Skip to content

Commit 2b6de9f

Browse files
committed
detect/integer: support missing modes for u8 prefilter
Ticket: 7865 <=, >=, and != were missing Also warns if an unimplemented mode is tried
1 parent 49629f7 commit 2b6de9f

1 file changed

Lines changed: 66 additions & 2 deletions

File tree

src/detect-engine-prefilter-common.c

Lines changed: 66 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -168,7 +168,16 @@ static void ApplyToU8Hash(PrefilterPacketU8HashCtx *ctx, PrefilterPacketHeaderVa
168168
} while (x--);
169169

170170
break;
171-
}
171+
}
172+
case DetectUintModeLte: {
173+
uint8_t x = v.u8[1];
174+
do {
175+
SigsArray *sa = ctx->array[x];
176+
sa->sigs[sa->offset++] = s->iid;
177+
} while (x--);
178+
179+
break;
180+
}
172181
case PREFILTER_U8HASH_MODE_GT:
173182
{
174183
int x = v.u8[1] + 1;
@@ -178,7 +187,16 @@ static void ApplyToU8Hash(PrefilterPacketU8HashCtx *ctx, PrefilterPacketHeaderVa
178187
} while (++x < 256);
179188

180189
break;
181-
}
190+
}
191+
case DetectUintModeGte: {
192+
int x = v.u8[1];
193+
do {
194+
SigsArray *sa = ctx->array[x];
195+
sa->sigs[sa->offset++] = s->iid;
196+
} while (++x < 256);
197+
198+
break;
199+
}
182200
case PREFILTER_U8HASH_MODE_RA:
183201
{
184202
int x = v.u8[1] + 1;
@@ -188,7 +206,20 @@ static void ApplyToU8Hash(PrefilterPacketU8HashCtx *ctx, PrefilterPacketHeaderVa
188206
} while (++x < v.u8[2]);
189207

190208
break;
209+
}
210+
case DetectUintModeNe: {
211+
for (uint8_t i = 0; i < UINT8_MAX; i++) {
212+
if (i != v.u8[1]) {
213+
SigsArray *sa = ctx->array[i];
214+
sa->sigs[sa->offset++] = s->iid;
215+
}
216+
}
217+
if (UINT8_MAX != v.u8[1]) {
218+
SigsArray *sa = ctx->array[UINT8_MAX];
219+
sa->sigs[sa->offset++] = s->iid;
191220
}
221+
break;
222+
}
192223
}
193224
}
194225

@@ -299,6 +330,16 @@ static void SetupU8Hash(DetectEngineCtx *de_ctx, HashListTable *hash_table, SigG
299330

300331
break;
301332
}
333+
case DetectUintModeLte: {
334+
uint8_t v = ctx->v1.u8[1];
335+
counts[v] += ctx->cnt;
336+
while (v > 0) {
337+
v--;
338+
counts[v] += ctx->cnt;
339+
}
340+
341+
break;
342+
}
302343
case PREFILTER_U8HASH_MODE_GT:
303344
{
304345
uint8_t v = ctx->v1.u8[1];
@@ -309,6 +350,16 @@ static void SetupU8Hash(DetectEngineCtx *de_ctx, HashListTable *hash_table, SigG
309350

310351
break;
311352
}
353+
case DetectUintModeGte: {
354+
uint8_t v = ctx->v1.u8[1];
355+
counts[v] += ctx->cnt;
356+
while (v < UINT8_MAX) {
357+
v++;
358+
counts[v] += ctx->cnt;
359+
}
360+
361+
break;
362+
}
312363
case PREFILTER_U8HASH_MODE_RA:
313364
{
314365
if (ctx->v1.u8[1] < ctx->v1.u8[2]) {
@@ -321,6 +372,19 @@ static void SetupU8Hash(DetectEngineCtx *de_ctx, HashListTable *hash_table, SigG
321372
}
322373
break;
323374
}
375+
case DetectUintModeNe: {
376+
for (uint8_t i = 0; i < UINT8_MAX; i++) {
377+
if (i != ctx->v1.u8[1]) {
378+
counts[i] += ctx->cnt;
379+
}
380+
}
381+
if (UINT8_MAX != ctx->v1.u8[1]) {
382+
counts[UINT8_MAX] += ctx->cnt;
383+
}
384+
break;
385+
}
386+
default:
387+
SCLogWarning("Prefilter not implemented for mode 0x%x", ctx->v1.u8[0]);
324388
}
325389
}
326390

0 commit comments

Comments
 (0)