From: Russ Combs (rucombs) Date: Fri, 24 Mar 2017 23:27:34 +0000 (-0400) Subject: Merge pull request #841 in SNORT/snort3 from jviiret-hs_valid_platform to master X-Git-Tag: 3.0.0-233~38 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8647c516be9ec8d544d00bb74d97c9a877bbf209;p=thirdparty%2Fsnort3.git Merge pull request #841 in SNORT/snort3 from jviiret-hs_valid_platform to master Squashed commit of the following: commit 884ae7e5c67ccc845e290b9e9e4002c783dea5b0 Author: Russ Combs Date: Thu Mar 23 09:36:00 2017 -0400 doc updates for optional build features commit 545015764289686c030d4f8220e0bf35275b5d5d Author: Justin Viiret Date: Fri Mar 3 10:56:18 2017 +1100 Check Hyperscan availability when configured This checks whether the host have the architectural features required by Hyperscan when it is configured with the hs_valid_platform() function. On failure, components that use HS (ips_regex, ips_sd_pattern, hyperscan MPSE) will produce parse errors. commit 48cfdcf9f14332c0d9b26022c6a20535ae8ed7f1 Author: Justin Viiret Date: Mon Mar 6 09:40:42 2017 +1100 autotools: require Hyperscan >= 4.4.0 This version is required for the hs_valid_platform() function. commit ea2f8816ca8c016977a6cdf88c39dc01461d5399 Author: Justin Viiret Date: Fri Mar 3 10:03:58 2017 +1100 cmake: require Hyperscan >= 4.4.0 This version is required for the hs_valid_platform() function. --- diff --git a/cmake/FindHS.cmake b/cmake/FindHS.cmake index 686701b06..43ee5ec6b 100644 --- a/cmake/FindHS.cmake +++ b/cmake/FindHS.cmake @@ -10,6 +10,6 @@ find_library(HS_LIBRARIES NAMES hs HINTS ${HS_LIBRARIES_DIR} ${PC_HYPERSCAN_LIBDIR} ${PC_HYPERSCAN_LIBRARY_DIRS}) include(FindPackageHandleStandardArgs) -find_package_handle_standard_args(HS DEFAULT_MSG HS_LIBRARIES HS_INCLUDE_DIRS) +find_package_handle_standard_args(HS REQUIRED_VARS HS_LIBRARIES HS_INCLUDE_DIRS VERSION_VAR PC_HYPERSCAN_VERSION) mark_as_advanced(HS_INCLUDE_DIRS HS_LIBRARIES) diff --git a/cmake/include_libraries.cmake b/cmake/include_libraries.cmake index 22f252670..2880619e5 100644 --- a/cmake/include_libraries.cmake +++ b/cmake/include_libraries.cmake @@ -19,6 +19,6 @@ find_package(LibLZMA QUIET) find_package(Asciidoc QUIET) find_package(DBLATEX QUIET) find_package(Ruby QUIET 1.8.7) -find_package(HS QUIET) +find_package(HS QUIET 4.4.0) find_package(SafeC QUIET) find_package(FLATBUFFERS QUIET) diff --git a/configure.ac b/configure.ac index 47532b4a3..c34f0de36 100644 --- a/configure.ac +++ b/configure.ac @@ -991,8 +991,8 @@ AM_CONDITIONAL([HAVE_FLATBUFFERS], [test "x$FBS_HEADERS" = "xyes"]) # hyperscan (optional) #-------------------------------------------------------------------------- -AC_MSG_CHECKING([for hyperscan pkg-config presence]) -PKG_CHECK_EXISTS([libhs], [ have_hyperscan_pkgconfig="yes" ], [ have_hyperscan_pkgconfig="no" ]) +AC_MSG_CHECKING([for hyperscan >= 4.4.0 pkg-config presence]) +PKG_CHECK_EXISTS([libhs >= 4.4.0], [ have_hyperscan_pkgconfig="yes" ], [ have_hyperscan_pkgconfig="no" ]) AC_MSG_RESULT(${have_hyperscan_pkgconfig}) HYPERSCAN_CPPFLAGS="" diff --git a/doc/building.txt b/doc/building.txt index 6a2281e98..a5b940d3e 100644 --- a/doc/building.txt +++ b/doc/building.txt @@ -5,18 +5,23 @@ into the Snort binary. For a full list of build options, run ./configure * *--enable-shell*: enable building local and remote command line shell support. +* *--enable-tsc-clock*: use the TSC register on x86 systems for improved + performance of latency and profiler features. + These options are built only if the required libraries and headers are present. There is no need to explicitly enable. -* *lzma*: for decompression of SWF and PDF files. +* *flatbuffers*: for an alternative perf_monitor logging format. -* *openssl*: for SHA and MD5 file signatures and the protected_content rule - option. +* *hyperscan* >= 4.4.0: for the regex and sd_pattern rule options and the hyperscan + search engine. * *intel-soft-cpm": an optional pattern matcher based on a library from Intel. -* hyperscan for the regex rule option and hyperscan search engine. +* *lzma*: for decompression of SWF and PDF files. + +* *safec*: for additional runtime error checking of some memory copy operations. If you need to use headers and/or libraries in non-standard locations, you can use these options: diff --git a/doc/tutorial.txt b/doc/tutorial.txt index 86e202199..e433aafe4 100644 --- a/doc/tutorial.txt +++ b/doc/tutorial.txt @@ -33,32 +33,32 @@ Required: Optional: -* lzma >= 5.1.2 from http://tukaani.org/xz/ for decompression of SWF and - PDF files - -* hyperscan from https://github.com/01org/hyperscan to build new and improved - regex and (coming soon) fast pattern support +* asciidoc from http://www.methods.co.nz/asciidoc/ to build the HTML + manual * cpputest from http://cpputest.github.io to run additional unit tests with make check -* asciidoc from http://www.methods.co.nz/asciidoc/ to build the HTML - manual - * dblatex from http://dblatex.sourceforge.net to build the pdf manual (in addition to asciidoc) -* w3m from http://sourceforge.net/projects/w3m/ to build the plain text - manual +* flatbuffers from https://google.github.io/flatbuffers/ for enabling the + flatbuffers serialization format -* source-highlight from http://www.gnu.org/software/src-highlite/ to - generate the dev guide +* hyperscan >= 4.4.0 from https://github.com/01org/hyperscan to build new + the regex and sd_pattern rule options and hyperscan search engine + +* lzma >= 5.1.2 from http://tukaani.org/xz/ for decompression of SWF and + PDF files * safec from https://sourceforge.net/projects/safeclib/ for runtime bounds checks on certain legacy C-library calls -* flatbuffers from https://google.github.io/flatbuffers/ for enabling the - flatbuffers serialization format +* source-highlight from http://www.gnu.org/software/src-highlite/ to + generate the dev guide + +* w3m from http://sourceforge.net/projects/w3m/ to build the plain text + manual === Building diff --git a/src/ips_options/ips_regex.cc b/src/ips_options/ips_regex.cc index 4dcd62b2a..f54683bda 100644 --- a/src/ips_options/ips_regex.cc +++ b/src/ips_options/ips_regex.cc @@ -301,6 +301,12 @@ bool RegexModule::set(const char*, Value& v, SnortConfig*) bool RegexModule::end(const char*, int, SnortConfig*) { + if ( hs_valid_platform() != HS_SUCCESS ) + { + ParseError("This host does not support Hyperscan."); + return false; + } + hs_compile_error_t* err = nullptr; if ( hs_compile(config.re.c_str(), config.hs_flags, HS_MODE_BLOCK, diff --git a/src/ips_options/ips_sd_pattern.cc b/src/ips_options/ips_sd_pattern.cc index d27bfbe14..1688cd609 100644 --- a/src/ips_options/ips_sd_pattern.cc +++ b/src/ips_options/ips_sd_pattern.cc @@ -368,6 +368,12 @@ bool SdPatternModule::set(const char*, Value& v, SnortConfig* sc) bool SdPatternModule::end(const char*, int, SnortConfig*) { + if ( hs_valid_platform() != HS_SUCCESS ) + { + ParseError("This host does not support Hyperscan."); + return false; + } + hs_compile_error_t* err = nullptr; if ( hs_compile(config.pii.c_str(), HS_FLAG_DOTALL|HS_FLAG_SOM_LEFTMOST, HS_MODE_BLOCK, diff --git a/src/search_engines/hyperscan.cc b/src/search_engines/hyperscan.cc index a1addd291..b18887f05 100644 --- a/src/search_engines/hyperscan.cc +++ b/src/search_engines/hyperscan.cc @@ -211,6 +211,12 @@ int HyperscanMpse::prep_patterns(SnortConfig* sc) if ( !pvector.size() ) return -1; + if ( hs_valid_platform() != HS_SUCCESS ) + { + ParseError("This host does not support Hyperscan."); + return -1; + } + hs_compile_error_t* errptr = nullptr; std::vector pats; std::vector flags;