/*
* Initialize Boyer-Moore-Horspool data for single pattern comparisons
*
* returns: 0 -> success
* !0 -> error,failed
*/
int BoyerContentSetup(Rule *rule, ContentInfo *content)
{
/* XXX: need to precompile the B-M stuff */
if( !content->patternByteForm || !content->patternByteFormLength )
return 0;
content->boyer_ptr = hbm_prep(content->patternByteForm,
content->patternByteFormLength,
content->flags & CONTENT_NOCASE);
if( !content->boyer_ptr )
{
/* error doing compilation. */
_ded.errMsg("Failed to setup pattern match for dynamic rule [%d:%d]\n",
rule->info.genID, rule->info.sigID);
return -1;
}
return 0;
}
/*
* Initialize Boyer-Moore-Horspool data for single pattern comparisons
*
* returns: 0 -> success
* !0 -> error,failed
*/
int BoyerContentSetup(Rule *rule, ContentInfo *content)
{
void *memoryLocation;
/* XXX: need to precompile the B-M stuff */
if( !content->patternByteForm || !content->patternByteFormLength )
return 0;
content->boyer_ptr = hbm_prep(content->patternByteForm,
content->patternByteFormLength,
content->flags & CONTENT_NOCASE);
if( !content->boyer_ptr )
{
/* error doing compilation. */
_ded.errMsg("Failed to setup pattern match for dynamic rule [%d:%d]\n",
rule->info.genID, rule->info.sigID);
return -1;
}
/* Initialize byte_extract pointers */
if (content->offset_refId)
{
if (!rule->ruleData)
{
DynamicEngineFatalMessage("ByteExtract variable '%s' in rule [%d:%d] is used before it is defined.\n",
content->offset_refId, rule->info.genID, rule->info.sigID);
}
memoryLocation = sfghash_find((SFGHASH*)rule->ruleData, content->offset_refId);
if (memoryLocation)
{
content->offset_location = memoryLocation;
}
else
{
DynamicEngineFatalMessage("ByteExtract variable '%s' in rule [%d:%d] is used before it is defined.\n",
content->offset_refId, rule->info.genID, rule->info.sigID);
}
}
if (content->depth_refId)
{
if (!rule->ruleData)
{
DynamicEngineFatalMessage("ByteExtract variable '%s' in rule [%d:%d] is used before it is defined.\n",
content->depth_refId, rule->info.genID, rule->info.sigID);
}
memoryLocation = sfghash_find((SFGHASH*)rule->ruleData, content->depth_refId);
if (memoryLocation)
{
content->depth_location = memoryLocation;
}
else
{
DynamicEngineFatalMessage("ByteExtract variable '%s' in rule [%d:%d] is used before it is defined.\n",
content->depth_refId, rule->info.genID, rule->info.sigID);
}
}
return 0;
}
/*
**
** mwmPrepPatterns:: Prepare the pattern group for searching
**
*/
int mwmPrepPatterns( void * pv )
{
MWM_STRUCT * ps = (MWM_STRUCT *) pv;
int kk;
MWM_PATTERN_STRUCT * plist;
/* Build an array of pointers to the list of Pattern nodes */
ps->msPatArray = (MWM_PATTERN_STRUCT*)calloc( sizeof(MWM_PATTERN_STRUCT), ps->msNumPatterns );
if( !ps->msPatArray )
{
return -1;
}
ps->msNumArray = (unsigned short *)calloc( sizeof(short), ps->msNumPatterns );
if( !ps->msNumArray )
{
return -1;
}
/* Copy the list node info into the Array */
for( kk=0, plist = ps->plist; plist!=NULL && kk < ps->msNumPatterns; plist=plist->next )
{
memcpy( &ps->msPatArray[kk++], plist, sizeof(MWM_PATTERN_STRUCT) );
}
mwmAnalyzePattens( ps );
/* Sort the patterns */
qsort( ps->msPatArray, ps->msNumPatterns, sizeof(MWM_PATTERN_STRUCT), sortcmp );
/* Build the Hash table, and pattern groups, per Wu & Manber */
mwmPrepHashedPatternGroups(ps);
/* Select the Pattern Matcher Class */
if( ps->msNumPatterns < 5 )
{
ps->msMethod = MTH_BM;
}
else
{
ps->msMethod = MTH_MWM;
}
/* Setup Wu-Manber */
if( ps->msMethod == MTH_MWM )
{
/* Build the Bad Char Shift Table per Wu & Manber */
mwmPrepBadCharTable(ps);
/* Build the Bad Word Shift Table per Wu & Manber */
if( (ps->msShiftLen > 1) && ps->msLargeShifts )
{
mbmPrepBadWordTable( ps );
}
/* Min patterns is 1 byte */
if( ps->msShiftLen == 1 )
{
ps->search = mwmSearchExNoBC;
}
/* Min patterns is >1 byte */
else if( (ps->msShiftLen > 1) && !ps->msLargeShifts )
{
ps->search = mwmSearchExBC;
}
/* Min patterns is >1 byte - and we've been asked to use a 2 byte bad words shift instead. */
else if( (ps->msShiftLen > 1) && ps->msLargeShifts && ps->msShift2 )
{
ps->search = mwmSearchExBW;
}
/* Min patterns is >1 byte */
else
{
ps->search = mwmSearchExBC;
}
#ifdef XXXX
// if( ps->msDetails ) /* For testing - show this info */
// mwmGroupDetails( ps );
#endif
}
/* Initialize the Boyer-Moore Pattern data */
if( ps->msMethod == MTH_BM )
{
int i;
/* Allocate and initialize the BMH data for each pattern */
for(i=0;i<ps->msNumPatterns;i++)
{
ps->msPatArray[ i ].psBmh = hbm_prep( ps->msPatArray[ i ].psPat, ps->msPatArray[ i ].psLen );
}
}
return 0;
}