classifierrfc.cc

网络流量采集及分析软件

        }
        break;
    } 
}    

void ClassifierRFC::projMatchDirectly(unsigned short eq, unsigned short chunk_id, int chunk_size, 
                                      unsigned short ch, filter_t *f)
{
    unsigned short ind[2], ind2[2];

    // project the points directly on the chunk
    switch (f->mtype) {
    case FT_EXACT:
        // set equiv class 2 for the distinct point
        getIndex(&f->value[0], &f->mask, chunk_size, ch, ind);
        for (unsigned short i = ind[0]; i < ind[1]; i++) {
            cdata.phases[0].chunks[chunk_id].entries[i] = eq;
        }
        break;
    case FT_RANGE:
        // start point is index from value 1, end point is index from value 2
        getIndex(&f->value[0], &f->mask, chunk_size, ch, ind);
        getIndex(&f->value[1], &f->mask, chunk_size, ch, ind2);
        
        // only add both points if the current byte part of the range is actually different
        // otherwise single point
        if (ind != ind2) {
            for (unsigned short i = ind[0]; i < ind2[1]; i++) {
                cdata.phases[0].chunks[chunk_id].entries[i] = eq;
            }
        } else {
            for (unsigned short i = ind[0]; i < ind[1]; i++) {
                cdata.phases[0].chunks[chunk_id].entries[i] = eq;
            }
        }
        break;
    case FT_SET:
      {
          // like FT_EXACT (n times)
          unsigned short i = 0;
          while (f->value[i].getLen()) {
              getIndex(&f->value[i], &f->mask, chunk_size, ch, ind);
              
              for (unsigned short j = ind[0]; j < ind[1]; j++) {
                  cdata.phases[0].chunks[chunk_id].entries[j] = eq;
              }
              
              i++;
          }
      }
      break;
    case FT_WILD:
        // nothing
        break;
    }   
}

void ClassifierRFC::projMatch(unsigned short rid, unsigned short chunk_id, int chunk_size, 
                              unsigned short ch, filter_t *f)
{
    unsigned short ind[2], ind2[2];

    switch (f->mtype) {
    case FT_EXACT:
        // start point is the index, end point is the right adjacent point
        getIndex(&f->value[0], &f->mask, chunk_size, ch, ind);
        addRuleToPoint(&nlines.lines[chunk_id].points[ind[0]], RULE_START, rid);
        addRuleToPoint(&nlines.lines[chunk_id].points[ind[1]], RULE_END, rid);
        break;
    case FT_RANGE:
        // start point is index from value 1, end point is index from value 2
        getIndex(&f->value[1], &f->mask, chunk_size, ch, ind);
        getIndex(&f->value[0], &f->mask, chunk_size, ch, ind2);

        // only add both points if the current byte part of the range is actually different
        // otherwise single point
        if (ind[0] != ind2[0]) {
            addRuleToPoint(&nlines.lines[chunk_id].points[ind[0]], RULE_START, rid);
            addRuleToPoint(&nlines.lines[chunk_id].points[ind2[1]], RULE_END, rid);
        } else {
            addRuleToPoint(&nlines.lines[chunk_id].points[ind[0]], RULE_START, rid);
            addRuleToPoint(&nlines.lines[chunk_id].points[ind[1]], RULE_END, rid);
        }
        break;
    case FT_SET:
      {
          // like FT_EXACT (n times)
          unsigned short i = 0;
          while (f->value[i].getLen()) {
              getIndex(&f->value[i], &f->mask,chunk_size, ch, ind);
              
              addRuleToPoint(&nlines.lines[chunk_id].points[ind[0]], RULE_START, rid);
              addRuleToPoint(&nlines.lines[chunk_id].points[ind[1]], RULE_END, rid);
              
              i++;
          }
      }
      break;
    case FT_WILD:
    	// start point is the first point, no end
    	addRuleToPoint(&nlines.lines[chunk_id].points[0], RULE_START, rid);
    	break;
    default:
        throw Error("unknown filter type: %i", f->mtype); 
    }
}

int ClassifierRFC::findNumberLine(refer_t ref, unsigned short offs, unsigned short chunk,
                                  unsigned short chunk_size)
{
    for (unsigned short i = 0; i < nlines.lineCount; i++) {
        if ((nldscs[i].offs == offs + chunk*chunk_size) && 
            (nldscs[i].ref == ref) && 
            (nldscs[i].len == chunk_size)) {
            return i;
        }
    }

    return -1;
}

void ClassifierRFC::addNumberLineDescr(refer_t ref, unsigned short offs, unsigned short chunk,
                                       unsigned short chunk_size, FilterValue* dmask)
{
    // create new number line description
    nldscs[nlines.lineCount].offs = offs + chunk*chunk_size;
    nldscs[nlines.lineCount].len = chunk_size;
    nldscs[nlines.lineCount].ref = ref;
    if (chunk_size == 1) {
        nldscs[nlines.lineCount].mask = (unsigned short) dmask->getValue()[chunk];
    } else {
        nldscs[nlines.lineCount].mask = 
          *((unsigned short *) &dmask->getValue()[chunk*chunk_size]);
    }
}

void ClassifierRFC::addNumberLine(refer_t ref, unsigned short offs, unsigned short chunk,
                                  unsigned short chunk_size, FilterValue* dmask)
{
    int line_size = (chunk_size == 1) ? NUMBER_LINE_SIZE_8B : NUMBER_LINE_SIZE_16B;

    if (nlines.lineCount == MAX_CHUNKS) {
        throw Error("the maximum number of number lines is %d", MAX_CHUNKS);
    }
    
    addNumberLineDescr(ref, offs, chunk, chunk_size, dmask);
    
    // alloc memory
    nlines.lines[nlines.lineCount].line_size = line_size;
    nlines.lines[nlines.lineCount].points = new point_t[line_size];
    memset(nlines.lines[nlines.lineCount].points, 0, sizeof(point_t)*line_size);
    nlines.lineCount++;
}


// find equiv class (create a new in case there is no existing)
unsigned short ClassifierRFC::findEC(unsigned short phase, unsigned short chunk, bitmap_t *bmp)
{
    int eq;

    // find bitmap in equiv class list
    chunkBmListIter_t b = eqcl[phase][chunk].bms.find(bmp);

    if (b == eqcl[phase][chunk].bms.end()) {
        // add new class
        if (eqcl[phase][chunk].freeList.size() > 0) {
            // reuse id from free list
            eq = eqcl[phase][chunk].freeList.front();
            eqcl[phase][chunk].freeList.pop_front();
            // set bitmap and flags
            *eqcl[phase][chunk].eids[eq].bm = *bmp;
            eqcl[phase][chunk].eids[eq].refc = 1;
            // insert into bitmap map
            eqcl[phase][chunk].bms[eqcl[phase][chunk].eids[eq].bm] = eq;
        } else {
            bmInfo_t bmi; 

            bmi.bm = new bitmap_t;
            *bmi.bm = *bmp;
            bmi.refc = 1;
            
            // get a new id
            eq = eqcl[phase][chunk].maxId++;
            // insert
            eqcl[phase][chunk].eids.push_back(bmi);
            eqcl[phase][chunk].bms[bmi.bm] = eq;
        }
    } else {
        // use existing class
        eq = b->second;
        eqcl[phase][chunk].eids[eq].refc++;
    }	      

    return eq;
}

void ClassifierRFC::addPreAllocEC(unsigned short phase, unsigned short chunk, 
                                  unsigned short cnt)
{
    int eq;
    bitmap_t bmp;
    bmReset(&bmp);

    for (unsigned short i = 0; i < cnt; i++) {
        bmInfo_t bmi;

        bmi.bm = new bitmap_t;
        *bmi.bm = bmp;
        bmi.refc = 0;
     
        eq = eqcl[phase][chunk].maxId++;
        eqcl[phase][chunk].eids.push_back(bmi);
        // put on free list 
        eqcl[phase][chunk].freeList.push_back(eq);
    }
}

void ClassifierRFC::makeNewChunk(unsigned short phase, unsigned int size)
{
    unsigned short chunk = cdata.phases[phase].chunkCount++;
    // alloc chunk memory 
    cdata.phases[phase].chunks[chunk].entries = new unsigned short[size];
    memset(cdata.phases[phase].chunks[chunk].entries, 0, sizeof(unsigned short)*size);
    cdata.phases[phase].chunks[chunk].entryCount = size;
}

// intersect the bitmaps in phase 1-n
void ClassifierRFC::doIntersection(unsigned short phase, unsigned short chunk, 
                				   unsigned short parent, int *indx, bitmap_t *bm)
{
    int size = 0;
    unsigned short pchunk = cdata.phases[phase].chunks[chunk].parentChunks[parent];

    for (chunkEqClArrayIter_t ei = eqcl[phase-1][pchunk].eids.begin();
         ei != eqcl[phase-1][pchunk].eids.end(); ++ei) {
        bitmap_t rbmp;
        
#ifdef PREALLOC_EQUIV_CLASSES
        if (ei->refc == 0) {
            // adjust index
            size = 1;
            for (unsigned short i = parent+1; i < cdata.phases[phase].chunks[chunk].parentCount; i++) {
                size *= eqcl[phase-1][cdata.phases[phase].chunks[chunk].parentChunks[i]].maxId;
            }
            (*indx) += size;

            continue;
        }
#endif

        bmAnd(bm, ei->bm, &rbmp);
        
        // go into recursion until we reached the last parent
        if ((parent < cdata.phases[phase].chunks[chunk].parentCount-1)) {
            doIntersection(phase, chunk, parent+1, indx, &rbmp);
        } else {
            int eq = findEC(phase, chunk, &rbmp);
            cdata.phases[phase].chunks[chunk].entries[*indx] = eq;
            (*indx)++;
        }
    }
}
    
int ClassifierRFC::hasBackwardSpec(Rule *r)
{
    for (filterListIter_t fi = r->getFilter()->begin(); fi != r->getFilter()->end(); ++fi) {
        if (!fi->rname.empty()) {
            return 1;
        }
    }

    return 0;
}

/* ------------------------------------ debug ---------------------------------------------*/      

#ifdef DEBUG

void ClassifierRFC::printNumberLines()
{
    // print number lines for debug
    for (unsigned short i = 0; i < nlines.lineCount; i++) {
        // print each number line
        cout << "line: " << i << "(" << nldscs[i].offs << "," 
             << nldscs[i].len << ")" << nlines.lines[i].line_size << endl;
        for (unsigned int j = 0; j < nlines.lines[i].line_size; j++) {
            if (nlines.lines[i].points[j].ruleCount > 0) {
                cout << "point " << j << " rule# " << nlines.lines[i].points[j].ruleCount << endl;        
                for (unsigned short k = 0; k < nlines.lines[i].points[j].ruleCount; k++) {
                    cout << nlines.lines[i].points[j].rules[k].type << ":"
                         << nlines.lines[i].points[j].rules[k].rid << ",";
                }
                cout << endl;
            }
        }
        cout << endl << endl;
    }
}

void ClassifierRFC::printChunk(unsigned short phase, unsigned short chunk, int show_cdata)
{
    cout << "phase " << phase << " chunk " << chunk << ": " << eqcl[phase][chunk].maxId 
         << " equiv classes" << endl;
    // equiv classes
    for (unsigned short eq = 0; eq < (int) eqcl[phase][chunk].maxId; eq++) {
        cout << eq << ": ";
        if (eqcl[phase][chunk].eids[eq].bm != NULL) {
            bmPrint(eqcl[phase][chunk].eids[eq].bm);
            // print reference counter
            cout << "/" << eqcl[phase][chunk].eids[eq].refc;
        } else {
            cout << "-";
        }
        cout << endl;
    }
    // chunk data
    if (show_cdata) {
        for (unsigned int k = 0; k < cdata.phases[phase].chunks[chunk].entryCount; k++) {
            cout << k << " : " << cdata.phases[phase].chunks[chunk].entries[k] << endl;
        }
    }
    cout << endl << endl;
}

#endif

#ifdef PROFILING

void ClassifierRFC::printProfiling(struct timeval *t1, struct timeval *t2)
{
    cout << "Time: " << (t2->tv_sec*1e6+t2->tv_usec) - (t1->tv_sec*1e6+t1->tv_usec) 
         << "us" << endl;
    
    unsigned long mem = 0;
    for (unsigned short i = 0; i < cdata.phaseCount; i++) {
        for (unsigned short j = 0; j < cdata.phases[i].chunkCount; j++) {
            // final rule map
            if (i == cdata.phaseCount-1) {
                mem += eqcl[i][j].maxId * sizeof(matchingRules_t);
            }
            // equiv class list and revese mapping
            mem += eqcl[i][j].maxId * (sizeof(bitmap_t) + sizeof(bmInfo_t));
            mem += eqcl[i][j].bms.size() * (sizeof(bitmap_t*) + sizeof(equivID_t) + 16);
            mem += eqcl[i][j].freeList.size() * sizeof(equivID_t);
            // chunk memory
            mem += cdata.phases[i].chunks[j].entryCount * sizeof(equivID_t);
        }
    }
          
    cout << "Memory: " << mem/1024 << "kB" << endl;
}

#endif

void ClassifierRFC::genFinalMap(unsigned short phase)
{
    unsigned int size = cdata.phases[phase].chunks[0].entryCount;

    if (size != rmap_size) {
        matchingRules_t *new_rmap = new matchingRules_t[size];
        memset(new_rmap, 0, sizeof(matchingRules_t)*size);
        if (rmap != NULL) {
            memcpy(new_rmap, rmap, sizeof(matchingRules_t)*rmap_size);
            saveDeleteArr(rmap);
        }
        rmap = new_rmap;