aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Further memory cleanups. Split out init only vars out of the sig group head.

Browse Source
remotes/origin/master-1.0.x
Victor Julien 15 years ago
parent 32e51e5e5a
commit 3c7a038477
13 changed files with 182 additions and 202 deletions
Show Stats Download Patch File Download Diff File

4
src/detect-engine-iponly.c
Unescape Escape View File

@ -435,6 +435,8 @@ void IPOnlyPrepare(DetectEngineCtx *de_ctx) {
continue;
SigGroupHeadSetSigCnt(gr->sh, de_ctx->io_ctx.max_idx);
SigGroupHeadInitDataFree(gr->sh->init);
gr->sh->init = NULL;
//printf(PRIu32 " ", gr->sh->sig_cnt);
}
//printf("\n");
@ -451,6 +453,8 @@ void IPOnlyPrepare(DetectEngineCtx *de_ctx) {
continue;
SigGroupHeadSetSigCnt(gr->sh, de_ctx->io_ctx.max_idx);
SigGroupHeadInitDataFree(gr->sh->init);
gr->sh->init = NULL;
//printf(PRIu32 " ", gr->sh->sig_cnt);
}
//printf("\n");

195
src/detect-engine-siggroup.c
Unescape Escape View File

@ -31,6 +31,9 @@ int SigGroupHeadClearSigs(SigGroupHead *);
static uint32_t detect_siggroup_head_memory = 0;
static uint32_t detect_siggroup_head_init_cnt = 0;
static uint32_t detect_siggroup_head_free_cnt = 0;
static uint32_t detect_siggroup_head_initdata_memory = 0;
static uint32_t detect_siggroup_head_initdata_init_cnt = 0;
static uint32_t detect_siggroup_head_initdata_free_cnt = 0;
static uint32_t detect_siggroup_sigarray_memory = 0;
static uint32_t detect_siggroup_sigarray_init_cnt = 0;
static uint32_t detect_siggroup_sigarray_free_cnt = 0;
@ -38,6 +41,35 @@ static uint32_t detect_siggroup_matcharray_memory = 0;
static uint32_t detect_siggroup_matcharray_init_cnt = 0;
static uint32_t detect_siggroup_matcharray_free_cnt = 0;
static SigGroupHeadInitData *SigGroupHeadInitDataAlloc(uint32_t size) {
SigGroupHeadInitData *sghid = malloc(sizeof(SigGroupHeadInitData));
if (sghid == NULL)
return NULL;
memset(sghid, 0x00, sizeof(SigGroupHeadInitData));
detect_siggroup_head_initdata_init_cnt++;
detect_siggroup_head_initdata_memory += sizeof(SigGroupHeadInitData);
return sghid;
}
void SigGroupHeadInitDataFree(SigGroupHeadInitData *sghid) {
if (sghid->content_array != NULL) {
free(sghid->content_array);
sghid->content_array = NULL;
sghid->content_size = 0;
}
if (sghid->uri_content_array != NULL) {
free(sghid->uri_content_array);
sghid->uri_content_array = NULL;
sghid->uri_content_size = 0;
}
free(sghid);
detect_siggroup_head_initdata_free_cnt++;
detect_siggroup_head_initdata_memory -= sizeof(SigGroupHeadInitData);
}
/**
* \brief Alloc a sig group head and it's sig_array
*
@ -53,6 +85,10 @@ static SigGroupHead *SigGroupHeadAlloc(uint32_t size) {
}
memset(sgh, 0, sizeof(SigGroupHead));
sgh->init = SigGroupHeadInitDataAlloc(size);
if (sgh->init == NULL)
goto error;
detect_siggroup_head_init_cnt++;
detect_siggroup_head_memory += sizeof(SigGroupHead);
@ -69,7 +105,7 @@ static SigGroupHead *SigGroupHeadAlloc(uint32_t size) {
return sgh;
error:
if (sgh != NULL)
free(sgh);
SigGroupHeadFree(sgh);
return NULL;
}
@ -82,7 +118,6 @@ void SigGroupHeadFree(SigGroupHead *sgh) {
return;
PatternMatchDestroyGroup(sgh);
SigGroupHeadClearSigs(sgh);
if (sgh->sig_array != NULL) {
free(sgh->sig_array);
@ -92,25 +127,18 @@ void SigGroupHeadFree(SigGroupHead *sgh) {
detect_siggroup_sigarray_memory -= sgh->sig_size;
}
if (sgh->content_array != NULL) {
free(sgh->content_array);
sgh->content_array = NULL;
sgh->content_size = 0;
}
if (sgh->uri_content_array != NULL) {
free(sgh->uri_content_array);
sgh->uri_content_array = NULL;
sgh->uri_content_size = 0;
}
if (sgh->match_array != NULL) {
detect_siggroup_matcharray_free_cnt++;
detect_siggroup_matcharray_memory -= (sgh->sig_cnt * sizeof(uint32_t));
detect_siggroup_matcharray_memory -= (sgh->sig_cnt * sizeof(SigIntId));
free(sgh->match_array);
sgh->match_array = NULL;
sgh->sig_cnt = 0;
}
if (sgh->init != NULL) {
SigGroupHeadInitDataFree(sgh->init);
}
free(sgh);
detect_siggroup_head_free_cnt++;
@ -127,8 +155,8 @@ uint32_t SigGroupHeadMpmHashFunc(HashListTable *ht, void *data, uint16_t datalen
uint32_t hash = 0;
uint32_t b;
for (b = 0; b < sgh->content_size; b+=1) {
hash += sgh->content_array[b];
for (b = 0; b < sgh->init->content_size; b+=1) {
hash += sgh->init->content_array[b];
}
return hash % ht->array_size;
}
@ -137,10 +165,10 @@ char SigGroupHeadMpmCompareFunc(void *data1, uint16_t len1, void *data2, uint16_
SigGroupHead *sgh1 = (SigGroupHead *)data1;
SigGroupHead *sgh2 = (SigGroupHead *)data2;
if (sgh1->content_size != sgh2->content_size)
if (sgh1->init->content_size != sgh2->init->content_size)
return 0;
if (memcmp(sgh1->content_array,sgh2->content_array,sgh1->content_size) != 0)
if (memcmp(sgh1->init->content_array,sgh2->init->content_array,sgh1->init->content_size) != 0)
return 0;
return 1;
@ -180,8 +208,8 @@ uint32_t SigGroupHeadMpmUriHashFunc(HashListTable *ht, void *data, uint16_t data
uint32_t hash = 0;
uint32_t b;
for (b = 0; b < sgh->uri_content_size; b+=1) {
hash += sgh->uri_content_array[b];
for (b = 0; b < sgh->init->uri_content_size; b+=1) {
hash += sgh->init->uri_content_array[b];
}
return hash % ht->array_size;
}
@ -190,10 +218,10 @@ char SigGroupHeadMpmUriCompareFunc(void *data1, uint16_t len1, void *data2, uint
SigGroupHead *sgh1 = (SigGroupHead *)data1;
SigGroupHead *sgh2 = (SigGroupHead *)data2;
if (sgh1->uri_content_size != sgh2->uri_content_size)
if (sgh1->init->uri_content_size != sgh2->init->uri_content_size)
return 0;
if (memcmp(sgh1->uri_content_array,sgh2->uri_content_array,sgh1->uri_content_size) != 0)
if (memcmp(sgh1->init->uri_content_array,sgh2->init->uri_content_array,sgh1->init->uri_content_size) != 0)
return 0;
return 1;
@ -231,12 +259,16 @@ void SigGroupHeadMpmUriHashFree(DetectEngineCtx *de_ctx) {
uint32_t SigGroupHeadHashFunc(HashListTable *ht, void *data, uint16_t datalen) {
SigGroupHead *sgh = (SigGroupHead *)data;
uint32_t hash = 0;
SCLogDebug("hashing sgh %p", sgh);
uint32_t b;
for (b = 0; b < sgh->sig_size; b+=1) {
hash += sgh->sig_array[b];
}
return hash % ht->array_size;
hash %= ht->array_size;
SCLogDebug("hash %"PRIu32" (sig_size %"PRIu32")", hash, sgh->sig_size);
return hash;
}
char SigGroupHeadCompareFunc(void *data1, uint16_t len1, void *data2, uint16_t len2) {
@ -335,6 +367,7 @@ int SigGroupHeadSPortHashAdd(DetectEngineCtx *de_ctx, SigGroupHead *sgh) {
int SigGroupHeadSPortHashRemove(DetectEngineCtx *de_ctx, SigGroupHead *sgh) {
return HashListTableRemove(de_ctx->sgh_sport_hash_table, (void *)sgh, 0);
}
SigGroupHead *SigGroupHeadSPortHashLookup(DetectEngineCtx *de_ctx, SigGroupHead *sgh) {
SigGroupHead *rsgh = HashListTableLookup(de_ctx->sgh_sport_hash_table, (void *)sgh, 0);
return rsgh;
@ -365,16 +398,9 @@ static void SigGroupHeadFreeSigArraysHash2(DetectEngineCtx *de_ctx, HashListTabl
sgh->sig_size = 0;
}
if (sgh->content_array != NULL) {
free(sgh->content_array);
sgh->content_array = NULL;
sgh->content_size = 0;
}
if (sgh->uri_content_array != NULL) {
free(sgh->uri_content_array);
sgh->uri_content_array = NULL;
sgh->uri_content_size = 0;
if (sgh->init != NULL) {
SigGroupHeadInitDataFree(sgh->init);
sgh->init = NULL;
}
}
}
@ -385,8 +411,6 @@ static void SigGroupHeadFreeSigArraysHash(DetectEngineCtx *de_ctx, HashListTable
for (htb = HashListTableGetListHead(ht); htb != NULL; htb = HashListTableGetListNext(htb)) {
SigGroupHead *sgh = (SigGroupHead *)HashListTableGetListData(htb);
SCLogDebug("sgh %p", sgh);
if (sgh->sig_array != NULL) {
detect_siggroup_sigarray_free_cnt++;
detect_siggroup_sigarray_memory -= sgh->sig_size;
@ -395,6 +419,11 @@ static void SigGroupHeadFreeSigArraysHash(DetectEngineCtx *de_ctx, HashListTable
sgh->sig_array = NULL;
sgh->sig_size = 0;
}
if (sgh->init != NULL) {
SigGroupHeadInitDataFree(sgh->init);
sgh->init = NULL;
}
}
}
@ -414,33 +443,17 @@ void SigGroupHeadFreeMpmArrays(DetectEngineCtx *de_ctx) {
for (htb = HashListTableGetListHead(de_ctx->sgh_dport_hash_table); htb != NULL; htb = HashListTableGetListNext(htb)) {
SigGroupHead *sgh = (SigGroupHead *)HashListTableGetListData(htb);
if (sgh->content_array != NULL) {
free(sgh->content_array);
sgh->content_array = NULL;
sgh->content_size = 0;
}
if (sgh->uri_content_array != NULL) {
free(sgh->uri_content_array);
sgh->uri_content_array = NULL;
sgh->uri_content_size = 0;
if (sgh->init != NULL) {
SigGroupHeadInitDataFree(sgh->init);
sgh->init = NULL;
}
}
for (htb = HashListTableGetListHead(de_ctx->sgh_sport_hash_table); htb != NULL; htb = HashListTableGetListNext(htb)) {
SigGroupHead *sgh = (SigGroupHead *)HashListTableGetListData(htb);
if (sgh->content_array != NULL) {
free(sgh->content_array);
sgh->content_array = NULL;
sgh->content_size = 0;
}
if (sgh->uri_content_array != NULL) {
free(sgh->uri_content_array);
sgh->uri_content_array = NULL;
sgh->uri_content_size = 0;
if (sgh->init != NULL) {
SigGroupHeadInitDataFree(sgh->init);
sgh->init = NULL;
}
}
}
@ -561,6 +574,12 @@ void DetectSigGroupPrintMemory(void) {
printf(" - detect_siggroup_head_free_cnt %" PRIu32 "\n", detect_siggroup_head_free_cnt);
printf(" - outstanding sig group heads %" PRIu32 "\n", detect_siggroup_head_init_cnt - detect_siggroup_head_free_cnt);
printf(" * Sig group head memory stats done\n");
printf(" * Sig group head initdata memory stats (SigGroupHeadInitData %" PRIuMAX "):\n", (uintmax_t)sizeof(SigGroupHeadInitData));
printf(" - detect_siggroup_head_initdata_memory %" PRIu32 "\n", detect_siggroup_head_initdata_memory);
printf(" - detect_siggroup_head_initdata_init_cnt %" PRIu32 "\n", detect_siggroup_head_initdata_init_cnt);
printf(" - detect_siggroup_head_initdata_free_cnt %" PRIu32 "\n", detect_siggroup_head_initdata_free_cnt);
printf(" - outstanding sig group head initdatas %" PRIu32 "\n", detect_siggroup_head_initdata_init_cnt - detect_siggroup_head_initdata_free_cnt);
printf(" * Sig group head memory initdata stats done\n");
printf(" * Sig group sigarray memory stats:\n");
printf(" - detect_siggroup_sigarray_memory %" PRIu32 "\n", detect_siggroup_sigarray_memory);
printf(" - detect_siggroup_sigarray_init_cnt %" PRIu32 "\n", detect_siggroup_sigarray_init_cnt);
@ -594,7 +613,7 @@ void SigGroupHeadPrintContent(DetectEngineCtx *de_ctx, SigGroupHead *sgh) {
uint32_t i;
for (i = 0; i < DetectContentMaxId(de_ctx); i++) {
if (sgh->content_array[(i/8)] & (1<<(i%8))) {
if (sgh->init->content_array[(i/8)] & (1<<(i%8))) {
printf("%" PRIu32 " ", i);
}
}
@ -607,7 +626,7 @@ void SigGroupHeadPrintContentCnt(DetectEngineCtx *de_ctx, SigGroupHead *sgh) {
uint32_t i, cnt = 0;
for (i = 0; i < DetectContentMaxId(de_ctx); i++) {
if (sgh->content_array[(i/8)] & (1<<(i%8))) {
if (sgh->init->content_array[(i/8)] & (1<<(i%8))) {
cnt++;
}
}
@ -628,16 +647,18 @@ int SigGroupHeadLoadContent(DetectEngineCtx *de_ctx, SigGroupHead *sgh) {
if (DetectContentMaxId(de_ctx) == 0)
return 0;
sgh->content_size = (DetectContentMaxId(de_ctx) / 8) + 1;
sgh->content_array = malloc(sgh->content_size * sizeof(uint32_t));
if (sgh->content_array == NULL)
BUG_ON(sgh->init == NULL);
sgh->init->content_size = (DetectContentMaxId(de_ctx) / 8) + 1;
sgh->init->content_array = malloc(sgh->init->content_size);
if (sgh->init->content_array == NULL)
return -1;
memset(sgh->content_array,0, sgh->content_size * sizeof(uint32_t));
memset(sgh->init->content_array,0, sgh->init->content_size);
uint32_t sig;
for (sig = 0; sig < sgh->sig_cnt; sig++) {
uint32_t num = sgh->match_array[sig];
SigIntId num = sgh->match_array[sig];
s = de_ctx->sig_array[num];
if (s == NULL)
@ -654,7 +675,7 @@ int SigGroupHeadLoadContent(DetectEngineCtx *de_ctx, SigGroupHead *sgh) {
if (sm->type == DETECT_CONTENT) {
DetectContentData *co = (DetectContentData *)sm->ctx;
sgh->content_array[(co->id/8)] |= 1<<(co->id%8);
sgh->init->content_array[(co->id/8)] |= 1<<(co->id%8);
}
}
}
@ -663,13 +684,13 @@ int SigGroupHeadLoadContent(DetectEngineCtx *de_ctx, SigGroupHead *sgh) {
}
int SigGroupHeadClearContent(SigGroupHead *sh) {
if (sh == NULL)
if (sh == NULL || sh->init == NULL)
return 0;
if (sh->content_array != NULL) {
free(sh->content_array);
sh->content_array = NULL;
sh->content_size = 0;
if (sh->init->content_array != NULL) {
free(sh->init->content_array);
sh->init->content_array = NULL;
sh->init->content_size = 0;
}
return 0;
}
@ -684,16 +705,18 @@ int SigGroupHeadLoadUricontent(DetectEngineCtx *de_ctx, SigGroupHead *sgh) {
if (DetectUricontentMaxId(de_ctx) == 0)
return 0;
sgh->uri_content_size = (DetectUricontentMaxId(de_ctx) / 8) + 1;
sgh->uri_content_array = malloc(sgh->uri_content_size * sizeof(uint32_t));
if (sgh->uri_content_array == NULL)
BUG_ON(sgh->init == NULL);
sgh->init->uri_content_size = (DetectUricontentMaxId(de_ctx) / 8) + 1;
sgh->init->uri_content_array = malloc(sgh->init->uri_content_size);
if (sgh->init->uri_content_array == NULL)
return -1;
memset(sgh->uri_content_array,0, sgh->uri_content_size * sizeof(uint32_t));
memset(sgh->init->uri_content_array, 0, sgh->init->uri_content_size);
uint32_t sig;
for (sig = 0; sig < sgh->sig_cnt; sig++) {
uint32_t num = sgh->match_array[sig];
SigIntId num = sgh->match_array[sig];
s = de_ctx->sig_array[num];
if (s == NULL)
@ -710,7 +733,7 @@ int SigGroupHeadLoadUricontent(DetectEngineCtx *de_ctx, SigGroupHead *sgh) {
if (sm->type == DETECT_URICONTENT) {
DetectUricontentData *co = (DetectUricontentData *)sm->ctx;
sgh->uri_content_array[(co->id/8)] |= 1<<(co->id%8);
sgh->init->uri_content_array[(co->id/8)] |= 1<<(co->id%8);
}
}
}
@ -718,13 +741,13 @@ int SigGroupHeadLoadUricontent(DetectEngineCtx *de_ctx, SigGroupHead *sgh) {
}
int SigGroupHeadClearUricontent(SigGroupHead *sh) {
if (sh == NULL)
return 0;
if (sh == NULL||sh->init == NULL)
return 0;
if (sh->uri_content_array != NULL) {
free(sh->uri_content_array);
sh->uri_content_array = NULL;
sh->uri_content_size = 0;
if (sh->init->uri_content_array != NULL) {
free(sh->init->uri_content_array);
sh->init->uri_content_array = NULL;
sh->init->uri_content_size = 0;
}
return 0;
@ -747,14 +770,14 @@ int SigGroupHeadBuildMatchArray (DetectEngineCtx *de_ctx, SigGroupHead *sgh, uin
BUG_ON(sgh->match_array != NULL);
sgh->match_array = malloc(sgh->sig_cnt * sizeof(uint32_t));
sgh->match_array = malloc(sgh->sig_cnt * sizeof(SigIntId));
if (sgh->match_array == NULL)
return -1;
memset(sgh->match_array,0, sgh->sig_cnt * sizeof(uint32_t));
memset(sgh->match_array,0, sgh->sig_cnt * sizeof(SigIntId));
detect_siggroup_matcharray_init_cnt++;
detect_siggroup_matcharray_memory += (sgh->sig_cnt * sizeof(uint32_t));
detect_siggroup_matcharray_memory += (sgh->sig_cnt * sizeof(SigIntId));
for (sig = 0; sig < max_idx+1; sig++) {
if (!(sgh->sig_array[(sig/8)] & (1<<(sig%8))))

1
src/detect-engine-siggroup.h
Unescape Escape View File

@ -43,6 +43,7 @@ int SigGroupHeadSPortHashInit(DetectEngineCtx *);
int SigGroupHeadHashRemove(DetectEngineCtx *, SigGroupHead *);
int SigGroupHeadSPortHashRemove(DetectEngineCtx *, SigGroupHead *);
void SigGroupHeadInitDataFree(SigGroupHeadInitData *sghid);
void SigGroupHeadSetSigCnt(SigGroupHead *sgh, uint32_t max_idx);
int SigGroupHeadBuildMatchArray (DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint32_t max_idx);
void SigGroupHeadFreeSigArrays(DetectEngineCtx *de_ctx);

48
src/detect.c
Unescape Escape View File

@ -1613,7 +1613,7 @@ int BuildDestinationAddressHeads(DetectEngineCtx *de_ctx, DetectAddressGroupsHea
/* content */
SigGroupHeadLoadContent(de_ctx, sgr->sh);
if (sgr->sh->content_size == 0) {
if (sgr->sh->init->content_size == 0) {
de_ctx->mpm_none++;
} else {
/* now have a look if we can reuse a mpm ctx */
@ -1633,7 +1633,7 @@ int BuildDestinationAddressHeads(DetectEngineCtx *de_ctx, DetectAddressGroupsHea
/* uricontent */
SigGroupHeadLoadUricontent(de_ctx, sgr->sh);
if (sgr->sh->uri_content_size == 0) {
if (sgr->sh->init->uri_content_size == 0) {
de_ctx->mpm_uri_none++;
} else {
/* now have a look if we can reuse a uri mpm ctx */
@ -1819,9 +1819,10 @@ static int BuildDestinationAddressHeadsWithBothPorts(DetectEngineCtx *de_ctx, De
(flow ? MAX_UNIQ_SMALL_TOSERVER_SP_GROUPS : MAX_UNIQ_SMALL_TOCLIENT_SP_GROUPS);
CreateGroupedPortList(de_ctx, de_ctx->sport_hash_table, &dst_gr->port, spgroups, CreateGroupedPortListCmpMpmMaxlen, max_idx);
SCLogDebug("adding sgh %p to the hash", dst_gr->sh);
SigGroupHeadHashAdd(de_ctx, dst_gr->sh);
dst_gr->sh->port = dst_gr->port;
dst_gr->sh->init->port = dst_gr->port;
/* mark this head for deletion once we no longer need
* the hash. We're only using the port ptr, so no problem
* when we remove this after initialization is done */
@ -1876,7 +1877,7 @@ static int BuildDestinationAddressHeadsWithBothPorts(DetectEngineCtx *de_ctx, De
SigGroupHeadSPortHashAdd(de_ctx, sp->sh);
sp->sh->port = sp->dst_ph;
sp->sh->init->port = sp->dst_ph;
/* mark this head for deletion once we no longer need
* the hash. We're only using the port ptr, so no problem
* when we remove this after initialization is done */
@ -1899,7 +1900,7 @@ static int BuildDestinationAddressHeadsWithBothPorts(DetectEngineCtx *de_ctx, De
SigGroupHeadBuildMatchArray(de_ctx,dp->sh, max_idx);
SigGroupHeadLoadContent(de_ctx, dp->sh);
if (dp->sh->content_size == 0) {
if (dp->sh->init->content_size == 0) {
de_ctx->mpm_none++;
} else {
/* now have a look if we can reuse a mpm ctx */
@ -1920,7 +1921,7 @@ static int BuildDestinationAddressHeadsWithBothPorts(DetectEngineCtx *de_ctx, De
}
SigGroupHeadLoadUricontent(de_ctx, dp->sh);
if (dp->sh->uri_content_size == 0) {
if (dp->sh->init->uri_content_size == 0) {
de_ctx->mpm_uri_none++;
} else {
/* now have a look if we can reuse a uri mpm ctx */
@ -1984,9 +1985,9 @@ static int BuildDestinationAddressHeadsWithBothPorts(DetectEngineCtx *de_ctx, De
sp->flags |= PORT_SIGGROUPHEAD_COPY;
sp->sh->flags |= SIG_GROUP_HEAD_REFERENCED;
SCLogDebug("replacing sp->dst_ph %p with lookup_sp_sgh->port %p", sp->dst_ph, lookup_sp_sgh->port);
SCLogDebug("replacing sp->dst_ph %p with lookup_sp_sgh->init->port %p", sp->dst_ph, lookup_sp_sgh->init->port);
DetectPortCleanupList(sp->dst_ph);
sp->dst_ph = lookup_sp_sgh->port;
sp->dst_ph = lookup_sp_sgh->init->port;
sp->flags |= PORT_GROUP_PORTS_COPY;
de_ctx->gh_reuse++;
@ -1998,41 +1999,31 @@ static int BuildDestinationAddressHeadsWithBothPorts(DetectEngineCtx *de_ctx, De
dst_gr->flags |= ADDRESS_SIGGROUPHEAD_COPY;
dst_gr->sh->flags |= SIG_GROUP_HEAD_REFERENCED;
SCLogDebug("replacing dst_gr->port %p with lookup_sgh->port %p", dst_gr->port, lookup_sgh->port);
SCLogDebug("replacing dst_gr->port %p with lookup_sgh->init->port %p", dst_gr->port, lookup_sgh->init->port);
DetectPortCleanupList(dst_gr->port);
dst_gr->port = lookup_sgh->port;
dst_gr->port = lookup_sgh->init->port;
dst_gr->flags |= ADDRESS_PORTS_COPY;
de_ctx->gh_reuse++;
}
/* free source port sgh's */
if (!(dst_gr->flags & ADDRESS_PORTS_COPY)) {
DetectPort *sp = dst_gr->port;
for ( ; sp != NULL; sp = sp->next) {
if (!(sp->flags & PORT_SIGGROUPHEAD_COPY)) {
if (!(sp->sh->flags & SIG_GROUP_HEAD_REFERENCED)) {
if (SigGroupHeadHashRemove(de_ctx,sp->sh) == 0 &&
SigGroupHeadSPortHashRemove(de_ctx,sp->sh) == 0) {
SigGroupHeadFree(sp->sh);
sp->sh = NULL;
}
}
}
}
}
}
/* free the temp list */
DetectAddressGroupCleanupList(tmp_gr_list);
/* clear now unneeded sig group head */
SigGroupHeadFree(src_gr->sh);
src_gr->sh = NULL;
/* free dst addr sgh's */
dst_gr_head = GetHeadPtr(src_gr->dst_gh,family);
for (dst_gr = dst_gr_head; dst_gr != NULL; dst_gr = dst_gr->next) {
if (!(dst_gr->flags & ADDRESS_SIGGROUPHEAD_COPY)) {
if (!(dst_gr->sh->flags & SIG_GROUP_HEAD_REFERENCED)) {
if (SigGroupHeadHashRemove(de_ctx,dst_gr->sh) == 0) {
//printf("BothPorts: removed sgh %p\n", dst_gr->sh);
SCLogDebug("removing sgh %p from hash", dst_gr->sh);
int r = SigGroupHeadHashRemove(de_ctx,dst_gr->sh);
BUG_ON(r == -1);
if (r == 0) {
SCLogDebug("removed sgh %p from hash", dst_gr->sh);
SigGroupHeadFree(dst_gr->sh);
dst_gr->sh = NULL;
}
@ -2121,9 +2112,6 @@ int SigAddressPrepareStage3(DetectEngineCtx *de_ctx) {
SigGroupHeadFreeMpmArrays(de_ctx);
/* cleanup group head sig arrays */
SigGroupHeadFreeSigArrays(de_ctx);
/* cleanup heads left over in *WithPorts */
/* XXX VJ breaks SigGroupCleanup */
//SigGroupHeadFreeHeads();
/* cleanup the hashes now since we won't need them
* after the initialization phase. */

41
src/detect.h
Unescape Escape View File

@ -144,7 +144,7 @@ typedef struct Signature_ {
uint8_t prio;
uint32_t gid; /**< generator id */
uint32_t num; /**< signature number, internal id */
SigIntId num; /**< signature number, internal id */
uint32_t id; /**< sid, set by the 'sid' rule keyword */
char *msg;
@ -346,6 +346,21 @@ typedef struct SigTableElmt_ {
#define SIG_GROUP_HEAD_FREE 0x10
#define SIG_GROUP_HEAD_REFERENCED 0x20 /**< sgh is being referenced by others, don't clear */
typedef struct SigGroupHeadInitData_ {
/* list of content containers
* XXX move into a separate data struct
* with only a ptr to it. Saves some memory
* after initialization
*/
uint8_t *content_array;
uint32_t content_size;
uint8_t *uri_content_array;
uint32_t uri_content_size;
/* port ptr */
struct DetectPort_ *port;
} SigGroupHeadInitData;
/** \brief head of the list of containers. */
typedef struct SigGroupHead_ {
uint8_t flags;
@ -359,24 +374,16 @@ typedef struct SigGroupHead_ {
/* number of sigs in this head */
uint32_t sig_cnt;
uint8_t *sig_array; /* bit array of sig nums */
uint32_t sig_size; /* size in bytes */
/* "Normal" detection uses these only at init, but ip-only
* uses it during runtime as well, thus not in init... */
uint8_t *sig_array; /**< bit array of sig nums (internal id's) */
uint32_t sig_size; /**< size in bytes */
/* array with sig nums... size is sig_cnt * sizeof(uint32_t) */
uint32_t *match_array;
/* Array with sig nums... size is sig_cnt * sizeof(SigIntId) */
SigIntId *match_array;
/* list of content containers
* XXX move into a separate data struct
* with only a ptr to it. Saves some memory
* after initialization
*/
uint32_t *content_array;
uint32_t content_size;
uint32_t *uri_content_array;
uint32_t uri_content_size;
/* port ptr */
struct DetectPort_ *port;
/* ptr to our init data we only use at... init :) */
SigGroupHeadInitData *init;
} SigGroupHead;
/** sigmatch has no options, so the parser shouldn't expect any */

7
src/eidps-common.h
Unescape Escape View File

@ -44,5 +44,12 @@
#include <assert.h>
#define BUG_ON(x) assert(!(x))
/** type for the internal signature id. Since it's used in the matching engine
* extensively keeping this as small as possible reduces the overall memory
* footprint of the engine. Set to uint32_t if the engine needs to support
* more than 64k sigs. */
#define SigIntId uint16_t
//#define SigIntId uint32_t
#endif /* __EIDPS_COMMON_H__ */

8
src/util-hashlist.c
Unescape Escape View File

@ -8,6 +8,7 @@
#include "eidps-common.h"
#include "util-hashlist.h"
#include "util-unittest.h"
#include "util-debug.h"
HashListTable* HashListTableInit(uint32_t size, uint32_t (*Hash)(struct HashListTable_ *, void *, uint16_t), char (*Compare)(void *, uint16_t, void *, uint16_t), void (*Free)(void *)) {
@ -94,6 +95,8 @@ int HashListTableAdd(HashListTable *ht, void *data, uint16_t datalen) {
uint32_t hash = ht->Hash(ht, data, datalen);
SCLogDebug("ht %p hash %"PRIu32"", ht, hash);
HashListTableBucket *hb = malloc(sizeof(HashListTableBucket));
if (hb == NULL) {
goto error;
@ -130,7 +133,10 @@ error:
int HashListTableRemove(HashListTable *ht, void *data, uint16_t datalen) {
uint32_t hash = ht->Hash(ht, data, datalen);
SCLogDebug("ht %p hash %"PRIu32"", ht, hash);
if (ht->array[hash] == NULL) {
SCLogDebug("ht->array[hash] NULL");
return -1;
}
@ -159,6 +165,7 @@ int HashListTableRemove(HashListTable *ht, void *data, uint16_t datalen) {
return 0;
}
SCLogDebug("fast track default case");
return -1;
}
@ -198,6 +205,7 @@ int HashListTableRemove(HashListTable *ht, void *data, uint16_t datalen) {
hashbucket = hashbucket->bucknext;
} while (hashbucket != NULL);
SCLogDebug("slow track default case");
return -1;
}

5
src/util-mpm-b2g.c
Unescape Escape View File

@ -375,12 +375,7 @@ static inline int B2gAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen,
/* we need a match */
B2gEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch);
/* keep track of highest pattern id XXX still used? */
if (pid > mpm_ctx->max_pattern_id)
mpm_ctx->max_pattern_id = pid;
mpm_ctx->total_pattern_cnt++;
return 0;
error:

4
src/util-mpm-b2g.h
Unescape Escape View File

@ -46,7 +46,7 @@
typedef struct B2gPattern_ {
uint8_t flags;
uint16_t len;
uint16_t len; /** \todo we're limited to 32/64 byte lengths, uint8_t would be fine here */
uint8_t *cs; /* case sensitive */
uint8_t *ci; /* case INsensitive */
struct B2gPattern_ *next;
@ -55,8 +55,8 @@ typedef struct B2gPattern_ {
typedef struct B2gHashItem_ {
uint16_t idx;
struct B2gHashItem_ *nxt;
uint8_t flags;
struct B2gHashItem_ *nxt;
} B2gHashItem;
typedef struct B2gCtx_ {

5
src/util-mpm-b3g.c
Unescape Escape View File

@ -371,12 +371,7 @@ static inline int B3gAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen,
/* we need a match */
B3gEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch);
/* keep track of highest pattern id XXX still used? */
if (pid > mpm_ctx->max_pattern_id)
mpm_ctx->max_pattern_id = pid;
mpm_ctx->total_pattern_cnt++;
return 0;
error:

25
src/util-mpm-wumanber.c
Unescape Escape View File

@ -440,12 +440,7 @@ static inline int WmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, u
/* we need a match */
WmEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch);
/* keep track of highest pattern id XXX still used? */
if (pid > mpm_ctx->max_pattern_id)
mpm_ctx->max_pattern_id = pid;
mpm_ctx->total_pattern_cnt++;
return 0;
error:
@ -2579,25 +2574,6 @@ int WmTestInitAddPattern06 (void) {
return result;
}
int WmTestInitAddPattern07 (void) {
int result = 0;
MpmCtx mpm_ctx;
memset(&mpm_ctx, 0x00, sizeof(MpmCtx));
MpmThreadCtx mpm_thread_ctx;
MpmInitCtx(&mpm_ctx, MPM_WUMANBER);
WmThreadInitCtx(&mpm_ctx, &mpm_thread_ctx, 1);
WmAddPattern(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 1, 0, 1234, 0, 0);
if (mpm_ctx.max_pattern_id == 1234)
result = 1;
WmThreadDestroyCtx(&mpm_ctx, &mpm_thread_ctx);
WmDestroyCtx(&mpm_ctx);
return result;
}
int WmTestPrepare01 (void) {
int result = 0;
MpmCtx mpm_ctx;
@ -3967,7 +3943,6 @@ void WmRegisterTests(void) {
UtRegisterTest("WmTestInitAddPattern04", WmTestInitAddPattern04, 1);
UtRegisterTest("WmTestInitAddPattern05", WmTestInitAddPattern05, 1);
UtRegisterTest("WmTestInitAddPattern06", WmTestInitAddPattern06, 1);
UtRegisterTest("WmTestInitAddPattern07", WmTestInitAddPattern07, 1);
UtRegisterTest("WmTestPrepare01", WmTestPrepare01, 1);
UtRegisterTest("WmTestPrepare02", WmTestPrepare02, 1);

19
src/util-mpm.c
Unescape Escape View File

@ -214,15 +214,6 @@ MpmMatchAppend(MpmThreadCtx *thread_ctx, PatternMatcherQueue *pmq, MpmEndMatch *
}
SCLogDebug("len %" PRIu32 " (offset %" PRIu32 ")", mb->len, m->offset);
#if 0
MpmMatch *tmp = thread_ctx->qlist;
while (tmp) {
printf("tmp %p tmp->next %p\n", tmp, tmp->next);
tmp = tmp->qnext;
}
#endif
return 1;
}
@ -278,18 +269,8 @@ void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t matcher, uint32_t m
void MpmInitCtx (MpmCtx *mpm_ctx, uint16_t matcher) {
mpm_ctx->mpm_type = matcher;
mpm_table[matcher].InitCtx(mpm_ctx);
// mpm_ctx->AddScanPattern = mpm_table[matcher].AddScanPattern;
// mpm_ctx->AddScanPatternNocase = mpm_table[matcher].AddScanPatternNocase;
// mpm_ctx->AddPattern = mpm_table[matcher].AddPattern;
// mpm_ctx->AddPatternNocase = mpm_table[matcher].AddPatternNocase;
// mpm_ctx->Prepare = mpm_table[matcher].Prepare;
// mpm_ctx->Scan = mpm_table[matcher].Scan;
// mpm_ctx->Search = mpm_table[matcher].Search;
// mpm_ctx->Cleanup = mpm_table[matcher].Cleanup;
}
void MpmTableSetup(void) {
memset(mpm_table, 0, sizeof(mpm_table));

22
src/util-mpm.h
Unescape Escape View File

@ -19,21 +19,21 @@ enum {
/* Data structures */
typedef struct MpmEndMatch_ {
uint32_t id;
uint32_t id; /**< pattern id storage */
uint16_t depth;
uint16_t offset;
uint8_t flags;
struct MpmEndMatch_ *next;
uint32_t sig_id; /* sig callback stuff -- internal id */
SigIntId sig_id; /**< sig callback stuff -- internal id */
uint8_t flags;
} MpmEndMatch;
typedef struct MpmMatch_ {
uint16_t offset; /* offset of this match in the search buffer */
struct MpmMatch_ *next; /* match list -- used to connect a match to a
* pattern id. */
struct MpmMatch_ *qnext; /* queue list -- used to cleanup all matches after
* the inspection. */
struct MpmMatchBucket_ *mb; /* pointer back to the bucket */
struct MpmMatch_ *next; /**< match list -- used to connect a match to a
* pattern id. */
struct MpmMatch_ *qnext; /**< queue list -- used to cleanup all matches
* after the inspection. */
struct MpmMatchBucket_ *mb; /**< pointer back to the bucket */
uint16_t offset; /**< offset of this match in the search buffer */
} MpmMatch;
typedef struct MpmMatchBucket_ {
@ -91,10 +91,6 @@ typedef struct MpmCtx_ {
uint16_t scan_maxlen;
uint16_t search_minlen;
uint16_t search_maxlen;
/* this is used to determine the size of the match
* loopup table */
uint32_t max_pattern_id;
} MpmCtx;
typedef struct MpmTableElmt_ {

Write Preview
Loading…
Cancel
Save