mirror of https://github.com/OISF/suricata
rust: add flowbit dependency resolver
This solution makes use of the petgraph crate to create a directed
stable graph of signatures. The algorithm is as follows:
- A stable Directed Graph is created
- A Flowbit Analyzer array is created which stores the sids per flowbit
per command
- for each entry in the flowbit analyzer "READ" array of type isset
- set array is walked => a directed edge* from the set sid to isset sid
with the weight of SET command is added.
- for each entry in the flowbit analyzer "READ" array of type isnotset
- unset array is walked => a directed edge from the set sid to isnotset sid
with the weight of SET command is added.
- If there was no error (cycle), this means that the current graph is a
DAG (Directed Acyclic Graph)
- Perform a topological sort of the DAG
1. If a cycle is formed by varying edge weights, it's an invalid cycle.
This would be formed by usage of different "WRITE" commands in
different signatures e.g.
sid: 1 => set, A; isset, B; # a directed edge of weight 0 is created
from 1 to 2 for flowbit A.
sid: 2 => isset, A; unset, B; # a directed edge of weight 2 is
created from 2 to 1 for flowbit B.
2. If the cycle is formed by the same edge weights, it is considered
unsatisfiable at runtime.
Bug 7771
Bug 7638
Bug 1399
pull/16172/head
Shivani Bhardwaj
6 months ago
parent
c796b6e9d1
commit
659e7f924a
@ -0,0 +1,286 @@
|
||||
/* Copyright (C) 2026 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
// Author: Shivani Bhardwaj <shivani@oisf.net>
|
||||
|
||||
use petgraph::algo::{is_cyclic_directed, tarjan_scc, toposort};
|
||||
use petgraph::graph::{GraphError, NodeIndex};
|
||||
use petgraph::stable_graph::StableDiGraph;
|
||||
use petgraph::visit::EdgeRef;
|
||||
use petgraph::Direction;
|
||||
use std::collections::{HashMap, HashSet};
|
||||
use std::os::raw::c_void;
|
||||
|
||||
/// Special Graph Node storing flowbit or signature
|
||||
#[derive(Debug, Copy, Clone)]
|
||||
struct SCGNode {
|
||||
iid: u32,
|
||||
sid: u32,
|
||||
nidx: NodeIndex, /* Graph's internal node index */
|
||||
}
|
||||
|
||||
/// Edge object to determine a genuine cycle breaker
|
||||
#[derive(Debug, Copy, Clone)]
|
||||
struct SCGEdge {
|
||||
cmd: u8,
|
||||
fb_id: u32,
|
||||
}
|
||||
|
||||
#[derive(Debug)]
|
||||
struct FlowbitSidStore {
|
||||
graph: StableDiGraph<SCGNode, SCGEdge>,
|
||||
iid_map: HashMap<u32, NodeIndex>,
|
||||
}
|
||||
|
||||
/// Function to create an empty directed Graph
|
||||
#[no_mangle]
|
||||
pub unsafe extern "C" fn SCCreateDirectedGraph() -> *mut c_void {
|
||||
// StableDiGraph is the ideal choice here for there is removal of
|
||||
// nodes in the line later and this type of graph guarantees to
|
||||
// not re-use any existing node indices
|
||||
let fb_sid_store = FlowbitSidStore {
|
||||
graph: StableDiGraph::new(),
|
||||
iid_map: HashMap::new(),
|
||||
};
|
||||
|
||||
/* Make an opaque pointer for C as nothing is changed there */
|
||||
return Box::into_raw(Box::new(fb_sid_store)) as *mut c_void;
|
||||
}
|
||||
|
||||
/// Drop the directed Graph. Called from C.
|
||||
#[no_mangle]
|
||||
pub unsafe extern "C" fn SCFreeDirectedGraph(store: *mut c_void) {
|
||||
let _ = Box::from_raw(store as *mut FlowbitSidStore);
|
||||
}
|
||||
|
||||
#[no_mangle]
|
||||
pub unsafe extern "C" fn SCGetOrCreateNodeGraph(graph: *mut c_void, iid: u32, sid: u32) -> i64 {
|
||||
let g = &mut *(graph as *mut FlowbitSidStore);
|
||||
|
||||
let Some(node_idx) = get_or_create_node(g, iid, sid) else {
|
||||
SCLogError!("Error adding node; Graph is at full capacity");
|
||||
return -2;
|
||||
};
|
||||
|
||||
node_idx.index() as i64
|
||||
}
|
||||
|
||||
/// Function to get or create a node and add an appropriate directed
|
||||
/// edge based on its type
|
||||
#[no_mangle]
|
||||
pub unsafe extern "C" fn SCCreateNodeEdgeDirectedGraph(
|
||||
fss_void: *mut c_void, from: u32, to: u32, cmd: u8, fb_id: u32,
|
||||
) -> i64 {
|
||||
let fss = &mut *(fss_void as *mut FlowbitSidStore);
|
||||
|
||||
let from_idx = NodeIndex::from(from);
|
||||
let to_idx = NodeIndex::from(to);
|
||||
|
||||
match fss
|
||||
.graph
|
||||
.try_update_edge(from_idx, to_idx, SCGEdge { cmd, fb_id })
|
||||
{
|
||||
/* edge from a flowbit setter to a flowbit reader */
|
||||
Ok(_) => {
|
||||
SCLogDebug!(
|
||||
"Created an edge from {:?} -> {:?} for flowbit {:?} with command: {:?}",
|
||||
from,
|
||||
to,
|
||||
fb_id,
|
||||
cmd
|
||||
);
|
||||
}
|
||||
Err(GraphError::EdgeIxLimit) => {
|
||||
SCLogError!("Error adding edge; Graph is at full capacity");
|
||||
return -2;
|
||||
}
|
||||
Err(GraphError::NodeOutBounds) => {
|
||||
SCLogError!("Error adding edge; node does not exist");
|
||||
return -2;
|
||||
}
|
||||
Err(_) => {
|
||||
SCLogError!("Error adding edge to the Graph");
|
||||
return -2;
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
fn check_cycle_update_graph(graph: &mut StableDiGraph<SCGNode, SCGEdge>) -> i8 {
|
||||
let mut MAX_STACK_SIZE: usize = 100;
|
||||
|
||||
for i in 0..MAX_STACK_SIZE {
|
||||
/* Check graph for any cycles */
|
||||
if !is_cyclic_directed(&*graph) {
|
||||
SCLogDebug!("no cycles after {} tries", i);
|
||||
return 0;
|
||||
}
|
||||
|
||||
SCLogDebug!("Found a cycle in i {}. Checking if it's valid..", i);
|
||||
|
||||
if !try_resolve_one_cycle(graph) {
|
||||
/* If we can't resolve any cycle, we're stuck */
|
||||
SCLogError!("Unable to resolve cycles after {} tries", i);
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
|
||||
SCLogError!(
|
||||
"Maximum tries ({}) reached while trying to resolve cycles",
|
||||
MAX_STACK_SIZE
|
||||
);
|
||||
return -1;
|
||||
}
|
||||
|
||||
fn try_resolve_one_cycle(graph: &mut StableDiGraph<SCGNode, SCGEdge>) -> bool {
|
||||
let sccs = tarjan_scc(&*graph);
|
||||
let mut edge_map: HashMap<petgraph::graph::EdgeIndex, u8> = HashMap::new();
|
||||
|
||||
/* Find the first multi-node SCC */
|
||||
for scc in sccs {
|
||||
if scc.len() == 1 {
|
||||
let self_loop_edges: Vec<_> = graph
|
||||
.edges(scc[0])
|
||||
.filter(|edge| edge.target() == scc[0])
|
||||
.map(|edge| edge.id())
|
||||
.collect();
|
||||
|
||||
if let Some(edge) = self_loop_edges.into_iter().next() {
|
||||
graph.remove_edge(edge);
|
||||
return true;
|
||||
}
|
||||
continue;
|
||||
}
|
||||
|
||||
SCLogDebug!("Current scc: {:?}", scc);
|
||||
let scc_set: HashSet<_> = scc.iter().copied().collect();
|
||||
let edge_indices: Vec<_> = graph.edge_indices().collect();
|
||||
|
||||
for edge_idx in edge_indices {
|
||||
let Some((_src, tgt)) = graph.edge_endpoints(edge_idx) else {
|
||||
continue;
|
||||
};
|
||||
if !(scc_set.contains(&_src) && scc_set.contains(&tgt)) {
|
||||
continue;
|
||||
}
|
||||
let SCGEdge { cmd, fb_id } = graph[edge_idx];
|
||||
let same_bit_setters = graph
|
||||
.edges_directed(tgt, Direction::Incoming)
|
||||
.filter(|e| e.weight().fb_id == fb_id)
|
||||
.count();
|
||||
if same_bit_setters > 1 {
|
||||
graph.remove_edge(edge_idx);
|
||||
return true;
|
||||
}
|
||||
/* store cycle edges to inspect their commands (weights) later */
|
||||
edge_map.insert(edge_idx, cmd);
|
||||
}
|
||||
/* Find if the cycle causing edges are made up of differing weights */
|
||||
let distinct_weights = edge_map.values().copied().collect::<HashSet<u8>>().len();
|
||||
debug_validate_bug_on!(distinct_weights == 0);
|
||||
if distinct_weights > 1 {
|
||||
/* Find and remove the edge with highest weight (lowest priority) */
|
||||
if let Some((cur_e, _)) = edge_map.iter().max_by_key(|(_, &weight)| weight) {
|
||||
graph.remove_edge(*cur_e);
|
||||
return true;
|
||||
}
|
||||
} else {
|
||||
/* Valid cycle with same weights -- can't resolve */
|
||||
let sids: Vec<_> = scc_set.into_iter().map(|a| graph[a].sid).collect();
|
||||
SCLogError!(
|
||||
"Cyclic dependency found between flowbits from signatures: {:?}",
|
||||
sids
|
||||
);
|
||||
return false;
|
||||
}
|
||||
break;
|
||||
}
|
||||
|
||||
/* couldn't resolve */
|
||||
false
|
||||
}
|
||||
|
||||
/// Wrapper function to resolve flowbit dependencies
|
||||
#[no_mangle]
|
||||
pub unsafe extern "C" fn SCResolveFlowbitDependencies(
|
||||
fss_void: *mut c_void, sorted_iid_list: *mut u32, sorted_iid_list_len: u32,
|
||||
) -> i8 {
|
||||
SCLogDebug!("Attempting to resolve flowbit dependencies");
|
||||
let fss = &mut *(fss_void as *mut FlowbitSidStore);
|
||||
|
||||
let r = check_cycle_update_graph(&mut fss.graph);
|
||||
if r == -1 {
|
||||
SCLogError!("Couldn't do anything to fix the graph. Retreating..");
|
||||
return -1;
|
||||
}
|
||||
|
||||
debug_validate_bug_on!(fss.graph.node_count() == 0);
|
||||
|
||||
let sorted_iid_list =
|
||||
std::slice::from_raw_parts_mut(&mut *sorted_iid_list, sorted_iid_list_len as usize);
|
||||
|
||||
/* No need for all the extra work if there's just one node */
|
||||
if fss.graph.node_count() == 1 {
|
||||
debug_validate_bug_on!(sorted_iid_list_len != 1);
|
||||
sorted_iid_list[0] = fss.graph[NodeIndex::from(0)].iid;
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* At this point, it must be a DAG, so perform a topological sort to find
|
||||
* out the correct order of signatures */
|
||||
return toposort_dag(&fss.graph, sorted_iid_list);
|
||||
}
|
||||
|
||||
fn get_or_create_node(fss: &mut FlowbitSidStore, iid: u32, sid: u32) -> Option<NodeIndex> {
|
||||
if let Some(&nidx) = fss.iid_map.get(&iid) {
|
||||
return Some(nidx); /* O(1) */
|
||||
}
|
||||
let nd = SCGNode {
|
||||
iid,
|
||||
sid,
|
||||
nidx: NodeIndex::from(u32::MAX),
|
||||
};
|
||||
if let Ok(idx) = fss.graph.try_add_node(nd) {
|
||||
/* O(1) */
|
||||
fss.graph[idx].nidx = idx;
|
||||
fss.iid_map.insert(iid, idx);
|
||||
SCLogDebug!("Created node: {:?}", fss.graph[idx]);
|
||||
return Some(idx);
|
||||
}
|
||||
|
||||
None
|
||||
}
|
||||
|
||||
/// Produce a topological ordering of the DAG
|
||||
fn toposort_dag(graph: &StableDiGraph<SCGNode, SCGEdge>, sorted_iid_list: &mut [u32]) -> i8 {
|
||||
match toposort(graph, None) {
|
||||
Ok(order) => {
|
||||
debug_validate_bug_on!(order.len() != sorted_iid_list.len());
|
||||
for (i, idx) in order.into_iter().enumerate() {
|
||||
SCLogDebug!("[{:?}]: {:?}", i, graph[idx]);
|
||||
sorted_iid_list[i] = graph[idx].iid;
|
||||
}
|
||||
0
|
||||
}
|
||||
Err(_) => {
|
||||
/* Unreachable in practice: cycles are resolved before this point */
|
||||
SCLogError!("Graph still contains a cycle; cannot produce an order");
|
||||
-1
|
||||
}
|
||||
}
|
||||
}
|
||||
Loading…
Reference in New Issue