aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix hash generation in b2g and ac addpattern. Brings down the no of patterns added from close to a million to a couple of thousands

Browse Source
remotes/origin/master-1.1.x
Anoop Saldanha 15 years ago committed by Victor Julien
parent 29b5cb9abd
commit 174048544d
7 changed files with 79 additions and 14 deletions
Show Stats Download Patch File Download Diff File

3
src/detect.c
Unescape Escape View File

@ -3609,16 +3609,19 @@ int SigGroupBuild (DetectEngineCtx *de_ctx) {
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
printf("packet- %d\n", mpm_ctx->pattern_cnt);
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_uri);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
printf("uri- %d\n", mpm_ctx->pattern_cnt);
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_stream);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
printf("stream- %d\n", mpm_ctx->pattern_cnt);
}
// SigAddressPrepareStage5(de_ctx);

51
src/util-mpm-ac.c
Unescape Escape View File

@ -181,7 +181,8 @@ static inline uint32_t SCACInitHashRaw(uint8_t *pat, uint16_t patlen)
* \retval hash A 32 bit unsigned hash.
*/
static inline SCACPattern *SCACInitHashLookup(SCACCtx *ctx, uint8_t *pat,
uint16_t patlen, char flags)
uint16_t patlen, char flags,
uint32_t pid)
{
uint32_t hash = SCACInitHashRaw(pat, patlen);
@ -191,7 +192,8 @@ static inline SCACPattern *SCACInitHashLookup(SCACCtx *ctx, uint8_t *pat,
SCACPattern *t = ctx->init_hash[hash];
for ( ; t != NULL; t = t->next) {
if (SCACCmpPattern(t, pat, patlen, flags) == 1)
//if (SCACCmpPattern(t, pat, patlen, flags) == 1)
if (t->flags == flags && t->id == pid)
return t;
}
@ -268,9 +270,9 @@ static inline void memcpy_tolower(uint8_t *d, uint8_t *s, uint16_t len)
static inline uint32_t SCACInitHash(SCACPattern *p)
{
uint32_t hash = p->len * p->cs[0];
uint32_t hash = p->len * p->original_pat[0];
if (p->len > 1)
hash += p->cs[1];
hash += p->original_pat[1];
return (hash % INIT_HASH_SIZE);
}
@ -327,7 +329,7 @@ static int SCACAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen,
}
/* check if we have already inserted this pattern */
SCACPattern *p = SCACInitHashLookup(ctx, pat, patlen, flags);
SCACPattern *p = SCACInitHashLookup(ctx, pat, patlen, flags, pid);
if (p == NULL) {
SCLogDebug("Allocing new pattern");
@ -338,6 +340,13 @@ static int SCACAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen,
p->flags = flags;
p->id = pid;
p->original_pat = SCMalloc(patlen);
if (p->original_pat == NULL)
goto error;
mpm_ctx->memory_cnt++;
mpm_ctx->memory_size += patlen;
memcpy(p->original_pat, pat, patlen);
p->ci = SCMalloc(patlen);
if (p->ci == NULL)
goto error;
@ -1994,6 +2003,37 @@ static int SCACTest24(void)
return result;
}
static int SCACTest25(void)
{
int result = 0;
MpmCtx mpm_ctx;
MpmThreadCtx mpm_thread_ctx;
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx));
MpmInitCtx(&mpm_ctx, MPM_AC, -1);
SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx, 0);
SCACAddPatternCI(&mpm_ctx, (uint8_t *)"ABCD", 4, 0, 0, 0, 0, 0);
SCACAddPatternCI(&mpm_ctx, (uint8_t *)"bCdEfG", 6, 0, 0, 1, 0, 0);
SCACAddPatternCI(&mpm_ctx, (uint8_t *)"fghJikl", 7, 0, 0, 2, 0, 0);
SCACPreparePatterns(&mpm_ctx);
char *buf = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, NULL,
(uint8_t *)buf, strlen(buf));
if (cnt == 3)
result = 1;
else
printf("3 != %" PRIu32 " ",cnt);
SCACDestroyCtx(&mpm_ctx);
SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx);
return result;
}
#endif /* UNITTESTS */
void SCACRegisterTests(void)
@ -2024,6 +2064,7 @@ void SCACRegisterTests(void)
UtRegisterTest("SCACTest22", SCACTest22, 1);
UtRegisterTest("SCACTest23", SCACTest23, 1);
UtRegisterTest("SCACTest24", SCACTest24, 1);
UtRegisterTest("SCACTest25", SCACTest25, 1);
#endif
return;

2
src/util-mpm-ac.h
Unescape Escape View File

@ -30,6 +30,8 @@ typedef struct SCACPattern_ {
uint16_t len;
/* flags decribing the pattern */
uint8_t flags;
/* holds the original pattern that was added */
uint8_t *original_pat;
/* case sensitive */
uint8_t *cs;
/* case INsensitive */

24
src/util-mpm-b2g.c
Unescape Escape View File

@ -177,9 +177,9 @@ static inline void memcpy_tolower(uint8_t *d, uint8_t *s, uint16_t len) {
* INIT HASH START
*/
static inline uint32_t B2gInitHash(B2gPattern *p) {
uint32_t hash = p->len * p->cs[0];
uint32_t hash = p->len * p->original_pat[0];
if (p->len > 1)
hash += p->cs[1];
hash += p->original_pat[1];
return (hash % INIT_HASH_SIZE);
}
@ -220,7 +220,8 @@ static inline int B2gInitHashAdd(B2gCtx *ctx, B2gPattern *p) {
static inline int B2gCmpPattern(B2gPattern *p, uint8_t *pat, uint16_t patlen, char flags);
static inline B2gPattern *B2gInitHashLookup(B2gCtx *ctx, uint8_t *pat, uint16_t patlen, char flags) {
static inline B2gPattern *B2gInitHashLookup(B2gCtx *ctx, uint8_t *pat, uint16_t patlen, char flags,
uint32_t pid) {
uint32_t hash = B2gInitHashRaw(pat,patlen);
//printf("B2gInitHashLookup: %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]);
@ -231,7 +232,8 @@ static inline B2gPattern *B2gInitHashLookup(B2gCtx *ctx, uint8_t *pat, uint16_t
B2gPattern *t = ctx->init_hash[hash];
for ( ; t != NULL; t = t->next) {
if (B2gCmpPattern(t,pat,patlen,flags) == 1)
//if (B2gCmpPattern(t,pat,patlen,flags) == 1)
if (t->flags == flags && t->id == pid)
return t;
}
@ -295,7 +297,7 @@ static int B2gAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_
return 0;
/* get a memory piece */
B2gPattern *p = B2gInitHashLookup(ctx, pat, patlen, flags);
B2gPattern *p = B2gInitHashLookup(ctx, pat, patlen, flags, pid);
if (p == NULL) {
SCLogDebug("allocing new pattern");
@ -307,6 +309,13 @@ static int B2gAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_
p->flags = flags;
p->id = pid;
p->original_pat = SCMalloc(patlen);
if (p->original_pat == NULL)
goto error;
mpm_ctx->memory_cnt++;
mpm_ctx->memory_size += patlen;
memcpy(p->original_pat, pat, patlen);
/* setup the case insensitive part of the pattern */
p->ci = SCMalloc(patlen);
if (p->ci == NULL)
@ -752,7 +761,10 @@ static void B2gGetConfig()
void B2gInitCtx (MpmCtx *mpm_ctx, int module_handle) {
SCLogDebug("mpm_ctx %p, ctx %p", mpm_ctx, mpm_ctx->ctx);
BUG_ON(mpm_ctx->ctx != NULL);
if (mpm_ctx->ctx != NULL)
return;
//BUG_ON(mpm_ctx->ctx != NULL);
mpm_ctx->ctx = SCMalloc(sizeof(B2gCtx));
if (mpm_ctx->ctx == NULL) {

1
src/util-mpm-b2g.h
Unescape Escape View File

@ -56,6 +56,7 @@ typedef struct B2gPattern_ {
uint8_t flags;
uint8_t pad0;
uint32_t id;
uint8_t *original_pat;
uint8_t *ci; /* case INsensitive */
uint8_t *cs; /* case sensitive */
struct B2gPattern_ *next;

5
src/util-mpm-b2gc.c
Unescape Escape View File

@ -904,7 +904,10 @@ static void B2gcGetConfig()
void B2gcInitCtx (MpmCtx *mpm_ctx, int module_handle) {
SCLogDebug("mpm_ctx %p, ctx %p", mpm_ctx, mpm_ctx->ctx);
BUG_ON(mpm_ctx->ctx != NULL);
if (mpm_ctx->ctx != NULL)
return;
//BUG_ON(mpm_ctx->ctx != NULL);
mpm_ctx->ctx = SCMalloc(sizeof(B2gcCtx));
if (mpm_ctx->ctx == NULL) {

7
src/util-mpm.c
Unescape Escape View File

@ -110,12 +110,15 @@ int32_t MpmFactoryRegisterMpmCtxProfile(const char *name, uint8_t flags)
}
/* let's make the new entry */
if ((items = realloc(items, (mpm_ctx_factory_container->no_of_items + 1) *
sizeof(MpmCtxFactoryItem))) == NULL) {
items = realloc(items,
(mpm_ctx_factory_container->no_of_items + 1) * sizeof(MpmCtxFactoryItem));
if (items == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
exit(EXIT_FAILURE);
}
mpm_ctx_factory_container->items = items;
MpmCtxFactoryItem *new_item = &items[mpm_ctx_factory_container->no_of_items];
new_item[0].name = strdup(name);
if (new_item[0].name == NULL) {

Write Preview
Loading…
Cancel
Save