Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

gen/refactor: transform and misc related changes for improved transform support #12427

Open
wants to merge 6 commits into
base: master
Choose a base branch
from

Conversation

jlucovsky
Copy link
Contributor

@jlucovsky jlucovsky commented Jan 19, 2025

Continuation of #12426

A set of changes from #12425 that improve transform support

Describe changes:

  • Detection engine thread context pointer now available to individual transform functions
  • Detect engine context available to transform free function
  • Defer memory release of keyword hash table until engine context has been reed
  • Make packet/tx_id available earlier
  • Refactor transform setup/apply pattern from 2 to 1 function: InspectionBufferSetupAndApplyTransforms

Updates:

  • Formatting fixup

Provide values to any of the below to override the defaults.

  • To use an LibHTP, Suricata-Verify or Suricata-Update pull request,
    link to the pull request in the respective _BRANCH variable.
  • Leave unused overrides blank or remove.

SV_REPO=
SV_BRANCH=
SU_REPO=
SU_BRANCH=
LIBHTP_REPO=
LIBHTP_BRANCH=

jlucovsky and others added 6 commits January 19, 2025 08:37
This commit makes the detection engine thread context available for
transforms to use. The Lua transform requires this value.

Issue: 2290
Issue: 2290

This commit extends the hash table logic with an alternate free function
that provides the detection engine context.

Users that wish to use the next functionality must use the
HashListTableInitWithCtx function when initializing the hash table.
Using this interface will result in the hash table "free with context"
function (new) being used instead.
Issue: 2290

Defer freeing the keyword hash table until the engine context has
been freed. This eliminates a double-free from occurring.

For the unittests ONLY, clear the keyword_hash to prevent a double
free attempt.
So transforms can access them through DetectEngineThreadCtx
git grep -A 1 -w InspectionBufferSetup shows numbers cases of the pattern:
    - InspectionBufferSetup
    - InspectionBufferApplyTransforms

Refactor the implementations of those functions into
InspectionBufferSetupAndApplyTransforms to reduce function call count.

Issuer: 2290
Copy link

codecov bot commented Jan 19, 2025

Codecov Report

Attention: Patch coverage is 91.90283% with 20 lines in your changes missing coverage. Please review.

Project coverage is 80.64%. Comparing base (8f6795d) to head (d64e5fd).
Report is 5 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master   #12427   +/-   ##
=======================================
  Coverage   80.63%   80.64%           
=======================================
  Files         918      920    +2     
  Lines      258696   258725   +29     
=======================================
+ Hits       208598   208636   +38     
+ Misses      50098    50089    -9     
Flag Coverage Δ
fuzzcorpus 56.81% <79.14%> (-0.01%) ⬇️
livemode 19.41% <19.57%> (+0.01%) ⬆️
pcap 44.28% <47.23%> (-0.02%) ⬇️
suricata-verify 63.25% <89.36%> (+0.01%) ⬆️
unittests 58.53% <42.10%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

@jlucovsky jlucovsky marked this pull request as ready for review January 19, 2025 14:45
@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline 24269

@@ -984,7 +986,7 @@ static void DetectBufferTypeFreeFunc(void *data)
static int DetectBufferTypeInit(void)
{
BUG_ON(g_buffer_type_hash);
g_buffer_type_hash = HashListTableInit(256, DetectBufferTypeHashNameFunc,
g_buffer_type_hash = HashListTableInitWithCtx(256, DetectBufferTypeHashNameFunc,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not sure I understand why in this global hash we'd free with de_ctx? That should only happen for per de_ctx hashes, right?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This change is necessary with the Luaxform so its free function can unregister the thread ctx

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it shows a problem with the original code. There should be no dependency on a de_ctx in this global data structure. So if we need to free something using a de_ctx here, it means we're storing data in the wrong place.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

3 participants