<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
The issue is with the "any" ip address, when handled by
DetectAddressSetup().<br>
<br>
/* if any, insert 0.0.0.0/0 and ::/0 as well */<br>
<br>
Not exactly sure the behavior for x86 but for sparc, the netmask
becomes 0xffffffff. Essentially the full range of IPv4 addresses are
added to the hash table. <br>
<br>
1. IPOnlyAddSignature() calls IPOnlyAddSlash16() to add 0.0.0.0/0 in
64K steps (2^32 divided by 2^16)<br>
<br>
2. The hash function uses the lower 16 bits which are all 0's, the same
for each entry to be hashed.<br>
<br>
#define IPONLY_EXTRACT_16(a) ((a)->ip[0] & 0x0000ffff)<br>
<br>
3. This is the worst case for the hashed list table as all keys get
hashed to the same bucket. Towards the end of the 64K steps, each add
would traverse a linked list of size 64K. <br>
<br>
4. I modified the hash function so the upper 16 bits are also used and
SigTestBidirec03 can run to completion now. <br>
<br>
#define IPONLY_EXTRACT_16(a)\<br>
((((a)->ip[0] & 0x0000ffff) + (((a)->ip[0] &
0xffff0000)>>8)) & 0x0000ffff)<br>
<br>
Question: I saw high = 0xffffffff and low = 0x0 in the following
invocation of IPOnlyAddSlash16(), for adding the address 0.0.0.0/0. Are
the high and low values correct? <br>
<br>
static void IPOnlyAddSlash16(DetectEngineCtx *de_ctx,
DetectEngineIPOnlyCtx *io_ctx,<br>
HashListTable *ht, DetectAddress *gr, char direction, Signature *s) {<br>
uint32_t high = ntohl(gr->ip2[0]);<br>
uint32_t low = ntohl(gr->ip[0]);<br>
<br>
Thanks,<br>
Yaomin<br>
<br>
<br>
On 01/31/10 10:00, Will Metcalf wrote:
<blockquote
cite="mid:c13e433a1001311000w2f7e209et331416ce4d25e60e@mail.gmail.com"
type="cite">I think this is a problem somewhere in the cidr masking.
I have seen this before on PPC so I'm guessing it is an endian issue, I
have not had a chance to look into it any further. Let me know if you
figure it out ;-)....<br>
<br>
<a moz-do-not-send="true"
href="https://redmine.openinfosecfoundation.org/issues/show/63">https://redmine.openinfosecfoundation.org/issues/show/63</a><br>
<br>
Regards,<br>
<br>
Will<br>
<br>
<div class="gmail_quote">On Sun, Jan 31, 2010 at 11:23 AM, Yao-Min
Chen <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:Yaomin.Chen@sun.com">Yaomin.Chen@sun.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">My
unit test SigTestBidirec03 seems to loop forever while traversing the<br>
hashed list of signature patterns (I verified this by setting break<br>
point and single stepping the run). Any hint on how to check whether the<br>
hashed list is properly terminated, and without self-looping?<br>
<br>
Test SigTestBidirec03 :<br>
^Cdbx: warning: Interrupt ignored but forwarded to child.<br>
t@1 (l@1) signal INT (Interrupt) in DetectAddressCmp at line 1392 in<br>
file "detect-engine-address.c"<br>
1392 if (a->flags & ADDRESS_FLAG_ANY &&
b->flags & ADDRESS_FLAG_ANY)<br>
(dbx) where<br>
current thread: t@1<br>
=>[1] DetectAddressCmp(a = <value not available>, b =
0xacc220), line<br>
1392 in "detect-engine-address.c"<br>
[2] IPOnlyCompareFunc(data1 = 0xa87ce8, len1 = <value not
available>,<br>
data2 = 0xacc220, len2 = <value not available>), line 190 in<br>
"detect-engine-iponly.c"<br>
[3] HashListTableLookup(ht = <value not available>, data =
0xacc220,<br>
datalen = <value not available>), line 237 in "util-hashlist.c"<br>
[4] IPOnlyAddSlash16(de_ctx = 0x4c8240, io_ctx = 0x4ca2d0, ht =<br>
0x2b06f8, gr = 0x5e3898, direction = <value not available>, s =<br>
0x5e3780), line 81 in "detect-engine-iponly.c"<br>
[5] IPOnlyAddSignature(de_ctx = 0x4c8240, io_ctx = 0x4ca2d0, s =<br>
0x5e3780), line 475 in "detect-engine-iponly.c"<br>
[6] SigAddressPrepareStage2(de_ctx = 0x4c8240), line 1667 in "detect.c"<br>
[7] SigGroupBuild(de_ctx = 0x4c8240), line 2797 in "detect.c"<br>
[8] UTHMatchPackets(de_ctx = 0x4c8240, p = <value not available>,<br>
num_packets = -16948332), line 465 in "util-unittest-helper.c"<br>
[9] SigTestBidirec03(), line 1352 in "detect-parse.c"<br>
[10] UtRunTests(regex_arg = <value not available>), line 182 in<br>
"util-unittest.c"<br>
[11] main(argc = <value not available>, argv = <value not
available>),<br>
line 596 in "suricata.c"<br>
<br>
Thanks,<br>
Yaomin<br>
<br>
_______________________________________________<br>
Oisf-devel mailing list<br>
<a moz-do-not-send="true"
href="mailto:Oisf-devel@openinfosecfoundation.org">Oisf-devel@openinfosecfoundation.org</a><br>
<a moz-do-not-send="true"
href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel"
target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel</a><br>
</blockquote>
</div>
<br>
<pre wrap="">
<hr size="4" width="90%">
_______________________________________________
Oisf-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Oisf-devel@openinfosecfoundation.org">Oisf-devel@openinfosecfoundation.org</a>
<a class="moz-txt-link-freetext" href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel</a>
</pre>
</blockquote>
<br>
</body>
</html>