2
0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-28 12:58:07 +00:00

9 Commits

Author SHA1 Message Date
John Johansen
91dd7527d9 Dfa minimization and unreachable state removal
Add basic Hopcroft based dfa minimization.  It currently does a simple
straight state comparison that can be quadratic in time to split partitions.
This is offset however by using hashing to setup the initial partitions so
that the number of states within a partition are relative few.

The hashing of states for initial partition setup is linear in time.  This
means the closer the initial partition set is to the final set, the closer
the algorithm is to completing in a linear time.  The hashing works as
follows:  For each state we know the number of transitions that are not
the default transition.  For each of of these we hash the set of letters
it can transition on using a simple djb2 hash algorithm.  This creates
a unique hash based on the number of transitions and the input it can
transition on.  If a state does not have the same hash we know it can not
the same as another because it either has a different number of transitions
or or transitions on a different set.

To further distiguish states, the number of transitions of each transitions
target state are added into the hash.  This serves to further distiguish
states as a transition to a state with a different number of transitions
can not possibly be reduced to an equivalent state.

A further distinction of states is made for accepting states in that
we know each state with a unique set of accept permissions must be in
its own partition to ensure the unique accept permissions are in the
final dfa.

The unreachable state removal is a basic walk of the dfa from the start
state marking all states that are reached.  It then sweeps any state not
reached away.  This does not do dead state removal where a non accepting
state gets into a loop that will never result in an accepting state.
2010-01-20 03:32:34 -08:00
John Johansen
dce395e7ad Add basic controls for dfa optimization 2010-01-08 04:30:56 -08:00
John Johansen
4f044e753c Add basic dfa stats and debug dumps for
equivelence classes
expr tree (add stats, update parser switch)
dfa
transition table
2010-01-08 02:17:45 -08:00
John Johansen
17a67d7227 Update parser to allow for multiple debug dump options via -D or --dump.
This will allow turning on and off various debug dumps as needed.
Multiple dump options can be specified as needed by using multiple
options.
  eg. apparmor_parser -D variables
      apparmor_parser -D dfa-tree -D dfa-simple-tree


The help option has also been updated to take an optional argument
to display help about give parameters, currently only dump is supported.

  eg.  apparmor_parser -h       # standard help
       apparmor_parser -h=dump  # dump info about --dump options

Also Enable the dfa expression tree dumps
2010-01-07 16:21:02 -08:00
Kees Cook
da6c9246f5 clear remaining $Id$ tags, since bzr does not suppor them 2009-11-11 10:44:26 -08:00
John Johansen
397ead10af add aare_reset_matchflags() to reset match flags
Signed-Off-By: Kees Cook <kees.cook@canonical.com>
2009-07-24 07:33:09 +00:00
John Johansen
814773b2e1 Update the parse to emit a 0 to seperate pairs in the dfa.
This was always the intended behavior and fixes a bug where
the dfa will match change profile rules using // seperator.
2008-03-13 16:46:19 +00:00
John Johansen
cd79c1ac77 update copyright dates 2007-04-11 08:12:51 +00:00
John Johansen
f3ba454d8c Add dfa support to the parser 2007-02-27 02:29:16 +00:00