aboutsummaryrefslogtreecommitdiffstats
path: root/framework/src/suricata/src/detect.c
diff options
context:
space:
mode:
Diffstat (limited to 'framework/src/suricata/src/detect.c')
-rw-r--r--framework/src/suricata/src/detect.c282
1 files changed, 76 insertions, 206 deletions
diff --git a/framework/src/suricata/src/detect.c b/framework/src/suricata/src/detect.c
index e0b5bfd3..c9a16ead 100644
--- a/framework/src/suricata/src/detect.c
+++ b/framework/src/suricata/src/detect.c
@@ -692,7 +692,7 @@ static StreamMsg *SigMatchSignaturesGetSmsg(Flow *f, Packet *p, uint8_t flags)
/* if the smsg is bigger than the current packet, we will
* process the smsg in a later run */
- if ((head->seq + head->data_len) > (TCP_GET_SEQ(p) + p->payload_len)) {
+ if (SEQ_GT((head->seq + head->data_len), (TCP_GET_SEQ(p) + p->payload_len))) {
SCLogDebug("smsg ends beyond current packet, skipping for now %"PRIu32">%"PRIu32,
(head->seq + head->data_len), (TCP_GET_SEQ(p) + p->payload_len));
goto end;
@@ -711,7 +711,7 @@ static StreamMsg *SigMatchSignaturesGetSmsg(Flow *f, Packet *p, uint8_t flags)
/* if the smsg is bigger than the current packet, we will
* process the smsg in a later run */
- if ((head->seq + head->data_len) > (TCP_GET_SEQ(p) + p->payload_len)) {
+ if (SEQ_GT((head->seq + head->data_len), (TCP_GET_SEQ(p) + p->payload_len))) {
SCLogDebug("smsg ends beyond current packet, skipping for now %"PRIu32">%"PRIu32,
(head->seq + head->data_len), (TCP_GET_SEQ(p) + p->payload_len));
goto end;
@@ -1086,8 +1086,8 @@ static inline void DetectMpmPrefilter(DetectEngineCtx *de_ctx,
}
if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_PACKET) {
/* run the multi packet matcher against the payload of the packet */
- SCLogDebug("search: (%p, maxlen %" PRIu32 ", sgh->sig_cnt %" PRIu32 ")",
- det_ctx->sgh, det_ctx->sgh->mpm_content_maxlen, det_ctx->sgh->sig_cnt);
+ SCLogDebug("search: (%p, minlen %" PRIu32 ", sgh->sig_cnt %" PRIu32 ")",
+ det_ctx->sgh, det_ctx->sgh->mpm_content_minlen, det_ctx->sgh->sig_cnt);
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_PACKET);
PacketPatternSearch(det_ctx, p);
@@ -3105,15 +3105,15 @@ int CreateGroupedAddrListCmpCnt(DetectAddress *a, DetectAddress *b)
return 0;
}
-int CreateGroupedAddrListCmpMpmMaxlen(DetectAddress *a, DetectAddress *b)
+int CreateGroupedAddrListCmpMpmMinlen(DetectAddress *a, DetectAddress *b)
{
if (a->sh == NULL || b->sh == NULL)
return 0;
- if (SMALL_MPM(a->sh->mpm_content_maxlen))
+ if (SMALL_MPM(a->sh->mpm_content_minlen))
return 1;
- if (a->sh->mpm_content_maxlen < b->sh->mpm_content_maxlen)
+ if (a->sh->mpm_content_minlen < b->sh->mpm_content_minlen)
return 1;
return 0;
}
@@ -3139,7 +3139,7 @@ int CreateGroupedAddrList(DetectEngineCtx *de_ctx, DetectAddress *srchead,
for (gr = srchead; gr != NULL; gr = gr->next) {
BUG_ON(gr->ip.family == 0 && !(gr->flags & ADDRESS_FLAG_ANY));
- if (SMALL_MPM(gr->sh->mpm_content_maxlen) && unique_groups > 0)
+ if (SMALL_MPM(gr->sh->mpm_content_minlen) && unique_groups > 0)
unique_groups++;
groups++;
@@ -3280,15 +3280,15 @@ int CreateGroupedPortListCmpCnt(DetectPort *a, DetectPort *b)
return 0;
}
-int CreateGroupedPortListCmpMpmMaxlen(DetectPort *a, DetectPort *b)
+int CreateGroupedPortListCmpMpmMinlen(DetectPort *a, DetectPort *b)
{
if (a->sh == NULL || b->sh == NULL)
return 0;
- if (SMALL_MPM(a->sh->mpm_content_maxlen))
+ if (SMALL_MPM(a->sh->mpm_content_minlen))
return 1;
- if (a->sh->mpm_content_maxlen < b->sh->mpm_content_maxlen)
+ if (a->sh->mpm_content_minlen < b->sh->mpm_content_minlen)
return 1;
return 0;
@@ -3315,7 +3315,7 @@ int CreateGroupedPortList(DetectEngineCtx *de_ctx,HashListTable *port_hash, Dete
SCLogDebug("hash list gr %p", gr);
DetectPortPrint(gr);
- if (SMALL_MPM(gr->sh->mpm_content_maxlen) && unique_groups > 0)
+ if (SMALL_MPM(gr->sh->mpm_content_minlen) && unique_groups > 0)
unique_groups++;
groups++;
@@ -3505,16 +3505,16 @@ int SigAddressPrepareStage2(DetectEngineCtx *de_ctx)
CreateGroupedAddrList(de_ctx,
de_ctx->flow_gh[f].tmp_gh[proto]->ipv4_head, AF_INET,
de_ctx->flow_gh[f].src_gh[proto], groups,
- CreateGroupedAddrListCmpMpmMaxlen, DetectEngineGetMaxSigId(de_ctx));
+ CreateGroupedAddrListCmpMpmMinlen, DetectEngineGetMaxSigId(de_ctx));
CreateGroupedAddrList(de_ctx,
de_ctx->flow_gh[f].tmp_gh[proto]->ipv6_head, AF_INET6,
de_ctx->flow_gh[f].src_gh[proto], groups,
- CreateGroupedAddrListCmpMpmMaxlen, DetectEngineGetMaxSigId(de_ctx));
+ CreateGroupedAddrListCmpMpmMinlen, DetectEngineGetMaxSigId(de_ctx));
CreateGroupedAddrList(de_ctx,
de_ctx->flow_gh[f].tmp_gh[proto]->any_head, AF_UNSPEC,
de_ctx->flow_gh[f].src_gh[proto], groups,
- CreateGroupedAddrListCmpMpmMaxlen, DetectEngineGetMaxSigId(de_ctx));
+ CreateGroupedAddrListCmpMpmMinlen, DetectEngineGetMaxSigId(de_ctx));
DetectAddressHeadFree(de_ctx->flow_gh[f].tmp_gh[proto]);
de_ctx->flow_gh[f].tmp_gh[proto] = NULL;
@@ -3697,7 +3697,8 @@ int BuildDestinationAddressHeads(DetectEngineCtx *de_ctx, DetectAddressHead *hea
* mind the limits we use. */
int groups = (flow ? de_ctx->max_uniq_toserver_dst_groups : de_ctx->max_uniq_toclient_dst_groups);
- CreateGroupedAddrList(de_ctx, tmp_gr_list, family, gr->dst_gh, groups, CreateGroupedAddrListCmpMpmMaxlen, max_idx);
+ CreateGroupedAddrList(de_ctx, tmp_gr_list, family, gr->dst_gh, groups,
+ CreateGroupedAddrListCmpMpmMinlen, max_idx);
/* see if the sig group head of each address group is the
* same as an earlier one. If it is, free our head and use
@@ -3722,62 +3723,6 @@ int BuildDestinationAddressHeads(DetectEngineCtx *de_ctx, DetectAddressHead *hea
printf("PatternMatchPrepareGroup failed\n");
goto error;
}
- if (sgr->sh->mpm_proto_tcp_ctx_ts != NULL) {
- if (de_ctx->mpm_max_patcnt < sgr->sh->mpm_proto_tcp_ctx_ts->pattern_cnt)
- de_ctx->mpm_max_patcnt = sgr->sh->mpm_proto_tcp_ctx_ts->pattern_cnt;
-
- de_ctx->mpm_tot_patcnt += sgr->sh->mpm_proto_tcp_ctx_ts->pattern_cnt;
- }
- if (sgr->sh->mpm_proto_tcp_ctx_tc != NULL) {
- if (de_ctx->mpm_max_patcnt < sgr->sh->mpm_proto_tcp_ctx_tc->pattern_cnt)
- de_ctx->mpm_max_patcnt = sgr->sh->mpm_proto_tcp_ctx_tc->pattern_cnt;
-
- de_ctx->mpm_tot_patcnt += sgr->sh->mpm_proto_tcp_ctx_tc->pattern_cnt;
- }
- if (sgr->sh->mpm_proto_udp_ctx_ts != NULL) {
- if (de_ctx->mpm_max_patcnt < sgr->sh->mpm_proto_udp_ctx_ts->pattern_cnt)
- de_ctx->mpm_max_patcnt = sgr->sh->mpm_proto_udp_ctx_ts->pattern_cnt;
-
- de_ctx->mpm_tot_patcnt += sgr->sh->mpm_proto_udp_ctx_ts->pattern_cnt;
- }
- if (sgr->sh->mpm_proto_udp_ctx_tc != NULL) {
- if (de_ctx->mpm_max_patcnt < sgr->sh->mpm_proto_udp_ctx_tc->pattern_cnt)
- de_ctx->mpm_max_patcnt = sgr->sh->mpm_proto_udp_ctx_tc->pattern_cnt;
-
- de_ctx->mpm_tot_patcnt += sgr->sh->mpm_proto_udp_ctx_tc->pattern_cnt;
- }
- if (sgr->sh->mpm_proto_other_ctx != NULL) {
- if (de_ctx->mpm_max_patcnt < sgr->sh->mpm_proto_other_ctx->pattern_cnt)
- de_ctx->mpm_max_patcnt = sgr->sh->mpm_proto_other_ctx->pattern_cnt;
-
- de_ctx->mpm_tot_patcnt += sgr->sh->mpm_proto_other_ctx->pattern_cnt;
- }
- if (sgr->sh->mpm_uri_ctx_ts != NULL) {
- if (de_ctx->mpm_uri_max_patcnt < sgr->sh->mpm_uri_ctx_ts->pattern_cnt)
- de_ctx->mpm_uri_max_patcnt = sgr->sh->mpm_uri_ctx_ts->pattern_cnt;
-
- de_ctx->mpm_uri_tot_patcnt += sgr->sh->mpm_uri_ctx_ts->pattern_cnt;
- }
- /* dbg */
- if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && sgr->sh->mpm_proto_tcp_ctx_ts) {
- de_ctx->mpm_memory_size += sgr->sh->mpm_proto_tcp_ctx_ts->memory_size;
- }
- if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && sgr->sh->mpm_proto_tcp_ctx_tc) {
- de_ctx->mpm_memory_size += sgr->sh->mpm_proto_tcp_ctx_tc->memory_size;
- }
- if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && sgr->sh->mpm_proto_udp_ctx_ts) {
- de_ctx->mpm_memory_size += sgr->sh->mpm_proto_udp_ctx_ts->memory_size;
- }
- if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && sgr->sh->mpm_proto_udp_ctx_tc) {
- de_ctx->mpm_memory_size += sgr->sh->mpm_proto_udp_ctx_tc->memory_size;
- }
- if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && sgr->sh->mpm_proto_other_ctx) {
- de_ctx->mpm_memory_size += sgr->sh->mpm_proto_other_ctx->memory_size;
- }
- if (!(sgr->sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY) && sgr->sh->mpm_uri_ctx_ts) {
- de_ctx->mpm_memory_size += sgr->sh->mpm_uri_ctx_ts->memory_size;
- }
-
SigGroupHeadHashAdd(de_ctx, sgr->sh);
SigGroupHeadStore(de_ctx, sgr->sh);
de_ctx->gh_unique++;
@@ -3871,7 +3816,8 @@ int BuildDestinationAddressHeadsWithBothPorts(DetectEngineCtx *de_ctx, DetectAdd
* mind the limits we use. */
int groups = (flow ? de_ctx->max_uniq_toserver_dst_groups : de_ctx->max_uniq_toclient_dst_groups);
- CreateGroupedAddrList(de_ctx, tmp_gr_list, family, src_gr->dst_gh, groups, CreateGroupedAddrListCmpMpmMaxlen, max_idx);
+ CreateGroupedAddrList(de_ctx, tmp_gr_list, family, src_gr->dst_gh, groups,
+ CreateGroupedAddrListCmpMpmMinlen, max_idx);
/* add the ports to the dst address groups and the sigs
* to the ports */
@@ -3922,7 +3868,8 @@ int BuildDestinationAddressHeadsWithBothPorts(DetectEngineCtx *de_ctx, DetectAdd
int spgroups = (flow ? de_ctx->max_uniq_toserver_sp_groups : de_ctx->max_uniq_toclient_sp_groups);
- CreateGroupedPortList(de_ctx, de_ctx->sport_hash_table, &dst_gr->port, spgroups, CreateGroupedPortListCmpMpmMaxlen, max_idx);
+ CreateGroupedPortList(de_ctx, de_ctx->sport_hash_table, &dst_gr->port, spgroups,
+ CreateGroupedPortListCmpMpmMinlen, max_idx);
SCLogDebug("adding sgh %p to the hash", dst_gr->sh);
SigGroupHeadHashAdd(de_ctx, dst_gr->sh);
@@ -3978,7 +3925,7 @@ int BuildDestinationAddressHeadsWithBothPorts(DetectEngineCtx *de_ctx, DetectAdd
CreateGroupedPortList(de_ctx, de_ctx->dport_hash_table,
&sp->dst_ph, dpgroups,
- CreateGroupedPortListCmpMpmMaxlen, max_idx);
+ CreateGroupedPortListCmpMpmMinlen, max_idx);
SigGroupHeadSPortHashAdd(de_ctx, sp->sh);
@@ -4010,62 +3957,6 @@ int BuildDestinationAddressHeadsWithBothPorts(DetectEngineCtx *de_ctx, DetectAdd
printf("PatternMatchPrepareGroup failed\n");
goto error;
}
- if (dp->sh->mpm_proto_tcp_ctx_ts != NULL) {
- if (de_ctx->mpm_max_patcnt < dp->sh->mpm_proto_tcp_ctx_ts->pattern_cnt)
- de_ctx->mpm_max_patcnt = dp->sh->mpm_proto_tcp_ctx_ts->pattern_cnt;
-
- de_ctx->mpm_tot_patcnt += dp->sh->mpm_proto_tcp_ctx_ts->pattern_cnt;
- }
- if (dp->sh->mpm_proto_tcp_ctx_tc != NULL) {
- if (de_ctx->mpm_max_patcnt < dp->sh->mpm_proto_tcp_ctx_tc->pattern_cnt)
- de_ctx->mpm_max_patcnt = dp->sh->mpm_proto_tcp_ctx_tc->pattern_cnt;
-
- de_ctx->mpm_tot_patcnt += dp->sh->mpm_proto_tcp_ctx_tc->pattern_cnt;
- }
- if (dp->sh->mpm_proto_udp_ctx_ts != NULL) {
- if (de_ctx->mpm_max_patcnt < dp->sh->mpm_proto_udp_ctx_ts->pattern_cnt)
- de_ctx->mpm_max_patcnt = dp->sh->mpm_proto_udp_ctx_ts->pattern_cnt;
-
- de_ctx->mpm_tot_patcnt += dp->sh->mpm_proto_udp_ctx_ts->pattern_cnt;
- }
- if (dp->sh->mpm_proto_udp_ctx_tc != NULL) {
- if (de_ctx->mpm_max_patcnt < dp->sh->mpm_proto_udp_ctx_tc->pattern_cnt)
- de_ctx->mpm_max_patcnt = dp->sh->mpm_proto_udp_ctx_tc->pattern_cnt;
-
- de_ctx->mpm_tot_patcnt += dp->sh->mpm_proto_udp_ctx_tc->pattern_cnt;
- }
- if (dp->sh->mpm_proto_other_ctx != NULL) {
- if (de_ctx->mpm_max_patcnt < dp->sh->mpm_proto_other_ctx->pattern_cnt)
- de_ctx->mpm_max_patcnt = dp->sh->mpm_proto_other_ctx->pattern_cnt;
-
- de_ctx->mpm_tot_patcnt += dp->sh->mpm_proto_other_ctx->pattern_cnt;
- }
- if (dp->sh->mpm_uri_ctx_ts != NULL) {
- if (de_ctx->mpm_uri_max_patcnt < dp->sh->mpm_uri_ctx_ts->pattern_cnt)
- de_ctx->mpm_uri_max_patcnt = dp->sh->mpm_uri_ctx_ts->pattern_cnt;
-
- de_ctx->mpm_uri_tot_patcnt += dp->sh->mpm_uri_ctx_ts->pattern_cnt;
- }
- /* dbg */
- if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && dp->sh->mpm_proto_tcp_ctx_ts) {
- de_ctx->mpm_memory_size += dp->sh->mpm_proto_tcp_ctx_ts->memory_size;
- }
- if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && dp->sh->mpm_proto_tcp_ctx_tc) {
- de_ctx->mpm_memory_size += dp->sh->mpm_proto_tcp_ctx_tc->memory_size;
- }
- if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && dp->sh->mpm_proto_udp_ctx_ts) {
- de_ctx->mpm_memory_size += dp->sh->mpm_proto_udp_ctx_ts->memory_size;
- }
- if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && dp->sh->mpm_proto_udp_ctx_tc) {
- de_ctx->mpm_memory_size += dp->sh->mpm_proto_udp_ctx_tc->memory_size;
- }
- if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_COPY) && dp->sh->mpm_proto_other_ctx) {
- de_ctx->mpm_memory_size += dp->sh->mpm_proto_other_ctx->memory_size;
- }
- if (!(dp->sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY) && dp->sh->mpm_uri_ctx_ts) {
- de_ctx->mpm_memory_size += dp->sh->mpm_uri_ctx_ts->memory_size;
- }
-
SigGroupHeadDPortHashAdd(de_ctx, dp->sh);
SigGroupHeadStore(de_ctx, dp->sh);
de_ctx->gh_unique++;
@@ -4250,20 +4141,8 @@ int SigAddressPrepareStage3(DetectEngineCtx *de_ctx)
DetectPortSpHashFree(de_ctx);
if (!(de_ctx->flags & DE_QUIET)) {
- SCLogDebug("MPM memory %" PRIuMAX " (dynamic %" PRIu32 ", ctxs %" PRIuMAX ", avg per ctx %" PRIu32 ")",
- de_ctx->mpm_memory_size + ((de_ctx->mpm_unique + de_ctx->mpm_uri_unique) * (uintmax_t)sizeof(MpmCtx)),
- de_ctx->mpm_memory_size, ((de_ctx->mpm_unique + de_ctx->mpm_uri_unique) * (uintmax_t)sizeof(MpmCtx)),
- de_ctx->mpm_unique ? de_ctx->mpm_memory_size / de_ctx->mpm_unique: 0);
-
SCLogDebug("max sig id %" PRIu32 ", array size %" PRIu32 "", DetectEngineGetMaxSigId(de_ctx), DetectEngineGetMaxSigId(de_ctx) / 8 + 1);
SCLogDebug("signature group heads: unique %" PRIu32 ", copies %" PRIu32 ".", de_ctx->gh_unique, de_ctx->gh_reuse);
- SCLogDebug("MPM instances: %" PRIu32 " unique, copies %" PRIu32 " (none %" PRIu32 ").",
- de_ctx->mpm_unique, de_ctx->mpm_reuse, de_ctx->mpm_none);
- SCLogDebug("MPM (URI) instances: %" PRIu32 " unique, copies %" PRIu32 " (none %" PRIu32 ").",
- de_ctx->mpm_uri_unique, de_ctx->mpm_uri_reuse, de_ctx->mpm_uri_none);
- SCLogDebug("MPM max patcnt %" PRIu32 ", avg %" PRIu32 "", de_ctx->mpm_max_patcnt, de_ctx->mpm_unique?de_ctx->mpm_tot_patcnt/de_ctx->mpm_unique:0);
- if (de_ctx->mpm_uri_tot_patcnt && de_ctx->mpm_uri_unique)
- SCLogDebug("MPM (URI) max patcnt %" PRIu32 ", avg %" PRIu32 " (%" PRIu32 "/%" PRIu32 ")", de_ctx->mpm_uri_max_patcnt, de_ctx->mpm_uri_tot_patcnt/de_ctx->mpm_uri_unique, de_ctx->mpm_uri_tot_patcnt, de_ctx->mpm_uri_unique);
SCLogDebug("port maxgroups: %" PRIu32 ", avg %" PRIu32 ", tot %" PRIu32 "", g_groupportlist_maxgroups, g_groupportlist_groupscnt ? g_groupportlist_totgroups/g_groupportlist_groupscnt : 0, g_groupportlist_totgroups);
SCLogInfo("building signature grouping structure, stage 3: building destination address lists... complete");
@@ -4376,6 +4255,9 @@ int SigAddressPrepareStage4(DetectEngineCtx *de_ctx)
SCLogDebug("filestore count %u", sgh->filestore_cnt);
SigGroupHeadBuildNonMpmArray(de_ctx, sgh);
+
+ sgh->mpm_uricontent_minlen = SigGroupHeadGetMinMpmSize(de_ctx, sgh, DETECT_SM_LIST_UMATCH);
+ SCLogDebug("http_uri content min mpm len: %u", sgh->mpm_uricontent_minlen);
}
if (de_ctx->decoder_event_sgh != NULL) {
@@ -4471,7 +4353,7 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx)
DetectPort *dp = sp->dst_ph;
for ( ; dp != NULL; dp = dp->next) {
printf(" 4 Dst port(range): "); DetectPortPrint(dp);
- printf(" (sigs %" PRIu32 ", sgh %p, maxlen %" PRIu32 ")", dp->sh->sig_cnt, dp->sh, dp->sh->mpm_content_maxlen);
+ printf(" (sigs %" PRIu32 ", sgh %p, minlen %" PRIu32 ")", dp->sh->sig_cnt, dp->sh, dp->sh->mpm_content_minlen);
#ifdef PRINTSIGS
printf(" - ");
for (u = 0; u < dp->sh->sig_cnt; u++) {
@@ -9913,10 +9795,6 @@ static int SigTestSgh01 (void)
printf("internal id != 0: ");
goto end;
}
- if (de_ctx->sig_list->mpm_content_maxlen != 3) {
- printf("de_ctx->sig_list->mpm_content_maxlen %u, expected 3: ", de_ctx->sig_list->mpm_content_maxlen);
- goto end;
- }
de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any 81 (msg:\"2\"; content:\"two\"; content:\"abcd\"; sid:2;)");
if (de_ctx->sig_list->next == NULL) {
@@ -9927,10 +9805,6 @@ static int SigTestSgh01 (void)
printf("internal id != 1: ");
goto end;
}
- if (de_ctx->sig_list->next->mpm_content_maxlen != 4) {
- printf("de_ctx->sig_list->mpm_content_maxlen %u, expected 4: ", de_ctx->sig_list->next->mpm_content_maxlen);
- goto end;
- }
de_ctx->sig_list->next->next = SigInit(de_ctx,"alert tcp any any -> any 80 (msg:\"3\"; content:\"three\"; sid:3;)");
if (de_ctx->sig_list->next->next == NULL) {
@@ -9941,10 +9815,6 @@ static int SigTestSgh01 (void)
printf("internal id != 2: ");
goto end;
}
- if (de_ctx->sig_list->next->next->mpm_content_maxlen != 5) {
- printf("de_ctx->sig_list->next->next->mpm_content_maxlen %u, expected 5: ", de_ctx->sig_list->next->next->mpm_content_maxlen);
- goto end;
- }
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
@@ -9961,8 +9831,8 @@ static int SigTestSgh01 (void)
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
#endif
- if (sgh->mpm_content_maxlen != 3) {
- printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
+ if (sgh->mpm_content_minlen != 3) {
+ printf("sgh->mpm_content_minlen %u, expected 3: ", sgh->mpm_content_minlen);
goto end;
}
@@ -10006,13 +9876,13 @@ static int SigTestSgh01 (void)
#if 0
printf("-\n");
- printf("sgh2->mpm_content_maxlen %u\n", sgh2->mpm_content_maxlen);
- printf("sgh2->mpm_uricontent_maxlen %u\n", sgh2->mpm_uricontent_maxlen);
+ printf("sgh2->mpm_content_minlen %u\n", sgh2->mpm_content_minlen);
+ printf("sgh2->mpm_uricontent_minlen %u\n", sgh2->mpm_uricontent_minlen);
printf("sgh2->sig_cnt %u\n", sgh2->sig_cnt);
printf("sgh2->sig_size %u\n", sgh2->sig_size);
#endif
- if (sgh2->mpm_content_maxlen != 4) {
- printf("sgh2->mpm_content_maxlen %u, expected 4: ", sgh2->mpm_content_maxlen);
+ if (sgh2->mpm_content_minlen != 4) {
+ printf("sgh2->mpm_content_minlen %u, expected 4: ", sgh2->mpm_content_minlen);
goto end;
}
@@ -10084,8 +9954,8 @@ static int SigTestSgh02 (void)
goto end;
}
- if (sgh->mpm_content_maxlen != 3) {
- printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
+ if (sgh->mpm_content_minlen != 3) {
+ printf("sgh->mpm_content_minlen %u, expected 3: ", sgh->mpm_content_minlen);
goto end;
}
@@ -10108,8 +9978,8 @@ static int SigTestSgh02 (void)
goto end;
}
#if 0
- printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
- printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
+ printf("sgh->mpm_content_minlen %u\n", sgh->mpm_content_minlen);
+ printf("sgh->mpm_uricontent_minlen %u\n", sgh->mpm_uricontent_minlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
@@ -10122,8 +9992,8 @@ static int SigTestSgh02 (void)
goto end;
}
- if (sgh->mpm_content_maxlen != 3) {
- printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
+ if (sgh->mpm_content_minlen != 3) {
+ printf("sgh->mpm_content_minlen %u, expected 3: ", sgh->mpm_content_minlen);
goto end;
}
@@ -10144,8 +10014,8 @@ static int SigTestSgh02 (void)
goto end;
}
#if 0
- printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
- printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
+ printf("sgh->mpm_content_minlen %u\n", sgh->mpm_content_minlen);
+ printf("sgh->mpm_uricontent_minlen %u\n", sgh->mpm_uricontent_minlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
@@ -10158,8 +10028,8 @@ static int SigTestSgh02 (void)
goto end;
}
- if (sgh->mpm_content_maxlen != 3) {
- printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
+ if (sgh->mpm_content_minlen != 3) {
+ printf("sgh->mpm_content_minlen %u, expected 3: ", sgh->mpm_content_minlen);
goto end;
}
@@ -10173,8 +10043,8 @@ static int SigTestSgh02 (void)
goto end;
}
#if 0
- printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
- printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
+ printf("sgh->mpm_content_minlen %u\n", sgh->mpm_content_minlen);
+ printf("sgh->mpm_uricontent_minlen %u\n", sgh->mpm_uricontent_minlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
@@ -10188,8 +10058,8 @@ static int SigTestSgh02 (void)
goto end;
}
- if (sgh->mpm_content_maxlen != 3) {
- printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
+ if (sgh->mpm_content_minlen != 3) {
+ printf("sgh->mpm_content_minlen %u, expected 3: ", sgh->mpm_content_minlen);
goto end;
}
@@ -10203,8 +10073,8 @@ static int SigTestSgh02 (void)
goto end;
}
#if 0
- printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
- printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
+ printf("sgh->mpm_content_minlen %u\n", sgh->mpm_content_minlen);
+ printf("sgh->mpm_uricontent_minlen %u\n", sgh->mpm_uricontent_minlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
@@ -10281,14 +10151,14 @@ static int SigTestSgh03 (void)
}
#if 0
printf("-\n");
- printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
- printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
+ printf("sgh->mpm_content_minlen %u\n", sgh->mpm_content_minlen);
+ printf("sgh->mpm_uricontent_minlen %u\n", sgh->mpm_uricontent_minlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
- if (sgh->mpm_content_maxlen != 3) {
- printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
+ if (sgh->mpm_content_minlen != 3) {
+ printf("sgh->mpm_content_minlen %u, expected 3: ", sgh->mpm_content_minlen);
goto end;
}
@@ -10321,8 +10191,8 @@ static int SigTestSgh03 (void)
#if 0
printf("-\n");
printf("sgh %p\n", sgh);
- printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
- printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
+ printf("sgh->mpm_content_minlen %u\n", sgh->mpm_content_minlen);
+ printf("sgh->mpm_uricontent_minlen %u\n", sgh->mpm_uricontent_minlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
@@ -10344,8 +10214,8 @@ static int SigTestSgh03 (void)
goto end;
}
- if (sgh->mpm_content_maxlen != 3) {
- printf("sgh->mpm_content_maxlen %u, expected 3 (%x): ", sgh->mpm_content_maxlen, p->dst.addr_data32[0]);
+ if (sgh->mpm_content_minlen != 3) {
+ printf("sgh->mpm_content_minlen %u, expected 3 (%x): ", sgh->mpm_content_minlen, p->dst.addr_data32[0]);
goto end;
}
@@ -10359,14 +10229,14 @@ static int SigTestSgh03 (void)
}
#if 0
printf("-\n");
- printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
- printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
+ printf("sgh->mpm_content_minlen %u\n", sgh->mpm_content_minlen);
+ printf("sgh->mpm_uricontent_minlen %u\n", sgh->mpm_uricontent_minlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
- if (sgh->mpm_content_maxlen != 3) {
- printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
+ if (sgh->mpm_content_minlen != 3) {
+ printf("sgh->mpm_content_minlen %u, expected 3: ", sgh->mpm_content_minlen);
goto end;
}
@@ -10452,8 +10322,8 @@ static int SigTestSgh04 (void)
goto end;
}
- if (sgh->mpm_content_maxlen != 3) {
- printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
+ if (sgh->mpm_content_minlen != 3) {
+ printf("sgh->mpm_content_minlen %u, expected 3: ", sgh->mpm_content_minlen);
goto end;
}
@@ -10476,8 +10346,8 @@ static int SigTestSgh04 (void)
goto end;
}
#if 0
- printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
- printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
+ printf("sgh->mpm_content_minlen %u\n", sgh->mpm_content_minlen);
+ printf("sgh->mpm_uricontent_minlen %u\n", sgh->mpm_uricontent_minlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
@@ -10490,8 +10360,8 @@ static int SigTestSgh04 (void)
goto end;
}
- if (sgh->mpm_content_maxlen != 3) {
- printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
+ if (sgh->mpm_content_minlen != 3) {
+ printf("sgh->mpm_content_minlen %u, expected 3: ", sgh->mpm_content_minlen);
goto end;
}
@@ -10512,8 +10382,8 @@ static int SigTestSgh04 (void)
goto end;
}
#if 0
- printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
- printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
+ printf("sgh->mpm_content_minlen %u\n", sgh->mpm_content_minlen);
+ printf("sgh->mpm_uricontent_minlen %u\n", sgh->mpm_uricontent_minlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
@@ -10526,8 +10396,8 @@ static int SigTestSgh04 (void)
goto end;
}
- if (sgh->mpm_content_maxlen != 3) {
- printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
+ if (sgh->mpm_content_minlen != 3) {
+ printf("sgh->mpm_content_minlen %u, expected 3: ", sgh->mpm_content_minlen);
goto end;
}
@@ -10541,8 +10411,8 @@ static int SigTestSgh04 (void)
goto end;
}
#if 0
- printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
- printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
+ printf("sgh->mpm_content_minlen %u\n", sgh->mpm_content_minlen);
+ printf("sgh->mpm_uricontent_minlen %u\n", sgh->mpm_uricontent_minlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
@@ -10556,14 +10426,14 @@ static int SigTestSgh04 (void)
}
#if 0
printf("-\n");
- printf("sgh->mpm_content_maxlen %u\n", sgh->mpm_content_maxlen);
- printf("sgh->mpm_uricontent_maxlen %u\n", sgh->mpm_uricontent_maxlen);
+ printf("sgh->mpm_content_minlen %u\n", sgh->mpm_content_minlen);
+ printf("sgh->mpm_uricontent_minlen %u\n", sgh->mpm_uricontent_minlen);
printf("sgh->sig_cnt %u\n", sgh->sig_cnt);
printf("sgh->sig_size %u\n", sgh->sig_size);
printf("sgh->refcnt %u\n", sgh->refcnt);
#endif
- if (sgh->mpm_content_maxlen != 3) {
- printf("sgh->mpm_content_maxlen %u, expected 3: ", sgh->mpm_content_maxlen);
+ if (sgh->mpm_content_minlen != 3) {
+ printf("sgh->mpm_content_minlen %u, expected 3: ", sgh->mpm_content_minlen);
goto end;
}