Merge pull request #841 in SNORT/snort3 from jviiret-hs_valid_platform to master

Squashed commit of the following:

commit 884ae7e5c67ccc845e290b9e9e4002c783dea5b0
Author: Russ Combs <rucombs@cisco.com>
Date:   Thu Mar 23 09:36:00 2017 -0400

    doc updates for optional build features

commit 545015764289686c030d4f8220e0bf35275b5d5d
Author: Justin Viiret <justin.viiret@intel.com>
Date:   Fri Mar 3 10:56:18 2017 +1100

    Check Hyperscan availability when configured

    This checks whether the host have the architectural features required by
    Hyperscan when it is configured with the hs_valid_platform() function.

    On failure, components that use HS (ips_regex, ips_sd_pattern, hyperscan
    MPSE) will produce parse errors.

commit 48cfdcf9f14332c0d9b26022c6a20535ae8ed7f1
Author: Justin Viiret <justin.viiret@intel.com>
Date:   Mon Mar 6 09:40:42 2017 +1100

    autotools: require Hyperscan >= 4.4.0

    This version is required for the hs_valid_platform() function.

commit ea2f8816ca8c016977a6cdf88c39dc01461d5399
Author: Justin Viiret <justin.viiret@intel.com>
Date:   Fri Mar 3 10:03:58 2017 +1100

    cmake: require Hyperscan >= 4.4.0

    This version is required for the hs_valid_platform() function.

diff --git a/cmake/FindHS.cmake b/cmake/FindHS.cmake
index 686701b069bd13e805048f8d3d499c351a85f662..43ee5ec6b7b7dcf7bb6989d689f36794ee943abb 100644 (file)
--- a/cmake/FindHS.cmake
+++ b/cmake/FindHS.cmake
@@ -10,6 +10,6 @@ find_library(HS_LIBRARIES NAMES hs
     HINTS ${HS_LIBRARIES_DIR} ${PC_HYPERSCAN_LIBDIR} ${PC_HYPERSCAN_LIBRARY_DIRS})
 
 include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(HS DEFAULT_MSG HS_LIBRARIES HS_INCLUDE_DIRS)
+find_package_handle_standard_args(HS REQUIRED_VARS HS_LIBRARIES HS_INCLUDE_DIRS VERSION_VAR PC_HYPERSCAN_VERSION)
 
 mark_as_advanced(HS_INCLUDE_DIRS HS_LIBRARIES)

diff --git a/cmake/include_libraries.cmake b/cmake/include_libraries.cmake
index 22f252670294bad25795eb0a27fa355310fc63bb..2880619e57e32e9e87cb6cdeb827e8274fff11fe 100644 (file)
--- a/cmake/include_libraries.cmake
+++ b/cmake/include_libraries.cmake
@@ -19,6 +19,6 @@ find_package(LibLZMA QUIET)
 find_package(Asciidoc QUIET)
 find_package(DBLATEX QUIET)
 find_package(Ruby QUIET 1.8.7)
-find_package(HS QUIET)
+find_package(HS QUIET 4.4.0)
 find_package(SafeC QUIET)
 find_package(FLATBUFFERS QUIET)

diff --git a/configure.ac b/configure.ac
index 47532b4a38fec533eabb718b72ece2900de38b08..c34f0de3694c3588aaf4c356aa677d47eb26d571 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -991,8 +991,8 @@ AM_CONDITIONAL([HAVE_FLATBUFFERS], [test "x$FBS_HEADERS" = "xyes"])
 # hyperscan (optional)
 #--------------------------------------------------------------------------
 
-AC_MSG_CHECKING([for hyperscan pkg-config presence])
-PKG_CHECK_EXISTS([libhs], [ have_hyperscan_pkgconfig="yes" ], [ have_hyperscan_pkgconfig="no" ])
+AC_MSG_CHECKING([for hyperscan >= 4.4.0 pkg-config presence])
+PKG_CHECK_EXISTS([libhs >= 4.4.0], [ have_hyperscan_pkgconfig="yes" ], [ have_hyperscan_pkgconfig="no" ])
 AC_MSG_RESULT(${have_hyperscan_pkgconfig})
 
 HYPERSCAN_CPPFLAGS=""

diff --git a/doc/building.txt b/doc/building.txt
index 6a2281e988dabfbb422ee8d3632c2f364718b8f9..a5b940d3e5ce920039ac356f743a153def555551 100644 (file)
--- a/doc/building.txt
+++ b/doc/building.txt
@@ -5,18 +5,23 @@ into the Snort binary.  For a full list of build options, run ./configure
 *  *--enable-shell*: enable building local and remote command line shell
    support.
 
+* *--enable-tsc-clock*: use the TSC register on x86 systems for improved
+  performance of latency and profiler features.
+
 These options are built only if the required libraries and headers are
 present.  There is no need to explicitly enable.
 
-* *lzma*: for decompression of SWF and PDF files.
+* *flatbuffers*: for an alternative perf_monitor logging format.
 
-* *openssl*: for SHA and MD5 file signatures and the protected_content rule
-  option.
+* *hyperscan* >= 4.4.0: for the regex and sd_pattern rule options and the hyperscan
+  search engine.
 
 * *intel-soft-cpm": an optional pattern matcher based on a library from
   Intel.
 
-* hyperscan for the regex rule option and hyperscan search engine.
+* *lzma*: for decompression of SWF and PDF files.
+
+* *safec*: for additional runtime error checking of some memory copy operations.
 
 If you need to use headers and/or libraries in non-standard locations, you
 can use these options:

diff --git a/doc/tutorial.txt b/doc/tutorial.txt
index 86e2021991b68e41be80d8f127c0d53dd1ea9a1d..e433aafe453939e74743ced6a26ad81c2ee20c33 100644 (file)
--- a/doc/tutorial.txt
+++ b/doc/tutorial.txt
@@ -33,32 +33,32 @@ Required:
 
 Optional:
 
-* lzma >= 5.1.2 from http://tukaani.org/xz/ for decompression of SWF and
-  PDF files
-
-* hyperscan from https://github.com/01org/hyperscan to build new and improved
-  regex and (coming soon) fast pattern support
+* asciidoc from http://www.methods.co.nz/asciidoc/ to build the HTML
+  manual
 
 * cpputest from http://cpputest.github.io to run additional unit tests with
   make check
 
-* asciidoc from http://www.methods.co.nz/asciidoc/ to build the HTML
-  manual
-
 * dblatex from http://dblatex.sourceforge.net to build the pdf manual (in
   addition to asciidoc)
 
-* w3m from http://sourceforge.net/projects/w3m/ to build the plain text
-  manual
+* flatbuffers from https://google.github.io/flatbuffers/ for enabling the
+  flatbuffers serialization format
 
-* source-highlight from http://www.gnu.org/software/src-highlite/ to
-  generate the dev guide
+* hyperscan >= 4.4.0 from https://github.com/01org/hyperscan to build new
+  the regex and sd_pattern rule options and hyperscan search engine
+
+* lzma >= 5.1.2 from http://tukaani.org/xz/ for decompression of SWF and
+  PDF files
 
 * safec from https://sourceforge.net/projects/safeclib/ for runtime bounds
   checks on certain legacy C-library calls
 
-* flatbuffers from https://google.github.io/flatbuffers/ for enabling the
-  flatbuffers serialization format
+* source-highlight from http://www.gnu.org/software/src-highlite/ to
+  generate the dev guide
+
+* w3m from http://sourceforge.net/projects/w3m/ to build the plain text
+  manual
 
 === Building
 

diff --git a/src/ips_options/ips_regex.cc b/src/ips_options/ips_regex.cc
index 4dcd62b2adea6c50229d2e3ba53e19324e49b086..f54683bdaa416172d47a0d8b36c026dba0309766 100644 (file)
--- a/src/ips_options/ips_regex.cc
+++ b/src/ips_options/ips_regex.cc
@@ -301,6 +301,12 @@ bool RegexModule::set(const char*, Value& v, SnortConfig*)
 
 bool RegexModule::end(const char*, int, SnortConfig*)
 {
+    if ( hs_valid_platform() != HS_SUCCESS )
+    {
+        ParseError("This host does not support Hyperscan.");
+        return false;
+    }
+
     hs_compile_error_t* err = nullptr;
 
     if ( hs_compile(config.re.c_str(), config.hs_flags, HS_MODE_BLOCK,

diff --git a/src/ips_options/ips_sd_pattern.cc b/src/ips_options/ips_sd_pattern.cc
index d27bfbe147c3f69f49bc4d00230ca76c0c01dc27..1688cd609c70217fb289493aa235c669d2207551 100644 (file)
--- a/src/ips_options/ips_sd_pattern.cc
+++ b/src/ips_options/ips_sd_pattern.cc
@@ -368,6 +368,12 @@ bool SdPatternModule::set(const char*, Value& v, SnortConfig* sc)
 
 bool SdPatternModule::end(const char*, int, SnortConfig*)
 {
+    if ( hs_valid_platform() != HS_SUCCESS )
+    {
+        ParseError("This host does not support Hyperscan.");
+        return false;
+    }
+
     hs_compile_error_t* err = nullptr;
 
     if ( hs_compile(config.pii.c_str(), HS_FLAG_DOTALL|HS_FLAG_SOM_LEFTMOST, HS_MODE_BLOCK,

diff --git a/src/search_engines/hyperscan.cc b/src/search_engines/hyperscan.cc
index a1addd291ac8138d8263fbc0a4f20e8757fbdbe2..b18887f056882e1dd3c33279fd5e6193a6e477be 100644 (file)
--- a/src/search_engines/hyperscan.cc
+++ b/src/search_engines/hyperscan.cc
@@ -211,6 +211,12 @@ int HyperscanMpse::prep_patterns(SnortConfig* sc)
     if ( !pvector.size() )
         return -1;
 
+    if ( hs_valid_platform() != HS_SUCCESS )
+    {
+        ParseError("This host does not support Hyperscan.");
+        return -1;
+    }
+
     hs_compile_error_t* errptr = nullptr;
     std::vector<const char*> pats;
     std::vector<unsigned> flags;