suricata
util-var-name.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2023 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Generic variable name utility functions
24  */
25 
26 #include "suricata-common.h"
27 #include "detect.h"
28 #include "util-hash-string.h"
29 #include "util-hashlist.h"
30 #include "util-var-name.h"
31 #include "util-validate.h"
32 
33 /* Overall Design:
34  *
35  * Base Store: "base"
36  *
37  * Used during keyword registration. Operates under lock. Base is shared
38  * between all detect engines, detect engine versions and tenants.
39  * Each variable name is ref counted.
40  *
41  * During the freeing of a detect engine / tenant, unregistration decreases
42  * the ref cnt.
43  *
44  * Base has both a string to id and a id to string hash table. String to
45  * id is used during parsing/registration. id to string during unregistration.
46  *
47  *
48  * Active Store Pointer (atomic)
49  *
50  * The "active" store atomic pointer points to the active store. The call
51  * to `VarNameStoreActivate` will build a new lookup store and hot swap
52  * the pointer.
53  *
54  * Ensuring memory safety. During the hot swap, the pointer is replaced, so
55  * any new call to the lookup functions will automatically use the new store.
56  * This leaves the case of any lookup happening concurrently with the pointer
57  * swap. For this case we add the old store to a free list. It gets a timestamp
58  * before which it cannot be freed.
59  *
60  *
61  * Free List
62  *
63  * The free list contains old stores that are waiting to get removed. They
64  * contain a timestamp that is checked before they are freed.
65  *
66  */
67 typedef struct VarNameStore_ {
70  uint32_t max_id;
71  struct timeval free_after;
75 
76 /** \brief Name2idx mapping structure for flowbits, flowvars and pktvars. */
77 typedef struct VariableName_ {
78  char *name;
79  enum VarTypes type; /* flowbit, pktvar, etc */
80  uint32_t id;
81  uint32_t ref_cnt;
83 
84 #define VARNAME_HASHSIZE 0x1000
85 #define VARID_HASHSIZE 0x1000
86 
87 static SCMutex base_lock = SCMUTEX_INITIALIZER;
88 static VarNameStore base = { .names = NULL, .ids = NULL, .max_id = 0 };
89 static TAILQ_HEAD(, VarNameStore_) free_list = TAILQ_HEAD_INITIALIZER(free_list);
90 static SC_ATOMIC_DECLARE(VarNameStorePtr, active);
91 
92 static uint32_t VariableNameHash(HashListTable *ht, void *buf, uint16_t buflen);
93 static char VariableNameCompare(void *buf1, uint16_t len1, void *buf2, uint16_t len2);
94 static uint32_t VariableIdHash(HashListTable *ht, void *ptr, uint16_t _unused);
95 static char VariableIdCompare(void *ptr1, uint16_t _unused1, void *ptr2, uint16_t _unused2);
96 static void VariableNameFree(void *data);
97 
98 void VarNameStoreInit(void)
99 {
100  SCMutexLock(&base_lock);
101  base.names = HashListTableInit(
102  VARNAME_HASHSIZE, VariableNameHash, VariableNameCompare, VariableNameFree);
103  if (base.names == NULL) {
104  FatalError("failed to initialize variable name hash (names)");
105  }
106 
107  /* base.names owns the allocation, so use a NULL Free pointer here */
108  base.ids = HashListTableInit(VARID_HASHSIZE, VariableIdHash, VariableIdCompare, NULL);
109  if (base.ids == NULL) {
110  FatalError("failed to initialize variable name hash (names)");
111  }
112  SC_ATOMIC_INITPTR(active);
113  SCMutexUnlock(&base_lock);
114 }
115 
117 {
118  SCMutexLock(&base_lock);
119  VarNameStore *s = SC_ATOMIC_GET(active);
120  if (s) {
123  SCFree(s);
124  s = NULL;
125  }
126  SC_ATOMIC_SET(active, NULL);
127 
128  while ((s = TAILQ_FIRST(&free_list))) {
129  TAILQ_REMOVE(&free_list, s, next);
132  SCFree(s);
133  }
134 
135  for (HashListTableBucket *b = HashListTableGetListHead(base.names); b != NULL;
136  b = HashListTableGetListNext(b)) {
139  if (vn->ref_cnt > 0) {
140  SCLogWarning("%s (type %u, id %u) still has ref_cnt %u", vn->name, vn->type, vn->id,
141  vn->ref_cnt);
142  }
143  }
144  HashListTableFree(base.ids);
145  base.ids = NULL;
146  HashListTableFree(base.names);
147  base.names = NULL;
148  base.max_id = 0;
149  SCMutexUnlock(&base_lock);
150 }
151 
152 /**
153  * \retval id or 0 on error
154  */
155 uint32_t VarNameStoreRegister(const char *name, const enum VarTypes type)
156 {
157  SCMutexLock(&base_lock);
158  uint32_t id = 0;
159 
160  SCLogDebug("registering: name %s type %u", name, type);
161  VariableName lookup = { .type = type, .name = (char *)name };
162  VariableName *found = (VariableName *)HashListTableLookup(base.names, (void *)&lookup, 0);
163  if (found == NULL) {
164  VariableName *vn = SCCalloc(1, sizeof(VariableName));
165  if (likely(vn != NULL)) {
166  vn->type = type;
167  vn->name = SCStrdup(name);
168  if (vn->name != NULL) {
169  vn->ref_cnt = 1;
170  id = vn->id = ++base.max_id;
171  HashListTableAdd(base.names, (void *)vn, 0);
172  HashListTableAdd(base.ids, (void *)vn, 0);
173  SCLogDebug(
174  "new registration %s id %u type %u -> %u", vn->name, vn->id, vn->type, id);
175  } else {
176  SCFree(vn);
177  }
178  }
179  } else {
180  id = found->id;
181  found->ref_cnt++;
182  SCLogDebug("existing registration %s ref_cnt %u -> %u", name, found->ref_cnt, id);
183  }
184  SCMutexUnlock(&base_lock);
185  return id;
186 }
187 
188 const char *VarNameStoreSetupLookup(const uint32_t id, const enum VarTypes type)
189 {
190  const char *name = NULL;
191  SCMutexLock(&base_lock);
192  VariableName lookup = { .type = type, .id = id };
193  VariableName *found = (VariableName *)HashListTableLookup(base.ids, (void *)&lookup, 0);
194  if (found) {
195  name = found->name;
196  }
197  SCMutexUnlock(&base_lock);
198  return name;
199 }
200 
201 void VarNameStoreUnregister(const uint32_t id, const enum VarTypes type)
202 {
203  SCMutexLock(&base_lock);
204  VariableName lookup = { .type = type, .id = id };
205  VariableName *found = (VariableName *)HashListTableLookup(base.ids, (void *)&lookup, 0);
206  if (found) {
207  SCLogDebug("found %s ref_cnt %u", found->name, found->ref_cnt);
208  DEBUG_VALIDATE_BUG_ON(found->ref_cnt == 0);
209  found->ref_cnt--;
210  }
211  SCMutexUnlock(&base_lock);
212 }
213 
215 {
216  int result = 0;
217  SCMutexLock(&base_lock);
218  SCLogDebug("activating new lookup store");
219 
220  VarNameStore *new_active = NULL;
221 
222  // create lookup hash for id to string, strings should point to base
223  for (HashListTableBucket *b = HashListTableGetListHead(base.names); b != NULL;
224  b = HashListTableGetListNext(b)) {
226  BUG_ON(vn == NULL);
227  SCLogDebug("base: %s/%u/%u", vn->name, vn->id, vn->ref_cnt);
228  if (vn->ref_cnt == 0)
229  continue;
230 
231  if (new_active == NULL) {
232  new_active = SCCalloc(1, sizeof(*new_active));
233  if (new_active == NULL) {
234  result = -1;
235  goto out;
236  }
237 
238  new_active->names = HashListTableInit(
239  VARNAME_HASHSIZE, VariableNameHash, VariableNameCompare, NULL);
240  if (new_active->names == NULL) {
241  SCFree(new_active);
242  result = -1;
243  goto out;
244  }
245  new_active->ids =
246  HashListTableInit(VARID_HASHSIZE, VariableIdHash, VariableIdCompare, NULL);
247  if (new_active->ids == NULL) {
248  HashListTableFree(new_active->names);
249  SCFree(new_active);
250  result = -1;
251  goto out;
252  }
253  }
254 
255  /* memory is still owned by "base" */
256  HashListTableAdd(new_active->names, (void *)vn, 0);
257  HashListTableAdd(new_active->ids, (void *)vn, 0);
258  }
259 
260  if (new_active) {
261  VarNameStore *old_active = SC_ATOMIC_GET(active);
262  if (old_active) {
263  struct timeval ts, add;
264  memset(&ts, 0, sizeof(ts));
265  memset(&add, 0, sizeof(add));
266  gettimeofday(&ts, NULL);
267  add.tv_sec = 60;
268  timeradd(&ts, &add, &ts);
269  old_active->free_after = ts;
270 
271  TAILQ_INSERT_TAIL(&free_list, old_active, next);
272  SCLogDebug("old active is stored in free list");
273  }
274 
275  SC_ATOMIC_SET(active, new_active);
276  SCLogDebug("new store active");
277 
278  struct timeval now;
279  memset(&now, 0, sizeof(now));
280  gettimeofday(&now, NULL);
281 
282  VarNameStore *s = NULL;
283  while ((s = TAILQ_FIRST(&free_list))) {
284  char timebuf[64];
285  CreateIsoTimeString(SCTIME_FROM_TIMEVAL(&s->free_after), timebuf, sizeof(timebuf));
286 
287  if (!timercmp(&now, &s->free_after, >)) {
288  SCLogDebug("not yet freeing store %p before %s", s, timebuf);
289  break;
290  }
291  SCLogDebug("freeing store %p with time %s", s, timebuf);
292  TAILQ_REMOVE(&free_list, s, next);
295  SCFree(s);
296  }
297  }
298 out:
299  SCLogDebug("activating new lookup store: complete %d", result);
300  SCMutexUnlock(&base_lock);
301  return result;
302 }
303 
304 /** \brief find name for id+type at packet time. */
305 const char *VarNameStoreLookupById(const uint32_t id, const enum VarTypes type)
306 {
307  const char *name = NULL;
308 
309  const VarNameStore *current = SC_ATOMIC_GET(active);
310  if (current) {
311  VariableName lookup = { .type = type, .id = id };
312  const VariableName *found = HashListTableLookup(current->ids, (void *)&lookup, 0);
313  if (found) {
314  return found->name;
315  }
316  }
317 
318  return name;
319 }
320 
321 /** \brief find name for id+type at packet time. */
322 uint32_t VarNameStoreLookupByName(const char *name, const enum VarTypes type)
323 {
324  const VarNameStore *current = SC_ATOMIC_GET(active);
325  if (current) {
326  VariableName lookup = { .name = (char *)name, .type = type };
327  const VariableName *found = HashListTableLookup(current->names, (void *)&lookup, 0);
328  if (found) {
329  return found->id;
330  }
331  }
332 
333  return 0;
334 }
335 
336 static uint32_t VariableNameHash(HashListTable *ht, void *buf, uint16_t buflen)
337 {
338  VariableName *vn = (VariableName *)buf;
339  uint32_t hash = StringHashDjb2((const uint8_t *)vn->name, strlen(vn->name)) + vn->type;
340  return (hash % VARNAME_HASHSIZE);
341 }
342 
343 static char VariableNameCompare(void *buf1, uint16_t len1, void *buf2, uint16_t len2)
344 {
345  VariableName *vn1 = (VariableName *)buf1;
346  VariableName *vn2 = (VariableName *)buf2;
347  return (vn1->type == vn2->type && strcmp(vn1->name, vn2->name) == 0);
348 }
349 
350 static uint32_t VariableIdHash(HashListTable *ht, void *ptr, uint16_t _unused)
351 {
352  VariableName *vn = (VariableName *)ptr;
353  uint32_t hash = vn->id << vn->type;
354  return (hash % VARID_HASHSIZE);
355 }
356 
357 static char VariableIdCompare(void *ptr1, uint16_t _unused1, void *ptr2, uint16_t _unused2)
358 {
359  VariableName *vn1 = (VariableName *)ptr1;
360  VariableName *vn2 = (VariableName *)ptr2;
361 
362  return (vn1->id == vn2->id && vn1->type == vn2->type);
363 }
364 
365 static void VariableNameFree(void *data)
366 {
367  VariableName *vn = (VariableName *)data;
368  if (vn == NULL)
369  return;
370  if (vn->name != NULL) {
371  SCFree(vn->name);
372  vn->name = NULL;
373  }
374  SCFree(vn);
375 }
HashListTableGetListData
#define HashListTableGetListData(hb)
Definition: util-hashlist.h:57
util-hash-string.h
ts
uint64_t ts
Definition: source-erf-file.c:55
VARID_HASHSIZE
#define VARID_HASHSIZE
Definition: util-var-name.c:85
VarNameStore_::ids
HashListTable * ids
Definition: util-var-name.c:69
util-hashlist.h
VarNameStore_::max_id
uint32_t max_id
Definition: util-var-name.c:70
CreateIsoTimeString
void CreateIsoTimeString(const SCTime_t ts, char *str, size_t size)
Definition: util-time.c:209
VarNameStore_
Definition: util-var-name.c:67
SC_ATOMIC_SET
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
Definition: util-atomic.h:387
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
VarNameStoreInit
void VarNameStoreInit(void)
HashListTableGetListHead
HashListTableBucket * HashListTableGetListHead(HashListTable *ht)
Definition: util-hashlist.c:295
SCMutexLock
#define SCMutexLock(mut)
Definition: threads-debug.h:117
util-var-name.h
VarNameStoreSetupLookup
const char * VarNameStoreSetupLookup(const uint32_t id, const enum VarTypes type)
Definition: util-var-name.c:188
SCMUTEX_INITIALIZER
#define SCMUTEX_INITIALIZER
Definition: threads-debug.h:121
TAILQ_INSERT_TAIL
#define TAILQ_INSERT_TAIL(head, elm, field)
Definition: queue.h:294
VarNameStoreRegister
uint32_t VarNameStoreRegister(const char *name, const enum VarTypes type)
Definition: util-var-name.c:155
HashListTableLookup
void * HashListTableLookup(HashListTable *ht, void *data, uint16_t datalen)
Definition: util-hashlist.c:253
VarNameStore_::names
HashListTable * names
Definition: util-var-name.c:68
VariableName_::ref_cnt
uint32_t ref_cnt
Definition: util-var-name.c:81
HashListTableAdd
int HashListTableAdd(HashListTable *ht, void *data, uint16_t datalen)
Definition: util-hashlist.c:122
TAILQ_ENTRY
#define TAILQ_ENTRY(type)
Definition: queue.h:239
HashListTableGetListNext
#define HashListTableGetListNext(hb)
Definition: util-hashlist.h:56
TAILQ_HEAD_INITIALIZER
#define TAILQ_HEAD_INITIALIZER(head)
Definition: queue.h:236
VarNameStoreLookupByName
uint32_t VarNameStoreLookupByName(const char *name, const enum VarTypes type)
find name for id+type at packet time.
Definition: util-var-name.c:322
HashListTableInit
HashListTable * HashListTableInit(uint32_t size, uint32_t(*Hash)(struct HashListTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
Definition: util-hashlist.c:35
TAILQ_REMOVE
#define TAILQ_REMOVE(head, elm, field)
Definition: queue.h:312
TAILQ_FIRST
#define TAILQ_FIRST(head)
Definition: queue.h:250
type
uint8_t type
Definition: decode-icmpv4.h:0
VariableName_::name
char * name
Definition: util-var-name.c:78
SCMutexUnlock
#define SCMutexUnlock(mut)
Definition: threads-debug.h:119
detect.h
SCTIME_FROM_TIMEVAL
#define SCTIME_FROM_TIMEVAL(tv)
Definition: util-time.h:79
VarNameStoreUnregister
void VarNameStoreUnregister(const uint32_t id, const enum VarTypes type)
Definition: util-var-name.c:201
VariableName
struct VariableName_ VariableName
Name2idx mapping structure for flowbits, flowvars and pktvars.
VarNameStore
struct VarNameStore_ VarNameStore
VariableName_::id
uint32_t id
Definition: util-var-name.c:80
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:300
SC_ATOMIC_DECLARE
#define SC_ATOMIC_DECLARE(type, name)
wrapper for declaring atomic variables.
Definition: util-atomic.h:281
VarNameStore_::free_after
struct timeval free_after
Definition: util-var-name.c:71
VarNameStoreDestroy
void VarNameStoreDestroy(void)
Definition: util-var-name.c:116
HashListTable_
Definition: util-hashlist.h:37
suricata-common.h
VarNameStoreLookupById
const char * VarNameStoreLookupById(const uint32_t id, const enum VarTypes type)
find name for id+type at packet time.
Definition: util-var-name.c:305
VariableName_
Name2idx mapping structure for flowbits, flowvars and pktvars.
Definition: util-var-name.c:77
HashListTableFree
void HashListTableFree(HashListTable *ht)
Definition: util-hashlist.c:88
SCStrdup
#define SCStrdup(s)
Definition: util-mem.h:56
FatalError
#define FatalError(...)
Definition: util-debug.h:502
VariableName_::type
enum VarTypes type
Definition: util-var-name.c:79
util-validate.h
SCFree
#define SCFree(p)
Definition: util-mem.h:61
HashListTableBucket_
Definition: util-hashlist.h:28
SC_ATOMIC_INITPTR
#define SC_ATOMIC_INITPTR(name)
Definition: util-atomic.h:318
VarNameStorePtr
VarNameStore * VarNameStorePtr
Definition: util-var-name.c:74
TAILQ_HEAD
#define TAILQ_HEAD(name, type)
Definition: queue.h:230
VarTypes
VarTypes
Definition: util-var.h:27
timeradd
#define timeradd(a, b, r)
Definition: util-time.h:128
likely
#define likely(expr)
Definition: util-optimize.h:32
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:376
VARNAME_HASHSIZE
#define VARNAME_HASHSIZE
Definition: util-var-name.c:84
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
SCMutex
#define SCMutex
Definition: threads-debug.h:114
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:104
VarNameStoreActivate
int VarNameStoreActivate(void)
Definition: util-var-name.c:214
StringHashDjb2
uint32_t StringHashDjb2(const uint8_t *data, uint32_t datalen)
Definition: util-hash-string.c:22