Go to the documentation of this file.
66 const int list_id,
const bool eof);
69 const uint32_t input_len,
const uint64_t input_offset);
82 SCLogDebug(
"frame %p engine %p", frame, engine);
102 static int FrameStreamDataPrefilterFunc(
103 void *cb_data,
const uint8_t *input,
const uint32_t input_len,
const uint64_t input_offset)
106 SCLogDebug(
"prefilter: fsd %p { det_ctx:%p, transforms:%p, frame:%p, list_id:%d, idx:%u, "
107 "data_offset:%" PRIu64
"}, input: %p, input_len:%u, input_offset:%" PRIu64,
114 if (buffer == NULL) {
119 const int more_chunks = BufferSetup(fsd, buffer, input, input_len, input_offset);
122 const uint8_t *data = buffer->
inspect;
152 SCLogDebug(
"packet:%" PRIu64
", prefilter running on list %d -> frame field type %u",
154 if (
p->
proto == IPPROTO_UDP) {
165 const uint8_t *data = buffer->
inspect;
175 }
else if (
p->
proto == IPPROTO_TCP) {
187 memset(&fsd, 0,
sizeof(fsd));
190 if (SetupStreamCallbackData(&fsd, ssn, stream,
det_ctx,
ctx->transforms, frames,
frame,
191 ctx->list_id, eof)) {
199 ", prefilter done running on list %d -> frame field type %u; have %u matches",
203 static void PrefilterMpmFrameFree(
void *ptr)
221 mpm_reg->
frame_v1.type, pectx, PrefilterMpmFrameFree, mpm_reg->
pname);
246 SCLogDebug(
"sid %u: e %p Callback returned false",
s->
id, e);
249 "sid %u: e %p not for frame type %u (want %u)",
s->
id, e,
frame->
type, e->type);
271 const uint32_t data_len = frame_len;
273 SCLogDebug(
"packet %" PRIu64
" -> frame %p/%" PRIi64
"/%s offset %" PRIu64
274 " type %u len %" PRIi64,
281 buffer->
flags = ci_flags;
324 const uint32_t input_len,
const uint64_t input_offset)
328 const uint64_t so_input_re = input_offset + input_len;
329 const uint64_t so_frame_re =
332 const uint8_t *data = input;
333 uint8_t ci_flags = 0;
337 uint64_t fo_inspect_offset = 0;
350 data_len = input_len;
354 const uint64_t so_inspect_offset =
MAX(input_offset, so_frame_inspect_offset);
355 fo_inspect_offset = so_inspect_offset -
frame->
offset;
362 if (fo_inspect_offset >= (uint64_t)
frame->
len) {
363 SCLogDebug(
"data entirely past frame (%" PRIu64
" > %" PRIi64
")",
370 BUG_ON(so_inspect_offset < input_offset);
371 const uint32_t in_data_offset = so_inspect_offset - input_offset;
372 data += in_data_offset;
374 uint32_t in_data_excess = 0;
375 if (so_input_re >= so_frame_re) {
378 in_data_excess = so_input_re - so_frame_re;
380 data_len = input_len - in_data_offset - in_data_excess;
383 BUG_ON(so_inspect_offset < input_offset);
384 const uint32_t in_data_offset = so_inspect_offset - input_offset;
385 data += in_data_offset;
386 data_len = input_len - in_data_offset;
392 SCLogDebug(
"inspect_offset %" PRIu64, fo_inspect_offset);
394 buffer->
flags = ci_flags;
396 if (
frame->
len >= 0 && so_input_re >= so_frame_re) {
397 SCLogDebug(
"have the full frame, we can set progress accordingly (%" PRIu64
" > %" PRIu64
399 so_input_re, so_frame_re);
418 const bool ret = (
frame->
len >= 0 && so_input_re >= so_frame_re);
423 static int FrameStreamDataInspectFunc(
424 void *cb_data,
const uint8_t *input,
const uint32_t input_len,
const uint64_t input_offset)
427 SCLogDebug(
"inspect: fsd %p { det_ctx:%p, transforms:%p, s:%p, s->id:%u, frame:%p, list_id:%d, "
429 "requested_stream_offset:%" PRIu64
430 "}, input: %p, input_len:%u, input_offset:%" PRIu64,
437 if (buffer == NULL) {
445 more_chunks = BufferSetup(fsd, buffer, input, input_len, input_offset);
453 const uint8_t *data = buffer->
inspect;
462 const uint8_t ci_flags = buffer->
flags;
463 SCLogDebug(
"frame %p offset %" PRIu64
" type %u len %" PRIi64
464 " ci_flags %02x (start:%s, end:%s)",
468 SCLogDebug(
"buffer %p offset %" PRIu64
" len %u ci_flags %02x (start:%s, end:%s)", buffer,
478 p->
flow, data, data_len, data_offset, buffer->
flags,
481 SCLogDebug(
"DETECT_ENGINE_INSPECT_SIG_MATCH");
484 SCLogDebug(
"DETECT_ENGINE_INSPECT_SIG_NO_MATCH");
492 const int list_id,
const bool eof)
494 SCLogDebug(
"frame %" PRIi64
", len %" PRIi64
", offset %" PRIu64
", inspect_progress %" PRIu64,
499 if (usable <= frame_offset)
520 const uint64_t have = usable;
521 if (!ips && have < want) {
522 SCLogDebug(
"wanted %" PRIu64
" bytes, got %" PRIu64, want, have);
527 SCLogDebug(
"check inspection for having 2500 bytes: %" PRIu64, available_data);
528 if (!ips && !eof && available_data < 2500 &&
530 SCLogDebug(
"skip inspection until we have 2500 bytes (have %" PRIu64
")", available_data);
569 if (
p->
proto == IPPROTO_UDP) {
574 SCLogDebug(
"packet:%" PRIu64
", frame->id:%" PRIu64
575 ", list:%d, transforms:%p, s:%p, s->id:%u, engine:%p",
589 memset(&fsd, 0,
sizeof(fsd));
595 if (!SetupStreamCallbackData(
struct PrefilterMpmFrameCtx PrefilterMpmFrameCtx
uint64_t inspect_progress
struct DetectBufferMpmRegistry_::@87::@91 frame_v1
#define DETECT_CI_FLAGS_START
union PrefilterEngine_::@101 ctx
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
#define PREFILTER_PROFILING_END(ctx, profile_id)
uint32_t rule_id_array_cnt
Container for matching data for a signature group.
bool StreamTcpInlineMode(void)
See if stream engine is operating in inline mode.
uint64_t requested_stream_offset
#define PREFILTER_PROFILING_START(det_ctx)
const DetectEngineTransforms * transforms
main detection engine ctx
DetectEngineThreadCtx * det_ctx
one time registration of keywords at start up
const DetectEngineFrameInspectionEngine * inspect_engine
int PrefilterGenericMpmFrameRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
bool DetectRunFrameInspectRule(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, const Signature *s, Flow *f, Packet *p, const Frames *frames, const Frame *frame)
int PrefilterAppendFrameEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh, PrefilterFrameFn PrefilterFrameFunc, AppProto alproto, uint8_t frame_type, void *pectx, void(*FreeFunc)(void *pectx), const char *name)
DetectEngineTransforms transforms
void DetectRunPrefilterFrame(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const Frames *frames, const Frame *frame, const AppProto alproto)
DetectEngineFrameInspectionEngine * frame_inspect
const DetectEngineTransforms * transforms
union PrefilterEngine_::@102 cb
void InspectionBufferSetupMultiEmpty(InspectionBuffer *buffer)
setup the buffer empty
#define PKT_IS_TOSERVER(p)
const char * AppLayerParserGetFrameNameById(uint8_t ipproto, AppProto alproto, const uint8_t id)
#define STREAM_BASE_OFFSET(stream)
Per thread variable structure.
#define DETECT_ENGINE_INSPECT_SIG_MATCH
const DetectEngineTransforms * transforms
#define DETECT_CI_FLAGS_END
PrefilterFrameFn PrefilterFrame
uint32_t(* Search)(const struct MpmCtx_ *, struct MpmThreadCtx_ *, PrefilterRuleStore *, const uint8_t *, uint32_t)
PrefilterEngine * frame_engines
#define PREFILTER_PROFILING_ADD_BYTES(det_ctx, bytes)
@ DETECT_ENGINE_CONTENT_INSPECTION_MODE_FRAME
struct DetectEngineFrameInspectionEngine * next
int DetectEngineInspectFrameBufferGeneric(DetectEngineThreadCtx *det_ctx, const DetectEngineFrameInspectionEngine *engine, const Signature *s, Packet *p, const Frames *frames, const Frame *frame)
Do the content inspection & validation for a signature.
uint64_t frame_inspect_progress
struct DetectEngineFrameInspectionEngine::@83 v1
#define DETECT_ENGINE_INSPECT_SIG_NO_MATCH
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
uint64_t StreamDataRightEdge(const TcpStream *stream, const bool eof)
InspectionBuffer * InspectionBufferMultipleForListGet(DetectEngineThreadCtx *det_ctx, const int list_id, const uint32_t local_id)
for a InspectionBufferMultipleForList get a InspectionBuffer
bool DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const Signature *s, const SigMatchData *smd, Packet *p, Flow *f, const uint8_t *buffer, const uint32_t buffer_len, const uint32_t stream_start_offset, const uint8_t flags, const enum DetectContentInspectionType inspection_mode)
wrapper around DetectEngineContentInspectionInternal to return true/false only
AppProto alproto
application level protocol
void InspectionBufferSetupMulti(DetectEngineThreadCtx *det_ctx, InspectionBuffer *buffer, const DetectEngineTransforms *transforms, const uint8_t *data, const uint32_t data_len)
setup the buffer with our initial data
int StreamReassembleForFrame(TcpSession *ssn, TcpStream *stream, StreamReassembleRawFunc Callback, void *cb_data, const uint64_t offset, const bool eof)
#define DEBUG_VALIDATE_BUG_ON(exp)