diff --git a/src/detect-engine-siggroup.c b/src/detect-engine-siggroup.c index 73a4a82fba..44aef87401 100644 --- a/src/detect-engine-siggroup.c +++ b/src/detect-engine-siggroup.c @@ -720,6 +720,9 @@ int SigGroupHeadContainsSigId (DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint3 return 0; for (sig = 0; sig < sgh->sig_cnt; sig++) { + if (sgh->sig_array == NULL) + return 0; + if (!(sgh->sig_array[(sig/8)] & (1<<(sig%8)))) continue; diff --git a/src/detect-engine-siggroup.h b/src/detect-engine-siggroup.h index 0bb3178081..2ad0f5c3d4 100644 --- a/src/detect-engine-siggroup.h +++ b/src/detect-engine-siggroup.h @@ -42,5 +42,7 @@ void SigGroupHeadSetSigCnt(SigGroupHead *sgh, uint32_t max_idx); int SigGroupHeadBuildMatchArray (DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint32_t max_idx); void SigGroupHeadFreeSigArrays(DetectEngineCtx *de_ctx); +int SigGroupHeadContainsSigId (DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint32_t sid); + #endif /* __DETECT_ENGINE_SIGGROUP_H__ */ diff --git a/src/detect-parse.c b/src/detect-parse.c index c5c8a15e51..3fd563c2c0 100644 --- a/src/detect-parse.c +++ b/src/detect-parse.c @@ -330,8 +330,9 @@ int SigParsePort(Signature *s, const char *portstr, char flag) { } if (flag == 0) { - if (strcasecmp(port,"any") == 0) + if (strcasecmp(port,"any") == 0) { s->flags |= SIG_FLAG_SP_ANY; + } r = DetectPortParse(&s->sp,(char *)port); } else if (flag == 1) { @@ -410,8 +411,13 @@ int SigParseBasics(Signature *s, char *sigstr, char ***result) { /* Parse Address & Ports */ if (SigParseAddress(s, arr[CONFIG_SRC], 0) < 0) goto error; + + /* For "ip" we parse the ports as well, even though they will + be just "any". We do this for later sgh building for the + tcp and udp protocols. */ if (strcasecmp(arr[CONFIG_PROTO],"tcp") == 0 || - strcasecmp(arr[CONFIG_PROTO],"udp") == 0) { + strcasecmp(arr[CONFIG_PROTO],"udp") == 0 || + strcasecmp(arr[CONFIG_PROTO],"ip") == 0) { if (SigParsePort(s, arr[CONFIG_SP], 0) < 0) goto error; if (SigParsePort(s, arr[CONFIG_DP], 1) < 0) diff --git a/src/detect.c b/src/detect.c index 824d4fb5b6..567e76c45c 100644 --- a/src/detect.c +++ b/src/detect.c @@ -60,6 +60,9 @@ SigMatch *SigMatchAlloc(void); void SigMatchFree(SigMatch *sm); void DetectExitPrintStats(ThreadVars *tv, void *data); +void DbgPrintSigs(DetectEngineCtx *, SigGroupHead *); +void DbgPrintSigs2(DetectEngineCtx *, SigGroupHead *); + /* tm module api functions */ int Detect(ThreadVars *, Packet *, void *, PacketQueue *); int DetectThreadInit(ThreadVars *, void *, void **); @@ -173,6 +176,9 @@ int DetectLoadSigFile(DetectEngineCtx *de_ctx, char *sig_file) { sig = SigInit(de_ctx, line); if (sig != NULL) { +#ifdef DEBUG + printf("Sig %"PRIu32" loaded\n", sig->id); +#endif if (de_ctx->sig_list == NULL) { de_ctx->sig_list = sig; } else { @@ -696,6 +702,8 @@ static int DetectEngineLookupBuildSourceAddressList(DetectEngineCtx *de_ctx, Det DetectAddressGroup *gr = NULL, *lookup_gr = NULL, *head = NULL; int proto; + //printf("DetectEngineLookupBuildSourceAddressList: sig %"PRIu32", family %"PRIi32"\n", s->id, family); + if (family == AF_INET) { head = s->src.ipv4_head; } else if (family == AF_INET6) { @@ -815,6 +823,8 @@ static int DetectEngineLookupFlowAddSig(DetectEngineCtx *de_ctx, DetectEngineLoo else dsize ? g_detectengine_any_big_toserver++ : g_detectengine_any_small_toserver++; } else { + //printf("DetectEngineLookupFlowAddSig: s->id %"PRIu32"\n", s->id); + /* both */ DetectEngineLookupBuildSourceAddressList(de_ctx, &ds->flow_gh[0], s, family); DetectEngineLookupBuildSourceAddressList(de_ctx, &ds->flow_gh[1], s, family); @@ -972,7 +982,7 @@ int CreateGroupedAddrList(DetectEngineCtx *de_ctx, DetectAddressGroup *srchead, unique_groups++; //printf(" 1 -= Address "); DetectAddressDataPrint(gr->ad); printf("\n"); - //printf(" : "); DbgPrintSigs2(gr->sh); + //printf(" : "); DbgPrintSigs2(de_ctx, gr->sh); groups++; @@ -1135,9 +1145,11 @@ int CreateGroupedAddrList(DetectEngineCtx *de_ctx, DetectAddressGroup *srchead, #endif } +#ifdef DEBUG for (gr = newhead->ipv4_head; gr != NULL; gr = gr->next) { - //printf(" 4 -= R Address "); DetectAddressDataPrint(gr->ad); printf(" : "); DbgPrintSigs2(gr->sh); + printf(" 4 -= R Address "); DetectAddressDataPrint(gr->ad); printf(" : "); DbgPrintSigs2(de_ctx, gr->sh); } +#endif return 0; error: @@ -1184,9 +1196,9 @@ int CreateGroupedPortList(DetectEngineCtx *de_ctx,HashListTable *port_hash, Dete unique_groups++; groups++; - - //printf(":-:1:-: Port "); DetectPortPrint(gr); printf(" (cnt %" PRIu32 ", cost %" PRIu32 ", maxlen %" PRIu32 ") ", gr->cnt, gr->sh->cost, gr->sh->mpm_content_maxlen);DbgSghContainsSig(de_ctx,gr->sh,2001330); - +#ifdef DEBUG + printf(" -= 1:Port "); DetectPortPrint(gr); printf(" : "); DbgPrintSigs2(de_ctx, gr->sh); +#endif /* alloc a copy */ DetectPort *newtmp = DetectPortCopySingle(de_ctx,gr); if (newtmp == NULL) { @@ -1284,11 +1296,12 @@ int CreateGroupedPortList(DetectEngineCtx *de_ctx,HashListTable *port_hash, Dete DetectPortInsert(de_ctx,newhead,joingr); } +#ifdef DEBUG for (gr = *newhead; gr != NULL; gr = gr->next) { - //printf(":-:9:-: Port "); DetectPortPrint(gr); printf(" (cnt %" PRIu32 ", cost %" PRIu32 ") ", gr->cnt, gr->sh->cost); DbgSghContainsSig(de_ctx,gr->sh,2001330); - //printf(" -= Port "); DetectPortPrint(gr); printf(" : "); DbgPrintSigs2(gr->sh); + //printf(":-:9:-: Port "); DetectPortPrint(gr); printf(" (cnt %" PRIu32 "", gr->cnt); DbgSghContainsSig(de_ctx,gr->sh,489); + printf(" -= 9:Port "); DetectPortPrint(gr); printf(" : "); DbgPrintSigs2(de_ctx, gr->sh); } - +#endif return 0; error: return -1; @@ -1325,6 +1338,7 @@ int SigAddressPrepareStage2(DetectEngineCtx *de_ctx) { /* now for every rule add the source group to our temp lists */ for (tmp_s = de_ctx->sig_list; tmp_s != NULL; tmp_s = tmp_s->next) { + //printf("SigAddressPrepareStage2 tmp_s->id %u\n", tmp_s->id); if (!(tmp_s->flags & SIG_FLAG_IPONLY)) { DetectEngineLookupDsizeAddSig(de_ctx, tmp_s, AF_INET); DetectEngineLookupDsizeAddSig(de_ctx, tmp_s, AF_INET6); @@ -2154,7 +2168,7 @@ void DbgSghContainsSig(DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint32_t sid) /* shortcut for debugging. If enabled Stage5 will * print sigid's for all groups */ -//#define PRINTSIGS +#define PRINTSIGS /* just printing */ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) { @@ -2211,13 +2225,6 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) { printf("%" PRIu32 " ", s->id); } #endif - printf(" - "); - for (i = 0; i < dp->sh->sig_cnt; i++) { - Signature *s = de_ctx->sig_array[dp->sh->match_array[i]]; - if (s->id == 2008335 || s->id == 2001329 || s->id == 2001330 || - s->id == 2001331 || s->id == 2003321 || s->id == 2003322) - printf("%" PRIu32 " ", s->id); - } printf("\n"); } } @@ -2254,8 +2261,8 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) { } } } -#if 0 - for (global_src_gr = de_ctx->src_gh[proto]->ipv6_head; global_src_gr != NULL; +//#if 0 + for (global_src_gr = de_ctx->dsize_gh[ds].flow_gh[f].src_gh[proto]->ipv6_head; global_src_gr != NULL; global_src_gr = global_src_gr->next) { printf("- "); DetectAddressDataPrint(global_src_gr->ad); @@ -2329,7 +2336,7 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) { } } - for (global_src_gr = de_ctx->src_gh[proto]->any_head; global_src_gr != NULL; + for (global_src_gr = de_ctx->dsize_gh[ds].flow_gh[f].src_gh[proto]->any_head; global_src_gr != NULL; global_src_gr = global_src_gr->next) { printf("- "); DetectAddressDataPrint(global_src_gr->ad); @@ -2433,7 +2440,7 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) { } } } -#endif +//#endif } } } @@ -2441,17 +2448,17 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) { return 0; } +/** \brief Convert the signature list into the runtime + * match structure. */ int SigGroupBuild (DetectEngineCtx *de_ctx) { SigAddressPrepareStage1(de_ctx); SigAddressPrepareStage2(de_ctx); SigAddressPrepareStage3(de_ctx); -//abort(); -// SigAddressPrepareStage5(); +// SigAddressPrepareStage5(de_ctx); DbgPrintScanSearchStats(); // DetectAddressGroupPrintMemory(); // DetectSigGroupPrintMemory(); // DetectPortPrintMemory(); -//SigGroupGetSrcAddress(NULL); return 0; } @@ -2460,17 +2467,6 @@ int SigGroupCleanup (DetectEngineCtx *de_ctx) { return 0; } -int SigGroupGetSrcAddress(DetectAddressGroupsHead *src) { - uint32_t ip = 0x04030201; /* 1.2.3.4 */ - - printf("ip & 0x000000ff %8u 0x%08X >> 0 %" PRIu32 "\n", ip & 0x000000ff, ip & 0x000000ff, (ip & 0x000000ff) >> 0); - printf("ip & 0x0000ff00 %8u 0x%08X >> 8 %" PRIu32 "\n", ip & 0x0000ff00, ip & 0x0000ff00, (ip & 0x0000ff00) >> 8); - printf("ip & 0x00ff0000 %8u 0x%08X >> 16 %" PRIu32 "\n", ip & 0x00ff0000, ip & 0x00ff0000, (ip & 0x00ff0000) >> 16); - printf("ip & 0xff000000 %8u 0x%08X >> 24 %" PRIu32 "\n", ip & 0xff000000, ip & 0xff000000, (ip & 0xff000000) >> 24); - - return 0; -} - void SigTableSetup(void) { memset(sigmatch_table, 0, sizeof(sigmatch_table)); diff --git a/src/util-mpm-b2g.c b/src/util-mpm-b2g.c index f5dcec84a5..8fbd37910e 100644 --- a/src/util-mpm-b2g.c +++ b/src/util-mpm-b2g.c @@ -113,8 +113,7 @@ static inline void B2gEndMatchAppend(MpmCtx *mpm_ctx, B2gPattern *p, m->next = em; } -/** \todo XXX Unused??? */ -#if 0 +#ifdef PRINTMATCH static void prt (uint8_t *buf, uint16_t buflen) { uint16_t i; @@ -1148,7 +1147,9 @@ uint32_t B2gScanBNDMq(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatc continue; if (memcmp_lowercase(p->ci, buf+j, p->len) == 0) { - //printf("CI Exact match: "); prt(p->ci, p->len); printf("\n"); +#ifdef PRINTMATCH + printf("CI Exact match: "); prt(p->ci, p->len); printf("\n"); +#endif COUNT(tctx->scan_stat_loop_match++); MpmEndMatch *em; @@ -1165,7 +1166,9 @@ uint32_t B2gScanBNDMq(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatc continue; if (memcmp(p->cs, buf+j, p->len) == 0) { - //printf("CS Exact match: "); prt(p->cs, p->len); printf("\n"); +#ifdef PRINTMATCH + printf("CS Exact match: "); prt(p->cs, p->len); printf("\n"); +#endif COUNT(tctx->scan_stat_loop_match++); MpmEndMatch *em; @@ -1266,12 +1269,12 @@ uint32_t B2gScan(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQu #endif COUNT(tctx->scan_stat_loop_match++); - MpmEndMatch *em; + MpmEndMatch *em; for (em = p->em; em; em = em->next) { #ifdef PRINTMATCH -printf("(%" PRIu32 "%s) ", g_de_ctx->sig_array[em->sig_id]->id, em->flags & MPM_ENDMATCH_NOSEARCH ? "" : " (searchable)"); + printf("(%" PRIu32 "%s) ", g_de_ctx->sig_array[em->sig_id]->id, em->flags & MPM_ENDMATCH_NOSEARCH ? "" : " (searchable)"); + printf("em %p id %" PRIu32 "\n", em, em->id); #endif - //printf("em %p id %" PRIu32 "\n", em, em->id); if (MpmMatchAppend(mpm_thread_ctx, pmq, em, &mpm_thread_ctx->match[em->id], pos, p->len)) matches++; } @@ -1291,12 +1294,12 @@ printf("\n"); #endif COUNT(tctx->scan_stat_loop_match++); - MpmEndMatch *em; + MpmEndMatch *em; for (em = p->em; em; em = em->next) { #ifdef PRINTMATCH -printf("(%" PRIu32 "%s) ", g_de_ctx->sig_array[em->sig_id]->id, em->flags & MPM_ENDMATCH_NOSEARCH ? "" : " (searchable)"); + printf("(%" PRIu32 "%s) ", g_de_ctx->sig_array[em->sig_id]->id, em->flags & MPM_ENDMATCH_NOSEARCH ? "" : " (searchable)"); + printf("em %p id %" PRIu32 "\n", em, em->id); #endif - //printf("em %p id %" PRIu32 "\n", em, em->id); if (MpmMatchAppend(mpm_thread_ctx, pmq, em, &mpm_thread_ctx->match[em->id], pos, p->len)) matches++; }