[FEATURE]user-defined expr table scanning engine

src/maat_compile.c

@@ -40,7 +40,7 @@ struct compile_schema {
     int compile_id_column;
     int rule_tag_column;
     int declared_clause_num_column;
-    int table_id; //ugly
+    int table_id;
     struct table_manager *ref_tbl_mgr;
     struct log_handle *logger;
 };
@@ -52,7 +52,7 @@ struct group2compile_schema {
     int vtable_name_column;
     int clause_index_column;
     int asso_compile_table_id; //asso is abbreviation for associated
-    int table_id;//ugly
+    int table_id;
     struct table_manager *ref_tbl_mgr;
 };
 

src/maat_expr.c

@@ -34,7 +34,8 @@ struct expr_schema {
 	int expr_type_column;
     int match_method_column;
     int is_hexbin_column;
-    int table_id; //ugly
+    int table_id;
+    int expr_engine;
     struct table_manager *ref_tbl_mgr;
 };
 
@@ -327,6 +328,7 @@ void *expr_schema_new(cJSON *json, struct table_manager *tbl_mgr,
 {
     char table_type[NAME_MAX] = {0};
 	struct expr_schema *expr_schema = ALLOC(struct expr_schema, 1);
+    expr_schema->expr_engine = EXPR_ENGINE_TYPE_MAX;
 
     cJSON *custom_item = NULL;
     cJSON *item = cJSON_GetObjectItem(json, "table_id");
@@ -343,6 +345,20 @@ void *expr_schema_new(cJSON *json, struct table_manager *tbl_mgr,
     item = cJSON_GetObjectItem(json, "table_type");
     memcpy(table_type, item->valuestring, strlen(item->valuestring));
 
+    item = cJSON_GetObjectItem(json, "expr_engine");
+    if (item != NULL && item->type == cJSON_String) {
+        if (strcmp(item->valuestring, "hyperscan") == 0) {
+            expr_schema->expr_engine = EXPR_ENGINE_TYPE_HS;
+        } else if (strcmp(item->valuestring, "rulescan") == 0) {
+            expr_schema->expr_engine = EXPR_ENGINE_TYPE_RS;
+        } else {
+           log_fatal(logger, MODULE_EXPR, 
+                  "[%s:%d] expr table:<%s> schema has invalid expr_engine", 
+                  __FUNCTION__, __LINE__, table_name);
+            goto error; 
+        }
+    }
+
     item = cJSON_GetObjectItem(json, "custom");
     if (item == NULL || item->type != cJSON_Object) {
         log_fatal(logger, MODULE_EXPR, 
@@ -482,9 +498,14 @@ void *expr_runtime_new(void *expr_schema, size_t max_thread_num,
     expr_rt->n_worker_thread = max_thread_num;
     expr_rt->ref_garbage_bin = garbage_bin;
     expr_rt->logger = logger;
-    expr_rt->expr_engine = table_manager_get_expr_engine(schema->ref_tbl_mgr);
     expr_rt->district_map = maat_kv_store_new();
 
+    if (schema->expr_engine != EXPR_ENGINE_TYPE_MAX) {
+        expr_rt->expr_engine = schema->expr_engine;
+    } else {
+        expr_rt->expr_engine = table_manager_get_expr_engine(schema->ref_tbl_mgr);
+    }
+
     expr_rt->hit_cnt = alignment_int64_array_alloc(max_thread_num);
     expr_rt->scan_cnt = alignment_int64_array_alloc(max_thread_num);
     expr_rt->scan_bytes = alignment_int64_array_alloc(max_thread_num);
@@ -875,7 +896,7 @@ int expr_runtime_commit(void *expr_runtime, const char *table_name,
     if (rule_cnt > 0) {
         enum expr_engine_type engine_type = EXPR_ENGINE_TYPE_HS;
         if (expr_rt->expr_engine == MAAT_EXPR_ENGINE_RS) {
-            engine_type = EXPR_ENGINE_TYPE_RS; 
+            engine_type = EXPR_ENGINE_TYPE_RS;
         }
         
         struct timespec start, end;
@@ -894,8 +915,9 @@ int expr_runtime_commit(void *expr_runtime, const char *table_name,
         } else {
             log_info(expr_rt->logger, MODULE_EXPR,
                      "table[%s] has %zu rules, commit %zu expr rules(regex rules:%zu) "
-                     "and rebuild adapter_hs completed, version:%lld, consume:%lldms", table_name, rule_cnt,
+                     "and rebuild expr_matcher(%s) completed, version:%lld, consume:%lldms", table_name, rule_cnt,
-                     real_rule_cnt, real_regex_rule_cnt, maat_rt_version, time_elapse_ms);
+                     real_rule_cnt, real_regex_rule_cnt, engine_type == EXPR_ENGINE_TYPE_HS ? "hyperscan" : "rulescan",
+                     maat_rt_version, time_elapse_ms);
         }
     }
 

src/maat_group.c

@@ -31,7 +31,7 @@ struct group2group_schema {
     int group_id_column;
     int super_group_id_column;
     int is_exclude_column;
-    int table_id;//ugly
+    int table_id;
     struct table_manager *ref_tbl_mgr;
 };
 

src/maat_ip.c

@@ -40,7 +40,7 @@ struct ip_schema {
     int port1_column;
     int port2_column;
     int protocol_column;
-    int table_id; //ugly
+    int table_id;
     struct table_manager *ref_tbl_mgr;
 };
 

src/maat_ip_plugin.c

@@ -28,7 +28,7 @@ struct ip_plugin_schema {
 	int end_ip_column;
 	int rule_tag_column;
     int gc_timeout_s;
-    int table_id; //ugly
+    int table_id;
 	struct ex_container_schema container_schema;
     struct table_manager *ref_tbl_mgr;
     struct log_handle *logger;

src/maat_plugin.c

@@ -64,7 +64,7 @@ struct plugin_schema {
     size_t cb_cnt;
     struct plugin_callback_schema cb[MAX_PLUGIN_PER_TABLE];
     struct ex_container_schema container_schema;
-    int table_id; //ugly
+    int table_id;
     struct table_manager *ref_tbl_mgr;
     struct log_handle *logger;
 };

test/table_info.conf

@@ -128,6 +128,7 @@
         "table_name":"HTTP_REGION",
         "db_tables":["HTTP_URL", "HTTP_HOST"],
         "table_type":"expr",
+        "expr_engine":"rulescan",
         "valid_column":7,
         "custom": {
             "item_id":1,