aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Speed up per sgh content maxlen calc. Remove mpm ptrs from mpm ctx. Add unittests testing the detection engine internals.

Browse Source
remotes/origin/master-1.0.x
Victor Julien 15 years ago
parent e4c98c562c
commit 2d0e9658f8
21 changed files with 1199 additions and 311 deletions
Show Stats Download Patch File Download Diff File

16
src/app-layer-detect-proto.c
Unescape Escape View File

@ -109,7 +109,7 @@ void AlpProtoAdd(AlpProtoDetectCtx *ctx, uint16_t ip_proto, uint16_t al_proto, c
dir = &ctx->toserver;
}
dir->mpm_ctx.AddScanPattern(&dir->mpm_ctx, cd->content, cd->content_len,
mpm_table[dir->mpm_ctx.mpm_type].AddScanPattern(&dir->mpm_ctx, cd->content, cd->content_len,
cd->offset, cd->depth, dir->id, dir->id, 0);
dir->map[dir->id] = al_proto;
dir->id++;
@ -138,8 +138,8 @@ void AlpProtoFinalizeGlobal(AlpProtoDetectCtx *ctx) {
if (ctx == NULL)
return;
ctx->toclient.mpm_ctx.Prepare(&ctx->toclient.mpm_ctx);
ctx->toserver.mpm_ctx.Prepare(&ctx->toserver.mpm_ctx);
mpm_table[ctx->toclient.mpm_ctx.mpm_type].Prepare(&ctx->toclient.mpm_ctx);
mpm_table[ctx->toserver.mpm_ctx.mpm_type].Prepare(&ctx->toserver.mpm_ctx);
}
void AppLayerDetectProtoThreadInit(void) {
@ -227,7 +227,7 @@ uint16_t AppLayerDetectGetProto(AlpProtoDetectCtx *ctx, AlpProtoDetectThreadCtx
return ALPROTO_UNKNOWN;
uint16_t proto;
uint32_t cnt = dir->mpm_ctx.Scan(&dir->mpm_ctx, &tdir->mpm_ctx, &tdir->pmq, buf, buflen);
uint32_t cnt = mpm_table[dir->mpm_ctx.mpm_type].Scan(&dir->mpm_ctx, &tdir->mpm_ctx, &tdir->pmq, buf, buflen);
//printf("AppLayerDetectGetProto: scan cnt %" PRIu32 "\n", cnt);
if (cnt == 0) {
proto = ALPROTO_UNKNOWN;
@ -241,8 +241,8 @@ uint16_t AppLayerDetectGetProto(AlpProtoDetectCtx *ctx, AlpProtoDetectThreadCtx
end:
PmqReset(&tdir->pmq);
if (dir->mpm_ctx.Cleanup != NULL) {
dir->mpm_ctx.Cleanup(&tdir->mpm_ctx);
if (mpm_table[dir->mpm_ctx.mpm_type].Cleanup != NULL) {
mpm_table[dir->mpm_ctx.mpm_type].Cleanup(&tdir->mpm_ctx);
}
#if 0
printf("AppLayerDetectGetProto: returning %" PRIu16 " (%s): ", proto, flags & STREAM_TOCLIENT ? "TOCLIENT" : "TOSERVER");
@ -497,7 +497,7 @@ int AlpDetectTest03(void) {
AlpProtoFinalizeGlobal(&ctx);
AlpProtoFinalizeThread(&ctx, &tctx);
uint32_t cnt = ctx.toclient.mpm_ctx.Scan(&ctx.toclient.mpm_ctx, &tctx.toclient.mpm_ctx, NULL, l7data, sizeof(l7data));
uint32_t cnt = mpm_table[ctx.toclient.mpm_ctx.mpm_type].Scan(&ctx.toclient.mpm_ctx, &tctx.toclient.mpm_ctx, NULL, l7data, sizeof(l7data));
if (cnt != 1) {
printf("cnt %u != 1: ", cnt);
r = 0;
@ -530,7 +530,7 @@ int AlpDetectTest04(void) {
AlpProtoFinalizeGlobal(&ctx);
AlpProtoFinalizeThread(&ctx, &tctx);
uint32_t cnt = ctx.toclient.mpm_ctx.Scan(&ctx.toclient.mpm_ctx, &tctx.toclient.mpm_ctx, NULL, l7data, sizeof(l7data));
uint32_t cnt = mpm_table[ctx.toclient.mpm_ctx.mpm_type].Scan(&ctx.toclient.mpm_ctx, &tctx.toclient.mpm_ctx, NULL, l7data, sizeof(l7data));
if (cnt != 0) {
printf("cnt %u != 0: ", cnt);
r = 0;

3
src/detect-dsize.c
Unescape Escape View File

@ -187,6 +187,9 @@ int DetectDsizeSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, char *
sm->ctx = (void *)dd;
SigMatchAppend(s,m,sm);
/* tell the sig it has a dsize to speed up engine init */
s->flags |= SIG_FLAG_DSIZE;
return 0;
error:

11
src/detect-engine-address.c
Unescape Escape View File

@ -150,8 +150,10 @@ void DetectAddressGroupPrintMemory(void) {
#endif
}
/* used to see if the exact same address group exists in the list
* returns a ptr to the match, or NULL if no match
/** \brief lookup a address in a group list
* used to see if the exact same address group exists in the list
* returns a ptr to the match, or NULL if no match
* \todo hash/hashlist
*/
DetectAddressGroup *DetectAddressGroupLookup(DetectAddressGroup *head, DetectAddressGroup *gr) {
DetectAddressGroup *cur;
@ -208,10 +210,8 @@ int DetectAddressGroupAdd(DetectAddressGroup **head, DetectAddressGroup *ag) {
for (cur = *head; cur != NULL; cur = cur->next) {
prev_cur = cur;
int r = DetectAddressCmp(ag,cur);
int r = DetectAddressCmp(ag, cur);
if (r == ADDRESS_EB) {
//printf("r == EB, inserting here\n");
/* insert here */
ag->prev = cur->prev;
ag->next = cur;
@ -225,7 +225,6 @@ int DetectAddressGroupAdd(DetectAddressGroup **head, DetectAddressGroup *ag) {
return 0;
}
}
//printf("default append\n");
ag->prev = prev_cur;
if (prev_cur != NULL)
prev_cur->next = ag;

83
src/detect-engine-mpm.c
Unescape Escape View File

@ -39,7 +39,7 @@ uint32_t PacketPatternScan(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Packe
uint32_t ret;
det_ctx->pmq.mode = PMQ_MODE_SCAN;
ret = det_ctx->sgh->mpm_ctx->Scan(det_ctx->sgh->mpm_ctx, &det_ctx->mtc, &det_ctx->pmq, p->payload, p->payload_len);
ret = mpm_table[det_ctx->sgh->mpm_ctx->mpm_type].Scan(det_ctx->sgh->mpm_ctx, &det_ctx->mtc, &det_ctx->pmq, p->payload, p->payload_len);
//printf("PacketPatternScan: ret %" PRIu32 "\n", ret);
return ret;
@ -54,7 +54,7 @@ uint32_t PacketPatternMatch(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Pack
uint32_t ret;
det_ctx->pmq.mode = PMQ_MODE_SEARCH;
ret = det_ctx->sgh->mpm_ctx->Search(det_ctx->sgh->mpm_ctx, &det_ctx->mtc, &det_ctx->pmq, p->payload, p->payload_len);
ret = mpm_table[det_ctx->sgh->mpm_ctx->mpm_type].Search(det_ctx->sgh->mpm_ctx, &det_ctx->mtc, &det_ctx->pmq, p->payload, p->payload_len);
//printf("PacketPatternMatch: ret %" PRIu32 "\n", ret);
return ret;
@ -68,12 +68,12 @@ void PacketPatternCleanup(ThreadVars *t, DetectEngineThreadCtx *det_ctx) {
return;
/* content */
if (det_ctx->sgh->mpm_ctx != NULL && det_ctx->sgh->mpm_ctx->Cleanup != NULL) {
det_ctx->sgh->mpm_ctx->Cleanup(&det_ctx->mtc);
if (det_ctx->sgh->mpm_ctx != NULL && mpm_table[det_ctx->sgh->mpm_ctx->mpm_type].Cleanup != NULL) {
mpm_table[det_ctx->sgh->mpm_ctx->mpm_type].Cleanup(&det_ctx->mtc);
}
/* uricontent */
if (det_ctx->sgh->mpm_uri_ctx != NULL && det_ctx->sgh->mpm_uri_ctx->Cleanup != NULL) {
det_ctx->sgh->mpm_uri_ctx->Cleanup(&det_ctx->mtcu);
if (det_ctx->sgh->mpm_uri_ctx != NULL && mpm_table[det_ctx->sgh->mpm_uri_ctx->mpm_type].Cleanup != NULL) {
mpm_table[det_ctx->sgh->mpm_uri_ctx->mpm_type].Cleanup(&det_ctx->mtcu);
}
}
@ -161,53 +161,6 @@ void DbgPrintScanSearchStats() {
#endif
}
/** \brief set the mpm_content_maxlen and mpm_uricontent_maxlen variables in
* a sig group head */
void SigGroupHeadSetMpmMaxlen(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
{
SigMatch *sm;
uint32_t sig;
sgh->mpm_content_maxlen = 0;
sgh->mpm_uricontent_maxlen = 0;
/* for each signature in this group do */
for (sig = 0; sig < DetectEngineGetMaxSigId(de_ctx); sig++) {
if (!(sgh->sig_array[(sig/8)] & (1<<(sig%8))))
continue;
Signature *s = de_ctx->sig_array[sig];
if (s == NULL)
continue;
if (!(s->flags & SIG_FLAG_MPM))
continue;
uint16_t content_maxlen = 0, uricontent_maxlen = 0;
/* determine the length of the longest pattern */
for (sm = s->match; sm != NULL; sm = sm->next) {
if (sm->type == DETECT_CONTENT && !(sgh->flags & SIG_GROUP_HEAD_MPM_COPY)) {
DetectContentData *cd = (DetectContentData *)sm->ctx;
if (cd->content_len > content_maxlen)
content_maxlen = cd->content_len;
} else if (sm->type == DETECT_URICONTENT && !(sgh->flags & SIG_GROUP_HEAD_MPM_URI_COPY)) {
DetectUricontentData *ud = (DetectUricontentData *)sm->ctx;
if (ud->uricontent_len > uricontent_maxlen)
uricontent_maxlen = ud->uricontent_len;
}
}
if (sgh->mpm_content_maxlen == 0) sgh->mpm_content_maxlen = content_maxlen;
if (sgh->mpm_content_maxlen > content_maxlen)
sgh->mpm_content_maxlen = content_maxlen;
if (sgh->mpm_uricontent_maxlen == 0) sgh->mpm_uricontent_maxlen = uricontent_maxlen;
if (sgh->mpm_uricontent_maxlen > uricontent_maxlen)
sgh->mpm_uricontent_maxlen = uricontent_maxlen;
}
}
/** \brief Hash for looking up contents that are most used,
* always used, etc. */
typedef struct ContentHash_ {
@ -432,9 +385,9 @@ static int PatternMatchPreprarePopulateMpm(DetectEngineCtx *de_ctx, SigGroupHead
depth = scan_ch->cnt ? 0 : depth;
if (co->flags & DETECT_CONTENT_NOCASE) {
sgh->mpm_ctx->AddScanPatternNocase(sgh->mpm_ctx, co->content, co->content_len, offset, depth, co->id, s->num, scan_ch->nosearch);
mpm_table[sgh->mpm_ctx->mpm_type].AddScanPatternNocase(sgh->mpm_ctx, co->content, co->content_len, offset, depth, co->id, s->num, scan_ch->nosearch);
} else {
sgh->mpm_ctx->AddScanPattern(sgh->mpm_ctx, co->content, co->content_len, offset, depth, co->id, s->num, scan_ch->nosearch);
mpm_table[sgh->mpm_ctx->mpm_type].AddScanPattern(sgh->mpm_ctx, co->content, co->content_len, offset, depth, co->id, s->num, scan_ch->nosearch);
}
}
/* add the rest of the patterns to the search ctx */
@ -452,9 +405,9 @@ static int PatternMatchPreprarePopulateMpm(DetectEngineCtx *de_ctx, SigGroupHead
uint16_t depth = s->flags & SIG_FLAG_RECURSIVE ? 0 : co->depth;
if (co->flags & DETECT_CONTENT_NOCASE) {
sgh->mpm_ctx->AddPatternNocase(sgh->mpm_ctx, co->content, co->content_len, offset, depth, co->id, s->num);
mpm_table[sgh->mpm_ctx->mpm_type].AddPatternNocase(sgh->mpm_ctx, co->content, co->content_len, offset, depth, co->id, s->num);
} else {
sgh->mpm_ctx->AddPattern(sgh->mpm_ctx, co->content, co->content_len, offset, depth, co->id, s->num);
mpm_table[sgh->mpm_ctx->mpm_type].AddPattern(sgh->mpm_ctx, co->content, co->content_len, offset, depth, co->id, s->num);
}
}
}
@ -735,18 +688,18 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
* length is the same as maxlen (ie we only add the longest pattern) */
if (!uricontent_scanadded && uricontent_maxlen == ud->uricontent_len) {
if (ud->flags & DETECT_URICONTENT_NOCASE) {
sh->mpm_uri_ctx->AddScanPatternNocase(sh->mpm_uri_ctx, ud->uricontent, ud->uricontent_len, 0, 0, ud->id, s->num, 0);
mpm_table[sh->mpm_uri_ctx->mpm_type].AddScanPatternNocase(sh->mpm_uri_ctx, ud->uricontent, ud->uricontent_len, 0, 0, ud->id, s->num, 0);
} else {
sh->mpm_uri_ctx->AddScanPattern(sh->mpm_uri_ctx, ud->uricontent, ud->uricontent_len, 0, 0, ud->id, s->num, 0);
mpm_table[sh->mpm_uri_ctx->mpm_type].AddScanPattern(sh->mpm_uri_ctx, ud->uricontent, ud->uricontent_len, 0, 0, ud->id, s->num, 0);
}
uricontent_scanadded = 1;
/* otherwise it's a 'search' pattern */
} else {
if (ud->flags & DETECT_URICONTENT_NOCASE) {
sh->mpm_uri_ctx->AddPatternNocase(sh->mpm_uri_ctx, ud->uricontent, ud->uricontent_len, 0, 0, ud->id, s->num);
mpm_table[sh->mpm_uri_ctx->mpm_type].AddPatternNocase(sh->mpm_uri_ctx, ud->uricontent, ud->uricontent_len, 0, 0, ud->id, s->num);
} else {
sh->mpm_uri_ctx->AddPattern(sh->mpm_uri_ctx, ud->uricontent, ud->uricontent_len, 0, 0, ud->id, s->num);
mpm_table[sh->mpm_uri_ctx->mpm_type].AddPattern(sh->mpm_uri_ctx, ud->uricontent, ud->uricontent_len, 0, 0, ud->id, s->num);
}
}
}
@ -758,8 +711,8 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
/* load the patterns */
PatternMatchPreprarePopulateMpm(de_ctx, sh);
if (sh->mpm_ctx->Prepare != NULL) {
sh->mpm_ctx->Prepare(sh->mpm_ctx);
if (mpm_table[sh->mpm_ctx->mpm_type].Prepare != NULL) {
mpm_table[sh->mpm_ctx->mpm_type].Prepare(sh->mpm_ctx);
}
if (mpm_content_maxdepth) {
@ -779,8 +732,8 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
/* uricontent */
if (sh->flags & SIG_GROUP_HAVEURICONTENT && !(sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY)) {
if (sh->mpm_uri_ctx->Prepare != NULL) {
sh->mpm_uri_ctx->Prepare(sh->mpm_uri_ctx);
if (mpm_table[sh->mpm_uri_ctx->mpm_type].Prepare != NULL) {
mpm_table[sh->mpm_uri_ctx->mpm_type].Prepare(sh->mpm_uri_ctx);
}
if (mpm_uricontent_cnt && sh->mpm_uricontent_maxlen > 1) {
// printf("mpm_uricontent_cnt %" PRIu32 ", mpm_uricontent_maxlen %" PRId32 "\n", mpm_uricontent_cnt, mpm_uricontent_maxlen);

5
src/detect-engine-mpm.h
Unescape Escape View File

@ -3,9 +3,6 @@
#include "tm-modules.h"
/* XXX remove once */
//MpmCtx mpm_ctx[1];
uint16_t PatternMatchDefaultMatcher(void);
uint32_t PacketPatternScan(ThreadVars *, DetectEngineThreadCtx *, Packet *);
uint32_t PacketPatternMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *);
@ -26,8 +23,6 @@ void PatternMatchDestroyGroup(SigGroupHead *);
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **);
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *);
void SigGroupHeadSetMpmMaxlen(DetectEngineCtx *, SigGroupHead *);
void DbgPrintScanSearchStats();
#endif /* __DETECT_ENGINE_MPM_H__ */

46
src/detect-engine-siggroup.c
Unescape Escape View File

@ -466,6 +466,24 @@ int SigGroupHeadAppendSig(DetectEngineCtx *de_ctx, SigGroupHead **sgh, Signature
/* enable the sig in the bitarray */
(*sgh)->sig_array[s->num / 8] |= 1 << (s->num % 8);
/* update maxlen for mpm */
if (s->flags & SIG_FLAG_MPM) {
/* check with the precalculated values from the sig */
if (s->mpm_content_maxlen > 0) {
if ((*sgh)->mpm_content_maxlen == 0)
(*sgh)->mpm_content_maxlen = s->mpm_content_maxlen;
if ((*sgh)->mpm_content_maxlen > s->mpm_content_maxlen)
(*sgh)->mpm_content_maxlen = s->mpm_content_maxlen;
}
if (s->mpm_uricontent_maxlen > 0) {
if ((*sgh)->mpm_uricontent_maxlen == 0)
(*sgh)->mpm_uricontent_maxlen = s->mpm_uricontent_maxlen;
if ((*sgh)->mpm_uricontent_maxlen > s->mpm_uricontent_maxlen)
(*sgh)->mpm_uricontent_maxlen = s->mpm_uricontent_maxlen;
}
}
return 0;
error:
return -1;
@ -479,9 +497,13 @@ int SigGroupHeadClearSigs(SigGroupHead *sgh) {
memset(sgh->sig_array,0,sgh->sig_size);
}
sgh->sig_cnt = 0;
sgh->mpm_content_maxlen = 0;
sgh->mpm_uricontent_maxlen = 0;
return 0;
}
/** \brief copy signature array from one sgh to another */
int SigGroupHeadCopySigs(DetectEngineCtx *de_ctx, SigGroupHead *src, SigGroupHead **dst) {
if (src == NULL || de_ctx == NULL)
return 0;
@ -499,6 +521,24 @@ int SigGroupHeadCopySigs(DetectEngineCtx *de_ctx, SigGroupHead *src, SigGroupHea
(*dst)->sig_array[idx] = (*dst)->sig_array[idx] | src->sig_array[idx];
}
if (src->mpm_content_maxlen != 0) {
if ((*dst)->mpm_content_maxlen == 0)
(*dst)->mpm_content_maxlen = src->mpm_content_maxlen;
if ((*dst)->mpm_content_maxlen > src->mpm_content_maxlen)
(*dst)->mpm_content_maxlen = src->mpm_content_maxlen;
SCLogDebug("src (%p)->mpm_content_maxlen %u", src, src->mpm_content_maxlen);
SCLogDebug("dst (%p)->mpm_content_maxlen %u", (*dst), (*dst)->mpm_content_maxlen);
BUG_ON((*dst)->mpm_content_maxlen == 0);
}
if (src->mpm_uricontent_maxlen != 0) {
if ((*dst)->mpm_uricontent_maxlen == 0)
(*dst)->mpm_uricontent_maxlen = src->mpm_uricontent_maxlen;
if ((*dst)->mpm_uricontent_maxlen > src->mpm_uricontent_maxlen)
(*dst)->mpm_uricontent_maxlen = src->mpm_uricontent_maxlen;
}
return 0;
error:
return -1;
@ -603,6 +643,9 @@ int SigGroupHeadLoadContent(DetectEngineCtx *de_ctx, SigGroupHead *sgh) {
if (s == NULL)
continue;
if (!(s->flags & SIG_FLAG_MPM))
continue;
sm = s->match;
if (sm == NULL)
continue;
@ -656,6 +699,9 @@ int SigGroupHeadLoadUricontent(DetectEngineCtx *de_ctx, SigGroupHead *sgh) {
if (s == NULL)
continue;
if (!(s->flags & SIG_FLAG_MPM))
continue;
sm = s->match;
if (sm == NULL)
continue;

8
src/detect-engine.c
Unescape Escape View File

@ -14,6 +14,8 @@
#include "detect-engine-mpm.h"
#include "detect-engine-iponly.h"
#include "detect-engine.h"
#include "detect-content.h"
#include "detect-uricontent.h"
@ -80,9 +82,9 @@ void DetectEngineCtxFree(DetectEngineCtx *de_ctx) {
* getting & (re)setting the internal sig i
*/
inline uint32_t DetectEngineGetMaxSigId(DetectEngineCtx *de_ctx) {
return de_ctx->signum;
}
//inline uint32_t DetectEngineGetMaxSigId(DetectEngineCtx *de_ctx) {
// return de_ctx->signum;
//}
void DetectEngineResetMaxSigId(DetectEngineCtx *de_ctx) {
de_ctx->signum = 0;

4
src/detect-engine.h
Unescape Escape View File

@ -7,7 +7,9 @@
DetectEngineCtx *DetectEngineCtxInit(void);
void DetectEngineCtxFree(DetectEngineCtx *);
inline uint32_t DetectEngineGetMaxSigId(DetectEngineCtx *);
//inline uint32_t DetectEngineGetMaxSigId(DetectEngineCtx *);
/* faster as a macro than a inline function on my box -- VJ */
#define DetectEngineGetMaxSigId(de_ctx) ((de_ctx)->signum)
void DetectEngineResetMaxSigId(DetectEngineCtx *);
#endif /* __DETECT_ENGINE_H__ */

1
src/detect-flow.c
Unescape Escape View File

@ -275,6 +275,7 @@ int DetectFlowSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, char *f
SigMatchAppend(s,m,sm);
s->flags |= SIG_FLAG_FLOW;
return 0;
error:

113
src/detect-parse.c
Unescape Escape View File

@ -8,6 +8,9 @@
#include "detect-engine-address.h"
#include "detect-engine-port.h"
#include "detect-content.h"
#include "detect-uricontent.h"
#include "flow.h"
#include "util-unittest.h"
@ -556,6 +559,33 @@ Signature *SigInit(DetectEngineCtx *de_ctx, char *sigstr) {
sig->num = de_ctx->signum;
de_ctx->signum++;
/* set mpm_content_len */
/* determine the length of the longest pattern in the sig */
if (sig->flags & SIG_FLAG_MPM) {
sig->mpm_content_maxlen = 0;
sig->mpm_uricontent_maxlen = 0;
SigMatch *sm;
for (sm = sig->match; sm != NULL; sm = sm->next) {
if (sm->type == DETECT_CONTENT) {
DetectContentData *cd = (DetectContentData *)sm->ctx;
if (sig->mpm_content_maxlen == 0)
sig->mpm_content_maxlen = cd->content_len;
if (sig->mpm_content_maxlen < cd->content_len)
sig->mpm_content_maxlen = cd->content_len;
} else if (sm->type == DETECT_URICONTENT) {
DetectUricontentData *ud = (DetectUricontentData *)sm->ctx;
if (sig->mpm_uricontent_maxlen == 0)
sig->mpm_uricontent_maxlen = ud->uricontent_len;
if (sig->mpm_uricontent_maxlen < ud->uricontent_len)
sig->mpm_uricontent_maxlen = ud->uricontent_len;
}
}
}
return sig;
error:
@ -861,6 +891,87 @@ end:
DetectEngineCtxFree(de_ctx);
return result;
}
/**
* \test mpm
*/
int SigParseTestMpm01 (void) {
int result = 0;
Signature *sig = NULL;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
goto end;
sig = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"mpm test\"; content:\"abcd\"; sid:1;)");
if (sig == NULL) {
printf("sig failed to init: ");
goto end;
}
if (!(sig->flags & SIG_FLAG_MPM)) {
printf("sig doesn't have mpm flag set: ");
goto end;
}
if (sig->mpm_content_maxlen != 4) {
printf("mpm content max len %"PRIu16", expected 4: ", sig->mpm_content_maxlen);
goto end;
}
if (sig->mpm_uricontent_maxlen != 0) {
printf("mpm uricontent max len %"PRIu16", expected 0: ", sig->mpm_uricontent_maxlen);
goto end;
}
result = 1;
end:
if (sig != NULL)
SigFree(sig);
DetectEngineCtxFree(de_ctx);
return result;
}
/**
* \test mpm
*/
int SigParseTestMpm02 (void) {
int result = 0;
Signature *sig = NULL;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
goto end;
sig = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"mpm test\"; content:\"abcd\"; content:\"abcdef\"; sid:1;)");
if (sig == NULL) {
printf("sig failed to init: ");
goto end;
}
if (!(sig->flags & SIG_FLAG_MPM)) {
printf("sig doesn't have mpm flag set: ");
goto end;
}
if (sig->mpm_content_maxlen != 6) {
printf("mpm content max len %"PRIu16", expected 6: ", sig->mpm_content_maxlen);
goto end;
}
if (sig->mpm_uricontent_maxlen != 0) {
printf("mpm uricontent max len %"PRIu16", expected 0: ", sig->mpm_uricontent_maxlen);
goto end;
}
result = 1;
end:
if (sig != NULL)
SigFree(sig);
DetectEngineCtxFree(de_ctx);
return result;
}
#endif /* UNITTESTS */
void SigParseRegisterTests(void) {
@ -877,6 +988,8 @@ void SigParseRegisterTests(void) {
UtRegisterTest("SigParseTestNegation05", SigParseTestNegation05, 1);
UtRegisterTest("SigParseTestNegation06", SigParseTestNegation06, 1);
UtRegisterTest("SigParseTestNegation07", SigParseTestNegation07, 1);
UtRegisterTest("SigParseTestMpm01", SigParseTestMpm01, 1);
UtRegisterTest("SigParseTestMpm02", SigParseTestMpm02, 1);
#endif /* UNITTESTS */
}

4
src/detect-pcre.c
Unescape Escape View File

@ -140,7 +140,7 @@ int DetectPcreMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, S
else det_ctx->pkts_uri_scanned++;
det_ctx->pmq.mode = PMQ_MODE_SCAN;
ret = det_ctx->sgh->mpm_uri_ctx->Scan(det_ctx->sgh->mpm_uri_ctx, &det_ctx->mtcu, &det_ctx->pmq, p->http_uri.raw[det_ctx->pkt_cnt], p->http_uri.raw_size[det_ctx->pkt_cnt]);
ret = mpm_table[det_ctx->sgh->mpm_uri_ctx->mpm_type].Scan(det_ctx->sgh->mpm_uri_ctx, &det_ctx->mtcu, &det_ctx->pmq, p->http_uri.raw[det_ctx->pkt_cnt], p->http_uri.raw_size[det_ctx->pkt_cnt]);
if (ret > 0) {
if (det_ctx->sgh->mpm_uricontent_maxlen == 1) det_ctx->pkts_uri_searched1++;
else if (det_ctx->sgh->mpm_uricontent_maxlen == 2) det_ctx->pkts_uri_searched2++;
@ -149,7 +149,7 @@ int DetectPcreMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, S
else det_ctx->pkts_uri_searched++;
det_ctx->pmq.mode = PMQ_MODE_SEARCH;
ret += det_ctx->sgh->mpm_uri_ctx->Search(det_ctx->sgh->mpm_uri_ctx, &det_ctx->mtcu, &det_ctx->pmq, p->http_uri.raw[det_ctx->pkt_cnt], p->http_uri.raw_size[det_ctx->pkt_cnt]);
ret += mpm_table[det_ctx->sgh->mpm_uri_ctx->mpm_type].Search(det_ctx->sgh->mpm_uri_ctx, &det_ctx->mtcu, &det_ctx->pmq, p->http_uri.raw[det_ctx->pkt_cnt], p->http_uri.raw_size[det_ctx->pkt_cnt]);
/* indicate to uricontent that we have a uri,
* we scanned it _AND_ we found pattern matches. */

758
src/detect.c
Unescape Escape View File

@ -665,7 +665,7 @@ int SigAddressPrepareStage1(DetectEngineCtx *de_ctx) {
uint32_t cnt_payload = 0;
//DetectAddressGroupPrintMemory();
DetectSigGroupPrintMemory();
//DetectSigGroupPrintMemory();
//DetectPortPrintMemory();
if (!(de_ctx->flags & DE_QUIET)) {
@ -754,7 +754,7 @@ int SigAddressPrepareStage1(DetectEngineCtx *de_ctx) {
}
//DetectAddressGroupPrintMemory();
DetectSigGroupPrintMemory();
//DetectSigGroupPrintMemory();
//DetectPortPrintMemory();
if (!(de_ctx->flags & DE_QUIET)) {
@ -773,8 +773,6 @@ static int DetectEngineLookupBuildSourceAddressList(DetectEngineCtx *de_ctx, Det
DetectAddressGroup *gr = NULL, *lookup_gr = NULL, *head = NULL;
int proto;
//printf("DetectEngineLookupBuildSourceAddressList: sig %"PRIu32", family %"PRIi32"\n", s->id, family);
if (family == AF_INET) {
head = s->src.ipv4_head;
} else if (family == AF_INET6) {
@ -800,15 +798,10 @@ static int DetectEngineLookupBuildSourceAddressList(DetectEngineCtx *de_ctx, Det
}
if (lookup_gr == NULL) {
BUG_ON(gr->family == 0 && !(gr->flags & ADDRESS_FLAG_ANY));
DetectAddressGroup *grtmp = DetectAddressGroupCopy(gr);
if (grtmp == NULL) {
goto error;
}
BUG_ON(grtmp->family == 0 && !(grtmp->flags & ADDRESS_FLAG_ANY));
SigGroupHeadAppendSig(de_ctx, &grtmp->sh, s);
/* add to the lookup list */
@ -820,8 +813,6 @@ static int DetectEngineLookupBuildSourceAddressList(DetectEngineCtx *de_ctx, Det
DetectAddressGroupAdd(&flow_gh->tmp_gh[proto]->any_head, grtmp);
}
} else {
BUG_ON(lookup_gr->family == 0 && !(lookup_gr->flags & ADDRESS_FLAG_ANY));
/* our group will only have one sig, this one. So add that. */
SigGroupHeadAppendSig(de_ctx, &lookup_gr->sh, s);
lookup_gr->cnt++;
@ -864,16 +855,18 @@ static uint32_t g_detectengine_any_big_toserver = 0;
static int DetectEngineLookupFlowAddSig(DetectEngineCtx *de_ctx, DetectEngineLookupDsize *ds, Signature *s, int family, int dsize) {
uint8_t flags = 0;
SigMatch *sm = s->match;
for ( ; sm != NULL; sm = sm->next) {
if (sm->type != DETECT_FLOW)
continue;
if (s->flags & SIG_FLAG_FLOW) {
SigMatch *sm = s->match;
for ( ; sm != NULL; sm = sm->next) {
if (sm->type != DETECT_FLOW)
continue;
DetectFlowData *df = (DetectFlowData *)sm->ctx;
if (df == NULL)
continue;
DetectFlowData *df = (DetectFlowData *)sm->ctx;
if (df == NULL)
continue;
flags = df->flags;
flags = df->flags;
}
}
if (flags & FLOW_PKT_TOCLIENT) {
@ -926,30 +919,32 @@ static int DetectEngineLookupFlowAddSig(DetectEngineCtx *de_ctx, DetectEngineLoo
static int DetectEngineLookupDsizeAddSig(DetectEngineCtx *de_ctx, Signature *s, int family) {
uint16_t low = 0, high = 65535;
SigMatch *sm = s->match;
for ( ; sm != NULL; sm = sm->next) {
if (sm->type != DETECT_DSIZE)
continue;
if (s->flags & SIG_FLAG_DSIZE) {
SigMatch *sm = s->match;
for ( ; sm != NULL; sm = sm->next) {
if (sm->type != DETECT_DSIZE)
continue;
DetectDsizeData *dd = (DetectDsizeData *)sm->ctx;
if (dd == NULL)
continue;
DetectDsizeData *dd = (DetectDsizeData *)sm->ctx;
if (dd == NULL)
continue;
if (dd->mode == DETECTDSIZE_LT) {
low = 0;
high = dd->dsize - 1;
} else if (dd->mode == DETECTDSIZE_GT) {
low = dd->dsize + 1;
high = 65535;
} else if (dd->mode == DETECTDSIZE_EQ) {
low = dd->dsize;
high = dd->dsize;
} else if (dd->mode == DETECTDSIZE_RA) {
low = dd->dsize;
high = dd->dsize2;
}
if (dd->mode == DETECTDSIZE_LT) {
low = 0;
high = dd->dsize - 1;
} else if (dd->mode == DETECTDSIZE_GT) {
low = dd->dsize + 1;
high = 65535;
} else if (dd->mode == DETECTDSIZE_EQ) {
low = dd->dsize;
high = dd->dsize;
} else if (dd->mode == DETECTDSIZE_RA) {
low = dd->dsize;
high = dd->dsize2;
}
break;
break;
}
}
if (low <= 100) {
@ -1052,8 +1047,6 @@ int CreateGroupedAddrList(DetectEngineCtx *de_ctx, DetectAddressGroup *srchead,
for (gr = srchead; gr != NULL; gr = gr->next) {
BUG_ON(gr->family == 0 && !(gr->flags & ADDRESS_FLAG_ANY));
SigGroupHeadSetMpmMaxlen(de_ctx, gr->sh);
if (SMALL_MPM(gr->sh->mpm_content_maxlen) && unique_groups > 0)
unique_groups++;
@ -1064,8 +1057,8 @@ int CreateGroupedAddrList(DetectEngineCtx *de_ctx, DetectAddressGroup *srchead,
if (newtmp == NULL) {
goto error;
}
SigGroupHeadCopySigs(de_ctx, gr->sh,&newtmp->sh);
DetectPort *port = gr->port;
for ( ; port != NULL; port = port->next) {
DetectPortInsertCopy(de_ctx,&newtmp->port, port);
@ -1081,7 +1074,6 @@ int CreateGroupedAddrList(DetectEngineCtx *de_ctx, DetectAddressGroup *srchead,
/* look for the place to insert */
for ( ; tmpgr != NULL&&!insert; tmpgr = tmpgr->next) {
if (CompareFunc(gr, tmpgr)) {
//if (gr->cnt > tmpgr->cnt) {
if (tmpgr == tmplist) {
newtmp->next = tmplist;
tmplist = newtmp;
@ -1164,7 +1156,6 @@ int CreateGroupedAddrList(DetectEngineCtx *de_ctx, DetectAddressGroup *srchead,
if (newtmp == NULL) {
goto error;
}
SigGroupHeadCopySigs(de_ctx, gr->sh,&newtmp->sh);
DetectPort *port = gr->port;
@ -1205,6 +1196,7 @@ int CreateGroupedPortListCmpMpmMaxlen(DetectPort *a, DetectPort *b) {
if (a->sh->mpm_content_maxlen < b->sh->mpm_content_maxlen)
return 1;
return 0;
}
@ -1228,7 +1220,6 @@ int CreateGroupedPortList(DetectEngineCtx *de_ctx,HashListTable *port_hash, Dete
SCLogDebug("hash list gr %p", gr);
DetectPortPrint(gr);
SigGroupHeadSetMpmMaxlen(de_ctx, gr->sh);
if (SMALL_MPM(gr->sh->mpm_content_maxlen) && unique_groups > 0)
unique_groups++;
@ -1364,7 +1355,7 @@ int SigAddressPrepareStage2(DetectEngineCtx *de_ctx) {
if (!(de_ctx->flags & DE_QUIET)) {
SCLogInfo("building signature grouping structure, stage 2: "
"building source address list...");
"building source address lists...");
}
IPOnlyInit(de_ctx, &de_ctx->io_ctx);
@ -2015,7 +2006,6 @@ static int BuildDestinationAddressHeadsWithBothPorts(DetectEngineCtx *de_ctx, De
de_ctx->gh_reuse++;
}
/* free source port sgh's */
if (!(dst_gr->flags & ADDRESS_PORTS_COPY)) {
DetectPort *sp = dst_gr->port;
@ -2038,7 +2028,6 @@ static int BuildDestinationAddressHeadsWithBothPorts(DetectEngineCtx *de_ctx, De
/* clear now unneeded sig group head */
SigGroupHeadFree(src_gr->sh);
src_gr->sh = NULL;
/* free dst addr sgh's */
dst_gr_head = GetHeadPtr(src_gr->dst_gh,family);
for (dst_gr = dst_gr_head; dst_gr != NULL; dst_gr = dst_gr->next) {
@ -6543,6 +6532,672 @@ printf("@exit\n\n");
end:
return result;
}
static int SigTestSgh01 (void) {
ThreadVars th_v;
int result = 0;
Packet p;
DetectEngineThreadCtx *det_ctx;
memset(&th_v, 0, sizeof(th_v));
memset(&p, 0, sizeof(p));
p.src.family = AF_INET;
p.dst.family = AF_INET;
p.payload_len = 1;
p.proto = IPPROTO_TCP;
p.dp = 80;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any 80 (msg:\"1\"; content:\"one\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
if (de_ctx->sig_list->num != 0) {
printf("internal id != 0: ");
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any 81 (msg:\"2\"; content:\"two\"; content:\"abcd\"; sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result = 0;
goto end;
}
if (de_ctx->sig_list->next->num != 1) {
printf("internal id != 1: ");
goto end;
}
de_ctx->sig_list->next->next = SigInit(de_ctx,"alert tcp any any -> any 80 (msg:\"3\"; content:\"three\"; sid:3;)");
if (de_ctx->sig_list->next->next == NULL) {
result = 0;
goto end;
}
if (de_ctx->sig_list->next->next->num != 2) {
printf("internal id != 2: ");
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigGroupHead *sgh = SigMatchSignaturesGetSgh(&th_v, de_ctx, det_ctx, &p);
if (sgh == NULL) {
printf("no sgh: ");
goto end;
}
#if 0
printf("-\n");
printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
if (sgh->mpm_content_maxlen != 3) {
printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
goto end;
}
if (sgh->match_array == NULL) {
printf("sgh->match_array == NULL: ");
goto end;
}
if (sgh->match_array[0] != 0) {
printf("sgh doesn't contain sid 1, should have (sgh->match_array[0] %u, expected 0): ", sgh->match_array[0]);
goto end;
}
if (sgh->match_array[1] != 2) {
printf("sgh doesn't contain sid 3, should have: ");
goto end;
}
p.dp = 81;
sgh = SigMatchSignaturesGetSgh(&th_v, de_ctx, det_ctx, &p);
if (sgh == NULL) {
printf("no sgh: ");
goto end;
}
#if 0
printf("-\n");
printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
if (sgh->mpm_content_maxlen != 4) {
printf("sgh->mpm_content_maxlen %u, expected 4: ", sgh->mpm_content_maxlen);
goto end;
}
if (sgh->match_array[0] != 1) {
printf("sgh doesn't contain sid 2, should have: ");
goto end;
}
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
SigGroupCleanup(de_ctx);
DetectEngineCtxFree(de_ctx);
result = 1;
end:
return result;
}
static int SigTestSgh02 (void) {
ThreadVars th_v;
int result = 0;
Packet p;
DetectEngineThreadCtx *det_ctx;
memset(&th_v, 0, sizeof(th_v));
memset(&p, 0, sizeof(p));
p.src.family = AF_INET;
p.dst.family = AF_INET;
p.payload_len = 1;
p.proto = IPPROTO_TCP;
p.dp = 80;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any 80:82 (msg:\"1\"; content:\"one\"; content:\"1\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
if (de_ctx->sig_list->num != 0) {
printf("internal id != 0: ");
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any 81 (msg:\"2\"; content:\"two2\"; content:\"abcdef\"; sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result = 0;
goto end;
}
if (de_ctx->sig_list->next->num != 1) {
printf("internal id != 1: ");
goto end;
}
de_ctx->sig_list->next->next = SigInit(de_ctx,"alert tcp any any -> any 80:81 (msg:\"3\"; content:\"three\"; content:\"abcdefgh\"; sid:3;)");
if (de_ctx->sig_list->next->next == NULL) {
result = 0;
goto end;
}
if (de_ctx->sig_list->next->next->num != 2) {
printf("internal id != 2: ");
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigGroupHead *sgh = SigMatchSignaturesGetSgh(&th_v, de_ctx, det_ctx, &p);
if (sgh == NULL) {
printf("no sgh: ");
goto end;
}
if (sgh->mpm_content_maxlen != 3) {
printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
goto end;
}
if (sgh->match_array == NULL) {
printf("sgh->match_array == NULL: ");
goto end;
}
if (sgh->sig_cnt != 2) {
printf("sgh sig cnt %u, expected 2: ", sgh->sig_cnt);
goto end;
}
if (sgh->match_array[0] != 0) {
printf("sgh doesn't contain sid 1, should have (sgh->match_array[0] %u, expected 0): ", sgh->match_array[0]);
goto end;
}
if (sgh->match_array[1] != 2) {
printf("sgh doesn't contain sid 3, should have: ");
goto end;
}
#if 0
printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
p.dp = 81;
sgh = SigMatchSignaturesGetSgh(&th_v, de_ctx, det_ctx, &p);
if (sgh == NULL) {
printf("no sgh: ");
goto end;
}
if (sgh->mpm_content_maxlen != 3) {
printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
goto end;
}
if (sgh->sig_cnt != 3) {
printf("sgh sig cnt %u, expected 3: ", sgh->sig_cnt);
goto end;
}
if (sgh->match_array[0] != 0) {
printf("sgh doesn't contain sid 1, should have: ");
goto end;
}
if (sgh->match_array[1] != 1) {
printf("sgh doesn't contain sid 1, should have: ");
goto end;
}
if (sgh->match_array[2] != 2) {
printf("sgh doesn't contain sid 1, should have: ");
goto end;
}
#if 0
printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
p.dp = 82;
sgh = SigMatchSignaturesGetSgh(&th_v, de_ctx, det_ctx, &p);
if (sgh == NULL) {
printf("no sgh: ");
goto end;
}
if (sgh->mpm_content_maxlen != 3) {
printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
goto end;
}
if (sgh->sig_cnt != 1) {
printf("sgh sig cnt %u, expected 1: ", sgh->sig_cnt);
goto end;
}
if (sgh->match_array[0] != 0) {
printf("sgh doesn't contain sid 1, should have: ");
goto end;
}
#if 0
printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
p.src.family = AF_INET6;
p.dst.family = AF_INET6;
sgh = SigMatchSignaturesGetSgh(&th_v, de_ctx, det_ctx, &p);
if (sgh == NULL) {
printf("no sgh: ");
goto end;
}
if (sgh->mpm_content_maxlen != 3) {
printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
goto end;
}
if (sgh->sig_cnt != 1) {
printf("sgh sig cnt %u, expected 1: ", sgh->sig_cnt);
goto end;
}
if (sgh->match_array[0] != 0) {
printf("sgh doesn't contain sid 1, should have: ");
goto end;
}
#if 0
printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
SigGroupCleanup(de_ctx);
DetectEngineCtxFree(de_ctx);
result = 1;
end:
return result;
}
static int SigTestSgh03 (void) {
ThreadVars th_v;
int result = 0;
Packet p;
DetectEngineThreadCtx *det_ctx;
memset(&th_v, 0, sizeof(th_v));
memset(&p, 0, sizeof(p));
p.src.family = AF_INET;
p.dst.family = AF_INET;
p.payload_len = 1;
p.proto = IPPROTO_TCP;
p.dp = 80;
p.dst.addr_data32[0] = 0x04030201;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> 1.2.3.4-1.2.3.6 any (msg:\"1\"; content:\"one\"; content:\"1\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
if (de_ctx->sig_list->num != 0) {
printf("internal id != 0: ");
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,"alert ip any any -> 1.2.3.5 any (msg:\"2\"; content:\"two2\"; content:\"abcdef\"; sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result = 0;
goto end;
}
if (de_ctx->sig_list->next->num != 1) {
printf("internal id != 1: ");
goto end;
}
de_ctx->sig_list->next->next = SigInit(de_ctx,"alert ip any any -> 1.2.3.4-1.2.3.5 any (msg:\"3\"; content:\"three\"; content:\"abcdefgh\"; sid:3;)");
if (de_ctx->sig_list->next->next == NULL) {
result = 0;
goto end;
}
if (de_ctx->sig_list->next->next->num != 2) {
printf("internal id != 2: ");
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigGroupHead *sgh = SigMatchSignaturesGetSgh(&th_v, de_ctx, det_ctx, &p);
if (sgh == NULL) {
printf("no sgh: ");
goto end;
}
#if 0
printf("-\n");
printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
if (sgh->mpm_content_maxlen != 3) {
printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
goto end;
}
if (sgh->match_array == NULL) {
printf("sgh->match_array == NULL: ");
goto end;
}
if (sgh->sig_cnt != 2) {
printf("sgh sig cnt %u, expected 2: ", sgh->sig_cnt);
goto end;
}
if (sgh->match_array[0] != 0) {
printf("sgh doesn't contain sid 1, should have (sgh->match_array[0] %u, expected 0): ", sgh->match_array[0]);
goto end;
}
if (sgh->match_array[1] != 2) {
printf("sgh doesn't contain sid 3, should have: ");
goto end;
}
p.dst.addr_data32[0] = 0x05030201;
sgh = SigMatchSignaturesGetSgh(&th_v, de_ctx, det_ctx, &p);
if (sgh == NULL) {
printf("no sgh: ");
goto end;
}
#if 0
printf("-\n");
printf("sgh %p\n", sgh);
printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
if (sgh->sig_cnt != 3) {
printf("sgh sig cnt %u, expected 3: ", sgh->sig_cnt);
goto end;
}
if (sgh->match_array[0] != 0) {
printf("sgh doesn't contain sid 1, should have: ");
goto end;
}
if (sgh->match_array[1] != 1) {
printf("sgh doesn't contain sid 1, should have: ");
goto end;
}
if (sgh->match_array[2] != 2) {
printf("sgh doesn't contain sid 1, should have: ");
goto end;
}
if (sgh->mpm_content_maxlen != 3) {
printf("sgh->mpm_content_maxlen %u, expected 3 (%x): ", sgh->mpm_content_maxlen, p.dst.addr_data32[0]);
goto end;
}
p.dst.addr_data32[0] = 0x06030201;
sgh = SigMatchSignaturesGetSgh(&th_v, de_ctx, det_ctx, &p);
if (sgh == NULL) {
printf("no sgh: ");
goto end;
}
#if 0
printf("-\n");
printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
if (sgh->mpm_content_maxlen != 3) {
printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
goto end;
}
if (sgh->sig_cnt != 1) {
printf("sgh sig cnt %u, expected 1: ", sgh->sig_cnt);
goto end;
}
if (sgh->match_array[0] != 0) {
printf("sgh doesn't contain sid 1, should have: ");
goto end;
}
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
SigGroupCleanup(de_ctx);
DetectEngineCtxFree(de_ctx);
result = 1;
end:
return result;
}
static int SigTestSgh04 (void) {
ThreadVars th_v;
int result = 0;
Packet p;
DetectEngineThreadCtx *det_ctx;
memset(&th_v, 0, sizeof(th_v));
memset(&p, 0, sizeof(p));
p.src.family = AF_INET;
p.dst.family = AF_INET;
p.payload_len = 1;
p.proto = IPPROTO_TCP;
p.dp = 80;
p.dst.addr_data32[0] = 0x04030201;
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) {
goto end;
}
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> 1.2.3.4-1.2.3.6 any (msg:\"1\"; content:\"one\"; content:\"1\"; sid:1;)");
if (de_ctx->sig_list == NULL) {
result = 0;
goto end;
}
if (de_ctx->sig_list->num != 0) {
printf("internal id != 0: ");
goto end;
}
de_ctx->sig_list->next = SigInit(de_ctx,"alert ip any any -> 1.2.3.5 any (msg:\"2\"; content:\"two2\"; content:\"abcdef\"; sid:2;)");
if (de_ctx->sig_list->next == NULL) {
result = 0;
goto end;
}
if (de_ctx->sig_list->next->num != 1) {
printf("internal id != 1: ");
goto end;
}
de_ctx->sig_list->next->next = SigInit(de_ctx,"alert ip any any -> 1.2.3.4-1.2.3.5 any (msg:\"3\"; content:\"three\"; content:\"abcdefgh\"; sid:3;)");
if (de_ctx->sig_list->next->next == NULL) {
result = 0;
goto end;
}
if (de_ctx->sig_list->next->next->num != 2) {
printf("internal id != 2: ");
goto end;
}
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SigGroupHead *sgh = SigMatchSignaturesGetSgh(&th_v, de_ctx, det_ctx, &p);
if (sgh == NULL) {
printf("no sgh: ");
goto end;
}
if (sgh->mpm_content_maxlen != 3) {
printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
goto end;
}
if (sgh->match_array == NULL) {
printf("sgh->match_array == NULL: ");
goto end;
}
if (sgh->sig_cnt != 2) {
printf("sgh sig cnt %u, expected 2: ", sgh->sig_cnt);
goto end;
}
if (sgh->match_array[0] != 0) {
printf("sgh doesn't contain sid 1, should have (sgh->match_array[0] %u, expected 0): ", sgh->match_array[0]);
goto end;
}
if (sgh->match_array[1] != 2) {
printf("sgh doesn't contain sid 3, should have: ");
goto end;
}
#if 0
printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
p.dst.addr_data32[0] = 0x05030201;
sgh = SigMatchSignaturesGetSgh(&th_v, de_ctx, det_ctx, &p);
if (sgh == NULL) {
printf("no sgh: ");
goto end;
}
if (sgh->mpm_content_maxlen != 3) {
printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
goto end;
}
if (sgh->sig_cnt != 3) {
printf("sgh sig cnt %u, expected 3: ", sgh->sig_cnt);
goto end;
}
if (sgh->match_array[0] != 0) {
printf("sgh doesn't contain sid 1, should have: ");
goto end;
}
if (sgh->match_array[1] != 1) {
printf("sgh doesn't contain sid 1, should have: ");
goto end;
}
if (sgh->match_array[2] != 2) {
printf("sgh doesn't contain sid 1, should have: ");
goto end;
}
#if 0
printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
p.dst.addr_data32[0] = 0x06030201;
sgh = SigMatchSignaturesGetSgh(&th_v, de_ctx, det_ctx, &p);
if (sgh == NULL) {
printf("no sgh: ");
goto end;
}
if (sgh->mpm_content_maxlen != 3) {
printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
goto end;
}
if (sgh->sig_cnt != 1) {
printf("sgh sig cnt %u, expected 1: ", sgh->sig_cnt);
goto end;
}
if (sgh->match_array[0] != 0) {
printf("sgh doesn't contain sid 1, should have: ");
goto end;
}
#if 0
printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
p.proto = IPPROTO_GRE;
sgh = SigMatchSignaturesGetSgh(&th_v, de_ctx, det_ctx, &p);
if (sgh == NULL) {
printf("no sgh: ");
goto end;
}
#if 0
printf("-\n");
printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
if (sgh->mpm_content_maxlen != 3) {
printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
goto end;
}
if (sgh->match_array[0] != 0) {
printf("sgh doesn't contain sid 1, should have: ");
goto end;
}
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
SigGroupCleanup(de_ctx);
DetectEngineCtxFree(de_ctx);
result = 1;
end:
return result;
}
#endif /* UNITTESTS */
void SigRegisterTests(void) {
@ -6704,6 +7359,11 @@ void SigRegisterTests(void) {
UtRegisterTest("SigTestMemory01", SigTestMemory01, 1);
UtRegisterTest("SigTestMemory02", SigTestMemory02, 1);
UtRegisterTest("SigTestMemory03", SigTestMemory03, 1);
UtRegisterTest("SigTestSgh01", SigTestSgh01, 1);
UtRegisterTest("SigTestSgh02", SigTestSgh02, 1);
UtRegisterTest("SigTestSgh03", SigTestSgh03, 1);
UtRegisterTest("SigTestSgh04", SigTestSgh04, 1);
#endif /* UNITTESTS */
}

16
src/detect.h
Unescape Escape View File

@ -116,12 +116,16 @@ typedef struct DetectPort_ {
#define SIG_FLAG_SRC_ANY 0x0002 /**< source is any */
#define SIG_FLAG_DST_ANY 0x0004 /**< destination is any */
#define SIG_FLAG_SP_ANY 0x0008 /**< source port is any */
#define SIG_FLAG_DP_ANY 0x0010 /**< destination port is any */
#define SIG_FLAG_NOALERT 0x0020 /**< no alert flag is set */
#define SIG_FLAG_IPONLY 0x0040 /**< ip only signature */
#define SIG_FLAG_MPM 0x0080 /**< sig has mpm portion (content, uricontent, etc) */
#define SIG_FLAG_DEONLY 0x0100 /**< decode event only signature */
#define SIG_FLAG_PAYLOAD 0x0200 /**< signature is inspecting the packet payload */
#define SIG_FLAG_DSIZE 0x0400 /**< signature has a dsize setting */
#define SIG_FLAG_FLOW 0x0800 /**< signature has a flow setting */
/* Detection Engine flags */
#define DE_QUIET 0x01 /**< DE is quiet (esp for unittests) */
@ -156,6 +160,10 @@ typedef struct Signature_ {
/** inline -- action */
uint8_t action;
/* helper for init phase */
uint16_t mpm_content_maxlen;
uint16_t mpm_uricontent_maxlen;
} Signature;
/** \brief IP only rules matching ctx.
@ -369,10 +377,10 @@ typedef struct SigGroupHead_ {
/* port ptr */
struct DetectPort_ *port;
uint16_t mpm_len1;
uint16_t mpm_len2;
uint16_t mpm_len3;
uint16_t mpm_len4; /* 4+ */
// uint16_t mpm_len1;
// uint16_t mpm_len2;
// uint16_t mpm_len3;
// uint16_t mpm_len4; /* 4+ */
uint32_t refcnt;
} SigGroupHead;

102
src/util-mpm-b2g.c
Unescape Escape View File

@ -42,6 +42,8 @@ int B2gAddScanPatternCS(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, uint3
int B2gAddPatternCI(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid);
int B2gAddPatternCS(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid);
int B2gPreparePatterns(MpmCtx *mpm_ctx);
inline uint32_t B2gScanWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen);
inline uint32_t B2gSearchWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen);
uint32_t B2gScan1(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen);
#ifdef B2G_SCAN2
uint32_t B2gScan2(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen);
@ -66,8 +68,8 @@ void MpmB2gRegister (void) {
mpm_table[MPM_B2G].AddPattern = B2gAddPatternCS;
mpm_table[MPM_B2G].AddPatternNocase = B2gAddPatternCI;
mpm_table[MPM_B2G].Prepare = B2gPreparePatterns;
mpm_table[MPM_B2G].Scan = B2G_SCANFUNC; /* default to B2gSearch. We may fall back to 1 */
mpm_table[MPM_B2G].Search = B2G_SEARCHFUNC; /* default to B2gSearch. We may fall back to 1 */
mpm_table[MPM_B2G].Scan = B2gScanWrap;
mpm_table[MPM_B2G].Search = B2gSearchWrap;
mpm_table[MPM_B2G].Cleanup = MpmMatchCleanup;
mpm_table[MPM_B2G].PrintCtx = B2gPrintInfo;
mpm_table[MPM_B2G].PrintThreadCtx = B2gPrintSearchStats;
@ -800,7 +802,7 @@ int B2gPreparePatterns(MpmCtx *mpm_ctx) {
ctx->search_m = mpm_ctx->search_minlen;
if (mpm_ctx->search_minlen == 1) {
mpm_ctx->Search = B2gSearch1;
ctx->Search = B2gSearch1;
ctx->MBSearch = B2G_SEARCHFUNC;
}
/* make sure 'm' stays in bounds */
@ -824,9 +826,9 @@ int B2gPreparePatterns(MpmCtx *mpm_ctx) {
B2gBuildSearchMatchArray(mpm_ctx);
if (ctx->scan_1_pat_cnt) {
mpm_ctx->Scan = B2gScan1;
ctx->Scan = B2gScan1;
#ifdef B2G_SCAN2
mpm_ctx->Scan = B2gScan2;
ctx->Scan = B2gScan2;
if (ctx->scan_2_pat_cnt) {
ctx->MBScan2 = B2gScan2;
}
@ -834,7 +836,7 @@ int B2gPreparePatterns(MpmCtx *mpm_ctx) {
ctx->MBScan = B2G_SCANFUNC;
#ifdef B2G_SCAN2
} else if (ctx->scan_2_pat_cnt) {
mpm_ctx->Scan = B2gScan2;
ctx->Scan = B2gScan2;
ctx->MBScan = B2G_SCANFUNC;
#endif
}
@ -909,6 +911,10 @@ void B2gInitCtx (MpmCtx *mpm_ctx) {
return;
memset(ctx->init_hash, 0, sizeof(B2gPattern *) * INIT_HASH_SIZE);
/* init defaults */
ctx->Scan = B2G_SCANFUNC;
ctx->Search = B2G_SEARCHFUNC;
}
void B2gDestroyCtx(MpmCtx *mpm_ctx) {
@ -1083,6 +1089,16 @@ void B2gThreadDestroyCtx(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx) {
MpmMatchFreeSpares(mpm_thread_ctx, mpm_thread_ctx->qlist);
}
inline uint32_t B2gScanWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) {
B2gCtx *ctx = (B2gCtx *)mpm_ctx->ctx;
return ctx ? ctx->Scan(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen) : 0;
}
inline uint32_t B2gSearchWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) {
B2gCtx *ctx = (B2gCtx *)mpm_ctx->ctx;
return ctx ? ctx->Search(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen) : 0;
}
uint32_t B2gScanBNDMq(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) {
B2gCtx *ctx = (B2gCtx *)mpm_ctx->ctx;
#ifdef B2G_COUNTERS
@ -1871,13 +1887,14 @@ static int B2gTestScan01 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B2G);
B2gCtx *ctx = (B2gCtx *)mpm_ctx.ctx;
B2gAddScanPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); /* 1 match */
B2gPreparePatterns(&mpm_ctx);
B2gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1 /* 1 pattern */);
uint32_t cnt = mpm_ctx.Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);
@ -1897,13 +1914,14 @@ static int B2gTestScan02 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B2G);
B2gCtx *ctx = (B2gCtx *)mpm_ctx.ctx;
B2gAddScanPatternCS(&mpm_ctx, (uint8_t *)"abce", 4, 0, 0, 0, 0, 0); /* 1 match */
B2gPreparePatterns(&mpm_ctx);
B2gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1 /* 1 pattern */);
uint32_t cnt = mpm_ctx.Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);
@ -1923,6 +1941,7 @@ static int B2gTestScan03 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B2G);
B2gCtx *ctx = (B2gCtx *)mpm_ctx.ctx;
B2gAddScanPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); /* 1 match */
B2gAddScanPatternCS(&mpm_ctx, (uint8_t *)"bcde", 4, 0, 0, 1, 0, 0); /* 1 match */
@ -1931,7 +1950,7 @@ static int B2gTestScan03 (void) {
B2gPreparePatterns(&mpm_ctx);
B2gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 3 /* 3 patterns */);
uint32_t cnt = mpm_ctx.Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);
@ -1952,6 +1971,7 @@ static int B2gTestScan04 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B2G);
B2gCtx *ctx = (B2gCtx *)mpm_ctx.ctx;
B2gAddScanPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); /* 1 match */
B2gAddScanPatternCS(&mpm_ctx, (uint8_t *)"bcdegh", 6, 0, 0, 1, 0, 0); /* 1 match */
@ -1960,7 +1980,7 @@ static int B2gTestScan04 (void) {
B2gPreparePatterns(&mpm_ctx);
B2gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 3 /* 3 patterns */);
uint32_t cnt = mpm_ctx.Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);
@ -1981,6 +2001,7 @@ static int B2gTestScan05 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B2G);
B2gCtx *ctx = (B2gCtx *)mpm_ctx.ctx;
B2gAddScanPatternCI(&mpm_ctx, (uint8_t *)"ABCD", 4, 0, 0, 0, 0, 0); /* 1 match */
B2gAddScanPatternCI(&mpm_ctx, (uint8_t *)"bCdEfG", 6, 0, 0, 1, 0, 0); /* 1 match */
@ -1989,7 +2010,7 @@ static int B2gTestScan05 (void) {
B2gPreparePatterns(&mpm_ctx);
B2gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 3 /* 3 patterns */);
uint32_t cnt = mpm_ctx.Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2009,13 +2030,14 @@ static int B2gTestScan06 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B2G);
B2gCtx *ctx = (B2gCtx *)mpm_ctx.ctx;
B2gAddScanPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); /* 1 match */
B2gPreparePatterns(&mpm_ctx);
B2gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1 /* 1 pattern */);
uint32_t cnt = mpm_ctx.Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcd", 4);
uint32_t cnt = ctx->Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcd", 4);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2035,7 +2057,7 @@ static int B2gTestScan07 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B2G);
//B2gCtx *ctx = (B2gCtx *)mpm_ctx.ctx;
B2gCtx *ctx = (B2gCtx *)mpm_ctx.ctx;
B2gAddScanPatternCS(&mpm_ctx, (uint8_t *)"A", 1, 0, 0, 0, 0, 0); /* should match 30 times */
B2gAddScanPatternCS(&mpm_ctx, (uint8_t *)"AA", 2, 0, 0, 1, 0, 0); /* should match 29 times */
@ -2048,7 +2070,7 @@ static int B2gTestScan07 (void) {
B2gPreparePatterns(&mpm_ctx);
B2gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 6 /* 6 patterns */);
uint32_t cnt = mpm_ctx.Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 30);
uint32_t cnt = ctx->Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 30);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2068,13 +2090,14 @@ static int B2gTestScan08 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B2G);
B2gCtx *ctx = (B2gCtx *)mpm_ctx.ctx;
B2gAddScanPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); /* 1 match */
B2gPreparePatterns(&mpm_ctx);
B2gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1 /* 1 pattern */);
uint32_t cnt = mpm_ctx.Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"a", 1);
uint32_t cnt = ctx->Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"a", 1);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2094,13 +2117,14 @@ static int B2gTestScan09 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B2G);
B2gCtx *ctx = (B2gCtx *)mpm_ctx.ctx;
B2gAddScanPatternCS(&mpm_ctx, (uint8_t *)"ab", 2, 0, 0, 0, 0, 0); /* 1 match */
B2gPreparePatterns(&mpm_ctx);
B2gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1 /* 1 pattern */);
uint32_t cnt = mpm_ctx.Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"ab", 2);
uint32_t cnt = ctx->Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"ab", 2);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2120,13 +2144,14 @@ static int B2gTestScan10 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B2G);
B2gCtx *ctx = (B2gCtx *)mpm_ctx.ctx;
B2gAddScanPatternCS(&mpm_ctx, (uint8_t *)"abcdefgh", 8, 0, 0, 0, 0, 0); /* 1 match */
B2gPreparePatterns(&mpm_ctx);
B2gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1 /* 1 pattern */);
uint32_t cnt = mpm_ctx.Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679abcdefgh012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679", 208);
uint32_t cnt = ctx->Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679abcdefgh012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679", 208);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2146,6 +2171,7 @@ static int B2gTestScan11 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B2G);
B2gCtx *ctx = (B2gCtx *)mpm_ctx.ctx;
B2gAddScanPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); /* 1 match */
B2gAddScanPatternCS(&mpm_ctx, (uint8_t *)"abcde", 5, 0, 0, 0, 0, 0); /* 1 match */
@ -2153,7 +2179,7 @@ static int B2gTestScan11 (void) {
B2gPreparePatterns(&mpm_ctx);
B2gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 2 /* 2 patterns */);
uint32_t cnt = mpm_ctx.Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2173,6 +2199,7 @@ static int B2gTestScan12 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B2G);
B2gCtx *ctx = (B2gCtx *)mpm_ctx.ctx;
B2gAddScanPatternCS(&mpm_ctx, (uint8_t *)"wxyz", 4, 0, 0, 0, 0, 0); /* 1 match */
B2gAddScanPatternCS(&mpm_ctx, (uint8_t *)"vwxyz", 5, 0, 0, 0, 0, 0); /* 1 match */
@ -2180,7 +2207,7 @@ static int B2gTestScan12 (void) {
B2gPreparePatterns(&mpm_ctx);
B2gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 2 /* 2 patterns */);
uint32_t cnt = mpm_ctx.Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2200,13 +2227,14 @@ static int B2gTestSearch01 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B2G);
B2gCtx *ctx = (B2gCtx *)mpm_ctx.ctx;
B2gAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0); /* 1 match */
B2gPreparePatterns(&mpm_ctx);
B2gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1 /* 1 pattern */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2226,13 +2254,14 @@ static int B2gTestSearch02 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B2G);
B2gCtx *ctx = (B2gCtx *)mpm_ctx.ctx;
B2gAddPatternCS(&mpm_ctx, (uint8_t *)"abce", 4, 0, 0, 0, 0); /* 1 match */
B2gPreparePatterns(&mpm_ctx);
B2gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1 /* 1 pattern */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2252,6 +2281,7 @@ static int B2gTestSearch03 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B2G);
B2gCtx *ctx = (B2gCtx *)mpm_ctx.ctx;
B2gAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0); /* 1 match */
B2gAddPatternCS(&mpm_ctx, (uint8_t *)"bcde", 4, 0, 0, 1, 0); /* 1 match */
@ -2260,7 +2290,7 @@ static int B2gTestSearch03 (void) {
B2gPreparePatterns(&mpm_ctx);
B2gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 3 /* 3 patterns */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2281,6 +2311,7 @@ static int B2gTestSearch04 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B2G);
B2gCtx *ctx = (B2gCtx *)mpm_ctx.ctx;
B2gAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0); /* 1 match */
B2gAddPatternCS(&mpm_ctx, (uint8_t *)"bcdegh", 6, 0, 0, 1, 0); /* 1 match */
@ -2289,7 +2320,7 @@ static int B2gTestSearch04 (void) {
B2gPreparePatterns(&mpm_ctx);
B2gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 3 /* 3 patterns */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2310,6 +2341,7 @@ static int B2gTestSearch05 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B2G);
B2gCtx *ctx = (B2gCtx *)mpm_ctx.ctx;
B2gAddPatternCI(&mpm_ctx, (uint8_t *)"ABCD", 4, 0, 0, 0, 0); /* 1 match */
B2gAddPatternCI(&mpm_ctx, (uint8_t *)"bCdEfG", 6, 0, 0, 1, 0); /* 1 match */
@ -2318,7 +2350,7 @@ static int B2gTestSearch05 (void) {
B2gPreparePatterns(&mpm_ctx);
B2gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 3 /* 3 patterns */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2338,13 +2370,14 @@ static int B2gTestSearch06 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B2G);
B2gCtx *ctx = (B2gCtx *)mpm_ctx.ctx;
B2gAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0); /* 1 match */
B2gPreparePatterns(&mpm_ctx);
B2gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1 /* 1 pattern */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcd", 4);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcd", 4);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2364,7 +2397,7 @@ static int B2gTestSearch07 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B2G);
//B2gCtx *ctx = (B2gCtx *)mpm_ctx.ctx;
B2gCtx *ctx = (B2gCtx *)mpm_ctx.ctx;
B2gAddPatternCS(&mpm_ctx, (uint8_t *)"A", 1, 0, 0, 0, 0); /* should match 30 times */
B2gAddPatternCS(&mpm_ctx, (uint8_t *)"AA", 2, 0, 0, 1, 0); /* should match 29 times */
@ -2377,7 +2410,7 @@ static int B2gTestSearch07 (void) {
B2gPreparePatterns(&mpm_ctx);
B2gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 6 /* 6 patterns */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 30);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 30);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2397,13 +2430,14 @@ static int B2gTestSearch08 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B2G);
B2gCtx *ctx = (B2gCtx *)mpm_ctx.ctx;
B2gAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0); /* 1 match */
B2gPreparePatterns(&mpm_ctx);
B2gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1 /* 1 pattern */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"a", 1);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"a", 1);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2423,13 +2457,14 @@ static int B2gTestSearch09 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B2G);
B2gCtx *ctx = (B2gCtx *)mpm_ctx.ctx;
B2gAddPatternCS(&mpm_ctx, (uint8_t *)"ab", 2, 0, 0, 0, 0); /* 1 match */
B2gPreparePatterns(&mpm_ctx);
B2gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1 /* 1 pattern */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"ab", 2);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"ab", 2);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2449,13 +2484,14 @@ static int B2gTestSearch10 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B2G);
B2gCtx *ctx = (B2gCtx *)mpm_ctx.ctx;
B2gAddPatternCS(&mpm_ctx, (uint8_t *)"abcdefgh", 8, 0, 0, 0, 0); /* 1 match */
B2gPreparePatterns(&mpm_ctx);
B2gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1 /* 1 pattern */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679abcdefgh012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679", 208);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679abcdefgh012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679", 208);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2475,6 +2511,7 @@ static int B2gTestSearch11 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B2G);
B2gCtx *ctx = (B2gCtx *)mpm_ctx.ctx;
B2gAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0); /* 1 match */
B2gAddPatternCS(&mpm_ctx, (uint8_t *)"abcde", 5, 0, 0, 0, 0); /* 1 match */
@ -2482,7 +2519,7 @@ static int B2gTestSearch11 (void) {
B2gPreparePatterns(&mpm_ctx);
B2gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 2 /* 2 patterns */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2502,6 +2539,7 @@ static int B2gTestSearch12 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B2G);
B2gCtx *ctx = (B2gCtx *)mpm_ctx.ctx;
B2gAddPatternCS(&mpm_ctx, (uint8_t *)"wxyz", 4, 0, 0, 0, 0); /* 1 match */
B2gAddPatternCS(&mpm_ctx, (uint8_t *)"vwxyz", 5, 0, 0, 0, 0); /* 1 match */
@ -2509,7 +2547,7 @@ static int B2gTestSearch12 (void) {
B2gPreparePatterns(&mpm_ctx);
B2gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 2 /* 2 patterns */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);

5
src/util-mpm-b2g.h
Unescape Escape View File

@ -98,6 +98,11 @@ typedef struct B2gCtx_ {
uint8_t scan_s0;
uint8_t search_s0;
/* we store our own multi byte scan ptr here for B2gSearch1 */
uint32_t (*Scan)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
/* we store our own multi byte search ptr here for B2gSearch1 */
uint32_t (*Search)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
/* we store our own multi byte scan ptr here for B2gSearch1 */
uint32_t (*MBScan2)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
uint32_t (*MBScan)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);

110
src/util-mpm-b3g.c
Unescape Escape View File

@ -36,6 +36,8 @@ int B3gAddScanPatternCS(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, uint3
int B3gAddPatternCI(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, uint32_t);
int B3gAddPatternCS(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, uint32_t);
int B3gPreparePatterns(MpmCtx *);
inline uint32_t B3gScanWrap(MpmCtx *, MpmThreadCtx *, PatternMatcherQueue *, uint8_t *, uint16_t);
inline uint32_t B3gSearchWrap(MpmCtx *, MpmThreadCtx *, PatternMatcherQueue *, uint8_t *, uint16_t);
uint32_t B3gScan1(MpmCtx *, MpmThreadCtx *, PatternMatcherQueue *, uint8_t *, uint16_t);
uint32_t B3gScan2(MpmCtx *, MpmThreadCtx *, PatternMatcherQueue *, uint8_t *, uint16_t);
uint32_t B3gScan12(MpmCtx *, MpmThreadCtx *, PatternMatcherQueue *, uint8_t *, uint16_t);
@ -61,8 +63,8 @@ void MpmB3gRegister (void) {
mpm_table[MPM_B3G].AddPattern = B3gAddPatternCS;
mpm_table[MPM_B3G].AddPatternNocase = B3gAddPatternCI;
mpm_table[MPM_B3G].Prepare = B3gPreparePatterns;
mpm_table[MPM_B3G].Scan = B3G_SCANFUNC; /* default to B3gSearch. We may fall back to 1 */
mpm_table[MPM_B3G].Search = B3gSearch; /* default to B3gSearch. We may fall back to 1 */
mpm_table[MPM_B3G].Scan = B3gScanWrap;
mpm_table[MPM_B3G].Search = B3gSearchWrap;
mpm_table[MPM_B3G].Cleanup = MpmMatchCleanup;
mpm_table[MPM_B3G].PrintCtx = B3gPrintInfo;
mpm_table[MPM_B3G].PrintThreadCtx = B3gPrintSearchStats;
@ -844,26 +846,26 @@ int B3gPreparePatterns(MpmCtx *mpm_ctx) {
B3gBuildSearchMatchArray(mpm_ctx);
if (ctx->scan_1_pat_cnt) {
mpm_ctx->Scan = B3gScan1;
ctx->Scan = B3gScan1;
if (ctx->scan_2_pat_cnt) {
mpm_ctx->Scan = B3gScan12;
ctx->Scan = B3gScan12;
ctx->MBScan = B3G_SCANFUNC;
}
ctx->MBScan = B3G_SCANFUNC;
} else if (ctx->scan_2_pat_cnt) {
mpm_ctx->Scan = B3gScan2;
ctx->Scan = B3gScan2;
ctx->MBScan = B3G_SCANFUNC;
}
if (ctx->search_1_pat_cnt) {
mpm_ctx->Search = B3gSearch1;
ctx->Search = B3gSearch1;
if (ctx->search_2_pat_cnt) {
mpm_ctx->Search = B3gSearch12;
ctx->Search = B3gSearch12;
ctx->MBSearch = B3G_SEARCHFUNC;
}
ctx->MBSearch = B3G_SEARCHFUNC;
} else if (ctx->search_2_pat_cnt) {
mpm_ctx->Search = B3gSearch2;
ctx->Search = B3gSearch2;
ctx->MBSearch = B3G_SEARCHFUNC;
}
@ -935,6 +937,10 @@ void B3gInitCtx (MpmCtx *mpm_ctx) {
return;
memset(ctx->init_hash, 0, sizeof(B3gPattern *) * INIT_HASH_SIZE);
/* init default */
ctx->Scan = B3G_SCANFUNC;
ctx->Search = B3G_SEARCHFUNC;
}
void B3gDestroyCtx(MpmCtx *mpm_ctx) {
@ -1133,6 +1139,16 @@ void B3gThreadDestroyCtx(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx) {
MpmMatchFreeSpares(mpm_thread_ctx, mpm_thread_ctx->qlist);
}
inline uint32_t B3gScanWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) {
B3gCtx *ctx = (B3gCtx *)mpm_ctx->ctx;
return ctx->Scan(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen);
}
inline uint32_t B3gSearchWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) {
B3gCtx *ctx = (B3gCtx *)mpm_ctx->ctx;
return ctx->Search(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen);
}
uint32_t B3gScanBNDMq(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) {
B3gCtx *ctx = (B3gCtx *)mpm_ctx->ctx;
#ifdef B3G_COUNTERS
@ -1437,7 +1453,7 @@ uint32_t B3gScan2(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQ
uint8_t *bufend = buf + buflen - 1;
uint32_t cnt = 0;
B3gPattern *p;
MpmEndMatch *em;
MpmEndMatch *em;
B3gHashItem *thi, *hi;
if (buflen < 2)
@ -1846,7 +1862,7 @@ uint32_t B3gSearch2(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatche
uint8_t *bufend = buf + buflen - 1;
uint32_t cnt = 0;
B3gPattern *p;
MpmEndMatch *em;
MpmEndMatch *em;
B3gHashItem *thi, *hi;
if (buflen < 2)
@ -2094,13 +2110,14 @@ static int B3gTestScan01 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B3G);
B3gCtx *ctx = (B3gCtx *)mpm_ctx.ctx;
B3gAddScanPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); /* 1 match */
B3gPreparePatterns(&mpm_ctx);
B3gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1 /* 1 pattern */);
uint32_t cnt = mpm_ctx.Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2120,13 +2137,14 @@ static int B3gTestScan02 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B3G);
B3gCtx *ctx = (B3gCtx *)mpm_ctx.ctx;
B3gAddScanPatternCS(&mpm_ctx, (uint8_t *)"abce", 4, 0, 0, 0, 0, 0); /* 1 match */
B3gPreparePatterns(&mpm_ctx);
B3gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1 /* 1 pattern */);
uint32_t cnt = mpm_ctx.Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2146,6 +2164,7 @@ static int B3gTestScan03 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B3G);
B3gCtx *ctx = (B3gCtx *)mpm_ctx.ctx;
B3gAddScanPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); /* 1 match */
B3gAddScanPatternCS(&mpm_ctx, (uint8_t *)"bcde", 4, 0, 0, 1, 0, 0); /* 1 match */
@ -2154,7 +2173,7 @@ static int B3gTestScan03 (void) {
B3gPreparePatterns(&mpm_ctx);
B3gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 3 /* 3 patterns */);
uint32_t cnt = mpm_ctx.Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2175,6 +2194,7 @@ static int B3gTestScan04 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B3G);
B3gCtx *ctx = (B3gCtx *)mpm_ctx.ctx;
B3gAddScanPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); /* 1 match */
B3gAddScanPatternCS(&mpm_ctx, (uint8_t *)"bcdegh", 6, 0, 0, 1, 0, 0); /* 1 match */
@ -2183,7 +2203,7 @@ static int B3gTestScan04 (void) {
B3gPreparePatterns(&mpm_ctx);
B3gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 3 /* 3 patterns */);
uint32_t cnt = mpm_ctx.Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2204,6 +2224,7 @@ static int B3gTestScan05 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B3G);
B3gCtx *ctx = (B3gCtx *)mpm_ctx.ctx;
B3gAddScanPatternCI(&mpm_ctx, (uint8_t *)"ABCD", 4, 0, 0, 0, 0, 0); /* 1 match */
B3gAddScanPatternCI(&mpm_ctx, (uint8_t *)"bCdEfG", 6, 0, 0, 1, 0, 0); /* 1 match */
@ -2212,7 +2233,7 @@ static int B3gTestScan05 (void) {
B3gPreparePatterns(&mpm_ctx);
B3gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 3 /* 3 patterns */);
uint32_t cnt = mpm_ctx.Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2232,13 +2253,14 @@ static int B3gTestScan06 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B3G);
B3gCtx *ctx = (B3gCtx *)mpm_ctx.ctx;
B3gAddScanPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); /* 1 match */
B3gPreparePatterns(&mpm_ctx);
B3gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1 /* 1 pattern */);
uint32_t cnt = mpm_ctx.Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcd", 4);
uint32_t cnt = ctx->Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcd", 4);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2258,7 +2280,7 @@ static int B3gTestScan07 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B3G);
//B3gCtx *ctx = (B3gCtx *)mpm_ctx.ctx;
B3gCtx *ctx = (B3gCtx *)mpm_ctx.ctx;
B3gAddScanPatternCS(&mpm_ctx, (uint8_t *)"A", 1, 0, 0, 0, 0, 0); /* should match 30 times */
B3gAddScanPatternCS(&mpm_ctx, (uint8_t *)"AA", 2, 0, 0, 1, 0, 0); /* should match 29 times */
@ -2271,7 +2293,7 @@ static int B3gTestScan07 (void) {
B3gPreparePatterns(&mpm_ctx);
B3gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 6 /* 6 patterns */);
uint32_t cnt = mpm_ctx.Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 30);
uint32_t cnt = ctx->Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 30);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2291,13 +2313,14 @@ static int B3gTestScan08 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B3G);
B3gCtx *ctx = (B3gCtx *)mpm_ctx.ctx;
B3gAddScanPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); /* 1 match */
B3gPreparePatterns(&mpm_ctx);
B3gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1 /* 1 pattern */);
uint32_t cnt = mpm_ctx.Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"a", 1);
uint32_t cnt = ctx->Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"a", 1);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2317,13 +2340,14 @@ static int B3gTestScan09 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B3G);
B3gCtx *ctx = (B3gCtx *)mpm_ctx.ctx;
B3gAddScanPatternCS(&mpm_ctx, (uint8_t *)"ab", 2, 0, 0, 0, 0, 0); /* 1 match */
B3gPreparePatterns(&mpm_ctx);
B3gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1 /* 1 pattern */);
uint32_t cnt = mpm_ctx.Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"ab", 2);
uint32_t cnt = ctx->Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"ab", 2);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2343,13 +2367,14 @@ static int B3gTestScan10 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B3G);
B3gCtx *ctx = (B3gCtx *)mpm_ctx.ctx;
B3gAddScanPatternCS(&mpm_ctx, (uint8_t *)"abcdefgh", 8, 0, 0, 0, 0, 0); /* 1 match */
B3gPreparePatterns(&mpm_ctx);
B3gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1 /* 1 pattern */);
uint32_t cnt = mpm_ctx.Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679abcdefgh012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679", 208);
uint32_t cnt = ctx->Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679abcdefgh012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679", 208);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2369,6 +2394,7 @@ static int B3gTestScan11 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B3G);
B3gCtx *ctx = (B3gCtx *)mpm_ctx.ctx;
B3gAddScanPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); /* 1 match */
B3gAddScanPatternCS(&mpm_ctx, (uint8_t *)"abcde", 5, 0, 0, 0, 0, 0); /* 1 match */
@ -2376,7 +2402,7 @@ static int B3gTestScan11 (void) {
B3gPreparePatterns(&mpm_ctx);
B3gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 2 /* 2 patterns */);
uint32_t cnt = mpm_ctx.Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2396,6 +2422,7 @@ static int B3gTestScan12 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B3G);
B3gCtx *ctx = (B3gCtx *)mpm_ctx.ctx;
B3gAddScanPatternCS(&mpm_ctx, (uint8_t *)"wxyz", 4, 0, 0, 0, 0, 0); /* 1 match */
B3gAddScanPatternCS(&mpm_ctx, (uint8_t *)"vwxyz", 5, 0, 0, 0, 0, 0); /* 1 match */
@ -2403,7 +2430,7 @@ static int B3gTestScan12 (void) {
B3gPreparePatterns(&mpm_ctx);
B3gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 2 /* 2 patterns */);
uint32_t cnt = mpm_ctx.Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Scan(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2423,13 +2450,14 @@ static int B3gTestSearch01 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B3G);
B3gCtx *ctx = (B3gCtx *)mpm_ctx.ctx;
B3gAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0); /* 1 match */
B3gPreparePatterns(&mpm_ctx);
B3gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1 /* 1 pattern */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2449,13 +2477,14 @@ static int B3gTestSearch02 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B3G);
B3gCtx *ctx = (B3gCtx *)mpm_ctx.ctx;
B3gAddPatternCS(&mpm_ctx, (uint8_t *)"abce", 4, 0, 0, 0, 0); /* 1 match */
B3gPreparePatterns(&mpm_ctx);
B3gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1 /* 1 pattern */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2475,6 +2504,7 @@ static int B3gTestSearch03 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B3G);
B3gCtx *ctx = (B3gCtx *)mpm_ctx.ctx;
B3gAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0); /* 1 match */
B3gAddPatternCS(&mpm_ctx, (uint8_t *)"bcde", 4, 0, 0, 1, 0); /* 1 match */
@ -2483,7 +2513,7 @@ static int B3gTestSearch03 (void) {
B3gPreparePatterns(&mpm_ctx);
B3gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 3 /* 3 patterns */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2504,6 +2534,7 @@ static int B3gTestSearch04 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B3G);
B3gCtx *ctx = (B3gCtx *)mpm_ctx.ctx;
B3gAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0); /* 1 match */
B3gAddPatternCS(&mpm_ctx, (uint8_t *)"bcdegh", 6, 0, 0, 1, 0); /* 1 match */
@ -2512,7 +2543,7 @@ static int B3gTestSearch04 (void) {
B3gPreparePatterns(&mpm_ctx);
B3gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 3 /* 3 patterns */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2533,6 +2564,7 @@ static int B3gTestSearch05 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B3G);
B3gCtx *ctx = (B3gCtx *)mpm_ctx.ctx;
B3gAddPatternCI(&mpm_ctx, (uint8_t *)"ABCD", 4, 0, 0, 0, 0); /* 1 match */
B3gAddPatternCI(&mpm_ctx, (uint8_t *)"bCdEfG", 6, 0, 0, 1, 0); /* 1 match */
@ -2541,7 +2573,7 @@ static int B3gTestSearch05 (void) {
B3gPreparePatterns(&mpm_ctx);
B3gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 3 /* 3 patterns */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2561,13 +2593,14 @@ static int B3gTestSearch06 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B3G);
B3gCtx *ctx = (B3gCtx *)mpm_ctx.ctx;
B3gAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0); /* 1 match */
B3gPreparePatterns(&mpm_ctx);
B3gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1 /* 1 pattern */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcd", 4);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcd", 4);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2587,7 +2620,7 @@ static int B3gTestSearch07 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B3G);
//B3gCtx *ctx = (B3gCtx *)mpm_ctx.ctx;
B3gCtx *ctx = (B3gCtx *)mpm_ctx.ctx;
B3gAddPatternCS(&mpm_ctx, (uint8_t *)"A", 1, 0, 0, 0, 0); /* should match 30 times */
B3gAddPatternCS(&mpm_ctx, (uint8_t *)"AA", 2, 0, 0, 1, 0); /* should match 29 times */
@ -2600,7 +2633,7 @@ static int B3gTestSearch07 (void) {
B3gPreparePatterns(&mpm_ctx);
B3gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 6 /* 6 patterns */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 30);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 30);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2620,13 +2653,14 @@ static int B3gTestSearch08 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B3G);
B3gCtx *ctx = (B3gCtx *)mpm_ctx.ctx;
B3gAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0); /* 1 match */
B3gPreparePatterns(&mpm_ctx);
B3gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1 /* 1 pattern */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"a", 1);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"a", 1);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2646,13 +2680,14 @@ static int B3gTestSearch09 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B3G);
B3gCtx *ctx = (B3gCtx *)mpm_ctx.ctx;
B3gAddPatternCS(&mpm_ctx, (uint8_t *)"ab", 2, 0, 0, 0, 0); /* 1 match */
B3gPreparePatterns(&mpm_ctx);
B3gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1 /* 1 pattern */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"ab", 2);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"ab", 2);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2672,13 +2707,14 @@ static int B3gTestSearch10 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B3G);
B3gCtx *ctx = (B3gCtx *)mpm_ctx.ctx;
B3gAddPatternCS(&mpm_ctx, (uint8_t *)"abcdefgh", 8, 0, 0, 0, 0); /* 1 match */
B3gPreparePatterns(&mpm_ctx);
B3gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1 /* 1 pattern */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679abcdefgh012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679", 208);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679abcdefgh012345679012345679012345679012345679012345679012345679012345679012345679012345679012345679", 208);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2698,6 +2734,7 @@ static int B3gTestSearch11 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B3G);
B3gCtx *ctx = (B3gCtx *)mpm_ctx.ctx;
B3gAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0); /* 1 match */
B3gAddPatternCS(&mpm_ctx, (uint8_t *)"abcde", 5, 0, 0, 0, 0); /* 1 match */
@ -2705,7 +2742,7 @@ static int B3gTestSearch11 (void) {
B3gPreparePatterns(&mpm_ctx);
B3gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 2 /* 2 patterns */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);
@ -2725,6 +2762,7 @@ static int B3gTestSearch12 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_B3G);
B3gCtx *ctx = (B3gCtx *)mpm_ctx.ctx;
B3gAddPatternCS(&mpm_ctx, (uint8_t *)"wxyz", 4, 0, 0, 0, 0); /* 1 match */
B3gAddPatternCS(&mpm_ctx, (uint8_t *)"vwxyz", 5, 0, 0, 0, 0); /* 1 match */
@ -2732,7 +2770,7 @@ static int B3gTestSearch12 (void) {
B3gPreparePatterns(&mpm_ctx);
B3gThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 2 /* 2 patterns */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefghjiklmnopqrstuvwxyz", 26);
MpmMatchCleanup(&mpm_thread_ctx);

3
src/util-mpm-b3g.h
Unescape Escape View File

@ -92,6 +92,9 @@ typedef struct B3gCtx_ {
B3gHashItem search_hash1[256];
B3gHashItem **search_hash2;
uint32_t (*Scan)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
uint32_t (*Search)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
/* we store our own multi byte scan ptr here for B3gSearch1 */
uint32_t (*MBScan2)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
uint32_t (*MBScan)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);

186
src/util-mpm-wumanber.c
Unescape Escape View File

@ -44,6 +44,8 @@ int WmAddScanPatternCS(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32
int WmAddPatternCI(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid);
int WmAddPatternCS(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid);
int WmPreparePatterns(MpmCtx *mpm_ctx);
inline uint32_t WmScan(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen);
inline uint32_t WmSearch(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen);
uint32_t WmScan1(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen);
uint32_t WmScan2Hash9(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen);
uint32_t WmScan2Hash12(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen);
@ -83,8 +85,8 @@ void MpmWuManberRegister (void) {
mpm_table[MPM_WUMANBER].AddPattern = WmAddPatternCS;
mpm_table[MPM_WUMANBER].AddPatternNocase = WmAddPatternCI;
mpm_table[MPM_WUMANBER].Prepare = WmPreparePatterns;
mpm_table[MPM_WUMANBER].Scan = WmSearch2Hash16; /* default to WmSearch2. We may fall back to 1 */
mpm_table[MPM_WUMANBER].Search = WmSearch2Hash16; /* default to WmSearch2. We may fall back to 1 */
mpm_table[MPM_WUMANBER].Scan = WmScan;
mpm_table[MPM_WUMANBER].Search = WmSearch;
mpm_table[MPM_WUMANBER].Cleanup = MpmMatchCleanup;
mpm_table[MPM_WUMANBER].PrintCtx = WmPrintInfo;
mpm_table[MPM_WUMANBER].PrintThreadCtx = WmPrintSearchStats;
@ -162,7 +164,7 @@ void WmPrintInfo(MpmCtx *mpm_ctx) {
printf("Max shiftlen: %" PRIu32 "\n", ctx->scan_shiftlen);
printf("Hash size: %" PRIu32 "\n", ctx->scan_hash_size);
printf("Scan function: ");
if (mpm_ctx->Scan == WmScan1) {
if (ctx->Scan == WmScan1) {
printf("WmScan1 (allows single byte patterns)\n");
printf("MBScan funct: ");
if (ctx->MBScan == WmScan2Hash16) printf("WmSearch2Hash16\n");
@ -171,18 +173,18 @@ void WmPrintInfo(MpmCtx *mpm_ctx) {
else if (ctx->MBScan == WmScan2Hash12) printf("WmSearch2Hash12\n");
else if (ctx->MBScan == WmScan2Hash9) printf("WmSearch2Hash9\n");
}
if (mpm_ctx->Scan == WmScan2Hash16) printf("WmScan2Hash16 (only for multibyte patterns)\n");
else if (mpm_ctx->Scan == WmScan2Hash15) printf("WmScan2Hash15 (only for multibyte patterns)\n");
else if (mpm_ctx->Scan == WmScan2Hash14) printf("WmScan2Hash14 (only for multibyte patterns)\n");
else if (mpm_ctx->Scan == WmScan2Hash12) printf("WmScan2Hash12 (only for multibyte patterns)\n");
else if (mpm_ctx->Scan == WmScan2Hash9) printf("WmScan2Hash9 (only for multibyte patterns)\n");
if (ctx->Scan == WmScan2Hash16) printf("WmScan2Hash16 (only for multibyte patterns)\n");
else if (ctx->Scan == WmScan2Hash15) printf("WmScan2Hash15 (only for multibyte patterns)\n");
else if (ctx->Scan == WmScan2Hash14) printf("WmScan2Hash14 (only for multibyte patterns)\n");
else if (ctx->Scan == WmScan2Hash12) printf("WmScan2Hash12 (only for multibyte patterns)\n");
else if (ctx->Scan == WmScan2Hash9) printf("WmScan2Hash9 (only for multibyte patterns)\n");
else printf("ERROR\n");
printf("Smallest: %" PRIu32 "\n", mpm_ctx->search_minlen);
printf("Largest: %" PRIu32 "\n", mpm_ctx->search_maxlen);
printf("Max shiftlen: %" PRIu32 "\n", ctx->search_shiftlen);
printf("Hash size: %" PRIu32 "\n", ctx->search_hash_size);
printf("Search function: ");
if (mpm_ctx->Search == WmSearch1) {
if (ctx->Search == WmSearch1) {
printf("WmSearch1 (allows single byte patterns)\n");
printf("MBSearch funct: ");
if (ctx->MBSearch == WmSearch2Hash16) printf("WmSearch2Hash16\n");
@ -191,11 +193,11 @@ void WmPrintInfo(MpmCtx *mpm_ctx) {
else if (ctx->MBSearch == WmSearch2Hash12) printf("WmSearch2Hash12\n");
else if (ctx->MBSearch == WmSearch2Hash9) printf("WmSearch2Hash9\n");
}
if (mpm_ctx->Search == WmSearch2Hash16) printf("WmSearch2Hash16 (only for multibyte patterns)\n");
else if (mpm_ctx->Search == WmSearch2Hash15) printf("WmSearch2Hash15 (only for multibyte patterns)\n");
else if (mpm_ctx->Search == WmSearch2Hash14) printf("WmSearch2Hash14 (only for multibyte patterns)\n");
else if (mpm_ctx->Search == WmSearch2Hash12) printf("WmSearch2Hash12 (only for multibyte patterns)\n");
else if (mpm_ctx->Search == WmSearch2Hash9) printf("WmSearch2Hash9 (only for multibyte patterns)\n");
if (ctx->Search == WmSearch2Hash16) printf("WmSearch2Hash16 (only for multibyte patterns)\n");
else if (ctx->Search == WmSearch2Hash15) printf("WmSearch2Hash15 (only for multibyte patterns)\n");
else if (ctx->Search == WmSearch2Hash14) printf("WmSearch2Hash14 (only for multibyte patterns)\n");
else if (ctx->Search == WmSearch2Hash12) printf("WmSearch2Hash12 (only for multibyte patterns)\n");
else if (ctx->Search == WmSearch2Hash9) printf("WmSearch2Hash9 (only for multibyte patterns)\n");
else printf("ERROR\n");
printf("\n");
}
@ -927,23 +929,23 @@ int WmPreparePatterns(MpmCtx *mpm_ctx) {
if (ctx->scan_hash_size == HASH9_SIZE) {
ctx->MBScan = WmScan2Hash9;
mpm_ctx->Scan = WmScan2Hash9;
ctx->Scan = WmScan2Hash9;
} else if (ctx->scan_hash_size == HASH12_SIZE) {
ctx->MBScan = WmScan2Hash12;
mpm_ctx->Scan = WmScan2Hash12;
ctx->Scan = WmScan2Hash12;
} else if (ctx->scan_hash_size == HASH14_SIZE) {
ctx->MBScan = WmScan2Hash14;
mpm_ctx->Scan = WmScan2Hash14;
ctx->Scan = WmScan2Hash14;
} else if (ctx->scan_hash_size == HASH15_SIZE) {
ctx->MBScan = WmScan2Hash15;
mpm_ctx->Scan = WmScan2Hash15;
ctx->Scan = WmScan2Hash15;
} else {
ctx->MBScan = WmScan2Hash16;
mpm_ctx->Scan = WmScan2Hash16;
ctx->Scan = WmScan2Hash16;
}
if (mpm_ctx->scan_minlen == 1) {
mpm_ctx->Scan = WmScan1;
ctx->Scan = WmScan1;
}
/* search XXX use search only pat cnt*/
@ -966,23 +968,23 @@ int WmPreparePatterns(MpmCtx *mpm_ctx) {
if (ctx->search_hash_size == HASH9_SIZE) {
ctx->MBSearch = WmSearch2Hash9;
mpm_ctx->Search = WmSearch2Hash9;
ctx->Search = WmSearch2Hash9;
} else if (ctx->search_hash_size == HASH12_SIZE) {
ctx->MBSearch = WmSearch2Hash12;
mpm_ctx->Search = WmSearch2Hash12;
ctx->Search = WmSearch2Hash12;
} else if (ctx->search_hash_size == HASH14_SIZE) {
ctx->MBSearch = WmSearch2Hash14;
mpm_ctx->Search = WmSearch2Hash14;
ctx->Search = WmSearch2Hash14;
} else if (ctx->search_hash_size == HASH15_SIZE) {
ctx->MBSearch = WmSearch2Hash15;
mpm_ctx->Search = WmSearch2Hash15;
ctx->Search = WmSearch2Hash15;
} else {
ctx->MBSearch = WmSearch2Hash16;
mpm_ctx->Search = WmSearch2Hash16;
ctx->Search = WmSearch2Hash16;
}
if (mpm_ctx->search_minlen == 1) {
mpm_ctx->Search = WmSearch1;
ctx->Search = WmSearch1;
}
return 0;
@ -1023,6 +1025,16 @@ memcmp_lowercase(uint8_t *s1, uint8_t *s2, uint16_t n) {
return 0;
}
inline uint32_t WmScan(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) {
WmCtx *ctx = (WmCtx *)mpm_ctx->ctx;
return ctx->Scan(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen);
}
inline uint32_t WmSearch(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) {
WmCtx *ctx = (WmCtx *)mpm_ctx->ctx;
return ctx->Search(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen);
}
/* SCAN FUNCTIONS */
uint32_t WmScan2Hash9(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) {
WmCtx *ctx = (WmCtx *)mpm_ctx->ctx;
@ -2380,7 +2392,7 @@ int WmTestInitCtx02 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
WmInitCtx(&mpm_ctx);
WmCtx *ctx = (WmCtx *)mpm_ctx.ctx;
WmCtx *ctx = (WmCtx *)mpm_ctx.ctx;
if (ctx->parray == NULL)
result = 1;
@ -2395,7 +2407,7 @@ int WmTestInitCtx03 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmInitCtx(&mpm_ctx, MPM_WUMANBER);
if (mpm_ctx.Search == WmSearch2Hash16)
if (mpm_table[MPM_WUMANBER].Search == WmSearch)
result = 1;
WmDestroyCtx(&mpm_ctx);
@ -2591,11 +2603,12 @@ int WmTestPrepare01 (void) {
MpmCtx mpm_ctx;
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmInitCtx(&mpm_ctx, MPM_WUMANBER);
WmCtx *ctx = (WmCtx *)mpm_ctx.ctx;
WmAddPattern(&mpm_ctx, (uint8_t *)"a", 1, 0, 0, 1, 0, 0, 0, 0);
WmPreparePatterns(&mpm_ctx);
if (mpm_ctx.Search == WmSearch1)
if (ctx->Search == WmSearch1)
result = 1;
WmDestroyCtx(&mpm_ctx);
@ -2643,11 +2656,12 @@ int WmTestPrepare04 (void) {
MpmCtx mpm_ctx;
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmInitCtx(&mpm_ctx, MPM_WUMANBER);
WmCtx *ctx = (WmCtx *)mpm_ctx.ctx;
WmAddPattern(&mpm_ctx, (uint8_t *)"a", 1, 0, 0, 1, 1, 0, 0, 0);
WmPreparePatterns(&mpm_ctx);
if (mpm_ctx.Scan == WmScan1)
if (ctx->Scan == WmScan1)
result = 1;
WmDestroyCtx(&mpm_ctx);
@ -2697,13 +2711,14 @@ int WmTestSearch01 (void) {
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_WUMANBER);
WmCtx *ctx = (WmCtx *)mpm_ctx.ctx;
WmAddPattern(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 1, 0, 0, 0, 0);
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
//mpm_ctx.PrintCtx(&mpm_ctx);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcd", 4);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcd", 4);
MpmMatchCleanup(&mpm_thread_ctx);
if (cnt == 1)
@ -2732,7 +2747,7 @@ int WmTestSearch01Hash12 (void) {
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
//mpm_ctx.PrintCtx(&mpm_ctx);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcd", 4);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcd", 4);
MpmMatchCleanup(&mpm_thread_ctx);
if (cnt == 1)
@ -2761,7 +2776,7 @@ int WmTestSearch01Hash14 (void) {
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
//mpm_ctx.PrintCtx(&mpm_ctx);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcd", 4);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcd", 4);
MpmMatchCleanup(&mpm_thread_ctx);
if (cnt == 1)
@ -2790,7 +2805,7 @@ int WmTestSearch01Hash15 (void) {
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
//mpm_ctx.PrintCtx(&mpm_ctx);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcd", 4);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcd", 4);
MpmMatchCleanup(&mpm_thread_ctx);
if (cnt == 1)
@ -2819,7 +2834,7 @@ int WmTestSearch01Hash16 (void) {
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
//mpm_ctx.PrintCtx(&mpm_ctx);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcd", 4);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcd", 4);
MpmMatchCleanup(&mpm_thread_ctx);
if (cnt == 1)
@ -2838,12 +2853,13 @@ int WmTestSearch02 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_WUMANBER);
WmCtx *ctx = (WmCtx *)mpm_ctx.ctx;
WmAddPattern(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 1, 0, 0, 0, 0);
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abce", 4);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abce", 4);
MpmMatchCleanup(&mpm_thread_ctx);
if (cnt == 0)
@ -2860,12 +2876,13 @@ int WmTestSearch03 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_WUMANBER);
WmCtx *ctx = (WmCtx *)mpm_ctx.ctx;
WmAddPattern(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 1, 0, 0, 0, 0);
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefgh", 8);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefgh", 8);
MpmMatchCleanup(&mpm_thread_ctx);
if (cnt == 1)
result = 1;
@ -2883,12 +2900,13 @@ int WmTestSearch04 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_WUMANBER);
WmCtx *ctx = (WmCtx *)mpm_ctx.ctx;
WmAddPattern(&mpm_ctx, (uint8_t *)"bcde", 4, 0, 0, 1, 0, 0, 0, 0);
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefgh", 8);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefgh", 8);
MpmMatchCleanup(&mpm_thread_ctx);
if (cnt == 1)
@ -2905,12 +2923,13 @@ int WmTestSearch05 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_WUMANBER);
WmCtx *ctx = (WmCtx *)mpm_ctx.ctx;
WmAddPattern(&mpm_ctx, (uint8_t *)"efgh", 4, 0, 0, 1, 0, 0, 0, 0);
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefgh", 8);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefgh", 8);
MpmMatchCleanup(&mpm_thread_ctx);
if (cnt == 1)
@ -2927,12 +2946,13 @@ int WmTestSearch06 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_WUMANBER);
WmCtx *ctx = (WmCtx *)mpm_ctx.ctx;
WmAddPattern(&mpm_ctx, (uint8_t *)"eFgH", 4, 0, 0, 1, 0, 0, 0, 0);
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdEfGh", 8);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdEfGh", 8);
MpmMatchCleanup(&mpm_thread_ctx);
if (cnt == 1)
@ -2949,13 +2969,14 @@ int WmTestSearch07 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_WUMANBER);
WmCtx *ctx = (WmCtx *)mpm_ctx.ctx;
WmAddPattern(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0, 0, 0);
WmAddPattern(&mpm_ctx, (uint8_t *)"eFgH", 4, 0, 0, 1, 0, 1, 0, 0);
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 2);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdEfGh", 8);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdEfGh", 8);
MpmMatchCleanup(&mpm_thread_ctx);
if (cnt == 2)
@ -2972,13 +2993,14 @@ int WmTestSearch08 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_WUMANBER);
WmCtx *ctx = (WmCtx *)mpm_ctx.ctx;
WmAddPattern(&mpm_ctx, (uint8_t *)"abcde", 5, 0, 0, 1, 0, 0, 0, 0);
WmAddPattern(&mpm_ctx, (uint8_t *)"bcde", 4, 0, 0, 1, 0, 1, 0, 0);
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 2);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefgh", 8);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefgh", 8);
MpmMatchCleanup(&mpm_thread_ctx);
if (cnt == 2)
@ -2995,12 +3017,13 @@ int WmTestSearch09 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_WUMANBER);
WmCtx *ctx = (WmCtx *)mpm_ctx.ctx;
WmAddPattern(&mpm_ctx, (uint8_t *)"ab", 2, 0, 0, 1, 0, 0, 0, 0);
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"ab", 2);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"ab", 2);
MpmMatchCleanup(&mpm_thread_ctx);
if (cnt == 1)
@ -3022,8 +3045,9 @@ int WmTestSearch10 (void) {
WmAddPattern(&mpm_ctx, (uint8_t *)"gh", 2, 0, 0, 1, 0, 1, 0, 0);
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 2);
WmCtx *ctx = (WmCtx *)mpm_ctx.ctx;
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefgh", 8);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefgh", 8);
MpmMatchCleanup(&mpm_thread_ctx);
if (cnt == 2)
@ -3046,8 +3070,9 @@ int WmTestSearch11 (void) {
WmAddPattern(&mpm_ctx, (uint8_t *)"h", 1, 0, 0, 1, 0, 2, 0, 0);
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 3);
WmCtx *ctx = (WmCtx *)mpm_ctx.ctx;
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefgh", 8);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefgh", 8);
MpmMatchCleanup(&mpm_thread_ctx);
if (cnt == 3)
@ -3064,6 +3089,7 @@ int WmTestSearch12 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_WUMANBER);
WmCtx *ctx = (WmCtx *)mpm_ctx.ctx;
WmAddPattern(&mpm_ctx, (uint8_t *)"A", 1, 0, 0, 1, 0, 0, 0, 0);
WmAddPattern(&mpm_ctx, (uint8_t *)"d", 1, 0, 0, 1, 0, 1, 0, 0);
@ -3071,7 +3097,7 @@ int WmTestSearch12 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 3);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefgh", 8);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefgh", 8);
MpmMatchCleanup(&mpm_thread_ctx);
if (cnt == 2)
@ -3090,6 +3116,7 @@ int WmTestSearch13 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_WUMANBER);
WmCtx *ctx = (WmCtx *)mpm_ctx.ctx;
WmAddPattern(&mpm_ctx, (uint8_t *)"a", 1, 0, 0, 1, 0, 0, 0, 0);
WmAddPattern(&mpm_ctx, (uint8_t *)"de",2, 0, 0, 1, 0, 1, 0, 0);
@ -3097,7 +3124,7 @@ int WmTestSearch13 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 3);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefgh", 8);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefgh", 8);
MpmMatchCleanup(&mpm_thread_ctx);
if (cnt == 3)
@ -3116,6 +3143,7 @@ int WmTestSearch14 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_WUMANBER);
WmCtx *ctx = (WmCtx *)mpm_ctx.ctx;
WmAddPattern(&mpm_ctx, (uint8_t *)"A", 1, 0, 0, 1, 0, 0, 0, 0);
WmAddPattern(&mpm_ctx, (uint8_t *)"de",2, 0, 0, 1, 0, 1, 0, 0);
@ -3123,7 +3151,7 @@ int WmTestSearch14 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 3);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefgh", 8);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefgh", 8);
MpmMatchCleanup(&mpm_thread_ctx);
if (cnt == 2)
@ -3140,6 +3168,7 @@ int WmTestSearch15 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_WUMANBER);
WmCtx *ctx = (WmCtx *)mpm_ctx.ctx;
WmAddPattern(&mpm_ctx, (uint8_t *)"A", 1, 0, 0, 1, 0, 0, 0, 0);
WmAddPattern(&mpm_ctx, (uint8_t *)"de",2, 0, 0, 1, 0, 1, 0, 0);
@ -3147,7 +3176,7 @@ int WmTestSearch15 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 3);
mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefgh", 8);
ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefgh", 8);
uint32_t len = mpm_thread_ctx.match[1].len;
@ -3167,6 +3196,7 @@ int WmTestSearch16 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_WUMANBER);
WmCtx *ctx = (WmCtx *)mpm_ctx.ctx;
WmAddPattern(&mpm_ctx, (uint8_t *)"A", 1, 0, 0, 1, 0, 0, 0, 0);
WmAddPattern(&mpm_ctx, (uint8_t *)"de",2, 0, 0, 1, 0, 1, 0, 0);
@ -3174,7 +3204,7 @@ int WmTestSearch16 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 3);
mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefgh", 8);
ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"abcdefgh", 8);
uint32_t len = mpm_thread_ctx.match[0].len;
@ -3194,12 +3224,13 @@ int WmTestSearch17 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_WUMANBER);
WmCtx *ctx = (WmCtx *)mpm_ctx.ctx;
WmAddPatternCS(&mpm_ctx, (uint8_t *)"/VideoAccessCodecInstall.exe", 28, 0, 0, 0, 0);
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstall.exe", 28);
ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstall.exe", 28);
uint32_t len = mpm_thread_ctx.match[0].len;
@ -3226,7 +3257,7 @@ int WmTestSearch18Hash12 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstaLL.exe", 28);
ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstaLL.exe", 28);
uint32_t len = mpm_thread_ctx.match[0].len;
@ -3253,7 +3284,7 @@ int WmTestSearch18Hash14 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstaLL.exe", 28);
ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstaLL.exe", 28);
uint32_t len = mpm_thread_ctx.match[0].len;
@ -3280,7 +3311,7 @@ int WmTestSearch18Hash15 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstaLL.exe", 28);
ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstaLL.exe", 28);
uint32_t len = mpm_thread_ctx.match[0].len;
@ -3307,7 +3338,7 @@ int WmTestSearch18 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstaLL.exe", 28);
ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstaLL.exe", 28);
uint32_t len = mpm_thread_ctx.match[0].len;
@ -3334,7 +3365,7 @@ int WmTestSearch18Hash16 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstaLL.exe", 28);
ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstaLL.exe", 28);
uint32_t len = mpm_thread_ctx.match[0].len;
@ -3354,12 +3385,13 @@ int WmTestSearch19 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_WUMANBER);
WmCtx *ctx = (WmCtx *)mpm_ctx.ctx;
WmAddPatternCI(&mpm_ctx, (uint8_t *)"/VideoAccessCodecInstall.exe", 28, 0, 0, 0, 0);
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstaLL.exe", 28);
ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstaLL.exe", 28);
uint32_t len = mpm_thread_ctx.match[0].len;
@ -3386,7 +3418,7 @@ int WmTestSearch19Hash12 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstaLL.exe", 28);
ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstaLL.exe", 28);
uint32_t len = mpm_thread_ctx.match[0].len;
@ -3413,7 +3445,7 @@ int WmTestSearch19Hash14 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstaLL.exe", 28);
ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstaLL.exe", 28);
uint32_t len = mpm_thread_ctx.match[0].len;
@ -3440,7 +3472,7 @@ int WmTestSearch19Hash15 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstaLL.exe", 28);
ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstaLL.exe", 28);
uint32_t len = mpm_thread_ctx.match[0].len;
@ -3467,7 +3499,7 @@ int WmTestSearch19Hash16 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstaLL.exe", 28);
ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstaLL.exe", 28);
uint32_t len = mpm_thread_ctx.match[0].len;
@ -3487,12 +3519,13 @@ int WmTestSearch20 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_WUMANBER);
WmCtx *ctx = (WmCtx *)mpm_ctx.ctx;
WmAddPatternCS(&mpm_ctx, (uint8_t *)"/videoaccesscodecinstall.exe", 28, 0, 0, 0, 0);
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstall.exe", 28);
ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstall.exe", 28);
uint32_t len = mpm_thread_ctx.match[0].len;
@ -3519,7 +3552,7 @@ int WmTestSearch20Hash12 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstall.exe", 28);
ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstall.exe", 28);
uint32_t len = mpm_thread_ctx.match[0].len;
@ -3546,7 +3579,7 @@ int WmTestSearch20Hash14 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstall.exe", 28);
ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstall.exe", 28);
uint32_t len = mpm_thread_ctx.match[0].len;
@ -3573,7 +3606,7 @@ int WmTestSearch20Hash15 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstall.exe", 28);
ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstall.exe", 28);
uint32_t len = mpm_thread_ctx.match[0].len;
@ -3600,7 +3633,7 @@ int WmTestSearch20Hash16 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstall.exe", 28);
ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/VideoAccessCodecInstall.exe", 28);
uint32_t len = mpm_thread_ctx.match[0].len;
@ -3620,12 +3653,13 @@ int WmTestSearch21 (void) {
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_WUMANBER);
WmCtx *ctx = (WmCtx *)mpm_ctx.ctx;
WmAddPatternCS(&mpm_ctx, (uint8_t *)"/videoaccesscodecinstall.exe", 28, 0, 0, 0, 0);
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/videoaccesscodecinstall.exe", 28);
ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/videoaccesscodecinstall.exe", 28);
uint32_t len = mpm_thread_ctx.match[0].len;
@ -3652,7 +3686,7 @@ static int WmTestSearch21Hash12 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
//WmPrintInfo(&mpm_ctx);
mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/videoaccesscodecinstall.exe", 28);
ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/videoaccesscodecinstall.exe", 28);
uint32_t len = mpm_thread_ctx.match[0].len;
@ -3679,7 +3713,7 @@ static int WmTestSearch21Hash14 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
//WmPrintInfo(&mpm_ctx);
mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/videoaccesscodecinstall.exe", 28);
ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/videoaccesscodecinstall.exe", 28);
uint32_t len = mpm_thread_ctx.match[0].len;
@ -3706,7 +3740,7 @@ static int WmTestSearch21Hash15 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
//WmPrintInfo(&mpm_ctx);
mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/videoaccesscodecinstall.exe", 28);
ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/videoaccesscodecinstall.exe", 28);
uint32_t len = mpm_thread_ctx.match[0].len;
@ -3733,7 +3767,7 @@ static int WmTestSearch21Hash16 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
//WmPrintInfo(&mpm_ctx);
mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/videoaccesscodecinstall.exe", 28);
ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"/videoaccesscodecinstall.exe", 28);
uint32_t len = mpm_thread_ctx.match[0].len;
@ -3767,7 +3801,7 @@ static int WmTestSearch22Hash9 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 6 /* 6 patterns */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 30);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 30);
MpmMatchCleanup(&mpm_thread_ctx);
@ -3801,7 +3835,7 @@ static int WmTestSearch22Hash12 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 6 /* 6 patterns */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 30);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 30);
MpmMatchCleanup(&mpm_thread_ctx);
@ -3835,7 +3869,7 @@ static int WmTestSearch22Hash14 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 6 /* 6 patterns */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 30);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 30);
MpmMatchCleanup(&mpm_thread_ctx);
@ -3869,7 +3903,7 @@ static int WmTestSearch22Hash15 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 6 /* 6 patterns */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 30);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 30);
MpmMatchCleanup(&mpm_thread_ctx);
@ -3903,7 +3937,7 @@ static int WmTestSearch22Hash16 (void) {
WmPreparePatterns(&mpm_ctx);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 6 /* 6 patterns */);
uint32_t cnt = mpm_ctx.Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 30);
uint32_t cnt = ctx->Search(&mpm_ctx, &mpm_thread_ctx, NULL, (uint8_t *)"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 30);
MpmMatchCleanup(&mpm_thread_ctx);

4
src/util-mpm-wumanber.h
Unescape Escape View File

@ -48,6 +48,10 @@ typedef struct WmCtx_ {
WmHashItem **search_hash;
WmHashItem search_hash1[256];
/* we store our own scan ptr here for WmSearch1 */
uint32_t (*Scan)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
/* we store our own search ptr here for WmSearch1 */
uint32_t (*Search)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
/* we store our own multi byte scan ptr here for WmSearch1 */
uint32_t (*MBScan)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
/* we store our own multi byte search ptr here for WmSearch1 */

16
src/util-mpm.c
Unescape Escape View File

@ -279,14 +279,14 @@ void MpmInitCtx (MpmCtx *mpm_ctx, uint16_t matcher) {
mpm_ctx->mpm_type = matcher;
mpm_table[matcher].InitCtx(mpm_ctx);
mpm_ctx->AddScanPattern = mpm_table[matcher].AddScanPattern;
mpm_ctx->AddScanPatternNocase = mpm_table[matcher].AddScanPatternNocase;
mpm_ctx->AddPattern = mpm_table[matcher].AddPattern;
mpm_ctx->AddPatternNocase = mpm_table[matcher].AddPatternNocase;
mpm_ctx->Prepare = mpm_table[matcher].Prepare;
mpm_ctx->Scan = mpm_table[matcher].Scan;
mpm_ctx->Search = mpm_table[matcher].Search;
mpm_ctx->Cleanup = mpm_table[matcher].Cleanup;
// mpm_ctx->AddScanPattern = mpm_table[matcher].AddScanPattern;
// mpm_ctx->AddScanPatternNocase = mpm_table[matcher].AddScanPatternNocase;
// mpm_ctx->AddPattern = mpm_table[matcher].AddPattern;
// mpm_ctx->AddPatternNocase = mpm_table[matcher].AddPatternNocase;
// mpm_ctx->Prepare = mpm_table[matcher].Prepare;
// mpm_ctx->Scan = mpm_table[matcher].Scan;
// mpm_ctx->Search = mpm_table[matcher].Search;
// mpm_ctx->Cleanup = mpm_table[matcher].Cleanup;
}

16
src/util-mpm.h
Unescape Escape View File

@ -78,21 +78,6 @@ typedef struct MpmCtx_ {
void *ctx;
uint16_t mpm_type;
// void (*InitCtx)(struct MpmCtx_ *);
// void (*InitThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *, uint32_t);
// void (*DestroyCtx)(struct MpmCtx_ *);
// void (*DestroyThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *);
int (*AddScanPattern)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, uint32_t, uint8_t);
int (*AddScanPatternNocase)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, uint32_t, uint8_t);
int (*AddPattern)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, uint32_t);
int (*AddPatternNocase)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, uint32_t);
int (*Prepare)(struct MpmCtx_ *);
uint32_t (*Scan)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
uint32_t (*Search)(struct MpmCtx_ *, struct MpmThreadCtx_ *, PatternMatcherQueue *, uint8_t *, uint16_t);
void (*Cleanup)(struct MpmThreadCtx_ *);
// void (*PrintCtx)(struct MpmCtx_ *);
// void (*PrintThreadCtx)(struct MpmThreadCtx_ *);
uint32_t memory_cnt;
uint32_t memory_size;
@ -110,7 +95,6 @@ typedef struct MpmCtx_ {
/* this is used to determine the size of the match
* loopup table */
uint32_t max_pattern_id;
} MpmCtx;
typedef struct MpmTableElmt_ {

Write Preview
Loading…
Cancel
Save