Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

next/136/60x/20230911/v1 #9472

Merged
merged 5 commits into from
Sep 11, 2023
Merged

next/136/60x/20230911/v1 #9472

merged 5 commits into from
Sep 11, 2023

Commits on Sep 7, 2023

  1. var-names: reimplement var name handling 

    Implement a new design for handling var name id's. The old logic
was aware of detection engine versions and generally didn't work
well for multi-tenancy cases. Other than memory leaks and crashes,
logging of var names worked or failed based on which tenant was
loaded last.

This patch implements a new approach, where there is a global store
of vars and their id's for the lifetime of the program.

Overall Design:

Base Store: "base"

Used during keyword registration. Operates under lock. Base is shared
between all detect engines, detect engine versions and tenants.
Each variable name is ref counted.

During the freeing of a detect engine / tenant, unregistration decreases
the ref cnt.

Base has both a string to id and a id to string hash table. String to
id is used during parsing/registration. id to string during unregistration.

Active Store Pointer (atomic)

The "active" store atomic pointer points to the active lookup store. The call
to `VarNameStoreActivate` will build a new lookup store and hot swap
the pointer.

Ensuring memory safety. During the hot swap, the pointer is replaced, so
any new call to the lookup functions will automatically use the new store.
This leaves the case of any lookup happening concurrently with the pointer
swap. For this case we add the old store to a free list. It gets a timestamp
before which it cannot be freed.

Free List

The free list contains old stores that are waiting to get removed. They
contain a timestamp that is checked before they are freed.

Bug: OISF#6044.
Bug: OISF#6201.
(cherry picked from commit b130234)
    @victorjulien
    victorjulien committed Sep 7, 2023
    Configuration menu
    Copy the full SHA
    125d6ab View commit details
    Browse the repository at this point in the history

  2. detect/filemagic: fix thread ctx registration; reloads 

    Make sure thread ctx registration happens and id remains correct
in case of reloads.

To do so, move id var into the detect ctx.

(cherry picked from commit 2cac440)
    @victorjulien
    victorjulien committed Sep 7, 2023
    Configuration menu
    Copy the full SHA
    3f780e6 View commit details
    Browse the repository at this point in the history

  3. stat: add wrappers to isolate OS_WIN32 specifics 

    (cherry picked from commit 269f751)
    @victorjulien
    victorjulien committed Sep 7, 2023
    Configuration menu
    Copy the full SHA
    29b4608 View commit details
    Browse the repository at this point in the history

  4. path: new funcs to merge paths 

    Take windows directory separators into account.

Path is not checked or "resolved".

(cherry picked from commit 228caa6)
    @victorjulien
    victorjulien committed Sep 7, 2023
    Configuration menu
    Copy the full SHA
    161aaef View commit details
    Browse the repository at this point in the history

  5. bpf: close fp in all error paths

    @victorjulien
    victorjulien committed Sep 7, 2023
    Configuration menu
    Copy the full SHA
    e66c63b View commit details
    Browse the repository at this point in the history