79 #define SC_AC_BS_FAIL (-1) 81 #define STATE_QUEUE_CONTAINER_SIZE 65536 119 static void SCACBSGetConfig(
void)
137 static inline int SCACBSInitNewState(
MpmCtx *mpm_ctx)
156 for (ascii_code = 0; ascii_code < 256; ascii_code++) {
191 static void SCACBSSetOutputState(int32_t state, uint32_t pid,
MpmCtx *mpm_ctx)
198 for (i = 0; i < output_state->no_of_entries; i++) {
199 if (output_state->pids[i] == pid)
205 output_state->no_of_entries *
sizeof(uint32_t));
207 SCFree(output_state->pids);
208 output_state->pids = NULL;
212 output_state->pids = ptmp;
214 output_state->pids[output_state->no_of_entries - 1] = pid;
229 static inline void SCACBSEnter(uint8_t *pattern, uint16_t pattern_len, uint32_t pid,
234 int32_t newstate = 0;
240 for (i = 0; i < pattern_len; i++) {
250 for (p = i; p < pattern_len; p++) {
251 newstate = SCACBSInitNewState(mpm_ctx);
252 ctx->
goto_table[state][pattern[p]] = newstate;
258 SCACBSSetOutputState(state, pid, mpm_ctx);
269 static inline void SCACBSCreateGotoTable(
MpmCtx *mpm_ctx)
281 for (ascii_code = 0; ascii_code < 256; ascii_code++) {
290 static inline int SCACBSStateQueueIsEmpty(
StateQueue *q)
298 static inline void SCACBSEnqueue(
StateQueue *q, int32_t state)
303 for (i = q->
bot; i < q->
top; i++) {
304 if (q->
store[i] == state)
315 "Fatal Error. Exiting. Please file a bug report on this");
322 static inline int32_t SCACBSDequeue(
StateQueue *q)
329 "Fatal Error. Exiting. Please file a bug report on this");
377 static inline void SCACBSClubOutputStates(int32_t dst_state, int32_t src_state,
388 for (i = 0; i < output_src_state->no_of_entries; i++) {
389 for (j = 0; j < output_dst_state->no_of_entries; j++) {
390 if (output_src_state->pids[i] == output_dst_state->pids[j]) {
394 if (j == output_dst_state->no_of_entries) {
398 (output_dst_state->no_of_entries *
sizeof(uint32_t)));
400 SCFree(output_dst_state->pids);
401 output_dst_state->pids = NULL;
406 output_dst_state->pids = ptmp;
409 output_dst_state->pids[output_dst_state->no_of_entries - 1] =
410 output_src_state->pids[i];
423 static inline void SCACBSCreateFailureTable(
MpmCtx *mpm_ctx)
445 for (ascii_code = 0; ascii_code < 256; ascii_code++) {
446 int32_t temp_state = ctx->
goto_table[0][ascii_code];
447 if (temp_state != 0) {
448 SCACBSEnqueue(&q, temp_state);
453 while (!SCACBSStateQueueIsEmpty(&q)) {
455 r_state = SCACBSDequeue(&q);
456 for (ascii_code = 0; ascii_code < 256; ascii_code++) {
457 int32_t temp_state = ctx->
goto_table[r_state][ascii_code];
460 SCACBSEnqueue(&q, temp_state);
466 SCACBSClubOutputStates(temp_state, ctx->
failure_table[temp_state],
480 static inline void SCACBSCreateDeltaTable(
MpmCtx *mpm_ctx)
503 for (ascii_code = 0; ascii_code < 256; ascii_code++) {
507 SCACBSEnqueue(&q, temp_state);
510 while (!SCACBSStateQueueIsEmpty(&q)) {
511 r_state = SCACBSDequeue(&q);
513 for (ascii_code = 0; ascii_code < 256; ascii_code++) {
514 int32_t temp_state = ctx->
goto_table[r_state][ascii_code];
516 SCACBSEnqueue(&q, temp_state);
544 for (ascii_code = 0; ascii_code < 256; ascii_code++) {
548 SCACBSEnqueue(&q, temp_state);
551 while (!SCACBSStateQueueIsEmpty(&q)) {
552 r_state = SCACBSDequeue(&q);
554 for (ascii_code = 0; ascii_code < 256; ascii_code++) {
555 int32_t temp_state = ctx->
goto_table[r_state][ascii_code];
557 SCACBSEnqueue(&q, temp_state);
570 static inline void SCACBSClubOutputStatePresenceWithDeltaTable(
MpmCtx *mpm_ctx)
575 uint32_t temp_state = 0;
578 for (state = 0; state < ctx->
state_count; state++) {
579 for (ascii_code = 0; ascii_code < 256; ascii_code++) {
586 for (state = 0; state < ctx->
state_count; state++) {
587 for (ascii_code = 0; ascii_code < 256; ascii_code++) {
598 static inline void SCACBSInsertCaseSensitiveEntriesForPatterns(
MpmCtx *mpm_ctx)
604 for (state = 0; state < ctx->
state_count; state++) {
620 static void SCACBSPrintDeltaTable(
MpmCtx *mpm_ctx)
625 printf(
"##############Delta Table##############\n");
628 for (j = 0; j < 256; j++) {
629 if (SCACBSGetDelta(i, j, mpm_ctx) != 0) {
630 printf(
" %c -> %d\n", j, SCACBSGetDelta(i, j, mpm_ctx));
639 static inline int SCACBSZeroTransitionPresent(
SCACBSCtx *ctx, uint32_t state)
646 for (ascii = 0; ascii < 256; ascii++) {
655 for (ascii = 0; ascii < 256; ascii++) {
657 (state & 0x00FFFFFF)) {
673 static inline void SCACBSCreateModDeltaTable(
MpmCtx *mpm_ctx)
681 for (state = 1; state < ctx->
state_count; state++) {
684 for (ascii_code = 0; ascii_code < 256; ascii_code++) {
686 if (SCACBSZeroTransitionPresent(ctx, temp_state))
690 size +=
sizeof(uint16_t) * k * 2;
720 uint16_t *no_of_entries = NULL;
721 uint16_t *ascii_codes = NULL;
722 uint16_t ascii_code = 0;
724 for (state = 0; state < ctx->
state_count; state++) {
727 no_of_entries = curr_loc++;
728 ascii_codes = curr_loc;
731 for (ascii_code = 0; ascii_code < 256; ascii_code++) {
733 if (state != 0 && SCACBSZeroTransitionPresent(ctx, temp_state))
736 ascii_codes[k] = ascii_code;
743 no_of_entries[0] = k;
755 for (state = 1; state < ctx->
state_count; state++) {
758 for (ascii_code = 0; ascii_code < 256; ascii_code++) {
760 if (SCACBSZeroTransitionPresent(ctx, temp_state))
764 size +=
sizeof(uint32_t) * k * 2;
794 uint32_t *no_of_entries = NULL;
795 uint32_t *ascii_codes = NULL;
796 uint32_t ascii_code = 0;
798 for (state = 0; state < ctx->
state_count; state++) {
801 no_of_entries = curr_loc++;
802 ascii_codes = curr_loc;
805 for (ascii_code = 0; ascii_code < 256; ascii_code++) {
807 if (state != 0 && SCACBSZeroTransitionPresent(ctx, temp_state))
810 ascii_codes[k] = ascii_code;
817 no_of_entries[0] = k;
835 static inline void SCACBSPrepareStateTable(
MpmCtx *mpm_ctx)
840 SCACBSInitNewState(mpm_ctx);
843 SCACBSCreateGotoTable(mpm_ctx);
845 SCACBSCreateFailureTable(mpm_ctx);
847 SCACBSCreateDeltaTable(mpm_ctx);
849 SCACBSClubOutputStatePresenceWithDeltaTable(mpm_ctx);
851 SCACBSCreateModDeltaTable(mpm_ctx);
854 SCACBSInsertCaseSensitiveEntriesForPatterns(mpm_ctx);
867 SCACBSPrintDeltaTable(mpm_ctx);
893 SCLogDebug(
"no patterns supplied to this mpm_ctx");
907 uint32_t i = 0, p = 0;
910 while(node != NULL) {
951 SCACBSPrepareStateTable(mpm_ctx);
955 if (ctx->
parray[i] != NULL) {
984 if (mpm_thread_ctx->
ctx == NULL) {
1001 if (mpm_ctx->
ctx != NULL)
1005 if (mpm_ctx->
ctx == NULL) {
1037 if (mpm_thread_ctx->
ctx != NULL) {
1039 mpm_thread_ctx->
ctx = NULL;
1065 if (ctx->
parray != NULL) {
1068 if (ctx->
parray[i] != NULL) {
1096 uint32_t state_count;
1097 for (state_count = 0; state_count < ctx->
state_count; state_count++) {
1107 for (i = 0; i < (mpm_ctx->
max_pat_id + 1); i++) {
1163 uint16_t no_of_entries;
1164 uint16_t *ascii_codes;
1166 uint16_t *zero_state = state_table_mod_pointers[0] + 1;
1168 for (i = 0; i < buflen; i++) {
1172 no_of_entries = *(state_table_mod_pointers[state & 0x7FFF]);
1173 if (no_of_entries == 1) {
1174 ascii_codes = state_table_mod_pointers[state & 0x7FFF] + 1;
1176 if (buf_local == ascii_codes[0]) {
1177 state = *(ascii_codes + no_of_entries);;
1179 state = zero_state[buf_local];
1182 if (no_of_entries == 0) {
1187 ascii_codes = state_table_mod_pointers[state & 0x7FFF] + 1;
1189 int high = no_of_entries;
1191 while (low <= high) {
1192 mid = (low + high) / 2;
1193 if (ascii_codes[mid] == buf_local) {
1194 state = ((ascii_codes + no_of_entries))[mid];
1196 }
else if (ascii_codes[mid] < buf_local) {
1202 state = zero_state[buf_local];
1207 if (state & 0x8000) {
1211 for (k = 0; k < nentries; k++) {
1212 if (pids[k] & 0xFFFF0000) {
1213 uint32_t lower_pid = pids[k] & 0x0000FFFF;
1214 if (
SCMemcmp(pid_pat_list[lower_pid].cs,
1215 buf + i - pid_pat_list[lower_pid].patlen + 1,
1216 pid_pat_list[lower_pid].patlen) != 0) {
1220 if (bitarray[(lower_pid) / 8] & (1 << ((lower_pid) % 8))) {
1223 bitarray[(lower_pid) / 8] |= (1 << ((lower_pid) % 8));
1224 PrefilterAddSids(pmq, pid_pat_list[lower_pid].sids,
1225 pid_pat_list[lower_pid].sids_size);
1229 if (bitarray[pids[k] / 8] & (1 << (pids[k] % 8))) {
1232 bitarray[pids[k] / 8] |= (1 << (pids[k] % 8));
1233 PrefilterAddSids(pmq, pid_pat_list[pids[k]].sids,
1234 pid_pat_list[pids[k]].sids_size);
1246 uint32_t no_of_entries;
1247 uint32_t *ascii_codes;
1249 uint32_t *zero_state = state_table_mod_pointers[0] + 1;
1251 for (i = 0; i < buflen; i++) {
1255 no_of_entries = *(state_table_mod_pointers[state & 0x00FFFFFF]);
1256 if (no_of_entries == 1) {
1257 ascii_codes = state_table_mod_pointers[state & 0x00FFFFFF] + 1;
1259 if (buf_local == ascii_codes[0]) {
1260 state = *(ascii_codes + no_of_entries);;
1262 state = zero_state[buf_local];;
1265 if (no_of_entries == 0) {
1270 ascii_codes = state_table_mod_pointers[state & 0x00FFFFFF] + 1;
1272 int high = no_of_entries;
1274 while (low <= high) {
1275 mid = (low + high) / 2;
1276 if (ascii_codes[mid] == buf_local) {
1277 state = ((ascii_codes + no_of_entries))[mid];
1279 }
else if (ascii_codes[mid] < buf_local) {
1285 state = zero_state[buf_local];
1290 if (state & 0xFF000000) {
1294 for (k = 0; k < nentries; k++) {
1295 if (pids[k] & 0xFFFF0000) {
1296 uint32_t lower_pid = pids[k] & 0x0000FFFF;
1297 if (
SCMemcmp(pid_pat_list[lower_pid].cs,
1298 buf + i - pid_pat_list[lower_pid].patlen + 1,
1299 pid_pat_list[lower_pid].patlen) != 0) {
1303 if (bitarray[(lower_pid) / 8] & (1 << ((lower_pid) % 8))) {
1306 bitarray[(lower_pid) / 8] |= (1 << ((lower_pid) % 8));
1307 PrefilterAddSids(pmq, pid_pat_list[lower_pid].sids,
1308 pid_pat_list[lower_pid].sids_size);
1312 if (bitarray[pids[k] / 8] & (1 << (pids[k] % 8))) {
1315 bitarray[pids[k] / 8] |= (1 << (pids[k] % 8));
1316 PrefilterAddSids(pmq, pid_pat_list[pids[k]].sids,
1317 pid_pat_list[pids[k]].sids_size);
1349 uint16_t
offset, uint16_t depth, uint32_t pid,
1353 return MpmAddPattern(mpm_ctx, pat, patlen, offset, depth, pid, sid, flags);
1374 uint16_t
offset, uint16_t depth, uint32_t pid,
1377 return MpmAddPattern(mpm_ctx, pat, patlen, offset, depth, pid, sid, flags);
1383 #ifdef SC_AC_BS_COUNTERS 1385 printf(
"AC Thread Search stats (ctx %p)\n", ctx);
1386 printf(
"Total calls: %" PRIu32
"\n", ctx->
total_calls);
1397 printf(
"MPM AC Information:\n");
1398 printf(
"Memory allocs: %" PRIu32
"\n", mpm_ctx->
memory_cnt);
1399 printf(
"Memory alloced: %" PRIu32
"\n", mpm_ctx->
memory_size);
1400 printf(
" Sizeof:\n");
1401 printf(
" MpmCtx %" PRIuMAX
"\n", (uintmax_t)
sizeof(
MpmCtx));
1402 printf(
" SCACBSCtx: %" PRIuMAX
"\n", (uintmax_t)
sizeof(
SCACBSCtx));
1403 printf(
" MpmPattern %" PRIuMAX
"\n", (uintmax_t)
sizeof(
MpmPattern));
1404 printf(
" MpmPattern %" PRIuMAX
"\n", (uintmax_t)
sizeof(
MpmPattern));
1405 printf(
"Unique Patterns: %" PRIu32
"\n", mpm_ctx->
pattern_cnt);
1406 printf(
"Smallest: %" PRIu32
"\n", mpm_ctx->
minlen);
1407 printf(
"Largest: %" PRIu32
"\n", mpm_ctx->
maxlen);
1408 printf(
"Total states in the state table: %" PRIu32
"\n", ctx->
state_count);
1418 static int SCACBSTest01(
void)
1425 memset(&mpm_ctx, 0,
sizeof(
MpmCtx));
1436 const char *buf =
"abcdefghjiklmnopqrstuvwxyz";
1438 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
1439 (uint8_t *)buf, strlen(buf));
1444 printf(
"1 != %" PRIu32
" ",cnt);
1452 static int SCACBSTest02(
void)
1459 memset(&mpm_ctx, 0,
sizeof(
MpmCtx));
1470 const char *buf =
"abcdefghjiklmnopqrstuvwxyz";
1471 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
1472 (uint8_t *)buf, strlen(buf));
1477 printf(
"0 != %" PRIu32
" ",cnt);
1485 static int SCACBSTest03(
void)
1492 memset(&mpm_ctx, 0x00,
sizeof(
MpmCtx));
1507 const char *buf =
"abcdefghjiklmnopqrstuvwxyz";
1508 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
1509 (uint8_t *)buf, strlen(buf));
1514 printf(
"3 != %" PRIu32
" ",cnt);
1522 static int SCACBSTest04(
void)
1529 memset(&mpm_ctx, 0,
sizeof(
MpmCtx));
1541 const char *buf =
"abcdefghjiklmnopqrstuvwxyz";
1542 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
1543 (uint8_t *)buf, strlen(buf));
1548 printf(
"1 != %" PRIu32
" ",cnt);
1556 static int SCACBSTest05(
void)
1563 memset(&mpm_ctx, 0x00,
sizeof(
MpmCtx));
1575 const char *buf =
"abcdefghjiklmnopqrstuvwxyz";
1576 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
1577 (uint8_t *)buf, strlen(buf));
1582 printf(
"3 != %" PRIu32
" ",cnt);
1590 static int SCACBSTest06(
void)
1597 memset(&mpm_ctx, 0,
sizeof(
MpmCtx));
1607 const char *buf =
"abcd";
1608 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
1609 (uint8_t *)buf, strlen(buf));
1614 printf(
"1 != %" PRIu32
" ",cnt);
1622 static int SCACBSTest07(
void)
1629 memset(&mpm_ctx, 0,
sizeof(
MpmCtx));
1643 MpmAddPatternCS(&mpm_ctx, (uint8_t *)
"AAAAAAAAAA", 10, 0, 0, 4, 0, 0);
1645 MpmAddPatternCS(&mpm_ctx, (uint8_t *)
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
1652 const char *buf =
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
1653 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
1654 (uint8_t *)buf, strlen(buf));
1659 printf(
"135 != %" PRIu32
" ",cnt);
1667 static int SCACBSTest08(
void)
1674 memset(&mpm_ctx, 0,
sizeof(
MpmCtx));
1685 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
1691 printf(
"0 != %" PRIu32
" ",cnt);
1699 static int SCACBSTest09(
void)
1706 memset(&mpm_ctx, 0,
sizeof(
MpmCtx));
1717 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
1718 (uint8_t *)
"ab", 2);
1723 printf(
"1 != %" PRIu32
" ",cnt);
1731 static int SCACBSTest10(
void)
1738 memset(&mpm_ctx, 0,
sizeof(
MpmCtx));
1749 const char *buf =
"01234567890123456789012345678901234567890123456789" 1750 "01234567890123456789012345678901234567890123456789" 1752 "01234567890123456789012345678901234567890123456789" 1753 "01234567890123456789012345678901234567890123456789";
1754 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
1755 (uint8_t *)buf, strlen(buf));
1760 printf(
"1 != %" PRIu32
" ",cnt);
1768 static int SCACBSTest11(
void)
1775 memset(&mpm_ctx, 0,
sizeof(
MpmCtx));
1780 if (
MpmAddPatternCS(&mpm_ctx, (uint8_t *)
"he", 2, 0, 0, 1, 0, 0) == -1)
1782 if (
MpmAddPatternCS(&mpm_ctx, (uint8_t *)
"she", 3, 0, 0, 2, 0, 0) == -1)
1784 if (
MpmAddPatternCS(&mpm_ctx, (uint8_t *)
"his", 3, 0, 0, 3, 0, 0) == -1)
1786 if (
MpmAddPatternCS(&mpm_ctx, (uint8_t *)
"hers", 4, 0, 0, 4, 0, 0) == -1)
1795 const char *buf =
"he";
1796 result &= (
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf,
1799 result &= (
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf,
1802 result &= (
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf,
1805 result &= (
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf,
1815 static int SCACBSTest12(
void)
1822 memset(&mpm_ctx, 0x00,
sizeof(
MpmCtx));
1835 const char *buf =
"abcdefghijklmnopqrstuvwxyz";
1836 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
1837 (uint8_t *)buf, strlen(buf));
1842 printf(
"2 != %" PRIu32
" ",cnt);
1850 static int SCACBSTest13(
void)
1857 memset(&mpm_ctx, 0x00,
sizeof(
MpmCtx));
1863 const char *pat =
"abcdefghijklmnopqrstuvwxyzABCD";
1864 MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0);
1869 const char *buf =
"abcdefghijklmnopqrstuvwxyzABCD";
1870 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
1871 (uint8_t *)buf, strlen(buf));
1876 printf(
"1 != %" PRIu32
" ",cnt);
1884 static int SCACBSTest14(
void)
1891 memset(&mpm_ctx, 0x00,
sizeof(
MpmCtx));
1897 const char *pat =
"abcdefghijklmnopqrstuvwxyzABCDE";
1898 MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0);
1903 const char *buf =
"abcdefghijklmnopqrstuvwxyzABCDE";
1904 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
1905 (uint8_t *)buf, strlen(buf));
1910 printf(
"1 != %" PRIu32
" ",cnt);
1918 static int SCACBSTest15(
void)
1925 memset(&mpm_ctx, 0x00,
sizeof(
MpmCtx));
1931 const char *pat =
"abcdefghijklmnopqrstuvwxyzABCDEF";
1932 MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0);
1937 const char *buf =
"abcdefghijklmnopqrstuvwxyzABCDEF";
1938 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
1939 (uint8_t *)buf, strlen(buf));
1944 printf(
"1 != %" PRIu32
" ",cnt);
1952 static int SCACBSTest16(
void)
1959 memset(&mpm_ctx, 0x00,
sizeof(
MpmCtx));
1965 const char *pat =
"abcdefghijklmnopqrstuvwxyzABC";
1966 MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0);
1971 const char *buf =
"abcdefghijklmnopqrstuvwxyzABC";
1972 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
1973 (uint8_t *)buf, strlen(buf));
1978 printf(
"1 != %" PRIu32
" ",cnt);
1986 static int SCACBSTest17(
void)
1993 memset(&mpm_ctx, 0x00,
sizeof(
MpmCtx));
1999 const char *pat =
"abcdefghijklmnopqrstuvwxyzAB";
2000 MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0);
2005 const char *buf =
"abcdefghijklmnopqrstuvwxyzAB";
2006 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
2007 (uint8_t *)buf, strlen(buf));
2012 printf(
"1 != %" PRIu32
" ",cnt);
2020 static int SCACBSTest18(
void)
2027 memset(&mpm_ctx, 0x00,
sizeof(
MpmCtx));
2033 const char *pat =
"abcde""fghij""klmno""pqrst""uvwxy""z";
2034 MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0);
2039 const char *buf =
"abcde""fghij""klmno""pqrst""uvwxy""z";
2040 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
2041 (uint8_t *)buf, strlen(buf));
2046 printf(
"1 != %" PRIu32
" ",cnt);
2054 static int SCACBSTest19(
void)
2061 memset(&mpm_ctx, 0x00,
sizeof(
MpmCtx));
2067 const char *pat =
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
2068 MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0);
2073 const char *buf =
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
2074 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
2075 (uint8_t *)buf, strlen(buf));
2080 printf(
"1 != %" PRIu32
" ",cnt);
2087 static int SCACBSTest20(
void)
2094 memset(&mpm_ctx, 0x00,
sizeof(
MpmCtx));
2100 const char *pat =
"AAAAA""AAAAA""AAAAA""AAAAA""AAAAA""AAAAA""AA";
2101 MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0);
2106 const char *buf =
"AAAAA""AAAAA""AAAAA""AAAAA""AAAAA""AAAAA""AA";
2107 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
2108 (uint8_t *)buf, strlen(buf));
2113 printf(
"1 != %" PRIu32
" ",cnt);
2121 static int SCACBSTest21(
void)
2128 memset(&mpm_ctx, 0x00,
sizeof(
MpmCtx));
2139 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
2140 (uint8_t *)
"AA", 2);
2145 printf(
"1 != %" PRIu32
" ",cnt);
2153 static int SCACBSTest22(
void)
2160 memset(&mpm_ctx, 0x00,
sizeof(
MpmCtx));
2173 const char *buf =
"abcdefghijklmnopqrstuvwxyz";
2174 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
2175 (uint8_t *)buf, strlen(buf));
2180 printf(
"2 != %" PRIu32
" ",cnt);
2188 static int SCACBSTest23(
void)
2195 memset(&mpm_ctx, 0x00,
sizeof(
MpmCtx));
2206 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
2207 (uint8_t *)
"aa", 2);
2212 printf(
"1 != %" PRIu32
" ",cnt);
2220 static int SCACBSTest24(
void)
2227 memset(&mpm_ctx, 0x00,
sizeof(
MpmCtx));
2238 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
2239 (uint8_t *)
"aa", 2);
2244 printf(
"1 != %" PRIu32
" ",cnt);
2252 static int SCACBSTest25(
void)
2259 memset(&mpm_ctx, 0x00,
sizeof(
MpmCtx));
2271 const char *buf =
"ABCDEFGHIJKLMNOPQRSTUVWXYZ";
2272 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
2273 (uint8_t *)buf, strlen(buf));
2278 printf(
"3 != %" PRIu32
" ",cnt);
2286 static int SCACBSTest26(
void)
2293 memset(&mpm_ctx, 0x00,
sizeof(
MpmCtx));
2304 const char *buf =
"works";
2305 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
2306 (uint8_t *)buf, strlen(buf));
2311 printf(
"3 != %" PRIu32
" ",cnt);
2319 static int SCACBSTest27(
void)
2326 memset(&mpm_ctx, 0,
sizeof(
MpmCtx));
2337 const char *buf =
"tone";
2338 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
2339 (uint8_t *)buf, strlen(buf));
2344 printf(
"0 != %" PRIu32
" ",cnt);
2352 static int SCACBSTest28(
void)
2359 memset(&mpm_ctx, 0,
sizeof(
MpmCtx));
2370 const char *buf =
"tONE";
2371 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
2372 (uint8_t *)buf, strlen(buf));
2377 printf(
"0 != %" PRIu32
" ",cnt);
2385 static int SCACBSTest29(
void)
2392 memset(&mpm_ctx, 0x00,
sizeof(
MpmCtx));
2405 const char *buf =
"abcdefgh";
2406 uint32_t cnt =
SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq,
2407 (uint8_t *)buf, strlen(buf));
2412 printf(
"3 != %" PRIu32
" ",cnt);
2420 static int SCACBSTest30(
void)
2422 uint8_t *buf = (uint8_t *)
"onetwothreefourfivesixseveneightnine";
2423 uint16_t buflen = strlen((
char *)buf);
2429 memset(&th_v, 0,
sizeof(th_v));
2440 "(content:\"onetwothreefourfivesixseveneightnine\"; sid:1;)");
2444 "(content:\"onetwothreefourfivesixseveneightnine\"; fast_pattern:3,3; sid:2;)");
2453 printf(
"if (PacketAlertCheck(p, 1) != 1) failure\n");
2457 printf(
"if (PacketAlertCheck(p, 1) != 2) failure\n");
2463 if (de_ctx != NULL) {
#define SCMemcmp(a, b, c)
int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
void(* PrintCtx)(struct MpmCtx_ *)
int PacketAlertCheck(Packet *p, uint32_t sid)
Check if a certain sid alerted, this is used in the test functions.
void MpmFreePattern(MpmCtx *mpm_ctx, MpmPattern *p)
int PmqSetup(PrefilterRuleStore *)
Setup a pmq.
Signature * SigInit(DetectEngineCtx *, const char *)
Parses a signature and adds it to the Detection Engine Context.
#define MPM_PATTERN_FLAG_NOCASE
void(* InitCtx)(struct MpmCtx_ *)
int32_t(* goto_table)[256]
void(* RegisterUnittests)(void)
void SigCleanSignatures(DetectEngineCtx *de_ctx)
void(* DestroyThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *)
uint16_t single_state_size
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **)
initialize thread specific detection engine context
uint8_t ** state_table_mod_pointers
struct SCACBSCtx_ SCACBSCtx
struct MpmPattern_ * next
main detection engine ctx
#define STATE_QUEUE_CONTAINER_SIZE
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *)
void PmqFree(PrefilterRuleStore *)
Cleanup and free a Pmq.
void SCACBSDestroyCtx(MpmCtx *)
Destroy the mpm context.
#define SC_AC_BS_STATE_TYPE_U32
int SCACBSPreparePatterns(MpmCtx *mpm_ctx)
Process the patterns added to the mpm, and create the internal tables.
int(* Prepare)(struct MpmCtx_ *)
void(* PrintThreadCtx)(struct MpmThreadCtx_ *)
SC_AC_BS_STATE_TYPE_U32(* state_table_u32)[256]
int MpmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
void SCACBSPrintInfo(MpmCtx *mpm_ctx)
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
void SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
SC_AC_BS_STATE_TYPE_U16(* state_table_u16)[256]
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
void(* DestroyCtx)(struct MpmCtx_ *)
int SigGroupCleanup(DetectEngineCtx *de_ctx)
SCACBSPatternList * pid_pat_list
int SCACBSAddPatternCI(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t)
Add a case insensitive pattern. Although we have different calls for adding case sensitive and insens...
struct SCACBSThreadCtx_ SCACBSThreadCtx
uint32_t SCACBSSearch(const MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint32_t buflen)
The aho corasick search function.
Helper structure used by AC during state table creation.
#define MPM_INIT_HASH_SIZE
int SCACBSAddPatternCS(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t)
Add a case sensitive pattern. Although we have different calls for adding case sensitive and insensit...
void(* InitThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *)
void SCACBSPrintSearchStats(MpmThreadCtx *mpm_thread_ctx)
void MpmInitCtx(MpmCtx *mpm_ctx, uint16_t matcher)
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
SCACBSOutputTable * output_table
int32_t store[STATE_QUEUE_CONTAINER_SIZE]
void MpmACBSRegister(void)
Register the aho-corasick mpm.
structure for storing potential rule matches
int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
void SCACBSInitCtx(MpmCtx *)
Initialize the AC context.
#define SC_AC_BS_STATE_TYPE_U16
uint32_t(* Search)(const struct MpmCtx_ *, struct MpmThreadCtx_ *, PrefilterRuleStore *, const uint8_t *, uint32_t)
void SCACBSRegisterTests(void)
Per thread variable structure.
void SCACBSInitThreadCtx(MpmCtx *, MpmThreadCtx *)
Init the mpm thread context.
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
void UTHFreePackets(Packet **p, int numpkts)
UTHFreePackets: function to release the allocated data from UTHBuildPacket and the packet itself...
#define SCLogCritical(err_code,...)
Macro used to log CRITICAL messages.
int(* AddPatternNocase)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t)
int(* AddPattern)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t)
void SCACBSDestroyThreadCtx(MpmCtx *, MpmThreadCtx *)
Destroy the mpm thread context.
struct StateQueue_ StateQueue
Helper structure used by AC during state table creation.
uint32_t pattern_id_bitarray_size
DetectEngineCtx * DetectEngineCtxInit(void)
uint8_t * state_table_mod