aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fast pattern cleanup - Remove FastPatternSupportEnabledForSigMatchList() and all it's associated structures

Browse Source
remotes/origin/master
Anoop Saldanha 14 years ago committed by Victor Julien
parent 988c92f71c
commit db8500bb26
4 changed files with 6 additions and 95 deletions
Show Stats Download Patch File Download Diff File

6
src/detect-engine-mpm.c
Unescape Escape View File

@ -1523,7 +1523,7 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx,
* if we have a fast_pattern set in this Signature */
for (sm = s->sm_lists[list_id]; sm != NULL; sm = sm->next) {
/* this keyword isn't registered for fp support */
if (!FastPatternSupportEnabledForSigMatchType(sm->type))
if (sm->type != DETECT_CONTENT)
continue;
//if (PopulateMpmSkipContent(sgh, s, sm)) {
@ -1563,7 +1563,7 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx,
continue;
for (sm = s->sm_lists[list_id]; sm != NULL; sm = sm->next) {
if (!FastPatternSupportEnabledForSigMatchType(sm->type))
if (sm->type != DETECT_CONTENT)
continue;
//if (PopulateMpmSkipContent(sgh, s, sm)) {
@ -1585,7 +1585,7 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx,
continue;
for (sm = s->sm_lists[list_id]; sm != NULL; sm = sm->next) {
if (!FastPatternSupportEnabledForSigMatchType(sm->type))
if (sm->type != DETECT_CONTENT)
continue;
/* skip in case of:

57
src/detect-fast-pattern.c
Unescape Escape View File

@ -45,8 +45,6 @@ static pcre_extra *parse_regex_study = NULL;
static int DetectFastPatternSetup(DetectEngineCtx *, Signature *, char *);
void DetectFastPatternRegisterTests(void);
/* holds the list of sm's that should be given fp support */
SCFPSupportSMType *sm_fp_support_smtype_list = NULL;
/* holds the list of sm match lists that need to be searched for a keyword
* that has fp support */
SCFPSupportSMList *sm_fp_support_smlist_list = NULL;
@ -82,77 +80,22 @@ static void SupportFastPatternForSigMatchList(int list_id)
return;
}
/**
* \brief Lets one add a sigmatch type for fast pattern support(explains the weird
* name the function has).
*
* \param sm_type The sigmatch for which fp support has to be added.
*/
static void SupportFastPatternForSigMatchType(uint8_t sm_type)
{
if (sm_fp_support_smtype_list != NULL) {
SCFPSupportSMType *tmp_smtype_fp = sm_fp_support_smtype_list;
while (tmp_smtype_fp != NULL) {
if (tmp_smtype_fp->sm_type == sm_type) {
return;
}
tmp_smtype_fp = tmp_smtype_fp->next;
}
}
SCFPSupportSMType *new_smtype_fp = SCMalloc(sizeof(SCFPSupportSMType));
if (new_smtype_fp == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
exit(EXIT_FAILURE);
}
memset(new_smtype_fp, 0, sizeof(SCFPSupportSMType));
new_smtype_fp->sm_type = sm_type;
new_smtype_fp->next = sm_fp_support_smtype_list;
sm_fp_support_smtype_list = new_smtype_fp;
return;
}
/**
* \brief Registers the keywords(SMs) that should be given fp support.
*/
void SupportFastPatternForSigMatchTypes(void)
{
SupportFastPatternForSigMatchType(DETECT_CONTENT);
SupportFastPatternForSigMatchList(DETECT_SM_LIST_PMATCH);
SupportFastPatternForSigMatchType(DETECT_CONTENT);
SupportFastPatternForSigMatchList(DETECT_SM_LIST_UMATCH);
SupportFastPatternForSigMatchType(DETECT_CONTENT);
SupportFastPatternForSigMatchList(DETECT_SM_LIST_HCBDMATCH);
SupportFastPatternForSigMatchType(DETECT_CONTENT);
SupportFastPatternForSigMatchList(DETECT_SM_LIST_HSBDMATCH);
SupportFastPatternForSigMatchType(DETECT_CONTENT);
SupportFastPatternForSigMatchList(DETECT_SM_LIST_HHDMATCH);
SupportFastPatternForSigMatchType(DETECT_CONTENT);
SupportFastPatternForSigMatchList(DETECT_SM_LIST_HRHDMATCH);
SupportFastPatternForSigMatchType(DETECT_CONTENT);
SupportFastPatternForSigMatchList(DETECT_SM_LIST_HMDMATCH);
SupportFastPatternForSigMatchType(DETECT_CONTENT);
SupportFastPatternForSigMatchList(DETECT_SM_LIST_HCDMATCH);
SupportFastPatternForSigMatchType(DETECT_CONTENT);
SupportFastPatternForSigMatchList(DETECT_SM_LIST_HRUDMATCH);
SupportFastPatternForSigMatchType(DETECT_CONTENT);
SupportFastPatternForSigMatchList(DETECT_SM_LIST_HSMDMATCH);
SupportFastPatternForSigMatchType(DETECT_CONTENT);
SupportFastPatternForSigMatchList(DETECT_SM_LIST_HSCDMATCH);
SupportFastPatternForSigMatchType(DETECT_CONTENT);
SupportFastPatternForSigMatchList(DETECT_SM_LIST_HUADMATCH);
return;

32
src/detect-fast-pattern.h
Unescape Escape View File

@ -24,13 +24,6 @@
#ifndef __DETECT_FAST_PATTERN_H__
#define __DETECT_FAST_PATTERN_H__
typedef struct SCFPSupportSMType_ {
/* the sm type */
uint8_t sm_type;
/* the next member in the list */
struct SCFPSupportSMType_ *next;
} SCFPSupportSMType;
typedef struct SCFPSupportSMList_ {
/* the list id. Have a look at Signature->sm_lists[] */
int list_id;
@ -38,33 +31,8 @@ typedef struct SCFPSupportSMList_ {
struct SCFPSupportSMList_ *next;
} SCFPSupportSMList;
extern SCFPSupportSMType *sm_fp_support_smtype_list;
extern SCFPSupportSMList *sm_fp_support_smlist_list;
/**
* \brief Checks if a particular sigmatch type has fast pattern support.
*
* \param sm_type The sigmatch that has to be checked.
*
* \retval 1 If supported.
* \retval 0 If not.
*/
static inline int FastPatternSupportEnabledForSigMatchType(uint8_t sm_type)
{
if (sm_fp_support_smtype_list == NULL)
return 0;
SCFPSupportSMType *tmp_smtype_fp = sm_fp_support_smtype_list;
while (tmp_smtype_fp != NULL) {
if (tmp_smtype_fp->sm_type == sm_type)
return 1;
tmp_smtype_fp = tmp_smtype_fp->next;
}
return 0;
}
/**
* \brief Checks if a particular list(Signature->sm_lists[]) is in the list
* of lists that need to be searched for a keyword that has fp support.

6
src/detect.c
Unescape Escape View File

@ -371,7 +371,7 @@ void EngineAnalysisFastPattern(Signature *s)
* if we have a fast_pattern set in this Signature */
for (sm = s->sm_lists[list_id]; sm != NULL; sm = sm->next) {
/* this keyword isn't registered for fp support */
if (!FastPatternSupportEnabledForSigMatchType(sm->type))
if (sm->type != DETECT_CONTENT)
continue;
DetectContentData *cd = (DetectContentData *)sm->ctx;
@ -395,7 +395,7 @@ void EngineAnalysisFastPattern(Signature *s)
continue;
for (sm = s->sm_lists[list_id]; sm != NULL; sm = sm->next) {
if (!FastPatternSupportEnabledForSigMatchType(sm->type))
if (sm->type != DETECT_CONTENT)
continue;
DetectContentData *cd = (DetectContentData *)sm->ctx;
@ -411,7 +411,7 @@ void EngineAnalysisFastPattern(Signature *s)
continue;
for (sm = s->sm_lists[list_id]; sm != NULL; sm = sm->next) {
if (!FastPatternSupportEnabledForSigMatchType(sm->type))
if (sm->type != DETECT_CONTENT)
continue;
/* skip in case of:

Write Preview
Loading…
Cancel
Save