suricata
detect-engine-frame.c
Go to the documentation of this file.
1 /* Copyright (C) 2021-2023 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  */
24 
25 #include "suricata-common.h"
26 #include "suricata.h"
27 
28 #include "app-layer-parser.h"
29 #include "app-layer-frames.h"
30 
31 #include "detect-engine.h"
34 #include "detect-engine-mpm.h"
35 #include "detect-engine-frame.h"
36 
37 #include "stream-tcp.h"
38 
39 #include "util-profiling.h"
40 #include "util-validate.h"
41 #include "util-print.h"
42 
44  // shared between prefilter and inspect
47  const Frame *frame;
48  int list_id;
49  uint32_t idx; /**< multi buffer idx, incremented for each stream chunk */
50 
51  // inspection only
53  const Signature *s;
54  int inspect_result; // DETECT_ENGINE_INSPECT_SIG_MATCH / DETECT_ENGINE_INSPECT_SIG_NO_MATCH
56 
57  // prefilter only
58  const MpmCtx *mpm_ctx;
59 
61 };
62 
63 static bool SetupStreamCallbackData(struct FrameStreamData *dst, const TcpSession *ssn,
64  const TcpStream *stream, DetectEngineThreadCtx *det_ctx,
65  const DetectEngineTransforms *transforms, const Frames *_frames, const Frame *frame,
66  const int list_id, const bool eof);
67 
68 static bool BufferSetup(struct FrameStreamData *fsd, InspectionBuffer *buffer, const uint8_t *input,
69  const uint32_t input_len, const uint64_t input_offset);
70 static void BufferSetupUdp(DetectEngineThreadCtx *det_ctx, InspectionBuffer *buffer,
71  const Frame *frame, const Packet *p, const DetectEngineTransforms *transforms);
72 
74  const Frames *frames, const Frame *frame, const AppProto alproto)
75 {
76  SCLogDebug("pcap_cnt %" PRIu64, p->pcap_cnt);
77  PrefilterEngine *engine = sgh->frame_engines;
78  do {
79  if ((engine->alproto == alproto || engine->alproto == ALPROTO_UNKNOWN) &&
80  (engine->ctx.frame_type == frame->type ||
81  engine->ctx.frame_type == FRAME_ANY_TYPE)) {
82  SCLogDebug("frame %p engine %p", frame, engine);
84  engine->cb.PrefilterFrame(det_ctx, engine->pectx, p, frames, frame);
85  PREFILTER_PROFILING_END(det_ctx, engine->gid);
86  }
87  if (engine->is_last)
88  break;
89  engine++;
90  } while (1);
91 }
92 
93 /* generic mpm for frame engines */
94 
95 // TODO same as Generic?
96 typedef struct PrefilterMpmFrameCtx {
97  int list_id;
98  const MpmCtx *mpm_ctx;
101 
102 static int FrameStreamDataPrefilterFunc(
103  void *cb_data, const uint8_t *input, const uint32_t input_len, const uint64_t input_offset)
104 {
105  struct FrameStreamData *fsd = cb_data;
106  SCLogDebug("prefilter: fsd %p { det_ctx:%p, transforms:%p, frame:%p, list_id:%d, idx:%u, "
107  "data_offset:%" PRIu64 "}, input: %p, input_len:%u, input_offset:%" PRIu64,
108  fsd, fsd->det_ctx, fsd->transforms, fsd->frame, fsd->list_id, fsd->idx,
109  fsd->requested_stream_offset, input, input_len, input_offset);
110  // PrintRawDataFp(stdout, input, input_len);
111 
112  InspectionBuffer *buffer =
114  if (buffer == NULL) {
115  return 0;
116  }
117  SCLogDebug("buffer %p idx %u", buffer, fsd->idx);
118 
119  const int more_chunks = BufferSetup(fsd, buffer, input, input_len, input_offset);
120 
121  const uint32_t data_len = buffer->inspect_len;
122  const uint8_t *data = buffer->inspect;
124  const MpmCtx *mpm_ctx = fsd->mpm_ctx;
125 
126  if (data != NULL && data_len >= mpm_ctx->minlen) {
127  // PrintRawDataFp(stdout, data, data_len);
128 
130  mpm_ctx, &det_ctx->mtc, &det_ctx->pmq, data, data_len);
131  SCLogDebug("det_ctx->pmq.rule_id_array_cnt %u", det_ctx->pmq.rule_id_array_cnt);
133  }
134  return more_chunks;
135 }
136 
137 /** \brief Generic Mpm prefilter callback
138  *
139  * \param det_ctx detection engine thread ctx
140  * \param frames container for the frames
141  * \param frame frame to inspect
142  * \param pectx inspection context
143  */
144 static void PrefilterMpmFrame(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p,
145  const Frames *frames, const Frame *frame)
146 {
147  SCEnter();
148 
149  const PrefilterMpmFrameCtx *ctx = (const PrefilterMpmFrameCtx *)pectx;
150  const MpmCtx *mpm_ctx = ctx->mpm_ctx;
151 
152  SCLogDebug("packet:%" PRIu64 ", prefilter running on list %d -> frame field type %u",
153  p->pcap_cnt, ctx->list_id, frame->type);
154  if (p->proto == IPPROTO_UDP) {
155  // TODO can we use single here? Could it conflict with TCP?
157  if (buffer == NULL)
158  return;
160  if (frame->offset >= p->payload_len)
161  return;
162 
163  BufferSetupUdp(det_ctx, buffer, frame, p, ctx->transforms);
164  const uint32_t data_len = buffer->inspect_len;
165  const uint8_t *data = buffer->inspect;
166 
167  // PrintRawDataFp(stdout, data, data_len);
168 
169  if (data != NULL && data_len >= mpm_ctx->minlen) {
171  mpm_ctx, &det_ctx->mtc, &det_ctx->pmq, data, data_len);
172  SCLogDebug("det_ctx->pmq.rule_id_array_cnt %u", det_ctx->pmq.rule_id_array_cnt);
174  }
175  } else if (p->proto == IPPROTO_TCP) {
176  BUG_ON(p->flow->protoctx == NULL);
177  TcpSession *ssn = p->flow->protoctx;
178  TcpStream *stream;
179  if (PKT_IS_TOSERVER(p)) {
180  stream = &ssn->client;
181  } else {
182  stream = &ssn->server;
183  }
184  const bool eof = ssn->state == TCP_CLOSED || PKT_IS_PSEUDOPKT(p);
185 
186  struct FrameStreamData fsd;
187  memset(&fsd, 0, sizeof(fsd));
188  fsd.mpm_ctx = mpm_ctx;
189 
190  if (SetupStreamCallbackData(&fsd, ssn, stream, det_ctx, ctx->transforms, frames, frame,
191  ctx->list_id, eof)) {
192  StreamReassembleForFrame(ssn, stream, FrameStreamDataPrefilterFunc, &fsd,
193  fsd.requested_stream_offset, eof);
194  }
195  } else {
197  }
198  SCLogDebug("packet:%" PRIu64
199  ", prefilter done running on list %d -> frame field type %u; have %u matches",
201 }
202 
203 static void PrefilterMpmFrameFree(void *ptr)
204 {
205  SCFree(ptr);
206 }
207 
209  const DetectBufferMpmRegistry *mpm_reg, int list_id)
210 {
211  SCEnter();
212  PrefilterMpmFrameCtx *pectx = SCCalloc(1, sizeof(*pectx));
213  if (pectx == NULL)
214  return -1;
215  pectx->list_id = list_id;
216  BUG_ON(mpm_reg->frame_v1.alproto == ALPROTO_UNKNOWN);
217  pectx->mpm_ctx = mpm_ctx;
218  pectx->transforms = &mpm_reg->transforms;
219 
220  int r = PrefilterAppendFrameEngine(de_ctx, sgh, PrefilterMpmFrame, mpm_reg->frame_v1.alproto,
221  mpm_reg->frame_v1.type, pectx, PrefilterMpmFrameFree, mpm_reg->pname);
222  if (r != 0) {
223  SCFree(pectx);
224  }
225  return r;
226 }
227 
229  Flow *f, Packet *p, const Frames *frames, const Frame *frame)
230 {
231  BUG_ON(s->frame_inspect == NULL);
232 
233  SCLogDebug("inspecting rule %u against frame %p/%" PRIi64 "/%s", s->id, frame, frame->id,
235 
236  for (DetectEngineFrameInspectionEngine *e = s->frame_inspect; e != NULL; e = e->next) {
237  if (frame->type == e->type) {
238  // TODO check alproto, direction?
239 
240  // TODO there should be only one inspect engine for this frame, ever?
241 
242  if (e->v1.Callback(det_ctx, e, s, p, frames, frame)) {
243  SCLogDebug("sid %u: e %p Callback returned true", s->id, e);
244  return true;
245  }
246  SCLogDebug("sid %u: e %p Callback returned false", s->id, e);
247  } else {
248  SCLogDebug(
249  "sid %u: e %p not for frame type %u (want %u)", s->id, e, frame->type, e->type);
250  }
251  }
252  return false;
253 }
254 
255 static void BufferSetupUdp(DetectEngineThreadCtx *det_ctx, InspectionBuffer *buffer,
256  const Frame *frame, const Packet *p, const DetectEngineTransforms *transforms)
257 {
258  uint8_t ci_flags = DETECT_CI_FLAGS_START;
259  uint32_t frame_len;
260  if (frame->len == -1) {
261  frame_len = p->payload_len - frame->offset;
262  } else {
263  frame_len = (uint32_t)frame->len;
264  }
265  if (frame->offset + frame_len > p->payload_len) {
266  frame_len = p->payload_len - frame->offset;
267  } else {
268  ci_flags |= DETECT_CI_FLAGS_END;
269  }
270  const uint8_t *data = p->payload + frame->offset;
271  const uint32_t data_len = frame_len;
272 
273  SCLogDebug("packet %" PRIu64 " -> frame %p/%" PRIi64 "/%s offset %" PRIu64
274  " type %u len %" PRIi64,
275  p->pcap_cnt, frame, frame->id,
277  frame->offset, frame->type, frame->len);
278 
279  InspectionBufferSetupMulti(det_ctx, buffer, transforms, data, data_len);
280  buffer->inspect_offset = 0;
281  buffer->flags = ci_flags;
282 }
283 
284 /** \internal
285  * \brief setup buffer based on frame in UDP payload
286  */
287 static int DetectFrameInspectUdp(DetectEngineThreadCtx *det_ctx,
288  const DetectEngineFrameInspectionEngine *engine, const Signature *s,
289  const DetectEngineTransforms *transforms, Packet *p, const Frames *_frames,
290  const Frame *frame, const int list_id)
291 {
292  SCLogDebug("packet:%" PRIu64 ", inspect: s:%p s->id:%u, transforms:%p", p->pcap_cnt, s, s->id,
293  transforms);
294 
295  // TODO can we use single here? Could it conflict with TCP?
297  if (buffer == NULL)
299 
301  if (frame->offset >= p->payload_len)
303 
304  if (!buffer->initialized)
305  BufferSetupUdp(det_ctx, buffer, frame, p, transforms);
307  if (buffer->inspect == NULL)
309 
310  const bool match = DetectEngineContentInspection(det_ctx->de_ctx, det_ctx, s, engine->smd, p,
311  p->flow, buffer->inspect, buffer->inspect_len, 0, buffer->flags,
313  if (match) {
314  SCLogDebug("match!");
316  } else {
318  }
319 }
320 
321 /**
322  * \retval bool true if callback should run again */
323 static bool BufferSetup(struct FrameStreamData *fsd, InspectionBuffer *buffer, const uint8_t *input,
324  const uint32_t input_len, const uint64_t input_offset)
325 {
326  const Frame *frame = fsd->frame;
327  /* so: relative to start of stream */
328  const uint64_t so_input_re = input_offset + input_len;
329  const uint64_t so_frame_re =
330  frame->offset + (uint64_t)frame->len; // TODO if eof, set to available data?
331  SCLogDebug("frame offset:%" PRIu64, frame->offset);
332  const uint8_t *data = input;
333  uint8_t ci_flags = 0;
334  uint32_t data_len;
335 
336  /* fo: frame offset; offset relative to start of the frame */
337  uint64_t fo_inspect_offset = 0;
338 
339  if (frame->offset == 0 && input_offset == 0) {
340  ci_flags |= DETECT_CI_FLAGS_START;
341  SCLogDebug("have frame data start");
342 
343  if (frame->len >= 0) {
344  data_len = MIN(input_len, frame->len);
345  if (data_len == frame->len) {
346  ci_flags |= DETECT_CI_FLAGS_END;
347  SCLogDebug("have frame data end");
348  }
349  } else {
350  data_len = input_len;
351  }
352  } else {
353  const uint64_t so_frame_inspect_offset = frame->inspect_progress + frame->offset;
354  const uint64_t so_inspect_offset = MAX(input_offset, so_frame_inspect_offset);
355  fo_inspect_offset = so_inspect_offset - frame->offset;
356 
357  if (frame->offset >= input_offset) {
358  ci_flags |= DETECT_CI_FLAGS_START;
359  SCLogDebug("have frame data start");
360  }
361  if (frame->len >= 0) {
362  if (fo_inspect_offset >= (uint64_t)frame->len) {
363  SCLogDebug("data entirely past frame (%" PRIu64 " > %" PRIi64 ")",
364  fo_inspect_offset, frame->len);
366  return false;
367  }
368 
369  /* in: relative to start of input data */
370  BUG_ON(so_inspect_offset < input_offset);
371  const uint32_t in_data_offset = so_inspect_offset - input_offset;
372  data += in_data_offset;
373 
374  uint32_t in_data_excess = 0;
375  if (so_input_re >= so_frame_re) {
376  ci_flags |= DETECT_CI_FLAGS_END;
377  SCLogDebug("have frame data end");
378  in_data_excess = so_input_re - so_frame_re;
379  }
380  data_len = input_len - in_data_offset - in_data_excess;
381  } else {
382  /* in: relative to start of input data */
383  BUG_ON(so_inspect_offset < input_offset);
384  const uint32_t in_data_offset = so_inspect_offset - input_offset;
385  data += in_data_offset;
386  data_len = input_len - in_data_offset;
387  }
388  }
389  // PrintRawDataFp(stdout, data, data_len);
390  SCLogDebug("fsd->transforms %p", fsd->transforms);
391  InspectionBufferSetupMulti(fsd->det_ctx, buffer, fsd->transforms, data, data_len);
392  SCLogDebug("inspect_offset %" PRIu64, fo_inspect_offset);
393  buffer->inspect_offset = fo_inspect_offset;
394  buffer->flags = ci_flags;
395 
396  if (frame->len >= 0 && so_input_re >= so_frame_re) {
397  SCLogDebug("have the full frame, we can set progress accordingly (%" PRIu64 " > %" PRIu64
398  ")",
399  so_input_re, so_frame_re);
401  MAX(fo_inspect_offset + data_len, fsd->det_ctx->frame_inspect_progress);
402  } else {
404  MAX(fo_inspect_offset + data_len, fsd->det_ctx->frame_inspect_progress);
405  /* in IPS mode keep a sliding window */
406  const bool ips = StreamTcpInlineMode();
407  if (ips) {
408  if (fsd->det_ctx->frame_inspect_progress < 2500)
410  else
411  fsd->det_ctx->frame_inspect_progress -= 2500;
412  }
413  SCLogDebug("ips %s inspect_progress %" PRIu64, BOOL2STR(ips),
415  }
416 
417  /* keep going as long as there is possibly still data for this frame */
418  const bool ret = (frame->len >= 0 && so_input_re >= so_frame_re);
419  SCLogDebug("buffer set up, more to do: %s", BOOL2STR(ret));
420  return ret;
421 }
422 
423 static int FrameStreamDataInspectFunc(
424  void *cb_data, const uint8_t *input, const uint32_t input_len, const uint64_t input_offset)
425 {
426  struct FrameStreamData *fsd = cb_data;
427  SCLogDebug("inspect: fsd %p { det_ctx:%p, transforms:%p, s:%p, s->id:%u, frame:%p, list_id:%d, "
428  "idx:%u, "
429  "requested_stream_offset:%" PRIu64
430  "}, input: %p, input_len:%u, input_offset:%" PRIu64,
431  fsd, fsd->det_ctx, fsd->transforms, fsd->s, fsd->s->id, fsd->frame, fsd->list_id,
432  fsd->idx, fsd->requested_stream_offset, input, input_len, input_offset);
433  // PrintRawDataFp(stdout, input, input_len);
434 
435  InspectionBuffer *buffer =
437  if (buffer == NULL) {
438  return 0;
439  }
440  SCLogDebug("buffer %p idx %u", buffer, fsd->idx);
441 
442  /* if we've not done so already, set up the buffer */
443  int more_chunks = 1;
444  if (!buffer->initialized) {
445  more_chunks = BufferSetup(fsd, buffer, input, input_len, input_offset);
446  }
448  if (buffer->inspect == NULL) {
449  return more_chunks;
450  }
451 
452  const uint32_t data_len = buffer->inspect_len;
453  const uint8_t *data = buffer->inspect;
454  const uint64_t data_offset = buffer->inspect_offset;
456 
458  const Signature *s = fsd->s;
459  Packet *p = fsd->p;
460 
461 #ifdef DEBUG
462  const uint8_t ci_flags = buffer->flags;
463  SCLogDebug("frame %p offset %" PRIu64 " type %u len %" PRIi64
464  " ci_flags %02x (start:%s, end:%s)",
465  fsd->frame, fsd->frame->offset, fsd->frame->type, fsd->frame->len, ci_flags,
466  (ci_flags & DETECT_CI_FLAGS_START) ? "true" : "false",
467  (ci_flags & DETECT_CI_FLAGS_END) ? "true" : "false");
468  SCLogDebug("buffer %p offset %" PRIu64 " len %u ci_flags %02x (start:%s, end:%s)", buffer,
469  buffer->inspect_offset, buffer->inspect_len, ci_flags,
470  (ci_flags & DETECT_CI_FLAGS_START) ? "true" : "false",
471  (ci_flags & DETECT_CI_FLAGS_END) ? "true" : "false");
472  // PrintRawDataFp(stdout, data, data_len);
473  // PrintRawDataFp(stdout, data, MIN(64, data_len));
474 #endif
475  BUG_ON(fsd->frame->len > 0 && (int64_t)data_len > fsd->frame->len);
476 
477  const bool match = DetectEngineContentInspection(det_ctx->de_ctx, det_ctx, s, engine->smd, p,
478  p->flow, data, data_len, data_offset, buffer->flags,
480  if (match) {
481  SCLogDebug("DETECT_ENGINE_INSPECT_SIG_MATCH");
483  } else {
484  SCLogDebug("DETECT_ENGINE_INSPECT_SIG_NO_MATCH");
485  }
486  return more_chunks;
487 }
488 
489 static bool SetupStreamCallbackData(struct FrameStreamData *dst, const TcpSession *ssn,
490  const TcpStream *stream, DetectEngineThreadCtx *det_ctx,
491  const DetectEngineTransforms *transforms, const Frames *_frames, const Frame *frame,
492  const int list_id, const bool eof)
493 {
494  SCLogDebug("frame %" PRIi64 ", len %" PRIi64 ", offset %" PRIu64 ", inspect_progress %" PRIu64,
496 
497  const uint64_t frame_offset = frame->offset;
498  const uint64_t usable = StreamDataRightEdge(stream, eof);
499  if (usable <= frame_offset)
500  return false;
501 
502  uint64_t want = frame->inspect_progress;
503  if (frame->len == -1) {
504  if (eof) {
505  want = usable;
506  } else {
507  want += 2500;
508  }
509  } else {
510  /* don't have the full frame yet */
511  if (frame->offset + frame->len > usable) {
512  want += 2500;
513  } else {
514  want = frame->offset + frame->len;
515  }
516  }
517 
518  const bool ips = StreamTcpInlineMode();
519 
520  const uint64_t have = usable;
521  if (!ips && have < want) {
522  SCLogDebug("wanted %" PRIu64 " bytes, got %" PRIu64, want, have);
523  return false;
524  }
525 
526  const uint64_t available_data = usable - STREAM_BASE_OFFSET(stream);
527  SCLogDebug("check inspection for having 2500 bytes: %" PRIu64, available_data);
528  if (!ips && !eof && available_data < 2500 &&
529  (frame->len < 0 || frame->len > (int64_t)available_data)) {
530  SCLogDebug("skip inspection until we have 2500 bytes (have %" PRIu64 ")", available_data);
531  return false;
532  }
533 
534  const uint64_t offset =
536 
537  dst->det_ctx = det_ctx;
538  dst->transforms = transforms;
539  dst->frame = frame;
540  dst->list_id = list_id;
541  dst->requested_stream_offset = offset;
542  return true;
543 }
544 
545 /**
546  * \brief Do the content inspection & validation for a signature
547  *
548  * \param de_ctx Detection engine context
549  * \param det_ctx Detection engine thread context
550  * \param s Signature to inspect
551  * \param p Packet
552  * \param frame stream frame to inspect
553  *
554  * \retval 0 no match.
555  * \retval 1 match.
556  */
558  const DetectEngineFrameInspectionEngine *engine, const Signature *s, Packet *p,
559  const Frames *frames, const Frame *frame)
560 {
561  /* if prefilter didn't already run, we need to consider transformations */
562  const DetectEngineTransforms *transforms = NULL;
563  if (!engine->mpm) {
564  transforms = engine->v1.transforms;
565  }
566  const int list_id = engine->sm_list;
567  SCLogDebug("running inspect on %d", list_id);
568 
569  if (p->proto == IPPROTO_UDP) {
570  return DetectFrameInspectUdp(det_ctx, engine, s, transforms, p, frames, frame, list_id);
571  }
572  DEBUG_VALIDATE_BUG_ON(p->proto != IPPROTO_TCP);
573 
574  SCLogDebug("packet:%" PRIu64 ", frame->id:%" PRIu64
575  ", list:%d, transforms:%p, s:%p, s->id:%u, engine:%p",
576  p->pcap_cnt, frame->id, engine->sm_list, engine->v1.transforms, s, s->id, engine);
577 
578  BUG_ON(p->flow->protoctx == NULL);
579  TcpSession *ssn = p->flow->protoctx;
580  TcpStream *stream;
581  if (PKT_IS_TOSERVER(p)) {
582  stream = &ssn->client;
583  } else {
584  stream = &ssn->server;
585  }
586  const bool eof = ssn->state == TCP_CLOSED || PKT_IS_PSEUDOPKT(p);
587 
588  struct FrameStreamData fsd;
589  memset(&fsd, 0, sizeof(fsd));
590  fsd.inspect_engine = engine;
591  fsd.s = s;
593  fsd.p = p;
594 
595  if (!SetupStreamCallbackData(
596  &fsd, ssn, stream, det_ctx, transforms, frames, frame, list_id, eof)) {
598  }
600  ssn, stream, FrameStreamDataInspectFunc, &fsd, fsd.requested_stream_offset, eof);
601 
602  return fsd.inspect_result;
603 }
PrefilterMpmFrameCtx
struct PrefilterMpmFrameCtx PrefilterMpmFrameCtx
PrefilterMpmFrameCtx::list_id
int list_id
Definition: detect-engine-frame.c:97
Packet_::proto
uint8_t proto
Definition: decode.h:506
TcpStream_
Definition: stream-tcp-private.h:106
Frame::inspect_progress
uint64_t inspect_progress
Definition: app-layer-frames.h:55
MpmCtx_::mpm_type
uint8_t mpm_type
Definition: util-mpm.h:95
detect-engine.h
DetectBufferMpmRegistry_::frame_v1
struct DetectBufferMpmRegistry_::@87::@91 frame_v1
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
DETECT_CI_FLAGS_START
#define DETECT_CI_FLAGS_START
Definition: detect-engine-content-inspection.h:40
PrefilterEngine_::ctx
union PrefilterEngine_::@101 ctx
PKT_IS_PSEUDOPKT
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Definition: decode.h:1297
PREFILTER_PROFILING_END
#define PREFILTER_PROFILING_END(ctx, profile_id)
Definition: util-profiling.h:276
InspectionBuffer::initialized
bool initialized
Definition: detect.h:384
stream-tcp.h
PrefilterRuleStore_::rule_id_array_cnt
uint32_t rule_id_array_cnt
Definition: util-prefilter.h:40
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1570
StreamTcpInlineMode
bool StreamTcpInlineMode(void)
See if stream engine is operating in inline mode.
Definition: stream-tcp.c:7099
DetectEngineTransforms
Definition: detect.h:415
FrameStreamData::requested_stream_offset
uint64_t requested_stream_offset
Definition: detect-engine-frame.c:60
FrameStreamData::frame
const Frame * frame
Definition: detect-engine-frame.c:47
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:609
Flow_::proto
uint8_t proto
Definition: flow.h:378
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:85
Packet_::payload
uint8_t * payload
Definition: decode.h:588
InspectionBuffer
Definition: detect.h:380
Frame::offset
uint64_t offset
Definition: app-layer-frames.h:51
FrameStreamData::list_id
int list_id
Definition: detect-engine-frame.c:48
Frame
Definition: app-layer-frames.h:45
Flow_
Flow data structure.
Definition: flow.h:356
PREFILTER_PROFILING_START
#define PREFILTER_PROFILING_START(det_ctx)
Definition: util-profiling.h:260
DetectEngineThreadCtx_::pmq
PrefilterRuleStore pmq
Definition: detect.h:1298
ctx
struct Thresholds ctx
DetectEngineFrameInspectionEngine::transforms
const DetectEngineTransforms * transforms
Definition: detect.h:531
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:920
DetectEngineFrameInspectionEngine::mpm
bool mpm
Definition: detect.h:525
Frame::id
int64_t id
Definition: app-layer-frames.h:53
FrameStreamData::mpm_ctx
const MpmCtx * mpm_ctx
Definition: detect-engine-frame.c:58
FrameStreamData::det_ctx
DetectEngineThreadCtx * det_ctx
Definition: detect-engine-frame.c:45
PrefilterMpmFrameCtx::mpm_ctx
const MpmCtx * mpm_ctx
Definition: detect-engine-frame.c:98
MIN
#define MIN(x, y)
Definition: suricata-common.h:400
Frames
Definition: app-layer-frames.h:60
DetectBufferMpmRegistry_
one time registration of keywords at start up
Definition: detect.h:763
InspectionBuffer::flags
uint8_t flags
Definition: detect.h:385
detect-engine-frame.h
FrameStreamData::inspect_engine
const DetectEngineFrameInspectionEngine * inspect_engine
Definition: detect-engine-frame.c:52
PrefilterGenericMpmFrameRegister
int PrefilterGenericMpmFrameRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-frame.c:208
MAX
#define MAX(x, y)
Definition: suricata-common.h:404
DetectRunFrameInspectRule
bool DetectRunFrameInspectRule(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, const Signature *s, Flow *f, Packet *p, const Frames *frames, const Frame *frame)
Definition: detect-engine-frame.c:228
Flow_::protoctx
void * protoctx
Definition: flow.h:441
PrefilterAppendFrameEngine
int PrefilterAppendFrameEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh, PrefilterFrameFn PrefilterFrameFunc, AppProto alproto, uint8_t frame_type, void *pectx, void(*FreeFunc)(void *pectx), const char *name)
Definition: detect-engine-prefilter.c:389
DetectBufferMpmRegistry_::transforms
DetectEngineTransforms transforms
Definition: detect.h:776
Packet_::payload_len
uint16_t payload_len
Definition: decode.h:589
detect-engine-prefilter.h
DetectRunPrefilterFrame
void DetectRunPrefilterFrame(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const Frames *frames, const Frame *frame, const AppProto alproto)
Definition: detect-engine-frame.c:73
Signature_::frame_inspect
DetectEngineFrameInspectionEngine * frame_inspect
Definition: detect.h:728
FRAME_ANY_TYPE
#define FRAME_ANY_TYPE
Definition: app-layer-frames.h:30
PrefilterMpmFrameCtx::transforms
const DetectEngineTransforms * transforms
Definition: detect-engine-frame.c:99
PrefilterEngine_::cb
union PrefilterEngine_::@102 cb
InspectionBufferSetupMultiEmpty
void InspectionBufferSetupMultiEmpty(InspectionBuffer *buffer)
setup the buffer empty
Definition: detect-engine.c:1666
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:18
PKT_IS_TOSERVER
#define PKT_IS_TOSERVER(p)
Definition: decode.h:238
AppLayerParserGetFrameNameById
const char * AppLayerParserGetFrameNameById(uint8_t ipproto, AppProto alproto, const uint8_t id)
Definition: app-layer-parser.c:1645
FrameStreamData::idx
uint32_t idx
Definition: detect-engine-frame.c:49
DetectEngineThreadCtx_
Definition: detect.h:1197
PrefilterEngine_
Definition: detect.h:1505
STREAM_BASE_OFFSET
#define STREAM_BASE_OFFSET(stream)
Definition: stream-tcp-private.h:144
BOOL2STR
#define BOOL2STR(b)
Definition: util-debug.h:527
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
detect-engine-mpm.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
DetectEngineFrameInspectionEngine::sm_list
uint16_t sm_list
Definition: detect.h:526
DETECT_ENGINE_INSPECT_SIG_MATCH
#define DETECT_ENGINE_INSPECT_SIG_MATCH
Definition: detect-engine-state.h:38
TcpSession_::state
uint8_t state
Definition: stream-tcp-private.h:285
FrameStreamData::transforms
const DetectEngineTransforms * transforms
Definition: detect-engine-frame.c:46
InspectionBuffer::inspect_offset
uint64_t inspect_offset
Definition: detect.h:382
app-layer-parser.h
MpmCtx_::minlen
uint16_t minlen
Definition: util-mpm.h:104
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:309
util-profiling.h
PrefilterEngine_::alproto
AppProto alproto
Definition: detect.h:1509
Packet_
Definition: decode.h:484
DETECT_CI_FLAGS_END
#define DETECT_CI_FLAGS_END
Definition: detect-engine-content-inspection.h:42
DetectEngineFrameInspectionEngine
Definition: detect.h:521
Frame::len
int64_t len
Definition: app-layer-frames.h:52
PrefilterEngine_::PrefilterFrame
PrefilterFrameFn PrefilterFrame
Definition: detect.h:1532
PrefilterEngine_::frame_type
uint8_t frame_type
Definition: detect.h:1519
MpmTableElmt_::Search
uint32_t(* Search)(const struct MpmCtx_ *, struct MpmThreadCtx_ *, PrefilterRuleStore *, const uint8_t *, uint32_t)
Definition: util-mpm.h:177
SigGroupHead_::frame_engines
PrefilterEngine * frame_engines
Definition: detect.h:1583
DetectEngineThreadCtx_::mtc
MpmThreadCtx mtc
Definition: detect.h:1294
detect-engine-content-inspection.h
TCP_CLOSED
@ TCP_CLOSED
Definition: stream-tcp-private.h:162
PrefilterMpmFrameCtx
Definition: detect-engine-frame.c:96
PREFILTER_PROFILING_ADD_BYTES
#define PREFILTER_PROFILING_ADD_BYTES(det_ctx, bytes)
Definition: util-profiling.h:286
app-layer-frames.h
Packet_::flow
struct Flow_ * flow
Definition: decode.h:529
Frame::type
uint8_t type
Definition: app-layer-frames.h:46
suricata-common.h
DETECT_ENGINE_CONTENT_INSPECTION_MODE_FRAME
@ DETECT_ENGINE_CONTENT_INSPECTION_MODE_FRAME
Definition: detect-engine-content-inspection.h:35
DetectEngineFrameInspectionEngine::next
struct DetectEngineFrameInspectionEngine * next
Definition: detect.h:534
DetectEngineInspectFrameBufferGeneric
int DetectEngineInspectFrameBufferGeneric(DetectEngineThreadCtx *det_ctx, const DetectEngineFrameInspectionEngine *engine, const Signature *s, Packet *p, const Frames *frames, const Frame *frame)
Do the content inspection & validation for a signature.
Definition: detect-engine-frame.c:557
DetectEngineThreadCtx_::frame_inspect_progress
uint64_t frame_inspect_progress
Definition: detect.h:1271
FrameStreamData::inspect_result
int inspect_result
Definition: detect-engine-frame.c:54
PrefilterEngine_::gid
uint32_t gid
Definition: detect.h:1538
DetectEngineFrameInspectionEngine::v1
struct DetectEngineFrameInspectionEngine::@83 v1
TcpSession_::client
TcpStream client
Definition: stream-tcp-private.h:297
DETECT_ENGINE_INSPECT_SIG_NO_MATCH
#define DETECT_ENGINE_INSPECT_SIG_NO_MATCH
Definition: detect-engine-state.h:37
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
util-validate.h
InspectionBuffer::inspect_len
uint32_t inspect_len
Definition: detect.h:383
PrefilterEngine_::pectx
void * pectx
Definition: detect.h:1527
TcpSession_::server
TcpStream server
Definition: stream-tcp-private.h:296
InspectionBuffer::inspect
const uint8_t * inspect
Definition: detect.h:381
SCFree
#define SCFree(p)
Definition: util-mem.h:61
Signature_::id
uint32_t id
Definition: detect.h:714
Signature_
Signature container.
Definition: detect.h:669
FrameStreamData::s
const Signature * s
Definition: detect-engine-frame.c:53
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
mpm_table
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
Definition: util-mpm.c:47
StreamDataRightEdge
uint64_t StreamDataRightEdge(const TcpStream *stream, const bool eof)
Definition: stream-tcp-reassemble.c:417
PrefilterEngine_::is_last
bool is_last
Definition: detect.h:1522
DetectEngineThreadCtx_::de_ctx
DetectEngineCtx * de_ctx
Definition: detect.h:1313
suricata.h
InspectionBufferMultipleForListGet
InspectionBuffer * InspectionBufferMultipleForListGet(DetectEngineThreadCtx *det_ctx, const int list_id, const uint32_t local_id)
for a InspectionBufferMultipleForList get a InspectionBuffer
Definition: detect-engine.c:1598
dst
uint16_t dst
Definition: app-layer-dnp3.h:4
MpmCtx_
Definition: util-mpm.h:93
TcpSession_
Definition: stream-tcp-private.h:283
DetectEngineContentInspection
bool DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const Signature *s, const SigMatchData *smd, Packet *p, Flow *f, const uint8_t *buffer, const uint32_t buffer_len, const uint32_t stream_start_offset, const uint8_t flags, const enum DetectContentInspectionType inspection_mode)
wrapper around DetectEngineContentInspectionInternal to return true/false only
Definition: detect-engine-content-inspection.c:733
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:450
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
FrameStreamData::p
Packet * p
Definition: detect-engine-frame.c:55
InspectionBufferSetupMulti
void InspectionBufferSetupMulti(DetectEngineThreadCtx *det_ctx, InspectionBuffer *buffer, const DetectEngineTransforms *transforms, const uint8_t *data, const uint32_t data_len)
setup the buffer with our initial data
Definition: detect-engine.c:1679
StreamReassembleForFrame
int StreamReassembleForFrame(TcpSession *ssn, TcpStream *stream, StreamReassembleRawFunc Callback, void *cb_data, const uint64_t offset, const bool eof)
Definition: stream-tcp-reassemble.c:1897
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
DetectBufferMpmRegistry_::pname
char pname[32]
Definition: detect.h:765
DetectEngineFrameInspectionEngine::smd
SigMatchData * smd
Definition: detect.h:533
FrameStreamData
Definition: detect-engine-frame.c:43