From: Victor Julien Date: Thu, 16 Jul 2015 09:22:04 +0000 (+0200) Subject: detect: optimize Signature layout X-Git-Tag: suricata-3.0RC1~244 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a0899cbe85a5aa33863891f345feebcf7e37b0ac;p=thirdparty%2Fsuricata.git detect: optimize Signature layout --- diff --git a/src/detect.h b/src/detect.h index d8d884751a..223b6d31a4 100644 --- a/src/detect.h +++ b/src/detect.h @@ -384,40 +384,44 @@ typedef struct Signature_ { uint8_t action; uint8_t file_flags; + /** addresses, ports and proto this sig matches on */ + DetectProto proto; + + /** classification id **/ + uint8_t class; + /** ipv4 match arrays */ uint16_t addr_dst_match4_cnt; uint16_t addr_src_match4_cnt; + uint16_t addr_dst_match6_cnt; + uint16_t addr_src_match6_cnt; DetectMatchAddressIPv4 *addr_dst_match4; DetectMatchAddressIPv4 *addr_src_match4; /** ipv6 match arrays */ DetectMatchAddressIPv6 *addr_dst_match6; DetectMatchAddressIPv6 *addr_src_match6; - uint16_t addr_dst_match6_cnt; - uint16_t addr_src_match6_cnt; uint32_t id; /**< sid, set by the 'sid' rule keyword */ + uint32_t gid; /**< generator id */ + uint32_t rev; + int prio; + /** port settings for this signature */ DetectPort *sp, *dp; - /** addresses, ports and proto this sig matches on */ - DetectProto proto; - - /** classification id **/ - uint8_t class; - #ifdef PROFILING uint16_t profiling_id; #endif + /** number of sigmatches in the match and pmatch list */ + uint16_t sm_cnt; - uint32_t gid; /**< generator id */ + /* used to hold flags that are predominantly used during init */ + uint32_t init_flags; + /* coccinelle: Signature:init_flags:SIG_FLAG_INIT_ */ /** netblocks and hosts specified at the sid, in CIDR format */ IPOnlyCIDRItem *CidrSrc, *CidrDst; - uint32_t rev; - - int prio; - /* Hold copies of the sm lists for Match() */ SigMatchData *sm_arrays[DETECT_SM_LIST_MAX]; @@ -438,12 +442,6 @@ typedef struct Signature_ { /** address settings for this signature */ DetectAddressHead src, dst; - /* used to hold flags that are predominantly used during init */ - uint32_t init_flags; - /* coccinelle: Signature:init_flags:SIG_FLAG_INIT_ */ - - /** number of sigmatches in the match and pmatch list */ - uint16_t sm_cnt; /* used at init to determine max dsize */ SigMatch *dsize_sm; /* the fast pattern added from this signature */ @@ -452,12 +450,12 @@ typedef struct Signature_ { uint16_t mpm_content_maxlen; uint16_t mpm_uricontent_maxlen; + int list; + /* Be careful, this pointer is only valid while parsing the sig, * to warn the user about any possible problem */ char *sig_str; - int list; - /** ptr to the next sig in the list */ struct Signature_ *next; } Signature;