c802edd5 |
/*
* Copyright (C) 2010 Sourcefire, Inc.
*
* Authors: aCaB
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as
* published by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
* MA 02110-1301, USA.
*/
#include "matcher.h"
#include "others.h"
#include "str.h"
#include <string.h> |
125827cf |
#include <stdlib.h>
|
c802edd5 |
int hm_addhash(struct cli_matcher *root, const char *hash, uint32_t size, const char *virusname) {
const struct cli_htu32_element *item;
struct cli_sz_hash *szh;
struct cli_htu32 *ht;
enum CLI_HASH_TYPE type; |
a08646d2 |
uint8_t binhash[32]; |
c802edd5 |
int hashlen, i;
if(!root || !hash) {
cli_errmsg("hm_addhash: NULL root or hash\n");
return CL_ENULLARG;
}
if(!size || size == (uint32_t)-1) {
cli_errmsg("hm_addhash: null or invalid size (%u)\n", size);
return CL_EARG;
}
hashlen = strlen(hash);
switch(hashlen) {
case 32:
type = CLI_HASH_MD5;
break;
case 40:
type = CLI_HASH_SHA1;
break;
case 64:
type = CLI_HASH_SHA256;
break;
default:
cli_errmsg("hm_addhash: invalid hash %s -- FIXME!\n", hash);
return CL_EARG;
}
if(cli_hex2str_to(hash, (char *)binhash, hashlen)) {
cli_errmsg("hm_addhash: invalid hash %s\n", hash);
return CL_EARG;
}
|
8f3d3f5b |
hashlen /= 2; |
a08646d2 |
ht = &root->hm.sizehashes[type]; |
3faa9783 |
if(!root->hm.sizehashes[type].capacity) { |
a08646d2 |
i = cli_htu32_init(ht, 64, root->mempool);
if(i) return i;
}
item = cli_htu32_find(ht, size);
if(!item) {
struct cli_htu32_element htitem;
szh = mpool_calloc(root->mempool, 1, sizeof(*szh));
if(!szh) {
cli_errmsg("hm_addhash: failed to allocate size hash\n");
return CL_EMEM;
}
htitem.key = size;
htitem.data.as_ptr = szh;
i = cli_htu32_insert(ht, &htitem, root->mempool);
if(i) {
cli_errmsg("ht_addhash: failed to add item to hashtab");
mpool_free(root->mempool, szh);
return i;
}
} else
szh = (struct cli_sz_hash *)item->data.as_ptr; |
c802edd5 |
|
38d54c92 |
szh->items++; |
c802edd5 |
|
38d54c92 |
szh->hash_array = mpool_realloc2(root->mempool, szh->hash_array, hashlen * szh->items);
if(!szh->hash_array) {
cli_errmsg("ht_add: failed to grow hash array to %u entries\n", szh->items);
szh->items=0;
mpool_free(root->mempool, szh->virusnames); |
3faa9783 |
szh->virusnames = NULL; |
38d54c92 |
return CL_EMEM; |
c802edd5 |
}
|
38d54c92 |
szh->virusnames = mpool_realloc2(root->mempool, szh->virusnames, sizeof(*szh->virusnames) * szh->items);
if(!szh->virusnames) {
cli_errmsg("ht_add: failed to grow virusname array to %u entries\n", szh->items);
szh->items=0;
mpool_free(root->mempool, szh->hash_array); |
3faa9783 |
szh->hash_array = NULL; |
38d54c92 |
return CL_EMEM;
}
memcpy(&szh->hash_array[(szh->items-1) * hashlen], binhash, hashlen);
szh->virusnames[(szh->items-1)] = virusname; |
a08646d2 |
|
c802edd5 |
return 0;
} |
bb2f6b0b |
static const unsigned int hashlen[] = { |
a08646d2 |
16, /* CLI_HASH_MD5 */
20, /* CLI_HASH_SHA1 */
32, /* CLI_HASH_SHA256 */ |
bb2f6b0b |
};
|
096cea46 |
static inline int hm_cmp(const uint8_t *itm, const uint8_t *ref, unsigned int keylen) { |
3a8e2b6e |
#if WORDS_BIGENDIAN == 0 |
125827cf |
uint32_t i = *(uint32_t *)itm, r = *(uint32_t *)ref;
if(i!=r)
return (i<r) * 2 -1; |
bb2f6b0b |
return memcmp(&itm[4], &ref[4], keylen - 4); |
3a8e2b6e |
#else
return memcmp(itm, ref, keylen);
#endif |
bb2f6b0b |
}
|
ab769e30 |
static void hm_sort(struct cli_sz_hash *szh, size_t l, size_t r, unsigned int keylen) { |
a08646d2 |
uint8_t piv[32], tmph[32]; |
bb2f6b0b |
size_t l1, r1;
const char *tmpv;
|
125827cf |
if(l + 1 >= r) |
bb2f6b0b |
return;
l1 = l+1, r1 = r;
memcpy(piv, &szh->hash_array[keylen * l], keylen);
while(l1 < r1) { |
2296ab0f |
if(hm_cmp(&szh->hash_array[keylen * l1], piv, keylen) > 0) { |
bb2f6b0b |
r1--; |
189cf9bb |
if(l1 == r1) break; |
bb2f6b0b |
memcpy(tmph, &szh->hash_array[keylen * l1], keylen);
tmpv = szh->virusnames[l1];
memcpy(&szh->hash_array[keylen * l1], &szh->hash_array[keylen * r1], keylen);
szh->virusnames[l1] = szh->virusnames[r1];
memcpy(&szh->hash_array[keylen * r1], tmph, keylen);
szh->virusnames[r1] = tmpv;
} else
l1++;
}
l1--; |
125827cf |
if(l1!=l) {
memcpy(tmph, &szh->hash_array[keylen * l1], keylen);
tmpv = szh->virusnames[l1];
memcpy(&szh->hash_array[keylen * l1], &szh->hash_array[keylen * l], keylen);
szh->virusnames[l1] = szh->virusnames[l];
memcpy(&szh->hash_array[keylen * l], tmph, keylen);
szh->virusnames[l] = tmpv;
} |
bb2f6b0b |
hm_sort(szh, l, l1, keylen);
hm_sort(szh, r1, r, keylen);
}
|
125827cf |
|
bb2f6b0b |
void hm_flush(struct cli_matcher *root) {
enum CLI_HASH_TYPE type;
if(!root)
return;
for(type = CLI_HASH_MD5; type < CLI_HASH_AVAIL_TYPES; type++) { |
a08646d2 |
struct cli_htu32 *ht = &root->hm.sizehashes[type];
const struct cli_htu32_element *item = NULL;
|
3faa9783 |
if(!root->hm.sizehashes[type].capacity) |
a08646d2 |
continue;
while((item = cli_htu32_next(ht, item))) {
struct cli_sz_hash *szh = (struct cli_sz_hash *)item->data.as_ptr; |
bb2f6b0b |
unsigned int keylen = hashlen[type];
if(szh->items > 1)
hm_sort(szh, 0, szh->items, keylen);
}
}
}
|
096cea46 |
|
2296ab0f |
int cli_hm_have_size(const struct cli_matcher *root, enum CLI_HASH_TYPE type, uint32_t size) { |
3faa9783 |
return (size && size != 0xffffffff && root && root->hm.sizehashes[type].capacity && cli_htu32_find(&root->hm.sizehashes[type], size)); |
2296ab0f |
}
|
096cea46 |
int cli_hm_scan(const unsigned char *digest, uint32_t size, const char **virname, const struct cli_matcher *root, enum CLI_HASH_TYPE type) { |
a08646d2 |
const struct cli_htu32_element *item; |
096cea46 |
unsigned int keylen;
struct cli_sz_hash *szh;
size_t l, r;
|
3faa9783 |
if(!digest || !size || size == 0xffffffff || !root || !root->hm.sizehashes[type].capacity) |
096cea46 |
return CL_CLEAN;
|
a08646d2 |
item = cli_htu32_find(&root->hm.sizehashes[type], size);
if(!item) |
096cea46 |
return CL_CLEAN;
|
a08646d2 |
szh = (struct cli_sz_hash *)item->data.as_ptr; |
096cea46 |
keylen = hashlen[type];
l = 0; |
5e760623 |
r = szh->items - 1; |
125827cf |
while(l <= r) { |
096cea46 |
size_t c = (l + r) / 2; |
a08646d2 |
int res = hm_cmp(digest, &szh->hash_array[keylen * c], keylen); |
096cea46 |
|
125827cf |
if(res < 0) {
if(!c)
break;
r = c - 1;
} else if(res > 0)
l = c + 1; |
096cea46 |
else {
if(virname)
*virname = szh->virusnames[c];
return CL_VIRUS;
}
}
return CL_CLEAN;
} |
3faa9783 |
void hm_free(struct cli_matcher *root) {
enum CLI_HASH_TYPE type;
if(!root)
return;
for(type = CLI_HASH_MD5; type < CLI_HASH_AVAIL_TYPES; type++) {
struct cli_htu32 *ht = &root->hm.sizehashes[type];
const struct cli_htu32_element *item = NULL;
if(!root->hm.sizehashes[type].capacity)
continue;
while((item = cli_htu32_next(ht, item))) {
struct cli_sz_hash *szh = (struct cli_sz_hash *)item->data.as_ptr;
unsigned int keylen = hashlen[type];
mpool_free(root->mempool, szh->hash_array); |
e010aa7a |
while(szh->items) |
e10286bd |
mpool_free(root->mempool, (void *)szh->virusnames[--szh->items]); |
3faa9783 |
mpool_free(root->mempool, szh->virusnames);
mpool_free(root->mempool, szh);
}
cli_htu32_free(ht, root->mempool);
}
}
|