gfwleak/tango-maat
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[OPTIMIZE]optimize hyperscan callback performance

Browse Source
This commit is contained in:
liuwentan
2023-09-22 17:55:14 +08:00
parent d55ca3595a
commit e5eea6f610
2 changed files with 10 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
scanner/expr_matcher/adapter_rs/adapter_rs.cpp
View File

@@ -22,9 +22,9 @@
#include "maat_utils.h"
#include "../../bool_matcher/bool_matcher.h"
#define MAX_HIT_PATTERN_NUM 512
#define MAX_HIT_PATTERN_NUM 1024
pid_t rs_gettid()
pid_t rs_gettid()
{
return syscall(SYS_gettid);
}
@@ -430,11 +430,6 @@ static int matched_event_cb(unsigned int id, int pos_offset, int from, int to,
if (utarray_len(matched_pat->pattern_ids) >= MAX_HIT_PATTERN_NUM) {
return 0;
}
// duplicate pattern_id
if (utarray_find(matched_pat->pattern_ids, &pattern_id, compare_pattern_id)) {
return 0;
}
int ret = 0;
struct pattern_attribute pat_attr = matched_pat->ref_rs_attr[id];
@@ -487,7 +482,6 @@ static int matched_event_cb(unsigned int id, int pos_offset, int from, int to,
if (1 == ret) {
utarray_push_back(matched_pat->pattern_ids, &pattern_id);
utarray_sort(matched_pat->pattern_ids, compare_pattern_id);
}
return 0;
@@ -609,8 +603,9 @@ int adapter_rs_scan_stream(void *rs_stream, const char *data, size_t data_len,
return 0;
}
unsigned long long pattern_ids[n_pattern_id];
utarray_sort(matched_pat->pattern_ids, compare_pattern_id);
unsigned long long pattern_ids[n_pattern_id];
for (size_t i = 0; i < n_pattern_id; i++) {
pattern_ids[i] = *(unsigned long long *)utarray_eltptr(matched_pat->pattern_ids, i);
}
@@ -678,6 +673,8 @@ int adapter_rs_scan(void *rs_instance, int thread_id, const char *data, size_t d
return 0;
}
utarray_sort(matched_pat->pattern_ids, compare_pattern_id);
unsigned long long pattern_ids[n_pattern_id];
for (size_t i = 0; i < n_pattern_id; i++) {
pattern_ids[i] = *(unsigned long long *)utarray_eltptr(matched_pat->pattern_ids, i);