Main Page | Modules | Class List | Directories | File List | Class Members | File Members | Related Pages
src / sfutil

mwm.c File Reference

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <ctype.h>
#include "mwm.h"

Go to the source code of this file.

Functions

int FatalError (char *,...)
UINT64 mwmGetPatByteCount ()
void mwmResetByteCount ()
static void init_xlatcase ()
static INLINE void ConvCaseToUpper (unsigned char *s, int m)
static INLINE void ConvCaseToUpperEx (unsigned char *d, unsigned char *s, int m)
HBM_STRUCT * hbm_prepx (HBM_STRUCT *p, unsigned char *pat, int m)
HBM_STRUCT * hbm_prep (unsigned char *pat, int m)
static INLINE unsigned char * hbm_match (HBM_STRUCT *px, unsigned char *text, int n)
void * mwmNew ()
void mwmFree (void *pv)
int mwmAddPatternEx (void *pv, unsigned char *P, int m, unsigned noCase, unsigned offset, unsigned depth, void *id, int iid)
int mwmAddPattern (void *pv, unsigned char *P, int m, unsigned id)
static int bcompare (unsigned char *a, int alen, unsigned char *b, int blen)
static int CDECL sortcmp (const void *e1, const void *e2)
static unsigned HASH16 (unsigned char *T)
static void mwmPrepHashedPatternGroups (MWM_STRUCT *ps)
static void mwmPrepBadCharTable (MWM_STRUCT *ps)
static void mbmPrepBadWordTable (MWM_STRUCT *ps)
void mwmShowStats (void *pv)
static void mwmAnalyzePattens (MWM_STRUCT *ps)
void mwmLargeShifts (void *pv, int flag)
int mwmGetNumPatterns (void *pv)
void mwmSetRuleMask (void *pv, BITOP *rm)
static INLINE int mwmGroupMatch2 (MWM_STRUCT *ps, int index, unsigned char *Tx, unsigned char *T, unsigned char *Tc, int Tleft, void *data, int(*match)(void *, int, void *))
static int mwmSearchExNoBC (MWM_STRUCT *ps, unsigned char *Tx, int n, unsigned char *Tc, int(*match)(void *id, int index, void *data), void *data)
static int mwmSearchExBC (MWM_STRUCT *ps, unsigned char *Tx, int n, unsigned char *Tc, int(*match)(void *id, int index, void *data), void *data)
static int mwmSearchExBW (MWM_STRUCT *ps, unsigned char *Tx, int n, unsigned char *Tc, int(*match)(void *id, int index, void *data), void *data)
static void show_bytes (unsigned n, unsigned char *p)
void mwmGroupDetails (void *pv)
int mwmPrepPatterns (void *pv)
int mwmSearch (void *pv, unsigned char *T, int n, int(*match)(void *id, int index, void *data), void *data)
void mwmFeatures (void)

Variables

static UINT64 iPatCount = 0
static unsigned char xlatcase [256]
static unsigned char S [65536]

Function Documentation

static int bcompare (  unsigned char *  a,
int  alen,
unsigned char *  b,
int  blen
)  [static]
 

Definition at line 598 of file mwm.c.

References memcmp().

Referenced by sortcmp().

static INLINE void ConvCaseToUpper (  unsigned char *  s,
int  m
)  [static]
 

Definition at line 240 of file mwm.c.

References xlatcase.

Referenced by mwmAddPatternEx().

static INLINE void ConvCaseToUpperEx (  unsigned char *  d,
unsigned char *  s,
int  m
)  [static]
 

Definition at line 252 of file mwm.c.

References xlatcase.

Referenced by mwmSearch().

int FatalError (  char *  ,
  ...
) 
 

Referenced by AddConnection(), AddDestination(), AddFuncToOutputList(), AddOptFuncToList(), AddReference(), AddRspFuncToList(), AddSource(), AlertCSVParseArgs(), AllocAddrNode(), Asn1RuleParse(), ByteJumpInit(), ByteJumpParse(), ByteTestInit(), ByteTestParse(), CheckLogDir(), ConfigFileSearch(), Connect(), ConvInit(), ConvPort(), copy_argv(), CreatePidFile(), CreateServerList(), DatabaseInit(), DsizeCheckInit(), ExpandVars(), FatalErrorInvalidArg(), FatalErrorInvalidOption(), FatalErrorNoEnd(), FatalErrorNoOption(), FlowBitsInit(), FlowBitsParse(), FlowInit(), FlowParseArgs(), FlowParseOption(), fpEvalOTN(), Frag2Alloc(), Frag2Init(), Frag2InitPkt(), Frag3InitPkt(), Frag3ParseArgs(), FragBitsInit(), FTPBounceParse(), GenHomenet(), GenObfuscationMask(), GetIP(), GetOutputPlugin(), HttpInspectInit(), IcmpCodeCheckInit(), IcmpIdCheckInit(), IcmpSeqCheckInit(), IcmpTypeCheckInit(), IgnoreAllocAddrNode(), init_winsock(), InitFlowData(), InitFlowStats(), InitIgnoreHosts(), InitIgnorePorts(), IntegrityCheck(), IpAddrSetParse(), IpIdCheckInit(), IpOptionInit(), IpProtoRuleParseFunction(), IpSameCheckInit(), IpTosCheckInit(), IsDataAtInit(), IsDataAtParse(), LogAscii(), main(), mwmPrepHashedPatternGroups(), NewConnection(), NewNode(), NewScan(), OldUnifiedLogPacketAlert(), OpenAlertFile(), OpenAlertSock(), OpenLogFile(), OpenPcap(), OpenSessionFile(), OpenStatsFile(), OrderRuleLists(), OtnXMatchDataInitialize(), ParseActivatedBy(), ParseAlertFastArgs(), ParseARPspoofArgs(), ParseARPspoofHostArgs(), parseCIDR(), ParseClassificationConfig(), ParseClassType(), ParseCmdLine(), ParseConfig(), ParseContentListFile(), ParseConvArgs(), ParseDatabaseArgs(), ParseDsize(), ParseFlowArgs(), ParseFrag2Args(), ParseFragBits(), ParseFragOffset(), ParseIcmpCode(), ParseIcmpType(), ParseIP(), ParseIpList(), ParseIpOptionData(), ParseIpSame(), ParseLogFile(), ParseOutputPlugin(), ParsePattern(), ParsePerfMonitorArgs(), ParsePort(), ParsePortList(), ParsePortscanArgs(), ParsePreprocessor(), ParseReplacePattern(), ParseRule(), ParseRuleOptions(), ParseRulesFile(), ParseRuleTypeDeclaration(), ParseScanmungeArgs(), ParseSession(), ParseSFSuppress(), ParseSFThreshold(), ParseStream4Args(), ParseSyslogArgs(), ParseTag(), ParseTCPFlags(), ParseThreshold2(), PayloadReplaceInit(), PayloadSearchDepth(), PayloadSearchDistance(), PayloadSearchNocase(), PayloadSearchOffset(), PayloadSearchRawbytes(), PayloadSearchRegex(), PayloadSearchWithin(), PortscanAllocAddrNode(), PortscanIgnoreAllocAddrNode(), PortscanIgnoreParseIP(), PortscanInit(), PortscanParseIP(), PrintNetData(), ProcessAlertCommandLine(), ProcessArgs(), ProcessDetectionOptions(), ProcessEventQueue(), ProcessFileOption(), ProcessFlowbitsSize(), ProcessHeadNode(), ProcessIP(), ProcessLogCommandLine(), ProcessOptionList(), ProcessResetMac(), ProcessThresholdOptions(), read_infile(), RealAlertCSV(), RealUnifiedLogAlert(), RealUnifiedLogPacketAlert(), RealUnifiedLogStreamAlert(), ReferenceSystemAdd(), RegisterOutputPlugin(), RegisterPlugin(), RegisterPreprocessor(), RpcCheckInit(), RuleType(), SafeAlloc(), Scan2Init(), ScanParseIp(), ScanParsePort(), SessionInit(), SetChroot(), SetRpcPorts(), SetTelnetPorts(), SetUidGid(), SetupFlowBits(), sfRotatePerformanceStatisticsFile(), SnortAlloc(), SnortEventqInit(), SnortMain(), SnortPcreInit(), SnortPcreParse(), SPAlloc(), Stream4Init(), Stream4InitReassembler(), TagAlloc(), TcpAckCheckInit(), TcpdumpInitLogFile(), TCPFlagCheckInit(), TcpSeqCheckInit(), TcpWinCheckInit(), TtlCheckInit(), UnifiedInit(), UnifiedInitAlertFile(), UnifiedInitFile(), UnifiedInitLogFile(), UnifiedLogData(), UnifiedParseArgs(), VarAlloc(), VarDefine(), VarGet(), WhichProto(), xatou(), XLINK2STATE_ParseArgs(), and XLINK2STATE_Setup().

static unsigned HASH16 (  unsigned char *  T  )  [static]
 

Definition at line 632 of file mwm.c.

Referenced by mwmPrepHashedPatternGroups().

static INLINE unsigned char* hbm_match (  HBM_STRUCT *  px,
unsigned char *  text,
int  n
)  [static]
 

Definition at line 328 of file mwm.c.

References HBM_STRUCT::bcShift, HBM_STRUCT::M, and HBM_STRUCT::P.

HBM_STRUCT* hbm_prep (  unsigned char *  pat,
int  m
) 
 

Definition at line 295 of file mwm.c.

References hbm_prepx().

Referenced by mwmPrepPatterns().

HBM_STRUCT* hbm_prepx (  HBM_STRUCT *  p,
unsigned char *  pat,
int  m
) 
 

Definition at line 268 of file mwm.c.

References HBM_STRUCT::bcShift, HBM_STRUCT::M, memcpy, and HBM_STRUCT::P.

static void init_xlatcase (   )  [static]
 

Definition at line 227 of file mwm.c.

References xlatcase.

static void mbmPrepBadWordTable (  MWM_STRUCT *  ps  )  [static]
 

Definition at line 749 of file mwm.c.

References BWSHIFTABLESIZE, _mwm_struct::msNumPatterns, _mwm_struct::msPatArray, _mwm_struct::msShift2, _mwm_struct::msShiftLen, _mwm_pattern_struct::psLen, and _mwm_pattern_struct::psPat.

Referenced by mwmPrepPatterns().

int mwmAddPattern (  void *  pv,
unsigned char *  P,
int  m,
unsigned  id
) 
 

Definition at line 580 of file mwm.c.

References mwmAddPatternEx().

int mwmAddPatternEx (  void *  pv,
unsigned char *  P,
int  m,
unsigned  noCase,
unsigned  offset,
unsigned  depth,
void *  id,
int  iid
) 
 

Definition at line 439 of file mwm.c.

References ConvCaseToUpper(), memcmp(), memcpy, _mwm_struct::msAvg, _mwm_struct::msLargest, _mwm_struct::msNoCase, _mwm_struct::msNumPatterns, _mwm_struct::msSmallest, _mwm_struct::msTotal, _mwm_pattern_struct::next, NULL, _mwm_struct::plist, _mwm_pattern_struct::psDepth, _mwm_pattern_struct::psID, _mwm_pattern_struct::psIID, _mwm_pattern_struct::psLen, _mwm_pattern_struct::psNoCase, _mwm_pattern_struct::psOffset, _mwm_pattern_struct::psPat, and _mwm_pattern_struct::psPatCase.

Referenced by mpseAddPattern(), and mwmAddPattern().

static void mwmAnalyzePattens (  MWM_STRUCT *  ps  )  [static]
 

Definition at line 830 of file mwm.c.

References memset, _mwm_struct::msLargest, _mwm_struct::msLengths, _mwm_struct::msNumPatterns, _mwm_struct::msPatArray, and _mwm_pattern_struct::psLen.

Referenced by mwmPrepPatterns().

void mwmFeatures (  void   ) 
 

Definition at line 1426 of file mwm.c.

References MWM_FEATURES.

void mwmFree (  void *  pv  ) 
 

Definition at line 419 of file mwm.c.

References _mwm_struct::msHash, _mwm_struct::msNumArray, _mwm_struct::msPatArray, and _mwm_struct::msShift2.

Referenced by mpseFree().

int mwmGetNumPatterns (  void *  pv  ) 
 

Definition at line 862 of file mwm.c.

References _mwm_struct::msNumPatterns.

UINT64 mwmGetPatByteCount (   ) 
 

Definition at line 202 of file mwm.c.

References iPatCount.

void mwmGroupDetails (  void *  pv  ) 
 

Definition at line 1203 of file mwm.c.

References HASH_TYPE, _mwm_struct::msHash, _mwm_struct::msNumArray, _mwm_struct::msPatArray, _mwm_pattern_struct::psLen, _mwm_pattern_struct::psPat, and show_bytes().

static INLINE int mwmGroupMatch2 (  MWM_STRUCT *  ps,
int  index,
unsigned char *  Tx,
unsigned char *  T,
unsigned char *  Tc,
int  Tleft,
void *  data,
int(*)(void *, int, void *)  match
)  [static]
 

Definition at line 890 of file mwm.c.

References boIsBitSet(), HASHBYTES16, memcmp(), _mwm_struct::msNumArray, _mwm_struct::msPatArray, _mwm_pattern_struct::psID, _mwm_pattern_struct::psIID, _mwm_pattern_struct::psLen, _mwm_pattern_struct::psNoCase, _mwm_pattern_struct::psPat, _mwm_pattern_struct::psPatCase, and _mwm_struct::RuleMask.

Referenced by mwmSearchExBC(), mwmSearchExBW(), and mwmSearchExNoBC().

void mwmLargeShifts (  void *  pv,
int  flag
) 
 

Definition at line 853 of file mwm.c.

References _mwm_struct::msLargeShifts.

Referenced by mpseLargeShifts().

void* mwmNew (  void   ) 
 

Definition at line 400 of file mwm.c.

References init_xlatcase(), and _mwm_struct::msSmallest.

Referenced by mpseNew().

static void mwmPrepBadCharTable (  MWM_STRUCT *  ps  )  [static]
 

Definition at line 705 of file mwm.c.

References _mwm_struct::msNumPatterns, _mwm_struct::msPatArray, _mwm_struct::msShift, _mwm_struct::msShiftLen, _mwm_pattern_struct::psLen, and _mwm_pattern_struct::psPat.

Referenced by mwmPrepPatterns().

static void mwmPrepHashedPatternGroups (  MWM_STRUCT *  ps  )  [static]
 

Definition at line 640 of file mwm.c.

References FatalError(), HASH16(), HASH_TYPE, HASHTABLESIZE, and int().

Referenced by mwmPrepPatterns().

int mwmPrepPatterns (  void *  pv  ) 
 

Definition at line 1253 of file mwm.c.

References hbm_prep(), mbmPrepBadWordTable(), memcpy, _mwm_struct::msLargeShifts, _mwm_struct::msMethod, _mwm_struct::msNumArray, _mwm_struct::msNumPatterns, _mwm_struct::msPatArray, _mwm_struct::msShift2, _mwm_struct::msShiftLen, MTH_BM, MTH_MWM, mwmAnalyzePattens(), mwmPrepBadCharTable(), mwmPrepHashedPatternGroups(), mwmSearchExBC(), mwmSearchExBW(), mwmSearchExNoBC(), _mwm_pattern_struct::next, NULL, _mwm_struct::plist, _mwm_pattern_struct::psBmh, _mwm_pattern_struct::psLen, _mwm_pattern_struct::psPat, _mwm_struct::search, and sortcmp().

Referenced by mpsePrepPatterns().

void mwmResetByteCount (   ) 
 

Definition at line 207 of file mwm.c.

References iPatCount.

int mwmSearch (  void *  pv,
unsigned char *  T,
int  n,
int(*)(void *id, int index, void *data)  match,
void *  data
) 
 

Definition at line 1352 of file mwm.c.

References ConvCaseToUpperEx(), hbm_match(), iPatCount, memcmp(), _mwm_struct::msMethod, _mwm_struct::msNumPatterns, _mwm_struct::msPatArray, MTH_BM, NULL, _mwm_pattern_struct::psBmh, _mwm_pattern_struct::psID, _mwm_pattern_struct::psLen, _mwm_pattern_struct::psNoCase, _mwm_pattern_struct::psPatCase, S, and _mwm_struct::search.

Referenced by mpseSearch().

static int mwmSearchExBC (  MWM_STRUCT *  ps,
unsigned char *  Tx,
int  n,
unsigned char *  Tc,
int(*)(void *id, int index, void *data)  match,
void *  data
)  [static]
 

Definition at line 1057 of file mwm.c.

References HASH_TYPE, _mwm_struct::msHash, _mwm_struct::msShift, _mwm_struct::msShiftLen, and mwmGroupMatch2().

Referenced by mwmPrepPatterns().

static int mwmSearchExBW (  MWM_STRUCT *  ps,
unsigned char *  Tx,
int  n,
unsigned char *  Tc,
int(*)(void *id, int index, void *data)  match,
void *  data
)  [static]
 

Definition at line 1129 of file mwm.c.

References HASH_TYPE, _mwm_struct::msHash, _mwm_struct::msShift2, _mwm_struct::msShiftLen, and mwmGroupMatch2().

Referenced by mwmPrepPatterns().

static int mwmSearchExNoBC (  MWM_STRUCT *  ps,
unsigned char *  Tx,
int  n,
unsigned char *  Tc,
int(*)(void *id, int index, void *data)  match,
void *  data
)  [static]
 

Definition at line 967 of file mwm.c.

References HASH_TYPE, _mwm_struct::msHash, _mwm_struct::msHash1, _mwm_struct::msNumArray, _mwm_struct::msPatArray, _mwm_struct::msShiftLen, mwmGroupMatch2(), _mwm_pattern_struct::psID, _mwm_pattern_struct::psNoCase, and _mwm_pattern_struct::psPatCase.

Referenced by mwmPrepPatterns().

void mwmSetRuleMask (  void *  pv,
BITOP *  rm
) 
 

Definition at line 873 of file mwm.c.

References _mwm_struct::RuleMask.

Referenced by mpseSetRuleMask().

void mwmShowStats (  void *  pv  ) 
 

Definition at line 804 of file mwm.c.

References _mwm_struct::msAvg, _mwm_struct::msLargest, _mwm_struct::msLengths, _mwm_struct::msNumPatterns, _mwm_struct::msSmallest, and _mwm_struct::msTotal.

static void show_bytes (  unsigned  n,
unsigned char *  p
)  [static]
 

Definition at line 1189 of file mwm.c.

References int().

Referenced by mwmGroupDetails().

static int CDECL sortcmp (  const void *  e1,
const void *  e2
)  [static]
 

Definition at line 622 of file mwm.c.

References bcompare(), _mwm_pattern_struct::psLen, and _mwm_pattern_struct::psPat.

Referenced by mwmPrepPatterns().

Variable Documentation

UINT64 iPatCount = 0 [static]
 

Definition at line 200 of file mwm.c.

Referenced by mwmGetPatByteCount(), mwmResetByteCount(), and mwmSearch().

unsigned char S[65536] [static]
 

Definition at line 222 of file mwm.c.

Referenced by mwmSearch().

unsigned char xlatcase[256] [static]
 

Definition at line 215 of file mwm.c.

Generated on Sun May 14 14:51:26 2006 by  doxygen 1.4.2