aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect: remove unused alversion logic

Browse Source
pull/2622/head
Victor Julien 10 years ago
parent 6c6802b957
commit c066f043a5
3 changed files with 8 additions and 20 deletions
Show Stats Download Patch File Download Diff File

15
src/detect-engine-state.c
Unescape Escape View File

@ -194,12 +194,6 @@ static void DeStateSignatureAppend(DetectEngineState *state,
return;
}
static void DeStateStoreStateVersion(Flow *f,
const uint8_t alversion, uint8_t direction)
{
f->detect_alversion[direction & STREAM_TOSERVER ? 0 : 1] = alversion;
}
static void DeStateStoreFileNoMatchCnt(DetectEngineState *de_state, uint16_t file_no_match, uint8_t direction)
{
de_state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].filestore_cnt += file_no_match;
@ -337,7 +331,7 @@ static void StoreStateTxFileOnly(DetectEngineThreadCtx *det_ctx,
* \param check_before_add check for duplicates before adding the sig
*/
static void StoreStateTx(DetectEngineThreadCtx *det_ctx,
Flow *f, const uint8_t flags, const uint8_t alversion,
Flow *f, const uint8_t flags,
const uint64_t tx_id, void *tx,
const Signature *s, const SigMatchData *smd,
const uint32_t inspect_flags, const uint16_t file_no_match, int check_before_add)
@ -359,7 +353,6 @@ static void StoreStateTx(DetectEngineThreadCtx *det_ctx,
if (check_before_add == 0 || DeStateSearchState(destate, flags, s->num) == 0)
DeStateSignatureAppend(destate, s, inspect_flags, flags);
DeStateStoreStateVersion(f, alversion, flags);
StoreStateTxHandleFiles(det_ctx, f, destate, flags, tx_id, file_no_match);
}
@ -369,7 +362,7 @@ static void StoreStateTx(DetectEngineThreadCtx *det_ctx,
int DeStateDetectStartDetection(ThreadVars *tv, DetectEngineCtx *de_ctx,
DetectEngineThreadCtx *det_ctx,
const Signature *s, Packet *p, Flow *f, uint8_t flags,
AppProto alproto, const uint8_t alversion)
AppProto alproto)
{
SigMatchData *smd = NULL;
uint16_t file_no_match = 0;
@ -496,7 +489,7 @@ int DeStateDetectStartDetection(ThreadVars *tv, DetectEngineCtx *de_ctx,
}
/* store */
StoreStateTx(det_ctx, f, flags, alversion, tx_id, tx,
StoreStateTx(det_ctx, f, flags, tx_id, tx,
s, smd, inspect_flags, file_no_match, check_before_add);
} else {
StoreStateTxFileOnly(det_ctx, f, flags, tx_id, tx, file_no_match);
@ -721,7 +714,7 @@ static int DoInspectItem(ThreadVars *tv,
void DeStateDetectContinueDetection(ThreadVars *tv, DetectEngineCtx *de_ctx,
DetectEngineThreadCtx *det_ctx,
Packet *p, Flow *f, uint8_t flags,
AppProto alproto, const uint8_t alversion)
AppProto alproto)
{
uint16_t file_no_match = 0;
SigIntId store_cnt = 0;

7
src/detect-engine-state.h
Unescape Escape View File

@ -143,15 +143,13 @@ int DeStateFlowHasInspectableState(const Flow *f, const uint8_t flags);
* \param f Pointer to the flow.
* \param flags Flags.
* \param alproto App protocol.
* \param alversion Current app layer version.
*
* \retval >= 0 An integer value indicating the no of matches.
*/
int DeStateDetectStartDetection(ThreadVars *tv, DetectEngineCtx *de_ctx,
DetectEngineThreadCtx *det_ctx,
const Signature *s, Packet *p, Flow *f,
uint8_t flags,
AppProto alproto, uint8_t alversion);
uint8_t flags, AppProto alproto);
/**
* \brief Continue DeState detection of the signatures stored in the state.
@ -162,12 +160,11 @@ int DeStateDetectStartDetection(ThreadVars *tv, DetectEngineCtx *de_ctx,
* \param f Pointer to the flow.
* \param flags Flags.
* \param alproto App protocol.
* \param alversion Current app layer version.
*/
void DeStateDetectContinueDetection(ThreadVars *tv, DetectEngineCtx *de_ctx,
DetectEngineThreadCtx *det_ctx,
Packet *p, Flow *f, uint8_t flags,
AppProto alproto, uint8_t alversion);
AppProto alproto);
/**
* \brief Update the inspect id.

6
src/detect.c
Unescape Escape View File

@ -978,7 +978,6 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
uint8_t flow_flags = 0; /* flow/state flags */
const Signature *s = NULL;
const Signature *next_s = NULL;
uint8_t alversion = 0;
int state_alert = 0;
int alerts = 0;
int app_decoder_events = 0;
@ -1088,7 +1087,6 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
flow_flags = FlowGetDisruptionFlags(pflow, flow_flags);
has_state = (FlowGetAppState(pflow) != NULL);
alproto = FlowGetAppProtocol(pflow);
alversion = AppLayerParserGetStateVersion(pflow->alparser);
SCLogDebug("alstate %s, alproto %u", has_state ? "true" : "false", alproto);
} else {
SCLogDebug("packet doesn't have established flag set (proto %d)", p->proto);
@ -1170,7 +1168,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
if (has_inspectable_state == 1) {
/* initialize to 0(DE_STATE_MATCH_HAS_NEW_STATE) */
DeStateDetectContinueDetection(th_v, de_ctx, det_ctx, p, pflow,
flow_flags, alproto, alversion);
flow_flags, alproto);
}
}
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_STATEFUL);
@ -1444,7 +1442,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
* can store the tx_id with the alert */
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_STATEFUL);
state_alert = DeStateDetectStartDetection(th_v, de_ctx, det_ctx, s,
p, pflow, flow_flags, alproto, alversion);
p, pflow, flow_flags, alproto);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_STATEFUL);
if (state_alert == 0)
goto next;

Write Preview
Loading…
Cancel
Save