aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

code cleanup over last 2 commits

Browse Source
remotes/origin/HEAD
Anoop Saldanha 14 years ago committed by Victor Julien
parent 55c4e419fd
commit 9a665e035b
2 changed files with 140 additions and 276 deletions
Show Stats Download Patch File Download Diff File

207
src/detect-engine-mpm.c
Unescape Escape View File

@ -176,21 +176,11 @@ uint32_t PacketPatternSearchWithStreamCtx(DetectEngineThreadCtx *det_ctx,
ret = mpm_table[det_ctx->sgh->mpm_stream_ctx_ts->mpm_type].
Search(det_ctx->sgh->mpm_stream_ctx_ts, &det_ctx->mtc, &det_ctx->pmq,
p->payload, p->payload_len);
} else { //if (p->flowflags & FLOW_PKT_TOCLIENT) {
} else {
ret = mpm_table[det_ctx->sgh->mpm_stream_ctx_tc->mpm_type].
Search(det_ctx->sgh->mpm_stream_ctx_tc, &det_ctx->mtc, &det_ctx->pmq,
p->payload, p->payload_len);
}
//else {
// printf("packet pattern search with stream ctx");
// exit(0);
// ret = mpm_table[det_ctx->sgh->mpm_stream_ctx_ts->mpm_type].
// Search(det_ctx->sgh->mpm_stream_ctx_ts, &det_ctx->mtc, &det_ctx->pmq,
// p->payload, p->payload_len);
// ret = mpm_table[det_ctx->sgh->mpm_stream_ctx_tc->mpm_type].
// Search(det_ctx->sgh->mpm_stream_ctx_tc, &det_ctx->mtc, &det_ctx->pmq,
// p->payload, p->payload_len);
//}
SCReturnInt(ret);
}
@ -208,38 +198,22 @@ uint32_t PacketPatternSearch(DetectEngineThreadCtx *det_ctx, Packet *p)
uint32_t ret;
MpmCtx *mpm_ctx = NULL;
MpmCtx *mpm_ctx1 = NULL;
if (p->proto == IPPROTO_TCP) {
if (p->flowflags & FLOW_PKT_TOSERVER) {
mpm_ctx = det_ctx->sgh->mpm_proto_tcp_ctx_ts;
} else { // if (p->flowflags & FLOW_PKT_TOCLIENT) {
} else {
mpm_ctx = det_ctx->sgh->mpm_proto_tcp_ctx_tc;
}
//else {
// mpm_ctx = det_ctx->sgh->mpm_proto_tcp_ctx_ts;
// mpm_ctx1 = det_ctx->sgh->mpm_proto_tcp_ctx_tc;
//}
} else if (p->proto == IPPROTO_UDP) {
if (p->flowflags & FLOW_PKT_TOSERVER) {
mpm_ctx = det_ctx->sgh->mpm_proto_udp_ctx_ts;
} else { //if (p->flowflags & FLOW_PKT_TOCLIENT) {
} else {
mpm_ctx = det_ctx->sgh->mpm_proto_udp_ctx_tc;
}
//else {
// mpm_ctx = det_ctx->sgh->mpm_proto_udp_ctx_ts;
// mpm_ctx1 = det_ctx->sgh->mpm_proto_udp_ctx_tc;
//}
} else {
mpm_ctx = det_ctx->sgh->mpm_proto_other_ctx;
}
//else {
// printf("packet pattern search");
// exit(0);
// mpm_ctx = det_ctx->sgh->mpm_proto_other_ctx_ts;
// mpm_ctx1 = det_ctx->sgh->mpm_proto_other_ctx_tc;
//}
if (mpm_ctx == NULL)
SCReturnInt(0);
@ -250,13 +224,6 @@ uint32_t PacketPatternSearch(DetectEngineThreadCtx *det_ctx, Packet *p)
&det_ctx->pmq,
p->payload,
p->payload_len);
if (mpm_ctx1 != NULL) {
ret += mpm_table[mpm_ctx1->mpm_type].Search(mpm_ctx1,
&det_ctx->mtc,
&det_ctx->pmq,
p->payload,
p->payload_len);
}
#else
/* if the user has enabled cuda support, but is not using the cuda mpm
* algo, then we shouldn't take the path of the dispatcher. Call the mpm
@ -267,13 +234,6 @@ uint32_t PacketPatternSearch(DetectEngineThreadCtx *det_ctx, Packet *p)
&det_ctx->pmq,
p->payload,
p->payload_len);
if (mpm_ctx1 != NULL) {
ret += mpm_table[mpm_ctx1->mpm_type].Search(mpm_ctx1,
&det_ctx->mtc,
&det_ctx->pmq,
p->payload,
p->payload_len);
}
SCReturnInt(ret);
}
@ -286,13 +246,6 @@ uint32_t PacketPatternSearch(DetectEngineThreadCtx *det_ctx, Packet *p)
&det_ctx->pmq,
p->payload,
p->payload_len);
if (mpm_ctx1 != NULL) {
ret = mpm_table[mpm_ctx1->mpm_type].Search(mpm_ctx1,
&det_ctx->mtc,
&det_ctx->pmq,
p->payload,
p->payload_len);
}
}
#endif
@ -319,7 +272,7 @@ uint32_t UriPatternSearch(DetectEngineThreadCtx *det_ctx,
ret = mpm_table[det_ctx->sgh->mpm_uri_ctx_ts->mpm_type].
Search(det_ctx->sgh->mpm_uri_ctx_ts,
&det_ctx->mtcu, &det_ctx->pmq, uri, uri_len);
} else { //if (flags & STREAM_TOCLIENT) {
} else {
if (det_ctx->sgh->mpm_uri_ctx_tc == NULL)
SCReturnUInt(0U);
@ -327,24 +280,9 @@ uint32_t UriPatternSearch(DetectEngineThreadCtx *det_ctx,
Search(det_ctx->sgh->mpm_uri_ctx_tc,
&det_ctx->mtcu, &det_ctx->pmq, uri, uri_len);
}
//else {
// printf("uri pattern search");
// exit(0);
// if (det_ctx->sgh->mpm_uri_ctx_ts != NULL) {
// ret = mpm_table[det_ctx->sgh->mpm_uri_ctx_ts->mpm_type].
// Search(det_ctx->sgh->mpm_uri_ctx_ts,
// &det_ctx->mtcu, &det_ctx->pmq, uri, uri_len);
// }
// if (det_ctx->sgh->mpm_uri_ctx_tc != NULL) {
// ret += mpm_table[det_ctx->sgh->mpm_uri_ctx_tc->mpm_type].
// Search(det_ctx->sgh->mpm_uri_ctx_tc,
// &det_ctx->mtcu, &det_ctx->pmq, uri, uri_len);
// }
//}
//PrintRawDataFp(stdout, uri, uri_len);
SCReturnUInt(ret);
}
@ -370,7 +308,7 @@ uint32_t HttpClientBodyPatternSearch(DetectEngineThreadCtx *det_ctx,
ret = mpm_table[det_ctx->sgh->mpm_hcbd_ctx_ts->mpm_type].
Search(det_ctx->sgh->mpm_hcbd_ctx_ts, &det_ctx->mtcu,
&det_ctx->pmq, body, body_len);
} else { //if (flags & STREAM_TOCLIENT) {
} else {
if (det_ctx->sgh->mpm_hcbd_ctx_tc == NULL)
SCReturnUInt(0);
@ -378,20 +316,6 @@ uint32_t HttpClientBodyPatternSearch(DetectEngineThreadCtx *det_ctx,
Search(det_ctx->sgh->mpm_hcbd_ctx_tc, &det_ctx->mtcu,
&det_ctx->pmq, body, body_len);
}
//else {
// printf("hcbd pattern search");
// exit(0);
// if (det_ctx->sgh->mpm_hcbd_ctx_ts != NULL) {
// ret = mpm_table[det_ctx->sgh->mpm_hcbd_ctx_ts->mpm_type].
// Search(det_ctx->sgh->mpm_hcbd_ctx_ts, &det_ctx->mtcu,
// &det_ctx->pmq, body, body_len);
// }
// if (det_ctx->sgh->mpm_hcbd_ctx_tc != NULL) {
// ret += mpm_table[det_ctx->sgh->mpm_hcbd_ctx_tc->mpm_type].
// Search(det_ctx->sgh->mpm_hcbd_ctx_tc, &det_ctx->mtcu,
// &det_ctx->pmq, body, body_len);
// }
//}
SCReturnUInt(ret);
}
@ -418,7 +342,7 @@ uint32_t HttpServerBodyPatternSearch(DetectEngineThreadCtx *det_ctx,
ret = mpm_table[det_ctx->sgh->mpm_hsbd_ctx_ts->mpm_type].
Search(det_ctx->sgh->mpm_hsbd_ctx_ts, &det_ctx->mtcu,
&det_ctx->pmq, body, body_len);
} else { //if (flags & STREAM_TOCLIENT) {
} else {
if (det_ctx->sgh->mpm_hsbd_ctx_tc == NULL)
SCReturnUInt(0);
@ -426,20 +350,6 @@ uint32_t HttpServerBodyPatternSearch(DetectEngineThreadCtx *det_ctx,
Search(det_ctx->sgh->mpm_hsbd_ctx_tc, &det_ctx->mtcu,
&det_ctx->pmq, body, body_len);
}
//else {
// printf("hsbd pattern search");
// exit(0);
// if (det_ctx->sgh->mpm_hsbd_ctx_ts != NULL) {
// ret = mpm_table[det_ctx->sgh->mpm_hsbd_ctx_ts->mpm_type].
// Search(det_ctx->sgh->mpm_hsbd_ctx_ts, &det_ctx->mtcu,
// &det_ctx->pmq, body, body_len);
// }
// if (det_ctx->sgh->mpm_hsbd_ctx_tc != NULL) {
// ret += mpm_table[det_ctx->sgh->mpm_hsbd_ctx_tc->mpm_type].
// Search(det_ctx->sgh->mpm_hsbd_ctx_tc, &det_ctx->mtcu,
// &det_ctx->pmq, body, body_len);
// }
//}
SCReturnUInt(ret);
}
@ -466,7 +376,7 @@ uint32_t HttpHeaderPatternSearch(DetectEngineThreadCtx *det_ctx,
ret = mpm_table[det_ctx->sgh->mpm_hhd_ctx_ts->mpm_type].
Search(det_ctx->sgh->mpm_hhd_ctx_ts, &det_ctx->mtcu,
&det_ctx->pmq, headers, headers_len);
} else { //if (flags & STREAM_TOCLIENT) {
} else {
if (det_ctx->sgh->mpm_hhd_ctx_tc == NULL)
SCReturnUInt(0);
@ -474,20 +384,6 @@ uint32_t HttpHeaderPatternSearch(DetectEngineThreadCtx *det_ctx,
Search(det_ctx->sgh->mpm_hhd_ctx_tc, &det_ctx->mtcu,
&det_ctx->pmq, headers, headers_len);
}
//else {
// printf("hhd pattern search");
// exit(0);
// if (det_ctx->sgh->mpm_hhd_ctx_ts != NULL) {
// ret = mpm_table[det_ctx->sgh->mpm_hhd_ctx_ts->mpm_type].
// Search(det_ctx->sgh->mpm_hhd_ctx_ts, &det_ctx->mtcu,
// &det_ctx->pmq, headers, headers_len);
// }
// if (det_ctx->sgh->mpm_hhd_ctx_tc != NULL) {
// ret += mpm_table[det_ctx->sgh->mpm_hhd_ctx_tc->mpm_type].
// Search(det_ctx->sgh->mpm_hhd_ctx_tc, &det_ctx->mtcu,
// &det_ctx->pmq, headers, headers_len);
// }
//}
SCReturnUInt(ret);
}
@ -514,7 +410,7 @@ uint32_t HttpRawHeaderPatternSearch(DetectEngineThreadCtx *det_ctx,
ret = mpm_table[det_ctx->sgh->mpm_hrhd_ctx_ts->mpm_type].
Search(det_ctx->sgh->mpm_hrhd_ctx_ts, &det_ctx->mtcu,
&det_ctx->pmq, raw_headers, raw_headers_len);
} else { //if (flags & STREAM_TOCLIENT) {
} else {
if (det_ctx->sgh->mpm_hrhd_ctx_tc == NULL)
SCReturnUInt(0);
@ -522,20 +418,6 @@ uint32_t HttpRawHeaderPatternSearch(DetectEngineThreadCtx *det_ctx,
Search(det_ctx->sgh->mpm_hrhd_ctx_tc, &det_ctx->mtcu,
&det_ctx->pmq, raw_headers, raw_headers_len);
}
//else {
// printf("hrhd pattern search");
// exit(0);
// if (det_ctx->sgh->mpm_hrhd_ctx_ts != NULL) {
// ret = mpm_table[det_ctx->sgh->mpm_hrhd_ctx_ts->mpm_type].
// Search(det_ctx->sgh->mpm_hrhd_ctx_ts, &det_ctx->mtcu,
// &det_ctx->pmq, raw_headers, raw_headers_len);
// }
// if (det_ctx->sgh->mpm_hrhd_ctx_tc != NULL) {
// ret += mpm_table[det_ctx->sgh->mpm_hrhd_ctx_tc->mpm_type].
// Search(det_ctx->sgh->mpm_hrhd_ctx_tc, &det_ctx->mtcu,
// &det_ctx->pmq, raw_headers, raw_headers_len);
// }
//}
SCReturnUInt(ret);
}
@ -562,7 +444,7 @@ uint32_t HttpMethodPatternSearch(DetectEngineThreadCtx *det_ctx,
ret = mpm_table[det_ctx->sgh->mpm_hmd_ctx_ts->mpm_type].
Search(det_ctx->sgh->mpm_hmd_ctx_ts, &det_ctx->mtcu,
&det_ctx->pmq, raw_method, raw_method_len);
} else { //if (flags & STREAM_TOCLIENT) {
} else {
if (det_ctx->sgh->mpm_hmd_ctx_tc == NULL)
SCReturnUInt(0);
@ -570,20 +452,6 @@ uint32_t HttpMethodPatternSearch(DetectEngineThreadCtx *det_ctx,
Search(det_ctx->sgh->mpm_hmd_ctx_tc, &det_ctx->mtcu,
&det_ctx->pmq, raw_method, raw_method_len);
}
//else {
// printf("hmd pattern search");
// exit(0);
// if (det_ctx->sgh->mpm_hmd_ctx_ts != NULL) {
// ret = mpm_table[det_ctx->sgh->mpm_hmd_ctx_ts->mpm_type].
// Search(det_ctx->sgh->mpm_hmd_ctx_ts, &det_ctx->mtcu,
// &det_ctx->pmq, raw_method, raw_method_len);
// }
// if (det_ctx->sgh->mpm_hmd_ctx_tc != NULL) {
// ret += mpm_table[det_ctx->sgh->mpm_hmd_ctx_tc->mpm_type].
// Search(det_ctx->sgh->mpm_hmd_ctx_tc, &det_ctx->mtcu,
// &det_ctx->pmq, raw_method, raw_method_len);
// }
//}
SCReturnUInt(ret);
}
@ -610,7 +478,7 @@ uint32_t HttpCookiePatternSearch(DetectEngineThreadCtx *det_ctx,
ret = mpm_table[det_ctx->sgh->mpm_hcd_ctx_ts->mpm_type].
Search(det_ctx->sgh->mpm_hcd_ctx_ts, &det_ctx->mtcu,
&det_ctx->pmq, cookie, cookie_len);
} else { //if (flags & STREAM_TOCLIENT) {
} else {
if (det_ctx->sgh->mpm_hcd_ctx_tc == NULL)
SCReturnUInt(0);
@ -618,20 +486,6 @@ uint32_t HttpCookiePatternSearch(DetectEngineThreadCtx *det_ctx,
Search(det_ctx->sgh->mpm_hcd_ctx_tc, &det_ctx->mtcu,
&det_ctx->pmq, cookie, cookie_len);
}
//else {
// printf("hcd pattern search");
// exit(0);
// if (det_ctx->sgh->mpm_hcd_ctx_ts != NULL) {
// ret = mpm_table[det_ctx->sgh->mpm_hcd_ctx_ts->mpm_type].
// Search(det_ctx->sgh->mpm_hcd_ctx_ts, &det_ctx->mtcu,
// &det_ctx->pmq, cookie, cookie_len);
// }
// if (det_ctx->sgh->mpm_hcd_ctx_tc != NULL) {
// ret += mpm_table[det_ctx->sgh->mpm_hcd_ctx_tc->mpm_type].
// Search(det_ctx->sgh->mpm_hcd_ctx_tc, &det_ctx->mtcu,
// &det_ctx->pmq, cookie, cookie_len);
// }
//}
SCReturnUInt(ret);
}
@ -658,7 +512,7 @@ uint32_t HttpRawUriPatternSearch(DetectEngineThreadCtx *det_ctx,
ret = mpm_table[det_ctx->sgh->mpm_hrud_ctx_ts->mpm_type].
Search(det_ctx->sgh->mpm_hrud_ctx_ts, &det_ctx->mtcu,
&det_ctx->pmq, uri, uri_len);
} else { //if (flags & STREAM_TOCLIENT) {
} else {
if (det_ctx->sgh->mpm_hrud_ctx_tc == NULL)
SCReturnUInt(0);
@ -666,20 +520,6 @@ uint32_t HttpRawUriPatternSearch(DetectEngineThreadCtx *det_ctx,
Search(det_ctx->sgh->mpm_hrud_ctx_tc, &det_ctx->mtcu,
&det_ctx->pmq, uri, uri_len);
}
//else {
// printf("hrud pattern search");
// exit(0);
// if (det_ctx->sgh->mpm_hrud_ctx_ts == NULL) {
// ret = mpm_table[det_ctx->sgh->mpm_hrud_ctx_ts->mpm_type].
// Search(det_ctx->sgh->mpm_hrud_ctx_ts, &det_ctx->mtcu,
// &det_ctx->pmq, uri, uri_len);
// }
// if (det_ctx->sgh->mpm_hrud_ctx_tc == NULL) {
// ret += mpm_table[det_ctx->sgh->mpm_hrud_ctx_tc->mpm_type].
// Search(det_ctx->sgh->mpm_hrud_ctx_tc, &det_ctx->mtcu,
// &det_ctx->pmq, uri, uri_len);
// }
//}
SCReturnUInt(ret);
}
@ -721,7 +561,7 @@ uint32_t StreamPatternSearch(DetectEngineThreadCtx *det_ctx, Packet *p,
cnt++;
}
} else { //if (flags & STREAM_TOCLIENT) {
} else {
for ( ; smsg != NULL; smsg = smsg->next) {
r = mpm_table[det_ctx->sgh->mpm_stream_ctx_tc->mpm_type].
Search(det_ctx->sgh->mpm_stream_ctx_tc, &det_ctx->mtcs,
@ -739,29 +579,6 @@ uint32_t StreamPatternSearch(DetectEngineThreadCtx *det_ctx, Packet *p,
cnt++;
}
}
//else {
// printf("stream pattern search");
// exit(0);
// for ( ; smsg != NULL; smsg = smsg->next) {
// r = mpm_table[det_ctx->sgh->mpm_stream_ctx_ts->mpm_type].
// Search(det_ctx->sgh->mpm_stream_ctx_ts, &det_ctx->mtcs,
// &det_ctx->smsg_pmq[cnt], smsg->data.data,
// smsg->data.data_len);
// r += mpm_table[det_ctx->sgh->mpm_stream_ctx_tc->mpm_type].
// Search(det_ctx->sgh->mpm_stream_ctx_tc, &det_ctx->mtcs,
// &det_ctx->smsg_pmq[cnt], smsg->data.data,
// smsg->data.data_len);
// if (r > 0) {
// ret += r;
//
// SCLogDebug("smsg match stored in det_ctx->smsg_pmq[%u]", cnt);
//
// /* merge results with overall pmq */
// PmqMerge(&det_ctx->smsg_pmq[cnt], &det_ctx->pmq);
// }
// } /* for */
//
//} /* else */
SCReturnInt(ret);
}

209
src/detect.c
Unescape Escape View File

@ -3183,43 +3183,70 @@ int BuildDestinationAddressHeads(DetectEngineCtx *de_ctx, DetectAddressHead *hea
printf("PatternMatchPrepareGroup failed\n");
goto error;
}
//if (sgr->sh->mpm_proto_tcp_ctx != NULL) {
// if (de_ctx->mpm_max_patcnt < sgr->sh->mpm_proto_tcp_ctx->pattern_cnt)
// de_ctx->mpm_max_patcnt = sgr->sh->mpm_proto_tcp_ctx->pattern_cnt;
//
// de_ctx->mpm_tot_patcnt += sgr->sh->mpm_proto_tcp_ctx->pattern_cnt;
//}
//if (sgr->sh->mpm_proto_udp_ctx != NULL) {
// if (de_ctx->mpm_max_patcnt < sgr->sh->mpm_proto_udp_ctx->pattern_cnt)
// de_ctx->mpm_max_patcnt = sgr->sh->mpm_proto_udp_ctx->pattern_cnt;
//
// de_ctx->mpm_tot_patcnt += sgr->sh->mpm_proto_udp_ctx->pattern_cnt;
//}
//if (sgr->sh->mpm_proto_other_ctx != NULL) {
// if (de_ctx->mpm_max_patcnt < sgr->sh->mpm_proto_other_ctx->pattern_cnt)
// de_ctx->mpm_max_patcnt = sgr->sh->mpm_proto_other_ctx->pattern_cnt;
//
// de_ctx->mpm_tot_patcnt += sgr->sh->mpm_proto_other_ctx->pattern_cnt;
//}
//if (sgr->sh->mpm_uri_ctx != NULL) {
// if (de_ctx->mpm_uri_max_patcnt < sgr->sh->mpm_uri_ctx->pattern_cnt)
// de_ctx->mpm_uri_max_patcnt = sgr->sh->mpm_uri_ctx->pattern_cnt;
//
// de_ctx->mpm_uri_tot_patcnt += sgr->sh->mpm_uri_ctx->pattern_cnt;
//}
///* dbg */
//if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && sgr->sh->mpm_proto_tcp_ctx) {
// de_ctx->mpm_memory_size += sgr->sh->mpm_proto_tcp_ctx->memory_size;
//}
//if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && sgr->sh->mpm_proto_udp_ctx) {
// de_ctx->mpm_memory_size += sgr->sh->mpm_proto_udp_ctx->memory_size;
//}
//if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && sgr->sh->mpm_proto_other_ctx) {
// de_ctx->mpm_memory_size += sgr->sh->mpm_proto_other_ctx->memory_size;
//}
//if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY) && sgr->sh->mpm_uri_ctx) {
// de_ctx->mpm_memory_size += sgr->sh->mpm_uri_ctx->memory_size;
//}
if (sgr->sh->mpm_proto_tcp_ctx_ts != NULL) {
if (de_ctx->mpm_max_patcnt < sgr->sh->mpm_proto_tcp_ctx_ts->pattern_cnt)
de_ctx->mpm_max_patcnt = sgr->sh->mpm_proto_tcp_ctx_ts->pattern_cnt;
de_ctx->mpm_tot_patcnt += sgr->sh->mpm_proto_tcp_ctx_ts->pattern_cnt;
}
if (sgr->sh->mpm_proto_tcp_ctx_tc != NULL) {
if (de_ctx->mpm_max_patcnt < sgr->sh->mpm_proto_tcp_ctx_tc->pattern_cnt)
de_ctx->mpm_max_patcnt = sgr->sh->mpm_proto_tcp_ctx_tc->pattern_cnt;
de_ctx->mpm_tot_patcnt += sgr->sh->mpm_proto_tcp_ctx_tc->pattern_cnt;
}
if (sgr->sh->mpm_proto_udp_ctx_ts != NULL) {
if (de_ctx->mpm_max_patcnt < sgr->sh->mpm_proto_udp_ctx_ts->pattern_cnt)
de_ctx->mpm_max_patcnt = sgr->sh->mpm_proto_udp_ctx_ts->pattern_cnt;
de_ctx->mpm_tot_patcnt += sgr->sh->mpm_proto_udp_ctx_ts->pattern_cnt;
}
if (sgr->sh->mpm_proto_udp_ctx_tc != NULL) {
if (de_ctx->mpm_max_patcnt < sgr->sh->mpm_proto_udp_ctx_tc->pattern_cnt)
de_ctx->mpm_max_patcnt = sgr->sh->mpm_proto_udp_ctx_tc->pattern_cnt;
de_ctx->mpm_tot_patcnt += sgr->sh->mpm_proto_udp_ctx_tc->pattern_cnt;
}
if (sgr->sh->mpm_proto_other_ctx != NULL) {
if (de_ctx->mpm_max_patcnt < sgr->sh->mpm_proto_other_ctx->pattern_cnt)
de_ctx->mpm_max_patcnt = sgr->sh->mpm_proto_other_ctx->pattern_cnt;
de_ctx->mpm_tot_patcnt += sgr->sh->mpm_proto_other_ctx->pattern_cnt;
}
if (sgr->sh->mpm_uri_ctx_ts != NULL) {
if (de_ctx->mpm_uri_max_patcnt < sgr->sh->mpm_uri_ctx_ts->pattern_cnt)
de_ctx->mpm_uri_max_patcnt = sgr->sh->mpm_uri_ctx_ts->pattern_cnt;
de_ctx->mpm_uri_tot_patcnt += sgr->sh->mpm_uri_ctx_ts->pattern_cnt;
}
if (sgr->sh->mpm_uri_ctx_tc != NULL) {
if (de_ctx->mpm_uri_max_patcnt < sgr->sh->mpm_uri_ctx_tc->pattern_cnt)
de_ctx->mpm_uri_max_patcnt = sgr->sh->mpm_uri_ctx_tc->pattern_cnt;
de_ctx->mpm_uri_tot_patcnt += sgr->sh->mpm_uri_ctx_tc->pattern_cnt;
}
/* dbg */
if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && sgr->sh->mpm_proto_tcp_ctx_ts) {
de_ctx->mpm_memory_size += sgr->sh->mpm_proto_tcp_ctx_ts->memory_size;
}
if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && sgr->sh->mpm_proto_tcp_ctx_tc) {
de_ctx->mpm_memory_size += sgr->sh->mpm_proto_tcp_ctx_tc->memory_size;
}
if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && sgr->sh->mpm_proto_udp_ctx_ts) {
de_ctx->mpm_memory_size += sgr->sh->mpm_proto_udp_ctx_ts->memory_size;
}
if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && sgr->sh->mpm_proto_udp_ctx_tc) {
de_ctx->mpm_memory_size += sgr->sh->mpm_proto_udp_ctx_tc->memory_size;
}
if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && sgr->sh->mpm_proto_other_ctx) {
de_ctx->mpm_memory_size += sgr->sh->mpm_proto_other_ctx->memory_size;
}
if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY) && sgr->sh->mpm_uri_ctx_ts) {
de_ctx->mpm_memory_size += sgr->sh->mpm_uri_ctx_ts->memory_size;
}
if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY) && sgr->sh->mpm_uri_ctx_tc) {
de_ctx->mpm_memory_size += sgr->sh->mpm_uri_ctx_tc->memory_size;
}
SigGroupHeadHashAdd(de_ctx, sgr->sh);
SigGroupHeadStore(de_ctx, sgr->sh);
@ -3452,43 +3479,70 @@ int BuildDestinationAddressHeadsWithBothPorts(DetectEngineCtx *de_ctx, DetectAdd
printf("PatternMatchPrepareGroup failed\n");
goto error;
}
//if (dp->sh->mpm_proto_tcp_ctx != NULL) {
// if (de_ctx->mpm_max_patcnt < dp->sh->mpm_proto_tcp_ctx->pattern_cnt)
// de_ctx->mpm_max_patcnt = dp->sh->mpm_proto_tcp_ctx->pattern_cnt;
//
// de_ctx->mpm_tot_patcnt += dp->sh->mpm_proto_tcp_ctx->pattern_cnt;
//}
//if (dp->sh->mpm_proto_udp_ctx != NULL) {
// if (de_ctx->mpm_max_patcnt < dp->sh->mpm_proto_udp_ctx->pattern_cnt)
// de_ctx->mpm_max_patcnt = dp->sh->mpm_proto_udp_ctx->pattern_cnt;
//
// de_ctx->mpm_tot_patcnt += dp->sh->mpm_proto_udp_ctx->pattern_cnt;
//}
//if (dp->sh->mpm_proto_other_ctx != NULL) {
// if (de_ctx->mpm_max_patcnt < dp->sh->mpm_proto_other_ctx->pattern_cnt)
// de_ctx->mpm_max_patcnt = dp->sh->mpm_proto_other_ctx->pattern_cnt;
//
// de_ctx->mpm_tot_patcnt += dp->sh->mpm_proto_other_ctx->pattern_cnt;
//}
//if (dp->sh->mpm_uri_ctx != NULL) {
// if (de_ctx->mpm_uri_max_patcnt < dp->sh->mpm_uri_ctx->pattern_cnt)
// de_ctx->mpm_uri_max_patcnt = dp->sh->mpm_uri_ctx->pattern_cnt;
//
// de_ctx->mpm_uri_tot_patcnt += dp->sh->mpm_uri_ctx->pattern_cnt;
//}
///* dbg */
//if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && dp->sh->mpm_proto_tcp_ctx) {
// de_ctx->mpm_memory_size += dp->sh->mpm_proto_tcp_ctx->memory_size;
//}
//if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && dp->sh->mpm_proto_udp_ctx) {
// de_ctx->mpm_memory_size += dp->sh->mpm_proto_udp_ctx->memory_size;
//}
//if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && dp->sh->mpm_proto_other_ctx) {
// de_ctx->mpm_memory_size += dp->sh->mpm_proto_other_ctx->memory_size;
//}
//if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY) && dp->sh->mpm_uri_ctx) {
// de_ctx->mpm_memory_size += dp->sh->mpm_uri_ctx->memory_size;
//}
if (dp->sh->mpm_proto_tcp_ctx_ts != NULL) {
if (de_ctx->mpm_max_patcnt < dp->sh->mpm_proto_tcp_ctx_ts->pattern_cnt)
de_ctx->mpm_max_patcnt = dp->sh->mpm_proto_tcp_ctx_ts->pattern_cnt;
de_ctx->mpm_tot_patcnt += dp->sh->mpm_proto_tcp_ctx_ts->pattern_cnt;
}
if (dp->sh->mpm_proto_tcp_ctx_tc != NULL) {
if (de_ctx->mpm_max_patcnt < dp->sh->mpm_proto_tcp_ctx_tc->pattern_cnt)
de_ctx->mpm_max_patcnt = dp->sh->mpm_proto_tcp_ctx_tc->pattern_cnt;
de_ctx->mpm_tot_patcnt += dp->sh->mpm_proto_tcp_ctx_tc->pattern_cnt;
}
if (dp->sh->mpm_proto_udp_ctx_ts != NULL) {
if (de_ctx->mpm_max_patcnt < dp->sh->mpm_proto_udp_ctx_ts->pattern_cnt)
de_ctx->mpm_max_patcnt = dp->sh->mpm_proto_udp_ctx_ts->pattern_cnt;
de_ctx->mpm_tot_patcnt += dp->sh->mpm_proto_udp_ctx_ts->pattern_cnt;
}
if (dp->sh->mpm_proto_udp_ctx_tc != NULL) {
if (de_ctx->mpm_max_patcnt < dp->sh->mpm_proto_udp_ctx_tc->pattern_cnt)
de_ctx->mpm_max_patcnt = dp->sh->mpm_proto_udp_ctx_tc->pattern_cnt;
de_ctx->mpm_tot_patcnt += dp->sh->mpm_proto_udp_ctx_tc->pattern_cnt;
}
if (dp->sh->mpm_proto_other_ctx != NULL) {
if (de_ctx->mpm_max_patcnt < dp->sh->mpm_proto_other_ctx->pattern_cnt)
de_ctx->mpm_max_patcnt = dp->sh->mpm_proto_other_ctx->pattern_cnt;
de_ctx->mpm_tot_patcnt += dp->sh->mpm_proto_other_ctx->pattern_cnt;
}
if (dp->sh->mpm_uri_ctx_ts != NULL) {
if (de_ctx->mpm_uri_max_patcnt < dp->sh->mpm_uri_ctx_ts->pattern_cnt)
de_ctx->mpm_uri_max_patcnt = dp->sh->mpm_uri_ctx_ts->pattern_cnt;
de_ctx->mpm_uri_tot_patcnt += dp->sh->mpm_uri_ctx_ts->pattern_cnt;
}
if (dp->sh->mpm_uri_ctx_tc != NULL) {
if (de_ctx->mpm_uri_max_patcnt < dp->sh->mpm_uri_ctx_tc->pattern_cnt)
de_ctx->mpm_uri_max_patcnt = dp->sh->mpm_uri_ctx_tc->pattern_cnt;
de_ctx->mpm_uri_tot_patcnt += dp->sh->mpm_uri_ctx_tc->pattern_cnt;
}
/* dbg */
if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && dp->sh->mpm_proto_tcp_ctx_ts) {
de_ctx->mpm_memory_size += dp->sh->mpm_proto_tcp_ctx_ts->memory_size;
}
if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && dp->sh->mpm_proto_tcp_ctx_tc) {
de_ctx->mpm_memory_size += dp->sh->mpm_proto_tcp_ctx_tc->memory_size;
}
if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && dp->sh->mpm_proto_udp_ctx_ts) {
de_ctx->mpm_memory_size += dp->sh->mpm_proto_udp_ctx_ts->memory_size;
}
if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && dp->sh->mpm_proto_udp_ctx_tc) {
de_ctx->mpm_memory_size += dp->sh->mpm_proto_udp_ctx_tc->memory_size;
}
if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && dp->sh->mpm_proto_other_ctx) {
de_ctx->mpm_memory_size += dp->sh->mpm_proto_other_ctx->memory_size;
}
if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY) && dp->sh->mpm_uri_ctx_ts) {
de_ctx->mpm_memory_size += dp->sh->mpm_uri_ctx_ts->memory_size;
}
if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY) && dp->sh->mpm_uri_ctx_tc) {
de_ctx->mpm_memory_size += dp->sh->mpm_uri_ctx_tc->memory_size;
}
SigGroupHeadDPortHashAdd(de_ctx, dp->sh);
SigGroupHeadStore(de_ctx, dp->sh);
@ -3883,13 +3937,6 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) {
for ( ; dp != NULL; dp = dp->next) {
printf(" 4 Dst port(range): "); DetectPortPrint(dp);
printf(" (sigs %" PRIu32 ", sgh %p, maxlen %" PRIu32 ")", dp->sh->sig_cnt, dp->sh, dp->sh->mpm_content_maxlen);
//printf(" mpm_proto_tcp_ctx %p, mpm_prooto_udp_ctx "
// "%p, mpm_proto_other_ctx %p mpm_stream_ctx "
// "%p",
// dp->sh->mpm_proto_tcp_ctx,
// dp->sh->mpm_proto_udp_ctx,
// dp->sh->mpm_proto_other_ctx,
// dp->sh->mpm_stream_ctx);
#ifdef PRINTSIGS
printf(" - ");
for (u = 0; u < dp->sh->sig_cnt; u++) {

Write Preview
Loading…
Cancel
Save