aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

refactor all http mpm engine code

Browse Source
remotes/origin/master-1.2.x
Anoop Saldanha 14 years ago committed by Victor Julien
parent 34cf557abf
commit a5dec3cb2e
1 changed files with 76 additions and 430 deletions
Show Stats Download Patch File Download Diff File

506
src/detect-engine-mpm.c
Unescape Escape View File

@ -19,6 +19,7 @@
* \file * \file
* *
* \author Victor Julien <victor@inliniac.net> * \author Victor Julien <victor@inliniac.net>
* \author Anoop Saldanha <anoopsaldanha@gmail.com>
* *
* Multi pattern matcher * Multi pattern matcher
*/ */
@ -735,14 +736,7 @@ static void PopulateMpmAddPatternToMpm(DetectEngineCtx *de_ctx,
uint8_t flags = 0; uint8_t flags = 0;
DetectContentData *cd = NULL; DetectContentData *cd = NULL;
DetectContentData *ud = NULL;
DetectContentData *hcbd = NULL;
DetectContentData *hsbd = NULL;
DetectContentData *hhd = NULL;
DetectContentData *hrhd = NULL;
DetectContentData *hmd = NULL;
DetectContentData *hcd = NULL;
DetectContentData *hrud = NULL;
switch (mpm_sm->type) { switch (mpm_sm->type) {
case DETECT_CONTENT: case DETECT_CONTENT:
{ {
@ -870,453 +864,105 @@ static void PopulateMpmAddPatternToMpm(DetectEngineCtx *de_ctx,
} /* case DETECT_CONTENT */ } /* case DETECT_CONTENT */
case DETECT_URICONTENT: case DETECT_URICONTENT:
{ case DETECT_AL_HTTP_RAW_URI:
ud = (DetectContentData *)mpm_sm->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) {
/* add the content to the "uri" mpm */
if (ud->flags & DETECT_CONTENT_NOCASE) {
mpm_table[sgh->mpm_uri_ctx->mpm_type].
AddPatternNocase(sgh->mpm_uri_ctx,
ud->content + ud->fp_chop_offset,
ud->fp_chop_len,
0, 0, ud->id, s->num, flags);
} else {
mpm_table[sgh->mpm_uri_ctx->mpm_type].
AddPattern(sgh->mpm_uri_ctx,
ud->content + ud->fp_chop_offset,
ud->fp_chop_len,
0, 0, ud->id, s->num, flags);
}
} else {
if (ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
if (DETECT_CONTENT_IS_SINGLE(ud)) {
ud->flags |= DETECT_CONTENT_URI_MPM;
}
/* see if we can bypass the match validation for this pattern */
} else {
if (DETECT_CONTENT_IS_SINGLE(ud)) {
ud->flags |= DETECT_CONTENT_URI_MPM;
}
} /* else - if (ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */
/* add the content to the "uri" mpm */
if (ud->flags & DETECT_CONTENT_NOCASE) {
mpm_table[sgh->mpm_uri_ctx->mpm_type].
AddPatternNocase(sgh->mpm_uri_ctx,
ud->content, ud->content_len,
0, 0, ud->id, s->num, flags);
} else {
mpm_table[sgh->mpm_uri_ctx->mpm_type].
AddPattern(sgh->mpm_uri_ctx,
ud->content, ud->content_len,
0, 0, ud->id, s->num, flags);
}
}
/* tell matcher we are inspecting uri */
s->flags |= SIG_FLAG_MPM_HTTP;
s->mpm_pattern_id_div_8 = ud->id / 8;
s->mpm_pattern_id_mod_8 = 1 << (ud->id % 8);
if (ud->flags & DETECT_CONTENT_NEGATED)
s->flags |= SIG_FLAG_MPM_HTTP_NEG;
sgh->flags |= SIG_GROUP_HEAD_MPM_URI;
break;
} /* case DETECT_URICONTENT */
case DETECT_AL_HTTP_CLIENT_BODY: case DETECT_AL_HTTP_CLIENT_BODY:
{
hcbd = (DetectContentData *)mpm_sm->ctx;
if (hcbd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) {
/* add the content to the "hcbd" mpm */
if (hcbd->flags & DETECT_CONTENT_NOCASE) {
mpm_table[sgh->mpm_hcbd_ctx->mpm_type].
AddPatternNocase(sgh->mpm_hcbd_ctx,
hcbd->content + hcbd->fp_chop_offset,
hcbd->fp_chop_len,
0, 0, hcbd->id, s->num, flags);
} else {
mpm_table[sgh->mpm_hcbd_ctx->mpm_type].
AddPattern(sgh->mpm_hcbd_ctx,
hcbd->content + hcbd->fp_chop_offset,
hcbd->fp_chop_len,
0, 0, hcbd->id, s->num, flags);
}
} else {
if (hcbd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
if (DETECT_CONTENT_IS_SINGLE(hcbd)) {
hcbd->flags |= DETECT_CONTENT_HCBD_MPM;
}
/* see if we can bypass the match validation for this pattern */
} else {
if (DETECT_CONTENT_IS_SINGLE(hcbd)) {
hcbd->flags |= DETECT_CONTENT_HCBD_MPM;
}
} /* else - if (hcbd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */
/* add the content to the "hcbd" mpm */
if (hcbd->flags & DETECT_CONTENT_NOCASE) {
mpm_table[sgh->mpm_hcbd_ctx->mpm_type].
AddPatternNocase(sgh->mpm_hcbd_ctx,
hcbd->content, hcbd->content_len,
0, 0, hcbd->id, s->num, flags);
} else {
mpm_table[sgh->mpm_hcbd_ctx->mpm_type].
AddPattern(sgh->mpm_hcbd_ctx,
hcbd->content, hcbd->content_len,
0, 0, hcbd->id, s->num, flags);
}
}
/* tell matcher we are inspecting uri */
s->flags |= SIG_FLAG_MPM_HTTP;
s->mpm_pattern_id_div_8 = hcbd->id / 8;
s->mpm_pattern_id_mod_8 = 1 << (hcbd->id % 8);
if (hcbd->flags & DETECT_CONTENT_NEGATED)
s->flags |= SIG_FLAG_MPM_HTTP_NEG;
sgh->flags |= SIG_GROUP_HEAD_MPM_HCBD;
break;
} /* case DETECT_AL_HTTP_CLIENT_BODY */
case DETECT_AL_HTTP_SERVER_BODY: case DETECT_AL_HTTP_SERVER_BODY:
{
hsbd = (DetectContentData *)mpm_sm->ctx;
if (hsbd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) {
/* add the content to the "hcbd" mpm */
if (hsbd->flags & DETECT_CONTENT_NOCASE) {
mpm_table[sgh->mpm_hsbd_ctx->mpm_type].
AddPatternNocase(sgh->mpm_hsbd_ctx,
hsbd->content + hsbd->fp_chop_offset,
hsbd->fp_chop_len,
0, 0, hsbd->id, s->num, flags);
} else {
mpm_table[sgh->mpm_hsbd_ctx->mpm_type].
AddPattern(sgh->mpm_hsbd_ctx,
hsbd->content + hsbd->fp_chop_offset,
hsbd->fp_chop_len,
0, 0, hsbd->id, s->num, flags);
}
} else {
if (hsbd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
if (DETECT_CONTENT_IS_SINGLE(hsbd)) {
hsbd->flags |= DETECT_CONTENT_HSBD_MPM;
}
/* see if we can bypass the match validation for this pattern */
} else {
if (DETECT_CONTENT_IS_SINGLE(hsbd)) {
hsbd->flags |= DETECT_CONTENT_HSBD_MPM;
}
} /* else - if (hcbd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */
/* add the content to the "hsbd" mpm */
if (hsbd->flags & DETECT_CONTENT_NOCASE) {
mpm_table[sgh->mpm_hsbd_ctx->mpm_type].
AddPatternNocase(sgh->mpm_hsbd_ctx,
hsbd->content, hsbd->content_len,
0, 0, hsbd->id, s->num, flags);
} else {
mpm_table[sgh->mpm_hsbd_ctx->mpm_type].
AddPattern(sgh->mpm_hsbd_ctx,
hsbd->content, hsbd->content_len,
0, 0, hsbd->id, s->num, flags);
}
}
/* tell matcher we are inspecting uri */
s->flags |= SIG_FLAG_MPM_HTTP;
s->mpm_pattern_id_div_8 = hsbd->id / 8;
s->mpm_pattern_id_mod_8 = 1 << (hsbd->id % 8);
if (hsbd->flags & DETECT_CONTENT_NEGATED)
s->flags |= SIG_FLAG_MPM_HTTP_NEG;
sgh->flags |= SIG_GROUP_HEAD_MPM_HSBD;
break;
} /* case DETECT_AL_HTTP_CLIENT_BODY */
case DETECT_AL_HTTP_HEADER: case DETECT_AL_HTTP_HEADER:
{
hhd = (DetectContentData *)mpm_sm->ctx;
if (hhd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) {
/* add the content to the "hhd" mpm */
if (hhd->flags & DETECT_CONTENT_NOCASE) {
mpm_table[sgh->mpm_hhd_ctx->mpm_type].
AddPatternNocase(sgh->mpm_hhd_ctx,
hhd->content + hhd->fp_chop_offset,
hhd->fp_chop_len,
0, 0, hhd->id, s->num, flags);
} else {
mpm_table[sgh->mpm_hhd_ctx->mpm_type].
AddPattern(sgh->mpm_hhd_ctx,
hhd->content + hhd->fp_chop_offset,
hhd->fp_chop_len,
0, 0, hhd->id, s->num, flags);
}
} else {
if (hhd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
if (DETECT_CONTENT_IS_SINGLE(hhd)) {
hhd->flags |= DETECT_CONTENT_HHD_MPM;
}
/* see if we can bypass the match validation for this pattern */
} else {
if (DETECT_CONTENT_IS_SINGLE(hhd)) {
hhd->flags |= DETECT_CONTENT_HHD_MPM;
}
} /* else - if (hhd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */
/* add the content to the "hhd" mpm */
if (hhd->flags & DETECT_CONTENT_NOCASE) {
mpm_table[sgh->mpm_hhd_ctx->mpm_type].
AddPatternNocase(sgh->mpm_hhd_ctx,
hhd->content, hhd->content_len,
0, 0, hhd->id, s->num, flags);
} else {
mpm_table[sgh->mpm_hhd_ctx->mpm_type].
AddPattern(sgh->mpm_hhd_ctx,
hhd->content, hhd->content_len,
0, 0, hhd->id, s->num, flags);
}
}
/* tell matcher we are inspecting uri */
s->flags |= SIG_FLAG_MPM_HTTP;
s->mpm_pattern_id_div_8 = hhd->id / 8;
s->mpm_pattern_id_mod_8 = 1 << (hhd->id % 8);
if (hhd->flags & DETECT_CONTENT_NEGATED)
s->flags |= SIG_FLAG_MPM_HTTP_NEG;
sgh->flags |= SIG_GROUP_HEAD_MPM_HHD;
break;
} /* case DETECT_AL_HTTP_HEADER */
case DETECT_AL_HTTP_RAW_HEADER: case DETECT_AL_HTTP_RAW_HEADER:
{
hrhd = (DetectContentData *)mpm_sm->ctx;
if (hrhd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) {
/* add the content to the "hrhd" mpm */
if (hrhd->flags & DETECT_CONTENT_NOCASE) {
mpm_table[sgh->mpm_hrhd_ctx->mpm_type].
AddPatternNocase(sgh->mpm_hrhd_ctx,
hrhd->content + hrhd->fp_chop_offset,
hrhd->fp_chop_len,
0, 0, hrhd->id, s->num, flags);
} else {
mpm_table[sgh->mpm_hrhd_ctx->mpm_type].
AddPattern(sgh->mpm_hrhd_ctx,
hrhd->content + hrhd->fp_chop_offset,
hrhd->fp_chop_len,
0, 0, hrhd->id, s->num, flags);
}
} else {
if (hrhd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
if (DETECT_CONTENT_IS_SINGLE(hrhd)) {
hrhd->flags |= DETECT_CONTENT_HRHD_MPM;
}
/* see if we can bypass the match validation for this pattern */
} else {
if (DETECT_CONTENT_IS_SINGLE(hrhd)) {
hrhd->flags |= DETECT_CONTENT_HRHD_MPM;
}
} /* else - if (hrhd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */
/* add the content to the "hrhd" mpm */
if (hrhd->flags & DETECT_CONTENT_NOCASE) {
mpm_table[sgh->mpm_hrhd_ctx->mpm_type].
AddPatternNocase(sgh->mpm_hrhd_ctx,
hrhd->content, hrhd->content_len,
0, 0, hrhd->id, s->num, flags);
} else {
mpm_table[sgh->mpm_hrhd_ctx->mpm_type].
AddPattern(sgh->mpm_hrhd_ctx,
hrhd->content, hrhd->content_len,
0, 0, hrhd->id, s->num, flags);
}
}
/* tell matcher we are inspecting uri */
s->flags |= SIG_FLAG_MPM_HTTP;
s->mpm_pattern_id_div_8 = hrhd->id / 8;
s->mpm_pattern_id_mod_8 = 1 << (hrhd->id % 8);
if (hrhd->flags & DETECT_CONTENT_NEGATED)
s->flags |= SIG_FLAG_MPM_HTTP_NEG;
sgh->flags |= SIG_GROUP_HEAD_MPM_HRHD;
break;
} /* case DETECT_AL_HTTP_RAW_HEADER */
case DETECT_AL_HTTP_METHOD: case DETECT_AL_HTTP_METHOD:
{
hmd = (DetectContentData *)mpm_sm->ctx;
if (hmd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) {
/* add the content to the "hmd" mpm */
if (hmd->flags & DETECT_CONTENT_NOCASE) {
mpm_table[sgh->mpm_hmd_ctx->mpm_type].
AddPatternNocase(sgh->mpm_hmd_ctx,
hmd->content + hmd->fp_chop_offset,
hmd->fp_chop_len,
0, 0, hmd->id, s->num, flags);
} else {
mpm_table[sgh->mpm_hmd_ctx->mpm_type].
AddPattern(sgh->mpm_hmd_ctx,
hmd->content + hmd->fp_chop_offset,
hmd->fp_chop_len,
0, 0, hmd->id, s->num, flags);
}
} else {
if (hmd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
if (DETECT_CONTENT_IS_SINGLE(hmd)) {
hmd->flags |= DETECT_CONTENT_HMD_MPM;
}
/* see if we can bypass the match validation for this pattern */
} else {
if (DETECT_CONTENT_IS_SINGLE(hmd)) {
hmd->flags |= DETECT_CONTENT_HMD_MPM;
}
} /* else - if (hmd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */
/* add the content to the "hmd" mpm */
if (hmd->flags & DETECT_CONTENT_NOCASE) {
mpm_table[sgh->mpm_hmd_ctx->mpm_type].
AddPatternNocase(sgh->mpm_hmd_ctx,
hmd->content, hmd->content_len,
0, 0, hmd->id, s->num, flags);
} else {
mpm_table[sgh->mpm_hmd_ctx->mpm_type].
AddPattern(sgh->mpm_hmd_ctx,
hmd->content, hmd->content_len,
0, 0, hmd->id, s->num, flags);
}
}
/* tell matcher we are inspecting method */
s->flags |= SIG_FLAG_MPM_HTTP;
s->mpm_pattern_id_div_8 = hmd->id / 8;
s->mpm_pattern_id_mod_8 = 1 << (hmd->id % 8);
if (hmd->flags & DETECT_CONTENT_NEGATED)
s->flags |= SIG_FLAG_MPM_HTTP_NEG;
sgh->flags |= SIG_GROUP_HEAD_MPM_HMD;
break;
} /* case DETECT_AL_HTTP_METHOD */
case DETECT_AL_HTTP_COOKIE: case DETECT_AL_HTTP_COOKIE:
{ {
hcd = (DetectContentData *)mpm_sm->ctx; MpmCtx *mpm_ctx = NULL;
if (hcd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { uint32_t sgh_flags = 0;
/* add the content to the "hcd" mpm */ uint32_t cd_flags = 0;
if (hcd->flags & DETECT_CONTENT_NOCASE) {
mpm_table[sgh->mpm_hcd_ctx->mpm_type]. if (mpm_sm->type == DETECT_URICONTENT) {
AddPatternNocase(sgh->mpm_hcd_ctx, mpm_ctx = sgh->mpm_uri_ctx;
hcd->content + hcd->fp_chop_offset, sgh_flags = SIG_GROUP_HEAD_MPM_URI;
hcd->fp_chop_len, cd_flags = DETECT_CONTENT_URI_MPM;
0, 0, hcd->id, s->num, flags); } else if (mpm_sm->type == DETECT_AL_HTTP_CLIENT_BODY) {
} else { mpm_ctx = sgh->mpm_hcbd_ctx;
mpm_table[sgh->mpm_hcd_ctx->mpm_type]. sgh_flags = SIG_GROUP_HEAD_MPM_HCBD;
AddPattern(sgh->mpm_hcd_ctx, cd_flags = DETECT_CONTENT_HCBD_MPM;
hcd->content + hcd->fp_chop_offset, } else if (mpm_sm->type == DETECT_AL_HTTP_SERVER_BODY) {
hcd->fp_chop_len, mpm_ctx = sgh->mpm_hsbd_ctx;
0, 0, hcd->id, s->num, flags); sgh_flags = SIG_GROUP_HEAD_MPM_HSBD;
} cd_flags = DETECT_CONTENT_HSBD_MPM;
} else { } else if (mpm_sm->type == DETECT_AL_HTTP_HEADER) {
if (hcd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { mpm_ctx = sgh->mpm_hhd_ctx;
if (DETECT_CONTENT_IS_SINGLE(hcd)) { sgh_flags = SIG_GROUP_HEAD_MPM_HHD;
hcd->flags |= DETECT_CONTENT_HCD_MPM; cd_flags = DETECT_CONTENT_HHD_MPM;
} } else if (mpm_sm->type == DETECT_AL_HTTP_RAW_HEADER) {
mpm_ctx = sgh->mpm_hrhd_ctx;
/* see if we can bypass the match validation for this pattern */ sgh_flags = SIG_GROUP_HEAD_MPM_HRHD;
} else { cd_flags = DETECT_CONTENT_HRHD_MPM;
if (DETECT_CONTENT_IS_SINGLE(hcd)) { } else if (mpm_sm->type == DETECT_AL_HTTP_METHOD) {
hcd->flags |= DETECT_CONTENT_HCD_MPM; mpm_ctx = sgh->mpm_hmd_ctx;
} sgh_flags = SIG_GROUP_HEAD_MPM_HMD;
} /* else - if (hcd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */ cd_flags = DETECT_CONTENT_HMD_MPM;
} else if (mpm_sm->type == DETECT_AL_HTTP_COOKIE) {
/* add the content to the "hcd" mpm */ mpm_ctx = sgh->mpm_hcd_ctx;
if (hcd->flags & DETECT_CONTENT_NOCASE) { sgh_flags = SIG_GROUP_HEAD_MPM_HCD;
mpm_table[sgh->mpm_hcd_ctx->mpm_type]. cd_flags = DETECT_CONTENT_HCD_MPM;
AddPatternNocase(sgh->mpm_hcd_ctx, } else if (mpm_sm->type == DETECT_AL_HTTP_RAW_URI) {
hcd->content, hcd->content_len, mpm_ctx = sgh->mpm_hrud_ctx;
0, 0, hcd->id, s->num, flags); sgh_flags = SIG_GROUP_HEAD_MPM_HRUD;
} else { cd_flags = DETECT_CONTENT_HRUD_MPM;
mpm_table[sgh->mpm_hcd_ctx->mpm_type].
AddPattern(sgh->mpm_hcd_ctx,
hcd->content, hcd->content_len,
0, 0, hcd->id, s->num, flags);
}
} }
/* tell matcher we are inspecting cookie */
s->flags |= SIG_FLAG_MPM_HTTP;
s->mpm_pattern_id_div_8 = hcd->id / 8;
s->mpm_pattern_id_mod_8 = 1 << (hcd->id % 8);
if (hcd->flags & DETECT_CONTENT_NEGATED)
s->flags |= SIG_FLAG_MPM_HTTP_NEG;
sgh->flags |= SIG_GROUP_HEAD_MPM_HCD; cd = (DetectContentData *)mpm_sm->ctx;
if (cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) {
break; /* add the content to the mpm */
} /* case DETECT_AL_HTTP_COOKIE */ if (cd->flags & DETECT_CONTENT_NOCASE) {
mpm_table[mpm_ctx->mpm_type].
case DETECT_AL_HTTP_RAW_URI: AddPatternNocase(mpm_ctx,
{ cd->content + cd->fp_chop_offset,
hrud = (DetectContentData *)mpm_sm->ctx; cd->fp_chop_len,
if (hrud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { 0, 0, cd->id, s->num, flags);
/* add the content to the "hrud" mpm */
if (hrud->flags & DETECT_CONTENT_NOCASE) {
mpm_table[sgh->mpm_hrud_ctx->mpm_type].
AddPatternNocase(sgh->mpm_hrud_ctx,
hrud->content + hrud->fp_chop_offset,
hrud->fp_chop_len,
0, 0, hrud->id, s->num, flags);
} else { } else {
mpm_table[sgh->mpm_hrud_ctx->mpm_type]. mpm_table[mpm_ctx->mpm_type].
AddPattern(sgh->mpm_hrud_ctx, AddPattern(mpm_ctx,
hrud->content + hrud->fp_chop_offset, cd->content + cd->fp_chop_offset,
hrud->fp_chop_len, cd->fp_chop_len,
0, 0, hrud->id, s->num, flags); 0, 0, cd->id, s->num, flags);
} }
} else { } else {
if (hrud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { if (cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
if (DETECT_CONTENT_IS_SINGLE(hrud)) { if (DETECT_CONTENT_IS_SINGLE(cd)) {
hrud->flags |= DETECT_CONTENT_HRUD_MPM; cd->flags |= cd_flags;
} }
/* see if we can bypass the match validation for this pattern */ /* see if we can bypass the match validation for this pattern */
} else { } else {
if (DETECT_CONTENT_IS_SINGLE(hrud)) { if (DETECT_CONTENT_IS_SINGLE(cd)) {
hrud->flags |= DETECT_CONTENT_HRUD_MPM; cd->flags |= cd_flags;
} }
} /* else - if (hrud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */ } /* else - if (cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */
/* add the content to the "hrud" mpm */ /* add the content to the "uri" mpm */
if (hrud->flags & DETECT_CONTENT_NOCASE) { if (cd->flags & DETECT_CONTENT_NOCASE) {
mpm_table[sgh->mpm_hrud_ctx->mpm_type]. mpm_table[mpm_ctx->mpm_type].
AddPatternNocase(sgh->mpm_hrud_ctx, AddPatternNocase(mpm_ctx,
hrud->content, hrud->content_len, cd->content, cd->content_len,
0, 0, hrud->id, s->num, flags); 0, 0, cd->id, s->num, flags);
} else { } else {
mpm_table[sgh->mpm_hrud_ctx->mpm_type]. mpm_table[mpm_ctx->mpm_type].
AddPattern(sgh->mpm_hrud_ctx, AddPattern(mpm_ctx,
hrud->content, hrud->content_len, cd->content, cd->content_len,
0, 0, hrud->id, s->num, flags); 0, 0, cd->id, s->num, flags);
} }
} }
/* tell matcher we are inspecting raw uri */ /* tell matcher we are inspecting uri */
s->flags |= SIG_FLAG_MPM_HTTP; s->flags |= SIG_FLAG_MPM_HTTP;
s->mpm_pattern_id_div_8 = hrud->id / 8; s->mpm_pattern_id_div_8 = cd->id / 8;
s->mpm_pattern_id_mod_8 = 1 << (hrud->id % 8); s->mpm_pattern_id_mod_8 = 1 << (cd->id % 8);
if (hrud->flags & DETECT_CONTENT_NEGATED) if (cd->flags & DETECT_CONTENT_NEGATED)
s->flags |= SIG_FLAG_MPM_HTTP_NEG; s->flags |= SIG_FLAG_MPM_HTTP_NEG;
sgh->flags |= SIG_GROUP_HEAD_MPM_HRUD; sgh->flags |= sgh_flags;
break; break;
} /* case DETECT_AL_HTTP_RAW_URI */ }
} /* switch (mpm_sm->type) */ } /* switch (mpm_sm->type) */
SCLogDebug("%"PRIu32" adding cd->id %"PRIu32" to the mpm phase " SCLogDebug("%"PRIu32" adding cd->id %"PRIu32" to the mpm phase "

Write Preview
Loading…
Cancel
Save