Merge pull request #633 in SNORT/snort3 from hs to master

Squashed commit of the following:

commit 55c5043898a1cc1856d055d576e1518112cd97ff
Author: Russ Combs <rucombs@cisco.com>
Date:   Thu Sep 22 14:25:23 2016 -0400

    fix hyperscan with nocase

diff --git a/src/search_engines/hyperscan.cc b/src/search_engines/hyperscan.cc
index 84c33e68d788690c604973567777130fa6f1cb67..99b138d9e82d980e08828e10b66e0462d792e403 100644 (file)
--- a/src/search_engines/hyperscan.cc
+++ b/src/search_engines/hyperscan.cc
@@ -62,6 +62,11 @@ Pattern::Pattern(
     flags = d.flags;
     user = u;
     user_tree = user_list = nullptr;
+
+    if ( no_case )
+        flags |= HS_FLAG_CASELESS;
+
+    flags |= HS_FLAG_SINGLEMATCH;
 }
 
 void Pattern::escape(const uint8_t* s, unsigned n, bool literal)
@@ -207,7 +212,7 @@ int HyperscanMpse::prep_patterns(SnortConfig* sc)
     for ( auto& p : pvector )
     {
         pats.push_back(p.pat.c_str());
-        flags.push_back(p.flags | HS_FLAG_SINGLEMATCH);
+        flags.push_back(p.flags);
         ids.push_back(id++);
     }
 

diff --git a/src/search_engines/test/hyperscan_test.cc b/src/search_engines/test/hyperscan_test.cc
index 4fc30369c5c1fea358d83ed08af1ac17b432bbd2..30365279ac492a96158a41bb229f8e9f65b00505 100644 (file)
--- a/src/search_engines/test/hyperscan_test.cc
+++ b/src/search_engines/test/hyperscan_test.cc
@@ -222,21 +222,35 @@ TEST(mpse_hs_match, single)
     CHECK(hits == 1);
 }
 
+TEST(mpse_hs_match, nocase)
+{
+    Mpse::PatternDescriptor desc(true, true, false);
+
+    CHECK(hs->add_pattern(nullptr, (uint8_t*)"foo", 3, desc, s_user) == 0);
+    CHECK(hs->prep_patterns(snort_conf) == 0);
+    CHECK(hs->get_pattern_count() == 1);
+
+    hyperscan_setup(snort_conf);
+
+    int state = 0;
+    CHECK(hs->search((uint8_t*)"foo", 3, match, nullptr, &state) == 0);
+    CHECK(hs->search((uint8_t*)"fOo", 3, match, nullptr, &state) == 0);
+    CHECK(hits == 2);
+}
+
 TEST(mpse_hs_match, other)
 {
     Mpse::PatternDescriptor desc(false, true, false);
 
     CHECK(hs->add_pattern(nullptr, (uint8_t*)"foo", 3, desc, s_user) == 0);
-    CHECK(hs->add_pattern(nullptr, (uint8_t*)"\rbar\n", 3, desc, s_user) == 0);
-    CHECK(hs->add_pattern(nullptr, (uint8_t*)"\\(baz\\)", 3, desc, s_user) == 0);
-
     CHECK(hs->prep_patterns(snort_conf) == 0);
-    CHECK(hs->get_pattern_count() == 3);
+    CHECK(hs->get_pattern_count() == 1);
 
     hyperscan_setup(snort_conf);
 
     int state = 0;
     CHECK(hs->search((uint8_t*)"foo", 3, match, nullptr, &state) == 0);
+    CHECK(hs->search((uint8_t*)"fOo", 3, match, nullptr, &state) == 0);
     CHECK(hits == 1);
 }