mirror of
https://github.com/VectorCamp/vectorscan.git
synced 2025-10-01 03:57:43 +03:00
Logical Combination of patterns.
This commit is contained in:
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (c) 2015-2017, Intel Corporation
|
||||
* Copyright (c) 2015-2018, Intel Corporation
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions are met:
|
||||
@@ -100,7 +100,8 @@ int pcreCallOut(pcre_callout_block *block) {
|
||||
|
||||
static
|
||||
bool decodeExprPcre(string &expr, unsigned *flags, bool *highlander,
|
||||
bool *prefilter, bool *som, hs_expr_ext *ext) {
|
||||
bool *prefilter, bool *som, bool *combination,
|
||||
bool *quiet, hs_expr_ext *ext) {
|
||||
string regex;
|
||||
unsigned int hs_flags = 0;
|
||||
if (!readExpression(expr, regex, &hs_flags, ext)) {
|
||||
@@ -109,7 +110,8 @@ bool decodeExprPcre(string &expr, unsigned *flags, bool *highlander,
|
||||
|
||||
expr.swap(regex);
|
||||
|
||||
if (!getPcreFlags(hs_flags, flags, highlander, prefilter, som)) {
|
||||
if (!getPcreFlags(hs_flags, flags, highlander, prefilter, som,
|
||||
combination, quiet)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
@@ -221,6 +223,8 @@ GroundTruth::compile(unsigned id, bool no_callouts) {
|
||||
bool highlander = false;
|
||||
bool prefilter = false;
|
||||
bool som = false;
|
||||
bool combination = false;
|
||||
bool quiet = false;
|
||||
|
||||
// we can still match approximate matching patterns with PCRE if edit
|
||||
// distance 0 is requested
|
||||
@@ -238,7 +242,8 @@ GroundTruth::compile(unsigned id, bool no_callouts) {
|
||||
hs_expr_ext ext;
|
||||
|
||||
// Decode the flags
|
||||
if (!decodeExprPcre(re, &flags, &highlander, &prefilter, &som, &ext)) {
|
||||
if (!decodeExprPcre(re, &flags, &highlander, &prefilter, &som,
|
||||
&combination, &quiet, &ext)) {
|
||||
throw PcreCompileFailure("Unable to decode flags.");
|
||||
}
|
||||
|
||||
@@ -261,7 +266,7 @@ GroundTruth::compile(unsigned id, bool no_callouts) {
|
||||
som |= !!somFlags;
|
||||
|
||||
// For traditional Hyperscan, add global callout to pattern.
|
||||
if (!no_callouts) {
|
||||
if (!combination && !no_callouts) {
|
||||
addCallout(re);
|
||||
}
|
||||
|
||||
@@ -275,12 +280,22 @@ GroundTruth::compile(unsigned id, bool no_callouts) {
|
||||
compiled->highlander = highlander;
|
||||
compiled->prefilter = prefilter;
|
||||
compiled->som = som;
|
||||
compiled->combination = combination;
|
||||
compiled->quiet = quiet;
|
||||
compiled->min_offset = ext.min_offset;
|
||||
compiled->max_offset = ext.max_offset;
|
||||
compiled->min_length = ext.min_length;
|
||||
compiled->expression = i->second; // original PCRE
|
||||
flags |= PCRE_NO_AUTO_POSSESS;
|
||||
|
||||
if (compiled->combination) {
|
||||
compiled->pl.parseLogicalCombination(id, re.c_str(), ~0U, 0, ~0ULL);
|
||||
compiled->pl.logicalKeyRenumber();
|
||||
compiled->report = id;
|
||||
return compiled;
|
||||
}
|
||||
|
||||
|
||||
compiled->bytecode =
|
||||
pcre_compile2(re.c_str(), flags, &errcode, &errptr, &errloc, nullptr);
|
||||
|
||||
@@ -424,8 +439,94 @@ int scanOffset(const CompiledPcre &compiled, const string &buffer,
|
||||
return ret;
|
||||
}
|
||||
|
||||
/** \brief Returns 1 if compliant to all logical combinations. */
|
||||
static
|
||||
char isLogicalCombination(vector<char> &lv, const vector<LogicalOp> &comb,
|
||||
size_t lkeyCount, unsigned start, unsigned result) {
|
||||
assert(start <= result);
|
||||
for (unsigned i = start; i <= result; i++) {
|
||||
const LogicalOp &op = comb[i - lkeyCount];
|
||||
assert(i == op.id);
|
||||
switch (op.op) {
|
||||
case LOGICAL_OP_NOT:
|
||||
lv[op.id] = !lv[op.ro];
|
||||
break;
|
||||
case LOGICAL_OP_AND:
|
||||
lv[op.id] = lv[op.lo] & lv[op.ro]; // &&
|
||||
break;
|
||||
case LOGICAL_OP_OR:
|
||||
lv[op.id] = lv[op.lo] | lv[op.ro]; // ||
|
||||
break;
|
||||
default:
|
||||
assert(0);
|
||||
break;
|
||||
}
|
||||
}
|
||||
return lv[result];
|
||||
}
|
||||
|
||||
bool GroundTruth::run(unsigned, const CompiledPcre &compiled,
|
||||
const string &buffer, ResultSet &rs, string &error) {
|
||||
if (compiled.quiet) {
|
||||
return true;
|
||||
}
|
||||
|
||||
if (compiled.combination) {
|
||||
// Compile and run sub-expressions, store match results.
|
||||
map<unsigned long long, set<MatchResult>> offset_to_matches;
|
||||
map<unsigned long long, set<unsigned>> offset_to_lkeys;
|
||||
set<unsigned> sub_exps;
|
||||
const auto &m_lkey = compiled.pl.getLkeyMap();
|
||||
for (const auto &it_lkey : m_lkey) {
|
||||
if (sub_exps.find(it_lkey.first) == sub_exps.end()) {
|
||||
sub_exps.emplace(it_lkey.first);
|
||||
ResultSet sub_rs(RESULT_FROM_PCRE);
|
||||
shared_ptr<CompiledPcre> sub_pcre;
|
||||
try {
|
||||
sub_pcre = compile(it_lkey.first);
|
||||
}
|
||||
catch (const SoftPcreCompileFailure &err) {
|
||||
return false;
|
||||
}
|
||||
catch (const PcreCompileFailure &err) {
|
||||
return false;
|
||||
}
|
||||
sub_pcre->quiet = false; // force not quiet in sub-exp.
|
||||
if (!run(it_lkey.first, *sub_pcre, buffer, sub_rs, error)) {
|
||||
rs.clear();
|
||||
return false;
|
||||
}
|
||||
for (const auto &it_mr : sub_rs.matches) {
|
||||
offset_to_matches[it_mr.to].emplace(it_mr);
|
||||
offset_to_lkeys[it_mr.to].emplace(it_lkey.second);
|
||||
if (sub_pcre->highlander) {
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
// Calculate rs for combination expression.
|
||||
vector<char> lv;
|
||||
const auto &comb = compiled.pl.getLogicalTree();
|
||||
lv.resize(m_lkey.size() + comb.size());
|
||||
const auto &li = compiled.pl.getCombInfoById(compiled.report);
|
||||
for (const auto &it : offset_to_lkeys) {
|
||||
for (auto report : it.second) {
|
||||
lv[report] = 1;
|
||||
}
|
||||
if (isLogicalCombination(lv, comb, m_lkey.size(),
|
||||
li.start, li.result)) {
|
||||
for (const auto &mr : offset_to_matches.at(it.first)) {
|
||||
if ((mr.to >= compiled.min_offset) &&
|
||||
(mr.to <= compiled.max_offset)) {
|
||||
rs.addMatch(mr.from, mr.to);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
CalloutContext ctx(out);
|
||||
|
||||
pcre_extra extra;
|
||||
|
Reference in New Issue
Block a user