aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

updates to ac-gfbs search. Disable handling < 65k states separately. Now any state count would be given same treatment

Browse Source
remotes/origin/master-1.2.x
Anoop Saldanha 14 years ago committed by Victor Julien
parent efb4c27b1f
commit b69ac9514f
1 changed files with 174 additions and 174 deletions
Show Stats Download Patch File Download Diff File

348
src/util-mpm-ac-gfbs.c
Unescape Escape View File

@ -749,63 +749,63 @@ static inline void SCACGfbsCreateModGotoTable(MpmCtx *mpm_ctx)
{ {
SCACGfbsCtx *ctx = (SCACGfbsCtx *)mpm_ctx->ctx; SCACGfbsCtx *ctx = (SCACGfbsCtx *)mpm_ctx->ctx;
if (ctx->state_count < 65536) { //if (ctx->state_count < 65536) {
/* Let us use uint16_t for all. That way we don't have to worry about // /* Let us use uint16_t for all. That way we don't have to worry about
* alignment. Technically 8 bits is all we need to store ascii codes, // * alignment. Technically 8 bits is all we need to store ascii codes,
* but by avoiding it, we save a lot of time on handling alignment */ // * but by avoiding it, we save a lot of time on handling alignment */
int size = (ctx->state_count * sizeof(SC_AC_GFBS_STATE_TYPE_U16) * 3 + // int size = (ctx->state_count * sizeof(SC_AC_GFBS_STATE_TYPE_U16) * 3 +
256 * sizeof(SC_AC_GFBS_STATE_TYPE_U16) * 2); // 256 * sizeof(SC_AC_GFBS_STATE_TYPE_U16) * 2);
ctx->goto_table_mod = SCMalloc(size); // ctx->goto_table_mod = SCMalloc(size);
if (ctx->goto_table_mod == NULL) { // if (ctx->goto_table_mod == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); // SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
exit(EXIT_FAILURE); // exit(EXIT_FAILURE);
} // }
memset(ctx->goto_table_mod, 0, size); // memset(ctx->goto_table_mod, 0, size);
//
mpm_ctx->memory_cnt++; // mpm_ctx->memory_cnt++;
mpm_ctx->memory_size += size; // mpm_ctx->memory_size += size;
//
/* buffer to hold pointers in the buffer, so that a state can use it // /* buffer to hold pointers in the buffer, so that a state can use it
* directly to access its state data */ // * directly to access its state data */
ctx->goto_table_mod_pointers = SCMalloc(ctx->state_count * sizeof(uint8_t *)); // ctx->goto_table_mod_pointers = SCMalloc(ctx->state_count * sizeof(uint8_t *));
if (ctx->goto_table_mod_pointers == NULL) { // if (ctx->goto_table_mod_pointers == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); // SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
exit(EXIT_FAILURE); // exit(EXIT_FAILURE);
} // }
memset(ctx->goto_table_mod_pointers, 0, // memset(ctx->goto_table_mod_pointers, 0,
ctx->state_count * sizeof(uint8_t *)); // ctx->state_count * sizeof(uint8_t *));
//
SC_AC_GFBS_STATE_TYPE_U16 temp_states[256]; // SC_AC_GFBS_STATE_TYPE_U16 temp_states[256];
uint16_t *curr_loc = (uint16_t *)ctx->goto_table_mod; // uint16_t *curr_loc = (uint16_t *)ctx->goto_table_mod;
uint16_t *no_of_entries = NULL; // uint16_t *no_of_entries = NULL;
uint16_t *ascii_codes = NULL; // uint16_t *ascii_codes = NULL;
int32_t state = 0; // int32_t state = 0;
uint16_t ascii_code = 0; // uint16_t ascii_code = 0;
uint16_t k = 0; // uint16_t k = 0;
for (state = 0; state < ctx->state_count; state++) { // for (state = 0; state < ctx->state_count; state++) {
/* store the starting location in the buffer for this state */ // /* store the starting location in the buffer for this state */
ctx->goto_table_mod_pointers[state] = (uint8_t *)curr_loc; // ctx->goto_table_mod_pointers[state] = (uint8_t *)curr_loc;
no_of_entries = curr_loc++; // no_of_entries = curr_loc++;
ascii_codes = curr_loc; // ascii_codes = curr_loc;
k = 0; // k = 0;
/* store all states that have non fail transitions in the temp buffer */ // /* store all states that have non fail transitions in the temp buffer */
for (ascii_code = 0; ascii_code < 256; ascii_code++) { // for (ascii_code = 0; ascii_code < 256; ascii_code++) {
if (ctx->goto_table[state][ascii_code] == SC_AC_GFBS_FAIL) // if (ctx->goto_table[state][ascii_code] == SC_AC_GFBS_FAIL)
continue; // continue;
ascii_codes[k] = ascii_code; // ascii_codes[k] = ascii_code;
temp_states[k] = ctx->goto_table[state][ascii_code]; // temp_states[k] = ctx->goto_table[state][ascii_code];
k++; // k++;
} // }
/* if we have any non fail transitions from our previous for search, // /* if we have any non fail transitions from our previous for search,
* store the acii codes as well the corresponding states */ // * store the acii codes as well the corresponding states */
if (k > 0) { // if (k > 0) {
no_of_entries[0] = k; // no_of_entries[0] = k;
curr_loc += k; // curr_loc += k;
memcpy(curr_loc, temp_states, k * sizeof(SC_AC_GFBS_STATE_TYPE_U16)); // memcpy(curr_loc, temp_states, k * sizeof(SC_AC_GFBS_STATE_TYPE_U16));
curr_loc += k; // curr_loc += k;
} // }
} // }
} else { //} else {
/* Let us use uint32_t for all. That way we don't have to worry about /* Let us use uint32_t for all. That way we don't have to worry about
* alignment. Technically 8 bits is all we need to store ascii codes, * alignment. Technically 8 bits is all we need to store ascii codes,
* but by avoiding it, we save a lot of time on handling alignment */ * but by avoiding it, we save a lot of time on handling alignment */
@ -861,7 +861,7 @@ static inline void SCACGfbsCreateModGotoTable(MpmCtx *mpm_ctx)
curr_loc += k; curr_loc += k;
} }
} }
} //}
return; return;
} }
@ -1131,13 +1131,13 @@ void SCACGfbsDestroyCtx(MpmCtx *mpm_ctx)
ctx->goto_table_mod = NULL; ctx->goto_table_mod = NULL;
mpm_ctx->memory_cnt--; mpm_ctx->memory_cnt--;
if (ctx->state_count < 65536) { //if (ctx->state_count < 65536) {
mpm_ctx->memory_size -= (ctx->state_count * sizeof(SC_AC_GFBS_STATE_TYPE_U16) * 3 + // mpm_ctx->memory_size -= (ctx->state_count * sizeof(SC_AC_GFBS_STATE_TYPE_U16) * 3 +
256 * sizeof(SC_AC_GFBS_STATE_TYPE_U16) * 2); // 256 * sizeof(SC_AC_GFBS_STATE_TYPE_U16) * 2);
} else { //} else {
mpm_ctx->memory_size -= (ctx->state_count * sizeof(SC_AC_GFBS_STATE_TYPE_U32) * 3 + mpm_ctx->memory_size -= (ctx->state_count * sizeof(SC_AC_GFBS_STATE_TYPE_U32) * 3 +
256 * sizeof(SC_AC_GFBS_STATE_TYPE_U32) * 2); 256 * sizeof(SC_AC_GFBS_STATE_TYPE_U32) * 2);
} //}
} }
if (ctx->goto_table_mod_pointers != NULL) { if (ctx->goto_table_mod_pointers != NULL) {
@ -1177,116 +1177,116 @@ uint32_t SCACGfbsSearch(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,
SCACGfbsPatternList *pid_pat_list = ctx->pid_pat_list; SCACGfbsPatternList *pid_pat_list = ctx->pid_pat_list;
/* really hate the extra cmp here, but can't help it */ /* really hate the extra cmp here, but can't help it */
if (ctx->state_count < 65536) { //if (ctx->state_count < 65536) {
/* \todo Change it for stateful MPM. Supply the state using mpm_thread_ctx */ // /* \todo Change it for stateful MPM. Supply the state using mpm_thread_ctx */
int32_t temp_state; // int32_t temp_state;
uint16_t *no_of_entries; // uint16_t *no_of_entries;
uint16_t *ascii_codes; // uint16_t *ascii_codes;
uint8_t **goto_table_mod_pointers = ctx->goto_table_mod_pointers; // uint8_t **goto_table_mod_pointers = ctx->goto_table_mod_pointers;
int32_t *failure_table = ctx->failure_table; // int32_t *failure_table = ctx->failure_table;
int i; // int i;
/* \todo tried loop unrolling with register var, with no perf increase. Need // /* \todo tried loop unrolling with register var, with no perf increase. Need
* to dig deeper */ // * to dig deeper */
/* with so many var declarations the register declaration here is useless */ // /* with so many var declarations the register declaration here is useless */
register int32_t state = 0; // register int32_t state = 0;
for (i = 0; i < buflen; i++) { // for (i = 0; i < buflen; i++) {
/* get the goto state transition */ // /* get the goto state transition */
no_of_entries = (uint16_t *)goto_table_mod_pointers[state]; // no_of_entries = (uint16_t *)goto_table_mod_pointers[state];
if (no_of_entries[0] == 0) { // if (no_of_entries[0] == 0) {
temp_state = SC_AC_GFBS_FAIL; // temp_state = SC_AC_GFBS_FAIL;
} else { // } else {
ascii_codes = no_of_entries + 1; // ascii_codes = no_of_entries + 1;
buf_local = u8_tolower(buf[i]); // buf_local = u8_tolower(buf[i]);
if (state == 0) { // if (state == 0) {
temp_state = ((SC_AC_GFBS_STATE_TYPE_U16 *)(ascii_codes + no_of_entries[0]))[buf_local]; // temp_state = ((SC_AC_GFBS_STATE_TYPE_U16 *)(ascii_codes + no_of_entries[0]))[buf_local];
} else { // } else {
int low = 0; // int low = 0;
int high = no_of_entries[0]; // int high = no_of_entries[0];
int mid; // int mid;
temp_state = SC_AC_GFBS_FAIL; // temp_state = SC_AC_GFBS_FAIL;
while (low <= high) { // while (low <= high) {
mid = (low + high) / 2; // mid = (low + high) / 2;
if (ascii_codes[mid] == buf_local) { // if (ascii_codes[mid] == buf_local) {
temp_state = ((SC_AC_GFBS_STATE_TYPE_U16 *)(ascii_codes + no_of_entries[0]))[mid]; // temp_state = ((SC_AC_GFBS_STATE_TYPE_U16 *)(ascii_codes + no_of_entries[0]))[mid];
break; // break;
} else if (ascii_codes[mid] < buf_local) { // } else if (ascii_codes[mid] < buf_local) {
low = mid + 1; // low = mid + 1;
} else { // } else {
high = mid - 1; // high = mid - 1;
} // }
} // }
} // }
} // }
while (temp_state == SC_AC_GFBS_FAIL) { // while (temp_state == SC_AC_GFBS_FAIL) {
state = failure_table[state]; // state = failure_table[state];
//
/* get the goto state transition */ // /* get the goto state transition */
no_of_entries = (uint16_t *)goto_table_mod_pointers[state]; // no_of_entries = (uint16_t *)goto_table_mod_pointers[state];
if (no_of_entries[0] == 0) { // if (no_of_entries[0] == 0) {
temp_state = SC_AC_GFBS_FAIL; // temp_state = SC_AC_GFBS_FAIL;
} else { // } else {
ascii_codes = no_of_entries + 1; // ascii_codes = no_of_entries + 1;
buf_local = u8_tolower(buf[i]); // buf_local = u8_tolower(buf[i]);
if (state == 0) { // if (state == 0) {
temp_state = ((SC_AC_GFBS_STATE_TYPE_U16 *)(ascii_codes + no_of_entries[0]))[buf_local]; // temp_state = ((SC_AC_GFBS_STATE_TYPE_U16 *)(ascii_codes + no_of_entries[0]))[buf_local];
} else { // } else {
int low = 0; // int low = 0;
int high = no_of_entries[0]; // int high = no_of_entries[0];
int mid; // int mid;
temp_state = SC_AC_GFBS_FAIL; // temp_state = SC_AC_GFBS_FAIL;
while (low <= high) { // while (low <= high) {
mid = (low + high) / 2; // mid = (low + high) / 2;
if (ascii_codes[mid] == buf_local) { // if (ascii_codes[mid] == buf_local) {
temp_state = ((SC_AC_GFBS_STATE_TYPE_U16 *)(ascii_codes + no_of_entries[0]))[mid]; // temp_state = ((SC_AC_GFBS_STATE_TYPE_U16 *)(ascii_codes + no_of_entries[0]))[mid];
break; // break;
} else if (ascii_codes[mid] < buf_local) { // } else if (ascii_codes[mid] < buf_local) {
low = mid + 1; // low = mid + 1;
} else { // } else {
high = mid - 1; // high = mid - 1;
} // }
} // }
} // }
} /* else - if (no_of_entries[0] == 0) */ // } /* else - if (no_of_entries[0] == 0) */
} /* while (temp_state == SC_AC_GFBS_FAIL) */ // } /* while (temp_state == SC_AC_GFBS_FAIL) */
//
state = temp_state; // state = temp_state;
if (ctx->output_table[state].no_of_entries != 0) { // if (ctx->output_table[state].no_of_entries != 0) {
uint32_t no_of_pid_entries = ctx->output_table[state].no_of_entries; // uint32_t no_of_pid_entries = ctx->output_table[state].no_of_entries;
uint32_t *pids = ctx->output_table[state].pids; // uint32_t *pids = ctx->output_table[state].pids;
uint32_t k = 0; // uint32_t k = 0;
for (k = 0; k < no_of_pid_entries; k++) { // for (k = 0; k < no_of_pid_entries; k++) {
if (pids[k] & 0xFFFF0000) { // if (pids[k] & 0xFFFF0000) {
if (SCMemcmp(pid_pat_list[pids[k] & 0x0000FFFF].cs, // if (SCMemcmp(pid_pat_list[pids[k] & 0x0000FFFF].cs,
buf + i - pid_pat_list[pids[k] & 0x0000FFFF].patlen + 1, // buf + i - pid_pat_list[pids[k] & 0x0000FFFF].patlen + 1,
pid_pat_list[pids[k] & 0x0000FFFF].patlen) != 0) { // pid_pat_list[pids[k] & 0x0000FFFF].patlen) != 0) {
/* inside loop */ // /* inside loop */
if (pid_pat_list[pids[k] & 0x0000FFFF].case_state != 3) { // if (pid_pat_list[pids[k] & 0x0000FFFF].case_state != 3) {
continue; // continue;
} // }
} // }
//
if (pmq->pattern_id_bitarray[(pids[k] & 0x0000FFFF) / 8] & (1 << ((pids[k] & 0x0000FFFF) % 8))) { // if (pmq->pattern_id_bitarray[(pids[k] & 0x0000FFFF) / 8] & (1 << ((pids[k] & 0x0000FFFF) % 8))) {
; // ;
} else { // } else {
pmq->pattern_id_bitarray[(pids[k] & 0x0000FFFF) / 8] |= (1 << ((pids[k] & 0x0000FFFF) % 8)); // pmq->pattern_id_bitarray[(pids[k] & 0x0000FFFF) / 8] |= (1 << ((pids[k] & 0x0000FFFF) % 8));
pmq->pattern_id_array[pmq->pattern_id_array_cnt++] = (pids[k] & 0x0000FFFF); // pmq->pattern_id_array[pmq->pattern_id_array_cnt++] = (pids[k] & 0x0000FFFF);
} // }
matches++; // matches++;
} else { // } else {
if (pmq->pattern_id_bitarray[pids[k] / 8] & (1 << (pids[k] % 8))) { // if (pmq->pattern_id_bitarray[pids[k] / 8] & (1 << (pids[k] % 8))) {
; // ;
} else { // } else {
pmq->pattern_id_bitarray[pids[k] / 8] |= (1 << (pids[k] % 8)); // pmq->pattern_id_bitarray[pids[k] / 8] |= (1 << (pids[k] % 8));
pmq->pattern_id_array[pmq->pattern_id_array_cnt++] = pids[k]; // pmq->pattern_id_array[pmq->pattern_id_array_cnt++] = pids[k];
} // }
matches++; // matches++;
} // }
loop: // loop:
; // ;
} // }
} /* if (ctx->output_table[state].no_of_entries != 0) */ // } /* if (ctx->output_table[state].no_of_entries != 0) */
} /* for (i = 0; i < buflen; i++) */ // } /* for (i = 0; i < buflen; i++) */
} else { //} else {
/* \todo Change it for stateful MPM. Supply the state using mpm_thread_ctx */ /* \todo Change it for stateful MPM. Supply the state using mpm_thread_ctx */
int32_t temp_state = 0; int32_t temp_state = 0;
uint32_t no_of_entries; uint32_t no_of_entries;
@ -1412,7 +1412,7 @@ uint32_t SCACGfbsSearch(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,
} }
} /* if (ctx->output_table[state].no_of_entries != 0) */ } /* if (ctx->output_table[state].no_of_entries != 0) */
} /* for (i = 0; i < buflen; i++) */ } /* for (i = 0; i < buflen; i++) */
} //}
return matches; return matches;
} }

Write Preview
Loading…
Cancel
Save