gfwleak/tango-maat
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[OPTIMIZE]optimize hyperscan callback performance

Browse Source
This commit is contained in:
liuwentan
2023-09-22 17:55:14 +08:00
parent d55ca3595a
commit e5eea6f610
2 changed files with 10 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
scanner/expr_matcher/adapter_hs/adapter_hs.cpp
View File

@@ -22,9 +22,9 @@
#include "maat_utils.h" #include "maat_utils.h"
#include "../../bool_matcher/bool_matcher.h" #include "../../bool_matcher/bool_matcher.h"
#define MAX_HIT_PATTERN_NUM 512 #define MAX_HIT_PATTERN_NUM 1024
pid_t hs_gettid() pid_t hs_gettid()
{ {
return syscall(SYS_gettid); return syscall(SYS_gettid);
} }
@@ -584,11 +584,6 @@ static int matched_event_cb(unsigned int id, unsigned long long from,
if (utarray_len(matched_pat->pattern_ids) >= MAX_HIT_PATTERN_NUM) { if (utarray_len(matched_pat->pattern_ids) >= MAX_HIT_PATTERN_NUM) {
return 0; return 0;
} }
// duplicate pattern_id
if (utarray_find(matched_pat->pattern_ids, &pattern_id, compare_pattern_id)) {
return 0;
}
int ret = 0; int ret = 0;
struct pattern_attribute pat_attr = matched_pat->ref_hs_attr[id]; struct pattern_attribute pat_attr = matched_pat->ref_hs_attr[id];
@@ -640,7 +635,6 @@ static int matched_event_cb(unsigned int id, unsigned long long from,
if (1 == ret) { if (1 == ret) {
utarray_push_back(matched_pat->pattern_ids, &pattern_id); utarray_push_back(matched_pat->pattern_ids, &pattern_id);
utarray_sort(matched_pat->pattern_ids, compare_pattern_id);
} }
return 0; return 0;
@@ -834,8 +828,9 @@ int adapter_hs_scan_stream(void *hs_stream, const char *data, size_t data_len,
return 0; return 0;
} }
unsigned long long pattern_ids[n_pattern_id]; utarray_sort(stream->matched_pat->pattern_ids, compare_pattern_id);
unsigned long long pattern_ids[n_pattern_id];
for (size_t i = 0; i < n_pattern_id; i++) { for (size_t i = 0; i < n_pattern_id; i++) {
pattern_ids[i] = *(unsigned long long *)utarray_eltptr(stream->matched_pat->pattern_ids, i); pattern_ids[i] = *(unsigned long long *)utarray_eltptr(stream->matched_pat->pattern_ids, i);
} }

15
scanner/expr_matcher/adapter_rs/adapter_rs.cpp
View File

@@ -22,9 +22,9 @@
#include "maat_utils.h" #include "maat_utils.h"
#include "../../bool_matcher/bool_matcher.h" #include "../../bool_matcher/bool_matcher.h"
#define MAX_HIT_PATTERN_NUM 512 #define MAX_HIT_PATTERN_NUM 1024
pid_t rs_gettid() pid_t rs_gettid()
{ {
return syscall(SYS_gettid); return syscall(SYS_gettid);
} }
@@ -430,11 +430,6 @@ static int matched_event_cb(unsigned int id, int pos_offset, int from, int to,
if (utarray_len(matched_pat->pattern_ids) >= MAX_HIT_PATTERN_NUM) { if (utarray_len(matched_pat->pattern_ids) >= MAX_HIT_PATTERN_NUM) {
return 0; return 0;
} }
// duplicate pattern_id
if (utarray_find(matched_pat->pattern_ids, &pattern_id, compare_pattern_id)) {
return 0;
}
int ret = 0; int ret = 0;
struct pattern_attribute pat_attr = matched_pat->ref_rs_attr[id]; struct pattern_attribute pat_attr = matched_pat->ref_rs_attr[id];
@@ -487,7 +482,6 @@ static int matched_event_cb(unsigned int id, int pos_offset, int from, int to,
if (1 == ret) { if (1 == ret) {
utarray_push_back(matched_pat->pattern_ids, &pattern_id); utarray_push_back(matched_pat->pattern_ids, &pattern_id);
utarray_sort(matched_pat->pattern_ids, compare_pattern_id);
} }
return 0; return 0;
@@ -609,8 +603,9 @@ int adapter_rs_scan_stream(void *rs_stream, const char *data, size_t data_len,
return 0; return 0;
} }
unsigned long long pattern_ids[n_pattern_id]; utarray_sort(matched_pat->pattern_ids, compare_pattern_id);
unsigned long long pattern_ids[n_pattern_id];
for (size_t i = 0; i < n_pattern_id; i++) { for (size_t i = 0; i < n_pattern_id; i++) {
pattern_ids[i] = *(unsigned long long *)utarray_eltptr(matched_pat->pattern_ids, i); pattern_ids[i] = *(unsigned long long *)utarray_eltptr(matched_pat->pattern_ids, i);
} }
@@ -678,6 +673,8 @@ int adapter_rs_scan(void *rs_instance, int thread_id, const char *data, size_t d
return 0; return 0;
} }
utarray_sort(matched_pat->pattern_ids, compare_pattern_id);
unsigned long long pattern_ids[n_pattern_id]; unsigned long long pattern_ids[n_pattern_id];
for (size_t i = 0; i < n_pattern_id; i++) { for (size_t i = 0; i < n_pattern_id; i++) {
pattern_ids[i] = *(unsigned long long *)utarray_eltptr(matched_pat->pattern_ids, i); pattern_ids[i] = *(unsigned long long *)utarray_eltptr(matched_pat->pattern_ids, i);