From: Victor Julien Date: Wed, 15 Jul 2015 07:53:39 +0000 (+0200) Subject: Sync alversion/appversion types X-Git-Tag: suricata-3.0RC1~241 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=62fa9f09d4fe021cdd6b437ac8f3f26e7620043c;p=thirdparty%2Fsuricata.git Sync alversion/appversion types The app layer state 'version' field is incremented with each update to the state. It is used by the detection engine to see if the current version of the state has already been inspected. Since app layer and detect always run closely together there is no need for a big number here. The detect code really only checks for equal/not-equal, so wrap arounds are not an issue. --- diff --git a/src/app-layer-parser.c b/src/app-layer-parser.c index 2c4d2f8b2c..c79e6142bb 100644 --- a/src/app-layer-parser.c +++ b/src/app-layer-parser.c @@ -128,7 +128,7 @@ struct AppLayerParserState_ { uint8_t flags; /* State version, incremented for each update. Can wrap around. */ - uint16_t version; + uint8_t version; /* Indicates the current transaction that is being inspected. * We have a var per direction. */ uint64_t inspect_id[2]; @@ -606,7 +606,7 @@ AppLayerDecoderEvents *AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alp uint16_t AppLayerParserGetStateVersion(AppLayerParserState *pstate) { SCEnter(); - SCReturnCT((pstate == NULL) ? 0 : pstate->version, "uint16_t"); + SCReturnCT((pstate == NULL) ? 0 : pstate->version, "uint8_t"); } FileContainer *AppLayerParserGetFiles(uint8_t ipproto, AppProto alproto, @@ -871,7 +871,7 @@ int AppLayerParserParse(AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alp goto error; } pstate->version++; - SCLogDebug("app layer parser state version incremented to %"PRIu16, + SCLogDebug("app layer parser state version incremented to %"PRIu8, pstate->version); if (flags & STREAM_EOF) @@ -1166,7 +1166,7 @@ void AppLayerParserStatePrintDetails(AppLayerParserState *pstate) "p->inspect_id[0](%"PRIu64"), " "p->inspect_id[1](%"PRIu64"), " "p->log_id(%"PRIu64"), " - "p->version(%"PRIu16"), " + "p->version(%"PRIu8"), " "p->decoder_events(%p).", pstate, p->inspect_id[0], p->inspect_id[1], p->log_id, p->version, p->decoder_events); diff --git a/src/detect-engine-state.c b/src/detect-engine-state.c index ca6cf3abec..8d5baca8bd 100644 --- a/src/detect-engine-state.c +++ b/src/detect-engine-state.c @@ -243,7 +243,7 @@ static void DeStateFlowRuleAppend(DetectEngineStateFlow *state, Signature *s, } static void DeStateStoreStateVersion(Flow *f, - uint16_t alversion, uint8_t direction) + const uint8_t alversion, uint8_t direction) { f->detect_alversion[direction & STREAM_TOSERVER ? 0 : 1] = alversion; } @@ -373,7 +373,8 @@ static int HasStoredSigs(Flow *f, uint8_t flags) * \retval 1 inspectable state * \retval 2 inspectable state, but no update */ -int DeStateFlowHasInspectableState(Flow *f, AppProto alproto, uint16_t alversion, uint8_t flags) +int DeStateFlowHasInspectableState(Flow *f, AppProto alproto, + const uint8_t alversion, uint8_t flags) { int r = 0; @@ -394,7 +395,7 @@ int DeStateFlowHasInspectableState(Flow *f, AppProto alproto, uint16_t alversion } static int StoreState(DetectEngineThreadCtx *det_ctx, - Flow *f, const uint8_t flags, const uint16_t alversion, + Flow *f, const uint8_t flags, const uint8_t alversion, Signature *s, SigMatch *sm, const uint32_t inspect_flags, const uint16_t file_no_match) { @@ -445,7 +446,7 @@ static void StoreStateTxFileOnly(DetectEngineThreadCtx *det_ctx, * \param check_before_add check for duplicates before adding the sig */ static void StoreStateTx(DetectEngineThreadCtx *det_ctx, - Flow *f, const uint8_t flags, const uint16_t alversion, + Flow *f, const uint8_t flags, const uint8_t alversion, const uint64_t tx_id, void *tx, Signature *s, SigMatch *sm, const uint32_t inspect_flags, const uint16_t file_no_match, int check_before_add) @@ -475,7 +476,7 @@ static void StoreStateTx(DetectEngineThreadCtx *det_ctx, int DeStateDetectStartDetection(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Packet *p, Flow *f, uint8_t flags, - AppProto alproto, uint16_t alversion) + AppProto alproto, const uint8_t alversion) { SigMatch *sm = NULL; uint16_t file_no_match = 0; @@ -978,7 +979,7 @@ static int DoInspectFlowRule(ThreadVars *tv, void DeStateDetectContinueDetection(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p, Flow *f, uint8_t flags, - AppProto alproto, uint16_t alversion) + AppProto alproto, const uint8_t alversion) { uint16_t file_no_match = 0; SigIntId store_cnt = 0; diff --git a/src/detect-engine-state.h b/src/detect-engine-state.h index 4c88ae794a..8efb9445a0 100644 --- a/src/detect-engine-state.h +++ b/src/detect-engine-state.h @@ -178,7 +178,7 @@ void DetectEngineStateFlowFree(DetectEngineStateFlow *state); * \retval 1 Has state. * \retval 0 Has no state. */ -int DeStateFlowHasInspectableState(Flow *f, AppProto alproto, uint16_t alversion, uint8_t flags); +int DeStateFlowHasInspectableState(Flow *f, AppProto alproto, uint8_t alversion, uint8_t flags); /** * \brief Match app layer sig list against app state and store relevant match @@ -198,7 +198,7 @@ int DeStateFlowHasInspectableState(Flow *f, AppProto alproto, uint16_t alversion int DeStateDetectStartDetection(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Packet *p, Flow *f, uint8_t flags, - AppProto alproto, uint16_t alversion); + AppProto alproto, uint8_t alversion); /** * \brief Continue DeState detection of the signatures stored in the state. @@ -214,7 +214,7 @@ int DeStateDetectStartDetection(ThreadVars *tv, DetectEngineCtx *de_ctx, void DeStateDetectContinueDetection(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p, Flow *f, uint8_t flags, - AppProto alproto, uint16_t alversion); + AppProto alproto, uint8_t alversion); /** * \brief Update the inspect id. diff --git a/src/detect.c b/src/detect.c index 04fb11f17d..2b8c0da3d9 100644 --- a/src/detect.c +++ b/src/detect.c @@ -1236,7 +1236,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh StreamMsg *smsg = NULL; Signature *s = NULL; Signature *next_s = NULL; - uint16_t alversion = 0; + uint8_t alversion = 0; int state_alert = 0; int alerts = 0; int app_decoder_events = 0;