aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

variable names global vars, global no more. Moved to detection engine ctx, a place it belongs

Browse Source
remotes/origin/HEAD
Anoop Saldanha 14 years ago committed by Victor Julien
parent 946100845f
commit f2dd61868d
9 changed files with 43 additions and 46 deletions
Show Stats Download Patch File Download Diff File

7
src/alert-debuglog.c
Unescape Escape View File

@ -145,12 +145,7 @@ static void AlertDebugLogFlowBits(AlertDebugLogThread *aft, Packet *p)
while (gv != NULL) { while (gv != NULL) {
if (gv->type == DETECT_FLOWBITS) { if (gv->type == DETECT_FLOWBITS) {
FlowBit *fb = (FlowBit *) gv; FlowBit *fb = (FlowBit *) gv;
char *name = VariableIdxGetName(fb->idx, fb->type); MemBufferWriteString(aft->buffer, "FLOWBIT idx(%"PRIu32")\n", fb->idx);
if (name != NULL) {
MemBufferWriteString(aft->buffer, "FLOWBIT: %s\n",
name);
SCFree(name);
}
} }
gv = gv->next; gv = gv->next;
} }

4
src/detect-engine.c
Unescape Escape View File

@ -123,7 +123,7 @@ DetectEngineCtx *DetectEngineCtxInit(void) {
DetectPortSpHashInit(de_ctx); DetectPortSpHashInit(de_ctx);
DetectPortDpHashInit(de_ctx); DetectPortDpHashInit(de_ctx);
ThresholdHashInit(de_ctx); ThresholdHashInit(de_ctx);
VariableNameInitHash(); VariableNameInitHash(de_ctx);
DetectParseDupSigHashInit(de_ctx); DetectParseDupSigHashInit(de_ctx);
de_ctx->mpm_pattern_id_store = MpmPatternIdTableInitHash(); de_ctx->mpm_pattern_id_store = MpmPatternIdTableInitHash();
@ -159,7 +159,7 @@ void DetectEngineCtxFree(DetectEngineCtx *de_ctx) {
ThresholdContextDestroy(de_ctx); ThresholdContextDestroy(de_ctx);
SigCleanSignatures(de_ctx); SigCleanSignatures(de_ctx);
VariableNameFreeHash(); VariableNameFreeHash(de_ctx);
if (de_ctx->sig_array) if (de_ctx->sig_array)
SCFree(de_ctx->sig_array); SCFree(de_ctx->sig_array);

10
src/detect-flowbits.c
Unescape Escape View File

@ -229,7 +229,7 @@ int DetectFlowbitSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
if (cd == NULL) if (cd == NULL)
goto error; goto error;
cd->idx = VariableNameGetIdx(fb_name,DETECT_FLOWBITS); cd->idx = VariableNameGetIdx(de_ctx, fb_name, DETECT_FLOWBITS);
cd->cmd = fb_cmd; cd->cmd = fb_cmd;
SCLogDebug("idx %" PRIu32 ", cmd %s, name %s", SCLogDebug("idx %" PRIu32 ", cmd %s, name %s",
@ -609,7 +609,7 @@ static int FlowBitsTestSig04(void) {
s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"isset option\"; flowbits:isset,fbt; content:\"GET \"; sid:1;)"); s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"isset option\"; flowbits:isset,fbt; content:\"GET \"; sid:1;)");
idx = VariableNameGetIdx("fbt",DETECT_FLOWBITS); idx = VariableNameGetIdx(de_ctx, "fbt", DETECT_FLOWBITS);
if (s == NULL || idx != 1) { if (s == NULL || idx != 1) {
goto end; goto end;
@ -790,7 +790,7 @@ static int FlowBitsTestSig06(void) {
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
idx = VariableNameGetIdx("myflow",DETECT_FLOWBITS); idx = VariableNameGetIdx(de_ctx, "myflow", DETECT_FLOWBITS);
gv = p->flow->flowvar; gv = p->flow->flowvar;
@ -896,7 +896,7 @@ static int FlowBitsTestSig07(void) {
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
idx = VariableNameGetIdx("myflow",DETECT_FLOWBITS); idx = VariableNameGetIdx(de_ctx, "myflow", DETECT_FLOWBITS);
gv = p->flow->flowvar; gv = p->flow->flowvar;
@ -1005,7 +1005,7 @@ static int FlowBitsTestSig08(void) {
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
idx = VariableNameGetIdx("myflow",DETECT_FLOWBITS); idx = VariableNameGetIdx(de_ctx, "myflow", DETECT_FLOWBITS);
gv = p->flow->flowvar; gv = p->flow->flowvar;

4
src/detect-flowint.c
Unescape Escape View File

@ -115,7 +115,7 @@ int DetectFlowintMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
* return zero(not match). * return zero(not match).
*/ */
if (sfd->targettype == FLOWINT_TARGET_VAR) { if (sfd->targettype == FLOWINT_TARGET_VAR) {
sfd->target.tvar.idx = VariableNameGetIdx(sfd->target.tvar.name, DETECT_FLOWINT); sfd->target.tvar.idx = VariableNameGetIdx(det_ctx->de_ctx, sfd->target.tvar.name, DETECT_FLOWINT);
fvt = FlowVarGet(p->flow, sfd->target.tvar.idx); fvt = FlowVarGet(p->flow, sfd->target.tvar.idx);
/* We don't have that variable initialized yet */ /* We don't have that variable initialized yet */
@ -335,7 +335,7 @@ DetectFlowintData *DetectFlowintParse(DetectEngineCtx *de_ctx,
/* Set the name of the origin var to modify/compared with the target */ /* Set the name of the origin var to modify/compared with the target */
sfd->name = SCStrdup(varname); sfd->name = SCStrdup(varname);
if (de_ctx != NULL) if (de_ctx != NULL)
sfd->idx = VariableNameGetIdx(varname, DETECT_FLOWINT); sfd->idx = VariableNameGetIdx(de_ctx, varname, DETECT_FLOWINT);
sfd->target.value =(uint32_t) value_long; sfd->target.value =(uint32_t) value_long;
sfd->modifier = modifier; sfd->modifier = modifier;

2
src/detect-flowvar.c
Unescape Escape View File

@ -222,7 +222,7 @@ static int DetectFlowvarSetup (DetectEngineCtx *de_ctx, Signature *s, char *raws
} }
cd->name = SCStrdup(varname); cd->name = SCStrdup(varname);
cd->idx = VariableNameGetIdx(varname,DETECT_FLOWVAR); cd->idx = VariableNameGetIdx(de_ctx, varname, DETECT_FLOWVAR);
memcpy(cd->content, str, len); memcpy(cd->content, str, len);
cd->content_len = len; cd->content_len = len;
cd->flags = 0; cd->flags = 0;

4
src/detect-pcre.c
Unescape Escape View File

@ -1054,9 +1054,9 @@ DetectPcreData *DetectPcreParseCapture(char *regexstr, DetectEngineCtx *de_ctx,
} }
if (capture_str_ptr != NULL) { if (capture_str_ptr != NULL) {
if (pd->flags & DETECT_PCRE_CAPTURE_PKT) if (pd->flags & DETECT_PCRE_CAPTURE_PKT)
pd->capidx = VariableNameGetIdx((char *)capture_str_ptr,DETECT_PKTVAR); pd->capidx = VariableNameGetIdx(de_ctx, (char *)capture_str_ptr, DETECT_PKTVAR);
else if (pd->flags & DETECT_PCRE_CAPTURE_FLOW) else if (pd->flags & DETECT_PCRE_CAPTURE_FLOW)
pd->capidx = VariableNameGetIdx((char *)capture_str_ptr,DETECT_FLOWVAR); pd->capidx = VariableNameGetIdx(de_ctx, (char *)capture_str_ptr, DETECT_FLOWVAR);
} }
} }
//printf("DetectPcreParseCapture: pd->capname %s\n", pd->capname ? pd->capname : "NULL"); //printf("DetectPcreParseCapture: pd->capname %s\n", pd->capname ? pd->capname : "NULL");

4
src/detect.h
Unescape Escape View File

@ -571,6 +571,10 @@ typedef struct DetectEngineCtx_ {
HashListTable *sport_hash_table; HashListTable *sport_hash_table;
HashListTable *dport_hash_table; HashListTable *dport_hash_table;
HashListTable *variable_names;
HashListTable *variable_idxs;
uint16_t variable_names_idx;
/* hash table used to cull out duplicate sigs */ /* hash table used to cull out duplicate sigs */
HashListTable *dup_sig_hash_table; HashListTable *dup_sig_hash_table;

46
src/util-var-name.c
Unescape Escape View File

@ -27,10 +27,6 @@
#include "detect.h" #include "detect.h"
#include "util-hashlist.h" #include "util-hashlist.h"
HashListTable *variable_names;
HashListTable *variable_idxs;
uint16_t variable_names_idx;
/** \brief Name2idx mapping structure for flowbits, flowvars and pktvars. */ /** \brief Name2idx mapping structure for flowbits, flowvars and pktvars. */
typedef struct VariableName_ { typedef struct VariableName_ {
char *name; char *name;
@ -104,26 +100,28 @@ static void VariableNameFree(void *data) {
* \retval -1 in case of error * \retval -1 in case of error
* \retval 0 in case of success * \retval 0 in case of success
*/ */
int VariableNameInitHash() { int VariableNameInitHash(DetectEngineCtx *de_ctx) {
variable_names = HashListTableInit(4096, VariableNameHash, VariableNameCompare, VariableNameFree); de_ctx->variable_names = HashListTableInit(4096, VariableNameHash, VariableNameCompare, VariableNameFree);
if (variable_names == NULL) if (de_ctx->variable_names == NULL)
return -1; return -1;
variable_idxs = HashListTableInit(4096, VariableIdxHash, VariableIdxCompare, NULL); de_ctx->variable_idxs = HashListTableInit(4096, VariableIdxHash, VariableIdxCompare, NULL);
if (variable_idxs == NULL) if (de_ctx->variable_idxs == NULL)
return -1; return -1;
variable_names_idx = 0; de_ctx->variable_names_idx = 0;
return 0; return 0;
} }
void VariableNameFreeHash() { void VariableNameFreeHash(DetectEngineCtx *de_ctx) {
if (variable_names != NULL) { if (de_ctx->variable_names != NULL) {
HashListTableFree(variable_names); HashListTableFree(de_ctx->variable_names);
HashListTableFree(variable_idxs); HashListTableFree(de_ctx->variable_idxs);
variable_names = NULL; de_ctx->variable_names = NULL;
variable_idxs = NULL; de_ctx->variable_idxs = NULL;
} }
return;
} }
/** \brief Get a name idx for a name. If the name is already used reuse the idx. /** \brief Get a name idx for a name. If the name is already used reuse the idx.
@ -132,7 +130,7 @@ void VariableNameFreeHash() {
* \retval 0 in case of error * \retval 0 in case of error
* \retval _ the idx. * \retval _ the idx.
*/ */
uint16_t VariableNameGetIdx(char *name, uint8_t type) { uint16_t VariableNameGetIdx(DetectEngineCtx *de_ctx, char *name, uint8_t type) {
uint16_t idx = 0; uint16_t idx = 0;
VariableName *fn = SCMalloc(sizeof(VariableName)); VariableName *fn = SCMalloc(sizeof(VariableName));
@ -146,13 +144,13 @@ uint16_t VariableNameGetIdx(char *name, uint8_t type) {
if (fn->name == NULL) if (fn->name == NULL)
goto error; goto error;
VariableName *lookup_fn = (VariableName *)HashListTableLookup(variable_names, (void *)fn, 0); VariableName *lookup_fn = (VariableName *)HashListTableLookup(de_ctx->variable_names, (void *)fn, 0);
if (lookup_fn == NULL) { if (lookup_fn == NULL) {
variable_names_idx++; de_ctx->variable_names_idx++;
idx = fn->idx = variable_names_idx; idx = fn->idx = de_ctx->variable_names_idx;
HashListTableAdd(variable_names, (void *)fn, 0); HashListTableAdd(de_ctx->variable_names, (void *)fn, 0);
HashListTableAdd(variable_idxs, (void *)fn, 0); HashListTableAdd(de_ctx->variable_idxs, (void *)fn, 0);
} else { } else {
idx = lookup_fn->idx; idx = lookup_fn->idx;
VariableNameFree(fn); VariableNameFree(fn);
@ -170,7 +168,7 @@ error:
* \retval NULL in case of error * \retval NULL in case of error
* \retval name of the variable if successful. * \retval name of the variable if successful.
*/ */
char *VariableIdxGetName(uint16_t idx, uint8_t type) char *VariableIdxGetName(DetectEngineCtx *de_ctx, uint16_t idx, uint8_t type)
{ {
VariableName *fn = SCMalloc(sizeof(VariableName)); VariableName *fn = SCMalloc(sizeof(VariableName));
if (fn == NULL) if (fn == NULL)
@ -182,7 +180,7 @@ char *VariableIdxGetName(uint16_t idx, uint8_t type)
fn->type = type; fn->type = type;
fn->idx = idx; fn->idx = idx;
VariableName *lookup_fn = (VariableName *)HashListTableLookup(variable_idxs, (void *)fn, 0); VariableName *lookup_fn = (VariableName *)HashListTableLookup(de_ctx->variable_idxs, (void *)fn, 0);
if (lookup_fn != NULL) { if (lookup_fn != NULL) {
name = SCStrdup(lookup_fn->name); name = SCStrdup(lookup_fn->name);
if (name == NULL) if (name == NULL)

8
src/util-var-name.h
Unescape Escape View File

@ -24,11 +24,11 @@
#ifndef __UTIL_VAR_NAME_H__ #ifndef __UTIL_VAR_NAME_H__
#define __UTIL_VAR_NAME_H__ #define __UTIL_VAR_NAME_H__
int VariableNameInitHash(); int VariableNameInitHash(DetectEngineCtx *);
void VariableNameFreeHash(); void VariableNameFreeHash(DetectEngineCtx *);
uint16_t VariableNameGetIdx(char *, uint8_t); uint16_t VariableNameGetIdx(DetectEngineCtx *, char *, uint8_t);
char * VariableIdxGetName(uint16_t , uint8_t); char * VariableIdxGetName(DetectEngineCtx *, uint16_t , uint8_t);
#endif #endif

Write Preview
Loading…
Cancel
Save