This repository has been archived on 2025-09-14. You can view files and clone it, but cannot push or open issues or pull requests.
Files
tango-maat/src/maat_expr.cpp

764 lines
22 KiB
C++
Raw Normal View History

2023-01-30 21:59:35 +08:00
/*
**********************************************************************************************
* File: maat_expr.cpp
* Description:
* Authors: Liu WenTan <liuwentan@geedgenetworks.com>
* Date: 2022-10-31
* Copyright: (c) 2018-2022 Geedge Networks, Inc. All rights reserved.
***********************************************************************************************
*/
#include <string.h>
#include <assert.h>
#include "maat_expr.h"
#include "adapter_hs.h"
#include "maat_utils.h"
#include "maat_kv.h"
#include "maat_limits.h"
#include "rcu_hash.h"
#include "maat_rule.h"
2023-01-31 20:39:53 +08:00
#include "maat_compile.h"
2023-02-03 17:28:14 +08:00
#include "maat_group.h"
#include "alignment.h"
2023-01-30 21:59:35 +08:00
#include "maat_garbage_collection.h"
#define MAX_DISTRICT_STR 128
#define MODULE_EXPR module_name_str("maat.expr")
struct expr_schema {
int item_id_column;
int group_id_column;
int district_column;
int keywords_column;
int expr_type_column;
int match_method_column;
int is_hexbin_column;
enum hs_scan_mode scan_mode; /* adapter_hs scan mode */
2023-01-31 20:39:53 +08:00
int table_id; //ugly
2023-02-03 17:28:14 +08:00
struct table_manager *ref_tbl_mgr;
2023-01-30 21:59:35 +08:00
};
enum expr_type {
EXPR_TYPE_STRING = 0,
EXPR_TYPE_AND,
EXPR_TYPE_REGEX,
EXPR_TYPE_MAX
};
enum match_method {
MATCH_METHOD_SUB = 0,
MATCH_METHOD_RIGHT,
MATCH_METHOD_LEFT,
MATCH_METHOD_COMPLETE,
MATCH_METHOD_MAX
};
struct expr_item {
int item_id;
int group_id;
2023-02-03 17:28:14 +08:00
int district_id;
2023-01-30 21:59:35 +08:00
char keywords[MAX_KEYWORDS_STR];
enum expr_type expr_type;
enum match_method match_method;
int is_hexbin;
int is_case_sensitive;
};
struct expr_runtime {
enum hs_scan_mode scan_mode;
struct adapter_hs *hs;
struct adapter_hs_stream *hs_stream;
struct rcu_hash_table *htable;
struct group2group_runtime *ref_g2g_rt;
uint32_t rule_num;
uint32_t updating_rule_num;
struct maat_item *item_hash;
void (*item_user_data_free)(void *);
2023-01-31 20:39:53 +08:00
int n_worker_thread;
2023-01-30 21:59:35 +08:00
struct maat_garbage_bin *ref_garbage_bin;
struct log_handle *logger;
2023-02-03 17:28:14 +08:00
long long *scan_cnt;
long long *hit_cnt;
2023-01-30 21:59:35 +08:00
// long long *stream_num;
};
enum expr_type int_to_expr_type(int expr_type)
{
enum expr_type type = EXPR_TYPE_MAX;
switch (expr_type) {
case 0:
type = EXPR_TYPE_STRING;
break;
case 1:
type = EXPR_TYPE_AND;
break;
case 2:
type = EXPR_TYPE_REGEX;
break;
default:
break;
}
return type;
}
enum match_method int_to_match_method_type(int match_method_type)
{
enum match_method type = MATCH_METHOD_MAX;
switch (match_method_type) {
case 0:
type = MATCH_METHOD_SUB;
break;
case 1:
type = MATCH_METHOD_RIGHT;
break;
case 2:
type = MATCH_METHOD_LEFT;
break;
case 3:
type = MATCH_METHOD_COMPLETE;
break;
default:
break;
}
return type;
}
struct expr_item *expr_item_new(const char *line, struct expr_schema *expr_schema,
struct log_handle *logger)
{
size_t column_offset = 0;
size_t column_len = 0;
int db_hexbin = -1;
int expr_type = -1;
int match_method_type = -1;
2023-02-03 17:28:14 +08:00
enum table_type table_type = TABLE_TYPE_INVALID;
2023-01-30 21:59:35 +08:00
struct expr_item *expr_item = ALLOC(struct expr_item, 1);
int ret = get_column_pos(line, expr_schema->item_id_column, &column_offset, &column_len);
if (ret < 0) {
2023-02-03 17:28:14 +08:00
log_error(logger, MODULE_EXPR,
"expr table(table_id:%d) line:%s has no item_id",
2023-01-31 20:39:53 +08:00
expr_schema->table_id, line);
2023-01-30 21:59:35 +08:00
goto error;
}
expr_item->item_id = atoi(line + column_offset);
ret = get_column_pos(line, expr_schema->group_id_column, &column_offset, &column_len);
if (ret < 0) {
2023-02-03 17:28:14 +08:00
log_error(logger, MODULE_EXPR,
"expr table(table_id:%d) line:%s has no group_id",
2023-01-31 20:39:53 +08:00
expr_schema->table_id, line);
2023-01-30 21:59:35 +08:00
goto error;
}
expr_item->group_id = atoi(line + column_offset);
2023-02-03 17:28:14 +08:00
table_type = table_manager_get_table_type(expr_schema->tbl_mgr, expr_schema->table_id);
if (table_type == TABLE_TYPE_EXPR_PLUS) {
2023-01-30 21:59:35 +08:00
ret = get_column_pos(line, expr_schema->district_column, &column_offset, &column_len);
if (ret < 0) {
2023-02-03 17:28:14 +08:00
goto error;
2023-01-30 21:59:35 +08:00
}
if (column_len >= MAX_DISTRICT_STR) {
log_error(logger, MODULE_EXPR,
2023-02-03 17:28:14 +08:00
"expr table(table_id:%d) line:%s district length too long",
expr_schema->table_id, line);
goto error;
2023-01-30 21:59:35 +08:00
}
2023-02-03 17:28:14 +08:00
char district[MAX_DISTRICT_STR] = {0};
memcpy(district, (line + column_offset), column_len);
assert(strlen(district) > 0);
str_unescape(district);
2023-02-06 08:14:25 +08:00
expr_item->district_id = table_manager_get_district_id(expr_schema->ref_tbl_mgr, district);
2023-01-30 21:59:35 +08:00
}
2023-02-06 08:14:25 +08:00
2023-01-30 21:59:35 +08:00
ret = get_column_pos(line, expr_schema->keywords_column, &column_offset, &column_len);
if (ret < 0) {
2023-02-03 17:28:14 +08:00
log_error(logger, MODULE_EXPR,
"expr table(table_id:%d) line:%s has no keywords",
2023-01-31 20:39:53 +08:00
expr_schema->table_id, line);
2023-01-30 21:59:35 +08:00
goto error;
}
if (column_len >= MAX_KEYWORDS_STR) {
log_error(logger, MODULE_EXPR,
2023-01-31 20:39:53 +08:00
"expr table(table_id:%d) line:%s keywords length too long",
expr_schema->table_id, line);
2023-01-30 21:59:35 +08:00
goto error;
}
memcpy(expr_item->keywords, (line + column_offset), column_len);
ret = get_column_pos(line, expr_schema->expr_type_column, &column_offset, &column_len);
if (ret < 0) {
2023-02-03 17:28:14 +08:00
log_error(logger, MODULE_EXPR,
"expr table(table_id:%d) line:%s has no expr_type",
2023-01-31 20:39:53 +08:00
expr_schema->table_id, line);
2023-01-30 21:59:35 +08:00
goto error;
}
expr_type = atoi(line + column_offset);
expr_item->expr_type = int_to_expr_type(expr_type);
ret = get_column_pos(line, expr_schema->match_method_column, &column_offset, &column_len);
if (ret < 0) {
2023-02-03 17:28:14 +08:00
log_error(logger, MODULE_EXPR,
"expr table(table_id:%d) line:%s has no match_method",
2023-01-31 20:39:53 +08:00
expr_schema->table_id, line);
2023-01-30 21:59:35 +08:00
goto error;
}
match_method_type = atoi(line + column_offset);
expr_item->match_method = int_to_match_method_type(match_method_type);
ret = get_column_pos(line, expr_schema->is_hexbin_column, &column_offset, &column_len);
if (ret < 0) {
2023-02-03 17:28:14 +08:00
log_error(logger, MODULE_EXPR,
"expr table(table_id:%d) line:%s has no is_hexbin",
2023-01-31 20:39:53 +08:00
expr_schema->table_id, line);
2023-01-30 21:59:35 +08:00
goto error;
}
db_hexbin = atoi(line + column_offset);
switch (db_hexbin) {
case 0:
expr_item->is_hexbin = FALSE;
expr_item->is_case_sensitive = FALSE;
break;
case 1:
expr_item->is_hexbin = TRUE;
expr_item->is_case_sensitive = TRUE;
break;
case 2:
expr_item->is_hexbin = FALSE;
expr_item->is_case_sensitive = TRUE;
break;
default:
log_error(logger, MODULE_EXPR,
2023-01-31 20:39:53 +08:00
"expr table(table_id:%d) line:%s has invalid hexbin value:%d",
expr_schema->table_id, line, db_hexbin);
2023-01-30 21:59:35 +08:00
goto error;
}
return expr_item;
error:
FREE(expr_item);
return NULL;
}
void expr_item_free(struct expr_item *expr_item)
{
FREE(expr_item);
}
2023-02-03 17:28:14 +08:00
void *expr_schema_new(cJSON *json, struct table_manager *tbl_mgr,
const char *table_name, struct log_handle *logger)
2023-01-30 21:59:35 +08:00
{
int read_cnt = 0;
struct expr_schema *expr_schema = ALLOC(struct expr_schema, 1);
struct maat_kv_store *scan_mode_map = maat_kv_store_new();
maat_kv_register(scan_mode_map, "block", HS_SCAN_MODE_BLOCK);
maat_kv_register(scan_mode_map, "stream", HS_SCAN_MODE_STREAM);
int ret = -1;
cJSON *custom_item = NULL;
2023-01-31 20:39:53 +08:00
cJSON *item = cJSON_GetObjectItem(json, "table_id");
if (item != NULL && item->type == cJSON_Number) {
expr_schema->table_id = item->valueint;
read_cnt++;
}
item = cJSON_GetObjectItem(json, "custom");
2023-01-30 21:59:35 +08:00
if (item == NULL || item->type != cJSON_Object) {
2023-02-03 17:28:14 +08:00
log_error(logger, MODULE_EXPR,
"table %s has no custom column", table_name);
2023-01-30 21:59:35 +08:00
goto error;
}
custom_item = cJSON_GetObjectItem(item, "scan_mode");
if (custom_item != NULL && custom_item->type == cJSON_String) {
2023-02-03 17:28:14 +08:00
ret = maat_kv_read(scan_mode_map, custom_item->valuestring,
(int*)&(expr_schema->scan_mode));
2023-01-30 21:59:35 +08:00
if (ret < 0) {
2023-02-03 17:28:14 +08:00
log_error(logger, MODULE_EXPR, "scan_mode %s illegal",
custom_item->valuestring);
2023-01-30 21:59:35 +08:00
goto error;
}
read_cnt++;
}
custom_item = cJSON_GetObjectItem(item, "item_id");
if (custom_item != NULL && custom_item->type == cJSON_Number) {
expr_schema->item_id_column = custom_item->valueint;
read_cnt++;
}
custom_item = cJSON_GetObjectItem(item, "group_id");
if (custom_item != NULL && custom_item->type == cJSON_Number) {
expr_schema->group_id_column = custom_item->valueint;
read_cnt++;
}
custom_item = cJSON_GetObjectItem(item, "keywords");
if (custom_item != NULL && custom_item->type == cJSON_Number) {
expr_schema->keywords_column = custom_item->valueint;
read_cnt++;
}
custom_item = cJSON_GetObjectItem(item, "district");
if (custom_item != NULL && custom_item->type == cJSON_Number) {
expr_schema->district_column = custom_item->valueint;
read_cnt++;
}
custom_item = cJSON_GetObjectItem(item, "expr_type");
if (custom_item != NULL && custom_item->type == cJSON_Number) {
expr_schema->expr_type_column = custom_item->valueint;
read_cnt++;
}
custom_item = cJSON_GetObjectItem(item, "match_method");
if (custom_item != NULL && custom_item->type == cJSON_Number) {
expr_schema->match_method_column = custom_item->valueint;
read_cnt++;
}
custom_item = cJSON_GetObjectItem(item, "is_hexbin");
if (custom_item != NULL && custom_item->type == cJSON_Number) {
expr_schema->is_hexbin_column = custom_item->valueint;
read_cnt++;
}
2023-02-03 17:28:14 +08:00
expr_schema->tbl_mgr = tbl_mgr;
2023-01-30 21:59:35 +08:00
if (read_cnt < 8) {
goto error;
}
maat_kv_store_free(scan_mode_map);
return expr_schema;
error:
maat_kv_store_free(scan_mode_map);
FREE(expr_schema);
return NULL;
}
void expr_schema_free(void *expr_schema)
{
FREE(expr_schema);
}
2023-01-31 20:39:53 +08:00
void expr_rule_free(and_expr_t *expr_rule)
{
if (NULL == expr_rule) {
return;
}
for (size_t i = 0; i < expr_rule->n_patterns; i++) {
FREE(expr_rule->patterns[i].pat);
}
FREE(expr_rule);
}
void expr_ex_data_free(void *user_ctx, void *data)
{
and_expr_t *expr_rule = (and_expr_t *)data;
expr_rule_free(expr_rule);
}
2023-02-03 17:28:14 +08:00
void *expr_runtime_new(void *expr_schema, int max_thread_num,
struct maat_garbage_bin *garbage_bin,
2023-01-30 21:59:35 +08:00
struct log_handle *logger)
{
if (NULL == expr_schema) {
return NULL;
}
struct expr_schema *schema = (struct expr_schema *)expr_schema;
struct expr_runtime *expr_rt = ALLOC(struct expr_runtime, 1);
expr_rt->htable = rcu_hash_new(expr_ex_data_free);
expr_rt->scan_mode = schema->scan_mode;
expr_rt->item_user_data_free = maat_item_inner_free;
2023-01-31 20:39:53 +08:00
expr_rt->n_worker_thread = max_thread_num;
2023-01-30 21:59:35 +08:00
expr_rt->ref_garbage_bin = garbage_bin;
expr_rt->logger = logger;
2023-02-03 17:28:14 +08:00
expr_rt->hit_cnt = alignment_int64_array_alloc(max_thread_num);
expr_rt->scan_cnt = alignment_int64_array_alloc(max_thread_num);
2023-01-30 21:59:35 +08:00
return expr_rt;
}
void expr_runtime_free(void *expr_runtime)
{
if (NULL == expr_runtime) {
return;
}
struct expr_runtime *expr_rt = (struct expr_runtime *)expr_runtime;
if (expr_rt->hs != NULL) {
adapter_hs_destroy(expr_rt->hs);
expr_rt->hs = NULL;
}
if (expr_rt->hs_stream != NULL) {
adapter_hs_stream_close(expr_rt->hs_stream);
expr_rt->hs_stream = NULL;
}
if (expr_rt->htable != NULL) {
rcu_hash_free(expr_rt->htable);
expr_rt->htable = NULL;
}
struct maat_item *item = NULL, *tmp = NULL;
HASH_ITER(hh, expr_rt->item_hash, item, tmp) {
HASH_DELETE(hh, expr_rt->item_hash, item);
maat_item_free(item, expr_rt->item_user_data_free);
}
2023-02-03 17:28:14 +08:00
if (expr_rt->hit_cnt != NULL) {
alignment_int64_array_free(expr_rt->hit_cnt);
expr_rt->hit_cnt = NULL;
}
if (expr_rt->scan_cnt != NULL) {
alignment_int64_array_free(expr_rt->scan_cnt);
expr_rt->scan_cnt = NULL;
}
2023-01-30 21:59:35 +08:00
FREE(expr_rt);
}
2023-02-03 17:28:14 +08:00
int expr_runtime_update_row(struct expr_runtime *expr_rt, char *key,
size_t key_len, and_expr_t *expr_rule,
int is_valid, struct log_handle *logger)
2023-01-30 21:59:35 +08:00
{
void *data = NULL;
if (0 == is_valid) {
//delete
data = rcu_hash_find(expr_rt->htable, key, key_len);
if (NULL == data) {
log_error(logger, MODULE_EXPR,
2023-02-03 17:28:14 +08:00
"the key of expr rule not exist, can't be deleted, expr_id:%d",
expr_rule->expr_id);
2023-01-30 21:59:35 +08:00
return -1;
}
rcu_hash_del(expr_rt->htable, key, key_len);
} else {
//add
data = rcu_hash_find(expr_rt->htable, key, key_len);
if (data != NULL) {
log_error(logger, MODULE_EXPR,
2023-02-03 17:28:14 +08:00
"the key of expr rule already exist, can't be added, expr_id:%d",
expr_rule->expr_id);
2023-01-30 21:59:35 +08:00
return -1;
}
rcu_hash_add(expr_rt->htable, key, key_len, (void *)expr_rule);
}
return 0;
}
2023-01-31 20:39:53 +08:00
enum pattern_type expr_type2pattern_type(enum expr_type expr_type)
{
enum pattern_type pattern_type = PATTERN_TYPE_STR;
switch (expr_type) {
case EXPR_TYPE_STRING:
case EXPR_TYPE_AND:
break;
case EXPR_TYPE_REGEX:
pattern_type = PATTERN_TYPE_REG;
break;
default:
break;
}
return pattern_type;
}
#define MAAT_MAX_EXPR_ITEM_NUM 8
2023-02-03 17:28:14 +08:00
and_expr_t *expr_item_to_expr_rule(struct expr_item *expr_item,
struct log_handle *logger)
2023-01-30 21:59:35 +08:00
{
size_t i = 0;
size_t sub_expr_cnt = 0;
char *pos = NULL;
char *saveptr = NULL;
char *sub_key_array[MAAT_MAX_EXPR_ITEM_NUM];
and_expr_t *expr_rule = ALLOC(and_expr_t, 1);
switch (expr_item->expr_type) {
case EXPR_TYPE_AND:
case EXPR_TYPE_REGEX:
for (i = 0, pos = expr_item->keywords; ; i++, pos = NULL) {
char *tmp = strtok_r_esc(pos, '&', &saveptr);
if (NULL == tmp) {
break;
}
if (i >= MAAT_MAX_EXPR_ITEM_NUM) {
2023-01-31 20:39:53 +08:00
log_error(logger, MODULE_EXPR,
2023-02-03 17:28:14 +08:00
"expr item_id:%d too many patterns",
expr_item->item_id);
2023-01-30 21:59:35 +08:00
return NULL;
}
sub_key_array[i] = tmp;
if (expr_item->expr_type == EXPR_TYPE_REGEX) {
sub_key_array[i] = str_unescape_and(sub_key_array[i]);
} else {
sub_key_array[i] = str_unescape(sub_key_array[i]);
}
}
sub_expr_cnt = i;
break;
case EXPR_TYPE_STRING:
sub_expr_cnt = 1;
sub_key_array[0] = expr_item->keywords;
sub_key_array[0] = str_unescape(sub_key_array[0]);
break;
default:
break;
}
for (i = 0; i < sub_expr_cnt; i++) {
expr_rule->expr_id = expr_item->item_id;
expr_rule->patterns[i].pat = ALLOC(char, strlen(sub_key_array[i]));
memcpy(expr_rule->patterns[i].pat, sub_key_array[i], strlen(sub_key_array[i]));
expr_rule->patterns[i].pat_len = strlen(sub_key_array[i]);
expr_rule->patterns[i].type = expr_type2pattern_type(expr_item->expr_type);
}
2023-02-06 08:14:25 +08:00
int *district_tag = ALLOC(int, 1);
*district_tag = expr_item->district_id;
expr_rule->user_tag = district_tag;
2023-01-30 21:59:35 +08:00
expr_rule->n_patterns = sub_expr_cnt;
return expr_rule;
}
2023-02-03 17:28:14 +08:00
int expr_runtime_update(void *expr_runtime, void *expr_schema,
const char *line, int valid_column)
2023-01-30 21:59:35 +08:00
{
if (NULL == expr_runtime || NULL == expr_schema) {
return -1;
}
int ret = -1;
struct maat_item_inner *u_para = NULL;
struct maat_item *item = NULL;
and_expr_t *expr_rule = NULL;
struct expr_schema *schema = (struct expr_schema *)expr_schema;
struct expr_runtime *expr_rt = (struct expr_runtime *)expr_runtime;
int item_id = get_column_value(line, schema->item_id_column);
int is_valid = get_column_value(line, valid_column);
if (is_valid < 0) {
return -1;
} else if (0 == is_valid) {
//delete
HASH_FIND_INT(expr_rt->item_hash, &item_id, item);
if (NULL == item) {
return -1;
}
u_para = (struct maat_item_inner *)item->user_data;
item->user_data = NULL;
if (NULL == u_para) {
return -1;
}
HASH_DELETE(hh, expr_rt->item_hash, item);
2023-01-31 20:39:53 +08:00
maat_garbage_bagging(expr_rt->ref_garbage_bin, u_para, maat_item_inner_free);
2023-01-30 21:59:35 +08:00
} else {
//add
HASH_FIND_INT(expr_rt->item_hash, &item_id, item);
if (item) {
log_error(expr_rt->logger, MODULE_EXPR,
2023-02-03 17:28:14 +08:00
"expr runtime add item %d to item_hash failed, already exist",
item_id);
2023-01-30 21:59:35 +08:00
return -1;
}
struct expr_item *expr_item = expr_item_new(line, schema, expr_rt->logger);
if (NULL == expr_item) {
return -1;
}
2023-02-06 08:14:25 +08:00
u_para = maat_item_inner_new(expr_item->group_id, item_id, expr_item->district_id);
2023-01-31 20:39:53 +08:00
item = maat_item_new(item_id, expr_item->group_id, u_para);
2023-01-30 21:59:35 +08:00
HASH_ADD_INT(expr_rt->item_hash, item_id, item);
expr_rule = expr_item_to_expr_rule(expr_item, expr_rt->logger);
expr_item_free(expr_item);
if (NULL == expr_rule) {
2023-02-03 17:28:14 +08:00
log_error(expr_rt->logger, MODULE_EXPR,
"transform expr table(table_id:%d) item to expr_rule failed, item_id:%d",
2023-01-31 20:39:53 +08:00
schema->table_id, item_id);
2023-01-30 21:59:35 +08:00
return -1;
}
}
char *key = (char *)&item_id;
2023-02-03 17:28:14 +08:00
ret = expr_runtime_update_row(expr_rt, key, sizeof(int), expr_rule,
is_valid, expr_rt->logger);
2023-01-30 21:59:35 +08:00
if (ret < 0) {
if (expr_rule != NULL) {
expr_rule_free(expr_rule);
}
return -1;
} else {
if (0 == is_valid) {
expr_rt->rule_num--;
} else {
expr_rt->rule_num++;
}
}
return 0;
}
int expr_runtime_commit(void *expr_runtime)
{
if (NULL == expr_runtime) {
return -1;
}
int ret = 0;
struct expr_runtime *expr_rt = (struct expr_runtime *)expr_runtime;
void **ex_data_array = NULL;
size_t rule_cnt = rcu_hash_list_updating_data(expr_rt->htable, &ex_data_array);
if (0 == rule_cnt) {
FREE(ex_data_array);
return 0;
}
and_expr_t *rules = ALLOC(and_expr_t, rule_cnt);
for (size_t i = 0; i < rule_cnt; i++) {
rules[i] = *(and_expr_t *)ex_data_array[i];
}
struct adapter_hs *new_adapter_hs = NULL;
struct adapter_hs *old_adapter_hs = NULL;
log_info(expr_rt->logger, MODULE_EXPR,
2023-02-03 17:28:14 +08:00
"committing %zu expr rules for rebuilding adapter_hs engine",
rule_cnt);
new_adapter_hs = adapter_hs_initialize(expr_rt->scan_mode,
expr_rt->n_worker_thread,
rules, rule_cnt,
expr_rt->logger);
2023-01-30 21:59:35 +08:00
if (NULL == new_adapter_hs) {
log_error(expr_rt->logger, MODULE_EXPR,
2023-02-03 17:28:14 +08:00
"rebuild adapter_hs engine failed when update %zu expr rules",
rule_cnt);
2023-01-30 21:59:35 +08:00
ret = -1;
}
old_adapter_hs = expr_rt->hs;
expr_rt->hs = new_adapter_hs;
2023-02-03 17:28:14 +08:00
maat_garbage_bagging(expr_rt->ref_garbage_bin, old_adapter_hs,
(void (*)(void*))adapter_hs_destroy);
2023-01-30 21:59:35 +08:00
rcu_hash_commit(expr_rt->htable);
rule_cnt = rcu_hash_updating_count(expr_rt->htable);
assert(rule_cnt == 0);
FREE(rules);
FREE(ex_data_array);
return ret;
}
2023-02-03 17:28:14 +08:00
int expr_runtime_scan_string(struct expr_runtime *expr_rt, int thread_id,
const char *data, size_t data_len,
int *group_ids, size_t group_ids_size,
int vtable_id, struct maat_state *state)
2023-01-30 21:59:35 +08:00
{
size_t n_hit_item = 0;
2023-02-06 08:14:25 +08:00
struct hs_scan_results hit_results[MAX_SCANNER_HIT_ITEM_NUM] = {0};
int ret = adapter_hs_scan(expr_rt->hs, thread_id, data, data_len,
hit_item_ids, MAX_SCANNER_HIT_ITEM_NUM,
&n_hit_item);
2023-01-30 21:59:35 +08:00
if (ret < 0) {
return -1;
}
2023-02-03 17:28:14 +08:00
if (0 == n_hit_item) {
return 0;
2023-01-30 21:59:35 +08:00
}
2023-02-03 17:28:14 +08:00
if (n_hit_item > MAX_SCANNER_HIT_ITEM_NUM) {
log_info(expr_rt->logger, MODULE_EXPR,
"hit expr item count:%d exceed maxium:%d",
n_hit_item, MAX_SCANNER_HIT_ITEM_NUM);
n_hit_item = MAX_SCANNER_HIT_ITEM_NUM;
2023-01-30 21:59:35 +08:00
}
2023-02-03 17:28:14 +08:00
size_t group_hit_cnt = 0;
2023-02-06 08:14:25 +08:00
ret = maat_compile_state_update(expr_rt->item_hash, vtable_id, hit_item_ids,
n_hit_item, group_ids, group_ids_size,
&group_hit_cnt, state);
2023-02-03 17:28:14 +08:00
if (ret < 0) {
return -1;
2023-01-30 21:59:35 +08:00
}
2023-02-03 17:28:14 +08:00
return group_hit_cnt;
2023-01-30 21:59:35 +08:00
}
void expr_runtime_stream_open(struct expr_runtime *expr_rt, int thread_id)
{
2023-01-31 20:39:53 +08:00
if (NULL == expr_rt) {
2023-01-30 21:59:35 +08:00
return;
}
2023-01-31 20:39:53 +08:00
struct adapter_hs_stream *hs_stream = adapter_hs_stream_open(expr_rt->hs, thread_id);
expr_rt->hs_stream = hs_stream;
2023-01-30 21:59:35 +08:00
}
2023-02-03 17:28:14 +08:00
int expr_runtime_scan_stream(struct expr_runtime *expr_rt, const char *data,
size_t data_len, int result[], size_t *n_result)
2023-01-30 21:59:35 +08:00
{
2023-01-31 20:39:53 +08:00
if (NULL == expr_rt) {
2023-01-30 21:59:35 +08:00
return -1;
}
2023-02-03 17:28:14 +08:00
return adapter_hs_scan_stream(expr_rt->hs_stream, data, data_len,
result, n_result);
2023-01-30 21:59:35 +08:00
}
void expr_runtime_stream_close(struct expr_runtime *expr_rt)
{
2023-01-31 20:39:53 +08:00
if (expr_rt != NULL) {
adapter_hs_stream_close(expr_rt->hs_stream);
expr_rt->hs_stream = NULL;
2023-01-30 21:59:35 +08:00
}
}
2023-02-03 17:28:14 +08:00
void expr_runtime_scan_hit_inc(struct expr_runtime *expr_rt, int thread_id)
{
alignment_int64_array_add(expr_rt->hit_cnt, thread_id, 1);
}
long long expr_runtime_scan_hit_sum(struct expr_runtime *expr_rt, int n_thread)
{
return alignment_int64_array_sum(expr_rt->hit_cnt, n_thread);
}