From a372c1d14ef77667ec5062200d3bb408ec1ba330 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Thu, 6 May 2010 21:14:13 +0200 Subject: [PATCH] Fix/workaround a strange detection issue. --- src/decode.h | 3 ++- src/detect-engine-address.c | 2 ++ src/detect-engine-alert.c | 10 ++++++---- src/detect-engine-mpm.c | 1 - src/detect-engine-port.c | 2 ++ src/detect.c | 18 ++++++++++-------- src/detect.h | 2 ++ src/util-action.c | 32 ++++++++++++++++---------------- src/util-mpm.c | 3 +++ 9 files changed, 43 insertions(+), 30 deletions(-) diff --git a/src/decode.h b/src/decode.h index 53cae2ca61..ff0b1ab2b8 100644 --- a/src/decode.h +++ b/src/decode.h @@ -186,7 +186,8 @@ typedef uint16_t Port; /* structure to store the sids/gids/etc the detection engine * found in this packet */ typedef struct PacketAlert_ { - uint16_t num; /* Internal num, used for sorting */ + SigIntId num; /* Internal num, used for sorting */ + SigIntId order_id; /* Internal num, used for sorting */ uint8_t action; /* Internal num, used for sorting */ uint32_t gid; uint32_t sid; diff --git a/src/detect-engine-address.c b/src/detect-engine-address.c index 793ab9f7ca..84697ee946 100644 --- a/src/detect-engine-address.c +++ b/src/detect-engine-address.c @@ -1492,6 +1492,7 @@ void DetectAddressPrint(DetectAddress *gr) inet_ntop(AF_INET, &in, mask, sizeof(mask)); SCLogDebug("%s/%s", ip, mask); +// printf("%s/%s", ip, mask); } else if (gr->family == AF_INET6) { struct in6_addr in6; char ip[66], mask[66]; @@ -1502,6 +1503,7 @@ void DetectAddressPrint(DetectAddress *gr) inet_ntop(AF_INET6, &in6, mask, sizeof(mask)); SCLogDebug("%s/%s", ip, mask); +// printf("%s/%s", ip, mask); } return; diff --git a/src/detect-engine-alert.c b/src/detect-engine-alert.c index 7a6872e266..8ec66f6f8f 100644 --- a/src/detect-engine-alert.c +++ b/src/detect-engine-alert.c @@ -59,14 +59,15 @@ int PacketAlertAppend(DetectEngineThreadCtx *det_ctx, Signature *s, Packet *p) /* It should be usually the last, so check it before iterating */ if (p->alerts.cnt == 0 || (p->alerts.cnt > 0 && - p->alerts.alerts[p->alerts.cnt - 1].num < s->num)) { + p->alerts.alerts[p->alerts.cnt - 1].order_id < s->order_id)) { /* We just add it */ if (s->gid > 1) p->alerts.alerts[p->alerts.cnt].gid = s->gid; else p->alerts.alerts[p->alerts.cnt].gid = 1; - p->alerts.alerts[p->alerts.cnt].num= s->num; + p->alerts.alerts[p->alerts.cnt].num = s->num; + p->alerts.alerts[p->alerts.cnt].order_id = s->order_id; p->alerts.alerts[p->alerts.cnt].action = s->action; p->alerts.alerts[p->alerts.cnt].sid = s->id; p->alerts.alerts[p->alerts.cnt].rev = s->rev; @@ -77,7 +78,7 @@ int PacketAlertAppend(DetectEngineThreadCtx *det_ctx, Signature *s, Packet *p) } else { /* We need to make room for this s->num (a bit ugly with mamcpy but we are planning changes here)*/ - for (i = p->alerts.cnt - 1; i >= 0 && p->alerts.alerts[i].num > s->num; i--) { + for (i = p->alerts.cnt - 1; i >= 0 && p->alerts.alerts[i].order_id > s->order_id; i--) { memcpy(&p->alerts.alerts[i + 1], &p->alerts.alerts[i], sizeof(PacketAlert)); } @@ -88,7 +89,8 @@ int PacketAlertAppend(DetectEngineThreadCtx *det_ctx, Signature *s, Packet *p) else p->alerts.alerts[i].gid = 1; - p->alerts.alerts[i].num= s->num; + p->alerts.alerts[i].num = s->num; + p->alerts.alerts[i].order_id = s->order_id; p->alerts.alerts[i].action = s->action; p->alerts.alerts[i].sid = s->id; p->alerts.alerts[i].rev = s->rev; diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c index e4becf1e66..b3db5f2fc8 100644 --- a/src/detect-engine-mpm.c +++ b/src/detect-engine-mpm.c @@ -479,7 +479,6 @@ static int PatternMatchPreprarePopulateMpm(DetectEngineCtx *de_ctx, SigGroupHead /* now determine which one to add to the mpm phase */ for (sig = 0; sig < sgh->sig_cnt; sig++) { uint32_t num = sgh->match_array[sig]; - Signature *s = de_ctx->sig_array[num]; if (s == NULL) continue; diff --git a/src/detect-engine-port.c b/src/detect-engine-port.c index 205d86ca20..06952957b8 100644 --- a/src/detect-engine-port.c +++ b/src/detect-engine-port.c @@ -830,8 +830,10 @@ void DetectPortPrint(DetectPort *dp) { if (dp->flags & PORT_FLAG_ANY) { SCLogDebug("=> port %p: ANY", dp); + //printf("ANY"); } else { SCLogDebug("=> port %p %" PRIu32 "-%" PRIu32 "", dp, dp->port, dp->port2); + //printf("%" PRIu32 "-%" PRIu32 "", dp->port, dp->port2); } } diff --git a/src/detect.c b/src/detect.c index ed5823dd65..3601ea6ceb 100644 --- a/src/detect.c +++ b/src/detect.c @@ -392,14 +392,13 @@ int SigLoadSignatures (DetectEngineCtx *de_ctx, char *sig_file) Signature *s = de_ctx->sig_list; - /* Assign the unique id of signatures after sorting, + /* Assign the unique order id of signatures after sorting, * so the IP Only engine process them in order too */ - uint16_t sig_id = 0; + SigIntId sig_id = 0; while (s != NULL) { - s->num = sig_id++; + s->order_id = sig_id++; s = s->next; } - de_ctx->signum = sig_id; /* Setup the signature group lookup structure and pattern matchers */ SigGroupBuild(de_ctx); @@ -792,6 +791,7 @@ end: for (i = 0; i < p->alerts.cnt; i++) { SCLogDebug("Sig->num: %"PRIu16, p->alerts.alerts[i].num); s = de_ctx->sig_array[p->alerts.alerts[i].num]; + int res = PacketAlertHandle(de_ctx, det_ctx, s, p, i); /* Thresholding might remove one alert */ if (res == 0) { @@ -2577,7 +2577,7 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) { for (ds = 0; ds < DSIZE_STATES; ds++) { for (f = 0; f < FLOW_STATES; f++) { for (proto = 0; proto < 256; proto++) { - if (proto != 6) + if (proto != 17) continue; for (global_src_gr = de_ctx->dsize_gh[ds].flow_gh[f].src_gh[proto]->ipv4_head; global_src_gr != NULL; @@ -2596,6 +2596,8 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) { global_dst_gr = global_dst_gr->next) { printf(" 2 Dst Addr: "); DetectAddressPrint(global_dst_gr); + printf("\n"); + //printf(" (sh %p) ", global_dst_gr->sh); if (global_dst_gr->sh) { if (global_dst_gr->sh->flags & ADDRESS_SIGGROUPHEAD_COPY) { @@ -2612,7 +2614,7 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) { DetectPort *dp = sp->dst_ph; for ( ; dp != NULL; dp = dp->next) { printf(" 4 Dst port(range): "); DetectPortPrint(dp); - printf(" (sigs %" PRIu32 ", maxlen %" PRIu32 ")", dp->sh->sig_cnt, dp->sh->mpm_content_maxlen); + printf(" (sigs %" PRIu32 ", sgh %p, maxlen %" PRIu32 ")", dp->sh->sig_cnt, dp->sh, dp->sh->mpm_content_maxlen); #ifdef PRINTSIGS printf(" - "); for (u = 0; u < dp->sh->sig_cnt; u++) { @@ -2656,7 +2658,7 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) { } } } -//#if 0 +#if 0 for (global_src_gr = de_ctx->dsize_gh[ds].flow_gh[f].src_gh[proto]->ipv6_head; global_src_gr != NULL; global_src_gr = global_src_gr->next) { @@ -2835,7 +2837,7 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) { } } } -//#endif +#endif } } } diff --git a/src/detect.h b/src/detect.h index 388a81b90b..25f2180527 100644 --- a/src/detect.h +++ b/src/detect.h @@ -265,6 +265,8 @@ typedef struct Signature_ { /** number of sigmatches in the match and pmatch list */ uint16_t sm_cnt; + + SigIntId order_id; } Signature; typedef struct DetectEngineIPOnlyThreadCtx_ { diff --git a/src/util-action.c b/src/util-action.c index c67267c0a3..afb2239b8b 100644 --- a/src/util-action.c +++ b/src/util-action.c @@ -448,7 +448,7 @@ int UtilActionTest08(void) /* Assing the internal id after sorting, so the IP Only engine * process them in order too */ while (s != NULL) { - s->num = sig_id++; + s->order_id = sig_id++; s = s->next; } @@ -531,7 +531,7 @@ int UtilActionTest09(void) /* Assing the internal id after sorting, so the IP Only engine * process them in order too */ while (s != NULL) { - s->num = sig_id++; + s->order_id = sig_id++; s = s->next; } @@ -613,7 +613,7 @@ int UtilActionTest10(void) /* Assing the internal id after sorting, so the IP Only engine * process them in order too */ while (s != NULL) { - s->num = sig_id++; + s->order_id = sig_id++; s = s->next; } @@ -698,7 +698,7 @@ int UtilActionTest11(void) /* Assing the internal id after sorting, so the IP Only engine * process them in order too */ while (s != NULL) { - s->num = sig_id++; + s->order_id = sig_id++; s = s->next; } @@ -776,7 +776,7 @@ int UtilActionTest12(void) /* Assing the internal id after sorting, so the IP Only engine * process them in order too */ while (s != NULL) { - s->num = sig_id++; + s->order_id = sig_id++; s = s->next; } @@ -857,7 +857,7 @@ int UtilActionTest13(void) /* Assing the internal id after sorting, so the IP Only engine * process them in order too */ while (s != NULL) { - s->num = sig_id++; + s->order_id = sig_id++; s = s->next; } @@ -944,7 +944,7 @@ int UtilActionTest14(void) /* Assing the internal id after sorting, so the IP Only engine * process them in order too */ while (s != NULL) { - s->num = sig_id++; + s->order_id = sig_id++; s = s->next; } @@ -1024,7 +1024,7 @@ int UtilActionTest15(void) /* Assing the internal id after sorting, so the IP Only engine * process them in order too */ while (s != NULL) { - s->num = sig_id++; + s->order_id = sig_id++; s = s->next; } @@ -1099,7 +1099,7 @@ int UtilActionTest16(void) /* Assing the internal id after sorting, so the IP Only engine * process them in order too */ while (s != NULL) { - s->num = sig_id++; + s->order_id = sig_id++; s = s->next; } @@ -1174,7 +1174,7 @@ int UtilActionTest17(void) /* Assing the internal id after sorting, so the IP Only engine * process them in order too */ while (s != NULL) { - s->num = sig_id++; + s->order_id = sig_id++; s = s->next; } @@ -1254,7 +1254,7 @@ int UtilActionTest18(void) /* Assing the internal id after sorting, so the IP Only engine * process them in order too */ while (s != NULL) { - s->num = sig_id++; + s->order_id = sig_id++; s = s->next; } @@ -1340,7 +1340,7 @@ int UtilActionTest19(void) /* Assing the internal id after sorting, so the IP Only engine * process them in order too */ while (s != NULL) { - s->num = sig_id++; + s->order_id = sig_id++; s = s->next; } @@ -1426,7 +1426,7 @@ int UtilActionTest20(void) /* Assing the internal id after sorting, so the IP Only engine * process them in order too */ while (s != NULL) { - s->num = sig_id++; + s->order_id = sig_id++; s = s->next; } @@ -1506,7 +1506,7 @@ int UtilActionTest21(void) /* Assing the internal id after sorting, so the IP Only engine * process them in order too */ while (s != NULL) { - s->num = sig_id++; + s->order_id = sig_id++; s = s->next; } @@ -1592,7 +1592,7 @@ int UtilActionTest22(void) /* Assing the internal id after sorting, so the IP Only engine * process them in order too */ while (s != NULL) { - s->num = sig_id++; + s->order_id = sig_id++; s = s->next; } @@ -1678,7 +1678,7 @@ int UtilActionTest23(void) /* Assing the internal id after sorting, so the IP Only engine * process them in order too */ while (s != NULL) { - s->num = sig_id++; + s->order_id = sig_id++; s = s->next; } diff --git a/src/util-mpm.c b/src/util-mpm.c index fda64454d1..51b4ce1eb3 100644 --- a/src/util-mpm.c +++ b/src/util-mpm.c @@ -42,6 +42,7 @@ */ int PmqSetup(PatternMatcherQueue *pmq, uint32_t maxid) { SCEnter(); + SCLogDebug("maxid %u", maxid); if (pmq == NULL) { SCReturnInt(-1); @@ -94,6 +95,8 @@ MpmVerifyMatch(MpmThreadCtx *thread_ctx, PatternMatcherQueue *pmq, MpmEndMatch * int ret = 0; for ( ; em != NULL; em = em->next) { + SCLogDebug("em->sig_id %u", em->sig_id); + /* check offset */ if (offset < em->offset) continue;