Example #1
0
void * mpseNew( int method, int use_global_counter_flag )
{
    MPSE * p;

    p = (MPSE*)calloc( 1,sizeof(MPSE) );
    if( !p ) return NULL;

    p->method = method;
    p->verbose = 0;
    p->obj = NULL;
    p->bcnt = 0;
    p->inc_global_counter = use_global_counter_flag;

    switch( method )
    {
        case MPSE_AC_BNFA:
            p->obj=bnfaNew();
            return (void*)p;
        case MPSE_AC:
            p->obj = acsmNew();
            return (void*)p;
        case MPSE_ACF:
            p->obj = acsmNew2();
            if(p->obj)acsmSelectFormat2((ACSM_STRUCT2*)p->obj,ACF_FULL  );
            return (void*)p;
        case MPSE_ACS:
            p->obj = acsmNew2();
            if(p->obj)acsmSelectFormat2((ACSM_STRUCT2*)p->obj,ACF_SPARSE  );
            return (void*)p;
        case MPSE_ACB:
            p->obj = acsmNew2();
            if(p->obj)acsmSelectFormat2((ACSM_STRUCT2*)p->obj,ACF_BANDED  );
            return (void*)p;
        case MPSE_ACSB:
            p->obj = acsmNew2();
            if(p->obj)acsmSelectFormat2((ACSM_STRUCT2*)p->obj,ACF_SPARSEBANDS  );
            return (void*)p;
        case MPSE_LOWMEM:
            p->obj = KTrieNew();
            return (void*)p;

        default:
            free(p);
            return 0;
    }
}
Example #2
0
File: mpse.c Project: eqmcc/snort
void * mpseNew( int method, int use_global_counter_flag,
                void (*userfree)(void *p),
                void (*optiontreefree)(void **p),
                void (*neg_list_free)(void **p))
{
    MPSE * p;

    p = (MPSE*)calloc( 1,sizeof(MPSE) );
    if( !p ) return NULL;

    p->method = method;
    p->verbose = 0;
    p->obj = NULL;
    p->bcnt = 0;
    p->inc_global_counter = (char)use_global_counter_flag;

    switch( method )
    {
        case MPSE_AC_BNFA:
            p->obj=bnfaNew(userfree, optiontreefree, neg_list_free);
            if(p->obj)
               ((bnfa_struct_t*)(p->obj))->bnfaMethod = 1;
            break;
        case MPSE_AC_BNFA_Q:
            p->obj=bnfaNew(userfree, optiontreefree, neg_list_free);
            if(p->obj)
               ((bnfa_struct_t*)(p->obj))->bnfaMethod = 0;
            break;
        case MPSE_AC:
            p->obj = acsmNew(userfree, optiontreefree, neg_list_free);
            break;
        case MPSE_ACF:
            p->obj = acsmNew2(userfree, optiontreefree, neg_list_free);
            if(p->obj)acsmSelectFormat2((ACSM_STRUCT2*)p->obj,ACF_FULL  );
            break;
        case MPSE_ACF_Q:
            p->obj = acsmNew2(userfree, optiontreefree, neg_list_free);
            if(p->obj)acsmSelectFormat2((ACSM_STRUCT2*)p->obj,ACF_FULLQ  );
            break;
        case MPSE_ACS:
            p->obj = acsmNew2(userfree, optiontreefree, neg_list_free);
            if(p->obj)acsmSelectFormat2((ACSM_STRUCT2*)p->obj,ACF_SPARSE  );
            break;
        case MPSE_ACB:
            p->obj = acsmNew2(userfree, optiontreefree, neg_list_free);
            if(p->obj)acsmSelectFormat2((ACSM_STRUCT2*)p->obj,ACF_BANDED  );
            break;
        case MPSE_ACSB:
            p->obj = acsmNew2(userfree, optiontreefree, neg_list_free);
            if(p->obj)acsmSelectFormat2((ACSM_STRUCT2*)p->obj,ACF_SPARSEBANDS  );
            break;
        case MPSE_LOWMEM:
            p->obj = KTrieNew(0,userfree, optiontreefree, neg_list_free);
            break;
        case MPSE_LOWMEM_Q:
            p->obj = KTrieNew(1,userfree, optiontreefree, neg_list_free);
            break;
#ifdef INTEL_SOFT_CPM
        case MPSE_INTEL_CPM:
            p->obj=IntelPmNew(userfree, optiontreefree, neg_list_free);
            break;
#endif
        default:
            /* p is free'd below if no case */
            break;
    }

    if( !p->obj )
    {
        free(p);
        p = NULL;
    }

    return (void *)p;
}
int32_t nvmStringMatchCoproInjectData (nvmCoprocessorState *c, uint8_t *data) {
	uint32_t /*byte_order,*/ pattern_data;
	uint16_t g, i, patterns_no, pattern_length, pattern_nocase;
	nvmStringMatchCoproInternalData *smcdata = c -> data;
	nvmStringMatchCoproPattern *p, *q;
	int32_t out;

	smdebug ("String-matching coprocessor initialising\n");

	/* Get first byte, which contains info on the data */
// 	byte_order = *(uint32_t *) data;
// 	data += SIZE_DD;		// So that it points to pattern data

	smcdata -> patterns = NULL;

	smcdata -> graphs_no = *(uint16_t *) data;
	data += SIZE_DW;
	smdebug ("* %hd pattern groups\n", smcdata -> graphs_no);
	smcdata -> acsm = (ACSM_STRUCT2 **) malloc (sizeof (ACSM_STRUCT2 *) * smcdata -> graphs_no);

	/* Read data for all graphs */
	for (g = 0; g < smcdata -> graphs_no; g++) {
		/* Init Aho-Corasick state machine */
		smcdata -> acsm[g] = acsmNew2 ();
		smcdata -> acsm[g] -> acsmFormat = ACF_FULL;		// For the moment...

		patterns_no = *(uint16_t *) data;
		data += SIZE_DW;
		smdebug ("* %hd patterns\n", patterns_no);
		for (i = 0; i < patterns_no; i++) {
			pattern_length = *(uint16_t *) data;
			data += SIZE_DW;
			smdebug ("* Pattern:\n  - Length: %hd\n", pattern_length);
			pattern_nocase = *(uint16_t *) data;
			data += SIZE_DW;
			smdebug ("  - Nocase: %hd\n", pattern_nocase);
			pattern_data = *(uint32_t *) data;
			data += SIZE_DD;
			smdebug ("  - Data: %u\n", pattern_data);

			smdebug ("  - Text: \"");
			print_pattern ((char *)data, pattern_length);
			smdebug ("\"\n");

			/* Add pattern to list */
			if (!(p = (nvmStringMatchCoproPattern *) malloc (sizeof (nvmStringMatchCoproPattern)))) {
				fprintf (stderr, "Cannot allocate memory for pattern\n");
				exit (9);
			}
			p -> pattern = (char *) malloc (pattern_length * SIZE_DB);
			memcpy (p -> pattern, data, pattern_length);
			p -> len = pattern_length;
			p -> data = pattern_data;
			p -> next = NULL;

			/* Append new pattern to list */
			if (smcdata -> patterns != NULL) {
				for (q = smcdata -> patterns; q -> next; q = q -> next)
					;
				q -> next = p;
			} else {
				smcdata -> patterns = p;
			}

			/* Add pattern to Aho-Corasick SM */
			acsmAddPattern2 (smcdata -> acsm[g], data, pattern_length, pattern_nocase, 0, 0, p, i);
			smcdata -> patterns_no++;

			/* On with next pattern */
			data += pattern_length * SIZE_DB;
		}

		/* All patterns added: compile graph */
	// 	Print_DFA (smcdata -> acsm);
		acsmCompile2 (smcdata -> acsm[g]);
#ifdef COPRO_STRINGMATCH_DEBUG
		acsmPrintInfo2 (smcdata -> acsm[g]);
#endif
	}

	/* Prepare stuff for results */
	smcdata -> matches_no = 0;
	smcdata -> next_match_id = 0;

	out = nvmSUCCESS;

	return (out);
}