aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

rebase commit for hscd and hsmd patches

Browse Source
remotes/origin/master
Anoop Saldanha 15 years ago committed by Victor Julien
parent 22b1f5b22b
commit 0677190960
6 changed files with 103 additions and 47 deletions
Show Stats Download Patch File Download Diff File

4
src/detect-engine-hscd.c
Unescape Escape View File

@ -340,7 +340,7 @@ match:
* \retval cnt Number of matches reported by the mpm algo. * \retval cnt Number of matches reported by the mpm algo.
*/ */
int DetectEngineRunHttpStatCodeMpm(DetectEngineThreadCtx *det_ctx, Flow *f, int DetectEngineRunHttpStatCodeMpm(DetectEngineThreadCtx *det_ctx, Flow *f,
HtpState *htp_state) HtpState *htp_state, uint8_t flags)
{ {
SCEnter(); SCEnter();
@ -374,7 +374,7 @@ int DetectEngineRunHttpStatCodeMpm(DetectEngineThreadCtx *det_ctx, Flow *f,
cnt += HttpStatCodePatternSearch(det_ctx, cnt += HttpStatCodePatternSearch(det_ctx,
(uint8_t *)bstr_ptr(tx->response_status), (uint8_t *)bstr_ptr(tx->response_status),
bstr_len(tx->response_status)); bstr_len(tx->response_status), flags);
} }
end: end:

2
src/detect-engine-hscd.h
Unescape Escape View File

@ -26,7 +26,7 @@
#include "app-layer-htp.h" #include "app-layer-htp.h"
int DetectEngineRunHttpStatCodeMpm(DetectEngineThreadCtx *, int DetectEngineRunHttpStatCodeMpm(DetectEngineThreadCtx *,
Flow *f, HtpState *); Flow *f, HtpState *, uint8_t);
int DetectEngineInspectHttpStatCode(DetectEngineCtx *, DetectEngineThreadCtx *, int DetectEngineInspectHttpStatCode(DetectEngineCtx *, DetectEngineThreadCtx *,
Signature *, Flow *, uint8_t, void *); Signature *, Flow *, uint8_t, void *);
void DetectEngineHttpStatCodeRegisterTests(void); void DetectEngineHttpStatCodeRegisterTests(void);

4
src/detect-engine-hsmd.c
Unescape Escape View File

@ -340,7 +340,7 @@ match:
* \retval cnt Number of matches reported by the mpm algo. * \retval cnt Number of matches reported by the mpm algo.
*/ */
int DetectEngineRunHttpStatMsgMpm(DetectEngineThreadCtx *det_ctx, Flow *f, int DetectEngineRunHttpStatMsgMpm(DetectEngineThreadCtx *det_ctx, Flow *f,
HtpState *htp_state) HtpState *htp_state, uint8_t flags)
{ {
SCEnter(); SCEnter();
@ -374,7 +374,7 @@ int DetectEngineRunHttpStatMsgMpm(DetectEngineThreadCtx *det_ctx, Flow *f,
cnt += HttpStatMsgPatternSearch(det_ctx, cnt += HttpStatMsgPatternSearch(det_ctx,
(uint8_t *)bstr_ptr(tx->response_message), (uint8_t *)bstr_ptr(tx->response_message),
bstr_len(tx->response_message)); bstr_len(tx->response_message), flags);
} }
end: end:

4
src/detect-engine-hsmd.h
Unescape Escape View File

@ -26,9 +26,9 @@
#include "app-layer-htp.h" #include "app-layer-htp.h"
int DetectEngineRunHttpStatMsgMpm(DetectEngineThreadCtx *, int DetectEngineRunHttpStatMsgMpm(DetectEngineThreadCtx *,
Flow *f, HtpState *); Flow *f, HtpState *, uint8_t);
int DetectEngineInspectHttpStatMsg(DetectEngineCtx *, DetectEngineThreadCtx *, int DetectEngineInspectHttpStatMsg(DetectEngineCtx *, DetectEngineThreadCtx *,
Signature *, Flow *, uint8_t, void *); Signature *, Flow *, uint8_t, void *);
void DetectEngineHttpStatMsgRegisterTests(void); void DetectEngineHttpStatMsgRegisterTests(void);
#endif /* __DETECT_ENGINE_HSMD_H__ */ #endif /* __DETECT_ENGINE_HSMD_H__ */

132
src/detect-engine-mpm.c
Unescape Escape View File

@ -534,17 +534,26 @@ uint32_t HttpRawUriPatternSearch(DetectEngineThreadCtx *det_ctx,
* \retval ret Number of matches. * \retval ret Number of matches.
*/ */
uint32_t HttpStatMsgPatternSearch(DetectEngineThreadCtx *det_ctx, uint32_t HttpStatMsgPatternSearch(DetectEngineThreadCtx *det_ctx,
uint8_t *stat_msg, uint32_t stat_msg_len) uint8_t *stat_msg, uint32_t stat_msg_len, uint8_t flags)
{ {
SCEnter(); SCEnter();
if (det_ctx->sgh->mpm_hsmd_ctx == NULL)
SCReturnUInt(0);
uint32_t ret; uint32_t ret;
ret = mpm_table[det_ctx->sgh->mpm_hsmd_ctx->mpm_type]. if (flags & STREAM_TOSERVER) {
Search(det_ctx->sgh->mpm_hsmd_ctx, &det_ctx->mtcu, if (det_ctx->sgh->mpm_hsmd_ctx_ts == NULL)
&det_ctx->pmq, stat_msg, stat_msg_len); SCReturnUInt(0);
ret = mpm_table[det_ctx->sgh->mpm_hsmd_ctx_ts->mpm_type].
Search(det_ctx->sgh->mpm_hsmd_ctx_ts, &det_ctx->mtcu,
&det_ctx->pmq, stat_msg, stat_msg_len);
} else {
if (det_ctx->sgh->mpm_hsmd_ctx_tc == NULL)
SCReturnUInt(0);
ret = mpm_table[det_ctx->sgh->mpm_hsmd_ctx_tc->mpm_type].
Search(det_ctx->sgh->mpm_hsmd_ctx_tc, &det_ctx->mtcu,
&det_ctx->pmq, stat_msg, stat_msg_len);
}
SCReturnUInt(ret); SCReturnUInt(ret);
} }
@ -559,17 +568,26 @@ uint32_t HttpStatMsgPatternSearch(DetectEngineThreadCtx *det_ctx,
* \retval ret Number of matches. * \retval ret Number of matches.
*/ */
uint32_t HttpStatCodePatternSearch(DetectEngineThreadCtx *det_ctx, uint32_t HttpStatCodePatternSearch(DetectEngineThreadCtx *det_ctx,
uint8_t *stat_code, uint32_t stat_code_len) uint8_t *stat_code, uint32_t stat_code_len, uint8_t flags)
{ {
SCEnter(); SCEnter();
if (det_ctx->sgh->mpm_hscd_ctx == NULL)
SCReturnUInt(0);
uint32_t ret; uint32_t ret;
ret = mpm_table[det_ctx->sgh->mpm_hscd_ctx->mpm_type]. if (flags & STREAM_TOSERVER) {
Search(det_ctx->sgh->mpm_hscd_ctx, &det_ctx->mtcu, if (det_ctx->sgh->mpm_hscd_ctx_ts == NULL)
&det_ctx->pmq, stat_code, stat_code_len); SCReturnUInt(0);
ret = mpm_table[det_ctx->sgh->mpm_hscd_ctx_ts->mpm_type].
Search(det_ctx->sgh->mpm_hscd_ctx_ts, &det_ctx->mtcu,
&det_ctx->pmq, stat_code, stat_code_len);
} else {
if (det_ctx->sgh->mpm_hscd_ctx_tc == NULL)
SCReturnUInt(0);
ret = mpm_table[det_ctx->sgh->mpm_hscd_ctx_tc->mpm_type].
Search(det_ctx->sgh->mpm_hscd_ctx_tc, &det_ctx->mtcu,
&det_ctx->pmq, stat_code, stat_code_len);
}
SCReturnUInt(ret); SCReturnUInt(ret);
} }
@ -1295,11 +1313,17 @@ static void PopulateMpmAddPatternToMpm(DetectEngineCtx *de_ctx,
sgh_flags = SIG_GROUP_HEAD_MPM_HRUD; sgh_flags = SIG_GROUP_HEAD_MPM_HRUD;
cd_flags = DETECT_CONTENT_HRUD_MPM; cd_flags = DETECT_CONTENT_HRUD_MPM;
} else if (mpm_sm->type == DETECT_AL_HTTP_STAT_MSG) { } else if (mpm_sm->type == DETECT_AL_HTTP_STAT_MSG) {
mpm_ctx = sgh->mpm_hsmd_ctx; if (s->flags & SIG_FLAG_TOSERVER)
mpm_ctx_ts = sgh->mpm_hsmd_ctx_ts;
if (s->flags & SIG_FLAG_TOCLIENT)
mpm_ctx_tc = sgh->mpm_hsmd_ctx_tc;
sgh_flags = SIG_GROUP_HEAD_MPM_HSMD; sgh_flags = SIG_GROUP_HEAD_MPM_HSMD;
cd_flags = DETECT_CONTENT_HSMD_MPM; cd_flags = DETECT_CONTENT_HSMD_MPM;
} else if (mpm_sm->type == DETECT_AL_HTTP_STAT_CODE) { } else if (mpm_sm->type == DETECT_AL_HTTP_STAT_CODE) {
mpm_ctx = sgh->mpm_hscd_ctx; if (s->flags & SIG_FLAG_TOSERVER)
mpm_ctx_ts = sgh->mpm_hscd_ctx_ts;
if (s->flags & SIG_FLAG_TOCLIENT)
mpm_ctx_tc = sgh->mpm_hscd_ctx_tc;
sgh_flags = SIG_GROUP_HEAD_MPM_HSCD; sgh_flags = SIG_GROUP_HEAD_MPM_HSCD;
cd_flags = DETECT_CONTENT_HSCD_MPM; cd_flags = DETECT_CONTENT_HSCD_MPM;
} }
@ -1952,37 +1976,45 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
if (sh->flags & SIG_GROUP_HAVEHSMDCONTENT) { if (sh->flags & SIG_GROUP_HAVEHSMDCONTENT) {
if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) {
sh->mpm_hsmd_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_hsmd); sh->mpm_hsmd_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_hsmd, 0);
sh->mpm_hsmd_ctx_tc = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_hsmd, 1);
} else { } else {
sh->mpm_hsmd_ctx = MpmFactoryGetMpmCtxForProfile(MPM_CTX_FACTORY_UNIQUE_CONTEXT); sh->mpm_hsmd_ctx_ts = MpmFactoryGetMpmCtxForProfile(MPM_CTX_FACTORY_UNIQUE_CONTEXT, 0);
sh->mpm_hsmd_ctx_tc = MpmFactoryGetMpmCtxForProfile(MPM_CTX_FACTORY_UNIQUE_CONTEXT, 1);
} }
if (sh->mpm_hsmd_ctx == NULL) { if (sh->mpm_hsmd_ctx_ts == NULL || sh->mpm_hsmd_ctx_tc == NULL) {
SCLogDebug("sh->mpm_hsmd_ctx == NULL. This should never happen"); SCLogDebug("sh->mpm_hsmd_ctx == NULL. This should never happen");
exit(EXIT_FAILURE); exit(EXIT_FAILURE);
} }
#ifndef __SC_CUDA_SUPPORT__ #ifndef __SC_CUDA_SUPPORT__
MpmInitCtx(sh->mpm_hsmd_ctx, de_ctx->mpm_matcher, -1); MpmInitCtx(sh->mpm_hsmd_ctx_ts, de_ctx->mpm_matcher, -1);
MpmInitCtx(sh->mpm_hsmd_ctx_tc, de_ctx->mpm_matcher, -1);
#else #else
MpmInitCtx(sh->mpm_hsmd_ctx, de_ctx->mpm_matcher, de_ctx->cuda_rc_mod_handle); MpmInitCtx(sh->mpm_hsmd_ctx_ts, de_ctx->mpm_matcher, de_ctx->cuda_rc_mod_handle);
MpmInitCtx(sh->mpm_hsmd_ctx_tc, de_ctx->mpm_matcher, de_ctx->cuda_rc_mod_handle);
#endif #endif
} }
if (sh->flags & SIG_GROUP_HAVEHSCDCONTENT) { if (sh->flags & SIG_GROUP_HAVEHSCDCONTENT) {
if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) {
sh->mpm_hscd_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_hscd); sh->mpm_hscd_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_hscd, 0);
sh->mpm_hscd_ctx_tc = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_hscd, 1);
} else { } else {
sh->mpm_hscd_ctx = MpmFactoryGetMpmCtxForProfile(MPM_CTX_FACTORY_UNIQUE_CONTEXT); sh->mpm_hscd_ctx_ts = MpmFactoryGetMpmCtxForProfile(MPM_CTX_FACTORY_UNIQUE_CONTEXT, 0);
sh->mpm_hscd_ctx_tc = MpmFactoryGetMpmCtxForProfile(MPM_CTX_FACTORY_UNIQUE_CONTEXT, 1);
} }
if (sh->mpm_hscd_ctx == NULL) { if (sh->mpm_hscd_ctx_ts == NULL || sh->mpm_hscd_ctx_tc == NULL) {
SCLogDebug("sh->mpm_hscd_ctx == NULL. This should never happen"); SCLogDebug("sh->mpm_hscd_ctx == NULL. This should never happen");
exit(EXIT_FAILURE); exit(EXIT_FAILURE);
} }
#ifndef __SC_CUDA_SUPPORT__ #ifndef __SC_CUDA_SUPPORT__
MpmInitCtx(sh->mpm_hscd_ctx, de_ctx->mpm_matcher, -1); MpmInitCtx(sh->mpm_hscd_ctx_ts, de_ctx->mpm_matcher, -1);
MpmInitCtx(sh->mpm_hscd_ctx_tc, de_ctx->mpm_matcher, -1);
#else #else
MpmInitCtx(sh->mpm_hscd_ctx, de_ctx->mpm_matcher, de_ctx->cuda_rc_mod_handle); MpmInitCtx(sh->mpm_hscd_ctx_ts, de_ctx->mpm_matcher, de_ctx->cuda_rc_mod_handle, 0);
MpmInitCtx(sh->mpm_hscd_ctx_tc, de_ctx->mpm_matcher, de_ctx->cuda_rc_mod_handle, 1);
#endif #endif
} }
@ -2299,27 +2331,51 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
} }
} }
} }
if (sh->mpm_hsmd_ctx != NULL) { if (sh->mpm_hsmd_ctx_ts != NULL) {
if (sh->mpm_hsmd_ctx->pattern_cnt == 0) { if (sh->mpm_hsmd_ctx_ts->pattern_cnt == 0) {
MpmFactoryReClaimMpmCtx(sh->mpm_hsmd_ctx); MpmFactoryReClaimMpmCtx(sh->mpm_hsmd_ctx_ts);
sh->mpm_hsmd_ctx = NULL; sh->mpm_hsmd_ctx_ts = NULL;
} else {
if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL &&
sh->flags & SIG_GROUP_HAVEHSMDCONTENT) {
if (mpm_table[sh->mpm_hsmd_ctx_ts->mpm_type].Prepare != NULL)
mpm_table[sh->mpm_hsmd_ctx_ts->mpm_type].Prepare(sh->mpm_hsmd_ctx_ts);
}
}
}
if (sh->mpm_hsmd_ctx_tc != NULL) {
if (sh->mpm_hsmd_ctx_tc->pattern_cnt == 0) {
MpmFactoryReClaimMpmCtx(sh->mpm_hsmd_ctx_tc);
sh->mpm_hsmd_ctx_tc = NULL;
} else { } else {
if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL && if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL &&
sh->flags & SIG_GROUP_HAVEHSMDCONTENT) { sh->flags & SIG_GROUP_HAVEHSMDCONTENT) {
if (mpm_table[sh->mpm_hsmd_ctx->mpm_type].Prepare != NULL) if (mpm_table[sh->mpm_hsmd_ctx_tc->mpm_type].Prepare != NULL)
mpm_table[sh->mpm_hsmd_ctx->mpm_type].Prepare(sh->mpm_hsmd_ctx); mpm_table[sh->mpm_hsmd_ctx_tc->mpm_type].Prepare(sh->mpm_hsmd_ctx_tc);
}
}
}
if (sh->mpm_hscd_ctx_ts != NULL) {
if (sh->mpm_hscd_ctx_ts->pattern_cnt == 0) {
MpmFactoryReClaimMpmCtx(sh->mpm_hscd_ctx_ts);
sh->mpm_hscd_ctx_ts = NULL;
} else {
if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL &&
sh->flags & SIG_GROUP_HAVEHSCDCONTENT) {
if (mpm_table[sh->mpm_hscd_ctx_ts->mpm_type].Prepare != NULL)
mpm_table[sh->mpm_hscd_ctx_ts->mpm_type].Prepare(sh->mpm_hscd_ctx_ts);
} }
} }
} }
if (sh->mpm_hscd_ctx != NULL) { if (sh->mpm_hscd_ctx_tc != NULL) {
if (sh->mpm_hscd_ctx->pattern_cnt == 0) { if (sh->mpm_hscd_ctx_tc->pattern_cnt == 0) {
MpmFactoryReClaimMpmCtx(sh->mpm_hscd_ctx); MpmFactoryReClaimMpmCtx(sh->mpm_hscd_ctx_tc);
sh->mpm_hscd_ctx = NULL; sh->mpm_hscd_ctx_tc = NULL;
} else { } else {
if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL && if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL &&
sh->flags & SIG_GROUP_HAVEHSCDCONTENT) { sh->flags & SIG_GROUP_HAVEHSCDCONTENT) {
if (mpm_table[sh->mpm_hscd_ctx->mpm_type].Prepare != NULL) if (mpm_table[sh->mpm_hscd_ctx_tc->mpm_type].Prepare != NULL)
mpm_table[sh->mpm_hscd_ctx->mpm_type].Prepare(sh->mpm_hscd_ctx); mpm_table[sh->mpm_hscd_ctx_tc->mpm_type].Prepare(sh->mpm_hscd_ctx_tc);
} }
} }
} }

4
src/detect.c
Unescape Escape View File

@ -1212,12 +1212,12 @@ static inline void DetectMpmPrefilter(DetectEngineCtx *de_ctx,
} }
if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HSMD) { if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HSMD) {
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HSMD); PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HSMD);
DetectEngineRunHttpStatMsgMpm(det_ctx, p->flow, alstate); DetectEngineRunHttpStatMsgMpm(det_ctx, p->flow, alstate, flags);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HSMD); PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HSMD);
} }
if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HSCD) { if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HSCD) {
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HSCD); PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HSCD);
DetectEngineRunHttpStatCodeMpm(det_ctx, p->flow, alstate); DetectEngineRunHttpStatCodeMpm(det_ctx, p->flow, alstate, flags);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HSCD); PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HSCD);
} }
} }

Write Preview
Loading…
Cancel
Save