detect-icode: implement prefilter

src/detect-icode.c

@@ -1,4 +1,4 @@
-/* Copyright (C) 2007-2010 Open Information Security Foundation
+/* Copyright (C) 2007-2016 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -29,6 +29,7 @@
 
 #include "detect.h"
 #include "detect-parse.h"
+#include "detect-engine-prefilter-common.h"
 
 #include "detect-icode.h"
 
@@ -50,6 +51,8 @@ static int DetectICodeSetup(DetectEngineCtx *, Signature *, char *);
 void DetectICodeRegisterTests(void);
 void DetectICodeFree(void *);
 
+static int PrefilterSetupICode(SigGroupHead *sgh);
+static _Bool PrefilterICodeIsPrefilterable(const Signature *s);
 
 /**
  * \brief Registration function for icode: keyword
@@ -64,9 +67,31 @@ void DetectICodeRegister (void)
     sigmatch_table[DETECT_ICODE].Free = DetectICodeFree;
     sigmatch_table[DETECT_ICODE].RegisterTests = DetectICodeRegisterTests;
 
+    sigmatch_table[DETECT_ICODE].SupportsPrefilter = PrefilterICodeIsPrefilterable;
+    sigmatch_table[DETECT_ICODE].SetupPrefilter = PrefilterSetupICode;
+
     DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study);
 }
 
+static inline int ICodeMatch(const uint8_t pcode, const uint8_t mode,
+                             const uint8_t dcode1, const uint8_t dcode2)
+{
+    switch (mode) {
+        case DETECT_ICODE_EQ:
+            return (pcode == dcode1) ? 1 : 0;
+
+        case DETECT_ICODE_LT:
+            return (pcode < dcode1) ? 1 : 0;
+
+        case DETECT_ICODE_GT:
+            return (pcode > dcode1) ? 1 : 0;
+
+        case DETECT_ICODE_RN:
+            return (pcode > dcode1 && pcode < dcode2) ? 1 : 0;
+    }
+    return 0;
+}
+
 /**
  * \brief This function is used to match icode rule option set on a packet with those passed via icode:
  *
@@ -80,38 +105,21 @@ void DetectICodeRegister (void)
  */
 int DetectICodeMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx)
 {
-    int ret = 0;
-    uint8_t picode;
-    const DetectICodeData *icd = (const DetectICodeData *)ctx;
-
     if (PKT_IS_PSEUDOPKT(p))
         return 0;
 
+    uint8_t picode;
     if (PKT_IS_ICMPV4(p)) {
         picode = ICMPV4_GET_CODE(p);
     } else if (PKT_IS_ICMPV6(p)) {
         picode = ICMPV6_GET_CODE(p);
     } else {
         /* Packet not ICMPv4 nor ICMPv6 */
-        return ret;
-    }
-
-    switch(icd->mode) {
-        case DETECT_ICODE_EQ:
-            ret = (picode == icd->code1) ? 1 : 0;
-            break;
-        case DETECT_ICODE_LT:
-            ret = (picode < icd->code1) ? 1 : 0;
-            break;
-        case DETECT_ICODE_GT:
-            ret = (picode > icd->code1) ? 1 : 0;
-            break;
-        case DETECT_ICODE_RN:
-            ret = (picode >= icd->code1 && picode <= icd->code2) ? 1 : 0;
-            break;
+        return 0;
     }
 
-    return ret;
+    const DetectICodeData *icd = (const DetectICodeData *)ctx;
+    return ICodeMatch(picode, icd->mode, icd->code1, icd->code2);
 }
 
 /**
@@ -263,6 +271,74 @@ void DetectICodeFree(void *ptr)
     SCFree(icd);
 }
 
+/* prefilter code */
+
+static void
+PrefilterPacketICodeMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
+{
+    if (PKT_IS_PSEUDOPKT(p)) {
+        SCReturn;
+    }
+
+    uint8_t picode;
+    if (PKT_IS_ICMPV4(p)) {
+        picode = ICMPV4_GET_CODE(p);
+    } else if (PKT_IS_ICMPV6(p)) {
+        picode = ICMPV6_GET_CODE(p);
+    } else {
+        /* Packet not ICMPv4 nor ICMPv6 */
+        return;
+    }
+
+    const PrefilterPacketHeaderCtx *ctx = pectx;
+
+    if (ICodeMatch(picode, ctx->v1.u8[0], ctx->v1.u8[1], ctx->v1.u8[2]))
+    {
+        SCLogDebug("packet matches ICMP code %u", picode);
+        PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
+    }
+}
+
+static void
+PrefilterPacketICodeSet(PrefilterPacketHeaderValue *v, void *smctx)
+{
+    const DetectICodeData *a = smctx;
+    v->u8[0] = a->mode;
+    v->u8[1] = a->code1;
+    v->u8[2] = a->code2;
+}
+
+static _Bool
+PrefilterPacketICodeCompare(PrefilterPacketHeaderValue v, void *smctx)
+{
+    const DetectICodeData *a = smctx;
+    if (v.u8[0] == a->mode &&
+        v.u8[1] == a->code1 &&
+        v.u8[2] == a->code2)
+        return TRUE;
+    return FALSE;
+}
+
+static int PrefilterSetupICode(SigGroupHead *sgh)
+{
+    return PrefilterSetupPacketHeader(sgh, DETECT_ICODE,
+            PrefilterPacketICodeSet,
+            PrefilterPacketICodeCompare,
+            PrefilterPacketICodeMatch);
+}
+
+static _Bool PrefilterICodeIsPrefilterable(const Signature *s)
+{
+    const SigMatch *sm;
+    for (sm = s->sm_lists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) {
+        switch (sm->type) {
+            case DETECT_ICODE:
+                return TRUE;
+        }
+    }
+    return FALSE;
+}
+
 #ifdef UNITTESTS
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"