suricata
util-prefilter.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Pattern matcher utility Functions
24  */
25 
26 #include "suricata-common.h"
27 
28 /**
29  * \brief Setup a pmq
30  *
31  * \param pmq Pattern matcher queue to be initialized
32  *
33  * \retval -1 error
34  * \retval 0 ok
35  */
37 {
38  SCEnter();
39 
40  if (pmq == NULL) {
41  SCReturnInt(-1);
42  }
43 
44  memset(pmq, 0, sizeof(PrefilterRuleStore));
45 
46  pmq->rule_id_array_size = 128; /* Initial size, TODO: Make configure option. */
47  pmq->rule_id_array_cnt = 0;
48 
49  size_t bytes = pmq->rule_id_array_size * sizeof(SigIntId);
50  pmq->rule_id_array = (SigIntId*)SCMalloc(bytes);
51  if (pmq->rule_id_array == NULL) {
52  pmq->rule_id_array_size = 0;
53  SCReturnInt(-1);
54  }
55  // Don't need to zero memory since it is always written first.
56 
57  SCReturnInt(0);
58 }
59 
60 /** \brief Add array of Signature IDs to rule ID array.
61  *
62  * Checks size of the array first
63  *
64  * \param pmq storage for match results
65  * \param new_size number of Signature IDs needing to be stored.
66  *
67  */
68 int
70 {
71  /* Need to make the array bigger. Double the size needed to
72  * also handle the case that sids_size might still be
73  * larger than the old size.
74  */
75  new_size = new_size * 2;
76  SigIntId *new_array = (SigIntId*)SCRealloc(pmq->rule_id_array,
77  new_size * sizeof(SigIntId));
78  if (unlikely(new_array == NULL)) {
79  /* Try again just big enough. */
80  new_size = new_size / 2;
81  new_array = (SigIntId*)SCRealloc(pmq->rule_id_array,
82  new_size * sizeof(SigIntId));
83  if (unlikely(new_array == NULL)) {
84 
85  SCLogError(SC_ERR_MEM_ALLOC, "Failed to realloc PatternMatchQueue"
86  " rule ID array. Some signature ID matches lost");
87  return 0;
88  }
89  }
90  pmq->rule_id_array = new_array;
91  pmq->rule_id_array_size = new_size;
92 
93  return new_size;
94 }
95 
96 /** \brief Reset a Pmq for reusage. Meant to be called after a single search.
97  * \param pmq Pattern matcher to be reset.
98  * \todo memset is expensive, but we need it as we merge pmq's. We might use
99  * a flag so we can clear pmq's the old way if we can.
100  */
102 {
103  if (pmq == NULL)
104  return;
105 
106  pmq->rule_id_array_cnt = 0;
107  /* TODO: Realloc the rule id array smaller at some size? */
108 }
109 
110 /** \brief Cleanup a Pmq
111  * \param pmq Pattern matcher queue to be cleaned up.
112  */
114 {
115  if (pmq == NULL)
116  return;
117  if (pmq->rule_id_array != NULL) {
118  SCFree(pmq->rule_id_array);
119  pmq->rule_id_array = NULL;
120  }
121 }
122 
123 /** \brief Cleanup and free a Pmq
124  * \param pmq Pattern matcher queue to be free'd.
125  */
127 {
128  if (pmq == NULL)
129  return;
130 
131  PmqCleanup(pmq);
132 }
int PrefilterAddSidsResize(PrefilterRuleStore *pmq, uint32_t new_size)
Add array of Signature IDs to rule ID array.
void PmqReset(PrefilterRuleStore *pmq)
Reset a Pmq for reusage. Meant to be called after a single search.
#define unlikely(expr)
Definition: util-optimize.h:35
uint32_t rule_id_array_size
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:294
#define SCEnter(...)
Definition: util-debug.h:337
SigIntId * rule_id_array
#define SCReturnInt(x)
Definition: util-debug.h:341
#define SCRealloc(x, a)
Definition: util-mem.h:238
#define SCMalloc(a)
Definition: util-mem.h:222
#define SCFree(a)
Definition: util-mem.h:322
void PmqCleanup(PrefilterRuleStore *pmq)
Cleanup a Pmq.
uint32_t rule_id_array_cnt
structure for storing potential rule matches
int PmqSetup(PrefilterRuleStore *pmq)
Setup a pmq.
void PmqFree(PrefilterRuleStore *pmq)
Cleanup and free a Pmq.
#define SigIntId