From ea4b7cc33b1897da121cc29399e4493973feec3a Mon Sep 17 00:00:00 2001
From: Jason Ish <jason.ish@endace.com>
Date: Sat, 29 May 2010 00:35:38 -0600
Subject: [PATCH] add profiling to stateful detection engine + other fixups.

---
 src/detect-engine-state.c |  9 ++++++++-
 src/detect.c              | 11 ++++++++---
 src/util-profiling.c      |  5 +++++
 src/util-profiling.h      |  7 +++++++
 4 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/src/detect-engine-state.c b/src/detect-engine-state.c
index 4983103858..4844c32209 100644
--- a/src/detect-engine-state.c
+++ b/src/detect-engine-state.c
@@ -39,6 +39,7 @@
 #include "app-layer-htp.h"
 
 #include "util-unittest.h"
+#include "util-profiling.h"
 
 #define CASE_CODE(E)  case E: return #E
 const char *DeStateMatchResultToString(DeStateMatchResult res)
@@ -332,10 +333,13 @@ int DeStateDetectContinueDetection(ThreadVars *tv, DetectEngineCtx *de_ctx, Dete
                 continue;
             }
 
+            PROFILING_START;
+
             /* let's continue detection */
             SigMatch *sm;
+            int match = 0;
             for (sm = item->nm; sm != NULL; sm = sm->next) {
-                int match = sigmatch_table[sm->type].AppLayerMatch(tv,
+                match = sigmatch_table[sm->type].AppLayerMatch(tv,
                         det_ctx, f, flags, alstate, s, sm);
                 if (match == 0) {
                     item->nm = sm;
@@ -349,6 +353,9 @@ int DeStateDetectContinueDetection(ThreadVars *tv, DetectEngineCtx *de_ctx, Dete
 
             SCLogDebug("signature %"PRIu32" match state %s",
                     s->id, DeStateMatchResultToString(det_ctx->de_state_sig_array[item->sid]));
+
+            RULE_PROFILING_END(s, match);
+
         }
     }
 
diff --git a/src/detect.c b/src/detect.c
index ad6c2d6b3d..78d1c80ab3 100644
--- a/src/detect.c
+++ b/src/detect.c
@@ -649,6 +649,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
 
             }
         }
+
         if (s->flags & SIG_FLAG_MPM_URI) {
             if (det_ctx->pmq.pattern_id_bitarray != NULL) {
                 /* filter out sigs that want pattern matches, but
@@ -722,12 +723,12 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
             if (de_state_start == TRUE) {
                 SCLogDebug("stateful app layer match inspection starting");
                 if (DeStateDetectStartDetection(th_v, det_ctx, s, p->flow, flags, alstate, alproto) != 1)
-                    continue;
+                    goto next;
             } else {
                 SCLogDebug("signature %"PRIu32" (%"PRIuMAX"): %s",
                         s->id, (uintmax_t)s->num, DeStateMatchResultToString(det_ctx->de_state_sig_array[s->num]));
                 if (det_ctx->de_state_sig_array[s->num] != DE_STATE_MATCH_NEW) {
-                    continue;
+                    goto next;
                 }
             }
         }
@@ -791,7 +792,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
                     /* Limit the number of times we do this recursive thing.
                      * XXX is this a sane limit? Should it be configurable? */
                     if (det_ctx->pkt_cnt == 10)
-                        break;
+                        goto done;
                 } while (rmatch);
 
             } else {
@@ -833,6 +834,10 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
         }
     next:
         RULE_PROFILING_END(s, match);
+        continue;
+    done:
+        RULE_PROFILING_END(s, match);
+        break;
     }
 
     if (p->flow != NULL) {
diff --git a/src/util-profiling.c b/src/util-profiling.c
index 3f32ebafba..d0c2b64b53 100644
--- a/src/util-profiling.c
+++ b/src/util-profiling.c
@@ -77,6 +77,11 @@ typedef struct SCProfileSummary_ {
 
 int profiling_rules_enabled = 0;
 
+/**
+ * Used as a check so we don't double enter a profiling run.
+ */
+__thread int profiling_entered = 0;
+
 /**
  * \brief Initialize profiling.
  */
diff --git a/src/util-profiling.h b/src/util-profiling.h
index 2fc67ec07b..1d293099ca 100644
--- a/src/util-profiling.h
+++ b/src/util-profiling.h
@@ -29,11 +29,17 @@
 #include "util-cpu.h"
 
 extern int profiling_rules_enabled;
+extern __thread int profiling_entered;
 
 #define PROFILING_START \
     uint64_t profile_start_ = 0; \
     uint64_t profile_end_ = 0; \
     if (profiling_rules_enabled) { \
+        if (profiling_entered > 0) { \
+            SCLogError(SC_ERR_FATAL, "Re-entered profiling, exiting."); \
+            exit(1); \
+        } \
+        profiling_entered++; \
         profile_start_ = UtilCpuGetTicks(); \
     }
 
@@ -42,6 +48,7 @@ extern int profiling_rules_enabled;
         profile_end_ = UtilCpuGetTicks(); \
         SCProfilingUpdateRuleCounter(r->profiling_id, \
             profile_end_ - profile_start_, m); \
+        profiling_entered--; \
     }
 
 void SCProfilingInit(void);