Merge pull request #896 in SNORT/snort3 from appidz to master

Squashed commit of the following:

commit f74a4934f522d20201f3e9607352205171979874
Author: Russ Combs <rucombs@cisco.com>
Date:   Wed May 17 12:20:47 2017 -0400

    detection: rename method for clarity

commit c9c1f77634e1d7926e103135a56476e2ea7a8323
Author: Russ Combs <rucombs@cisco.com>
Date:   Wed May 17 11:52:48 2017 -0400

    detection: ensure reassembly is in next context

commit 3cc411a86df37df167e1246d20c438bee0216d99
Author: Russ Combs <rucombs@cisco.com>
Date:   Tue May 16 21:43:59 2017 -0400

    search tool: refactor to remove dependencies

commit 7b38d3db78bf7a1f11ad65627dd724fdf0962674
Author: Russ Combs <rucombs@cisco.com>
Date:   Tue May 16 16:32:34 2017 -0400

    search tool: refactor unit test

commit b4ae4ce14603a5e730145e4231fccee78eb03af6
Author: Russ Combs <rucombs@cisco.com>
Date:   Tue May 16 12:49:47 2017 -0400

    search tool: use configured or default method

commit fd996bdb1f947cb9ed3ac547e5ed2227ccdfef89
Author: Russ Combs <rucombs@cisco.com>
Date:   Tue May 16 12:23:25 2017 -0400

    search tool: refactor ctor

commit fc758793dbc64bb3db8a72362a32c10b9f18a682
Author: Russ Combs <rucombs@cisco.com>
Date:   Tue May 16 12:24:32 2017 -0400

    appid: master key must be thread local

commit 7d4db6cfc221d5ac0b98916b88839c3e77e3d359
Author: Russ Combs <rucombs@cisco.com>
Date:   Tue May 16 12:22:39 2017 -0400

    appid: use actual referer length for search

diff --git a/src/detection/detection_engine.cc b/src/detection/detection_engine.cc
index 393edbc40bb4fd25d0bba7982c5f4c4f1ad8195f..ef4c0b662f530ef068f8b5c28243c18d1f2d4b15 100644 (file)
--- a/src/detection/detection_engine.cc
+++ b/src/detection/detection_engine.cc
@@ -110,7 +110,8 @@ Packet* DetectionEngine::get_encode_packet()
 
 // we need to stay in the current context until rebuild is successful
 // any events while rebuilding will be logged against the current packet
-Packet* DetectionEngine::set_packet()
+// however, rebuild is always in the next context, not current.
+Packet* DetectionEngine::set_next_packet()
 {
     const IpsContext* c = Snort::get_switcher()->get_next();
     Packet* p = c->packet;
@@ -141,6 +142,12 @@ uint8_t* DetectionEngine::get_buffer(unsigned& max)
     return Snort::get_switcher()->get_context()->buf;
 }
 
+uint8_t* DetectionEngine::get_next_buffer(unsigned& max)
+{
+    max = IpsContext::buf_size;
+    return Snort::get_switcher()->get_next()->buf;
+}
+
 DataBuffer& DetectionEngine::get_alt_buffer(Packet* p)
 {
     assert(p);

diff --git a/src/detection/detection_engine.h b/src/detection/detection_engine.h
index 37ad0b06d284b1899b555b6b1bb65c8fb658fe0a..0531947e4a2944290212b1f743cd5115a753a38e 100644 (file)
--- a/src/detection/detection_engine.h
+++ b/src/detection/detection_engine.h
@@ -22,7 +22,7 @@
 #define DETECTION_ENGINE_H
 
 // DetectionEngine manages a detection context.  To detect a rebuilt
-// packet (PDU), first call set_packet().  If rebuild is successful,
+// packet (PDU), first call set_next_packet().  If rebuild is successful,
 // then instantiate a new DetectionEngine to detect that packet.
 
 #include "actions/actions.h"
@@ -52,7 +52,8 @@ public:
     static IpsContext* get_context();
 
     static Packet* get_current_packet();
-    static Packet* set_packet();
+    static Packet* set_next_packet();
+    static uint8_t* get_next_buffer(unsigned& max);
 
     static bool offloaded(Packet*);
     static bool offload(Packet*);

diff --git a/src/detection/fp_config.cc b/src/detection/fp_config.cc
index 101a8682377e0a993814d07df7f39fabed55438d..3f5bd8d3c107f23d0d0b2e85b440971916a4b0cc 100644 (file)
--- a/src/detection/fp_config.cc
+++ b/src/detection/fp_config.cc
@@ -32,6 +32,7 @@
 #include <cassert>
 #include <cstring>
 
+#include "framework/mpse.h"
 #include "log/messages.h"
 #include "managers/mpse_manager.h"
 
@@ -51,7 +52,7 @@ FastPatternConfig::FastPatternConfig()
 FastPatternConfig::~FastPatternConfig()
 { }
 
-bool FastPatternConfig::set_detect_search_method(const char* method)
+bool FastPatternConfig::set_search_method(const char* method)
 {
     const MpseApi* api = MpseManager::get_search_api(method);
 
@@ -63,6 +64,14 @@ bool FastPatternConfig::set_detect_search_method(const char* method)
     return true;
 }
 
+const char* FastPatternConfig::get_search_method()
+{
+    if ( !search_api )
+        return nullptr;
+
+    return search_api->base.name;
+}
+
 void FastPatternConfig::set_max_pattern_len(unsigned int max_len)
 {
     if (max_pattern_len != 0)

diff --git a/src/detection/fp_config.h b/src/detection/fp_config.h
index c5a2659df8e81a2df994380f22cb20049f81780c..302914d2297357a5b4ed82a61cd38c3653438b7c 100644 (file)
--- a/src/detection/fp_config.h
+++ b/src/detection/fp_config.h
@@ -118,7 +118,9 @@ public:
     int get_search_opt()
     { return search_opt; }
 
-    bool set_detect_search_method(const char*);
+    bool set_search_method(const char*);
+    const char* get_search_method();
+
     void set_max_pattern_len(unsigned);
 
     const struct MpseApi* get_search_api()

diff --git a/src/flow/flow.cc b/src/flow/flow.cc
index 4a8a2d0fba587f0350993f5dc4150b281eda2dc1..21e6ca0bfa5b9bc3a5fabca17bf547bb25543d56 100644 (file)
--- a/src/flow/flow.cc
+++ b/src/flow/flow.cc
@@ -128,7 +128,7 @@ inline void Flow::clean()
 void Flow::reset(bool do_cleanup)
 {
     DetectionEngine::onload(this);
-    DetectionEngine::set_packet();
+    DetectionEngine::set_next_packet();
     DetectionEngine de;
 
     if ( session )

diff --git a/src/main/modules.cc b/src/main/modules.cc
index 6e2d3a54cf6438f3c0a877300e625cc7f3bdc02b..9c20a0e6fd64af1a870be91cae56644b1b95fe48 100644 (file)
--- a/src/main/modules.cc
+++ b/src/main/modules.cc
@@ -331,7 +331,7 @@ bool SearchEngineModule::set(const char*, Value& v, SnortConfig* sc)
 
     else if ( v.is("search_method") )
     {
-        if ( !fp->set_detect_search_method(v.get_string()) )
+        if ( !fp->set_search_method(v.get_string()) )
             return false;
     }
     else if ( v.is("search_optimize") )

diff --git a/src/managers/mpse_manager.cc b/src/managers/mpse_manager.cc
index 5719a17975d980556542820b5e3be2866b1ba69a..bcb5c907ae3b36ce9838b339530fa175643e5559 100644 (file)
--- a/src/managers/mpse_manager.cc
+++ b/src/managers/mpse_manager.cc
@@ -25,8 +25,10 @@
 
 #include <list>
 
+#include "detection/fp_config.h"
 #include "framework/mpse.h"
 #include "log/messages.h"
+#include "main/snort_config.h"
 
 #include "module_manager.h"
 
@@ -95,6 +97,12 @@ Mpse* MpseManager::get_search_engine(
 
 Mpse* MpseManager::get_search_engine(const char* type)
 {
+    if ( !type and snort_conf->fast_pattern_config )
+        type = snort_conf->fast_pattern_config->get_search_method();
+
+    if ( !type )
+        type = "ac_bnfa";
+
     const MpseApi* api = get_search_api(type);
 
     if ( !api )
@@ -103,6 +111,10 @@ Mpse* MpseManager::get_search_engine(const char* type)
     Module* mod = ModuleManager::get_module(api->base.name);
     Mpse* eng = api->ctor(nullptr, mod, nullptr);
     eng->set_api(api);
+
+    if ( snort_conf->fast_pattern_config and snort_conf->fast_pattern_config->get_search_opt() )
+        eng->set_opt(1);
+
     return eng;
 }
 

diff --git a/src/mime/file_mime_process.cc b/src/mime/file_mime_process.cc
index f4772a30c7a2d29370e06fcb6254f0bca2fd5740..35327feb609d38d0e5ec4731d478c04a51c2d094 100644 (file)
--- a/src/mime/file_mime_process.cc
+++ b/src/mime/file_mime_process.cc
@@ -700,7 +700,7 @@ void MimeSession::init()
     const MimeToken* tmp;
 
     /* Header search */
-    mime_hdr_search_mpse = new SearchTool();
+    mime_hdr_search_mpse = new SearchTool;
     if (mime_hdr_search_mpse == nullptr)
     {
         // FIXIT-M make configurable or at least fall back to any

diff --git a/src/network_inspectors/appid/app_forecast.cc b/src/network_inspectors/appid/app_forecast.cc
index afd8252048f2663c2ee03e81583794f3b87ab9c5..886e670a869fa6db1bf85200f858db0106a27818 100644 (file)
--- a/src/network_inspectors/appid/app_forecast.cc
+++ b/src/network_inspectors/appid/app_forecast.cc
@@ -31,7 +31,7 @@
 #include "time/packet_time.h"
 #include "appid_session.h"
 
-static AFActKey master_key;
+static THREAD_LOCAL AFActKey master_key;
 static THREAD_LOCAL SFXHASH* AF_indicators = nullptr;     // list of "indicator apps"
 static THREAD_LOCAL SFXHASH* AF_actives = nullptr;        // list of hosts to watch
 

diff --git a/src/network_inspectors/appid/appid_discovery.cc b/src/network_inspectors/appid/appid_discovery.cc
index 41182b626fc86407716090b660a0332009236f52..2c1dd7da0bb4d860b67bc611b76ebf1d98b7bb28 100644 (file)
--- a/src/network_inspectors/appid/appid_discovery.cc
+++ b/src/network_inspectors/appid/appid_discovery.cc
@@ -49,8 +49,8 @@
 
 AppIdDiscovery::AppIdDiscovery()
 {
-    tcp_patterns = new SearchTool("ac_full");
-    udp_patterns = new SearchTool("ac_full");
+    tcp_patterns = new SearchTool;
+    udp_patterns = new SearchTool;
 }
 
 AppIdDiscovery::~AppIdDiscovery()

diff --git a/src/network_inspectors/appid/appid_utils/sf_mlmp.cc b/src/network_inspectors/appid/appid_utils/sf_mlmp.cc
index 410ac1c9ab725c2e7592de75ad3ad0723f628415..7ad7f508efe2594126969fd9d7b248fb1333b43e 100644 (file)
--- a/src/network_inspectors/appid/appid_utils/sf_mlmp.cc
+++ b/src/network_inspectors/appid/appid_utils/sf_mlmp.cc
@@ -212,7 +212,7 @@ static int createTreesRecusively(tMlmpTree* rootNode)
     tPatternNode* ddPatternNode;
 
     /* set up the MPSE for url patterns */
-    patternMatcher = rootNode->patternTree = new SearchTool("ac_full");
+    patternMatcher = rootNode->patternTree = new SearchTool;
 
     for (primaryPatternNode = rootNode->patternList;
         primaryPatternNode;

diff --git a/src/network_inspectors/appid/appid_utils/sf_multi_mpse.cc b/src/network_inspectors/appid/appid_utils/sf_multi_mpse.cc
index 4bdb39a6f623a783f82caebe9d5f7d0c67610bb0..a96e7d8da4450a0966fd94a638e768b11658a089 100644 (file)
--- a/src/network_inspectors/appid/appid_utils/sf_multi_mpse.cc
+++ b/src/network_inspectors/appid/appid_utils/sf_multi_mpse.cc
@@ -184,7 +184,7 @@ static int createTreesRecusively(void* root)
     tPatternList* patternNode;
 
     /* set up the MPSE for url patterns */
-    if (!(patternMatcher = rootNode->patternTree = new SearchTool("ac_full")))
+    if (!(patternMatcher = rootNode->patternTree = new SearchTool))
         return -1;
 
     for (patternNode = rootNode->patternList;

diff --git a/src/network_inspectors/appid/detector_plugins/detector_dns.cc b/src/network_inspectors/appid/detector_plugins/detector_dns.cc
index 717663b4d30d11356933601ca7f04f5f3b63cd7e..889f5340829375d5fbbf97a02f64b631afc0d637 100644 (file)
--- a/src/network_inspectors/appid/detector_plugins/detector_dns.cc
+++ b/src/network_inspectors/appid/detector_plugins/detector_dns.cc
@@ -184,7 +184,7 @@ static int dns_host_detector_create_matcher(DetectorDNSHostPattern* list)
     if (serviceDnsConfig.dns_host_host_matcher)
         delete serviceDnsConfig.dns_host_host_matcher;
 
-    serviceDnsConfig.dns_host_host_matcher = new SearchTool("ac_full");
+    serviceDnsConfig.dns_host_host_matcher = new SearchTool;
     if (!serviceDnsConfig.dns_host_host_matcher)
         return 0;
 

diff --git a/src/network_inspectors/appid/detector_plugins/detector_imap.cc b/src/network_inspectors/appid/detector_plugins/detector_imap.cc
index e942d8962159157e49b47b990b9c167bd7ff5efa..a2a36df7c0e5a4f6790ec25ad9c93df82c5d25d9 100644 (file)
--- a/src/network_inspectors/appid/detector_plugins/detector_imap.cc
+++ b/src/network_inspectors/appid/detector_plugins/detector_imap.cc
@@ -516,7 +516,7 @@ ImapClientDetector::~ImapClientDetector()
 void ImapClientDetector::do_custom_init()
 {
     unsigned index = 0;
-    cmd_matcher = new SearchTool("ac_full");
+    cmd_matcher = new SearchTool;
 
     if ( tcp_patterns.size() )
         for (auto& pat : tcp_patterns)

diff --git a/src/network_inspectors/appid/detector_plugins/detector_pattern.cc b/src/network_inspectors/appid/detector_plugins/detector_pattern.cc
index 180086e0c9c7c18e1df7335bb18f16aff9d6f899..c2885bd98c3ccec7f0f7fc39825ed7e94b54b87c 100644 (file)
--- a/src/network_inspectors/appid/detector_plugins/detector_pattern.cc
+++ b/src/network_inspectors/appid/detector_plugins/detector_pattern.cc
@@ -122,7 +122,7 @@ static void register_pattern(SearchTool** patterns, Pattern* pattern)
 {
     if (!*patterns)
     {
-        *patterns = new SearchTool("ac_full");
+        *patterns = new SearchTool;
         if (!*patterns)
         {
             ErrorMessage("Error initializing the pattern table\n");

diff --git a/src/network_inspectors/appid/detector_plugins/detector_pop3.cc b/src/network_inspectors/appid/detector_plugins/detector_pop3.cc
index 39f5619e69e3d8c27cf4bfc04128fa2dbf3cc79d..6ad92ce8cae42c8b617596a622e07ac9fa3a2f52 100644 (file)
--- a/src/network_inspectors/appid/detector_plugins/detector_pop3.cc
+++ b/src/network_inspectors/appid/detector_plugins/detector_pop3.cc
@@ -209,7 +209,7 @@ Pop3ClientDetector::~Pop3ClientDetector()
 void Pop3ClientDetector::do_custom_init()
 {
     unsigned index = 0;
-    cmd_matcher = new SearchTool("ac_full");
+    cmd_matcher = new SearchTool;
 
     if ( tcp_patterns.size() )
         for (auto& pat : tcp_patterns)

diff --git a/src/network_inspectors/appid/detector_plugins/http_url_patterns.cc b/src/network_inspectors/appid/detector_plugins/http_url_patterns.cc
index f3fca7aff3465b0d0ddb6e81a4cb346e0181ac8c..46b3cb33b05c3b31183c74a9fecdf07a0987cc1c 100644 (file)
--- a/src/network_inspectors/appid/detector_plugins/http_url_patterns.cc
+++ b/src/network_inspectors/appid/detector_plugins/http_url_patterns.cc
@@ -698,7 +698,7 @@ int HttpPatternMatchers::process_host_patterns(DetectorHTTPPatterns patterns)
 int HttpPatternMatchers::process_chp_list(CHPListElement* chplist)
 {
     for (size_t i = 0; i <= MAX_PATTERN_TYPE; i++)
-        chp_matchers[i] = new SearchTool("ac_full");
+        chp_matchers[i] = new SearchTool;
 
     for (CHPListElement* chpe = chplist; chpe; chpe = chpe->next)
         chp_matchers[chpe->chp_action.ptype]->add(chpe->chp_action.pattern,
@@ -739,7 +739,7 @@ static FieldPattern http_field_patterns[] =
 
 static SearchTool* process_http_field_patterns(FieldPattern* patternList, size_t patternListCount)
 {
-    SearchTool* patternMatcher = new SearchTool("ac_full");
+    SearchTool* patternMatcher = new SearchTool;
 
     for (size_t i=0; i < patternListCount; i++)
         patternMatcher->add( (char*)patternList[i].data, patternList[i].length,
@@ -1690,8 +1690,9 @@ bool HttpPatternMatchers::get_appid_from_url(char* host, char* url, char** versi
         APPINFO_FLAG_REFERRED)))
     {
         char* referer_start = referer;
+        size_t ref_len = strlen(referer);
 
-        char* referer_offset = (char*)service_strstr((uint8_t*)referer_start, URL_SCHEME_MAX_LEN,
+        char* referer_offset = (char*)service_strstr((uint8_t*)referer_start, ref_len,
             (uint8_t*)URL_SCHEME_END_PATTERN, sizeof(URL_SCHEME_END_PATTERN)-1);
 
         if ( !referer_offset )

diff --git a/src/network_inspectors/appid/service_plugins/service_mdns.cc b/src/network_inspectors/appid/service_plugins/service_mdns.cc
index 9ca5048c956e622e1af9467e8714b1aeccee6276..ccc4f484be1edb0513d322a66a84e9828a20f0a8 100644 (file)
--- a/src/network_inspectors/appid/service_plugins/service_mdns.cc
+++ b/src/network_inspectors/appid/service_plugins/service_mdns.cc
@@ -104,7 +104,7 @@ MdnsServiceDetector::MdnsServiceDetector(ServiceDiscovery* sd)
         { 5353, IpProtocol::UDP, false },
     };
 
-    matcher = new SearchTool("ac_full");
+    matcher = new SearchTool;
     for (unsigned i = 0; i < sizeof(patterns) / sizeof(*patterns); i++)
         matcher->add((char*)patterns[i].pattern, patterns[i].length, &patterns[i]);
     matcher->prep();

diff --git a/src/network_inspectors/appid/service_plugins/service_ssl.cc b/src/network_inspectors/appid/service_plugins/service_ssl.cc
index ec76549dfde433dcd45b01d3ca1661babea630f2..80a9854d54724ac04b36295c354ae81a023ea983 100644 (file)
--- a/src/network_inspectors/appid/service_plugins/service_ssl.cc
+++ b/src/network_inspectors/appid/service_plugins/service_ssl.cc
@@ -238,7 +238,7 @@ static int ssl_detector_create_matcher(SearchTool** matcher, DetectorSSLCertPatt
     if (*matcher)
         delete *matcher;
 
-    if (!(*matcher = new SearchTool("ac_full")))
+    if (!(*matcher = new SearchTool))
         return 0;
 
     patternIndex = &size;

diff --git a/src/network_inspectors/binder/test/binder_test.cc b/src/network_inspectors/binder/test/binder_test.cc
index b1680c7a6823768db0d871a0a6ee0973b7442ca9..cfb7b49302516795c7158415e638a8c4c2a7deb7 100644 (file)
--- a/src/network_inspectors/binder/test/binder_test.cc
+++ b/src/network_inspectors/binder/test/binder_test.cc
@@ -88,7 +88,7 @@ bool sfvar_ip_in(sfip_var_t*, const SfIp*) { return false; }
 SO_PUBLIC Inspector* InspectorManager::get_inspector(const char*, bool) { return s_inspector; }
 InspectorType InspectorManager::get_type(const char*) { return InspectorType::IT_BINDER; }
 Inspector* InspectorManager::get_binder() { return nullptr; }
-uint8_t* DetectionEngine::get_buffer(unsigned&) { return nullptr; }
+uint8_t* DetectionEngine::get_next_buffer(unsigned&) { return nullptr; }
 
 int16_t ProtocolReference::find(const char*) { return 0; }
 const char* ProtocolReference::get_name(uint16_t) { return ""; }

diff --git a/src/search_engines/search_tool.cc b/src/search_engines/search_tool.cc
index 0f627b16b3fe1d88a09e6c0e2c0485bb68e1061d..4a78d4aaf019397ff412f8c7986bd6ff4a437e20 100644 (file)
--- a/src/search_engines/search_tool.cc
+++ b/src/search_engines/search_tool.cc
@@ -23,26 +23,14 @@
 
 #include "search_tool.h"
 
-#include "managers/mpse_manager.h"
-#include "main/snort_config.h"
-#include "detection/fp_config.h"
+#include <cassert>
 
-SearchTool::SearchTool() : SearchTool("ac_bnfa")
-{
-}
+#include "managers/mpse_manager.h"
 
 SearchTool::SearchTool(const char* method)
 {
-    if ( snort_conf->fast_pattern_config )
-    {
-        const struct MpseApi* mpse_api = snort_conf->fast_pattern_config->get_search_api();
-        mpse = MpseManager::get_search_engine(snort_conf, mpse_api, nullptr);
-
-        if ( mpse && snort_conf->fast_pattern_config->get_search_opt() )
-            mpse->set_opt(1);
-    }
-    else
-        mpse = MpseManager::get_search_engine(method);
+    mpse = MpseManager::get_search_engine(method);
+    assert(mpse);
     max_len = 0;
 }
 

diff --git a/src/search_engines/search_tool.h b/src/search_engines/search_tool.h
index 1842e3db12a50183ef253649c3eac09a55d661af..1c87ec82975998c989a0fb883c1d8facdc898701 100644 (file)
--- a/src/search_engines/search_tool.h
+++ b/src/search_engines/search_tool.h
@@ -25,13 +25,13 @@
 class SO_PUBLIC SearchTool
 {
 public:
-    SearchTool();
-    SearchTool(const char* method);
+    SearchTool(const char* method = nullptr);
     ~SearchTool();
 
     void add(const char* pattern, unsigned len, int s_id, bool no_case = true);
-    void add(const uint8_t* pattern, unsigned len, int s_id, bool no_case = true);
     void add(const char* pattern, unsigned len, void* s_context, bool no_case = true);
+
+    void add(const uint8_t* pattern, unsigned len, int s_id, bool no_case = true);
     void add(const uint8_t* pattern, unsigned len, void* s_context, bool no_case = true);
 
     void prep();

diff --git a/src/search_engines/test/search_tool_test.cc b/src/search_engines/test/search_tool_test.cc
index 0c54cec80125f6d2ee99e1f0f3a6d7ed0557ddfd..bc185a478f7da049c746a6ee656242a001eaf06d 100644 (file)
--- a/src/search_engines/test/search_tool_test.cc
+++ b/src/search_engines/test/search_tool_test.cc
@@ -38,7 +38,6 @@
 #include <CppUTest/CommandLineTestRunner.h>
 #include <CppUTest/TestHarness.h>
 
-
 //-------------------------------------------------------------------------
 // base stuff
 //-------------------------------------------------------------------------
@@ -53,6 +52,7 @@ SnortConfig::SnortConfig()
     state = &s_state;
     memset(state, 0, sizeof(*state));
     num_slots = 1;
+    fast_pattern_config = nullptr;
 }
 
 SnortConfig::~SnortConfig() { }
@@ -116,32 +116,24 @@ static MpseAgent s_agent =
 };
 
 extern const BaseApi* se_ac_bnfa;
-const MpseApi* mpse_api = (MpseApi*)se_ac_bnfa;
-Mpse* acf = nullptr;
+Mpse* mpse = nullptr;
 
 Mpse* MpseManager::get_search_engine(const char *type)
 {
-    acf = nullptr;
+    assert(!strcmp(type, "ac_bnfa"));
 
-    if(strcmp(type, "ac_bnfa") == 0)
-    {
-        CHECK(se_ac_bnfa);
-        mpse_api->init();
-        acf = mpse_api->ctor(snort_conf, nullptr, &s_agent);
-        CHECK(acf);
-    }
+    const MpseApi* mpse_api = (MpseApi*)se_ac_bnfa;
+    mpse_api->init();
+    mpse = mpse_api->ctor(snort_conf, nullptr, &s_agent);
+    CHECK(mpse);
 
-    return acf;
-}
-
-Mpse* MpseManager::get_search_engine(SnortConfig*, const MpseApi*, const MpseAgent*)
-{
-    return MpseManager::get_search_engine("ac_bnfa");
+    return mpse;
 }
 
 void MpseManager::delete_search_engine(Mpse*)
 {
-    mpse_api->dtor(acf);
+    const MpseApi* mpse_api = (MpseApi*)se_ac_bnfa;
+    mpse_api->dtor(mpse);
 }
 
 Mpse::Mpse(const char*) { }
@@ -171,14 +163,12 @@ static int Test_SearchStrFound(
 TEST_GROUP(search_tool_tests)
 {
     void setup()
-    {
-        CHECK(se_ac_bnfa);
-    }
+    { CHECK(se_ac_bnfa); }
 };
 
 TEST(search_tool_tests, ac_bnfa)
 {
-    SearchTool *stool = new SearchTool;
+    SearchTool *stool = new SearchTool("ac_bnfa");
     CHECK(stool->mpse);
 
     pattern_id = 1;

diff --git a/src/service_inspectors/dce_rpc/dce_common.cc b/src/service_inspectors/dce_rpc/dce_common.cc
index 053519c1b3f397a3c7ed4399003cca5164843695..d462fabb56d9262e29b4ce1e8019e62cd3957fc4 100644 (file)
--- a/src/service_inspectors/dce_rpc/dce_common.cc
+++ b/src/service_inspectors/dce_rpc/dce_common.cc
@@ -364,7 +364,7 @@ static void dce2_fill_rpkt_info(Packet* rpkt, Packet* p)
 Packet* DCE2_GetRpkt(Packet* p,DCE2_RpktType rpkt_type,
     const uint8_t* data, uint32_t data_len)
 {
-    Packet* rpkt = DetectionEngine::set_packet();
+    Packet* rpkt = DetectionEngine::set_next_packet();
     dce2_fill_rpkt_info(rpkt, p);
     uint16_t data_overhead = 0;
 

diff --git a/src/service_inspectors/http_inspect/http_js_norm.cc b/src/service_inspectors/http_inspect/http_js_norm.cc
index 35714dedd75f7c833dd22bdfb802ab4013bf36a9..a828a36373f67a4dc112da447acde1742f6b5d4e 100644 (file)
--- a/src/service_inspectors/http_inspect/http_js_norm.cc
+++ b/src/service_inspectors/http_inspect/http_js_norm.cc
@@ -43,8 +43,8 @@ void HttpJsNorm::configure()
     if ( javascript_search_mpse || htmltype_search_mpse )
         return;
 
-    javascript_search_mpse = new SearchTool();
-    htmltype_search_mpse = new SearchTool();
+    javascript_search_mpse = new SearchTool;
+    htmltype_search_mpse = new SearchTool;
 
     javascript_search_mpse->add(script_start, script_start_length, JS_JAVASCRIPT);
     javascript_search_mpse->prep();

diff --git a/src/service_inspectors/imap/imap.cc b/src/service_inspectors/imap/imap.cc
index 59decc2d0b8b0088a5c95be71f038df25891a9d7..ff4c9e377ba7dd55d8a45e36b813e9d47a6c6871 100644 (file)
--- a/src/service_inspectors/imap/imap.cc
+++ b/src/service_inspectors/imap/imap.cc
@@ -182,7 +182,7 @@ static void IMAP_SearchInit()
     const IMAPToken* tmp;
     if ( imap_cmd_search_mpse )
         return;
-    imap_cmd_search_mpse = new SearchTool();
+    imap_cmd_search_mpse = new SearchTool;
 
     for (tmp = &imap_known_cmds[0]; tmp->name != NULL; tmp++)
     {
@@ -191,7 +191,7 @@ static void IMAP_SearchInit()
         imap_cmd_search_mpse->add(tmp->name, tmp->name_len, tmp->search_id);
     }
     imap_cmd_search_mpse->prep();
-    imap_resp_search_mpse = new SearchTool();
+    imap_resp_search_mpse = new SearchTool;
 
     for (tmp = &imap_resps[0]; tmp->name != NULL; tmp++)
     {

diff --git a/src/service_inspectors/pop/pop.cc b/src/service_inspectors/pop/pop.cc
index 01799f44fea0a3bdd6a0613d02d0324cc279c284..b4627b5319c7f455cb456f10cd426671cc14b6f1 100644 (file)
--- a/src/service_inspectors/pop/pop.cc
+++ b/src/service_inspectors/pop/pop.cc
@@ -139,7 +139,7 @@ static void POP_SearchInit()
     const POPToken* tmp;
     if ( pop_cmd_search_mpse )
         return;
-    pop_cmd_search_mpse = new SearchTool();
+    pop_cmd_search_mpse = new SearchTool;
 
     for (tmp = &pop_known_cmds[0]; tmp->name != NULL; tmp++)
     {
@@ -148,7 +148,7 @@ static void POP_SearchInit()
         pop_cmd_search_mpse->add(tmp->name, tmp->name_len, tmp->search_id);
     }
     pop_cmd_search_mpse->prep();
-    pop_resp_search_mpse = new SearchTool();
+    pop_resp_search_mpse = new SearchTool;
 
     for (tmp = &pop_resps[0]; tmp->name != NULL; tmp++)
     {

diff --git a/src/service_inspectors/smtp/smtp.cc b/src/service_inspectors/smtp/smtp.cc
index b1f486fbea240c2a0d4dd431dc3850beab7deeea..66e2e01fae2017dbadb3ab3c73cc0344ff858a97 100644 (file)
--- a/src/service_inspectors/smtp/smtp.cc
+++ b/src/service_inspectors/smtp/smtp.cc
@@ -255,7 +255,7 @@ static void SMTP_TermCmds(SMTP_PROTO_CONF* config)
 
 static void SMTP_CommandSearchInit(SMTP_PROTO_CONF* config)
 {
-    config->cmd_search_mpse = new SearchTool();
+    config->cmd_search_mpse = new SearchTool;
     config->cmd_search = (SMTPSearch*)snort_calloc(config->num_cmds, sizeof(*config->cmd_search));
 
     for ( const SMTPToken* tmp = config->cmds; tmp->name != NULL; tmp++ )
@@ -281,7 +281,7 @@ static void SMTP_ResponseSearchInit()
     if ( smtp_resp_search_mpse )
         return;
 
-    smtp_resp_search_mpse = new SearchTool();
+    smtp_resp_search_mpse = new SearchTool;
 
     for (tmp = &smtp_resps[0]; tmp->name != NULL; tmp++)
     {

diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc
index d59e914579413e59ddcc714000838d897b8f15f0..de85eb45870171a0d017dcee444b7559846ecbd3 100644 (file)
--- a/src/stream/ip/ip_defrag.cc
+++ b/src/stream/ip/ip_defrag.cc
@@ -592,7 +592,7 @@ static void FragRebuild(FragTracker* ft, Packet* p)
     Profile profile(fragRebuildPerfStats);
     size_t offset = 0;
 
-    Packet* dpkt = DetectionEngine::set_packet();
+    Packet* dpkt = DetectionEngine::set_next_packet();
     PacketManager::encode_format(ENC_FLAG_DEF|ENC_FLAG_FWD, p, dpkt, PSEUDO_PKT_IP);
 
     // the encoder ensures enough space for a maximum datagram

diff --git a/src/stream/stream_splitter.cc b/src/stream/stream_splitter.cc
index 5df95bf9e45b36ba73ddaea7f3bd9116e42ce8a6..32adf9200f9a225d402d34df0f960f751d6a2a61 100644 (file)
--- a/src/stream/stream_splitter.cc
+++ b/src/stream/stream_splitter.cc
@@ -37,7 +37,7 @@ const StreamBuffer StreamSplitter::reassemble(
     unsigned n, uint32_t flags, unsigned& copied)
 {
     unsigned max;
-    uint8_t* pdu_buf = DetectionEngine::get_buffer(max);
+    uint8_t* pdu_buf = DetectionEngine::get_next_buffer(max);
 
     assert(offset + n < max);
     memcpy(pdu_buf+offset, p, n);

diff --git a/src/stream/tcp/tcp_reassembler.cc b/src/stream/tcp/tcp_reassembler.cc
index 2cd06c8744f8a20953aec792198c9c1da757f7c7..b83b80324fa93db477b865b0a485a77b2fc7caf9 100644 (file)
--- a/src/stream/tcp/tcp_reassembler.cc
+++ b/src/stream/tcp/tcp_reassembler.cc
@@ -593,7 +593,7 @@ int TcpReassembler::_flush_to_seq(uint32_t bytes, Packet* p, uint32_t pkt_flags)
     Profile profile(s5TcpFlushPerfStats);
 
     DetectionEngine::onload(session->flow);
-    Packet* pdu = DetectionEngine::set_packet();
+    Packet* pdu = DetectionEngine::set_next_packet();
 
     if ( !p )
     {
@@ -621,7 +621,7 @@ int TcpReassembler::_flush_to_seq(uint32_t bytes, Packet* p, uint32_t pkt_flags)
             footprint = pdu->max_dsize;
 
         DetectionEngine::onload(session->flow);
-        pdu = DetectionEngine::set_packet();
+        pdu = DetectionEngine::set_next_packet();
 
         DAQ_PktHdr_t pkth;
         session->GetPacketHeaderFoo(&pkth, pkt_flags);

diff --git a/src/stream/user/user_session.cc b/src/stream/user/user_session.cc
index 1884747474ef7511cd26fe93a0f9f74a540ac5db..20775809853d58cd824f3aa91bcc6848e5516c23 100644 (file)
--- a/src/stream/user/user_session.cc
+++ b/src/stream/user/user_session.cc
@@ -203,7 +203,7 @@ void UserTracker::flush(Packet* p, unsigned flush_amt, uint32_t flags)
     StreamBuffer sb = { nullptr, 0 };
     trace_logf(stream_user, "flush[%d]\n", flush_amt);
     uint32_t rflags = flags & ~PKT_PDU_TAIL;
-    Packet* up = DetectionEngine::set_packet();
+    Packet* up = DetectionEngine::set_next_packet();
 
     while ( !seg_list.empty() and bytes_flushed < flush_amt )
     {