|
|
|
@ -1065,114 +1065,6 @@ void PatternMatchDestroyGroup(SigGroupHead *sh)
|
|
|
|
return;
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/** \brief Hash for looking up contents that are most used,
|
|
|
|
|
|
|
|
* always used, etc. */
|
|
|
|
|
|
|
|
typedef struct ContentHash_ {
|
|
|
|
|
|
|
|
DetectContentData *ptr;
|
|
|
|
|
|
|
|
uint32_t cnt;
|
|
|
|
|
|
|
|
int use; /* use no matter what */
|
|
|
|
|
|
|
|
} ContentHash;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
typedef struct UricontentHash_ {
|
|
|
|
|
|
|
|
DetectContentData *ptr;
|
|
|
|
|
|
|
|
uint32_t cnt;
|
|
|
|
|
|
|
|
int use; /* use no matter what */
|
|
|
|
|
|
|
|
} UricontentHash;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
uint32_t ContentHashFunc(HashTable *ht, void *data, uint16_t datalen)
|
|
|
|
|
|
|
|
{
|
|
|
|
|
|
|
|
ContentHash *ch = (ContentHash *)data;
|
|
|
|
|
|
|
|
DetectContentData *co = ch->ptr;
|
|
|
|
|
|
|
|
uint32_t hash = 0;
|
|
|
|
|
|
|
|
int i;
|
|
|
|
|
|
|
|
for (i = 0; i < co->content_len; i++) {
|
|
|
|
|
|
|
|
hash += co->content[i];
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
hash = hash % ht->array_size;
|
|
|
|
|
|
|
|
SCLogDebug("hash %" PRIu32 "", hash);
|
|
|
|
|
|
|
|
return hash;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
uint32_t UricontentHashFunc(HashTable *ht, void *data, uint16_t datalen)
|
|
|
|
|
|
|
|
{
|
|
|
|
|
|
|
|
UricontentHash *ch = (UricontentHash *)data;
|
|
|
|
|
|
|
|
DetectContentData *ud = ch->ptr;
|
|
|
|
|
|
|
|
uint32_t hash = 0;
|
|
|
|
|
|
|
|
int i;
|
|
|
|
|
|
|
|
for (i = 0; i < ud->content_len; i++) {
|
|
|
|
|
|
|
|
hash += ud->content[i];
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
hash = hash % ht->array_size;
|
|
|
|
|
|
|
|
SCLogDebug("hash %" PRIu32 "", hash);
|
|
|
|
|
|
|
|
return hash;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
char ContentHashCompareFunc(void *data1, uint16_t len1, void *data2, uint16_t len2)
|
|
|
|
|
|
|
|
{
|
|
|
|
|
|
|
|
ContentHash *ch1 = (ContentHash *)data1;
|
|
|
|
|
|
|
|
ContentHash *ch2 = (ContentHash *)data2;
|
|
|
|
|
|
|
|
DetectContentData *co1 = ch1->ptr;
|
|
|
|
|
|
|
|
DetectContentData *co2 = ch2->ptr;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if (co1->content_len == co2->content_len &&
|
|
|
|
|
|
|
|
((co1->flags & DETECT_CONTENT_NOCASE) == (co2->flags & DETECT_CONTENT_NOCASE)) &&
|
|
|
|
|
|
|
|
SCMemcmp(co1->content, co2->content, co1->content_len) == 0)
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
char UricontentHashCompareFunc(void *data1, uint16_t len1, void *data2, uint16_t len2)
|
|
|
|
|
|
|
|
{
|
|
|
|
|
|
|
|
UricontentHash *ch1 = (UricontentHash *)data1;
|
|
|
|
|
|
|
|
UricontentHash *ch2 = (UricontentHash *)data2;
|
|
|
|
|
|
|
|
DetectContentData *ud1 = ch1->ptr;
|
|
|
|
|
|
|
|
DetectContentData *ud2 = ch2->ptr;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if (ud1->content_len == ud2->content_len &&
|
|
|
|
|
|
|
|
((ud1->flags & DETECT_CONTENT_NOCASE) == (ud2->flags & DETECT_CONTENT_NOCASE)) &&
|
|
|
|
|
|
|
|
SCMemcmp(ud1->content, ud2->content, ud1->content_len) == 0)
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
ContentHash *ContentHashAlloc(DetectContentData *ptr)
|
|
|
|
|
|
|
|
{
|
|
|
|
|
|
|
|
ContentHash *ch = SCMalloc(sizeof(ContentHash));
|
|
|
|
|
|
|
|
if (unlikely(ch == NULL))
|
|
|
|
|
|
|
|
return NULL;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
ch->ptr = ptr;
|
|
|
|
|
|
|
|
ch->cnt = 1;
|
|
|
|
|
|
|
|
ch->use = 0;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
return ch;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
UricontentHash *UricontentHashAlloc(DetectContentData *ptr)
|
|
|
|
|
|
|
|
{
|
|
|
|
|
|
|
|
UricontentHash *ch = SCMalloc(sizeof(UricontentHash));
|
|
|
|
|
|
|
|
if (unlikely(ch == NULL))
|
|
|
|
|
|
|
|
return NULL;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
ch->ptr = ptr;
|
|
|
|
|
|
|
|
ch->cnt = 1;
|
|
|
|
|
|
|
|
ch->use = 0;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
return ch;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
void ContentHashFree(void *ch)
|
|
|
|
|
|
|
|
{
|
|
|
|
|
|
|
|
SCFree(ch);
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
void UricontentHashFree(void *ch)
|
|
|
|
|
|
|
|
{
|
|
|
|
|
|
|
|
SCFree(ch);
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/** \brief Predict a strength value for patterns
|
|
|
|
/** \brief Predict a strength value for patterns
|
|
|
|
*
|
|
|
|
*
|
|
|
|
* Patterns with high character diversity score higher.
|
|
|
|
* Patterns with high character diversity score higher.
|
|
|
|
|