fix for #564.

Get rid of the hash table, and use a single-one_time_alloc'ed array for
pattern id assignment.

diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c
index aacb7c55f752a0af7240fb77d36bf4239b90f0d0..a6f5f4b969d3131b032a7de569b3e2179934ccb6 100644 (file)
--- a/src/detect-engine-mpm.c
+++ b/src/detect-engine-mpm.c
@@ -3345,3 +3345,73 @@ uint32_t DetectPatternGetIdV2(MpmPatternIdStore *ht, void *ctx, Signature *s, ui
 
     SCReturnUInt(id);
 }
+
+void DetectFigureFPAndId(DetectEngineCtx *de_ctx)
+{
+    typedef struct DetectFigureFPAndId_t_ {
+        PatIntId id;
+        uint16_t content_len;
+        uint32_t flags;
+        int sm_list;
+
+        uint8_t *content;
+    } DetectFigureFPAndId_t;
+
+    uint32_t struct_total_size = 0;
+    uint32_t content_total_size = 0;
+    Signature *s = NULL;
+
+    for (s = de_ctx->sig_list; s != NULL; s = s->next) {
+        s->mpm_sm = RetrieveFPForSigV2(s);
+        if (s->mpm_sm != NULL) {
+            DetectContentData *cd = (DetectContentData *)s->mpm_sm->ctx;
+            struct_total_size += sizeof(DetectFigureFPAndId_t);
+            content_total_size += cd->content_len;
+        }
+    }
+
+    /* array hash buffer - i've run out of ideas to name it */
+    uint8_t *ahb = SCMalloc(sizeof(uint8_t) * (struct_total_size + content_total_size));
+    if (ahb == NULL)
+        exit(EXIT_FAILURE);
+
+    PatIntId max_id = 0;
+    DetectFigureFPAndId_t *struct_offset = (DetectFigureFPAndId_t *)ahb;
+    uint8_t *content_offset = ahb + struct_total_size;
+    for (s = de_ctx->sig_list; s != NULL; s = s->next) {
+        if (s->mpm_sm != NULL) {
+            int sm_list = SigMatchListSMBelongsTo(s, s->mpm_sm);
+            BUG_ON(sm_list == -1);
+            DetectContentData *cd = (DetectContentData *)s->mpm_sm->ctx;
+            DetectFigureFPAndId_t *dup = (DetectFigureFPAndId_t *)ahb;
+            for (; dup != struct_offset; dup++) {
+                if (dup->content_len != cd->content_len ||
+                    dup->sm_list != sm_list ||
+                    SCMemcmp(dup->content, cd->content, dup->content_len) != 0) {
+                    continue;
+                }
+
+                break;
+            }
+            if (dup != struct_offset) {
+                cd->id = dup->id;
+                continue;
+            }
+
+            struct_offset->id = max_id++;
+            cd->id = struct_offset->id;
+            struct_offset->content_len = cd->content_len;
+            struct_offset->sm_list = sm_list;
+            struct_offset->content = content_offset;
+            content_offset += cd->content_len;
+            memcpy(struct_offset->content, cd->content, cd->content_len);
+
+            struct_offset++;
+        } /* if (s->mpm_sm != NULL) */
+    } /* for */
+
+    de_ctx->max_fp_id = max_id;
+
+    SCFree(ahb);
+    return;
+}

diff --git a/src/detect-engine-mpm.h b/src/detect-engine-mpm.h
index 7480e8cc25ea4f297d05e1122f24378e3550bbb7..75328972ebf5cac3c3ed5443911c72770027d627 100644 (file)
--- a/src/detect-engine-mpm.h
+++ b/src/detect-engine-mpm.h
@@ -85,5 +85,7 @@ int SignatureHasStreamContent(Signature *);
 SigMatch *RetrieveFPForSig(Signature *s);
 SigMatch *RetrieveFPForSigV2(Signature *s);
 
+void DetectFigureFPAndId(DetectEngineCtx *de_ctx);
+
 #endif /* __DETECT_ENGINE_MPM_H__ */
 

diff --git a/src/detect.c b/src/detect.c
index 751462688ea8bf6f7ee793573e71c2ccaac0a1a9..c5eed62f28e55ed84e9899bbf1b7b634e96cd7f6 100644 (file)
--- a/src/detect.c
+++ b/src/detect.c
@@ -4383,15 +4383,7 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) {
  */
 int SigGroupBuild(DetectEngineCtx *de_ctx)
 {
-    Signature *s = NULL;
-    for (s = de_ctx->sig_list; s != NULL; s = s->next) {
-        s->mpm_sm = RetrieveFPForSigV2(s);
-        if (s->mpm_sm != NULL) {
-            DetectContentData *cd = (DetectContentData *)s->mpm_sm->ctx;
-            cd->id = DetectPatternGetIdV2(de_ctx->mpm_pattern_id_store, cd, s, SigMatchListSMBelongsTo(s, s->mpm_sm));
-        }
-    }
-    de_ctx->max_fp_id = de_ctx->mpm_pattern_id_store->max_id;
+    DetectFigureFPAndId(de_ctx);
 
     /* if we are using single sgh_mpm_context then let us init the standard mpm
      * contexts using the mpm_ctx factory */