Пример #1
0
int  mpsePrepPatterns  ( void * pvoid )
{
  int retv;
  MPSE * p = (MPSE*)pvoid;

  switch( p->method )
   {
     case MPSE_AC_BNFA:
       retv = bnfaCompile( (bnfa_struct_t*) p->obj);
     break;
     
     case MPSE_AC:
       retv = acsmCompile( (ACSM_STRUCT*) p->obj);
     break;
     
     case MPSE_ACF:
     case MPSE_ACS:
     case MPSE_ACB:
     case MPSE_ACSB:
       retv = acsmCompile2( (ACSM_STRUCT2*) p->obj);
     break;
     
     case MPSE_LOWMEM:
       return KTrieCompile( (KTRIE_STRUCT *)p->obj);

     default:
       retv = 1;
     break; 
   }
  
  return retv;
}
Пример #2
0
Файл: mpse.c Проект: eqmcc/snort
int  mpsePrepPatterns  ( void * pvoid,
                         int ( *build_tree )(void *id, void **existing_tree),
                         int ( *neg_list_func )(void *id, void **list) )
{
  int retv;
  MPSE * p = (MPSE*)pvoid;

  switch( p->method )
   {
     case MPSE_AC_BNFA:
     case MPSE_AC_BNFA_Q:
       retv = bnfaCompile( (bnfa_struct_t*) p->obj, build_tree, neg_list_func );
     break;

     case MPSE_AC:
       retv = acsmCompile( (ACSM_STRUCT*) p->obj, build_tree, neg_list_func );
     break;

     case MPSE_ACF:
     case MPSE_ACF_Q:
     case MPSE_ACS:
     case MPSE_ACB:
     case MPSE_ACSB:
       retv = acsmCompile2( (ACSM_STRUCT2*) p->obj, build_tree, neg_list_func );
     break;

     case MPSE_LOWMEM:
     case MPSE_LOWMEM_Q:
       return KTrieCompile( (KTRIE_STRUCT *)p->obj, build_tree, neg_list_func );

#ifdef INTEL_SOFT_CPM
     case MPSE_INTEL_CPM:
       return IntelPmFinishGroup((IntelPm *)p->obj, build_tree, neg_list_func);
#endif

     default:
       retv = 1;
     break;
   }

  return retv;
}
Пример #3
0
int32_t nvmStringMatchCoproInjectData (nvmCoprocessorState *c, uint8_t *data) {
	uint32_t /*byte_order,*/ pattern_data;
	uint16_t g, i, patterns_no, pattern_length, pattern_nocase;
	nvmStringMatchCoproInternalData *smcdata = c -> data;
	nvmStringMatchCoproPattern *p, *q;
	int32_t out;

	smdebug ("String-matching coprocessor initialising\n");

	/* Get first byte, which contains info on the data */
// 	byte_order = *(uint32_t *) data;
// 	data += SIZE_DD;		// So that it points to pattern data

	smcdata -> patterns = NULL;

	smcdata -> graphs_no = *(uint16_t *) data;
	data += SIZE_DW;
	smdebug ("* %hd pattern groups\n", smcdata -> graphs_no);
	smcdata -> acsm = (ACSM_STRUCT2 **) malloc (sizeof (ACSM_STRUCT2 *) * smcdata -> graphs_no);

	/* Read data for all graphs */
	for (g = 0; g < smcdata -> graphs_no; g++) {
		/* Init Aho-Corasick state machine */
		smcdata -> acsm[g] = acsmNew2 ();
		smcdata -> acsm[g] -> acsmFormat = ACF_FULL;		// For the moment...

		patterns_no = *(uint16_t *) data;
		data += SIZE_DW;
		smdebug ("* %hd patterns\n", patterns_no);
		for (i = 0; i < patterns_no; i++) {
			pattern_length = *(uint16_t *) data;
			data += SIZE_DW;
			smdebug ("* Pattern:\n  - Length: %hd\n", pattern_length);
			pattern_nocase = *(uint16_t *) data;
			data += SIZE_DW;
			smdebug ("  - Nocase: %hd\n", pattern_nocase);
			pattern_data = *(uint32_t *) data;
			data += SIZE_DD;
			smdebug ("  - Data: %u\n", pattern_data);

			smdebug ("  - Text: \"");
			print_pattern ((char *)data, pattern_length);
			smdebug ("\"\n");

			/* Add pattern to list */
			if (!(p = (nvmStringMatchCoproPattern *) malloc (sizeof (nvmStringMatchCoproPattern)))) {
				fprintf (stderr, "Cannot allocate memory for pattern\n");
				exit (9);
			}
			p -> pattern = (char *) malloc (pattern_length * SIZE_DB);
			memcpy (p -> pattern, data, pattern_length);
			p -> len = pattern_length;
			p -> data = pattern_data;
			p -> next = NULL;

			/* Append new pattern to list */
			if (smcdata -> patterns != NULL) {
				for (q = smcdata -> patterns; q -> next; q = q -> next)
					;
				q -> next = p;
			} else {
				smcdata -> patterns = p;
			}

			/* Add pattern to Aho-Corasick SM */
			acsmAddPattern2 (smcdata -> acsm[g], data, pattern_length, pattern_nocase, 0, 0, p, i);
			smcdata -> patterns_no++;

			/* On with next pattern */
			data += pattern_length * SIZE_DB;
		}

		/* All patterns added: compile graph */
	// 	Print_DFA (smcdata -> acsm);
		acsmCompile2 (smcdata -> acsm[g]);
#ifdef COPRO_STRINGMATCH_DEBUG
		acsmPrintInfo2 (smcdata -> acsm[g]);
#endif
	}

	/* Prepare stuff for results */
	smcdata -> matches_no = 0;
	smcdata -> next_match_id = 0;

	out = nvmSUCCESS;

	return (out);
}