suricata
util-prefilter.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Pattern matcher utility Functions
24  */
25 
26 #include "suricata-common.h"
27 #include "util-prefilter.h"
28 
29 /**
30  * \brief Setup a pmq
31  *
32  * \param pmq Pattern matcher queue to be initialized
33  *
34  * \retval -1 error
35  * \retval 0 ok
36  */
38 {
39  SCEnter();
40 
41  if (pmq == NULL) {
42  SCReturnInt(-1);
43  }
44 
45  memset(pmq, 0, sizeof(PrefilterRuleStore));
46 
47  pmq->rule_id_array_size = 128; /* Initial size, TODO: Make configure option. */
48  pmq->rule_id_array_cnt = 0;
49 
50  size_t bytes = pmq->rule_id_array_size * sizeof(SigIntId);
51  pmq->rule_id_array = (SigIntId*)SCMalloc(bytes);
52  if (pmq->rule_id_array == NULL) {
53  pmq->rule_id_array_size = 0;
54  SCReturnInt(-1);
55  }
56  // Don't need to zero memory since it is always written first.
57 
58  SCReturnInt(0);
59 }
60 
61 /** \brief Add array of Signature IDs to rule ID array.
62  *
63  * Checks size of the array first
64  *
65  * \param pmq storage for match results
66  * \param new_size number of Signature IDs needing to be stored.
67  *
68  */
69 int
71 {
72  /* Need to make the array bigger. Double the size needed to
73  * also handle the case that sids_size might still be
74  * larger than the old size.
75  */
76  new_size = new_size * 2;
77  SigIntId *new_array = (SigIntId*)SCRealloc(pmq->rule_id_array,
78  new_size * sizeof(SigIntId));
79  if (unlikely(new_array == NULL)) {
80  /* Try again just big enough. */
81  new_size = new_size / 2;
82  new_array = (SigIntId*)SCRealloc(pmq->rule_id_array,
83  new_size * sizeof(SigIntId));
84  if (unlikely(new_array == NULL)) {
85 
86  SCLogError("Failed to realloc PatternMatchQueue"
87  " rule ID array. Some signature ID matches lost");
88  return 0;
89  }
90  }
91  pmq->rule_id_array = new_array;
92  pmq->rule_id_array_size = new_size;
93 
94  return new_size;
95 }
96 
97 /** \brief Reset a Pmq for reusage. Meant to be called after a single search.
98  * \param pmq Pattern matcher to be reset.
99  * \todo memset is expensive, but we need it as we merge pmq's. We might use
100  * a flag so we can clear pmq's the old way if we can.
101  */
103 {
104  if (pmq == NULL)
105  return;
106 
107  PMQ_RESET(pmq);
108 }
109 
110 /** \brief Cleanup a Pmq
111  * \param pmq Pattern matcher queue to be cleaned up.
112  */
114 {
115  if (pmq == NULL)
116  return;
117  if (pmq->rule_id_array != NULL) {
118  SCFree(pmq->rule_id_array);
119  pmq->rule_id_array = NULL;
120  }
121 }
122 
123 /** \brief Cleanup and free a Pmq
124  * \param pmq Pattern matcher queue to be free'd.
125  */
127 {
128  if (pmq == NULL)
129  return;
130 
131  PmqCleanup(pmq);
132 }
PmqReset
void PmqReset(PrefilterRuleStore *pmq)
Reset a Pmq for reusage. Meant to be called after a single search.
Definition: util-prefilter.c:102
PrefilterRuleStore_::rule_id_array_cnt
uint32_t rule_id_array_cnt
Definition: util-prefilter.h:40
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
PrefilterRuleStore_
structure for storing potential rule matches
Definition: util-prefilter.h:34
PrefilterAddSidsResize
int PrefilterAddSidsResize(PrefilterRuleStore *pmq, uint32_t new_size)
Add array of Signature IDs to rule ID array.
Definition: util-prefilter.c:70
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
PMQ_RESET
#define PMQ_RESET(pmq)
Definition: util-prefilter.h:46
SCRealloc
#define SCRealloc(ptr, sz)
Definition: util-mem.h:50
util-prefilter.h
suricata-common.h
PmqCleanup
void PmqCleanup(PrefilterRuleStore *pmq)
Cleanup a Pmq.
Definition: util-prefilter.c:113
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
SCFree
#define SCFree(p)
Definition: util-mem.h:61
PmqFree
void PmqFree(PrefilterRuleStore *pmq)
Cleanup and free a Pmq.
Definition: util-prefilter.c:126
PrefilterRuleStore_::rule_id_array_size
uint32_t rule_id_array_size
Definition: util-prefilter.h:42
SigIntId
#define SigIntId
Definition: suricata-common.h:304
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275
PmqSetup
int PmqSetup(PrefilterRuleStore *pmq)
Setup a pmq.
Definition: util-prefilter.c:37
PrefilterRuleStore_::rule_id_array
SigIntId * rule_id_array
Definition: util-prefilter.h:38