detect: consolidate per rule group file loops

Don't loop multiple times over the per group sig array.
pull/10134/head
Victor Julien 3 years ago committed by Victor Julien
parent 3b8ed937d7
commit 75c1b7fb10

@ -1825,10 +1825,7 @@ int SigPrepareStage4(DetectEngineCtx *de_ctx)
SCLogDebug("sgh %p", sgh);
SigGroupHeadSetFilemagicFlag(de_ctx, sgh);
SigGroupHeadSetFileHashFlag(de_ctx, sgh);
SigGroupHeadSetFilesizeFlag(de_ctx, sgh);
SigGroupHeadSetFilestoreCount(de_ctx, sgh);
SigGroupHeadSetupFiles(de_ctx, sgh);
SCLogDebug("filestore count %u", sgh->filestore_cnt);
PrefilterSetupRuleGroup(de_ctx, sgh);

@ -513,122 +513,41 @@ int SigGroupHeadBuildMatchArray(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
}
/**
* \brief Set the need magic flag in the sgh.
*
* \param de_ctx detection engine ctx for the signatures
* \param sgh sig group head to set the flag in
*/
void SigGroupHeadSetFilemagicFlag(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
{
#ifdef HAVE_MAGIC
Signature *s = NULL;
uint32_t sig = 0;
if (sgh == NULL)
return;
for (sig = 0; sig < sgh->init->sig_cnt; sig++) {
s = sgh->init->match_array[sig];
if (s == NULL)
continue;
if (SignatureIsFilemagicInspecting(s)) {
sgh->flags |= SIG_GROUP_HEAD_HAVEFILEMAGIC;
break;
}
}
#endif
return;
}
/**
* \brief Set the need size flag in the sgh.
* \brief Set the need hash flag in the sgh.
*
* \param de_ctx detection engine ctx for the signatures
* \param sgh sig group head to set the flag in
* \param sgh sig group head to update
*/
void SigGroupHeadSetFilesizeFlag(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
void SigGroupHeadSetupFiles(const DetectEngineCtx *de_ctx, SigGroupHead *sgh)
{
Signature *s = NULL;
uint32_t sig = 0;
if (sgh == NULL)
return;
for (sig = 0; sig < sgh->init->sig_cnt; sig++) {
s = sgh->init->match_array[sig];
for (uint32_t sig = 0; sig < sgh->init->sig_cnt; sig++) {
const Signature *s = sgh->init->match_array[sig];
if (s == NULL)
continue;
if (SignatureIsFilesizeInspecting(s)) {
sgh->flags |= SIG_GROUP_HEAD_HAVEFILESIZE;
break;
}
}
return;
}
/**
* \brief Set the need hash flag in the sgh.
*
* \param de_ctx detection engine ctx for the signatures
* \param sgh sig group head to set the flag in
*/
void SigGroupHeadSetFileHashFlag(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
{
Signature *s = NULL;
uint32_t sig = 0;
if (sgh == NULL)
return;
for (sig = 0; sig < sgh->init->sig_cnt; sig++) {
s = sgh->init->match_array[sig];
if (s == NULL)
continue;
if (SignatureIsFileMd5Inspecting(s)) {
sgh->flags |= SIG_GROUP_HEAD_HAVEFILEMD5;
SCLogDebug("sgh %p has filemd5", sgh);
break;
}
if (SignatureIsFileSha1Inspecting(s)) {
sgh->flags |= SIG_GROUP_HEAD_HAVEFILESHA1;
SCLogDebug("sgh %p has filesha1", sgh);
break;
}
if (SignatureIsFileSha256Inspecting(s)) {
sgh->flags |= SIG_GROUP_HEAD_HAVEFILESHA256;
SCLogDebug("sgh %p has filesha256", sgh);
break;
}
}
return;
}
/**
* \brief Set the filestore_cnt in the sgh.
*
* \param de_ctx detection engine ctx for the signatures
* \param sgh sig group head to set the counter in
*/
void SigGroupHeadSetFilestoreCount(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
{
Signature *s = NULL;
uint32_t sig = 0;
if (sgh == NULL)
return;
for (sig = 0; sig < sgh->init->sig_cnt; sig++) {
s = sgh->init->match_array[sig];
if (s == NULL)
continue;
#ifdef HAVE_MAGIC
if (SignatureIsFilemagicInspecting(s)) {
sgh->flags |= SIG_GROUP_HEAD_HAVEFILEMAGIC;
}
#endif
if (SignatureIsFilestoring(s)) {
sgh->filestore_cnt++;
}

@ -53,10 +53,8 @@ void SigGroupHeadRegisterTests(void);
void SigGroupHeadPrintSigs(DetectEngineCtx *de_ctx, SigGroupHead *sgh);
void SigGroupHeadStore(DetectEngineCtx *, SigGroupHead *);
void SigGroupHeadSetFilemagicFlag(DetectEngineCtx *, SigGroupHead *);
void SigGroupHeadSetFilestoreCount(DetectEngineCtx *, SigGroupHead *);
void SigGroupHeadSetFileHashFlag(DetectEngineCtx *, SigGroupHead *);
void SigGroupHeadSetFilesizeFlag(DetectEngineCtx *, SigGroupHead *);
void SigGroupHeadSetupFiles(const DetectEngineCtx *de_ctx, SigGroupHead *sgh);
int SigGroupHeadBuildNonPrefilterArray(DetectEngineCtx *de_ctx, SigGroupHead *sgh);

Loading…
Cancel
Save