Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 20:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'topic/christian/fix-rulematcher-iteration'

Browse source 
* topic/christian/fix-rulematcher-iteration:
  Define ordering on Rule instances and use on sets in RuleMatcher
This commit is contained in:
Christian Kreibich 2024-11-18 09:39:05 -08:00
commit 5e0e2a8bd8
5 changed files with 18 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

4
CHANGES
View file

@ -1,3 +1,7 @@
7.1.0-dev.577 | 2024-11-18 09:39:05 -0800
* Define ordering on Rule instances and use on sets in RuleMatcher (Christian Kreibich, Corelight)
7.1.0-dev.575 | 2024-11-18 17:28:18 +0100 7.1.0-dev.575 | 2024-11-18 17:28:18 +0100
* communityid: Use GetField() over GetFieldAs() (Arne Welzel, Corelight) * communityid: Use GetField() over GetFieldAs() (Arne Welzel, Corelight)

2
VERSION
View file

@ -1 +1 @@
7.1.0-dev.575 7.1.0-dev.577

3
src/Rule.h
View file

@ -59,6 +59,9 @@ public:
void PrintDebug(); void PrintDebug();
bool operator==(const Rule& other) { return strcmp(ID(), other.ID()) == 0; }
bool operator<(const Rule& other) { return strcmp(ID(), other.ID()) < 0; }
static const char* TypeToString(Rule::PatternType type); static const char* TypeToString(Rule::PatternType type);
private: private:

10
src/RuleMatcher.cc
View file

@ -657,7 +657,8 @@ RuleMatcher::MIME_Matches* RuleMatcher::Match(RuleFileMagicState* state, const u
} }
// Find rules for which patterns have matched. // Find rules for which patterns have matched.
set<Rule*> rule_matches; auto cmp = [](Rule* a, Rule* b) { return *a < *b; };
set<Rule*, decltype(cmp)> rule_matches(cmp);
for ( AcceptingMatchSet::const_iterator it = accepted_matches.begin(); it != accepted_matches.end(); ++it ) { for ( AcceptingMatchSet::const_iterator it = accepted_matches.begin(); it != accepted_matches.end(); ++it ) {
auto [aidx, mpos] = *it; auto [aidx, mpos] = *it;
@ -841,7 +842,12 @@ void RuleMatcher::Match(RuleEndpointState* state, Rule::PatternType type, const
// matched patterns per connection (which is a plausible assumption). // matched patterns per connection (which is a plausible assumption).
// Find rules for which patterns have matched. // Find rules for which patterns have matched.
set<pair<Rule*, MatchPos>> rule_matches; auto cmp = [](pair<Rule*, MatchPos> a, pair<Rule*, MatchPos> b) {
if ( *a.first == *b.first )
return a.second < b.second;
return *a.first < *b.first;
};
set<pair<Rule*, MatchPos>, decltype(cmp)> rule_matches(cmp);
for ( AcceptingMatchSet::const_iterator it = accepted_matches.begin(); it != accepted_matches.end(); ++it ) { for ( AcceptingMatchSet::const_iterator it = accepted_matches.begin(); it != accepted_matches.end(); ++it ) {
AcceptIdx aidx = it->first; AcceptIdx aidx = it->first;

4
testing/btest/Baseline/signatures.tcp-end-of-match/.stdout
View file

@ -1,7 +1,7 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
signature_match, message, 1448
signature_match with end_of_match, message, 1448, rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability
portability_match with end_of_match, 1448, rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability portability_match with end_of_match, 1448, rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability
portability_match, 1448 portability_match, 1448
portability_match_with_msg with end_of_match, custom message, 1448, 69, rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability portability_match_with_msg with end_of_match, custom message, 1448, 69, rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability
portability_match_with_msg, custom message, 1448 portability_match_with_msg, custom message, 1448
signature_match, message, 1448
signature_match with end_of_match, message, 1448, rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability