + return (hash % INIT_HASH_SIZE); +} + +static inline uint32_t B3gInitHashRaw(uint8_t *pat, uint16_t patlen) { + uint32_t hash = patlen * pat[0]; + if (patlen > 1) + hash += pat[1]; + + return (hash % INIT_HASH_SIZE); +} + +static inline int B3gInitHashAdd(B3gCtx *ctx, B3gPattern *p) { + uint32_t hash = B3gInitHash(p); + + //printf("B3gInitHashAdd: %" PRIu32 "\n", hash); + + if (ctx->init_hash[hash] == NULL) { + ctx->init_hash[hash] = p; + //printf("B3gInitHashAdd: hash %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]); + return 0; + } + + B3gPattern *tt = NULL; + B3gPattern *t = ctx->init_hash[hash]; + + /* get the list tail */ + do { + tt = t; + t = t->next; + } while (t != NULL); + + tt->next = p; + //printf("B3gInitHashAdd: hash %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]); + + return 0; +} + +static inline int B3gCmpPattern(B3gPattern *p, uint8_t *pat, uint16_t patlen, char nocase); + +static inline B3gPattern *B3gInitHashLookup(B3gCtx *ctx, uint8_t *pat, uint16_t patlen, char nocase) { + uint32_t hash = B3gInitHashRaw(pat,patlen); + + //printf("B3gInitHashLookup: %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]); + + if (ctx->init_hash[hash] == NULL) { + return NULL; + } + + B3gPattern *t = ctx->init_hash[hash]; + for ( ; t != NULL; t = t->next) { + if (B3gCmpPattern(t,pat,patlen,nocase) == 1) + return t; + } + + return NULL; +} + +static inline int B3gCmpPattern(B3gPattern *p, uint8_t *pat, uint16_t patlen, char nocase) { + if (p->len != patlen) + return 0; + + if (!((nocase && p->flags & B3G_NOCASE) || (!nocase && !(p->flags & B3G_NOCASE)))) + return 0; + + if (memcmp(p->cs, pat, patlen) != 0) + return 0; + + return 1; +} + +/* B3gAddPattern + * + * pat: ptr to the pattern + * patlen: length of the pattern + * nocase: nocase flag: 1 enabled, 0 disable + * pid: pattern id + * sid: signature id (internal id) + */ +static inline int B3gAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, char nocase, char scan, uint32_t pid, uint32_t sid, uint8_t nosearch) { + B3gCtx *ctx = (B3gCtx *)mpm_ctx->ctx; + +// printf("B3gAddPattern: ctx %p \"", mpm_ctx); prt(pat, patlen); +// printf("\" id %" PRIu32 ", nocase %s\n", id, nocase ? "true" : "false"); + + if (patlen == 0) + return 0; + + /* get a memory piece */ + B3gPattern *p = B3gInitHashLookup(ctx, pat, patlen, nocase); + if (p == NULL) { +// printf("B3gAddPattern: allocing new pattern\n"); + p = B3gAllocPattern(mpm_ctx); + if (p == NULL) + goto error; + + p->len = patlen; + + if (nocase) p->flags |= B3G_NOCASE; + + /* setup the case insensitive part of the pattern */ + p->ci = SCMalloc(patlen); + if (p->ci == NULL) goto error; + mpm_ctx->memory_cnt++; + mpm_ctx->memory_size += patlen; + memcpy_tolower(p->ci, pat, patlen); + + /* setup the case sensitive part of the pattern */ + if (p->flags & B3G_NOCASE) { + /* nocase means no difference between cs and ci */ + p->cs = p->ci; + } else { + if (memcmp(p->ci,pat,p->len) == 0) { + /* no diff between cs and ci: pat is lowercase */ + p->cs = p->ci; + } else { + p->cs = SCMalloc(patlen); + if (p->cs == NULL) goto error; + mpm_ctx->memory_cnt++; + mpm_ctx->memory_size += patlen; + memcpy(p->cs, pat, patlen); + } + } + + //printf("B3gAddPattern: ci \""); prt(p->ci,p->len); + //printf("\" cs \""); prt(p->cs,p->len); + //printf("\" prefix_ci %" PRIu32 ", prefix_cs %" PRIu32 "\n", p->prefix_ci, p->prefix_cs); + + /* put in the pattern hash */ + B3gInitHashAdd(ctx, p); + + if (mpm_ctx->pattern_cnt == 65535) { + printf("Max search words reached\n"); + exit(1); + } + if (scan) mpm_ctx->scan_pattern_cnt++; + mpm_ctx->pattern_cnt++; + + if (scan) { /* SCAN */ + if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen; + if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen; + else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen; + p->flags |= B3G_SCAN; + } else { /* SEARCH */ + if (mpm_ctx->search_maxlen < patlen) mpm_ctx->search_maxlen = patlen; + if (mpm_ctx->search_minlen == 0) mpm_ctx->search_minlen = patlen; + else if (mpm_ctx->search_minlen > patlen) mpm_ctx->search_minlen = patlen; + } + } else { + /* if we're reusing a pattern, check we need to check that it is a + * scan pattern if that is what we're adding. If so we set the pattern + * to be a scan pattern. */ + if (scan) { + p->flags |= B3G_SCAN; + + if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen; + if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen; + else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen; + } + } + + /* we need a match */ + B3gEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch); + + mpm_ctx->total_pattern_cnt++; + return 0; + +error: + B3gFreePattern(mpm_ctx, p); + return -1; +} + +/* +static inline int +memcmp_lowercase(uint8_t *s1, uint8_t *s2, uint16_t n) { + size_t i; + + * check backwards because we already tested the first + * 2 to 4 chars. This way we are more likely to detect + * a miss and thus speed up a little... * + for (i = n - 1; i; i--) { + if (u8_tolower(*(s2+i)) != s1[i]) + return 1; + } + + return 0; +} +*/ + +static inline uint32_t B3gScanWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) { + B3gCtx *ctx = (B3gCtx *)mpm_ctx->ctx; + return ctx->Scan(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen); +} + +static inline uint32_t B3gSearchWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) { + B3gCtx *ctx = (B3gCtx *)mpm_ctx->ctx; + return ctx->Search(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen); +} + #endif diff --git a/src/util-mpm-wumanber.c b/src/util-mpm-wumanber.c index b735bdc..777589d 100644 --- a/src/util-mpm-wumanber.c +++ b/src/util-mpm-wumanber.c @@ -24,8 +24,6 @@ #include "util-unittest.h" #include "util-debug.h" -#define INIT_HASH_SIZE 65535 - #define HASH16_SIZE 65536 #define HASH16(a,b) (((a)<<8) | (b)) #define HASH15_SIZE 32768 @@ -49,8 +47,6 @@ int WmAddScanPatternCS(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32 int WmAddPatternCI(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid); int WmAddPatternCS(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid); int WmPreparePatterns(MpmCtx *mpm_ctx); -inline uint32_t WmScan(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen); -inline uint32_t WmSearch(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen); uint32_t WmScan1(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen); uint32_t WmScan2Hash9(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen); uint32_t WmScan2Hash12(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen); @@ -108,39 +104,6 @@ void MpmWuManberRegister (void) { } } -/* append an endmatch to a pattern - * - * Only used in the initialization phase */ -static inline void WmEndMatchAppend(MpmCtx *mpm_ctx, WmPattern *p, - uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid, - uint8_t nosearch) -{ - MpmEndMatch *em = MpmAllocEndMatch(mpm_ctx); - if (em == NULL) { - printf("ERROR: WmAllocEndMatch failed\n"); - return; - } - - em->id = pid; - em->sig_id = sid; - em->depth = depth; - em->offset = offset; - - if (nosearch) - em->flags |= MPM_ENDMATCH_NOSEARCH; - - if (p->em == NULL) { - p->em = em; - return; - } - - MpmEndMatch *m = p->em; - while (m->next) { - m = m->next; - } - m->next = em; -} - void prt (uint8_t *buf, uint16_t buflen) { uint16_t i; @@ -208,33 +171,6 @@ void WmPrintInfo(MpmCtx *mpm_ctx) { printf("\n"); } -static inline WmPattern *WmAllocPattern(MpmCtx *mpm_ctx) { - WmPattern *p = SCMalloc(sizeof(WmPattern)); - if (p == NULL) { - printf("ERROR: WmAllocPattern: SCMalloc failed\n"); - exit(EXIT_FAILURE); - } - memset(p,0,sizeof(WmPattern)); - - mpm_ctx->memory_cnt++; - mpm_ctx->memory_size += sizeof(WmPattern); - return p; -} - -static inline WmHashItem * -WmAllocHashItem(MpmCtx *mpm_ctx) { - WmHashItem *hi = SCMalloc(sizeof(WmHashItem)); - if (hi == NULL) { - printf("ERROR: WmAllocHashItem: SCMalloc failed\n"); - exit(EXIT_FAILURE); - } - memset(hi,0,sizeof(WmHashItem)); - - mpm_ctx->memory_cnt++; - mpm_ctx->memory_size += sizeof(WmHashItem); - return hi; -} - static void WmHashFree(MpmCtx *mpm_ctx, WmHashItem *hi) { if (hi == NULL) return; @@ -247,95 +183,6 @@ static void WmHashFree(MpmCtx *mpm_ctx, WmHashItem *hi) { SCFree(hi); } -static inline void memcpy_tolower(uint8_t *d, uint8_t *s, uint16_t len) { - uint16_t i; - for (i = 0; i < len; i++) { - d[i] = wm_tolower(s[i]); - } -} - -/* - * INIT HASH START - */ -static inline uint32_t WmInitHash(WmPattern *p) { - uint32_t hash = p->len * p->cs[0]; - if (p->len > 1) - hash += p->cs[1]; - - return (hash % INIT_HASH_SIZE); -} - -static inline uint32_t WmInitHashRaw(uint8_t *pat, uint16_t patlen) { - uint32_t hash = patlen * pat[0]; - if (patlen > 1) - hash += pat[1]; - - return (hash % INIT_HASH_SIZE); -} - -static inline int WmInitHashAdd(WmCtx *ctx, WmPattern *p) { - uint32_t hash = WmInitHash(p); - - //printf("WmInitHashAdd: %" PRIu32 "\n", hash); - - if (ctx->init_hash[hash] == NULL) { - ctx->init_hash[hash] = p; - //printf("WmInitHashAdd: hash %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]); - return 0; - } - - WmPattern *tt = NULL; - WmPattern *t = ctx->init_hash[hash]; - - /* get the list tail */ - do { - tt = t; - t = t->next; - } while (t != NULL); - - tt->next = p; - //printf("WmInitHashAdd: hash %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]); - - return 0; -} - -static inline int WmCmpPattern(WmPattern *p, uint8_t *pat, uint16_t patlen, char nocase); - -static inline WmPattern *WmInitHashLookup(WmCtx *ctx, uint8_t *pat, uint16_t patlen, char nocase) { - uint32_t hash = WmInitHashRaw(pat,patlen); - - //printf("WmInitHashLookup: %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]); - - if (ctx->init_hash[hash] == NULL) { - return NULL; - } - - WmPattern *t = ctx->init_hash[hash]; - for ( ; t != NULL; t = t->next) { - if (WmCmpPattern(t,pat,patlen,nocase) == 1) - return t; - } - - return NULL; -} - -static inline int WmCmpPattern(WmPattern *p, uint8_t *pat, uint16_t patlen, char nocase) { - if (p->len != patlen) - return 0; - - if (!((nocase && p->flags & WUMANBER_NOCASE) || (!nocase && !(p->flags & WUMANBER_NOCASE)))) - return 0; - - if (memcmp(p->cs, pat, patlen) != 0) - return 0; - - return 1; -} - -/* - * INIT HASH END - */ - void WmFreePattern(MpmCtx *mpm_ctx, WmPattern *p) { if (p && p->em) { MpmEndMatchFreeAll(mpm_ctx, p->em); @@ -360,110 +207,6 @@ void WmFreePattern(MpmCtx *mpm_ctx, WmPattern *p) { } } -/* WmAddPattern - * - * pat: ptr to the pattern - * patlen: length of the pattern - * nocase: nocase flag: 1 enabled, 0 disable - * pid: pattern id - * sid: signature id (internal id) - */ -static inline int WmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, char nocase, char scan, uint32_t pid, uint32_t sid, uint8_t nosearch) { - WmCtx *ctx = (WmCtx *)mpm_ctx->ctx; - -// printf("WmAddPattern: ctx %p \"", mpm_ctx); prt(pat, patlen); -// printf("\" id %" PRIu32 ", nocase %s\n", id, nocase ? "true" : "false"); - - if (patlen == 0) - return 0; - - /* get a memory piece */ - WmPattern *p = WmInitHashLookup(ctx, pat, patlen, nocase); - if (p == NULL) { -// printf("WmAddPattern: allocing new pattern\n"); - p = WmAllocPattern(mpm_ctx); - if (p == NULL) - goto error; - - p->len = patlen; - - if (nocase) p->flags |= WUMANBER_NOCASE; - - /* setup the case insensitive part of the pattern */ - p->ci = SCMalloc(patlen); - if (p->ci == NULL) goto error; - mpm_ctx->memory_cnt++; - mpm_ctx->memory_size += patlen; - memcpy_tolower(p->ci, pat, patlen); - - /* setup the case sensitive part of the pattern */ - if (p->flags & WUMANBER_NOCASE) { - /* nocase means no difference between cs and ci */ - p->cs = p->ci; - } else { - if (memcmp(p->ci,pat,p->len) == 0) { - /* no diff between cs and ci: pat is lowercase */ - p->cs = p->ci; - } else { - p->cs = SCMalloc(patlen); - if (p->cs == NULL) goto error; - mpm_ctx->memory_cnt++; - mpm_ctx->memory_size += patlen; - memcpy(p->cs, pat, patlen); - } - } - - if (p->len > 1) { - p->prefix_cs = (uint16_t)(*(p->cs)+*(p->cs+1)); - p->prefix_ci = (uint16_t)(*(p->ci)+*(p->ci+1)); - } - - //printf("WmAddPattern: ci \""); prt(p->ci,p->len); - //printf("\" cs \""); prt(p->cs,p->len); - //printf("\" prefix_ci %" PRIu32 ", prefix_cs %" PRIu32 "\n", p->prefix_ci, p->prefix_cs); - - /* put in the pattern hash */ - WmInitHashAdd(ctx, p); - - if (mpm_ctx->pattern_cnt == 65535) { - printf("Max search words reached\n"); - exit(1); - } - mpm_ctx->pattern_cnt++; - - if (scan) { /* SCAN */ - if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen; - if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen; - else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen; - p->flags |= WUMANBER_SCAN; - } else { /* SEARCH */ - if (mpm_ctx->search_maxlen < patlen) mpm_ctx->search_maxlen = patlen; - if (mpm_ctx->search_minlen == 0) mpm_ctx->search_minlen = patlen; - else if (mpm_ctx->search_minlen > patlen) mpm_ctx->search_minlen = patlen; - } - } else { - /* if we're reusing a pattern, check we need to check that it is a - * scan pattern if that is what we're adding. If so we set the pattern - * to be a scan pattern. */ - if (scan) { - p->flags = WUMANBER_SCAN; - if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen; - if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen; - else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen; - } - } - - /* we need a match */ - WmEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch); - - mpm_ctx->total_pattern_cnt++; - return 0; - -error: - WmFreePattern(mpm_ctx, p); - return -1; -} - int WmAddScanPatternCI(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid, uint8_t nosearch) { @@ -900,7 +643,7 @@ int WmPreparePatterns(MpmCtx *mpm_ctx) { /* populate it with the patterns in the hash */ uint32_t i = 0, p = 0; - for (i = 0; i < INIT_HASH_SIZE; i++) { + for (i = 0; i < WM_INIT_HASH_SIZE; i++) { WmPattern *node = ctx->init_hash[i], *nnode = NULL; for ( ; node != NULL; ) { nnode = node->next; @@ -1022,31 +765,6 @@ void WmPrintSearchStats(MpmThreadCtx *mpm_thread_ctx) { #endif /* WUMANBER_COUNTERS */ } -static inline int -memcmp_lowercase(uint8_t *s1, uint8_t *s2, uint16_t n) { - size_t i; - - /* check backwards because we already tested the first - * 2 to 4 chars. This way we are more likely to detect - * a miss and thus speed up a little... */ - for (i = n - 1; i; i--) { - if (wm_tolower(*(s2+i)) != s1[i]) - return 1; - } - - return 0; -} - -inline uint32_t WmScan(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) { - WmCtx *ctx = (WmCtx *)mpm_ctx->ctx; - return ctx->Scan(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen); -} - -inline uint32_t WmSearch(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) { - WmCtx *ctx = (WmCtx *)mpm_ctx->ctx; - return ctx->Search(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen); -} - /* SCAN FUNCTIONS */ uint32_t WmScan2Hash9(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) { WmCtx *ctx = (WmCtx *)mpm_ctx->ctx; @@ -2244,11 +1962,11 @@ void WmInitCtx (MpmCtx *mpm_ctx, int module_handle) { /* initialize the hash we use to speed up pattern insertions */ WmCtx *ctx = (WmCtx *)mpm_ctx->ctx; - ctx->init_hash = SCMalloc(sizeof(WmPattern *) * INIT_HASH_SIZE); + ctx->init_hash = SCMalloc(sizeof(WmPattern *) * WM_INIT_HASH_SIZE); if (ctx->init_hash == NULL) return; - memset(ctx->init_hash, 0, sizeof(WmPattern *) * INIT_HASH_SIZE); + memset(ctx->init_hash, 0, sizeof(WmPattern *) * WM_INIT_HASH_SIZE); /* Initialize the defaults value from the config file. The given check make sure that we query config file only once for config values */ @@ -2265,7 +1983,7 @@ void WmDestroyCtx(MpmCtx *mpm_ctx) { if (ctx->init_hash) { SCFree(ctx->init_hash); mpm_ctx->memory_cnt--; - mpm_ctx->memory_size -= (INIT_HASH_SIZE * sizeof(WmPattern *)); + mpm_ctx->memory_size -= (WM_INIT_HASH_SIZE * sizeof(WmPattern *)); } if (ctx->parray) { diff --git a/src/util-mpm-wumanber.h b/src/util-mpm-wumanber.h index edbd66a..660058f 100644 --- a/src/util-mpm-wumanber.h +++ b/src/util-mpm-wumanber.h @@ -11,6 +11,9 @@ //#define WUMANBER_COUNTERS +#define WM_INIT_HASH_SIZE 65535 + + typedef struct WmPattern_ { uint8_t *cs; /* case sensitive */ uint8_t *ci; /* case INsensitive */ @@ -84,6 +87,263 @@ typedef struct WmThreadCtx_ { } WmThreadCtx; void MpmWuManberRegister(void); +void WmFreePattern(MpmCtx *, WmPattern *); + +/** ---- Inline functions ---- */ + +static inline uint32_t WmScan(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen); +static inline uint32_t WmSearch(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen); + +/* append an endmatch to a pattern + * + * Only used in the initialization phase */ +static inline void WmEndMatchAppend(MpmCtx *mpm_ctx, WmPattern *p, + uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid, + uint8_t nosearch) +{ + MpmEndMatch *em = MpmAllocEndMatch(mpm_ctx); + if (em == NULL) { + printf("ERROR: WmAllocEndMatch failed\n"); + return; + } + + em->id = pid; + em->sig_id = sid; + em->depth = depth; + em->offset = offset; + + if (nosearch) + em->flags |= MPM_ENDMATCH_NOSEARCH; + + if (p->em == NULL) { + p->em = em; + return; + } + + MpmEndMatch *m = p->em; + while (m->next) { + m = m->next; + } + m->next = em; +} + +static inline WmPattern *WmAllocPattern(MpmCtx *mpm_ctx) { + WmPattern *p = SCMalloc(sizeof(WmPattern)); + if (p == NULL) { + printf("ERROR: WmAllocPattern: SCMalloc failed\n"); + exit(EXIT_FAILURE); + } + memset(p,0,sizeof(WmPattern)); + + mpm_ctx->memory_cnt++; + mpm_ctx->memory_size += sizeof(WmPattern); + return p; +} + + +static inline WmHashItem * +WmAllocHashItem(MpmCtx *mpm_ctx) { + WmHashItem *hi = SCMalloc(sizeof(WmHashItem)); + if (hi == NULL) { + printf("ERROR: WmAllocHashItem: SCMalloc failed\n"); + exit(EXIT_FAILURE); + } + memset(hi,0,sizeof(WmHashItem)); + + mpm_ctx->memory_cnt++; + mpm_ctx->memory_size += sizeof(WmHashItem); + return hi; +} + +static inline uint32_t WmInitHash(WmPattern *p) { + uint32_t hash = p->len * p->cs[0]; + if (p->len > 1) + hash += p->cs[1]; + + return (hash % WM_INIT_HASH_SIZE); +} + +static inline uint32_t WmInitHashRaw(uint8_t *pat, uint16_t patlen) { + uint32_t hash = patlen * pat[0]; + if (patlen > 1) + hash += pat[1]; + + return (hash % WM_INIT_HASH_SIZE); +} + +static inline int WmInitHashAdd(WmCtx *ctx, WmPattern *p) { + uint32_t hash = WmInitHash(p); + + //printf("WmInitHashAdd: %" PRIu32 "\n", hash); + + if (ctx->init_hash[hash] == NULL) { + ctx->init_hash[hash] = p; + //printf("WmInitHashAdd: hash %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]); + return 0; + } + + WmPattern *tt = NULL; + WmPattern *t = ctx->init_hash[hash]; + + /* get the list tail */ + do { + tt = t; + t = t->next; + } while (t != NULL); + + tt->next = p; + //printf("WmInitHashAdd: hash %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]); + + return 0; +} + +static inline int WmCmpPattern(WmPattern *p, uint8_t *pat, uint16_t patlen, char nocase); + +static inline WmPattern *WmInitHashLookup(WmCtx *ctx, uint8_t *pat, uint16_t patlen, char nocase) { + uint32_t hash = WmInitHashRaw(pat,patlen); + + //printf("WmInitHashLookup: %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]); + + if (ctx->init_hash[hash] == NULL) { + return NULL; + } + + WmPattern *t = ctx->init_hash[hash]; + for ( ; t != NULL; t = t->next) { + if (WmCmpPattern(t,pat,patlen,nocase) == 1) + return t; + } + + return NULL; +} + +static inline int WmCmpPattern(WmPattern *p, uint8_t *pat, uint16_t patlen, char nocase) { + if (p->len != patlen) + return 0; + + if (!((nocase && p->flags & WUMANBER_NOCASE) || (!nocase && !(p->flags & WUMANBER_NOCASE)))) + return 0; + + if (memcmp(p->cs, pat, patlen) != 0) + return 0; + + return 1; +} + +/* WmAddPattern + * + * pat: ptr to the pattern + * patlen: length of the pattern + * nocase: nocase flag: 1 enabled, 0 disable + * pid: pattern id + * sid: signature id (internal id) + */ +static inline int WmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, char nocase, char scan, uint32_t pid, uint32_t sid, uint8_t nosearch) { + WmCtx *ctx = (WmCtx *)mpm_ctx->ctx; + +// printf("WmAddPattern: ctx %p \"", mpm_ctx); prt(pat, patlen); +// printf("\" id %" PRIu32 ", nocase %s\n", id, nocase ? "true" : "false"); + + if (patlen == 0) + return 0; + + /* get a memory piece */ + WmPattern *p = WmInitHashLookup(ctx, pat, patlen, nocase); + if (p == NULL) { +// printf("WmAddPattern: allocing new pattern\n"); + p = WmAllocPattern(mpm_ctx); + if (p == NULL) + goto error; + + p->len = patlen; + + if (nocase) p->flags |= WUMANBER_NOCASE; + + /* setup the case insensitive part of the pattern */ + p->ci = SCMalloc(patlen); + if (p->ci == NULL) goto error; + mpm_ctx->memory_cnt++; + mpm_ctx->memory_size += patlen; + memcpy_tolower(p->ci, pat, patlen); + + /* setup the case sensitive part of the pattern */ + if (p->flags & WUMANBER_NOCASE) { + /* nocase means no difference between cs and ci */ + p->cs = p->ci; + } else { + if (memcmp(p->ci,pat,p->len) == 0) { + /* no diff between cs and ci: pat is lowercase */ + p->cs = p->ci; + } else { + p->cs = SCMalloc(patlen); + if (p->cs == NULL) goto error; + mpm_ctx->memory_cnt++; + mpm_ctx->memory_size += patlen; + memcpy(p->cs, pat, patlen); + } + } + + if (p->len > 1) { + p->prefix_cs = (uint16_t)(*(p->cs)+*(p->cs+1)); + p->prefix_ci = (uint16_t)(*(p->ci)+*(p->ci+1)); + } + + //printf("WmAddPattern: ci \""); prt(p->ci,p->len); + //printf("\" cs \""); prt(p->cs,p->len); + //printf("\" prefix_ci %" PRIu32 ", prefix_cs %" PRIu32 "\n", p->prefix_ci, p->prefix_cs); + + /* put in the pattern hash */ + WmInitHashAdd(ctx, p); + + if (mpm_ctx->pattern_cnt == 65535) { + printf("Max search words reached\n"); + exit(1); + } + mpm_ctx->pattern_cnt++; + + if (scan) { /* SCAN */ + if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen; + if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen; + else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen; + p->flags |= WUMANBER_SCAN; + } else { /* SEARCH */ + if (mpm_ctx->search_maxlen < patlen) mpm_ctx->search_maxlen = patlen; + if (mpm_ctx->search_minlen == 0) mpm_ctx->search_minlen = patlen; + else if (mpm_ctx->search_minlen > patlen) mpm_ctx->search_minlen = patlen; + } + } else { + /* if we're reusing a pattern, check we need to check that it is a + * scan pattern if that is what we're adding. If so we set the pattern + * to be a scan pattern. */ + if (scan) { + p->flags = WUMANBER_SCAN; + if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen; + if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen; + else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen; + } + } + + /* we need a match */ + WmEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch); + + mpm_ctx->total_pattern_cnt++; + return 0; + +error: + WmFreePattern(mpm_ctx, p); + return -1; +} + +static inline uint32_t WmScan(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) { + WmCtx *ctx = (WmCtx *)mpm_ctx->ctx; + return ctx->Scan(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen); +} + +static inline uint32_t WmSearch(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) { + WmCtx *ctx = (WmCtx *)mpm_ctx->ctx; + return ctx->Search(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen); +} + #endif /* __UTIL_MPM_WUMANBER_H__ */ diff --git a/src/util-mpm.c b/src/util-mpm.c index 2252945..1c82e8b 100644 --- a/src/util-mpm.c +++ b/src/util-mpm.c @@ -123,111 +123,6 @@ MpmMatchCleanup(MpmThreadCtx *thread_ctx) { } } -/** \brief allocate a match - * - * used at search runtime */ -inline MpmMatch * -MpmMatchAlloc(MpmThreadCtx *thread_ctx) { - MpmMatch *m = SCMalloc(sizeof(MpmMatch)); - if (m == NULL) - return NULL; - - thread_ctx->memory_cnt++; - thread_ctx->memory_size += sizeof(MpmMatch); - - m->offset = 0; - m->next = NULL; - m->qnext = NULL; - m->mb = NULL; - return m; -} - -/** \brief append a match to a bucket - * - * used at search runtime */ -inline int -MpmMatchAppend(MpmThreadCtx *thread_ctx, PatternMatcherQueue *pmq, MpmEndMatch *em, MpmMatchBucket *mb, uint16_t offset, uint16_t patlen) -{ - /* don't bother looking at sigs that didn't match - * when we scanned. There's no matching anyway. */ - if (pmq != NULL && pmq->mode == PMQ_MODE_SEARCH) { - if (!(pmq->sig_bitarray[(em->sig_id / 8)] & (1<<(em->sig_id % 8)))) - return 0; - } - - /* if our endmatch is set to a single match being enough, - we're not going to add more if we already have one */ - if (em->flags & MPM_ENDMATCH_SINGLE && mb->len) - return 0; - - /* check offset */ - if (offset < em->offset) - return 0; - - /* check depth */ - if (em->depth && (offset+patlen) > em->depth) - return 0; - - /* ok all checks passed, now append the match */ - MpmMatch *m; - /* pull a match from the spare list */ - if (thread_ctx->sparelist != NULL) { - m = thread_ctx->sparelist; - thread_ctx->sparelist = m->qnext; - } else { - m = MpmMatchAlloc(thread_ctx); - if (m == NULL) - return 0; - } - - m->offset = offset; - m->mb = mb; - m->next = NULL; - m->qnext = NULL; - - /* append to the mb list */ - if (mb->bot == NULL) { /* empty list */ - mb->top = m; - mb->bot = m; - } else { /* more items in list */ - mb->bot->next = m; - mb->bot = m; - } - - mb->len++; - - /* put in the queue list */ - if (thread_ctx->qlist == NULL) { /* empty list */ - thread_ctx->qlist = m; - } else { /* more items in list */ - m->qnext = thread_ctx->qlist; - thread_ctx->qlist = m; - } - - BUG_ON(m == m->qnext); - - if (pmq != NULL) { - /* make sure we only append a sig with a matching pattern once, - * so we won't inspect it more than once. For this we keep a - * bitarray of sig internal id's and flag each sig that matched */ - if (!(pmq->sig_bitarray[(em->sig_id / 8)] & (1<<(em->sig_id % 8)))) { - /* flag this sig_id as being added now */ - pmq->sig_bitarray[(em->sig_id / 8)] |= (1<<(em->sig_id % 8)); - /* append the sig_id to the array with matches */ - pmq->sig_id_array[pmq->sig_id_array_cnt] = em->sig_id; - pmq->sig_id_array_cnt++; - } - - /* nosearch flag */ - if (pmq->mode == PMQ_MODE_SCAN && !(em->flags & MPM_ENDMATCH_NOSEARCH)) { - pmq->searchable++; - } - } - - SCLogDebug("len %" PRIu32 " (offset %" PRIu32 ")", mb->len, m->offset); - return 1; -} - void MpmMatchFree(MpmThreadCtx *ctx, MpmMatch *m) { ctx->memory_cnt--; ctx->memory_size -= sizeof(MpmMatch); diff --git a/src/util-mpm.h b/src/util-mpm.h index 92d23f0..952ee66 100644 --- a/src/util-mpm.h +++ b/src/util-mpm.h @@ -147,8 +147,6 @@ void PmqCleanup(PatternMatcherQueue *); void PmqFree(PatternMatcherQueue *); void MpmMatchCleanup(MpmThreadCtx *); -MpmMatch *MpmMatchAlloc(MpmThreadCtx *); -int MpmMatchAppend(MpmThreadCtx *, PatternMatcherQueue *, MpmEndMatch *, MpmMatchBucket *, uint16_t, uint16_t); MpmEndMatch *MpmAllocEndMatch (MpmCtx *); void MpmEndMatchFreeAll(MpmCtx *mpm_ctx, MpmEndMatch *em); void MpmMatchFreeSpares(MpmThreadCtx *mpm_ctx, MpmMatch *m); @@ -164,5 +162,114 @@ void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t, uint32_t); uint32_t MpmGetHashSize(const char *); uint32_t MpmGetBloomSize(const char *); +/** ------ Inline functions ------- */ + +static inline MpmMatch *MpmMatchAlloc(MpmThreadCtx *); +static inline int MpmMatchAppend(MpmThreadCtx *, PatternMatcherQueue *, MpmEndMatch *, MpmMatchBucket *, uint16_t, uint16_t); + +/** \brief allocate a match + * + * used at search runtime */ +static inline MpmMatch * +MpmMatchAlloc(MpmThreadCtx *thread_ctx) { + MpmMatch *m = SCMalloc(sizeof(MpmMatch)); + if (m == NULL) + return NULL; + + thread_ctx->memory_cnt++; + thread_ctx->memory_size += sizeof(MpmMatch); + + m->offset = 0; + m->next = NULL; + m->qnext = NULL; + m->mb = NULL; + return m; +} + +/** \brief append a match to a bucket + * + * used at search runtime */ +static inline int +MpmMatchAppend(MpmThreadCtx *thread_ctx, PatternMatcherQueue *pmq, MpmEndMatch *em, MpmMatchBucket *mb, uint16_t offset, uint16_t patlen) +{ + /* don't bother looking at sigs that didn't match + * when we scanned. There's no matching anyway. */ + if (pmq != NULL && pmq->mode == PMQ_MODE_SEARCH) { + if (!(pmq->sig_bitarray[(em->sig_id / 8)] & (1<<(em->sig_id % 8)))) + return 0; + } + + /* if our endmatch is set to a single match being enough, + we're not going to add more if we already have one */ + if (em->flags & MPM_ENDMATCH_SINGLE && mb->len) + return 0; + + /* check offset */ + if (offset < em->offset) + return 0; + + /* check depth */ + if (em->depth && (offset+patlen) > em->depth) + return 0; + + /* ok all checks passed, now append the match */ + MpmMatch *m; + /* pull a match from the spare list */ + if (thread_ctx->sparelist != NULL) { + m = thread_ctx->sparelist; + thread_ctx->sparelist = m->qnext; + } else { + m = MpmMatchAlloc(thread_ctx); + if (m == NULL) + return 0; + } + + m->offset = offset; + m->mb = mb; + m->next = NULL; + m->qnext = NULL; + + /* append to the mb list */ + if (mb->bot == NULL) { /* empty list */ + mb->top = m; + mb->bot = m; + } else { /* more items in list */ + mb->bot->next = m; + mb->bot = m; + } + + mb->len++; + + /* put in the queue list */ + if (thread_ctx->qlist == NULL) { /* empty list */ + thread_ctx->qlist = m; + } else { /* more items in list */ + m->qnext = thread_ctx->qlist; + thread_ctx->qlist = m; + } + + BUG_ON(m == m->qnext); + + if (pmq != NULL) { + /* make sure we only append a sig with a matching pattern once, + * so we won't inspect it more than once. For this we keep a + * bitarray of sig internal id's and flag each sig that matched */ + if (!(pmq->sig_bitarray[(em->sig_id / 8)] & (1<<(em->sig_id % 8)))) { + /* flag this sig_id as being added now */ + pmq->sig_bitarray[(em->sig_id / 8)] |= (1<<(em->sig_id % 8)); + /* append the sig_id to the array with matches */ + pmq->sig_id_array[pmq->sig_id_array_cnt] = em->sig_id; + pmq->sig_id_array_cnt++; + } + + /* nosearch flag */ + if (pmq->mode == PMQ_MODE_SCAN && !(em->flags & MPM_ENDMATCH_NOSEARCH)) { + pmq->searchable++; + } + } + + SCLogDebug("len %" PRIu32 " (offset %" PRIu32 ")", mb->len, m->offset); + return 1; +} #endif /* __UTIL_MPM_H__ */ diff --git a/src/util-radix-tree.c b/src/util-radix-tree.c index 61849b3..53313b0 100644 --- a/src/util-radix-tree.c +++ b/src/util-radix-tree.c @@ -366,7 +366,7 @@ static int SCRadixPrefixNetmaskCount(SCRadixPrefix *prefix) * \retval 1 On match. * \retval 0 On no match. */ -static int SCRadixPrefixContainNetmaskAndSetUserData(SCRadixPrefix *prefix, +int SCRadixPrefixContainNetmaskAndSetUserData(SCRadixPrefix *prefix, uint16_t bitlen, int exact_match) { @@ -418,7 +418,7 @@ static int SCRadixPrefixContainNetmaskAndSetUserData(SCRadixPrefix *prefix, * \param prefix Pointer to a prefix instance * \param tree Pointer to the Radix tree to which this prefix belongs */ -static void SCRadixReleasePrefix(SCRadixPrefix *prefix, SCRadixTree *tree) +void SCRadixReleasePrefix(SCRadixPrefix *prefix, SCRadixTree *tree) { SCRadixUserData *user_data_temp1 = NULL; SCRadixUserData *user_data_temp2 = NULL; @@ -445,40 +445,6 @@ static void SCRadixReleasePrefix(SCRadixPrefix *prefix, SCRadixTree *tree) } /** - * \brief Creates a new node for the Radix tree - * - * \retval node The newly created node for the radix tree - */ -static inline SCRadixNode *SCRadixCreateNode() -{ - SCRadixNode *node = NULL; - - if ( (node = SCMalloc(sizeof(SCRadixNode))) == NULL) { - SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); - exit(EXIT_FAILURE); - } - memset(node, 0, sizeof(SCRadixNode)); - - return node; -} - -/** - * \brief Frees a Radix tree node - * - * \param node Pointer to a Radix tree node - * \param tree Pointer to the Radix tree to which this node belongs - */ -static inline void SCRadixReleaseNode(SCRadixNode *node, SCRadixTree *tree) -{ - if (node != NULL) { - SCRadixReleasePrefix(node->prefix, tree); - SCFree(node); - } - - return; -} - -/** * \brief Creates a new Radix tree * * \param Free Function pointer supplied by the user to be used by the Radix @@ -1251,74 +1217,6 @@ void SCRadixRemoveKeyIPV6(uint8_t *key_stream, SCRadixTree *tree) } /** - * \brief Checks if an IP prefix falls under a netblock, in the path to the root - * of the tree, from the node. Used internally by SCRadixFindKey() - * - * \param prefix Pointer to the prefix that contains the ip address - * \param node Pointer to the node from where we have to climb the tree - */ -static inline SCRadixNode *SCRadixFindKeyIPNetblock(SCRadixPrefix *prefix, - SCRadixNode *node) -{ - SCRadixNode *netmask_node = NULL; - int mask = 0; - int bytes = 0; - int i = 0; - int j = 0; - - while (node != NULL && node->netmasks == NULL) - node = node->parent; - - if (node == NULL) - return NULL; - - /* hold the node found containing a netmask. We will need it when we call - * this function recursively */ - netmask_node = node; - - for (j = 0; j < netmask_node->netmask_cnt; j++) { - bytes = prefix->bitlen / 8; - for (i = 0; i < bytes; i++) { - mask = -1; - if ( ((i + 1) * 8) > netmask_node->netmasks[j]) { - if ( ((i + 1) * 8 - netmask_node->netmasks[j]) < 8) - mask = -1 << ((i + 1) * 8 - netmask_node->netmasks[j]); - else - mask = 0; - } - prefix->stream[i] &= mask; - } - - while (node->bit < prefix->bitlen) { - if (SC_RADIX_BITTEST(prefix->stream[node->bit >> 3], - (0x80 >> (node->bit % 8))) ) { - node = node->right; - } else { - node = node->left; - } - - if (node == NULL) - return NULL; - } - - if (node->bit != prefix->bitlen || node->prefix == NULL) - return NULL; - - if (memcmp(node->prefix->stream, prefix->stream, bytes) == 0) { - mask = -1 << (8 - prefix->bitlen % 8); - - if (prefix->bitlen % 8 == 0 || - (node->prefix->stream[bytes] & mask) == (prefix->stream[bytes] & mask)) { - if (SCRadixPrefixContainNetmaskAndSetUserData(node->prefix, prefix->bitlen, 0)) - return node; - } - } - } - - return SCRadixFindKeyIPNetblock(prefix, netmask_node->parent); -} - -/** * \brief Checks if an IP address key is present in the tree. The function * apart from handling any normal data, also handles ipv4/ipv6 netblocks * diff --git a/src/util-radix-tree.h b/src/util-radix-tree.h index f791760..6cfed45 100644 --- a/src/util-radix-tree.h +++ b/src/util-radix-tree.h @@ -108,5 +108,116 @@ void SCRadixPrintTree(SCRadixTree *); void SCRadixRegisterTests(void); +void SCRadixReleasePrefix(SCRadixPrefix *, SCRadixTree *); +int SCRadixPrefixContainNetmaskAndSetUserData(SCRadixPrefix *, uint16_t, int); +/** ----- Inline funcions ------ */ + +static inline SCRadixNode *SCRadixCreateNode(); +static inline void SCRadixReleaseNode(SCRadixNode *, SCRadixTree *); +static inline SCRadixNode *SCRadixFindKeyIPNetblock(SCRadixPrefix *, SCRadixNode *); + +/** + * \brief Creates a new node for the Radix tree + * + * \retval node The newly created node for the radix tree + */ +static inline SCRadixNode *SCRadixCreateNode() +{ + SCRadixNode *node = NULL; + + if ( (node = SCMalloc(sizeof(SCRadixNode))) == NULL) { + SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); + exit(EXIT_FAILURE); + } + memset(node, 0, sizeof(SCRadixNode)); + + return node; +} + +/** + * \brief Frees a Radix tree node + * + * \param node Pointer to a Radix tree node + * \param tree Pointer to the Radix tree to which this node belongs + */ +static inline void SCRadixReleaseNode(SCRadixNode *node, SCRadixTree *tree) +{ + if (node != NULL) { + SCRadixReleasePrefix(node->prefix, tree); + SCFree(node); + } + + return; +} + +/** + * \brief Checks if an IP prefix falls under a netblock, in the path to the root + * of the tree, from the node. Used internally by SCRadixFindKey() + * + * \param prefix Pointer to the prefix that contains the ip address + * \param node Pointer to the node from where we have to climb the tree + */ +static inline SCRadixNode *SCRadixFindKeyIPNetblock(SCRadixPrefix *prefix, + SCRadixNode *node) +{ + SCRadixNode *netmask_node = NULL; + int mask = 0; + int bytes = 0; + int i = 0; + int j = 0; + + while (node != NULL && node->netmasks == NULL) + node = node->parent; + + if (node == NULL) + return NULL; + + /* hold the node found containing a netmask. We will need it when we call + * this function recursively */ + netmask_node = node; + + for (j = 0; j < netmask_node->netmask_cnt; j++) { + bytes = prefix->bitlen / 8; + for (i = 0; i < bytes; i++) { + mask = -1; + if ( ((i + 1) * 8) > netmask_node->netmasks[j]) { + if ( ((i + 1) * 8 - netmask_node->netmasks[j]) < 8) + mask = -1 << ((i + 1) * 8 - netmask_node->netmasks[j]); + else + mask = 0; + } + prefix->stream[i] &= mask; + } + + while (node->bit < prefix->bitlen) { + if (SC_RADIX_BITTEST(prefix->stream[node->bit >> 3], + (0x80 >> (node->bit % 8))) ) { + node = node->right; + } else { + node = node->left; + } + + if (node == NULL) + return NULL; + } + + if (node->bit != prefix->bitlen || node->prefix == NULL) + return NULL; + + if (memcmp(node->prefix->stream, prefix->stream, bytes) == 0) { + mask = -1 << (8 - prefix->bitlen % 8); + + if (prefix->bitlen % 8 == 0 || + (node->prefix->stream[bytes] & mask) == (prefix->stream[bytes] & mask)) { + if (SCRadixPrefixContainNetmaskAndSetUserData(node->prefix, prefix->bitlen, 0)) + return node; + } + } + } + + return SCRadixFindKeyIPNetblock(prefix, netmask_node->parent); +} + + #endif /* __UTIL_RADIX_TREE_H__ */ diff --git a/src/util-spm-bm.c b/src/util-spm-bm.c index 70e1af0..f345b9b 100644 --- a/src/util-spm-bm.c +++ b/src/util-spm-bm.c @@ -18,238 +18,4 @@ #include #include -/** - * \brief Array setup function for bad characters that split the pattern - * Remember that the result array should be the length of ALPHABET_SIZE - * - * \param str pointer to the pattern string - * \param size length of the string - * \param result pointer to an empty array that will hold the badchars - */ -inline void PreBmBc(const uint8_t *x, int32_t m, int32_t *bmBc) { - int32_t i; - - for (i = 0; i < 256; ++i) { - bmBc[i] = m; - } - for (i = 0; i < m - 1; ++i) { - bmBc[(unsigned char)x[i]] = m - i - 1; - } -} - -/** - * \brief Array setup function for building prefixes (shift for valid prefixes) for boyermoore context - * - * \param x pointer to the pattern string - * \param m length of the string - * \param suff pointer to an empty array that will hold the prefixes (shifts) - */ -inline void BoyerMooreSuffixes(const uint8_t *x, int32_t m, int32_t *suff) { - int32_t f = 0, g, i; - suff[m - 1] = m; - g = m - 1; - for (i = m - 2; i >= 0; --i) { - if (i > g && suff[i + m - 1 - f] < i - g) - suff[i] = suff[i + m - 1 - f]; - else { - if (i < g) - g = i; - f = i; - while (g >= 0 && x[g] == x[g + m - 1 - f]) - --g; - suff[i] = f - g; - } - } -} - -/** - * \brief Array setup function for building prefixes (shift for valid prefixes) for boyermoore context - * - * \param x pointer to the pattern string - * \param m length of the string - * \param bmGs pointer to an empty array that will hold the prefixes (shifts) - */ -inline void PreBmGs(const uint8_t *x, int32_t m, int32_t *bmGs) { - int32_t i, j; - int32_t *suff; - - suff = SCMalloc(sizeof(int32_t) * (m + 1)); - - BoyerMooreSuffixes(x, m, suff); - - for (i = 0; i < m; ++i) - bmGs[i] = m; - - j = 0; - - for (i = m - 1; i >= -1; --i) - if (i == -1 || suff[i] == i + 1) - for (; j < m - 1 - i; ++j) - if (bmGs[j] == m) - bmGs[j] = m - 1 - i; - - for (i = 0; i <= m - 2; ++i) - bmGs[m - 1 - suff[i]] = m - 1 - i; - SCFree(suff); -} - -/** - * \brief Array setup function for bad characters that split the pattern - * Remember that the result array should be the length of ALPHABET_SIZE - * - * \param str pointer to the pattern string - * \param size length of the string - * \param result pointer to an empty array that will hold the badchars - */ -inline void PreBmBcNocase(const uint8_t *x, int32_t m, int32_t *bmBc) { - int32_t i; - - for (i = 0; i < 256; ++i) { - bmBc[i] = m; - } - for (i = 0; i < m - 1; ++i) { - bmBc[u8_tolower((unsigned char)x[i])] = m - 1 - i; - } -} - -inline void BoyerMooreSuffixesNocase(const uint8_t *x, int32_t m, int32_t *suff) { - int32_t f = 0, g, i; - - suff[m - 1] = m; - g = m - 1; - for (i = m - 2; i >= 0; --i) { - if (i > g && suff[i + m - 1 - f] < i - g) { - suff[i] = suff[i + m - 1 - f]; - } else { - if (i < g) { - g = i; - } - f = i; - while (g >= 0 && u8_tolower(x[g]) == u8_tolower(x[g + m - 1 - f])) { - --g; - } - suff[i] = f - g; - } - } -} - -/** - * \brief Array setup function for building prefixes (shift for valid prefixes) - * for boyermoore context case less - * - * \param x pointer to the pattern string - * \param m length of the string - * \param bmGs pointer to an empty array that will hold the prefixes (shifts) - */ -inline void PreBmGsNocase(const uint8_t *x, int32_t m, int32_t *bmGs) { - int32_t i, j; - int32_t* suff; - - suff = SCMalloc(sizeof(int32_t) * (m + 1)); - - BoyerMooreSuffixesNocase(x, m, suff); - - for (i = 0; i < m; ++i) { - bmGs[i] = m; - } - j = 0; - for (i = m - 1; i >= 0; --i) { - if (i == -1 || suff[i] == i + 1) { - for (; j < m - 1 - i; ++j) { - if (bmGs[j] == m) { - bmGs[j] = m - 1 - i; - } - } - } - } - for (i = 0; i <= m - 2; ++i) { - bmGs[m - 1 - suff[i]] = m - 1 - i; - } - - SCFree(suff); -} - -/** - * \brief Boyer Moore search algorithm - * Is better as the pattern length increases and for big buffers to search in. - * The algorithm needs a context of two arrays already prepared - * by prep_bad_chars() and prep_good_suffix() - * - * \param y pointer to the buffer to search in - * \param n length limit of the buffer - * \param x pointer to the pattern we ar searching for - * \param m length limit of the needle - * \param bmBc pointer to an array of BoyerMooreSuffixes prepared by prep_good_suffix() - * \param bmGs pointer to an array of bachars prepared by prep_bad_chars() - * - * \retval ptr to start of the match; NULL if no match - */ -inline uint8_t *BoyerMoore(uint8_t *x, int32_t m, uint8_t *y, int32_t n, int32_t *bmGs, int32_t *bmBc) { - int i, j, m1, m2; -#if 0 - printf("\nBad:\n"); - for (i=0;i= 0 && x[i] == y[i + j]; --i); - - if (i < 0) { - return y + j; - j += bmGs[0]; - } else { - // printf("%c", y[i+j]); - j += (m1 = bmGs[i]) > (m2 = bmBc[y[i + j]] - m + 1 + i)? m1: m2; -// printf("%d, %d\n", m1, m2); - } - } - return NULL; -} - - -/** - * \brief Boyer Moore search algorithm - * Is better as the pattern length increases and for big buffers to search in. - * The algorithm needs a context of two arrays already prepared - * by prep_bad_chars() and prep_good_suffix() - * - * \param y pointer to the buffer to search in - * \param n length limit of the buffer - * \param x pointer to the pattern we ar searching for - * \param m length limit of the needle - * \param bmBc pointer to an array of BoyerMooreSuffixes prepared by prep_good_suffix() - * \param bmGs pointer to an array of bachars prepared by prep_bad_chars() - * - * \retval ptr to start of the match; NULL if no match - */ -inline uint8_t *BoyerMooreNocase(uint8_t *x, int32_t m, uint8_t *y, int32_t n, int32_t *bmGs, int32_t *bmBc) { - int i, j, m1, m2; -#if 0 - printf("\nBad:\n"); - for (i=0;i= 0 && u8_tolower(x[i]) == u8_tolower(y[i + j]); --i); - - if (i < 0) { - return y + j; - } else { - j += (m1=bmGs[i]) > (m2=bmBc[u8_tolower(y[i + j])] - m + 1 + i)?m1:m2; - } - } - return NULL; -} diff --git a/src/util-spm-bm.h b/src/util-spm-bm.h index 8496407..6864a53 100644 --- a/src/util-spm-bm.h +++ b/src/util-spm-bm.h @@ -6,14 +6,252 @@ #define ALPHABET_SIZE 256 -inline void PreBmBc(const uint8_t *x, int32_t m, int32_t *bmBc); -inline void BoyerMooreSuffixes(const uint8_t *x, int32_t m, int32_t *suff); -inline void PreBmGs(const uint8_t *x, int32_t m, int32_t *bmGs); -inline uint8_t *BoyerMoore(uint8_t *x, int32_t m, uint8_t *y, int32_t n, int32_t *bmGs, int32_t *bmBc); -inline void PreBmBcNocase(const uint8_t *x, int32_t m, int32_t *bmBc); -inline void BoyerMooreSuffixesNocase(const uint8_t *x, int32_t m, int32_t *suff); -inline void PreBmGsNocase(const uint8_t *x, int32_t m, int32_t *bmGs); -inline uint8_t *BoyerMooreNocase(uint8_t *x, int32_t m, uint8_t *y, int32_t n, int32_t *bmGs, int32_t *bmBc); +static inline void PreBmBc(const uint8_t *x, int32_t m, int32_t *bmBc); +static inline void BoyerMooreSuffixes(const uint8_t *x, int32_t m, int32_t *suff); +static inline void PreBmGs(const uint8_t *x, int32_t m, int32_t *bmGs); +static inline uint8_t *BoyerMoore(uint8_t *x, int32_t m, uint8_t *y, int32_t n, int32_t *bmGs, int32_t *bmBc); +static inline void PreBmBcNocase(const uint8_t *x, int32_t m, int32_t *bmBc); +static inline void BoyerMooreSuffixesNocase(const uint8_t *x, int32_t m, int32_t *suff); +static inline void PreBmGsNocase(const uint8_t *x, int32_t m, int32_t *bmGs); +static inline uint8_t *BoyerMooreNocase(uint8_t *x, int32_t m, uint8_t *y, int32_t n, int32_t *bmGs, int32_t *bmBc); + +/** --------- Inline functions -------- */ + + +/** + * \brief Array setup function for bad characters that split the pattern + * Remember that the result array should be the length of ALPHABET_SIZE + * + * \param str pointer to the pattern string + * \param size length of the string + * \param result pointer to an empty array that will hold the badchars + */ +inline void PreBmBc(const uint8_t *x, int32_t m, int32_t *bmBc) { + int32_t i; + + for (i = 0; i < 256; ++i) { + bmBc[i] = m; + } + for (i = 0; i < m - 1; ++i) { + bmBc[(unsigned char)x[i]] = m - i - 1; + } +} + +/** + * \brief Array setup function for building prefixes (shift for valid prefixes) for boyermoore context + * + * \param x pointer to the pattern string + * \param m length of the string + * \param suff pointer to an empty array that will hold the prefixes (shifts) + */ +inline void BoyerMooreSuffixes(const uint8_t *x, int32_t m, int32_t *suff) { + int32_t f = 0, g, i; + suff[m - 1] = m; + g = m - 1; + for (i = m - 2; i >= 0; --i) { + if (i > g && suff[i + m - 1 - f] < i - g) + suff[i] = suff[i + m - 1 - f]; + else { + if (i < g) + g = i; + f = i; + while (g >= 0 && x[g] == x[g + m - 1 - f]) + --g; + suff[i] = f - g; + } + } +} + +/** + * \brief Array setup function for building prefixes (shift for valid prefixes) for boyermoore context + * + * \param x pointer to the pattern string + * \param m length of the string + * \param bmGs pointer to an empty array that will hold the prefixes (shifts) + */ +inline void PreBmGs(const uint8_t *x, int32_t m, int32_t *bmGs) { + int32_t i, j; + int32_t *suff; + + suff = SCMalloc(sizeof(int32_t) * (m + 1)); + + BoyerMooreSuffixes(x, m, suff); + + for (i = 0; i < m; ++i) + bmGs[i] = m; + + j = 0; + + for (i = m - 1; i >= -1; --i) + if (i == -1 || suff[i] == i + 1) + for (; j < m - 1 - i; ++j) + if (bmGs[j] == m) + bmGs[j] = m - 1 - i; + + for (i = 0; i <= m - 2; ++i) + bmGs[m - 1 - suff[i]] = m - 1 - i; + SCFree(suff); +} + +/** + * \brief Array setup function for bad characters that split the pattern + * Remember that the result array should be the length of ALPHABET_SIZE + * + * \param str pointer to the pattern string + * \param size length of the string + * \param result pointer to an empty array that will hold the badchars + */ +inline void PreBmBcNocase(const uint8_t *x, int32_t m, int32_t *bmBc) { + int32_t i; + + for (i = 0; i < 256; ++i) { + bmBc[i] = m; + } + for (i = 0; i < m - 1; ++i) { + bmBc[u8_tolower((unsigned char)x[i])] = m - 1 - i; + } +} + +inline void BoyerMooreSuffixesNocase(const uint8_t *x, int32_t m, int32_t *suff) { + int32_t f = 0, g, i; + + suff[m - 1] = m; + g = m - 1; + for (i = m - 2; i >= 0; --i) { + if (i > g && suff[i + m - 1 - f] < i - g) { + suff[i] = suff[i + m - 1 - f]; + } else { + if (i < g) { + g = i; + } + f = i; + while (g >= 0 && u8_tolower(x[g]) == u8_tolower(x[g + m - 1 - f])) { + --g; + } + suff[i] = f - g; + } + } +} + +/** + * \brief Array setup function for building prefixes (shift for valid prefixes) + * for boyermoore context case less + * + * \param x pointer to the pattern string + * \param m length of the string + * \param bmGs pointer to an empty array that will hold the prefixes (shifts) + */ +inline void PreBmGsNocase(const uint8_t *x, int32_t m, int32_t *bmGs) { + int32_t i, j; + int32_t* suff; + + suff = SCMalloc(sizeof(int32_t) * (m + 1)); + + BoyerMooreSuffixesNocase(x, m, suff); + + for (i = 0; i < m; ++i) { + bmGs[i] = m; + } + j = 0; + for (i = m - 1; i >= 0; --i) { + if (i == -1 || suff[i] == i + 1) { + for (; j < m - 1 - i; ++j) { + if (bmGs[j] == m) { + bmGs[j] = m - 1 - i; + } + } + } + } + for (i = 0; i <= m - 2; ++i) { + bmGs[m - 1 - suff[i]] = m - 1 - i; + } + + SCFree(suff); +} + +/** + * \brief Boyer Moore search algorithm + * Is better as the pattern length increases and for big buffers to search in. + * The algorithm needs a context of two arrays already prepared + * by prep_bad_chars() and prep_good_suffix() + * + * \param y pointer to the buffer to search in + * \param n length limit of the buffer + * \param x pointer to the pattern we ar searching for + * \param m length limit of the needle + * \param bmBc pointer to an array of BoyerMooreSuffixes prepared by prep_good_suffix() + * \param bmGs pointer to an array of bachars prepared by prep_bad_chars() + * + * \retval ptr to start of the match; NULL if no match + */ +inline uint8_t *BoyerMoore(uint8_t *x, int32_t m, uint8_t *y, int32_t n, int32_t *bmGs, int32_t *bmBc) { + int i, j, m1, m2; +#if 0 + printf("\nBad:\n"); + for (i=0;i= 0 && x[i] == y[i + j]; --i); + + if (i < 0) { + return y + j; + j += bmGs[0]; + } else { + // printf("%c", y[i+j]); + j += (m1 = bmGs[i]) > (m2 = bmBc[y[i + j]] - m + 1 + i)? m1: m2; +// printf("%d, %d\n", m1, m2); + } + } + return NULL; +} + + +/** + * \brief Boyer Moore search algorithm + * Is better as the pattern length increases and for big buffers to search in. + * The algorithm needs a context of two arrays already prepared + * by prep_bad_chars() and prep_good_suffix() + * + * \param y pointer to the buffer to search in + * \param n length limit of the buffer + * \param x pointer to the pattern we ar searching for + * \param m length limit of the needle + * \param bmBc pointer to an array of BoyerMooreSuffixes prepared by prep_good_suffix() + * \param bmGs pointer to an array of bachars prepared by prep_bad_chars() + * + * \retval ptr to start of the match; NULL if no match + */ +inline uint8_t *BoyerMooreNocase(uint8_t *x, int32_t m, uint8_t *y, int32_t n, int32_t *bmGs, int32_t *bmBc) { + int i, j, m1, m2; +#if 0 + printf("\nBad:\n"); + for (i=0;i= 0 && u8_tolower(x[i]) == u8_tolower(y[i + j]); --i); + + if (i < 0) { + return y + j; + } else { + j += (m1=bmGs[i]) > (m2=bmBc[u8_tolower(y[i + j])] - m + 1 + i)?m1:m2; + } + } + return NULL; +} #endif /* __UTIL_SPM_BM__ */ diff --git a/src/util-spm-bs.c b/src/util-spm-bs.c index e775aaa..e0f1e3c 100644 --- a/src/util-spm-bs.c +++ b/src/util-spm-bs.c @@ -17,92 +17,4 @@ #include #include -/** - * \brief Basic search improved. Limits are better handled, so - * it doesn't start searches that wont fit in the remaining buffer - * - * \param haystack pointer to the buffer to search in - * \param haystack_len length limit of the buffer - * \param neddle pointer to the pattern we ar searching for - * \param needle_len length limit of the needle - * - * \retval ptr to start of the match; NULL if no match - */ -inline uint8_t *BasicSearch(const uint8_t *haystack, uint32_t haystack_len, const uint8_t *needle, uint32_t needle_len) { - const uint8_t *h, *n; - const uint8_t *hmax = haystack + haystack_len; - const uint8_t *nmax = needle + needle_len; - - if (needle_len == 0 || needle_len > haystack_len) - return NULL; - - for (n = needle; nmax - n <= hmax - haystack; haystack++) { - if (*haystack != *n) { - continue; - } - /* one byte needles */ - if (needle_len == 1) - return (uint8_t *)haystack; - - for (h = haystack+1, n++; nmax - n <= hmax - haystack; h++, n++) { - if (*h != *n) { - break; - } - /* if we run out of needle we fully matched */ - if (n == nmax - 1) { - return (uint8_t *)haystack; - } - } - n = needle; - } - - return NULL; -} - -/** - * \brief Basic search case less - * - * \param haystack pointer to the buffer to search in - * \param haystack_len length limit of the buffer - * \param neddle pointer to the pattern we ar searching for - * \param needle_len length limit of the needle - * - * \retval ptr to start of the match; NULL if no match - */ -inline uint8_t *BasicSearchNocase(const uint8_t *haystack, uint32_t haystack_len, const uint8_t *needle, uint32_t needle_len) { - const uint8_t *h, *n; - const uint8_t *hmax = haystack + haystack_len; - const uint8_t *nmax = needle + needle_len; - - if (needle_len == 0 || needle_len > haystack_len) - return NULL; - - n = needle; - for (n = needle; nmax - n <= hmax - haystack; haystack++) { - if (u8_tolower(*haystack) != u8_tolower(*n)) { - continue; - } - /* one byte needles */ - if (needle_len == 1) { - return (uint8_t *)haystack; - } - - for (h = haystack+1, n++; nmax - n <= hmax - h ; h++, n++) { - if (u8_tolower(*h) != u8_tolower(*n)) { - break; - } - /* if we run out of needle we fully matched */ - if (n == nmax - 1) { - return (uint8_t *)haystack; - } - } - n = needle; - } - - return NULL; -} - -inline void BasicSearchInit (void) { - /* nothing no more */ -} - +/* Look at the .h, all the functions are Inlined */ diff --git a/src/util-spm-bs.h b/src/util-spm-bs.h index 6bb3afb..614f60f 100644 --- a/src/util-spm-bs.h +++ b/src/util-spm-bs.h @@ -3,10 +3,100 @@ #include "suricata-common.h" #include "suricata.h" +/** ----- Inline functions ------- */ +static inline uint8_t *BasicSearch(const uint8_t *, uint32_t, const uint8_t *, uint32_t); +static inline uint8_t *BasicSearchNocase(const uint8_t *, uint32_t, const uint8_t *, uint32_t); +static inline void BasicSearchInit (void); + +/** + * \brief Basic search improved. Limits are better handled, so + * it doesn't start searches that wont fit in the remaining buffer + * + * \param haystack pointer to the buffer to search in + * \param haystack_len length limit of the buffer + * \param neddle pointer to the pattern we ar searching for + * \param needle_len length limit of the needle + * + * \retval ptr to start of the match; NULL if no match + */ +static inline uint8_t *BasicSearch(const uint8_t *haystack, uint32_t haystack_len, const uint8_t *needle, uint32_t needle_len) { + const uint8_t *h, *n; + const uint8_t *hmax = haystack + haystack_len; + const uint8_t *nmax = needle + needle_len; + + if (needle_len == 0 || needle_len > haystack_len) + return NULL; + + for (n = needle; nmax - n <= hmax - haystack; haystack++) { + if (*haystack != *n) { + continue; + } + /* one byte needles */ + if (needle_len == 1) + return (uint8_t *)haystack; + + for (h = haystack+1, n++; nmax - n <= hmax - haystack; h++, n++) { + if (*h != *n) { + break; + } + /* if we run out of needle we fully matched */ + if (n == nmax - 1) { + return (uint8_t *)haystack; + } + } + n = needle; + } + + return NULL; +} + +/** + * \brief Basic search case less + * + * \param haystack pointer to the buffer to search in + * \param haystack_len length limit of the buffer + * \param neddle pointer to the pattern we ar searching for + * \param needle_len length limit of the needle + * + * \retval ptr to start of the match; NULL if no match + */ +static inline uint8_t *BasicSearchNocase(const uint8_t *haystack, uint32_t haystack_len, const uint8_t *needle, uint32_t needle_len) { + const uint8_t *h, *n; + const uint8_t *hmax = haystack + haystack_len; + const uint8_t *nmax = needle + needle_len; + + if (needle_len == 0 || needle_len > haystack_len) + return NULL; + + n = needle; + for (n = needle; nmax - n <= hmax - haystack; haystack++) { + if (u8_tolower(*haystack) != u8_tolower(*n)) { + continue; + } + /* one byte needles */ + if (needle_len == 1) { + return (uint8_t *)haystack; + } + + for (h = haystack+1, n++; nmax - n <= hmax - h ; h++, n++) { + if (u8_tolower(*h) != u8_tolower(*n)) { + break; + } + /* if we run out of needle we fully matched */ + if (n == nmax - 1) { + return (uint8_t *)haystack; + } + } + n = needle; + } + + return NULL; +} + +static inline void BasicSearchInit (void) { + /* nothing no more */ +} -inline uint8_t *BasicSearch(const uint8_t *, uint32_t, const uint8_t *, uint32_t); -inline uint8_t *BasicSearchNocase(const uint8_t *, uint32_t, const uint8_t *, uint32_t); -inline void BasicSearchInit (void); #endif /* __UTIL_SPM_BS__ */ diff --git a/src/util-spm-bs2bm.c b/src/util-spm-bs2bm.c index 552e843..3537a4a 100644 --- a/src/util-spm-bs2bm.c +++ b/src/util-spm-bs2bm.c @@ -16,144 +16,4 @@ #include #include -/** - * \brief Array setup function for Bs2Bm of bad characters index (not found at the needle) - * - * \param neddle pointer to the pattern we ar searching for - * \param needle_len length limit of the needle - * \param badchars pointer to an empty array of bachars. The array prepared contains - * characters that can't be inside the needle_len. So the skips can be - * faster - */ -inline void Bs2BmBadchars(const uint8_t *needle, uint32_t needle_len, uint8_t *badchars) { - uint32_t i; - for (i = 0; i < ALPHABET_SIZE; i++) - badchars[i] = 1; - - /* set to 0 the values where index as ascii is present - * because they are not badchars - */ - for (i = 0; i < needle_len; i++) - badchars[needle[i]] = 0; -} - -/** - * \brief Array setup function for Bs2BmNocase of bad characters index (not found at the needle) - * - * \param neddle pointer to the pattern we ar searching for - * \param needle_len length limit of the needle - * \param badchars pointer to an empty array of bachars. The array prepared contains - * characters that can't be inside the needle_len. So the skips can be - * faster - */ -inline void Bs2BmBadcharsNocase(const uint8_t *needle, uint32_t needle_len, uint8_t *badchars) { - uint32_t i; - for (i = 0; i < ALPHABET_SIZE; i++) - badchars[i] = 1; - - /* set to 0 the values where index as ascii is present - * because they are not badchars - */ - for (i = 0; i < needle_len; i++) { - badchars[u8_tolower(needle[i])] = 0; - } -} - - -/** - * \brief Basic search with a bad characters array. The array badchars contains - * flags at character's ascii index that can't be inside the needle. So the skips can be - * faster - * - * \param haystack pointer to the buffer to search in - * \param haystack_len length limit of the buffer - * \param neddle pointer to the pattern we ar searching for - * \param needle_len length limit of the needle - * \param badchars pointer to an array of bachars prepared by Bs2BmBadchars() - * - * \retval ptr to start of the match; NULL if no match - */ -inline uint8_t * Bs2Bm(const uint8_t *haystack, uint32_t haystack_len, const uint8_t *needle, uint32_t needle_len, uint8_t badchars[]) -{ - const uint8_t *h, *n; - const uint8_t *hmax = haystack + haystack_len; - const uint8_t *nmax = needle + needle_len; - - if (needle_len == 0 || needle_len > haystack_len) - return NULL; - - for (n = needle; nmax - n <= hmax - haystack; haystack++) { - if (*haystack != *n) { - continue; - } - /* one byte needles */ - if (needle_len == 1) - return (uint8_t *)haystack; - - for (h = haystack+1, n++; nmax - n <= hmax - haystack; h++, n++) { - if (*h != *n) { - if (badchars[*h] == 1) { - /* skip it! */ - haystack = h; - } - break; - } - /* if we run out of needle we fully matched */ - if (n == nmax - 1 ) { - return (uint8_t *)haystack; - } - } - n = needle; - } - - return NULL; -} - -/** - * \brief Basic search case less with a bad characters array. The array badchars contains - * flags at character's ascii index that can't be inside the needle. So the skips can be - * faster - * - * \param haystack pointer to the buffer to search in - * \param haystack_len length limit of the buffer - * \param neddle pointer to the pattern we ar searching for - * \param needle_len length limit of the needle - * \param badchars pointer to an array of bachars prepared by Bs2BmBadchars() - * - * \retval ptr to start of the match; NULL if no match - */ -inline uint8_t *Bs2BmNocase(const uint8_t *haystack, uint32_t haystack_len, const uint8_t *needle, uint32_t needle_len, uint8_t badchars[]) -{ - const uint8_t *h, *n; - const uint8_t *hmax = haystack + haystack_len; - const uint8_t *nmax = needle + needle_len; - - if (needle_len == 0 || needle_len > haystack_len) - return NULL; - - for (n = needle; nmax - n <= hmax - haystack; haystack++) { - if (u8_tolower(*haystack) != u8_tolower(*n)) { - continue; - } - /* one byte needles */ - if (needle_len == 1) - return (uint8_t *)haystack; - - for (h = haystack+1, n++; nmax - n <= hmax - haystack; h++, n++) { - if (u8_tolower(*h) != u8_tolower(*n)) { - if (badchars[u8_tolower(*h)] == 1) { - /* skip it! */ - haystack = h; - } - break; - } - /* if we run out of needle we fully matched */ - if (n == nmax - 1) { - return (uint8_t *)haystack; - } - } - n = needle; - } - - return NULL; -} +/* Look at the .h, all the functions are Inline */ diff --git a/src/util-spm-bs2bm.h b/src/util-spm-bs2bm.h index 5ec6806..3784cee 100644 --- a/src/util-spm-bs2bm.h +++ b/src/util-spm-bs2bm.h @@ -6,10 +6,153 @@ #define ALPHABET_SIZE 256 -inline void Bs2BmBadchars(const uint8_t *, uint32_t, uint8_t *); -inline void Bs2BmBadcharsNocase(const uint8_t *, uint32_t, uint8_t *); -inline uint8_t * Bs2Bm(const uint8_t *, uint32_t, const uint8_t *, uint32_t, uint8_t []); -inline uint8_t *Bs2BmNocase(const uint8_t *, uint32_t, const uint8_t *, uint32_t, uint8_t []); +/** ----- Inline funcions ------ */ +static inline void Bs2BmBadchars(const uint8_t *, uint32_t, uint8_t *); +static inline void Bs2BmBadcharsNocase(const uint8_t *, uint32_t, uint8_t *); +static inline uint8_t * Bs2Bm(const uint8_t *, uint32_t, const uint8_t *, uint32_t, uint8_t []); +static inline uint8_t *Bs2BmNocase(const uint8_t *, uint32_t, const uint8_t *, uint32_t, uint8_t []); + +/** + * \brief Array setup function for Bs2Bm of bad characters index (not found at the needle) + * + * \param neddle pointer to the pattern we ar searching for + * \param needle_len length limit of the needle + * \param badchars pointer to an empty array of bachars. The array prepared contains + * characters that can't be inside the needle_len. So the skips can be + * faster + */ +static inline void Bs2BmBadchars(const uint8_t *needle, uint32_t needle_len, uint8_t *badchars) { + uint32_t i; + for (i = 0; i < ALPHABET_SIZE; i++) + badchars[i] = 1; + + /* set to 0 the values where index as ascii is present + * because they are not badchars + */ + for (i = 0; i < needle_len; i++) + badchars[needle[i]] = 0; +} + +/** + * \brief Array setup function for Bs2BmNocase of bad characters index (not found at the needle) + * + * \param neddle pointer to the pattern we ar searching for + * \param needle_len length limit of the needle + * \param badchars pointer to an empty array of bachars. The array prepared contains + * characters that can't be inside the needle_len. So the skips can be + * faster + */ +static inline void Bs2BmBadcharsNocase(const uint8_t *needle, uint32_t needle_len, uint8_t *badchars) { + uint32_t i; + for (i = 0; i < ALPHABET_SIZE; i++) + badchars[i] = 1; + + /* set to 0 the values where index as ascii is present + * because they are not badchars + */ + for (i = 0; i < needle_len; i++) { + badchars[u8_tolower(needle[i])] = 0; + } +} + + +/** + * \brief Basic search with a bad characters array. The array badchars contains + * flags at character's ascii index that can't be inside the needle. So the skips can be + * faster + * + * \param haystack pointer to the buffer to search in + * \param haystack_len length limit of the buffer + * \param neddle pointer to the pattern we ar searching for + * \param needle_len length limit of the needle + * \param badchars pointer to an array of bachars prepared by Bs2BmBadchars() + * + * \retval ptr to start of the match; NULL if no match + */ +static inline uint8_t * Bs2Bm(const uint8_t *haystack, uint32_t haystack_len, const uint8_t *needle, uint32_t needle_len, uint8_t badchars[]) +{ + const uint8_t *h, *n; + const uint8_t *hmax = haystack + haystack_len; + const uint8_t *nmax = needle + needle_len; + + if (needle_len == 0 || needle_len > haystack_len) + return NULL; + + for (n = needle; nmax - n <= hmax - haystack; haystack++) { + if (*haystack != *n) { + continue; + } + /* one byte needles */ + if (needle_len == 1) + return (uint8_t *)haystack; + + for (h = haystack+1, n++; nmax - n <= hmax - haystack; h++, n++) { + if (*h != *n) { + if (badchars[*h] == 1) { + /* skip it! */ + haystack = h; + } + break; + } + /* if we run out of needle we fully matched */ + if (n == nmax - 1 ) { + return (uint8_t *)haystack; + } + } + n = needle; + } + + return NULL; +} + +/** + * \brief Basic search case less with a bad characters array. The array badchars contains + * flags at character's ascii index that can't be inside the needle. So the skips can be + * faster + * + * \param haystack pointer to the buffer to search in + * \param haystack_len length limit of the buffer + * \param neddle pointer to the pattern we ar searching for + * \param needle_len length limit of the needle + * \param badchars pointer to an array of bachars prepared by Bs2BmBadchars() + * + * \retval ptr to start of the match; NULL if no match + */ +static inline uint8_t *Bs2BmNocase(const uint8_t *haystack, uint32_t haystack_len, const uint8_t *needle, uint32_t needle_len, uint8_t badchars[]) +{ + const uint8_t *h, *n; + const uint8_t *hmax = haystack + haystack_len; + const uint8_t *nmax = needle + needle_len; + + if (needle_len == 0 || needle_len > haystack_len) + return NULL; + + for (n = needle; nmax - n <= hmax - haystack; haystack++) { + if (u8_tolower(*haystack) != u8_tolower(*n)) { + continue; + } + /* one byte needles */ + if (needle_len == 1) + return (uint8_t *)haystack; + + for (h = haystack+1, n++; nmax - n <= hmax - haystack; h++, n++) { + if (u8_tolower(*h) != u8_tolower(*n)) { + if (badchars[u8_tolower(*h)] == 1) { + /* skip it! */ + haystack = h; + } + break; + } + /* if we run out of needle we fully matched */ + if (n == nmax - 1) { + return (uint8_t *)haystack; + } + } + n = needle; + } + + return NULL; +} #endif /* __UTIL_SPM_BS2BM__ */ diff --git a/src/util-spm.c b/src/util-spm.c index 8e45e31..e9a6bfe 100644 --- a/src/util-spm.c +++ b/src/util-spm.c @@ -41,87 +41,7 @@ #include "util-clock.h" -/** - * Wrappers for building context and searching (Bs2Bm and boyermoore) - * Use them if you cant store the context - * - */ - -/** - * \brief Search a pattern in the text using the Bs2Bm algorithm (build a bad characters array) - * - * \param text Text to search in - * \param textlen length of the text - * \param needle pattern to search for - * \param needlelen length of the pattern - */ -inline uint8_t *Bs2bmSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen) { - uint8_t badchars[ALPHABET_SIZE]; - Bs2BmBadchars(needle, needlelen, badchars); - - return Bs2Bm(text, textlen, needle, needlelen, badchars); -} - -/** - * \brief Search a pattern in the text using the Bs2Bm nocase algorithm (build a bad characters array) - * - * \param text Text to search in - * \param textlen length of the text - * \param needle pattern to search for - * \param needlelen length of the pattern - */ -inline uint8_t *Bs2bmNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen) { - uint8_t badchars[ALPHABET_SIZE]; - Bs2BmBadchars(needle, needlelen, badchars); - - return Bs2BmNocase(text, textlen, needle, needlelen, badchars); -} - -/** - * \brief Search a pattern in the text using Boyer Moore algorithm - * (build a bad character shifts array and good prefixes shift array) - * - * \param text Text to search in - * \param textlen length of the text - * \param needle pattern to search for - * \param needlelen length of the pattern - */ -inline uint8_t *BoyerMooreSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen) { - int32_t bmBc[ALPHABET_SIZE]; - int32_t *bmGs = SCMalloc(sizeof(int32_t)*(needlelen + 1)); - - PreBmGs(needle, needlelen, bmGs); - PreBmBc(needle, needlelen, bmBc); - - uint8_t *ret = BoyerMoore(needle, needlelen, text, textlen, bmGs, bmBc); - SCFree(bmGs); - - return ret; -} - -/** - * \brief Search a pattern in the text using Boyer Moore nocase algorithm - * (build a bad character shifts array and good prefixes shift array) - * - * \param text Text to search in - * \param textlen length of the text - * \param needle pattern to search for - * \param needlelen length of the pattern - */ -inline uint8_t *BoyerMooreNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen) { - int32_t bmBc[ALPHABET_SIZE]; - int32_t *bmGs = SCMalloc(sizeof(int32_t)*(needlelen + 1)); - - PreBmGsNocase(needle, needlelen, bmGs); - PreBmBcNocase(needle, needlelen, bmBc); - - uint8_t *ret = BoyerMooreNocase(needle, needlelen, text, textlen, bmGs, bmBc); - SCFree(bmGs); - - return ret; -} - - +/* Look at the .h, all the functions are Inline */ #ifdef UNITTESTS /** Comment out this if you want stats @@ -138,7 +58,7 @@ inline uint8_t *BoyerMooreNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t * \param times If you are testing performance, se the numebr of times * that you want to repeat the search */ -inline uint8_t *BasicSearchWrapper(uint8_t *text, uint8_t *needle, int times) { +uint8_t *BasicSearchWrapper(uint8_t *text, uint8_t *needle, int times) { uint32_t textlen = strlen((char *)text); uint32_t needlelen = strlen((char *)needle); @@ -157,7 +77,7 @@ inline uint8_t *BasicSearchWrapper(uint8_t *text, uint8_t *needle, int times) { return ret; } -inline uint8_t *BasicSearchNocaseWrapper(uint8_t *text, uint8_t *needle, int times) { +uint8_t *BasicSearchNocaseWrapper(uint8_t *text, uint8_t *needle, int times) { uint32_t textlen = strlen((char *)text); uint32_t needlelen = strlen((char *)needle); @@ -173,7 +93,7 @@ inline uint8_t *BasicSearchNocaseWrapper(uint8_t *text, uint8_t *needle, int tim return ret; } -inline uint8_t *Bs2bmWrapper(uint8_t *text, uint8_t *needle, int times) { +uint8_t *Bs2bmWrapper(uint8_t *text, uint8_t *needle, int times) { uint32_t textlen = strlen((char *)text); uint32_t needlelen = strlen((char *)needle); @@ -192,7 +112,7 @@ inline uint8_t *Bs2bmWrapper(uint8_t *text, uint8_t *needle, int times) { return ret; } -inline uint8_t *Bs2bmNocaseWrapper(uint8_t *text, uint8_t *needle, int times) { +uint8_t *Bs2bmNocaseWrapper(uint8_t *text, uint8_t *needle, int times) { uint32_t textlen = strlen((char *)text); uint32_t needlelen = strlen((char *)needle); @@ -211,7 +131,7 @@ inline uint8_t *Bs2bmNocaseWrapper(uint8_t *text, uint8_t *needle, int times) { return ret; } -inline uint8_t *BoyerMooreWrapper(uint8_t *text, uint8_t *needle, int times) { +uint8_t *BoyerMooreWrapper(uint8_t *text, uint8_t *needle, int times) { uint32_t textlen = strlen((char *)text); uint32_t needlelen = strlen((char *)needle); @@ -234,7 +154,7 @@ inline uint8_t *BoyerMooreWrapper(uint8_t *text, uint8_t *needle, int times) { return ret; } -inline uint8_t *BoyerMooreNocaseWrapper(uint8_t *text, uint8_t *needle, int times) { +uint8_t *BoyerMooreNocaseWrapper(uint8_t *text, uint8_t *needle, int times) { uint32_t textlen = strlen((char *)text); uint32_t needlelen = strlen((char *)needle); @@ -265,7 +185,7 @@ inline uint8_t *BoyerMooreNocaseWrapper(uint8_t *text, uint8_t *needle, int time * \param times If you are testing performance, se the numebr of times * that you want to repeat the search */ -inline uint8_t *BasicSearchCtxWrapper(uint8_t *text, uint8_t *needle, int times) { +uint8_t *BasicSearchCtxWrapper(uint8_t *text, uint8_t *needle, int times) { uint32_t textlen = strlen((char *)text); uint32_t needlelen = strlen((char *)needle); @@ -282,7 +202,7 @@ inline uint8_t *BasicSearchCtxWrapper(uint8_t *text, uint8_t *needle, int times) return ret; } -inline uint8_t *BasicSearchNocaseCtxWrapper(uint8_t *text, uint8_t *needle, int times) { +uint8_t *BasicSearchNocaseCtxWrapper(uint8_t *text, uint8_t *needle, int times) { uint32_t textlen = strlen((char *)text); uint32_t needlelen = strlen((char *)needle); @@ -299,7 +219,7 @@ inline uint8_t *BasicSearchNocaseCtxWrapper(uint8_t *text, uint8_t *needle, int return ret; } -inline uint8_t *Bs2bmCtxWrapper(uint8_t *text, uint8_t *needle, int times) { +uint8_t *Bs2bmCtxWrapper(uint8_t *text, uint8_t *needle, int times) { uint32_t textlen = strlen((char *)text); uint32_t needlelen = strlen((char *)needle); @@ -319,7 +239,7 @@ inline uint8_t *Bs2bmCtxWrapper(uint8_t *text, uint8_t *needle, int times) { return ret; } -inline uint8_t *Bs2bmNocaseCtxWrapper(uint8_t *text, uint8_t *needle, int times) { +uint8_t *Bs2bmNocaseCtxWrapper(uint8_t *text, uint8_t *needle, int times) { uint32_t textlen = strlen((char *)text); uint32_t needlelen = strlen((char *)needle); @@ -339,7 +259,7 @@ inline uint8_t *Bs2bmNocaseCtxWrapper(uint8_t *text, uint8_t *needle, int times) return ret; } -inline uint8_t *BoyerMooreCtxWrapper(uint8_t *text, uint8_t *needle, int times) { +uint8_t *BoyerMooreCtxWrapper(uint8_t *text, uint8_t *needle, int times) { uint32_t textlen = strlen((char *)text); uint32_t needlelen = strlen((char *)needle); @@ -363,7 +283,7 @@ inline uint8_t *BoyerMooreCtxWrapper(uint8_t *text, uint8_t *needle, int times) return ret; } -inline uint8_t *RawCtxWrapper(uint8_t *text, uint8_t *needle, int times) { +uint8_t *RawCtxWrapper(uint8_t *text, uint8_t *needle, int times) { uint32_t textlen = strlen((char *)text); uint32_t needlelen = strlen((char *)needle); @@ -379,7 +299,7 @@ inline uint8_t *RawCtxWrapper(uint8_t *text, uint8_t *needle, int times) { return ret; } -inline uint8_t *BoyerMooreNocaseCtxWrapper(uint8_t *text, uint8_t *needle, int times) { +uint8_t *BoyerMooreNocaseCtxWrapper(uint8_t *text, uint8_t *needle, int times) { uint32_t textlen = strlen((char *)text); uint32_t needlelen = strlen((char *)needle); diff --git a/src/util-spm.h b/src/util-spm.h index 46e6a36..971cc44 100644 --- a/src/util-spm.h +++ b/src/util-spm.h @@ -8,10 +8,10 @@ #include "util-spm-bm.h" /** Default algorithm to use: Boyer Moore */ -inline uint8_t *Bs2bmSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen); -inline uint8_t *Bs2bmNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen); -inline uint8_t *BoyerMooreSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen); -inline uint8_t *BoyerMooreNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen); +static inline uint8_t *Bs2bmSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen); +static inline uint8_t *Bs2bmNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen); +static inline uint8_t *BoyerMooreSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen); +static inline uint8_t *BoyerMooreNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen); /* Macros for automatic algorithm selection (use them only when you can't store the context) */ #define SpmSearch(text, textlen, needle, needlelen) ({\ @@ -37,4 +37,88 @@ inline uint8_t *BoyerMooreNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t }) void UtilSpmSearchRegistertests(void); + +/** ------ inline functions ------ */ + +/** + * Wrappers for building context and searching (Bs2Bm and boyermoore) + * Use them if you cant store the context + * + */ + +/** + * \brief Search a pattern in the text using the Bs2Bm algorithm (build a bad characters array) + * + * \param text Text to search in + * \param textlen length of the text + * \param needle pattern to search for + * \param needlelen length of the pattern + */ +static inline uint8_t *Bs2bmSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen) { + uint8_t badchars[ALPHABET_SIZE]; + Bs2BmBadchars(needle, needlelen, badchars); + + return Bs2Bm(text, textlen, needle, needlelen, badchars); +} + +/** + * \brief Search a pattern in the text using the Bs2Bm nocase algorithm (build a bad characters array) + * + * \param text Text to search in + * \param textlen length of the text + * \param needle pattern to search for + * \param needlelen length of the pattern + */ +static inline uint8_t *Bs2bmNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen) { + uint8_t badchars[ALPHABET_SIZE]; + Bs2BmBadchars(needle, needlelen, badchars); + + return Bs2BmNocase(text, textlen, needle, needlelen, badchars); +} + +/** + * \brief Search a pattern in the text using Boyer Moore algorithm + * (build a bad character shifts array and good prefixes shift array) + * + * \param text Text to search in + * \param textlen length of the text + * \param needle pattern to search for + * \param needlelen length of the pattern + */ +static inline uint8_t *BoyerMooreSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen) { + int32_t bmBc[ALPHABET_SIZE]; + int32_t *bmGs = SCMalloc(sizeof(int32_t)*(needlelen + 1)); + + PreBmGs(needle, needlelen, bmGs); + PreBmBc(needle, needlelen, bmBc); + + uint8_t *ret = BoyerMoore(needle, needlelen, text, textlen, bmGs, bmBc); + SCFree(bmGs); + + return ret; +} + +/** + * \brief Search a pattern in the text using Boyer Moore nocase algorithm + * (build a bad character shifts array and good prefixes shift array) + * + * \param text Text to search in + * \param textlen length of the text + * \param needle pattern to search for + * \param needlelen length of the pattern + */ +static inline uint8_t *BoyerMooreNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen) { + int32_t bmBc[ALPHABET_SIZE]; + int32_t *bmGs = SCMalloc(sizeof(int32_t)*(needlelen + 1)); + + PreBmGsNocase(needle, needlelen, bmGs); + PreBmBcNocase(needle, needlelen, bmBc); + + uint8_t *ret = BoyerMooreNocase(needle, needlelen, text, textlen, bmGs, bmBc); + SCFree(bmGs); + + return ret; +} + + #endif /* __UTIL_SPM_H__ */ -- 1.6.0.4