[FEATURE]expr_matcher support dual engine(hyperscan & rulescan) & benchmark

1 files changed, 235 insertions, 0 deletions

diff --git a/scanner/expr_matcher/expr_matcher.cpp b/scanner/expr_matcher/expr_matcher.cpp
new file mode 100644
index 0000000..3a37383
--- /dev/null
+++ b/scanner/expr_matcher/expr_matcher.cpp
@@ -0,0 +1,235 @@
+/*
+**********************************************************************************************
+*	File: expr_matcher.cpp
+*   Description: 
+*	Authors: Liu wentan <[email protected]>
+*	Date:    2023-06-30
+*   Copyright: (c) Since 2023 Geedge Networks, Ltd. All rights reserved.
+***********************************************************************************************
+*/
+
+#include <unistd.h>
+#include <assert.h>
+#include <sys/syscall.h>
+
+#include "log/log.h"
+#include "expr_matcher.h"
+#include "maat_utils.h"
+#include "adapter_hs/adapter_hs.h"
+#include "adapter_rs/adapter_rs.h"
+
+pid_t expr_matcher_gettid() 
+{
+	return syscall(SYS_gettid);
+}
+
+static const char *expr_matcher_module_name_str(const char *name)
+{
+	static __thread char module[64];
+	snprintf(module, sizeof(module), "%s(%d)", name, expr_matcher_gettid());
+    
+	return module;
+}
+
+#define MODULE_EXPR_MATCHER	 expr_matcher_module_name_str("maat.expr_matcher")
+
+struct expr_matcher {
+    enum expr_engine_type engine_type;
+    void *engine;
+    struct log_handle *logger;
+};
+
+struct expr_matcher_stream {
+    enum expr_engine_type engine_type;
+    void *handle;
+};
+
+struct expr_engine_operations {
+    enum expr_engine_type type;
+    void *(*engine_new)(struct expr_rule *rules, size_t n_rule,
+                        size_t n_literal_pattern, size_t n_regex_pattern,
+                        size_t n_worker_thread, struct log_handle *logger);
+    void (*engine_free)(void *engine);
+    int (*engine_scan)(void *engine, int thread_id, const char *scan_data,
+                       size_t data_len, struct expr_scan_result *result_array,
+                       size_t n_result_array, size_t *n_hit_result);
+    void *(*engine_stream_open)(void *engine, int thread_id);
+    void (*engine_stream_close)(void *stream);
+    int (*engine_scan_stream)(void *stream, const char *scan_data, size_t data_len,
+                              struct expr_scan_result *result_array, size_t n_result_array,
+                              size_t *n_hit_result);
+};
+
+struct expr_engine_operations expr_engine_ops[EXPR_ENGINE_TYPE_MAX] = {
+    {
+        .type = EXPR_ENGINE_TYPE_HS,
+        .engine_new = adapter_hs_new,
+        .engine_free = adapter_hs_free,
+        .engine_scan = adapter_hs_scan,
+        .engine_stream_open = adapter_hs_stream_open,
+        .engine_stream_close = adapter_hs_stream_close,
+        .engine_scan_stream = adapter_hs_scan_stream
+    },
+    {
+        .type = EXPR_ENGINE_TYPE_RS,
+        .engine_new = adapter_rs_new,
+        .engine_free = adapter_rs_free,
+        .engine_scan = adapter_rs_scan,
+        .engine_stream_open = adapter_rs_stream_open,
+        .engine_stream_close = adapter_rs_stream_close,
+        .engine_scan_stream = adapter_rs_scan_stream
+    }
+};
+
+int expr_matcher_verify_regex_expression(const char *regex_expr,
+                                         struct log_handle *logger)
+{
+    int ret = adapter_hs_verify_regex_expression(regex_expr, logger);
+    if (ret == 0) {
+        return 0;
+    }
+
+    return adapter_rs_verify_regex_expression(regex_expr, logger);
+}
+
+struct expr_matcher *
+expr_matcher_new(struct expr_rule *rules, size_t n_rule, enum expr_engine_type engine_type,
+                 size_t n_worker_thread, struct log_handle *logger)
+{
+    if (NULL == rules || 0 == n_rule || 0 == n_worker_thread ||
+        (engine_type != EXPR_ENGINE_TYPE_HS && engine_type != EXPR_ENGINE_TYPE_RS)) {
+        log_error(logger, MODULE_EXPR_MATCHER, "[%s:%d]engine type:%d is illegal", 
+                  __FUNCTION__, __LINE__, engine_type);
+        return NULL;
+    }
+
+    size_t i = 0, j = 0;
+    size_t literal_pat_num = 0;
+    size_t regex_pat_num = 0;
+
+    for (i = 0; i < n_rule; i++) {
+        if (rules[i].n_patterns > MAX_EXPR_PATTERN_NUM) {
+            log_error(logger, MODULE_EXPR_MATCHER, 
+                      "[%s:%d] the number of patterns in one expression should less than"
+                      " %d", __FUNCTION__, __LINE__, MAX_EXPR_PATTERN_NUM);
+            return NULL;
+        }
+
+        for (j = 0; j < rules[i].n_patterns; j++) {
+            /* pat_len should not 0 */
+            if (0 == rules[i].patterns[j].pat_len) {
+                log_error(logger, MODULE_EXPR_MATCHER,
+                          "[%s:%d] expr pattern length should not 0",
+                          __FUNCTION__, __LINE__);
+                return NULL;
+            }
+
+            if (rules[i].patterns[j].type == EXPR_PATTERN_TYPE_STR) {
+                literal_pat_num++;
+            } else {
+                regex_pat_num++;
+            }
+        }
+    }
+
+    if (0 == literal_pat_num && 0 == regex_pat_num) {
+        log_error(logger, MODULE_EXPR_MATCHER,
+                  "[%s:%d] exprs has no valid pattern", __FUNCTION__, __LINE__);
+        return NULL;
+    }
+
+    void *engine = expr_engine_ops[engine_type].engine_new(rules, n_rule, literal_pat_num,
+                                                           regex_pat_num, n_worker_thread,
+                                                           logger);
+    if (NULL == engine) {
+        log_error(logger, MODULE_EXPR_MATCHER,
+                  "[%s:%d]expr_matcher engine_new failed.", __FUNCTION__, __LINE__);
+        return NULL;
+    }
+
+    struct expr_matcher *matcher = ALLOC(struct expr_matcher, 1);
+    matcher->engine_type = engine_type;
+    matcher->engine = engine;
+    matcher->logger = logger;
+    
+    return matcher;
+}
+
+void expr_matcher_free(struct expr_matcher *matcher)
+{
+    if (NULL == matcher) {
+       return;
+    }
+
+    if (matcher->engine != NULL) {
+        expr_engine_ops[matcher->engine_type].engine_free(matcher->engine);
+        matcher->engine = NULL;
+    }
+    
+    FREE(matcher);
+}
+
+int expr_matcher_match(struct expr_matcher *matcher, int thread_id, const char *scan_data,
+                       size_t data_len, struct expr_scan_result *result_array,
+                       size_t n_result_array, size_t *n_hit_results)
+{
+    if (NULL == matcher || thread_id < 0 || NULL == scan_data || 0 == data_len
+        || NULL == result_array || 0 == n_result_array || NULL == n_hit_results) {
+        return -1;
+    }
+
+    return expr_engine_ops[matcher->engine_type].engine_scan(matcher->engine, thread_id,
+                                                            scan_data, data_len, result_array,
+                                                            n_result_array, n_hit_results);
+}
+
+struct expr_matcher_stream *
+expr_matcher_stream_open(struct expr_matcher *matcher, int thread_id)
+{
+    if (NULL == matcher || thread_id < 0) {
+        return NULL;
+    }
+
+    void *s_handle = expr_engine_ops[matcher->engine_type].engine_stream_open(matcher->engine,
+                                                                              thread_id);
+    if (NULL == s_handle) {
+        log_error(matcher->logger, MODULE_EXPR_MATCHER,
+                  "[%s:%d] expr_matcher engine_stream_open failed.",
+                  __FUNCTION__, __LINE__);
+        return NULL;
+    }
+
+    struct expr_matcher_stream *stream = ALLOC(struct expr_matcher_stream, 1);
+    stream->engine_type = matcher->engine_type;
+    stream->handle = s_handle;
+    
+    return stream;
+}
+
+int expr_matcher_stream_match(struct expr_matcher_stream *stream, const char *scan_data,
+						      size_t data_len, struct expr_scan_result *result_array, 
+						      size_t n_result_array, size_t *n_hit_results)
+{
+    if (NULL == stream || NULL == scan_data || 0 == data_len || NULL == result_array
+        || 0 == n_result_array || NULL == n_hit_results) {
+        return -1;
+    }
+
+    return expr_engine_ops[stream->engine_type].engine_scan_stream(stream->handle, scan_data,
+                                                                         data_len, result_array,
+                                                                         n_result_array, n_hit_results);
+}
+
+void expr_matcher_stream_close(struct expr_matcher_stream *stream)
+{
+    if (NULL == stream) {
+        return;
+    }
+
+    if (stream->handle != NULL) {
+        expr_engine_ops[stream->engine_type].engine_stream_close(stream->handle);
+        stream->handle = NULL;
+    }
+    
+    FREE(stream);
+}
\ No newline at end of file