From: Russ Combs (rucombs) <rucombs@cisco.com>
Date: Thu, 22 Sep 2016 21:02:30 +0000 (-0400)
Subject: Merge pull request #633 in SNORT/snort3 from hs to master
X-Git-Tag: 3.0.0-233~263^2~2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2774331ec020c1e1147db8d9531efe1cd1a5d053;p=thirdparty%2Fsnort3.git

Merge pull request #633 in SNORT/snort3 from hs to master

Squashed commit of the following:

commit 55c5043898a1cc1856d055d576e1518112cd97ff
Author: Russ Combs <rucombs@cisco.com>
Date:   Thu Sep 22 14:25:23 2016 -0400

    fix hyperscan with nocase
---

diff --git a/src/search_engines/hyperscan.cc b/src/search_engines/hyperscan.cc
index 84c33e68d..99b138d9e 100644
--- a/src/search_engines/hyperscan.cc
+++ b/src/search_engines/hyperscan.cc
@@ -62,6 +62,11 @@ Pattern::Pattern(
     flags = d.flags;
     user = u;
     user_tree = user_list = nullptr;
+
+    if ( no_case )
+        flags |= HS_FLAG_CASELESS;
+
+    flags |= HS_FLAG_SINGLEMATCH;
 }
 
 void Pattern::escape(const uint8_t* s, unsigned n, bool literal)
@@ -207,7 +212,7 @@ int HyperscanMpse::prep_patterns(SnortConfig* sc)
     for ( auto& p : pvector )
     {
         pats.push_back(p.pat.c_str());
-        flags.push_back(p.flags | HS_FLAG_SINGLEMATCH);
+        flags.push_back(p.flags);
         ids.push_back(id++);
     }
 
diff --git a/src/search_engines/test/hyperscan_test.cc b/src/search_engines/test/hyperscan_test.cc
index 4fc30369c..30365279a 100644
--- a/src/search_engines/test/hyperscan_test.cc
+++ b/src/search_engines/test/hyperscan_test.cc
@@ -222,21 +222,35 @@ TEST(mpse_hs_match, single)
     CHECK(hits == 1);
 }
 
+TEST(mpse_hs_match, nocase)
+{
+    Mpse::PatternDescriptor desc(true, true, false);
+
+    CHECK(hs->add_pattern(nullptr, (uint8_t*)"foo", 3, desc, s_user) == 0);
+    CHECK(hs->prep_patterns(snort_conf) == 0);
+    CHECK(hs->get_pattern_count() == 1);
+
+    hyperscan_setup(snort_conf);
+
+    int state = 0;
+    CHECK(hs->search((uint8_t*)"foo", 3, match, nullptr, &state) == 0);
+    CHECK(hs->search((uint8_t*)"fOo", 3, match, nullptr, &state) == 0);
+    CHECK(hits == 2);
+}
+
 TEST(mpse_hs_match, other)
 {
     Mpse::PatternDescriptor desc(false, true, false);
 
     CHECK(hs->add_pattern(nullptr, (uint8_t*)"foo", 3, desc, s_user) == 0);
-    CHECK(hs->add_pattern(nullptr, (uint8_t*)"\rbar\n", 3, desc, s_user) == 0);
-    CHECK(hs->add_pattern(nullptr, (uint8_t*)"\\(baz\\)", 3, desc, s_user) == 0);
-
     CHECK(hs->prep_patterns(snort_conf) == 0);
-    CHECK(hs->get_pattern_count() == 3);
+    CHECK(hs->get_pattern_count() == 1);
 
     hyperscan_setup(snort_conf);
 
     int state = 0;
     CHECK(hs->search((uint8_t*)"foo", 3, match, nullptr, &state) == 0);
+    CHECK(hs->search((uint8_t*)"fOo", 3, match, nullptr, &state) == 0);
     CHECK(hits == 1);
 }