detect: unify delayed detect and reload

Instead of threading logic with dummy slots and all, use the regular
reload logic for delayed detect.

This means we pass a empty detect engine to the threads and then
reload (live swap) it as soon as the engine is running.
pull/1389/head
Victor Julien 11 years ago
parent 38b349af1e
commit b0cb4c17ec

@ -720,11 +720,6 @@ typedef struct DetectEngineCtx_ {
char *rule_file; char *rule_file;
int rule_line; int rule_line;
/** Is detect engine using a delayed init */
int delayed_detect;
/** Did we load the signatures? */
int delayed_detect_initialized;
/** list of keywords that need thread local ctxs */ /** list of keywords that need thread local ctxs */
DetectEngineThreadKeywordCtxItem *keyword_list; DetectEngineThreadKeywordCtxItem *keyword_list;
int keyword_id; int keyword_id;

@ -1958,7 +1958,7 @@ static int FinalizeRunMode(SCInstance *suri, char **argv)
return TM_ECODE_OK; return TM_ECODE_OK;
} }
static void SetupDelayedDetect(DetectEngineCtx *de_ctx, SCInstance *suri) static void SetupDelayedDetect(SCInstance *suri)
{ {
/* In offline mode delayed init of detect is a bad idea */ /* In offline mode delayed init of detect is a bad idea */
if (suri->offline) { if (suri->offline) {
@ -1974,7 +1974,6 @@ static void SetupDelayedDetect(DetectEngineCtx *de_ctx, SCInstance *suri)
} }
} }
} }
de_ctx->delayed_detect = suri->delayed_detect;
SCLogInfo("Delayed detect %s", suri->delayed_detect ? "enabled" : "disabled"); SCLogInfo("Delayed detect %s", suri->delayed_detect ? "enabled" : "disabled");
if (suri->delayed_detect) { if (suri->delayed_detect) {
@ -2299,6 +2298,9 @@ int main(int argc, char **argv)
StreamTcpInitConfig(STREAM_VERBOSE); StreamTcpInitConfig(STREAM_VERBOSE);
} }
if (MagicInit() != 0)
exit(EXIT_FAILURE);
DetectEngineCtx *de_ctx = NULL; DetectEngineCtx *de_ctx = NULL;
if (!suri.disabled_detect) { if (!suri.disabled_detect) {
de_ctx = DetectEngineCtxInit(); de_ctx = DetectEngineCtxInit();
@ -2313,28 +2315,22 @@ int main(int argc, char **argv)
CudaVarsSetDeCtx(de_ctx); CudaVarsSetDeCtx(de_ctx);
#endif /* __SC_CUDA_SUPPORT__ */ #endif /* __SC_CUDA_SUPPORT__ */
} else { SetupDelayedDetect(&suri);
/* disable raw reassembly */
(void)ConfSetFinal("stream.reassembly.raw", "false");
/* tell the app layer to consider only the log id */
RegisterAppLayerGetActiveTxIdFunc(AppLayerTransactionGetActiveLogOnly);
}
if (MagicInit() != 0)
exit(EXIT_FAILURE);
if (de_ctx != NULL) {
SetupDelayedDetect(de_ctx, &suri);
if (!suri.delayed_detect) { if (!suri.delayed_detect) {
if (LoadSignatures(de_ctx, &suri) != TM_ECODE_OK) if (LoadSignatures(de_ctx, &suri) != TM_ECODE_OK)
exit(EXIT_FAILURE); exit(EXIT_FAILURE);
if (suri.run_mode == RUNMODE_ENGINE_ANALYSIS) { if (suri.run_mode == RUNMODE_ENGINE_ANALYSIS) {
exit(EXIT_SUCCESS); exit(EXIT_SUCCESS);
} }
DetectEngineAddToMaster(de_ctx);
} }
DetectEngineAddToMaster(de_ctx);
} else {
/* disable raw reassembly */
(void)ConfSetFinal("stream.reassembly.raw", "false");
/* tell the app layer to consider only the log id */
RegisterAppLayerGetActiveTxIdFunc(AppLayerTransactionGetActiveLogOnly);
} }
SCAsn1LoadConfig(); SCAsn1LoadConfig();
@ -2403,15 +2399,13 @@ int main(int argc, char **argv)
/* registering singal handlers we use. We register usr2 here, so that one /* registering singal handlers we use. We register usr2 here, so that one
* can't call it during the first sig load phase or while threads are still * can't call it during the first sig load phase or while threads are still
* starting up. */ * starting up. */
if (de_ctx != NULL && suri.sig_file == NULL && suri.rule_reload == 1 && if (DetectEngineEnabled() && suri.sig_file == NULL && suri.rule_reload == 1 &&
suri.delayed_detect == 0) suri.delayed_detect == 0)
UtilSignalHandlerSetup(SIGUSR2, SignalHandlerSigusr2); UtilSignalHandlerSetup(SIGUSR2, SignalHandlerSigusr2);
if (de_ctx != NULL && suri.delayed_detect) { if (suri.delayed_detect) {
if (LoadSignatures(de_ctx, &suri) != TM_ECODE_OK) /* force 'reload', this will load the rules and swap engines */
exit(EXIT_FAILURE); DetectEngineReload();
de_ctx->delayed_detect_initialized = 1;
TmThreadActivateDummySlot();
if (suri.rule_reload) { if (suri.rule_reload) {
if (suri.sig_file != NULL) if (suri.sig_file != NULL)

@ -975,7 +975,7 @@ void UnixSocketKillSocketThread(void)
#else /* BUILD_UNIX_SOCKET */ #else /* BUILD_UNIX_SOCKET */
void UnixManagerThreadSpawn(DetectEngineCtx *de_ctx, int mode) void UnixManagerThreadSpawn(int mode)
{ {
SCLogError(SC_ERR_UNIMPLEMENTED, "Unix socket is not compiled"); SCLogError(SC_ERR_UNIMPLEMENTED, "Unix socket is not compiled");
return; return;

Loading…
Cancel
Save