From 6eab3f0a41a6727749b1399d0679e47de236ead4 Mon Sep 17 00:00:00 2001 From: Pablo Rincon Date: Mon, 15 Mar 2010 18:52:54 +0100 Subject: [PATCH] Moving back to .c files the functions that gcc cannot inline (Thanks Steve) --- src/counters.c | 112 ++++++++++++++++++++ src/counters.h | 112 +------------------- src/decode.c | 10 ++ src/decode.h | 13 +-- src/detect-content.c | 56 ++++++++++ src/detect-content.h | 59 +---------- src/detect-stream_size.c | 45 ++++++++ src/detect-stream_size.h | 45 +-------- src/detect-uricontent.c | 45 ++++++++ src/detect-uricontent.h | 52 +-------- src/detect.c | 55 ++++++++++ src/detect.h | 58 +---------- src/suricata.c | 8 +- src/tm-threads.c | 35 ++++++ src/tm-threads.h | 40 +------- src/util-bloomfilter.c | 16 --- src/util-bloomfilter.h | 21 ++++- src/util-byte.c | 241 ++++++++++++++++++++++++++++++++++++++++++ src/util-byte.h | 261 ++-------------------------------------------- src/util-debug-filters.c | 112 ++++++++++++++++++++ src/util-debug-filters.h | 112 -------------------- src/util-debug.c | 20 ++++ src/util-debug.h | 21 +---- src/util-mpm-b2g.c | 108 +++++++++++++++++++ src/util-mpm-b2g.h | 106 ------------------- src/util-mpm-b3g.c | 15 +++ src/util-mpm-b3g.h | 14 --- src/util-mpm-wumanber.c | 105 +++++++++++++++++++ src/util-mpm-wumanber.h | 107 +------------------ src/util-mpm.c | 86 +++++++++++++++ src/util-mpm.h | 90 +--------------- src/util-radix-tree.c | 16 +++ src/util-radix-tree.h | 19 +--- src/util-spm-bs.c | 43 ++++++++ src/util-spm-bs.h | 45 +-------- src/util-spm.c | 44 ++++++++ src/util-spm.h | 48 +-------- 37 files changed, 1214 insertions(+), 1181 deletions(-) diff --git a/src/counters.c b/src/counters.c index 56e4df1..9d7ad17 100644 --- a/src/counters.c +++ b/src/counters.c @@ -102,6 +102,118 @@ static void SCPerfInitOPCtx(void) } /** + * \brief Adds a value of type uint64_t to the local counter. + * + * \param id ID of the counter as set by the API + * \param pca Counter array that holds the local counter for this TM + * \param x Value to add to this local counter + */ +void SCPerfCounterAddUI64(uint16_t id, SCPerfCounterArray *pca, uint64_t x) +{ + if (!pca) { + SCLogDebug("counterarray is NULL"); + return; + } + if ((id < 1) || (id > pca->size)) { + SCLogDebug("counter doesn't exist"); + return; + } + + switch (pca->head[id].pc->value->type) { + case SC_PERF_TYPE_UINT64: + pca->head[id].ui64_cnt += x; + break; + case SC_PERF_TYPE_DOUBLE: + pca->head[id].d_cnt += x; + break; + } + + if (pca->head[id].syncs == ULONG_MAX) { + pca->head[id].syncs = 0; + pca->head[id].wrapped_syncs++; + } + pca->head[id].syncs++; + + return; +} + + +/** + * \brief Increments the local counter + * + * \param id Index of the counter in the counter array + * \param pca Counter array that holds the local counters for this TM + */ +void SCPerfCounterIncr(uint16_t id, SCPerfCounterArray *pca) +{ + if (pca == NULL) { + SCLogDebug("counterarray is NULL"); + return; + } + if ((id < 1) || (id > pca->size)) { + SCLogDebug("counter doesn't exist"); + return; + } + + switch (pca->head[id].pc->value->type) { + case SC_PERF_TYPE_UINT64: + pca->head[id].ui64_cnt++; + break; + case SC_PERF_TYPE_DOUBLE: + pca->head[id].d_cnt++; + break; + } + + if (pca->head[id].syncs == ULONG_MAX) { + pca->head[id].syncs = 0; + pca->head[id].wrapped_syncs++; + } + pca->head[id].syncs++; + + return; +} + + +/** + * \brief Adds a value of type double to the local counter + * + * \param id ID of the counter as set by the API + * \param pca Counter array that holds the local counter for this TM + * \param x Value to add to this local counter + */ +void SCPerfCounterAddDouble(uint16_t id, SCPerfCounterArray *pca, double x) +{ + if (!pca) { + SCLogDebug("counterarray is NULL"); + return; + } + if ((id < 1) || (id > pca->size)) { + SCLogDebug("counter doesn't exist"); + return; + } + + /* incase you are trying to add a double to a counter of type SC_PERF_TYPE_UINT64 + * it will be truncated */ + switch (pca->head[id].pc->value->type) { + case SC_PERF_TYPE_UINT64: + pca->head[id].ui64_cnt += x; + break; + case SC_PERF_TYPE_DOUBLE: + pca->head[id].d_cnt += x; + break; + } + + if (pca->head[id].syncs == ULONG_MAX) { + pca->head[id].syncs = 0; + pca->head[id].wrapped_syncs++; + } + pca->head[id].syncs++; + + return; +} + + +/** * \brief Releases the resources alloted to the output context of the Perf * Counter API */ diff --git a/src/counters.h b/src/counters.h index e95dbf1..803fc9a 100644 --- a/src/counters.h +++ b/src/counters.h @@ -220,6 +220,9 @@ int SCPerfAddToClubbedTMTable(char *, SCPerfContext *); SCPerfCounterArray *SCPerfGetCounterArrayRange(uint16_t, uint16_t, SCPerfContext *); SCPerfCounterArray * SCPerfGetAllCountersArray(SCPerfContext *); int SCPerfCounterDisplay(uint16_t, SCPerfContext *, int); +void SCPerfCounterAddDouble(uint16_t, SCPerfCounterArray *, double); +void SCPerfCounterIncr(uint16_t, SCPerfCounterArray *); +void SCPerfCounterAddUI64(uint16_t, SCPerfCounterArray *, uint64_t); int SCPerfUpdateCounterArray(SCPerfCounterArray *, SCPerfContext *, int); @@ -336,114 +339,5 @@ static inline void SCPerfCounterSetUI64(uint16_t id, SCPerfCounterArray *pca, return; } -/** - * \brief Adds a value of type double to the local counter - * - * \param id ID of the counter as set by the API - * \param pca Counter array that holds the local counter for this TM - * \param x Value to add to this local counter - */ -static inline void SCPerfCounterAddDouble(uint16_t id, SCPerfCounterArray *pca, double x) -{ - if (!pca) { - SCLogDebug("counterarray is NULL"); - return; - } - if ((id < 1) || (id > pca->size)) { - SCLogDebug("counter doesn't exist"); - return; - } - - /* incase you are trying to add a double to a counter of type SC_PERF_TYPE_UINT64 - * it will be truncated */ - switch (pca->head[id].pc->value->type) { - case SC_PERF_TYPE_UINT64: - pca->head[id].ui64_cnt += x; - break; - case SC_PERF_TYPE_DOUBLE: - pca->head[id].d_cnt += x; - break; - } - - if (pca->head[id].syncs == ULONG_MAX) { - pca->head[id].syncs = 0; - pca->head[id].wrapped_syncs++; - } - pca->head[id].syncs++; - - return; -} - -/** - * \brief Adds a value of type uint64_t to the local counter. - * - * \param id ID of the counter as set by the API - * \param pca Counter array that holds the local counter for this TM - * \param x Value to add to this local counter - */ -static inline void SCPerfCounterAddUI64(uint16_t id, SCPerfCounterArray *pca, uint64_t x) -{ - if (!pca) { - SCLogDebug("counterarray is NULL"); - return; - } - if ((id < 1) || (id > pca->size)) { - SCLogDebug("counter doesn't exist"); - return; - } - - switch (pca->head[id].pc->value->type) { - case SC_PERF_TYPE_UINT64: - pca->head[id].ui64_cnt += x; - break; - case SC_PERF_TYPE_DOUBLE: - pca->head[id].d_cnt += x; - break; - } - - if (pca->head[id].syncs == ULONG_MAX) { - pca->head[id].syncs = 0; - pca->head[id].wrapped_syncs++; - } - pca->head[id].syncs++; - - return; -} - -/** - * \brief Increments the local counter - * - * \param id Index of the counter in the counter array - * \param pca Counter array that holds the local counters for this TM - */ -static inline void SCPerfCounterIncr(uint16_t id, SCPerfCounterArray *pca) -{ - if (pca == NULL) { - SCLogDebug("counterarray is NULL"); - return; - } - if ((id < 1) || (id > pca->size)) { - SCLogDebug("counter doesn't exist"); - return; - } - - switch (pca->head[id].pc->value->type) { - case SC_PERF_TYPE_UINT64: - pca->head[id].ui64_cnt++; - break; - case SC_PERF_TYPE_DOUBLE: - pca->head[id].d_cnt++; - break; - } - - if (pca->head[id].syncs == ULONG_MAX) { - pca->head[id].syncs = 0; - pca->head[id].wrapped_syncs++; - } - pca->head[id].syncs++; - - return; -} - #endif /* __COUNTERS_H__ */ diff --git a/src/decode.c b/src/decode.c index 7112704..5f55406 100644 --- a/src/decode.c +++ b/src/decode.c @@ -23,6 +23,16 @@ void DecodeTunnel(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt } } +/** \brief Set the No payload inspection Flag for the packet. + * + * \param p Packet to set the flag in + */ +void DecodeSetNoPayloadInspectionFlag(Packet *p) { + SCEnter(); + p->flags |= PKT_NOPAYLOAD_INSPECTION; + SCReturn; +} + void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv) { /* register counters */ diff --git a/src/decode.h b/src/decode.h index 0aa2af2..099a507 100644 --- a/src/decode.h +++ b/src/decode.h @@ -538,20 +538,11 @@ Packet *TunnelPktSetup(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, ui #define PKT_NOPACKET_INSPECTION 0x01 /**< Flag to indicate that packet header or contents should not be inspected*/ #define PKT_NOPAYLOAD_INSPECTION 0x02 /**< Flag to indicate that packet contents should not be inspected*/ +void DecodeSetNoPayloadInspectionFlag(Packet *); + /** ------ inline functions ------ */ -static inline void DecodeSetNoPayloadInspectionFlag(Packet *); static inline void DecodeSetNoPacketInspectionFlag(Packet *); -/** \brief Set the No payload inspection Flag for the packet. - * - * \param p Packet to set the flag in - */ -static inline void DecodeSetNoPayloadInspectionFlag(Packet *p) { - SCEnter(); - p->flags |= PKT_NOPAYLOAD_INSPECTION; - SCReturn; -} - /** \brief Set the No packet inspection Flag for the packet. * * \param p Packet to set the flag in diff --git a/src/detect-content.c b/src/detect-content.c index 8e925fb..4deddc7 100644 --- a/src/detect-content.c +++ b/src/detect-content.c @@ -103,6 +103,62 @@ static void DetectContentPrintMatches(DetectEngineThreadCtx *det_ctx, DetectCont } #endif +int TestOffsetDepth(MpmMatch *m, DetectContentData *co, uint16_t pktoff) { + SCEnter(); + + if (m->offset >= pktoff) { + if (co->offset == 0 || (m->offset >= co->offset)) { + if (co->depth == 0 || ((m->offset + co->content_len) <= co->depth)) { + SCLogDebug("depth %" PRIu32 ", offset %" PRIu32 ", m->offset " + "%" PRIu32 ", return 1", co->depth, co->offset, + m->offset); + + /* If we reach this point, it means we have obtained a depth and + * offset match, which indicates that we have a FAILURE if the + * content is negated, and SUCCESS if the content is not negated */ + if (co->negated == 1) + SCReturnInt(0); + else + SCReturnInt(1); + } else { + /* We have success so far with offset, but a failure with + * depth. We can return a match at the bottom of this function + * for negated_content, provided offset is 0. If offset + * isn't 0 for negated_content, we have a failure and we return + * a no match here. If the content is not negated, we have a no + * match, which we return at the end of this function. */ + if (co->offset && co->negated == 1) + SCReturnInt(0); + } + } else { + /* If offset fails, and if the content is negated, we check if depth + * succeeds. If it succeeds, we have a no match for negated content. + * Else we have a success for negated content. If the content is + * not negated, we go down till the end and return a no match. */ + if (co->negated == 1) { + if (co->offset != 0) { + SCReturnInt(1); + } else if (co->depth && (m->offset+co->content_len) <= co->depth) { + SCLogDebug("depth %" PRIu32 ", offset %" PRIu32 ", m->offset %" PRIu32 ", " + "return 0", co->depth, co->offset, m->offset); + SCReturnInt(0); + } + } + } + } + SCLogDebug("depth %" PRIu32 ", offset %" PRIu32 ", m->offset %" PRIu32 ", " + "return 0 (or 1 if negated)", co->depth, co->offset, m->offset); + + /* If we reach this point, we have a match for negated content and no match + * otherwise */ + if (co->negated == 1) + SCReturnInt(1); + else + SCReturnInt(0); +} + + + /** * \brief test the within, distance, offset and depth of a match * diff --git a/src/detect-content.h b/src/detect-content.h index 8efa3a6..8c31174 100644 --- a/src/detect-content.h +++ b/src/detect-content.h @@ -83,64 +83,7 @@ int DetectContentPropagateIsdataat(SigMatch *); int DetectContentPropagateModifiers(SigMatch *); void DetectContentFree(void *); - -/** ------ inline functions ------ */ - -static inline int -TestOffsetDepth(MpmMatch *m, DetectContentData *co, uint16_t pktoff) { - SCEnter(); - - if (m->offset >= pktoff) { - if (co->offset == 0 || (m->offset >= co->offset)) { - if (co->depth == 0 || ((m->offset + co->content_len) <= co->depth)) { - SCLogDebug("depth %" PRIu32 ", offset %" PRIu32 ", m->offset " - "%" PRIu32 ", return 1", co->depth, co->offset, - m->offset); - - /* If we reach this point, it means we have obtained a depth and - * offset match, which indicates that we have a FAILURE if the - * content is negated, and SUCCESS if the content is not negated */ - if (co->negated == 1) - SCReturnInt(0); - else - SCReturnInt(1); - } else { - /* We have success so far with offset, but a failure with - * depth. We can return a match at the bottom of this function - * for negated_content, provided offset is 0. If offset - * isn't 0 for negated_content, we have a failure and we return - * a no match here. If the content is not negated, we have a no - * match, which we return at the end of this function. */ - if (co->offset && co->negated == 1) - SCReturnInt(0); - } - } else { - /* If offset fails, and if the content is negated, we check if depth - * succeeds. If it succeeds, we have a no match for negated content. - * Else we have a success for negated content. If the content is - * not negated, we go down till the end and return a no match. */ - if (co->negated == 1) { - if (co->offset != 0) { - SCReturnInt(1); - } else if (co->depth && (m->offset+co->content_len) <= co->depth) { - SCLogDebug("depth %" PRIu32 ", offset %" PRIu32 ", m->offset %" PRIu32 ", " - "return 0", co->depth, co->offset, m->offset); - SCReturnInt(0); - } - } - } - } - SCLogDebug("depth %" PRIu32 ", offset %" PRIu32 ", m->offset %" PRIu32 ", " - "return 0 (or 1 if negated)", co->depth, co->offset, m->offset); - - /* If we reach this point, we have a match for negated content and no match - * otherwise */ - if (co->negated == 1) - SCReturnInt(1); - else - SCReturnInt(0); -} - +int TestOffsetDepth(MpmMatch *, DetectContentData *, uint16_t); #endif /* __DETECT_CONTENT_H__ */ diff --git a/src/detect-stream_size.c b/src/detect-stream_size.c index f9b4946..52e28f2 100644 --- a/src/detect-stream_size.c +++ b/src/detect-stream_size.c @@ -63,6 +63,51 @@ error: } /** + * \brief Function to comapre the stream size against defined size in the user + * options. + * + * \param diff The stream size of server or client stream. + * \param stream_size User defined stream size + * \param mode The mode defined by user. + * + * \retval 1 on success and 0 on failure. + */ + +int DetectStreamSizeCompare (uint32_t diff, uint32_t stream_size, uint8_t mode) { + + int ret = 0; + switch (mode) { + case DETECTSSIZE_LT: + if (diff < stream_size) + ret = 1; + break; + case DETECTSSIZE_LEQ: + if (diff <= stream_size) + ret = 1; + break; + case DETECTSSIZE_EQ: + if (diff == stream_size) + ret = 1; + break; + case DETECTSSIZE_NEQ: + if (diff != stream_size) + ret = 1; + break; + case DETECTSSIZE_GEQ: + if (diff >= stream_size) + ret = 1; + break; + case DETECTSSIZE_GT: + if (diff > stream_size) + ret = 1; + break; + } + + return ret; +} + + +/** * \brief This function is used to match Stream size rule option on a packet with those passed via stream_size: * * \param t pointer to thread vars diff --git a/src/detect-stream_size.h b/src/detect-stream_size.h index 1201830..9ba31b6 100644 --- a/src/detect-stream_size.h +++ b/src/detect-stream_size.h @@ -27,53 +27,10 @@ typedef struct DetectStreamSizeData_ { }DetectStreamSizeData; void DetectStreamSizeRegister(void); +int DetectStreamSizeCompare (uint32_t, uint32_t, uint8_t); /** ------ inline functions ------ */ -/** - * \brief Function to comapre the stream size against defined size in the user - * options. - * - * \param diff The stream size of server or client stream. - * \param stream_size User defined stream size - * \param mode The mode defined by user. - * - * \retval 1 on success and 0 on failure. - */ - -static inline int DetectStreamSizeCompare (uint32_t diff, uint32_t stream_size, uint8_t mode) { - - int ret = 0; - switch (mode) { - case DETECTSSIZE_LT: - if (diff < stream_size) - ret = 1; - break; - case DETECTSSIZE_LEQ: - if (diff <= stream_size) - ret = 1; - break; - case DETECTSSIZE_EQ: - if (diff == stream_size) - ret = 1; - break; - case DETECTSSIZE_NEQ: - if (diff != stream_size) - ret = 1; - break; - case DETECTSSIZE_GEQ: - if (diff >= stream_size) - ret = 1; - break; - case DETECTSSIZE_GT: - if (diff > stream_size) - ret = 1; - break; - } - - return ret; -} - #endif /* _DETECT_STREAM_SIZE_H */ diff --git a/src/detect-uricontent.c b/src/detect-uricontent.c index ac366e8..5e5defb 100644 --- a/src/detect-uricontent.c +++ b/src/detect-uricontent.c @@ -85,6 +85,51 @@ void PktHttpUriFree(Packet *p) p->http_uri.cnt = 0; } +/* This function is called recursively (if necessary) to be able + * to determite whether or not a chain of content matches connected + * with 'within' and 'distance' options fully matches. The reason it + * was done like this is to make sure we can handle partial matches + * that turn out to fail being followed by full matches later in the + * packet. This adds some runtime complexity however. */ +int TestWithinDistanceOffsetDepthUri(ThreadVars *t, + DetectEngineThreadCtx *det_ctx, + MpmMatch *m, SigMatch *nsm) +{ + //printf("test_nextsigmatch m:%p, nsm:%p\n", m,nsm); + if (nsm == NULL) + return 1; + + DetectUricontentData *co = (DetectUricontentData *)nsm->ctx; + MpmMatch *nm = det_ctx->mtcu.match[co->id].top; + + for (; nm; nm = nm->next) { + SCLogDebug("(nm->offset+1) %" PRIu32 ", (m->offset+1) %" PRIu32 "", + (nm->offset+1), (m->offset+1)); + + if ((co->within == 0 || (co->within && + ((nm->offset+1) > (m->offset+1)) && + ((nm->offset+1) - (m->offset+1) <= co->within)))) + { + SCLogDebug("WITHIN (nm->offset+1) %" PRIu32 ", (m->offset+1) " + "%" PRIu32 "", (nm->offset+1), (m->offset+1)); + + if (co->distance == 0 || (co->distance && + ((nm->offset+1) > (m->offset+1)) && + ((nm->offset+1) - (m->offset+1) >= co->distance))) + { + if (TestOffsetDepthUri(nm, co) == 1) { + SCLogDebug("DISTANCE (nm->offset+1) %" PRIu32 ", " + "(m->offset+1) %" PRIu32 "", (nm->offset+1), + (m->offset+1)); + return TestWithinDistanceOffsetDepthUri(t, det_ctx, nm, + nsm->next); + } + } + } + } + return 0; +} + /** * \brief Checks if the packet sent as the argument, has a uricontent which diff --git a/src/detect-uricontent.h b/src/detect-uricontent.h index 67c117e..c2400d3 100644 --- a/src/detect-uricontent.h +++ b/src/detect-uricontent.h @@ -25,8 +25,11 @@ typedef struct DetectUricontentData_ { /* prototypes */ void DetectUricontentRegister (void); uint32_t DetectUricontentMaxId(DetectEngineCtx *); -void PktHttpUriFree(Packet *p); -uint32_t DetectUricontentInspectMpm(ThreadVars *th_v, DetectEngineThreadCtx *det_ctx, void *alstate); +void PktHttpUriFree(Packet *); +uint32_t DetectUricontentInspectMpm(ThreadVars *, DetectEngineThreadCtx *, void *); +int TestWithinDistanceOffsetDepthUri(ThreadVars *, + DetectEngineThreadCtx *, + MpmMatch *, SigMatch *); /** ------ inline functions ------ */ @@ -45,51 +48,6 @@ static inline int TestOffsetDepthUri(MpmMatch *m, DetectUricontentData *co) return 0; } -/* This function is called recursively (if necessary) to be able - * to determite whether or not a chain of content matches connected - * with 'within' and 'distance' options fully matches. The reason it - * was done like this is to make sure we can handle partial matches - * that turn out to fail being followed by full matches later in the - * packet. This adds some runtime complexity however. */ -static inline int TestWithinDistanceOffsetDepthUri(ThreadVars *t, - DetectEngineThreadCtx *det_ctx, - MpmMatch *m, SigMatch *nsm) -{ - //printf("test_nextsigmatch m:%p, nsm:%p\n", m,nsm); - if (nsm == NULL) - return 1; - - DetectUricontentData *co = (DetectUricontentData *)nsm->ctx; - MpmMatch *nm = det_ctx->mtcu.match[co->id].top; - - for (; nm; nm = nm->next) { - SCLogDebug("(nm->offset+1) %" PRIu32 ", (m->offset+1) %" PRIu32 "", - (nm->offset+1), (m->offset+1)); - - if ((co->within == 0 || (co->within && - ((nm->offset+1) > (m->offset+1)) && - ((nm->offset+1) - (m->offset+1) <= co->within)))) - { - SCLogDebug("WITHIN (nm->offset+1) %" PRIu32 ", (m->offset+1) " - "%" PRIu32 "", (nm->offset+1), (m->offset+1)); - - if (co->distance == 0 || (co->distance && - ((nm->offset+1) > (m->offset+1)) && - ((nm->offset+1) - (m->offset+1) >= co->distance))) - { - if (TestOffsetDepthUri(nm, co) == 1) { - SCLogDebug("DISTANCE (nm->offset+1) %" PRIu32 ", " - "(m->offset+1) %" PRIu32 "", (nm->offset+1), - (m->offset+1)); - return TestWithinDistanceOffsetDepthUri(t, det_ctx, nm, - nsm->next); - } - } - } - } - return 0; -} - static inline int DoDetectUricontent(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, SigMatch *sm, DetectUricontentData *co) diff --git a/src/detect.c b/src/detect.c index 8770174..f7a6e09 100644 --- a/src/detect.c +++ b/src/detect.c @@ -389,6 +389,61 @@ int SigLoadSignatures (DetectEngineCtx *de_ctx, char *sig_file) SCReturnInt(0); } +SigGroupHead *SigMatchSignaturesGetSgh(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p) { + SCEnter(); + + int ds,f; + SigGroupHead *sgh = NULL; + + /* select the dsize_gh */ + if (p->payload_len <= 100) + ds = 0; + else + ds = 1; + + /* select the flow_gh */ + if (p->flowflags & FLOW_PKT_TOCLIENT) + f = 0; + else + f = 1; + + SCLogDebug("ds %d, f %d", ds, f); + + /* find the right mpm instance */ + DetectAddress *ag = DetectAddressLookupInHead(de_ctx->dsize_gh[ds].flow_gh[f].src_gh[p->proto],&p->src); + if (ag != NULL) { + /* source group found, lets try a dst group */ + ag = DetectAddressLookupInHead(ag->dst_gh,&p->dst); + if (ag != NULL) { + if (ag->port == NULL) { + SCLogDebug("we don't have ports"); + sgh = ag->sh; + } else { + SCLogDebug("we have ports"); + + DetectPort *sport = DetectPortLookupGroup(ag->port,p->sp); + if (sport != NULL) { + DetectPort *dport = DetectPortLookupGroup(sport->dst_ph,p->dp); + if (dport != NULL) { + sgh = dport->sh; + } else { + SCLogDebug("no dst port group found for the packet"); + } + } else { + SCLogDebug("no src port group found for the packet"); + } + } + } else { + SCLogDebug("no dst address group found for the packet"); + } + } else { + SCLogDebug("no src address group found for the packet"); + } + + SCReturnPtr(sgh, "SigGroupHead"); +} + + /** * \brief Check if a certain sid alerted, this is used in the test functions * diff --git a/src/detect.h b/src/detect.h index 12d4099..b1468e2 100644 --- a/src/detect.h +++ b/src/detect.h @@ -586,67 +586,13 @@ void SigTableSetup(void); int PacketAlertCheck(Packet *p, uint32_t sid); int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p); +SigGroupHead *SigMatchSignaturesGetSgh(ThreadVars *, DetectEngineCtx *, + DetectEngineThreadCtx *, Packet *); int PacketAlertCheck(Packet *p, uint32_t sid); int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p); int SignatureIsIPOnly(DetectEngineCtx *de_ctx, Signature *s); -/** ------ inline functions ------ */ - -static inline SigGroupHead *SigMatchSignaturesGetSgh(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p) { - SCEnter(); - - int ds,f; - SigGroupHead *sgh = NULL; - - /* select the dsize_gh */ - if (p->payload_len <= 100) - ds = 0; - else - ds = 1; - - /* select the flow_gh */ - if (p->flowflags & FLOW_PKT_TOCLIENT) - f = 0; - else - f = 1; - - SCLogDebug("ds %d, f %d", ds, f); - - /* find the right mpm instance */ - DetectAddress *ag = DetectAddressLookupInHead(de_ctx->dsize_gh[ds].flow_gh[f].src_gh[p->proto],&p->src); - if (ag != NULL) { - /* source group found, lets try a dst group */ - ag = DetectAddressLookupInHead(ag->dst_gh,&p->dst); - if (ag != NULL) { - if (ag->port == NULL) { - SCLogDebug("we don't have ports"); - sgh = ag->sh; - } else { - SCLogDebug("we have ports"); - - DetectPort *sport = DetectPortLookupGroup(ag->port,p->sp); - if (sport != NULL) { - DetectPort *dport = DetectPortLookupGroup(sport->dst_ph,p->dp); - if (dport != NULL) { - sgh = dport->sh; - } else { - SCLogDebug("no dst port group found for the packet"); - } - } else { - SCLogDebug("no src port group found for the packet"); - } - } - } else { - SCLogDebug("no dst address group found for the packet"); - } - } else { - SCLogDebug("no src address group found for the packet"); - } - - SCReturnPtr(sgh, "SigGroupHead"); -} - #endif /* __DETECT_H__ */ diff --git a/src/suricata.c b/src/suricata.c index e5d886d..64136f9 100644 --- a/src/suricata.c +++ b/src/suricata.c @@ -133,9 +133,11 @@ int RunmodeIsUnittests(void) { return 0; } -static void SignalHandlerSigint(/*@unused@*/ int sig) { sigint_count = 1; sigflags |= SURICATA_SIGINT; } -static void SignalHandlerSigterm(/*@unused@*/ int sig) { sigterm_count = 1; sigflags |= SURICATA_SIGTERM; } -static void SignalHandlerSighup(/*@unused@*/ int sig) { sighup_count = 1; sigflags |= SURICATA_SIGHUP; } +/* Added sig = 0 just to avoid warnings of not used + * (it's a local copy, should not affect) */ +static void SignalHandlerSigint(/*@unused@*/ int sig) { sigint_count = 1; sigflags |= SURICATA_SIGINT; sig = 0; } +static void SignalHandlerSigterm(/*@unused@*/ int sig) { sigterm_count = 1; sigflags |= SURICATA_SIGTERM; sig = 0; } +static void SignalHandlerSighup(/*@unused@*/ int sig) { sighup_count = 1; sigflags |= SURICATA_SIGHUP; sig = 0; } #ifdef DBG_MEM_ALLOC #ifndef _GLOBAL_MEM_ diff --git a/src/tm-threads.c b/src/tm-threads.c index 926623b..0e73fd0 100644 --- a/src/tm-threads.c +++ b/src/tm-threads.c @@ -49,6 +49,41 @@ uint8_t tv_aof = THV_RESTART_THREAD; /* 1 slot functions */ +void TmThreadsSetFlag(ThreadVars *tv, uint8_t flag) { + if (SCSpinLock(&tv->flags_spinlock) != 0) { + SCLogError(SC_ERR_SPINLOCK,"spin lock errno=%d",errno); + return; + } + + tv->flags |= flag; + SCSpinUnlock(&tv->flags_spinlock); +} + +/** \retval 1 flag is set + * \retval 0 flag is not set + */ +int TmThreadsCheckFlag(ThreadVars *tv, uint8_t flag) { + int r; + if (SCSpinLock(&tv->flags_spinlock) != 0) { + SCLogError(SC_ERR_SPINLOCK,"spin lock errno=%d",errno); + return 0; + } + + r = (tv->flags & flag); + SCSpinUnlock(&tv->flags_spinlock); + return r; +} + +void TmThreadsUnsetFlag(ThreadVars *tv, uint8_t flag) { + if (SCSpinLock(&tv->flags_spinlock) != 0) { + SCLogError(SC_ERR_SPINLOCK,"spin lock errno=%d",errno); + return; + } + + tv->flags &= ~flag; + SCSpinUnlock(&tv->flags_spinlock); +} + void *TmThreadsSlot1NoIn(void *td) { ThreadVars *tv = (ThreadVars *)td; Tm1Slot *s = (Tm1Slot *)tv->tm_slots; diff --git a/src/tm-threads.h b/src/tm-threads.h index c5b186f..899e707 100644 --- a/src/tm-threads.h +++ b/src/tm-threads.h @@ -65,6 +65,7 @@ TmEcode TmThreadSetCPUAffinity(ThreadVars *, uint16_t); TmEcode TmThreadSetThreadPriority(ThreadVars *, int); TmEcode TmThreadSetupOptions(ThreadVars *); void TmThreadSetPrio(ThreadVars *); +void TmThreadsSetFlag(ThreadVars *, uint8_t); void TmThreadInitMC(ThreadVars *); void TmThreadTestThreadUnPaused(ThreadVars *); @@ -74,49 +75,14 @@ void TmThreadPause(ThreadVars *); void TmThreadPauseThreads(void); void TmThreadCheckThreadState(void); TmEcode TmThreadWaitOnThreadInit(void); -static inline int TmThreadsCheckFlag(ThreadVars *, uint8_t); -static inline void TmThreadsSetFlag(ThreadVars *, uint8_t); ThreadVars *TmThreadsGetCallingThread(void); +int TmThreadsCheckFlag(ThreadVars *, uint8_t); +void TmThreadsUnsetFlag(ThreadVars *, uint8_t); /** ------ inline functions ------ */ static inline TmEcode TmThreadsSlotVarRun (ThreadVars *, Packet *, TmSlot *); -/** \retval 1 flag is set - * \retval 0 flag is not set - */ -static inline int TmThreadsCheckFlag(ThreadVars *tv, uint8_t flag) { - int r; - if (SCSpinLock(&tv->flags_spinlock) != 0) { - SCLogError(SC_ERR_SPINLOCK,"spin lock errno=%d",errno); - return 0; - } - - r = (tv->flags & flag); - SCSpinUnlock(&tv->flags_spinlock); - return r; -} - -static inline void TmThreadsSetFlag(ThreadVars *tv, uint8_t flag) { - if (SCSpinLock(&tv->flags_spinlock) != 0) { - SCLogError(SC_ERR_SPINLOCK,"spin lock errno=%d",errno); - return; - } - - tv->flags |= flag; - SCSpinUnlock(&tv->flags_spinlock); -} - -static inline void TmThreadsUnsetFlag(ThreadVars *tv, uint8_t flag) { - if (SCSpinLock(&tv->flags_spinlock) != 0) { - SCLogError(SC_ERR_SPINLOCK,"spin lock errno=%d",errno); - return; - } - - tv->flags &= ~flag; - SCSpinUnlock(&tv->flags_spinlock); -} - /* separate run function so we can call it recursively */ static inline TmEcode TmThreadsSlotVarRun (ThreadVars *tv, Packet *p, TmSlot *slot) { TmEcode r = TM_ECODE_OK; diff --git a/src/util-bloomfilter.c b/src/util-bloomfilter.c index 079ab06..222253e 100644 --- a/src/util-bloomfilter.c +++ b/src/util-bloomfilter.c @@ -77,22 +77,6 @@ int BloomFilterAdd(BloomFilter *bf, void *data, uint16_t datalen) { return 0; } -inline int BloomFilterTest(BloomFilter *bf, void *data, uint16_t datalen) { - uint8_t iter = 0; - uint32_t hash = 0; - int hit = 1; - - for (iter = 0; iter < bf->hash_iterations; iter++) { - hash = bf->Hash(data, datalen, iter, bf->bitarray_size); - if (!(bf->bitarray[hash/8] & (1<hash_iterations; iter++) { + hash = bf->Hash(data, datalen, iter, bf->bitarray_size); + if (!(bf->bitarray[hash/8] & (1< 23) { + SCLogError(SC_ERR_ARG_LEN_LONG, "len too large (23 max)"); + return -1; + } + + if (len) { + /* Extract out the string so it can be null terminated */ + memcpy(strbuf, str, len); + strbuf[len] = '\0'; + ptr = strbuf; + } + + errno = 0; + *res = strtoull(ptr, &endptr, base); + + if (errno == ERANGE) { + SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range"); + return -1; + } else if (endptr == str) { + SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "Invalid numeric value"); + return -1; + /* If there is no numeric value in the given string then strtoull(), makes + endptr equals to ptr and return 0 as result */ + } else if (endptr == ptr && *res == 0) { + SCLogDebug("No numeric value"); + return -1; + } + /* This will interfere with some rules that do not know the length + * in advance and instead are just using the max. + */ +#if 0 + else if (len && *endptr != '\0') { + fprintf(stderr, "ByteExtractString: Extra characters following numeric value\n"); + return -1; + } +#endif + + return (endptr - ptr); +} + +int ByteExtractStringSigned(int64_t *res, int base, uint16_t len, const char *str) +{ + const char *ptr = str; + char *endptr; + + /* 23 - This is the largest string (octal, with a zero prefix) that + * will not overflow int64_t. The only way this length + * could be over 23 and still not overflow is if it were zero + * prefixed and we only support 1 byte of zero prefix for octal. + * + * "-0777777777777777777777" = 0xffffffffffffffff + */ + char strbuf[24]; + + if (len > 23) { + SCLogError(SC_ERR_ARG_LEN_LONG, "len too large (23 max)"); + return -1; + } + + if (len) { + /* Extract out the string so it can be null terminated */ + memcpy(strbuf, str, len); + strbuf[len] = '\0'; + ptr = strbuf; + } + + errno = 0; + *res = strtoll(ptr, &endptr, base); + + if (errno == ERANGE) { + SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range"); + return -1; + } else if (endptr == str) { + SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "Invalid numeric value"); + return -1; + } + /* This will interfere with some rules that do not know the length + * in advance and instead are just using the max. + */ +#if 0 + else if (len && *endptr != '\0') { + fprintf(stderr, "ByteExtractStringSigned: Extra characters following numeric value\n"); + return -1; + } +#endif + + //fprintf(stderr, "ByteExtractStringSigned: Extracted base %d: 0x%" PRIx64 "\n", base, *res); + + return (endptr - ptr); +} + +int ByteExtractStringUint32(uint32_t *res, int base, uint16_t len, const char *str) +{ + uint64_t i64; + int ret; + + ret = ByteExtractString(&i64, base, len, str); + if (ret <= 0) { + return ret; + } + + *res = (uint32_t)i64; + + if ((uint64_t)(*res) != i64) { + SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " + "(%" PRIx64 " != %" PRIx64 ")", (uint64_t)(*res), i64); + return -1; + } + + return ret; +} + +int ByteExtractStringUint16(uint16_t *res, int base, uint16_t len, const char *str) +{ + uint64_t i64; + int ret; + + ret = ByteExtractString(&i64, base, len, str); + if (ret <= 0) { + return ret; + } + + *res = (uint16_t)i64; + + if ((uint64_t)(*res) != i64) { + SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " + "(%" PRIx64 " != %" PRIx64 ")", (uint64_t)(*res), i64); + return -1; + } + + return ret; +} + +int ByteExtractStringUint8(uint8_t *res, int base, uint16_t len, const char *str) +{ + uint64_t i64; + int ret; + + ret = ByteExtractString(&i64, base, len, str); + if (ret <= 0) { + return ret; + } + + *res = (uint8_t)i64; + + if ((uint64_t)(*res) != i64) { + SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " + "(%" PRIx64 " != %" PRIx64 ")", (uint64_t)(*res), i64); + return -1; + } + + return ret; +} + +int ByteExtractStringInt32(int32_t *res, int base, uint16_t len, const char *str) +{ + int64_t i64; + int ret; + + ret = ByteExtractStringSigned(&i64, base, len, str); + if (ret <= 0) { + return ret; + } + + *res = (int32_t)i64; + + if ((int64_t)(*res) != i64) { + SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " + "(%" PRIx64 " != %" PRIx64 ")\n", (int64_t)(*res), i64); + return -1; + } + + return ret; +} + +int ByteExtractStringInt16(int16_t *res, int base, uint16_t len, const char *str) +{ + int64_t i64; + int ret; + + ret = ByteExtractStringSigned(&i64, base, len, str); + if (ret <= 0) { + return ret; + } + + *res = (int16_t)i64; + + if ((int64_t)(*res) != i64) { + SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " + "(%" PRIx64 " != %" PRIx64 ")\n", (int64_t)(*res), i64); + return -1; + } + + return ret; +} + +int ByteExtractStringInt8(int8_t *res, int base, uint16_t len, const char *str) +{ + int64_t i64; + int ret; + + ret = ByteExtractStringSigned(&i64, base, len, str); + if (ret <= 0) { + return ret; + } + + *res = (int8_t)i64; + + if ((int64_t)(*res) != i64) { + SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " + "(%" PRIx64 " != %" PRIx64 ")\n", (int64_t)(*res), i64); + return -1; + } + + return ret; +} #ifdef UNITTESTS diff --git a/src/util-byte.h b/src/util-byte.h index 704fd90..91b6978 100644 --- a/src/util-byte.h +++ b/src/util-byte.h @@ -98,7 +98,7 @@ static inline int ByteExtractUint16(uint16_t *res, int e, uint16_t len, const ui * \return n Number of bytes extracted on success * \return -1 On error */ -static inline int ByteExtractString(uint64_t *res, int base, uint16_t len, const char *str); +int ByteExtractString(uint64_t *res, int base, uint16_t len, const char *str); /** * Extract unsigned integer value from a string as uint64_t. @@ -112,7 +112,7 @@ static inline int ByteExtractString(uint64_t *res, int base, uint16_t len, const * \return n Number of bytes extracted on success * \return -1 On error */ -static inline int ByteExtractStringUint64(uint64_t *res, int base, uint16_t len, const char *str); +int ByteExtractStringUint64(uint64_t *res, int base, uint16_t len, const char *str); /** * Extract unsigned integer value from a string as uint32_t. @@ -125,7 +125,7 @@ static inline int ByteExtractStringUint64(uint64_t *res, int base, uint16_t len, * \return n Number of bytes extracted on success * \return -1 On error */ -static inline int ByteExtractStringUint32(uint32_t *res, int base, uint16_t len, const char *str); +int ByteExtractStringUint32(uint32_t *res, int base, uint16_t len, const char *str); /** * Extract unsigned integer value from a string as uint16_t. @@ -138,7 +138,7 @@ static inline int ByteExtractStringUint32(uint32_t *res, int base, uint16_t len, * \return n Number of bytes extracted on success * \return -1 On error */ -static inline int ByteExtractStringUint16(uint16_t *res, int base, uint16_t len, const char *str); +int ByteExtractStringUint16(uint16_t *res, int base, uint16_t len, const char *str); /** * Extract unsigned integer value from a string as uint8_t. @@ -151,7 +151,7 @@ static inline int ByteExtractStringUint16(uint16_t *res, int base, uint16_t len, * \return n Number of bytes extracted on success * \return -1 On error */ -static inline int ByteExtractStringUint8(uint8_t *res, int base, uint16_t len, const char *str); +int ByteExtractStringUint8(uint8_t *res, int base, uint16_t len, const char *str); /** * Extract signed integer value from a string. @@ -164,7 +164,7 @@ static inline int ByteExtractStringUint8(uint8_t *res, int base, uint16_t len, c * \return n Number of bytes extracted on success * \return -1 On error */ -static inline int ByteExtractStringSigned(int64_t *res, int base, uint16_t len, const char *str); +int ByteExtractStringSigned(int64_t *res, int base, uint16_t len, const char *str); /** * Extract signed integer value from a string as uint64_t. @@ -177,7 +177,7 @@ static inline int ByteExtractStringSigned(int64_t *res, int base, uint16_t len, * \return n Number of bytes extracted on success * \return -1 On error */ -static inline int ByteExtractStringInt64(int64_t *res, int base, uint16_t len, const char *str); +int ByteExtractStringInt64(int64_t *res, int base, uint16_t len, const char *str); /** * Extract signed integer value from a string as uint32_t. @@ -190,7 +190,7 @@ static inline int ByteExtractStringInt64(int64_t *res, int base, uint16_t len, c * \return n Number of bytes extracted on success * \return -1 On error */ -static inline int ByteExtractStringInt32(int32_t *res, int base, uint16_t len, const char *str); +int ByteExtractStringInt32(int32_t *res, int base, uint16_t len, const char *str); /** * Extract signed integer value from a string as uint16_t. @@ -203,7 +203,7 @@ static inline int ByteExtractStringInt32(int32_t *res, int base, uint16_t len, c * \return n Number of bytes extracted on success * \return -1 On error */ -static inline int ByteExtractStringInt16(int16_t *res, int base, uint16_t len, const char *str); +int ByteExtractStringInt16(int16_t *res, int base, uint16_t len, const char *str); /** * Extract signed integer value from a string as uint8_t. @@ -216,7 +216,7 @@ static inline int ByteExtractStringInt16(int16_t *res, int base, uint16_t len, c * \return n Number of bytes extracted on success * \return -1 On error */ -static inline int ByteExtractStringInt8(int8_t *res, int base, uint16_t len, const char *str); +int ByteExtractStringInt8(int8_t *res, int base, uint16_t len, const char *str); /** ------ Definitions of Inline functions ------ */ @@ -251,60 +251,6 @@ static inline int ByteExtract(uint64_t *res, int e, uint16_t len, const uint8_t return len; } -static inline int ByteExtractString(uint64_t *res, int base, uint16_t len, const char *str) -{ - const char *ptr = str; - char *endptr = NULL; - - /* 23 - This is the largest string (octal, with a zero prefix) that - * will not overflow uint64_t. The only way this length - * could be over 23 and still not overflow is if it were zero - * prefixed and we only support 1 byte of zero prefix for octal. - * - * "01777777777777777777777" = 0xffffffffffffffff - */ - char strbuf[24]; - - if (len > 23) { - SCLogError(SC_ERR_ARG_LEN_LONG, "len too large (23 max)"); - return -1; - } - - if (len) { - /* Extract out the string so it can be null terminated */ - memcpy(strbuf, str, len); - strbuf[len] = '\0'; - ptr = strbuf; - } - - errno = 0; - *res = strtoull(ptr, &endptr, base); - - if (errno == ERANGE) { - SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range"); - return -1; - } else if (endptr == str) { - SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "Invalid numeric value"); - return -1; - /* If there is no numeric value in the given string then strtoull(), makes - endptr equals to ptr and return 0 as result */ - } else if (endptr == ptr && *res == 0) { - SCLogDebug("No numeric value"); - return -1; - } - /* This will interfere with some rules that do not know the length - * in advance and instead are just using the max. - */ -#if 0 - else if (len && *endptr != '\0') { - fprintf(stderr, "ByteExtractString: Extra characters following numeric value\n"); - return -1; - } -#endif - - return (endptr - ptr); -} - static inline int ByteExtractUint64(uint64_t *res, int e, uint16_t len, const uint8_t *bytes) { uint64_t i64; @@ -368,193 +314,6 @@ static inline int ByteExtractUint16(uint16_t *res, int e, uint16_t len, const ui return ret; } - -static inline int ByteExtractStringInt64(int64_t *res, int base, uint16_t len, const char *str) -{ - return ByteExtractStringSigned(res, base, len, str); -} - -static inline int ByteExtractStringInt32(int32_t *res, int base, uint16_t len, const char *str) -{ - int64_t i64; - int ret; - - ret = ByteExtractStringSigned(&i64, base, len, str); - if (ret <= 0) { - return ret; - } - - *res = (int32_t)i64; - - if ((int64_t)(*res) != i64) { - SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " - "(%" PRIx64 " != %" PRIx64 ")\n", (int64_t)(*res), i64); - return -1; - } - - return ret; -} - -static inline int ByteExtractStringInt16(int16_t *res, int base, uint16_t len, const char *str) -{ - int64_t i64; - int ret; - - ret = ByteExtractStringSigned(&i64, base, len, str); - if (ret <= 0) { - return ret; - } - - *res = (int16_t)i64; - - if ((int64_t)(*res) != i64) { - SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " - "(%" PRIx64 " != %" PRIx64 ")\n", (int64_t)(*res), i64); - return -1; - } - - return ret; -} - -static inline int ByteExtractStringInt8(int8_t *res, int base, uint16_t len, const char *str) -{ - int64_t i64; - int ret; - - ret = ByteExtractStringSigned(&i64, base, len, str); - if (ret <= 0) { - return ret; - } - - *res = (int8_t)i64; - - if ((int64_t)(*res) != i64) { - SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " - "(%" PRIx64 " != %" PRIx64 ")\n", (int64_t)(*res), i64); - return -1; - } - - return ret; -} - -static inline int ByteExtractStringUint64(uint64_t *res, int base, uint16_t len, const char *str) -{ - return ByteExtractString(res, base, len, str); -} - -static inline int ByteExtractStringUint32(uint32_t *res, int base, uint16_t len, const char *str) -{ - uint64_t i64; - int ret; - - ret = ByteExtractString(&i64, base, len, str); - if (ret <= 0) { - return ret; - } - - *res = (uint32_t)i64; - - if ((uint64_t)(*res) != i64) { - SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " - "(%" PRIx64 " != %" PRIx64 ")", (uint64_t)(*res), i64); - return -1; - } - - return ret; -} - -static inline int ByteExtractStringUint16(uint16_t *res, int base, uint16_t len, const char *str) -{ - uint64_t i64; - int ret; - - ret = ByteExtractString(&i64, base, len, str); - if (ret <= 0) { - return ret; - } - - *res = (uint16_t)i64; - - if ((uint64_t)(*res) != i64) { - SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " - "(%" PRIx64 " != %" PRIx64 ")", (uint64_t)(*res), i64); - return -1; - } - - return ret; -} - -static inline int ByteExtractStringUint8(uint8_t *res, int base, uint16_t len, const char *str) -{ - uint64_t i64; - int ret; - - ret = ByteExtractString(&i64, base, len, str); - if (ret <= 0) { - return ret; - } - - *res = (uint8_t)i64; - - if ((uint64_t)(*res) != i64) { - SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " - "(%" PRIx64 " != %" PRIx64 ")", (uint64_t)(*res), i64); - return -1; - } - - return ret; -} - -static inline int ByteExtractStringSigned(int64_t *res, int base, uint16_t len, const char *str) -{ - const char *ptr = str; - char *endptr; - - /* 23 - This is the largest string (octal, with a zero prefix) that - * will not overflow int64_t. The only way this length - * could be over 23 and still not overflow is if it were zero - * prefixed and we only support 1 byte of zero prefix for octal. - * - * "-0777777777777777777777" = 0xffffffffffffffff - */ - char strbuf[24]; - - if (len > 23) { - SCLogError(SC_ERR_ARG_LEN_LONG, "len too large (23 max)"); - return -1; - } - - if (len) { - /* Extract out the string so it can be null terminated */ - memcpy(strbuf, str, len); - strbuf[len] = '\0'; - ptr = strbuf; - } - - errno = 0; - *res = strtoll(ptr, &endptr, base); - - if (errno == ERANGE) { - SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range"); - return -1; - } else if (endptr == str) { - SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "Invalid numeric value"); - return -1; - } - /* This will interfere with some rules that do not know the length - * in advance and instead are just using the max. - */ -#if 0 - else if (len && *endptr != '\0') { - fprintf(stderr, "ByteExtractStringSigned: Extra characters following numeric value\n"); - return -1; - } -#endif - - //fprintf(stderr, "ByteExtractStringSigned: Extracted base %d: 0x%" PRIx64 "\n", base, *res); - - return (endptr - ptr); -} /* UNITTESTS */ #ifdef UNITTESTS diff --git a/src/util-debug-filters.c b/src/util-debug-filters.c index dbdf4bf..f16d2f6 100644 --- a/src/util-debug-filters.c +++ b/src/util-debug-filters.c @@ -56,6 +56,118 @@ static SCLogFDFilterThreadList *sc_log_fd_filters_tl = NULL; static SCMutex sc_log_fd_filters_tl_m = PTHREAD_MUTEX_INITIALIZER; /** + * \brief Helper function used internally to add a FG filter + * + * \param file File_name of the filter + * \param function Function_name of the filter + * \param line Line number of the filter + * \param listtype The filter listtype. Can be either a blacklist or whitelist + * filter listtype(SC_LOG_FILTER_BL or SC_LOG_FILTER_WL) + * + * \retval 0 on successfully adding the filter; + * \retval -1 on failure + */ +int SCLogAddFGFilter(const char *file, const char *function, + int line, int listtype) +{ + SCLogFGFilterFile *fgf_file = NULL; + SCLogFGFilterFile *prev_fgf_file = NULL; + + SCLogFGFilterFunc *fgf_func = NULL; + SCLogFGFilterFunc *prev_fgf_func = NULL; + + SCLogFGFilterLine *fgf_line = NULL; + SCLogFGFilterLine *prev_fgf_line = NULL; + + int found = 0; + + if (sc_log_module_initialized != 1) { + printf("Logging module not initialized. Call SCLogInitLogModule() " + "first before using the debug API\n"); + return -1 ; + } + + if (file == NULL && function == NULL && line < 0) { + printf("Error: Invalid arguments supplied to SCLogAddFGFilter\n"); + return -1; + } + + SCMutex *m = &sc_log_fg_filters_m[listtype]; + + SCMutexLock(m); + + fgf_file = sc_log_fg_filters[listtype]; + + prev_fgf_file = fgf_file; + while (fgf_file != NULL) { + prev_fgf_file = fgf_file; + if (file == NULL && fgf_file->file == NULL) + found = 1; + else if (file != NULL && fgf_file->file != NULL) + found = (strcmp(file, fgf_file->file) == 0); + else + found = 0; + + if (found == 1) + break; + + fgf_file = fgf_file->next; + } + + if (found == 0) { + SCLogAddToFGFFileList(prev_fgf_file, file, function, line, listtype); + goto done; + } + + found = 0; + fgf_func = fgf_file->func; + prev_fgf_func = fgf_func; + while (fgf_func != NULL) { + prev_fgf_func = fgf_func; + if (function == NULL && fgf_func->func == NULL) + found = 1; + else if (function != NULL && fgf_func->func != NULL) + found = (strcmp(function, fgf_func->func) == 0); + else + found = 0; + + if (found == 1) + break; + + fgf_func = fgf_func->next; + } + + if (found == 0) { + SCLogAddToFGFFuncList(fgf_file, prev_fgf_func, function, line); + goto done; + } + + found = 0; + fgf_line = fgf_func->line; + prev_fgf_line = fgf_line; + while(fgf_line != NULL) { + prev_fgf_line = fgf_line; + if (line == fgf_line->line) { + found = 1; + break; + } + + fgf_line = fgf_line->next; + } + + if (found == 0) { + SCLogAddToFGFLineList(fgf_func, prev_fgf_line, line); + goto done; + } + + done: + SCMutexUnlock(&sc_log_fg_filters_m[listtype]); + sc_log_fg_filters_present = 1; + + return 0; +} + +/** * \brief Internal function used to check for matches against registered FG * filters. Checks if there is a match for the incoming log_message with * any of the FG filters. Based on whether the filter type is whitelist diff --git a/src/util-debug-filters.h b/src/util-debug-filters.h index f76a722..42c6f13 100644 --- a/src/util-debug-filters.h +++ b/src/util-debug-filters.h @@ -201,118 +201,6 @@ static inline void SCLogAddToFGFLineList(SCLogFGFilterFunc *fgf_func, return; } -/** - * \brief Helper function used internally to add a FG filter - * - * \param file File_name of the filter - * \param function Function_name of the filter - * \param line Line number of the filter - * \param listtype The filter listtype. Can be either a blacklist or whitelist - * filter listtype(SC_LOG_FILTER_BL or SC_LOG_FILTER_WL) - * - * \retval 0 on successfully adding the filter; - * \retval -1 on failure - */ -static inline int SCLogAddFGFilter(const char *file, const char *function, - int line, int listtype) -{ - SCLogFGFilterFile *fgf_file = NULL; - SCLogFGFilterFile *prev_fgf_file = NULL; - - SCLogFGFilterFunc *fgf_func = NULL; - SCLogFGFilterFunc *prev_fgf_func = NULL; - - SCLogFGFilterLine *fgf_line = NULL; - SCLogFGFilterLine *prev_fgf_line = NULL; - - int found = 0; - - if (sc_log_module_initialized != 1) { - printf("Logging module not initialized. Call SCLogInitLogModule() " - "first before using the debug API\n"); - return -1 ; - } - - if (file == NULL && function == NULL && line < 0) { - printf("Error: Invalid arguments supplied to SCLogAddFGFilter\n"); - return -1; - } - - SCMutex *m = &sc_log_fg_filters_m[listtype]; - - SCMutexLock(m); - - fgf_file = sc_log_fg_filters[listtype]; - - prev_fgf_file = fgf_file; - while (fgf_file != NULL) { - prev_fgf_file = fgf_file; - if (file == NULL && fgf_file->file == NULL) - found = 1; - else if (file != NULL && fgf_file->file != NULL) - found = (strcmp(file, fgf_file->file) == 0); - else - found = 0; - - if (found == 1) - break; - - fgf_file = fgf_file->next; - } - - if (found == 0) { - SCLogAddToFGFFileList(prev_fgf_file, file, function, line, listtype); - goto done; - } - - found = 0; - fgf_func = fgf_file->func; - prev_fgf_func = fgf_func; - while (fgf_func != NULL) { - prev_fgf_func = fgf_func; - if (function == NULL && fgf_func->func == NULL) - found = 1; - else if (function != NULL && fgf_func->func != NULL) - found = (strcmp(function, fgf_func->func) == 0); - else - found = 0; - - if (found == 1) - break; - - fgf_func = fgf_func->next; - } - - if (found == 0) { - SCLogAddToFGFFuncList(fgf_file, prev_fgf_func, function, line); - goto done; - } - - found = 0; - fgf_line = fgf_func->line; - prev_fgf_line = fgf_line; - while(fgf_line != NULL) { - prev_fgf_line = fgf_line; - if (line == fgf_line->line) { - found = 1; - break; - } - - fgf_line = fgf_line->next; - } - - if (found == 0) { - SCLogAddToFGFLineList(fgf_func, prev_fgf_line, line); - goto done; - } - - done: - SCMutexUnlock(&sc_log_fg_filters_m[listtype]); - sc_log_fg_filters_present = 1; - - return 0; -} - /** * \brief Helper function used internally to add a FG filter. This function is diff --git a/src/util-debug.c b/src/util-debug.c index e22c00f..dcad877 100644 --- a/src/util-debug.c +++ b/src/util-debug.c @@ -159,6 +159,26 @@ void SCLogOutputBuffer(SCLogLevel log_level, char *msg) } /** + * \brief Output function that logs a character string throught the syslog iface + * + * \param syslog_log_level Holds the syslog_log_level that the message should be + * logged as + * \param msg Pointer to the char string, that should be logged + * + * \todo syslog is thread-safe according to POSIX manual and glibc code, but we + * we will have to look into non POSIX compliant boxes like freeBSD + */ +void SCLogPrintToSyslog(int syslog_log_level, const char *msg) +{ + //static struct syslog_data data = SYSLOG_DATA_INIT; + //syslog_r(syslog_log_level, NULL, "%s", msg); + + syslog(syslog_log_level, "%s", msg); + + return; +} + +/** * \brief Adds the global log_format to the outgoing buffer * * \param log_level log_level of the message that has to be logged diff --git a/src/util-debug.h b/src/util-debug.h index 959dc2a..8c97256 100644 --- a/src/util-debug.h +++ b/src/util-debug.h @@ -22,6 +22,7 @@ extern SCEnumCharMap sc_syslog_facility_map[22]; * \brief Returns the full path given a file and configured log dir */ char *SCLogGetLogFilename(char *); +void SCLogPrintToSyslog(int, const char *); /** * \brief ENV vars that can be used to set the properties for the logging module @@ -978,25 +979,5 @@ static inline void SCLogPrintToStream(FILE *fd, char *msg) return; } -/** - * \brief Output function that logs a character string throught the syslog iface - * - * \param syslog_log_level Holds the syslog_log_level that the message should be - * logged as - * \param msg Pointer to the char string, that should be logged - * - * \todo syslog is thread-safe according to POSIX manual and glibc code, but we - * we will have to look into non POSIX compliant boxes like freeBSD - */ -static inline void SCLogPrintToSyslog(int syslog_log_level, const char *msg) -{ - //static struct syslog_data data = SYSLOG_DATA_INIT; - //syslog_r(syslog_log_level, NULL, "%s", msg); - - syslog(syslog_log_level, "%s", msg); - - return; -} - #endif /* __UTIL_DEBUG_H__ */ diff --git a/src/util-mpm-b2g.c b/src/util-mpm-b2g.c index da9f1d1..4a56da9 100644 --- a/src/util-mpm-b2g.c +++ b/src/util-mpm-b2g.c @@ -59,6 +59,7 @@ uint32_t B2gSearchBNDMq(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMa uint32_t B2gSearch(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen); void B2gPrintInfo(MpmCtx *mpm_ctx); void B2gPrintSearchStats(MpmThreadCtx *mpm_thread_ctx); +int B2gAddPattern(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, char, char, uint32_t, uint32_t, uint8_t); void B2gRegisterTests(void); void MpmB2gRegister (void) { @@ -129,6 +130,113 @@ static void B2gHashFree(MpmCtx *mpm_ctx, B2gHashItem *hi) { * INIT HASH END */ +/* B2gAddPattern + * + * pat: ptr to the pattern + * patlen: length of the pattern + * nocase: nocase flag: 1 enabled, 0 disable + * pid: pattern id + * sid: signature id (internal id) + */ +int B2gAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, char nocase, char scan, uint32_t pid, uint32_t sid, uint8_t nosearch) { + B2gCtx *ctx = (B2gCtx *)mpm_ctx->ctx; + + SCLogDebug("ctx %p len %"PRIu16" pid %" PRIu32 ", nocase %s", ctx, patlen, pid, nocase ? "true" : "false"); + + if (patlen == 0) + return 0; + + /* get a memory piece */ + B2gPattern *p = B2gInitHashLookup(ctx, pat, patlen, nocase); + if (p == NULL) { + SCLogDebug("allocing new pattern"); + + p = B2gAllocPattern(mpm_ctx); + if (p == NULL) + goto error; + + p->len = patlen; + + if (nocase) p->flags |= B2G_NOCASE; + + /* setup the case insensitive part of the pattern */ + p->ci = SCMalloc(patlen); + if (p->ci == NULL) goto error; + mpm_ctx->memory_cnt++; + mpm_ctx->memory_size += patlen; + memcpy_tolower(p->ci, pat, patlen); + + /* setup the case sensitive part of the pattern */ + if (p->flags & B2G_NOCASE) { + /* nocase means no difference between cs and ci */ + p->cs = p->ci; + } else { + if (memcmp(p->ci,pat,p->len) == 0) { + /* no diff between cs and ci: pat is lowercase */ + p->cs = p->ci; + } else { + p->cs = SCMalloc(patlen); + if (p->cs == NULL) goto error; + mpm_ctx->memory_cnt++; + mpm_ctx->memory_size += patlen; + memcpy(p->cs, pat, patlen); + } + } + + //printf("B2gAddPattern: ci \""); prt(p->ci,p->len); + //printf("\" cs \""); prt(p->cs,p->len); + //printf("\"\n"); + + /* put in the pattern hash */ + B2gInitHashAdd(ctx, p); + + if (mpm_ctx->pattern_cnt == 65535) { + printf("Max search words reached\n"); + exit(1); + } + if (scan) mpm_ctx->scan_pattern_cnt++; + mpm_ctx->pattern_cnt++; + + if (scan) { /* SCAN */ + if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen; + if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen; + else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen; + p->flags |= B2G_SCAN; + } else { /* SEARCH */ + if (mpm_ctx->search_maxlen < patlen) mpm_ctx->search_maxlen = patlen; + if (mpm_ctx->search_minlen == 0) mpm_ctx->search_minlen = patlen; + else if (mpm_ctx->search_minlen > patlen) mpm_ctx->search_minlen = patlen; + } + } else { + /* if we're reusing a pattern, check we need to check that it is a + * scan pattern if that is what we're adding. If so we set the pattern + * to be a scan pattern. */ + + //printf("reusing B2gAddPattern: ci \""); prt(p->ci,p->len); + //printf("\" cs \""); prt(p->cs,p->len); + //printf("\"\n"); + + if (scan) { + p->flags |= B2G_SCAN; + + if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen; + if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen; + else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen; + } + } + + /* we need a match */ + B2gEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch); + + mpm_ctx->total_pattern_cnt++; + return 0; + +error: + B2gFreePattern(mpm_ctx, p); + return -1; +} + + void B2gFreePattern(MpmCtx *mpm_ctx, B2gPattern *p) { if (p && p->em) { MpmEndMatchFreeAll(mpm_ctx, p->em); diff --git a/src/util-mpm-b2g.h b/src/util-mpm-b2g.h index b114482..1a3f865 100644 --- a/src/util-mpm-b2g.h +++ b/src/util-mpm-b2g.h @@ -297,112 +297,6 @@ static inline int B2gCmpPattern(B2gPattern *p, uint8_t *pat, uint16_t patlen, ch return 1; } -/* B2gAddPattern - * - * pat: ptr to the pattern - * patlen: length of the pattern - * nocase: nocase flag: 1 enabled, 0 disable - * pid: pattern id - * sid: signature id (internal id) - */ -static inline int B2gAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, char nocase, char scan, uint32_t pid, uint32_t sid, uint8_t nosearch) { - B2gCtx *ctx = (B2gCtx *)mpm_ctx->ctx; - - SCLogDebug("ctx %p len %"PRIu16" pid %" PRIu32 ", nocase %s", ctx, patlen, pid, nocase ? "true" : "false"); - - if (patlen == 0) - return 0; - - /* get a memory piece */ - B2gPattern *p = B2gInitHashLookup(ctx, pat, patlen, nocase); - if (p == NULL) { - SCLogDebug("allocing new pattern"); - - p = B2gAllocPattern(mpm_ctx); - if (p == NULL) - goto error; - - p->len = patlen; - - if (nocase) p->flags |= B2G_NOCASE; - - /* setup the case insensitive part of the pattern */ - p->ci = SCMalloc(patlen); - if (p->ci == NULL) goto error; - mpm_ctx->memory_cnt++; - mpm_ctx->memory_size += patlen; - memcpy_tolower(p->ci, pat, patlen); - - /* setup the case sensitive part of the pattern */ - if (p->flags & B2G_NOCASE) { - /* nocase means no difference between cs and ci */ - p->cs = p->ci; - } else { - if (memcmp(p->ci,pat,p->len) == 0) { - /* no diff between cs and ci: pat is lowercase */ - p->cs = p->ci; - } else { - p->cs = SCMalloc(patlen); - if (p->cs == NULL) goto error; - mpm_ctx->memory_cnt++; - mpm_ctx->memory_size += patlen; - memcpy(p->cs, pat, patlen); - } - } - - //printf("B2gAddPattern: ci \""); prt(p->ci,p->len); - //printf("\" cs \""); prt(p->cs,p->len); - //printf("\"\n"); - - /* put in the pattern hash */ - B2gInitHashAdd(ctx, p); - - if (mpm_ctx->pattern_cnt == 65535) { - printf("Max search words reached\n"); - exit(1); - } - if (scan) mpm_ctx->scan_pattern_cnt++; - mpm_ctx->pattern_cnt++; - - if (scan) { /* SCAN */ - if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen; - if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen; - else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen; - p->flags |= B2G_SCAN; - } else { /* SEARCH */ - if (mpm_ctx->search_maxlen < patlen) mpm_ctx->search_maxlen = patlen; - if (mpm_ctx->search_minlen == 0) mpm_ctx->search_minlen = patlen; - else if (mpm_ctx->search_minlen > patlen) mpm_ctx->search_minlen = patlen; - } - } else { - /* if we're reusing a pattern, check we need to check that it is a - * scan pattern if that is what we're adding. If so we set the pattern - * to be a scan pattern. */ - - //printf("reusing B2gAddPattern: ci \""); prt(p->ci,p->len); - //printf("\" cs \""); prt(p->cs,p->len); - //printf("\"\n"); - - if (scan) { - p->flags |= B2G_SCAN; - - if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen; - if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen; - else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen; - } - } - - /* we need a match */ - B2gEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch); - - mpm_ctx->total_pattern_cnt++; - return 0; - -error: - B2gFreePattern(mpm_ctx, p); - return -1; -} - static inline uint32_t B2gBloomHash(void *data, uint16_t datalen, uint8_t iter, uint32_t hash_size) { uint8_t *d = (uint8_t *)data; uint16_t i; diff --git a/src/util-mpm-b3g.c b/src/util-mpm-b3g.c index 12d046a..3f1c76b 100644 --- a/src/util-mpm-b3g.c +++ b/src/util-mpm-b3g.c @@ -53,6 +53,7 @@ uint32_t B3gSearch(MpmCtx *, MpmThreadCtx *, PatternMatcherQueue *, uint8_t *, u uint32_t B3gSearchBNDMq(MpmCtx *, MpmThreadCtx *, PatternMatcherQueue *, uint8_t *, uint16_t); void B3gPrintInfo(MpmCtx *); void B3gPrintSearchStats(MpmThreadCtx *); +B3gHashItem* B3gAllocHashItem(MpmCtx *); void B3gRegisterTests(void); void MpmB3gRegister (void) { @@ -120,6 +121,20 @@ static void B3gHashFree(MpmCtx *mpm_ctx, B3gHashItem *hi) { SCFree(hi); } +B3gHashItem * +B3gAllocHashItem(MpmCtx *mpm_ctx) { + B3gHashItem *hi = SCMalloc(sizeof(B3gHashItem)); + if (hi == NULL) { + printf("ERROR: B3gAllocHashItem: SCMalloc failed\n"); + exit(EXIT_FAILURE); + } + memset(hi,0,sizeof(B3gHashItem)); + + mpm_ctx->memory_cnt++; + mpm_ctx->memory_size += sizeof(B3gHashItem); + return hi; +} + /* * INIT HASH END */ diff --git a/src/util-mpm-b3g.h b/src/util-mpm-b3g.h index 4eccdeb..e66d1a5 100644 --- a/src/util-mpm-b3g.h +++ b/src/util-mpm-b3g.h @@ -179,20 +179,6 @@ static inline B3gPattern *B3gAllocPattern(MpmCtx *mpm_ctx) { return p; } -static inline B3gHashItem * -B3gAllocHashItem(MpmCtx *mpm_ctx) { - B3gHashItem *hi = SCMalloc(sizeof(B3gHashItem)); - if (hi == NULL) { - printf("ERROR: B3gAllocHashItem: SCMalloc failed\n"); - exit(EXIT_FAILURE); - } - memset(hi,0,sizeof(B3gHashItem)); - - mpm_ctx->memory_cnt++; - mpm_ctx->memory_size += sizeof(B3gHashItem); - return hi; -} - /* static inline void memcpy_tolower(uint8_t *d, uint8_t *s, uint16_t len) { uint16_t i; diff --git a/src/util-mpm-wumanber.c b/src/util-mpm-wumanber.c index 777589d..d4d472b 100644 --- a/src/util-mpm-wumanber.c +++ b/src/util-mpm-wumanber.c @@ -104,6 +104,111 @@ void MpmWuManberRegister (void) { } } +/* WmAddPattern + * + * pat: ptr to the pattern + * patlen: length of the pattern + * nocase: nocase flag: 1 enabled, 0 disable + * pid: pattern id + * sid: signature id (internal id) + */ +int WmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, char nocase, char scan, uint32_t pid, uint32_t sid, uint8_t nosearch) { + WmCtx *ctx = (WmCtx *)mpm_ctx->ctx; + +// printf("WmAddPattern: ctx %p \"", mpm_ctx); prt(pat, patlen); +// printf("\" id %" PRIu32 ", nocase %s\n", id, nocase ? "true" : "false"); + + if (patlen == 0) + return 0; + + /* get a memory piece */ + WmPattern *p = WmInitHashLookup(ctx, pat, patlen, nocase); + if (p == NULL) { +// printf("WmAddPattern: allocing new pattern\n"); + p = WmAllocPattern(mpm_ctx); + if (p == NULL) + goto error; + + p->len = patlen; + + if (nocase) p->flags |= WUMANBER_NOCASE; + + /* setup the case insensitive part of the pattern */ + p->ci = SCMalloc(patlen); + if (p->ci == NULL) goto error; + mpm_ctx->memory_cnt++; + mpm_ctx->memory_size += patlen; + memcpy_tolower(p->ci, pat, patlen); + + /* setup the case sensitive part of the pattern */ + if (p->flags & WUMANBER_NOCASE) { + /* nocase means no difference between cs and ci */ + p->cs = p->ci; + } else { + if (memcmp(p->ci,pat,p->len) == 0) { + /* no diff between cs and ci: pat is lowercase */ + p->cs = p->ci; + } else { + p->cs = SCMalloc(patlen); + if (p->cs == NULL) goto error; + mpm_ctx->memory_cnt++; + mpm_ctx->memory_size += patlen; + memcpy(p->cs, pat, patlen); + } + } + + if (p->len > 1) { + p->prefix_cs = (uint16_t)(*(p->cs)+*(p->cs+1)); + p->prefix_ci = (uint16_t)(*(p->ci)+*(p->ci+1)); + } + + //printf("WmAddPattern: ci \""); prt(p->ci,p->len); + //printf("\" cs \""); prt(p->cs,p->len); + //printf("\" prefix_ci %" PRIu32 ", prefix_cs %" PRIu32 "\n", p->prefix_ci, p->prefix_cs); + + /* put in the pattern hash */ + WmInitHashAdd(ctx, p); + + if (mpm_ctx->pattern_cnt == 65535) { + printf("Max search words reached\n"); + exit(1); + } + mpm_ctx->pattern_cnt++; + + if (scan) { /* SCAN */ + if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen; + if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen; + else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen; + p->flags |= WUMANBER_SCAN; + } else { /* SEARCH */ + if (mpm_ctx->search_maxlen < patlen) mpm_ctx->search_maxlen = patlen; + if (mpm_ctx->search_minlen == 0) mpm_ctx->search_minlen = patlen; + else if (mpm_ctx->search_minlen > patlen) mpm_ctx->search_minlen = patlen; + } + } else { + /* if we're reusing a pattern, check we need to check that it is a + * scan pattern if that is what we're adding. If so we set the pattern + * to be a scan pattern. */ + if (scan) { + p->flags = WUMANBER_SCAN; + if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen; + if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen; + else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen; + } + } + + /* we need a match */ + WmEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch); + + mpm_ctx->total_pattern_cnt++; + return 0; + +error: + WmFreePattern(mpm_ctx, p); + return -1; +} + + void prt (uint8_t *buf, uint16_t buflen) { uint16_t i; diff --git a/src/util-mpm-wumanber.h b/src/util-mpm-wumanber.h index 660058f..29c0b9f 100644 --- a/src/util-mpm-wumanber.h +++ b/src/util-mpm-wumanber.h @@ -88,6 +88,9 @@ typedef struct WmThreadCtx_ { void MpmWuManberRegister(void); void WmFreePattern(MpmCtx *, WmPattern *); +int WmAddPattern(MpmCtx *, uint8_t *, uint16_t, uint16_t, + uint16_t, char, char, uint32_t, + uint32_t, uint8_t); /** ---- Inline functions ---- */ @@ -230,110 +233,6 @@ static inline int WmCmpPattern(WmPattern *p, uint8_t *pat, uint16_t patlen, char return 1; } -/* WmAddPattern - * - * pat: ptr to the pattern - * patlen: length of the pattern - * nocase: nocase flag: 1 enabled, 0 disable - * pid: pattern id - * sid: signature id (internal id) - */ -static inline int WmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, char nocase, char scan, uint32_t pid, uint32_t sid, uint8_t nosearch) { - WmCtx *ctx = (WmCtx *)mpm_ctx->ctx; - -// printf("WmAddPattern: ctx %p \"", mpm_ctx); prt(pat, patlen); -// printf("\" id %" PRIu32 ", nocase %s\n", id, nocase ? "true" : "false"); - - if (patlen == 0) - return 0; - - /* get a memory piece */ - WmPattern *p = WmInitHashLookup(ctx, pat, patlen, nocase); - if (p == NULL) { -// printf("WmAddPattern: allocing new pattern\n"); - p = WmAllocPattern(mpm_ctx); - if (p == NULL) - goto error; - - p->len = patlen; - - if (nocase) p->flags |= WUMANBER_NOCASE; - - /* setup the case insensitive part of the pattern */ - p->ci = SCMalloc(patlen); - if (p->ci == NULL) goto error; - mpm_ctx->memory_cnt++; - mpm_ctx->memory_size += patlen; - memcpy_tolower(p->ci, pat, patlen); - - /* setup the case sensitive part of the pattern */ - if (p->flags & WUMANBER_NOCASE) { - /* nocase means no difference between cs and ci */ - p->cs = p->ci; - } else { - if (memcmp(p->ci,pat,p->len) == 0) { - /* no diff between cs and ci: pat is lowercase */ - p->cs = p->ci; - } else { - p->cs = SCMalloc(patlen); - if (p->cs == NULL) goto error; - mpm_ctx->memory_cnt++; - mpm_ctx->memory_size += patlen; - memcpy(p->cs, pat, patlen); - } - } - - if (p->len > 1) { - p->prefix_cs = (uint16_t)(*(p->cs)+*(p->cs+1)); - p->prefix_ci = (uint16_t)(*(p->ci)+*(p->ci+1)); - } - - //printf("WmAddPattern: ci \""); prt(p->ci,p->len); - //printf("\" cs \""); prt(p->cs,p->len); - //printf("\" prefix_ci %" PRIu32 ", prefix_cs %" PRIu32 "\n", p->prefix_ci, p->prefix_cs); - - /* put in the pattern hash */ - WmInitHashAdd(ctx, p); - - if (mpm_ctx->pattern_cnt == 65535) { - printf("Max search words reached\n"); - exit(1); - } - mpm_ctx->pattern_cnt++; - - if (scan) { /* SCAN */ - if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen; - if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen; - else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen; - p->flags |= WUMANBER_SCAN; - } else { /* SEARCH */ - if (mpm_ctx->search_maxlen < patlen) mpm_ctx->search_maxlen = patlen; - if (mpm_ctx->search_minlen == 0) mpm_ctx->search_minlen = patlen; - else if (mpm_ctx->search_minlen > patlen) mpm_ctx->search_minlen = patlen; - } - } else { - /* if we're reusing a pattern, check we need to check that it is a - * scan pattern if that is what we're adding. If so we set the pattern - * to be a scan pattern. */ - if (scan) { - p->flags = WUMANBER_SCAN; - if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen; - if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen; - else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen; - } - } - - /* we need a match */ - WmEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch); - - mpm_ctx->total_pattern_cnt++; - return 0; - -error: - WmFreePattern(mpm_ctx, p); - return -1; -} - static inline uint32_t WmScan(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) { WmCtx *ctx = (WmCtx *)mpm_ctx->ctx; return ctx->Scan(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen); diff --git a/src/util-mpm.c b/src/util-mpm.c index 1c82e8b..20b8f22 100644 --- a/src/util-mpm.c +++ b/src/util-mpm.c @@ -9,6 +9,92 @@ #include "util-mpm-b3g.h" #include "util-hashlist.h" +/** \brief append a match to a bucket + * + * used at search runtime */ +int +MpmMatchAppend(MpmThreadCtx *thread_ctx, PatternMatcherQueue *pmq, MpmEndMatch *em, MpmMatchBucket *mb, uint16_t offset, uint16_t patlen) +{ + /* don't bother looking at sigs that didn't match + * when we scanned. There's no matching anyway. */ + if (pmq != NULL && pmq->mode == PMQ_MODE_SEARCH) { + if (!(pmq->sig_bitarray[(em->sig_id / 8)] & (1<<(em->sig_id % 8)))) + return 0; + } + + /* if our endmatch is set to a single match being enough, + we're not going to add more if we already have one */ + if (em->flags & MPM_ENDMATCH_SINGLE && mb->len) + return 0; + + /* check offset */ + if (offset < em->offset) + return 0; + + /* check depth */ + if (em->depth && (offset+patlen) > em->depth) + return 0; + + /* ok all checks passed, now append the match */ + MpmMatch *m; + /* pull a match from the spare list */ + if (thread_ctx->sparelist != NULL) { + m = thread_ctx->sparelist; + thread_ctx->sparelist = m->qnext; + } else { + m = MpmMatchAlloc(thread_ctx); + if (m == NULL) + return 0; + } + + m->offset = offset; + m->mb = mb; + m->next = NULL; + m->qnext = NULL; + + /* append to the mb list */ + if (mb->bot == NULL) { /* empty list */ + mb->top = m; + mb->bot = m; + } else { /* more items in list */ + mb->bot->next = m; + mb->bot = m; + } + + mb->len++; + + /* put in the queue list */ + if (thread_ctx->qlist == NULL) { /* empty list */ + thread_ctx->qlist = m; + } else { /* more items in list */ + m->qnext = thread_ctx->qlist; + thread_ctx->qlist = m; + } + + BUG_ON(m == m->qnext); + + if (pmq != NULL) { + /* make sure we only append a sig with a matching pattern once, + * so we won't inspect it more than once. For this we keep a + * bitarray of sig internal id's and flag each sig that matched */ + if (!(pmq->sig_bitarray[(em->sig_id / 8)] & (1<<(em->sig_id % 8)))) { + /* flag this sig_id as being added now */ + pmq->sig_bitarray[(em->sig_id / 8)] |= (1<<(em->sig_id % 8)); + /* append the sig_id to the array with matches */ + pmq->sig_id_array[pmq->sig_id_array_cnt] = em->sig_id; + pmq->sig_id_array_cnt++; + } + + /* nosearch flag */ + if (pmq->mode == PMQ_MODE_SCAN && !(em->flags & MPM_ENDMATCH_NOSEARCH)) { + pmq->searchable++; + } + } + + SCLogDebug("len %" PRIu32 " (offset %" PRIu32 ")", mb->len, m->offset); + return 1; +} + /** \brief Setup a pmq * \param pmq Pattern matcher queue to be initialized * \param maxid Max id to be matched on diff --git a/src/util-mpm.h b/src/util-mpm.h index 952ee66..9548b89 100644 --- a/src/util-mpm.h +++ b/src/util-mpm.h @@ -162,10 +162,13 @@ void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t, uint32_t); uint32_t MpmGetHashSize(const char *); uint32_t MpmGetBloomSize(const char *); +int +MpmMatchAppend(MpmThreadCtx *, PatternMatcherQueue *, MpmEndMatch *, + MpmMatchBucket *, uint16_t, uint16_t); + /** ------ Inline functions ------- */ static inline MpmMatch *MpmMatchAlloc(MpmThreadCtx *); -static inline int MpmMatchAppend(MpmThreadCtx *, PatternMatcherQueue *, MpmEndMatch *, MpmMatchBucket *, uint16_t, uint16_t); /** \brief allocate a match * @@ -186,90 +189,5 @@ MpmMatchAlloc(MpmThreadCtx *thread_ctx) { return m; } -/** \brief append a match to a bucket - * - * used at search runtime */ -static inline int -MpmMatchAppend(MpmThreadCtx *thread_ctx, PatternMatcherQueue *pmq, MpmEndMatch *em, MpmMatchBucket *mb, uint16_t offset, uint16_t patlen) -{ - /* don't bother looking at sigs that didn't match - * when we scanned. There's no matching anyway. */ - if (pmq != NULL && pmq->mode == PMQ_MODE_SEARCH) { - if (!(pmq->sig_bitarray[(em->sig_id / 8)] & (1<<(em->sig_id % 8)))) - return 0; - } - - /* if our endmatch is set to a single match being enough, - we're not going to add more if we already have one */ - if (em->flags & MPM_ENDMATCH_SINGLE && mb->len) - return 0; - - /* check offset */ - if (offset < em->offset) - return 0; - - /* check depth */ - if (em->depth && (offset+patlen) > em->depth) - return 0; - - /* ok all checks passed, now append the match */ - MpmMatch *m; - /* pull a match from the spare list */ - if (thread_ctx->sparelist != NULL) { - m = thread_ctx->sparelist; - thread_ctx->sparelist = m->qnext; - } else { - m = MpmMatchAlloc(thread_ctx); - if (m == NULL) - return 0; - } - - m->offset = offset; - m->mb = mb; - m->next = NULL; - m->qnext = NULL; - - /* append to the mb list */ - if (mb->bot == NULL) { /* empty list */ - mb->top = m; - mb->bot = m; - } else { /* more items in list */ - mb->bot->next = m; - mb->bot = m; - } - - mb->len++; - - /* put in the queue list */ - if (thread_ctx->qlist == NULL) { /* empty list */ - thread_ctx->qlist = m; - } else { /* more items in list */ - m->qnext = thread_ctx->qlist; - thread_ctx->qlist = m; - } - - BUG_ON(m == m->qnext); - - if (pmq != NULL) { - /* make sure we only append a sig with a matching pattern once, - * so we won't inspect it more than once. For this we keep a - * bitarray of sig internal id's and flag each sig that matched */ - if (!(pmq->sig_bitarray[(em->sig_id / 8)] & (1<<(em->sig_id % 8)))) { - /* flag this sig_id as being added now */ - pmq->sig_bitarray[(em->sig_id / 8)] |= (1<<(em->sig_id % 8)); - /* append the sig_id to the array with matches */ - pmq->sig_id_array[pmq->sig_id_array_cnt] = em->sig_id; - pmq->sig_id_array_cnt++; - } - - /* nosearch flag */ - if (pmq->mode == PMQ_MODE_SCAN && !(em->flags & MPM_ENDMATCH_NOSEARCH)) { - pmq->searchable++; - } - } - - SCLogDebug("len %" PRIu32 " (offset %" PRIu32 ")", mb->len, m->offset); - return 1; -} #endif /* __UTIL_MPM_H__ */ diff --git a/src/util-radix-tree.c b/src/util-radix-tree.c index 53313b0..e69638b 100644 --- a/src/util-radix-tree.c +++ b/src/util-radix-tree.c @@ -107,6 +107,22 @@ void SCRadixChopIPAddressAgainstNetmask(uint8_t *stream, uint8_t netmask, } /** + * \brief Frees a Radix tree node + * + * \param node Pointer to a Radix tree node + * \param tree Pointer to the Radix tree to which this node belongs + */ +void SCRadixReleaseNode(SCRadixNode *node, SCRadixTree *tree) +{ + if (node != NULL) { + SCRadixReleasePrefix(node->prefix, tree); + SCFree(node); + } + + return; +} + +/** * \brief Allocates and returns a new instance of SCRadixUserData. * * \param netmask The netmask entry that has to be made in the new diff --git a/src/util-radix-tree.h b/src/util-radix-tree.h index 6cfed45..9b2ff5b 100644 --- a/src/util-radix-tree.h +++ b/src/util-radix-tree.h @@ -110,10 +110,11 @@ void SCRadixRegisterTests(void); void SCRadixReleasePrefix(SCRadixPrefix *, SCRadixTree *); int SCRadixPrefixContainNetmaskAndSetUserData(SCRadixPrefix *, uint16_t, int); +void SCRadixReleaseNode(SCRadixNode *, SCRadixTree *); + /** ----- Inline funcions ------ */ static inline SCRadixNode *SCRadixCreateNode(); -static inline void SCRadixReleaseNode(SCRadixNode *, SCRadixTree *); static inline SCRadixNode *SCRadixFindKeyIPNetblock(SCRadixPrefix *, SCRadixNode *); /** @@ -135,22 +136,6 @@ static inline SCRadixNode *SCRadixCreateNode() } /** - * \brief Frees a Radix tree node - * - * \param node Pointer to a Radix tree node - * \param tree Pointer to the Radix tree to which this node belongs - */ -static inline void SCRadixReleaseNode(SCRadixNode *node, SCRadixTree *tree) -{ - if (node != NULL) { - SCRadixReleasePrefix(node->prefix, tree); - SCFree(node); - } - - return; -} - -/** * \brief Checks if an IP prefix falls under a netblock, in the path to the root * of the tree, from the node. Used internally by SCRadixFindKey() * diff --git a/src/util-spm-bs.c b/src/util-spm-bs.c index e0f1e3c..267a9f0 100644 --- a/src/util-spm-bs.c +++ b/src/util-spm-bs.c @@ -17,4 +17,47 @@ #include #include +/** + * \brief Basic search improved. Limits are better handled, so + * it doesn't start searches that wont fit in the remaining buffer + * + * \param haystack pointer to the buffer to search in + * \param haystack_len length limit of the buffer + * \param neddle pointer to the pattern we ar searching for + * \param needle_len length limit of the needle + * + * \retval ptr to start of the match; NULL if no match + */ +uint8_t *BasicSearch(const uint8_t *haystack, uint32_t haystack_len, const uint8_t *needle, uint32_t needle_len) { + const uint8_t *h, *n; + const uint8_t *hmax = haystack + haystack_len; + const uint8_t *nmax = needle + needle_len; + + if (needle_len == 0 || needle_len > haystack_len) + return NULL; + + for (n = needle; nmax - n <= hmax - haystack; haystack++) { + if (*haystack != *n) { + continue; + } + /* one byte needles */ + if (needle_len == 1) + return (uint8_t *)haystack; + + for (h = haystack+1, n++; nmax - n <= hmax - haystack; h++, n++) { + if (*h != *n) { + break; + } + /* if we run out of needle we fully matched */ + if (n == nmax - 1) { + return (uint8_t *)haystack; + } + } + n = needle; + } + + return NULL; +} + + /* Look at the .h, all the functions are Inlined */ diff --git a/src/util-spm-bs.h b/src/util-spm-bs.h index 614f60f..fa9445f 100644 --- a/src/util-spm-bs.h +++ b/src/util-spm-bs.h @@ -3,54 +3,13 @@ #include "suricata-common.h" #include "suricata.h" + /** ----- Inline functions ------- */ -static inline uint8_t *BasicSearch(const uint8_t *, uint32_t, const uint8_t *, uint32_t); +uint8_t *BasicSearch(const uint8_t *, uint32_t, const uint8_t *, uint32_t); static inline uint8_t *BasicSearchNocase(const uint8_t *, uint32_t, const uint8_t *, uint32_t); static inline void BasicSearchInit (void); /** - * \brief Basic search improved. Limits are better handled, so - * it doesn't start searches that wont fit in the remaining buffer - * - * \param haystack pointer to the buffer to search in - * \param haystack_len length limit of the buffer - * \param neddle pointer to the pattern we ar searching for - * \param needle_len length limit of the needle - * - * \retval ptr to start of the match; NULL if no match - */ -static inline uint8_t *BasicSearch(const uint8_t *haystack, uint32_t haystack_len, const uint8_t *needle, uint32_t needle_len) { - const uint8_t *h, *n; - const uint8_t *hmax = haystack + haystack_len; - const uint8_t *nmax = needle + needle_len; - - if (needle_len == 0 || needle_len > haystack_len) - return NULL; - - for (n = needle; nmax - n <= hmax - haystack; haystack++) { - if (*haystack != *n) { - continue; - } - /* one byte needles */ - if (needle_len == 1) - return (uint8_t *)haystack; - - for (h = haystack+1, n++; nmax - n <= hmax - haystack; h++, n++) { - if (*h != *n) { - break; - } - /* if we run out of needle we fully matched */ - if (n == nmax - 1) { - return (uint8_t *)haystack; - } - } - n = needle; - } - - return NULL; -} - -/** * \brief Basic search case less * * \param haystack pointer to the buffer to search in diff --git a/src/util-spm.c b/src/util-spm.c index e9a6bfe..42645e3 100644 --- a/src/util-spm.c +++ b/src/util-spm.c @@ -40,6 +40,50 @@ #include "util-spm-bm.h" #include "util-clock.h" +/** + * \brief Search a pattern in the text using Boyer Moore algorithm + * (build a bad character shifts array and good prefixes shift array) + * + * \param text Text to search in + * \param textlen length of the text + * \param needle pattern to search for + * \param needlelen length of the pattern + */ +uint8_t *BoyerMooreSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen) { + int32_t bmBc[ALPHABET_SIZE]; + int32_t *bmGs = SCMalloc(sizeof(int32_t)*(needlelen + 1)); + + PreBmGs(needle, needlelen, bmGs); + PreBmBc(needle, needlelen, bmBc); + + uint8_t *ret = BoyerMoore(needle, needlelen, text, textlen, bmGs, bmBc); + SCFree(bmGs); + + return ret; +} + +/** + * \brief Search a pattern in the text using Boyer Moore nocase algorithm + * (build a bad character shifts array and good prefixes shift array) + * + * \param text Text to search in + * \param textlen length of the text + * \param needle pattern to search for + * \param needlelen length of the pattern + */ +uint8_t *BoyerMooreNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen) { + int32_t bmBc[ALPHABET_SIZE]; + int32_t *bmGs = SCMalloc(sizeof(int32_t)*(needlelen + 1)); + + PreBmGsNocase(needle, needlelen, bmGs); + PreBmBcNocase(needle, needlelen, bmBc); + + uint8_t *ret = BoyerMooreNocase(needle, needlelen, text, textlen, bmGs, bmBc); + SCFree(bmGs); + + return ret; +} + /* Look at the .h, all the functions are Inline */ #ifdef UNITTESTS diff --git a/src/util-spm.h b/src/util-spm.h index 971cc44..f1bbb6c 100644 --- a/src/util-spm.h +++ b/src/util-spm.h @@ -10,8 +10,8 @@ /** Default algorithm to use: Boyer Moore */ static inline uint8_t *Bs2bmSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen); static inline uint8_t *Bs2bmNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen); -static inline uint8_t *BoyerMooreSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen); -static inline uint8_t *BoyerMooreNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen); +uint8_t *BoyerMooreSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen); +uint8_t *BoyerMooreNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen); /* Macros for automatic algorithm selection (use them only when you can't store the context) */ #define SpmSearch(text, textlen, needle, needlelen) ({\ @@ -76,49 +76,5 @@ static inline uint8_t *Bs2bmNocaseSearch(uint8_t *text, uint32_t textlen, uint8_ return Bs2BmNocase(text, textlen, needle, needlelen, badchars); } -/** - * \brief Search a pattern in the text using Boyer Moore algorithm - * (build a bad character shifts array and good prefixes shift array) - * - * \param text Text to search in - * \param textlen length of the text - * \param needle pattern to search for - * \param needlelen length of the pattern - */ -static inline uint8_t *BoyerMooreSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen) { - int32_t bmBc[ALPHABET_SIZE]; - int32_t *bmGs = SCMalloc(sizeof(int32_t)*(needlelen + 1)); - - PreBmGs(needle, needlelen, bmGs); - PreBmBc(needle, needlelen, bmBc); - - uint8_t *ret = BoyerMoore(needle, needlelen, text, textlen, bmGs, bmBc); - SCFree(bmGs); - - return ret; -} - -/** - * \brief Search a pattern in the text using Boyer Moore nocase algorithm - * (build a bad character shifts array and good prefixes shift array) - * - * \param text Text to search in - * \param textlen length of the text - * \param needle pattern to search for - * \param needlelen length of the pattern - */ -static inline uint8_t *BoyerMooreNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen) { - int32_t bmBc[ALPHABET_SIZE]; - int32_t *bmGs = SCMalloc(sizeof(int32_t)*(needlelen + 1)); - - PreBmGsNocase(needle, needlelen, bmGs); - PreBmBcNocase(needle, needlelen, bmBc); - - uint8_t *ret = BoyerMooreNocase(needle, needlelen, text, textlen, bmGs, bmBc); - SCFree(bmGs); - - return ret; -} - #endif /* __UTIL_SPM_H__ */ -- 1.6.0.4