Detect: create per sgh non-MPM rule array

Array of rule id's that are not using MPM prefiltering. These will be
merged with the MPM results array. Together these should lead to a
list of all the rules that can possibly match.

diff --git a/src/detect-engine-siggroup.c b/src/detect-engine-siggroup.c
index 9c41831e07b71c1a40df31bfb631acda42b5d9fc..3dc16d46b4022276d394ae9a62386e8373fb599b 100644 (file)
--- a/src/detect-engine-siggroup.c
+++ b/src/detect-engine-siggroup.c
@@ -205,6 +205,12 @@ void SigGroupHeadFree(SigGroupHead *sgh)
         sgh->match_array = NULL;
     }
 
+    if (sgh->non_mpm_id_array != NULL) {
+        SCFree(sgh->non_mpm_id_array);
+        sgh->non_mpm_id_array = NULL;
+        sgh->non_mpm_id_cnt = 0;
+    }
+
     sgh->sig_cnt = 0;
 
     if (sgh->init != NULL) {
@@ -1696,6 +1702,49 @@ void SigGroupHeadSetFilestoreCount(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
     return;
 }
 
+/* build an array of rule id's for sigs with no mpm */
+int SigGroupHeadBuildNonMpmArray(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
+{
+    Signature *s = NULL;
+    uint32_t sig = 0;
+    uint32_t non_mpm = 0;
+
+    if (sgh == NULL)
+        return 0;
+
+    BUG_ON(sgh->non_mpm_id_array != NULL);
+
+    for (sig = 0; sig < sgh->sig_cnt; sig++) {
+        s = sgh->match_array[sig];
+        if (s == NULL)
+            continue;
+
+        if (s->mpm_sm == NULL)
+            non_mpm++;
+    }
+
+    if (non_mpm == 0) {
+        sgh->non_mpm_id_array = NULL;
+        return 0;
+    }
+
+    sgh->non_mpm_id_array = SCMalloc(non_mpm * sizeof(uint32_t));
+    BUG_ON(sgh->non_mpm_id_array == NULL);
+    memset(sgh->non_mpm_id_array, 0, non_mpm * sizeof(uint32_t));
+
+    for (sig = 0; sig < sgh->sig_cnt; sig++) {
+        s = sgh->match_array[sig];
+        if (s == NULL)
+            continue;
+        if (s->mpm_sm != NULL)
+            continue;
+
+        BUG_ON(sgh->non_mpm_id_cnt >= non_mpm);
+        sgh->non_mpm_id_array[sgh->non_mpm_id_cnt++] = s->num;
+    }
+    return 0;
+}
+
 int SigGroupHeadBuildHeadArray(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
 {
     Signature *s = NULL;

diff --git a/src/detect-engine-siggroup.h b/src/detect-engine-siggroup.h
index ff44aaf2886f91da425e745f829e03de7a6711fb..a9368ee19f89784f8e5bfbbcfc4092c04c7059de 100644 (file)
--- a/src/detect-engine-siggroup.h
+++ b/src/detect-engine-siggroup.h
@@ -91,4 +91,6 @@ void SigGroupHeadSetFilestoreCount(DetectEngineCtx *, SigGroupHead *);
 void SigGroupHeadSetFileMd5Flag(DetectEngineCtx *, SigGroupHead *);
 void SigGroupHeadSetFilesizeFlag(DetectEngineCtx *, SigGroupHead *);
 
+int SigGroupHeadBuildNonMpmArray(DetectEngineCtx *de_ctx, SigGroupHead *sgh);
+
 #endif /* __DETECT_ENGINE_SIGGROUP_H__ */

diff --git a/src/detect.c b/src/detect.c
index 9dd4b4e444f5bc4837374ce73990b599e7fab346..3082cad4beb5d5eaf68c6463f2002fa099af73f8 100644 (file)
--- a/src/detect.c
+++ b/src/detect.c
@@ -4013,6 +4013,8 @@ int SigAddressPrepareStage4(DetectEngineCtx *de_ctx)
         SigGroupHeadSetFilesizeFlag(de_ctx, sgh);
         SigGroupHeadSetFilestoreCount(de_ctx, sgh);
         SCLogDebug("filestore count %u", sgh->filestore_cnt);
+
+        SigGroupHeadBuildNonMpmArray(de_ctx, sgh);
     }
 
     if (de_ctx->decoder_event_sgh != NULL) {

diff --git a/src/detect.h b/src/detect.h
index 04ea0d8b0167b53b93e62389f89862f471270ac0..c5a8de180536049243db8bcfebb3d9e41adae8f7 100644 (file)
--- a/src/detect.h
+++ b/src/detect.h
@@ -975,6 +975,9 @@ typedef struct SigGroupHead_ {
      *  signatures to be inspected in a cache efficient way. */
     SignatureHeader *head_array;
 
+    uint32_t *non_mpm_id_array;
+    uint32_t non_mpm_id_cnt; // size is cnt * sizeof(uint32_t)
+
     /* pattern matcher instances */
     MpmCtx *mpm_proto_other_ctx;