Minor fixes against the last set of patches for #564, 565, 581 + fp automation.

Rename struct DetectFigureFPAndId_t_ to DetectFPAndItsId_ and move it's
definition from inside the function where it's used to the global namespace,
as requested on #suricata.

Rename DetectEngineContentModifiedBufferSetup to DetectEngineContentModifierBufferSetup.

Also rename DetectFigureFPAndId() to DetectSetFastPatternAndItsId().

Updated DetectSetFastPatternAndItsId() to not exit on failure and return error.
pull/326/merge
Anoop Saldanha 14 years ago committed by Victor Julien
parent 6de8b1ed53
commit a3212f6a0f

@ -3346,17 +3346,26 @@ uint32_t DetectPatternGetIdV2(MpmPatternIdStore *ht, void *ctx, Signature *s, ui
SCReturnUInt(id); SCReturnUInt(id);
} }
void DetectFigureFPAndId(DetectEngineCtx *de_ctx) typedef struct DetectFPAndItsId_ {
{ PatIntId id;
typedef struct DetectFigureFPAndId_t_ { uint16_t content_len;
PatIntId id; uint32_t flags;
uint16_t content_len; int sm_list;
uint32_t flags;
int sm_list;
uint8_t *content; uint8_t *content;
} DetectFigureFPAndId_t; } DetectFPAndItsId;
/**
* \brief Figured out the FP and their respective content ids for all the
* sigs in the engine.
*
* \param de_ctx Detection engine context.
*
* \retval 0 On success.
* \retval -1 On failure.
*/
int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx)
{
uint32_t struct_total_size = 0; uint32_t struct_total_size = 0;
uint32_t content_total_size = 0; uint32_t content_total_size = 0;
Signature *s = NULL; Signature *s = NULL;
@ -3365,7 +3374,7 @@ void DetectFigureFPAndId(DetectEngineCtx *de_ctx)
s->mpm_sm = RetrieveFPForSigV2(s); s->mpm_sm = RetrieveFPForSigV2(s);
if (s->mpm_sm != NULL) { if (s->mpm_sm != NULL) {
DetectContentData *cd = (DetectContentData *)s->mpm_sm->ctx; DetectContentData *cd = (DetectContentData *)s->mpm_sm->ctx;
struct_total_size += sizeof(DetectFigureFPAndId_t); struct_total_size += sizeof(DetectFPAndItsId);
content_total_size += cd->content_len; content_total_size += cd->content_len;
} }
} }
@ -3373,17 +3382,17 @@ void DetectFigureFPAndId(DetectEngineCtx *de_ctx)
/* array hash buffer - i've run out of ideas to name it */ /* array hash buffer - i've run out of ideas to name it */
uint8_t *ahb = SCMalloc(sizeof(uint8_t) * (struct_total_size + content_total_size)); uint8_t *ahb = SCMalloc(sizeof(uint8_t) * (struct_total_size + content_total_size));
if (ahb == NULL) if (ahb == NULL)
exit(EXIT_FAILURE); return -1;
PatIntId max_id = 0; PatIntId max_id = 0;
DetectFigureFPAndId_t *struct_offset = (DetectFigureFPAndId_t *)ahb; DetectFPAndItsId *struct_offset = (DetectFPAndItsId *)ahb;
uint8_t *content_offset = ahb + struct_total_size; uint8_t *content_offset = ahb + struct_total_size;
for (s = de_ctx->sig_list; s != NULL; s = s->next) { for (s = de_ctx->sig_list; s != NULL; s = s->next) {
if (s->mpm_sm != NULL) { if (s->mpm_sm != NULL) {
int sm_list = SigMatchListSMBelongsTo(s, s->mpm_sm); int sm_list = SigMatchListSMBelongsTo(s, s->mpm_sm);
BUG_ON(sm_list == -1); BUG_ON(sm_list == -1);
DetectContentData *cd = (DetectContentData *)s->mpm_sm->ctx; DetectContentData *cd = (DetectContentData *)s->mpm_sm->ctx;
DetectFigureFPAndId_t *dup = (DetectFigureFPAndId_t *)ahb; DetectFPAndItsId *dup = (DetectFPAndItsId *)ahb;
for (; dup != struct_offset; dup++) { for (; dup != struct_offset; dup++) {
if (dup->content_len != cd->content_len || if (dup->content_len != cd->content_len ||
dup->sm_list != sm_list || dup->sm_list != sm_list ||
@ -3413,5 +3422,5 @@ void DetectFigureFPAndId(DetectEngineCtx *de_ctx)
de_ctx->max_fp_id = max_id; de_ctx->max_fp_id = max_id;
SCFree(ahb); SCFree(ahb);
return; return 0;
} }

@ -85,7 +85,16 @@ int SignatureHasStreamContent(Signature *);
SigMatch *RetrieveFPForSig(Signature *s); SigMatch *RetrieveFPForSig(Signature *s);
SigMatch *RetrieveFPForSigV2(Signature *s); SigMatch *RetrieveFPForSigV2(Signature *s);
void DetectFigureFPAndId(DetectEngineCtx *de_ctx); /**
* \brief Figured out the FP and their respective content ids for all the
* sigs in the engine.
*
* \param de_ctx Detection engine context.
*
* \retval 0 On success.
* \retval -1 On failure.
*/
int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx);
#endif /* __DETECT_ENGINE_MPM_H__ */ #endif /* __DETECT_ENGINE_MPM_H__ */

@ -473,7 +473,8 @@ int SigLoadSignatures(DetectEngineCtx *de_ctx, char *sig_file, int sig_file_excl
} }
/* Setup the signature group lookup structure and pattern matchers */ /* Setup the signature group lookup structure and pattern matchers */
SigGroupBuild(de_ctx); if (SigGroupBuild(de_ctx) < 0)
goto end;
ret = 0; ret = 0;
@ -4379,11 +4380,13 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) {
* \param de_ctx Pointer to the Detection Engine Context whose Signatures have * \param de_ctx Pointer to the Detection Engine Context whose Signatures have
* to be processed * to be processed
* *
* \retval 0 Always * \retval 0 On Success.
* \retval -1 On failure.
*/ */
int SigGroupBuild(DetectEngineCtx *de_ctx) int SigGroupBuild(DetectEngineCtx *de_ctx)
{ {
DetectFigureFPAndId(de_ctx); if (DetectSetFastPatternAndItsId(de_ctx) < 0)
return -1;
/* if we are using single sgh_mpm_context then let us init the standard mpm /* if we are using single sgh_mpm_context then let us init the standard mpm
* contexts using the mpm_ctx factory */ * contexts using the mpm_ctx factory */

Loading…
Cancel
Save