detect: introduce DetectPrefilterBuildNonMpmList

Move building of non-mpm list into a separate function, that is inlined
for performance reasons.
pull/1295/head
Victor Julien 11 years ago
parent cc4f7a4b96
commit ca59eabca3

@ -1113,6 +1113,19 @@ static void AlertDebugLogModeSyncFlowbitsNamesToPacketStruct(Packet *p, DetectEn
return;
}
static inline void DetectPrefilterBuildNonMpmList(DetectEngineThreadCtx *det_ctx, SignatureMask mask)
{
uint32_t x = 0;
for (x = 0; x < det_ctx->sgh->non_mpm_store_cnt; x++) {
/* only if the mask matches this rule can possibly match,
* so build the non_mpm array only for match candidates */
SignatureMask rule_mask = det_ctx->sgh->non_mpm_store_array[x].mask;
if ((rule_mask & mask) == rule_mask) {
det_ctx->non_mpm_id_array[det_ctx->non_mpm_id_cnt++] = det_ctx->sgh->non_mpm_store_array[x].id;
}
}
}
/**
* \brief Signature match function
*
@ -1332,17 +1345,11 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
SignatureMask mask = 0;
PacketCreateMask(p, &mask, alproto, has_state, smsg, app_decoder_events);
/* prefilter non_mpm list against the mask of the packet */
/* build and prefilter non_mpm list against the mask of the packet */
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_NONMPMLIST);
det_ctx->non_mpm_id_cnt = 0;
uint32_t x = 0;
for (x = 0; x < det_ctx->sgh->non_mpm_store_cnt; x++) {
/* only if the mask matches this rule can possibly match,
* so build the non_mpm array only for match candidates */
SignatureMask rule_mask = det_ctx->sgh->non_mpm_store_array[x].mask;
if ((rule_mask & mask) == rule_mask) {
det_ctx->non_mpm_id_array[det_ctx->non_mpm_id_cnt++] = det_ctx->sgh->non_mpm_store_array[x].id;
}
if (likely(det_ctx->sgh->non_mpm_store_cnt > 0)) {
DetectPrefilterBuildNonMpmList(det_ctx, mask);
}
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_NONMPMLIST);

Loading…
Cancel
Save