Re: [pmacct-discussion] Layer 7 classification problem.

[Paolo Lucente]

Hi Mike,

On Mon, Nov 23, 2009 at 02:00:04PM +0300, Mike Lykov wrote:

> By the way, L7-filter have two types of filter:
> "The first speed shown for a pattern in the tables below is the speed when 
> used in the kernel (with the old V8 regular expression library). The second 
> is the speed when used in userspace (with the modern GNU library). "
> 
> i.e.userspace version uses GNU regex(7) library. Are pmacct using it also? 

pmacct only embeds the first one. I've written for you a quick patch
(attached) which leverages regex coming with the SO (typically POSIX
compliant). It works for me on a Linux (x86_64) and a Solaris (sparc)
with the http classifier from L7-filter project - but it's also true
everything was working fine at some quick testing before.

Let me know if you see any improvements. If this is the case, i can
either replace the current implementation or add a knob in the coming
release. The patch should apply fine to 0.12.0rc3; if not, please use
code in the CVS.

Cheers,
Paolo


diff -ur pmacct/src/classifier.c pmacct.class/src/classifier.c
--- pmacct/src/classifier.c	2009-10-31 12:46:10.000000000 +0100
+++ pmacct.class/src/classifier.c	2009-11-23 13:57:11.000000000 +0100
@@ -157,7 +157,13 @@
     payload[y] = '\0';
 
     while (class[j].id && j < max) {
-      if (class[j].pattern) ret = pm_regexec(class[j].pattern, payload);
+      char match;
+
+      if (class[j].pattern.buffer) {
+	ret = regexec(&class[j].pattern, payload, 0, (regmatch_t *) &match, 0);
+	if (!ret) ret = 1;
+	else ret = 0;
+      }
       else if (*class[j].func) {
 	cc_node = search_context_chain(fp, idx, class[j].protocol);
 	cc_rev_node = search_context_chain(fp, reverse, class[j].protocol);
@@ -370,11 +376,12 @@
         Log(LOG_ERR, "ERROR: Pattern in %s too long. A maximum of %d chars is allowed.\n", fname, MAX_PATTERN_LEN);
 	return 0;
       }
-      css->pattern = pm_regcomp(pre_process(line), &linelen);
-      if (!css->pattern) {
-	Log(LOG_ERR, "ERROR: Failed compiling regular expression for protocol '%s'\n", css->protocol);
-	return 0;
-      } 
+      memset(&css->pattern, 0, sizeof(css->pattern));
+      ret = regcomp(&css->pattern, pre_process(line), REG_EXTENDED|REG_ICASE|REG_NOSUB);
+      if (ret) {
+        Log(LOG_ERR, "ERROR: Failed compiling regular expression for protocol '%s' (%u)\n", css->protocol, ret);
+        return 0;
+      }
 
       datatype = done;
       break;
@@ -452,7 +459,7 @@
   }
 
   link_conntrack_helper(css);
-  css->pattern = NULL;
+  memset(&css->pattern, 0, sizeof(css->pattern));
   return 1;
 #else
   return 0;
diff -ur pmacct/src/classifier.h pmacct.class/src/classifier.h
--- pmacct/src/classifier.h	2006-11-19 16:16:07.000000000 +0100
+++ pmacct.class/src/classifier.h	2009-11-23 13:57:41.000000000 +0100
@@ -1,5 +1,5 @@
 #include <dirent.h>
-#include "regexp.h"
+#include <regex.h>
 #include "conntrack.h"
 
 /* defines */
@@ -27,7 +27,7 @@
 struct pkt_classifier {
   pm_class_t id;
   char protocol[MAX_PROTOCOL_LEN];
-  regexp *pattern;
+  regex_t pattern;
   pm_class_t (*func)(struct pkt_classifier_data *, int, void **, void **, void **);
   conntrack_helper ct_helper;
   void *extra;

_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists