1 //-------------------------------------------------------------------------- 2 // Copyright (C) 2020-2021 Cisco and/or its affiliates. All rights reserved. 3 // 4 // This program is free software; you can redistribute it and/or modify it 5 // under the terms of the GNU General Public License Version 2 as published 6 // by the Free Software Foundation. You may not use, modify or distribute 7 // this program under any other version of the GNU General Public License. 8 // 9 // This program is distributed in the hope that it will be useful, but 10 // WITHOUT ANY WARRANTY; without even the implied warranty of 11 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 // General Public License for more details. 13 // 14 // You should have received a copy of the GNU General Public License along 15 // with this program; if not, write to the Free Software Foundation, Inc., 16 // 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. 17 //-------------------------------------------------------------------------- 18 // boyer_moore_search.h author Brandon Stultz <brastult@cisco.com> 19 20 #ifndef BOYER_MOORE_SEARCH_H 21 #define BOYER_MOORE_SEARCH_H 22 23 // Boyer-Moore literal content matching routines (single pattern) 24 // use LiteralSearch::instantiate to get hyperscan if available 25 26 #include "helpers/literal_search.h" 27 #include "main/snort_types.h" 28 29 namespace snort 30 { 31 32 class SO_PUBLIC BoyerMooreSearch : public LiteralSearch 33 { 34 protected: 35 BoyerMooreSearch(const uint8_t* pattern, unsigned pattern_len); 36 37 protected: 38 void make_skip(); 39 40 const uint8_t* pattern; 41 unsigned pattern_len; 42 unsigned last; 43 44 unsigned skip[256]; 45 }; 46 47 class SO_PUBLIC BoyerMooreSearchCase : public BoyerMooreSearch 48 { 49 public: BoyerMooreSearchCase(const uint8_t * pat,unsigned pat_len)50 BoyerMooreSearchCase(const uint8_t* pat, unsigned pat_len) : 51 BoyerMooreSearch(pat, pat_len) { } 52 53 int search(const uint8_t* buffer, unsigned buffer_len) const; 54 search(void *,const uint8_t * buffer,unsigned buffer_len)55 int search(void*, const uint8_t* buffer, unsigned buffer_len) const override 56 { return search(buffer, buffer_len); } 57 }; 58 59 class SO_PUBLIC BoyerMooreSearchNoCase : public BoyerMooreSearch 60 { 61 public: BoyerMooreSearchNoCase(const uint8_t * pat,unsigned pat_len)62 BoyerMooreSearchNoCase(const uint8_t* pat, unsigned pat_len) : 63 BoyerMooreSearch(pat, pat_len) { } 64 65 int search(const uint8_t* buffer, unsigned buffer_len) const; 66 search(void *,const uint8_t * buffer,unsigned buffer_len)67 int search(void*, const uint8_t* buffer, unsigned buffer_len) const override 68 { return search(buffer, buffer_len); } 69 }; 70 71 } 72 #endif 73 74