From ad7eff555de898e7abcdbf89fdbe9a4806bb72b6 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Fri, 24 Jan 2014 11:40:06 +0100 Subject: [PATCH] app-layer-proto: speed up AppLayer Proto detection code uses a mix of pattern search and "probing parsers". The pattern search validates potential matches using a single pattern search algo. The code was using SpmSearch for this, but this made it inefficient as it builds a BoyerMoore context for each search. This lead to significant memory pressure, especially on high speed/bandwidth boxes. This patch switches the search calls to BoyerMoore and BoyerMoore- Nocase directly. This can be done as the ctx' were available already. --- src/app-layer-detect-proto.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/app-layer-detect-proto.c b/src/app-layer-detect-proto.c index f5b57193aa..ce5c8c2528 100644 --- a/src/app-layer-detect-proto.c +++ b/src/app-layer-detect-proto.c @@ -190,9 +190,9 @@ static AppProto AppLayerProtoDetectPMMatchSignature(const AppLayerProtoDetectPMS s->cd->offset, s->cd->depth); if (s->cd->flags & DETECT_CONTENT_NOCASE) - found = SpmNocaseSearch(sbuf, sbuflen, s->cd->content, s->cd->content_len); + found = BoyerMooreNocase(s->cd->content, s->cd->content_len, sbuf, sbuflen, s->cd->bm_ctx->bmGs, s->cd->bm_ctx->bmBc); else - found = SpmSearch(sbuf, sbuflen, s->cd->content, s->cd->content_len); + found = BoyerMoore(s->cd->content, s->cd->content_len, sbuf, sbuflen, s->cd->bm_ctx->bmGs, s->cd->bm_ctx->bmBc); if (found != NULL) proto = s->alproto;