mirror of https://github.com/OISF/suricata
prefilter: rename PatternMatcherQueue datatype
In preparation of the introduction of more general purpose prefilter engines, rename PatternMatcherQueue to PrefilterRuleStore. The new engines will fill this structure a similar way to the current mpm prefilters.pull/2310/head
parent
4c0ab681f2
commit
bb0cd0e883
@ -0,0 +1,132 @@
|
||||
/* Copyright (C) 2007-2014 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Victor Julien <victor@inliniac.net>
|
||||
*
|
||||
* Pattern matcher utility Functions
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
|
||||
/**
|
||||
* \brief Setup a pmq
|
||||
*
|
||||
* \param pmq Pattern matcher queue to be initialized
|
||||
*
|
||||
* \retval -1 error
|
||||
* \retval 0 ok
|
||||
*/
|
||||
int PmqSetup(PrefilterRuleStore *pmq)
|
||||
{
|
||||
SCEnter();
|
||||
|
||||
if (pmq == NULL) {
|
||||
SCReturnInt(-1);
|
||||
}
|
||||
|
||||
memset(pmq, 0, sizeof(PrefilterRuleStore));
|
||||
|
||||
pmq->rule_id_array_size = 128; /* Initial size, TODO: Make configure option. */
|
||||
pmq->rule_id_array_cnt = 0;
|
||||
|
||||
size_t bytes = pmq->rule_id_array_size * sizeof(SigIntId);
|
||||
pmq->rule_id_array = (SigIntId*)SCMalloc(bytes);
|
||||
if (pmq->rule_id_array == NULL) {
|
||||
pmq->rule_id_array_size = 0;
|
||||
SCReturnInt(-1);
|
||||
}
|
||||
// Don't need to zero memory since it is always written first.
|
||||
|
||||
SCReturnInt(0);
|
||||
}
|
||||
|
||||
/** \brief Add array of Signature IDs to rule ID array.
|
||||
*
|
||||
* Checks size of the array first
|
||||
*
|
||||
* \param pmq storage for match results
|
||||
* \param new_size number of Signature IDs needing to be stored.
|
||||
*
|
||||
*/
|
||||
int
|
||||
PrefilterAddSidsResize(PrefilterRuleStore *pmq, uint32_t new_size)
|
||||
{
|
||||
/* Need to make the array bigger. Double the size needed to
|
||||
* also handle the case that sids_size might still be
|
||||
* larger than the old size.
|
||||
*/
|
||||
new_size = new_size * 2;
|
||||
SigIntId *new_array = (SigIntId*)SCRealloc(pmq->rule_id_array,
|
||||
new_size * sizeof(SigIntId));
|
||||
if (unlikely(new_array == NULL)) {
|
||||
/* Try again just big enough. */
|
||||
new_size = new_size / 2;
|
||||
new_array = (SigIntId*)SCRealloc(pmq->rule_id_array,
|
||||
new_size * sizeof(SigIntId));
|
||||
if (unlikely(new_array == NULL)) {
|
||||
|
||||
SCLogError(SC_ERR_MEM_ALLOC, "Failed to realloc PatternMatchQueue"
|
||||
" rule ID array. Some signature ID matches lost");
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
pmq->rule_id_array = new_array;
|
||||
pmq->rule_id_array_size = new_size;
|
||||
|
||||
return new_size;
|
||||
}
|
||||
|
||||
/** \brief Reset a Pmq for reusage. Meant to be called after a single search.
|
||||
* \param pmq Pattern matcher to be reset.
|
||||
* \todo memset is expensive, but we need it as we merge pmq's. We might use
|
||||
* a flag so we can clear pmq's the old way if we can.
|
||||
*/
|
||||
void PmqReset(PrefilterRuleStore *pmq)
|
||||
{
|
||||
if (pmq == NULL)
|
||||
return;
|
||||
|
||||
pmq->rule_id_array_cnt = 0;
|
||||
/* TODO: Realloc the rule id array smaller at some size? */
|
||||
}
|
||||
|
||||
/** \brief Cleanup a Pmq
|
||||
* \param pmq Pattern matcher queue to be cleaned up.
|
||||
*/
|
||||
void PmqCleanup(PrefilterRuleStore *pmq)
|
||||
{
|
||||
if (pmq == NULL)
|
||||
return;
|
||||
if (pmq->rule_id_array != NULL) {
|
||||
SCFree(pmq->rule_id_array);
|
||||
pmq->rule_id_array = NULL;
|
||||
}
|
||||
}
|
||||
|
||||
/** \brief Cleanup and free a Pmq
|
||||
* \param pmq Pattern matcher queue to be free'd.
|
||||
*/
|
||||
void PmqFree(PrefilterRuleStore *pmq)
|
||||
{
|
||||
if (pmq == NULL)
|
||||
return;
|
||||
|
||||
PmqCleanup(pmq);
|
||||
}
|
@ -0,0 +1,80 @@
|
||||
/* Copyright (C) 2016 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Victor Julien <victor@inliniac.net>
|
||||
*/
|
||||
|
||||
#ifndef __UTIL_PREFILTER_H__
|
||||
#define __UTIL_PREFILTER_H__
|
||||
|
||||
/** \brief structure for storing potential rule matches
|
||||
*
|
||||
* Helper structure for the prefilter engine. The Pattern Matchers
|
||||
* and other prefilter engines will add rule id's for potential
|
||||
* rule matches */
|
||||
typedef struct PrefilterRuleStore_ {
|
||||
/* used for storing rule id's */
|
||||
|
||||
/* Array of rule IDs found. */
|
||||
SigIntId *rule_id_array;
|
||||
/* Number of rule IDs in the array. */
|
||||
uint32_t rule_id_array_cnt;
|
||||
/* The number of slots allocated for storing rule IDs */
|
||||
uint32_t rule_id_array_size;
|
||||
|
||||
} PrefilterRuleStore;
|
||||
|
||||
/* Resize Signature ID array. Only called from MpmAddSids(). */
|
||||
int PrefilterAddSidsResize(PrefilterRuleStore *pmq, uint32_t new_size);
|
||||
|
||||
/** \brief Add array of Signature IDs to rule ID array.
|
||||
*
|
||||
* Checks size of the array first. Calls PrefilterAddSidsResize to increase
|
||||
* The size of the array, since that is the slow path.
|
||||
*
|
||||
* \param pmq storage for match results
|
||||
* \param sids pointer to array of Signature IDs
|
||||
* \param sids_size number of Signature IDs in sids array.
|
||||
*
|
||||
*/
|
||||
static inline void
|
||||
PrefilterAddSids(PrefilterRuleStore *pmq, SigIntId *sids, uint32_t sids_size)
|
||||
{
|
||||
if (sids_size == 0)
|
||||
return;
|
||||
|
||||
uint32_t new_size = pmq->rule_id_array_cnt + sids_size;
|
||||
if (new_size > pmq->rule_id_array_size) {
|
||||
if (PrefilterAddSidsResize(pmq, new_size) == 0) {
|
||||
// Failed to allocate larger memory for all the SIDS, but
|
||||
// keep as many as we can.
|
||||
sids_size = pmq->rule_id_array_size - pmq->rule_id_array_cnt;
|
||||
}
|
||||
}
|
||||
SCLogDebug("Adding %u sids", sids_size);
|
||||
// Add SIDs for this pattern to the end of the array
|
||||
SigIntId *ptr = pmq->rule_id_array + pmq->rule_id_array_cnt;
|
||||
SigIntId *end = ptr + sids_size;
|
||||
do {
|
||||
*ptr++ = *sids++;
|
||||
} while (ptr != end);
|
||||
pmq->rule_id_array_cnt += sids_size;
|
||||
}
|
||||
#endif /* __UTIL_PREFILTER_H__ */
|
Loading…
Reference in New Issue