Skip to content

Commit 4ee904f

Browse files
catenacybervictorjulien
authored andcommitted
detect/integer: support missing modes for u8 prefilter
Ticket: 7865 <=, >=, and != were missing Also warns if an unimplemented mode is tried (cherry picked from commit 287b132)
1 parent 9ddc341 commit 4ee904f

1 file changed

Lines changed: 66 additions & 2 deletions

File tree

src/detect-engine-prefilter-common.c

Lines changed: 66 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -168,7 +168,16 @@ static void ApplyToU8Hash(PrefilterPacketU8HashCtx *ctx, PrefilterPacketHeaderVa
168168
} while (x--);
169169

170170
break;
171-
}
171+
}
172+
case DetectUintModeLte: {
173+
uint8_t x = v.u8[1];
174+
do {
175+
SigsArray *sa = ctx->array[x];
176+
sa->sigs[sa->offset++] = s->num;
177+
} while (x--);
178+
179+
break;
180+
}
172181
case PREFILTER_U8HASH_MODE_GT:
173182
{
174183
int x = v.u8[1] + 1;
@@ -178,7 +187,16 @@ static void ApplyToU8Hash(PrefilterPacketU8HashCtx *ctx, PrefilterPacketHeaderVa
178187
} while (++x < 256);
179188

180189
break;
181-
}
190+
}
191+
case DetectUintModeGte: {
192+
int x = v.u8[1];
193+
do {
194+
SigsArray *sa = ctx->array[x];
195+
sa->sigs[sa->offset++] = s->num;
196+
} while (++x < 256);
197+
198+
break;
199+
}
182200
case PREFILTER_U8HASH_MODE_RA:
183201
{
184202
int x = v.u8[1] + 1;
@@ -188,7 +206,20 @@ static void ApplyToU8Hash(PrefilterPacketU8HashCtx *ctx, PrefilterPacketHeaderVa
188206
} while (++x < v.u8[2]);
189207

190208
break;
209+
}
210+
case DetectUintModeNe: {
211+
for (uint8_t i = 0; i < UINT8_MAX; i++) {
212+
if (i != v.u8[1]) {
213+
SigsArray *sa = ctx->array[i];
214+
sa->sigs[sa->offset++] = s->num;
215+
}
216+
}
217+
if (UINT8_MAX != v.u8[1]) {
218+
SigsArray *sa = ctx->array[UINT8_MAX];
219+
sa->sigs[sa->offset++] = s->num;
191220
}
221+
break;
222+
}
192223
}
193224
}
194225

@@ -305,6 +336,16 @@ static void SetupU8Hash(DetectEngineCtx *de_ctx, HashListTable *hash_table,
305336

306337
break;
307338
}
339+
case DetectUintModeLte: {
340+
uint8_t v = ctx->v1.u8[1];
341+
counts[v] += ctx->cnt;
342+
while (v > 0) {
343+
v--;
344+
counts[v] += ctx->cnt;
345+
}
346+
347+
break;
348+
}
308349
case PREFILTER_U8HASH_MODE_GT:
309350
{
310351
uint8_t v = ctx->v1.u8[1];
@@ -315,6 +356,16 @@ static void SetupU8Hash(DetectEngineCtx *de_ctx, HashListTable *hash_table,
315356

316357
break;
317358
}
359+
case DetectUintModeGte: {
360+
uint8_t v = ctx->v1.u8[1];
361+
counts[v] += ctx->cnt;
362+
while (v < UINT8_MAX) {
363+
v++;
364+
counts[v] += ctx->cnt;
365+
}
366+
367+
break;
368+
}
318369
case PREFILTER_U8HASH_MODE_RA:
319370
{
320371
if (ctx->v1.u8[1] < ctx->v1.u8[2]) {
@@ -327,6 +378,19 @@ static void SetupU8Hash(DetectEngineCtx *de_ctx, HashListTable *hash_table,
327378
}
328379
break;
329380
}
381+
case DetectUintModeNe: {
382+
for (uint8_t i = 0; i < UINT8_MAX; i++) {
383+
if (i != ctx->v1.u8[1]) {
384+
counts[i] += ctx->cnt;
385+
}
386+
}
387+
if (UINT8_MAX != ctx->v1.u8[1]) {
388+
counts[UINT8_MAX] += ctx->cnt;
389+
}
390+
break;
391+
}
392+
default:
393+
SCLogWarning("Prefilter not implemented for mode 0x%x", ctx->v1.u8[0]);
330394
}
331395
}
332396

0 commit comments

Comments
 (0)