aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

variable names global vars, global no more. Moved to detection engine ctx, a place it belongs

Browse Source
remotes/origin/master
Anoop Saldanha 14 years ago committed by Victor Julien
parent 946100845f
commit f2dd61868d
9 changed files with 43 additions and 46 deletions
Show Stats Download Patch File Download Diff File

7
src/alert-debuglog.c
Unescape Escape View File

@ -145,12 +145,7 @@ static void AlertDebugLogFlowBits(AlertDebugLogThread *aft, Packet *p)
while (gv != NULL) {
if (gv->type == DETECT_FLOWBITS) {
FlowBit *fb = (FlowBit *) gv;
char *name = VariableIdxGetName(fb->idx, fb->type);
if (name != NULL) {
MemBufferWriteString(aft->buffer, "FLOWBIT: %s\n",
name);
SCFree(name);
}
MemBufferWriteString(aft->buffer, "FLOWBIT idx(%"PRIu32")\n", fb->idx);
}
gv = gv->next;
}

4
src/detect-engine.c
Unescape Escape View File

@ -123,7 +123,7 @@ DetectEngineCtx *DetectEngineCtxInit(void) {
DetectPortSpHashInit(de_ctx);
DetectPortDpHashInit(de_ctx);
ThresholdHashInit(de_ctx);
VariableNameInitHash();
VariableNameInitHash(de_ctx);
DetectParseDupSigHashInit(de_ctx);
de_ctx->mpm_pattern_id_store = MpmPatternIdTableInitHash();
@ -159,7 +159,7 @@ void DetectEngineCtxFree(DetectEngineCtx *de_ctx) {
ThresholdContextDestroy(de_ctx);
SigCleanSignatures(de_ctx);
VariableNameFreeHash();
VariableNameFreeHash(de_ctx);
if (de_ctx->sig_array)
SCFree(de_ctx->sig_array);

10
src/detect-flowbits.c
Unescape Escape View File

@ -229,7 +229,7 @@ int DetectFlowbitSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
if (cd == NULL)
goto error;
cd->idx = VariableNameGetIdx(fb_name,DETECT_FLOWBITS);
cd->idx = VariableNameGetIdx(de_ctx, fb_name, DETECT_FLOWBITS);
cd->cmd = fb_cmd;
SCLogDebug("idx %" PRIu32 ", cmd %s, name %s",
@ -609,7 +609,7 @@ static int FlowBitsTestSig04(void) {
s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"isset option\"; flowbits:isset,fbt; content:\"GET \"; sid:1;)");
idx = VariableNameGetIdx("fbt",DETECT_FLOWBITS);
idx = VariableNameGetIdx(de_ctx, "fbt", DETECT_FLOWBITS);
if (s == NULL || idx != 1) {
goto end;
@ -790,7 +790,7 @@ static int FlowBitsTestSig06(void) {
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
idx = VariableNameGetIdx("myflow",DETECT_FLOWBITS);
idx = VariableNameGetIdx(de_ctx, "myflow", DETECT_FLOWBITS);
gv = p->flow->flowvar;
@ -896,7 +896,7 @@ static int FlowBitsTestSig07(void) {
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
idx = VariableNameGetIdx("myflow",DETECT_FLOWBITS);
idx = VariableNameGetIdx(de_ctx, "myflow", DETECT_FLOWBITS);
gv = p->flow->flowvar;
@ -1005,7 +1005,7 @@ static int FlowBitsTestSig08(void) {
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
idx = VariableNameGetIdx("myflow",DETECT_FLOWBITS);
idx = VariableNameGetIdx(de_ctx, "myflow", DETECT_FLOWBITS);
gv = p->flow->flowvar;

4
src/detect-flowint.c
Unescape Escape View File

@ -115,7 +115,7 @@ int DetectFlowintMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
* return zero(not match).
*/
if (sfd->targettype == FLOWINT_TARGET_VAR) {
sfd->target.tvar.idx = VariableNameGetIdx(sfd->target.tvar.name, DETECT_FLOWINT);
sfd->target.tvar.idx = VariableNameGetIdx(det_ctx->de_ctx, sfd->target.tvar.name, DETECT_FLOWINT);
fvt = FlowVarGet(p->flow, sfd->target.tvar.idx);
/* We don't have that variable initialized yet */
@ -335,7 +335,7 @@ DetectFlowintData *DetectFlowintParse(DetectEngineCtx *de_ctx,
/* Set the name of the origin var to modify/compared with the target */
sfd->name = SCStrdup(varname);
if (de_ctx != NULL)
sfd->idx = VariableNameGetIdx(varname, DETECT_FLOWINT);
sfd->idx = VariableNameGetIdx(de_ctx, varname, DETECT_FLOWINT);
sfd->target.value =(uint32_t) value_long;
sfd->modifier = modifier;

2
src/detect-flowvar.c
Unescape Escape View File

@ -222,7 +222,7 @@ static int DetectFlowvarSetup (DetectEngineCtx *de_ctx, Signature *s, char *raws
}
cd->name = SCStrdup(varname);
cd->idx = VariableNameGetIdx(varname,DETECT_FLOWVAR);
cd->idx = VariableNameGetIdx(de_ctx, varname, DETECT_FLOWVAR);
memcpy(cd->content, str, len);
cd->content_len = len;
cd->flags = 0;

4
src/detect-pcre.c
Unescape Escape View File

@ -1054,9 +1054,9 @@ DetectPcreData *DetectPcreParseCapture(char *regexstr, DetectEngineCtx *de_ctx,
}
if (capture_str_ptr != NULL) {
if (pd->flags & DETECT_PCRE_CAPTURE_PKT)
pd->capidx = VariableNameGetIdx((char *)capture_str_ptr,DETECT_PKTVAR);
pd->capidx = VariableNameGetIdx(de_ctx, (char *)capture_str_ptr, DETECT_PKTVAR);
else if (pd->flags & DETECT_PCRE_CAPTURE_FLOW)
pd->capidx = VariableNameGetIdx((char *)capture_str_ptr,DETECT_FLOWVAR);
pd->capidx = VariableNameGetIdx(de_ctx, (char *)capture_str_ptr, DETECT_FLOWVAR);
}
}
//printf("DetectPcreParseCapture: pd->capname %s\n", pd->capname ? pd->capname : "NULL");

4
src/detect.h
Unescape Escape View File

@ -571,6 +571,10 @@ typedef struct DetectEngineCtx_ {
HashListTable *sport_hash_table;
HashListTable *dport_hash_table;
HashListTable *variable_names;
HashListTable *variable_idxs;
uint16_t variable_names_idx;
/* hash table used to cull out duplicate sigs */
HashListTable *dup_sig_hash_table;

46
src/util-var-name.c
Unescape Escape View File

@ -27,10 +27,6 @@
#include "detect.h"
#include "util-hashlist.h"
HashListTable *variable_names;
HashListTable *variable_idxs;
uint16_t variable_names_idx;
/** \brief Name2idx mapping structure for flowbits, flowvars and pktvars. */
typedef struct VariableName_ {
char *name;
@ -104,26 +100,28 @@ static void VariableNameFree(void *data) {
* \retval -1 in case of error
* \retval 0 in case of success
*/
int VariableNameInitHash() {
variable_names = HashListTableInit(4096, VariableNameHash, VariableNameCompare, VariableNameFree);
if (variable_names == NULL)
int VariableNameInitHash(DetectEngineCtx *de_ctx) {
de_ctx->variable_names = HashListTableInit(4096, VariableNameHash, VariableNameCompare, VariableNameFree);
if (de_ctx->variable_names == NULL)
return -1;
variable_idxs = HashListTableInit(4096, VariableIdxHash, VariableIdxCompare, NULL);
if (variable_idxs == NULL)
de_ctx->variable_idxs = HashListTableInit(4096, VariableIdxHash, VariableIdxCompare, NULL);
if (de_ctx->variable_idxs == NULL)
return -1;
variable_names_idx = 0;
de_ctx->variable_names_idx = 0;
return 0;
}
void VariableNameFreeHash() {
if (variable_names != NULL) {
HashListTableFree(variable_names);
HashListTableFree(variable_idxs);
variable_names = NULL;
variable_idxs = NULL;
void VariableNameFreeHash(DetectEngineCtx *de_ctx) {
if (de_ctx->variable_names != NULL) {
HashListTableFree(de_ctx->variable_names);
HashListTableFree(de_ctx->variable_idxs);
de_ctx->variable_names = NULL;
de_ctx->variable_idxs = NULL;
}
return;
}
/** \brief Get a name idx for a name. If the name is already used reuse the idx.
@ -132,7 +130,7 @@ void VariableNameFreeHash() {
* \retval 0 in case of error
* \retval _ the idx.
*/
uint16_t VariableNameGetIdx(char *name, uint8_t type) {
uint16_t VariableNameGetIdx(DetectEngineCtx *de_ctx, char *name, uint8_t type) {
uint16_t idx = 0;
VariableName *fn = SCMalloc(sizeof(VariableName));
@ -146,13 +144,13 @@ uint16_t VariableNameGetIdx(char *name, uint8_t type) {
if (fn->name == NULL)
goto error;
VariableName *lookup_fn = (VariableName *)HashListTableLookup(variable_names, (void *)fn, 0);
VariableName *lookup_fn = (VariableName *)HashListTableLookup(de_ctx->variable_names, (void *)fn, 0);
if (lookup_fn == NULL) {
variable_names_idx++;
de_ctx->variable_names_idx++;
idx = fn->idx = variable_names_idx;
HashListTableAdd(variable_names, (void *)fn, 0);
HashListTableAdd(variable_idxs, (void *)fn, 0);
idx = fn->idx = de_ctx->variable_names_idx;
HashListTableAdd(de_ctx->variable_names, (void *)fn, 0);
HashListTableAdd(de_ctx->variable_idxs, (void *)fn, 0);
} else {
idx = lookup_fn->idx;
VariableNameFree(fn);
@ -170,7 +168,7 @@ error:
* \retval NULL in case of error
* \retval name of the variable if successful.
*/
char *VariableIdxGetName(uint16_t idx, uint8_t type)
char *VariableIdxGetName(DetectEngineCtx *de_ctx, uint16_t idx, uint8_t type)
{
VariableName *fn = SCMalloc(sizeof(VariableName));
if (fn == NULL)
@ -182,7 +180,7 @@ char *VariableIdxGetName(uint16_t idx, uint8_t type)
fn->type = type;
fn->idx = idx;
VariableName *lookup_fn = (VariableName *)HashListTableLookup(variable_idxs, (void *)fn, 0);
VariableName *lookup_fn = (VariableName *)HashListTableLookup(de_ctx->variable_idxs, (void *)fn, 0);
if (lookup_fn != NULL) {
name = SCStrdup(lookup_fn->name);
if (name == NULL)

8
src/util-var-name.h
Unescape Escape View File

@ -24,11 +24,11 @@
#ifndef __UTIL_VAR_NAME_H__
#define __UTIL_VAR_NAME_H__
int VariableNameInitHash();
void VariableNameFreeHash();
int VariableNameInitHash(DetectEngineCtx *);
void VariableNameFreeHash(DetectEngineCtx *);
uint16_t VariableNameGetIdx(char *, uint8_t);
char * VariableIdxGetName(uint16_t , uint8_t);
uint16_t VariableNameGetIdx(DetectEngineCtx *, char *, uint8_t);
char * VariableIdxGetName(DetectEngineCtx *, uint16_t , uint8_t);
#endif

Write Preview
Loading…
Cancel
Save