1 //--------------------------------------------------------------------------
2 // Copyright (C) 2020-2021 Cisco and/or its affiliates. All rights reserved.
3 //
4 // This program is free software; you can redistribute it and/or modify it
5 // under the terms of the GNU General Public License Version 2 as published
6 // by the Free Software Foundation.  You may not use, modify or distribute
7 // this program under any other version of the GNU General Public License.
8 //
9 // This program is distributed in the hope that it will be useful, but
10 // WITHOUT ANY WARRANTY; without even the implied warranty of
11 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
12 // General Public License for more details.
13 //
14 // You should have received a copy of the GNU General Public License along
15 // with this program; if not, write to the Free Software Foundation, Inc.,
16 // 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
17 //--------------------------------------------------------------------------
18 // boyer_moore_search.h author Brandon Stultz <brastult@cisco.com>
19 
20 #ifndef BOYER_MOORE_SEARCH_H
21 #define BOYER_MOORE_SEARCH_H
22 
23 // Boyer-Moore literal content matching routines (single pattern)
24 // use LiteralSearch::instantiate to get hyperscan if available
25 
26 #include "helpers/literal_search.h"
27 #include "main/snort_types.h"
28 
29 namespace snort
30 {
31 
32 class SO_PUBLIC BoyerMooreSearch : public LiteralSearch
33 {
34 protected:
35     BoyerMooreSearch(const uint8_t* pattern, unsigned pattern_len);
36 
37 protected:
38     void make_skip();
39 
40     const uint8_t* pattern;
41     unsigned pattern_len;
42     unsigned last;
43 
44     unsigned skip[256];
45 };
46 
47 class SO_PUBLIC BoyerMooreSearchCase : public BoyerMooreSearch
48 {
49 public:
BoyerMooreSearchCase(const uint8_t * pat,unsigned pat_len)50     BoyerMooreSearchCase(const uint8_t* pat, unsigned pat_len) :
51         BoyerMooreSearch(pat, pat_len) { }
52 
53     int search(const uint8_t* buffer, unsigned buffer_len) const;
54 
search(void *,const uint8_t * buffer,unsigned buffer_len)55     int search(void*, const uint8_t* buffer, unsigned buffer_len) const override
56     { return search(buffer, buffer_len); }
57 };
58 
59 class SO_PUBLIC BoyerMooreSearchNoCase : public BoyerMooreSearch
60 {
61 public:
BoyerMooreSearchNoCase(const uint8_t * pat,unsigned pat_len)62     BoyerMooreSearchNoCase(const uint8_t* pat, unsigned pat_len) :
63         BoyerMooreSearch(pat, pat_len) { }
64 
65     int search(const uint8_t* buffer, unsigned buffer_len) const;
66 
search(void *,const uint8_t * buffer,unsigned buffer_len)67     int search(void*, const uint8_t* buffer, unsigned buffer_len) const override
68     { return search(buffer, buffer_len); }
69 };
70 
71 }
72 #endif
73 
74