http_uri: mpm cleanup. Use mpm_ctx's minlen

pull/1980/head
Victor Julien 11 years ago
parent 6bb2b001a3
commit 5857660568

@ -57,56 +57,27 @@
* \retval ret number of matches
*/
static uint32_t UriPatternSearch(DetectEngineThreadCtx *det_ctx,
uint8_t *uri, uint16_t uri_len, uint8_t flags)
const uint8_t *uri, const uint16_t uri_len,
const uint8_t flags)
{
SCEnter();
uint32_t ret;
uint32_t ret = 0;
DEBUG_VALIDATE_BUG_ON(flags & STREAM_TOCLIENT);
DEBUG_VALIDATE_BUG_ON(det_ctx->sgh->mpm_uri_ctx_ts == NULL);
ret = mpm_table[det_ctx->sgh->mpm_uri_ctx_ts->mpm_type].
Search(det_ctx->sgh->mpm_uri_ctx_ts,
&det_ctx->mtcu, &det_ctx->pmq, uri, uri_len);
if (uri_len >= det_ctx->sgh->mpm_uri_ctx_ts->minlen) {
ret = mpm_table[det_ctx->sgh->mpm_uri_ctx_ts->mpm_type].
Search(det_ctx->sgh->mpm_uri_ctx_ts,
&det_ctx->mtcu, &det_ctx->pmq, uri, uri_len);
}
//PrintRawDataFp(stdout, uri, uri_len);
SCReturnUInt(ret);
}
/**
* \brief Checks if the content sent as the argument, has a uricontent which
* has been provided in the rule. This match function matches the
* normalized http uri against the given rule using multi pattern
* search algorithms.
*
* \param det_ctx Pointer to the detection engine thread context
* \param content Pointer to the uri content currently being matched
* \param content_len Content_len of the received uri content
*
* \retval 1 if the uri contents match; 0 no match
*/
static inline int DoDetectAppLayerUricontentMatch (DetectEngineThreadCtx *det_ctx,
uint8_t *uri, uint16_t uri_len, uint8_t flags)
{
int ret = 0;
/* run the pattern matcher against the uri */
if (det_ctx->sgh->mpm_uricontent_minlen > uri_len) {
SCLogDebug("not searching as uri len is smaller than the "
"shortest uricontent length we need to match");
} else {
SCLogDebug("search: (%p, minlen %" PRIu32 ", sgh->sig_cnt "
"%" PRIu32 ")", det_ctx->sgh,
det_ctx->sgh->mpm_uricontent_minlen, det_ctx->sgh->sig_cnt);
ret += UriPatternSearch(det_ctx, uri, uri_len, flags);
SCLogDebug("post search: cnt %" PRIu32, ret);
}
return ret;
}
/**
* \brief Run the pattern matcher against the uri(s)
*
@ -132,10 +103,10 @@ uint32_t DetectUricontentInspectMpm(DetectEngineThreadCtx *det_ctx, Flow *f,
if (tx_ud == NULL || tx_ud->request_uri_normalized == NULL)
goto end;
cnt = DoDetectAppLayerUricontentMatch(det_ctx, (uint8_t *)
bstr_ptr(tx_ud->request_uri_normalized),
bstr_len(tx_ud->request_uri_normalized),
flags);
cnt = UriPatternSearch(det_ctx, (const uint8_t *)
bstr_ptr(tx_ud->request_uri_normalized),
bstr_len(tx_ud->request_uri_normalized),
flags);
end:
SCReturnUInt(cnt);

@ -3998,9 +3998,6 @@ int SigAddressPrepareStage4(DetectEngineCtx *de_ctx)
BUG_ON(PatternMatchPrepareGroup(de_ctx, sgh) != 0);
SigGroupHeadBuildNonMpmArray(de_ctx, sgh);
sgh->mpm_uricontent_minlen = SigGroupHeadGetMinMpmSize(de_ctx, sgh, DETECT_SM_LIST_UMATCH);
SCLogDebug("http_uri content min mpm len: %u", sgh->mpm_uricontent_minlen);
sgh->id = idx;
cnt++;
}

@ -967,7 +967,6 @@ typedef struct SigGroupHead_ {
/* track min pattern length for content. Used in grouping */
uint16_t mpm_content_minlen;
uint16_t mpm_uricontent_minlen; /**< len of shortest mpm pattern in sgh */
/* non mpm list excluding SYN rules */
uint32_t non_mpm_other_store_cnt;

Loading…
Cancel
Save