suricata
detect-engine-frame.c
Go to the documentation of this file.
1 /* Copyright (C) 2021-2023 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  */
24 
25 #include "suricata-common.h"
26 #include "suricata.h"
27 
28 #include "app-layer-parser.h"
29 #include "app-layer-frames.h"
30 
31 #include "detect-engine.h"
34 #include "detect-engine-mpm.h"
35 #include "detect-engine-frame.h"
36 
37 #include "stream-tcp.h"
38 
39 #include "util-profiling.h"
40 #include "util-validate.h"
41 #include "util-print.h"
42 
44  // shared between prefilter and inspect
47  const Frame *frame;
48  int list_id;
49  uint32_t idx; /**< multi buffer idx, incremented for each stream chunk */
50 
51  // inspection only
53  const Signature *s;
54  int inspect_result; // DETECT_ENGINE_INSPECT_SIG_MATCH / DETECT_ENGINE_INSPECT_SIG_NO_MATCH
56 
57  // prefilter only
58  const MpmCtx *mpm_ctx;
59 
61 };
62 
63 static bool SetupStreamCallbackData(struct FrameStreamData *dst, const TcpSession *ssn,
64  const TcpStream *stream, DetectEngineThreadCtx *det_ctx,
65  const DetectEngineTransforms *transforms, const Frames *_frames, const Frame *frame,
66  const int list_id, const bool eof);
67 
68 static bool BufferSetup(struct FrameStreamData *fsd, InspectionBuffer *buffer, const uint8_t *input,
69  const uint32_t input_len, const uint64_t input_offset);
70 static void BufferSetupUdp(InspectionBuffer *buffer, const Frame *frame, const Packet *p,
71  const DetectEngineTransforms *transforms);
72 
74  const Frames *frames, const Frame *frame, const AppProto alproto)
75 {
76  SCLogDebug("pcap_cnt %" PRIu64, p->pcap_cnt);
77  PrefilterEngine *engine = sgh->frame_engines;
78  do {
79  BUG_ON(engine->alproto == ALPROTO_UNKNOWN);
80  if (engine->alproto == alproto && engine->ctx.frame_type == frame->type) {
81  SCLogDebug("frame %p engine %p", frame, engine);
83  engine->cb.PrefilterFrame(det_ctx, engine->pectx, p, frames, frame);
84  PREFILTER_PROFILING_END(det_ctx, engine->gid);
85  }
86  if (engine->is_last)
87  break;
88  engine++;
89  } while (1);
90 }
91 
92 /* generic mpm for frame engines */
93 
94 // TODO same as Generic?
95 typedef struct PrefilterMpmFrameCtx {
96  int list_id;
97  const MpmCtx *mpm_ctx;
100 
101 static int FrameStreamDataPrefilterFunc(
102  void *cb_data, const uint8_t *input, const uint32_t input_len, const uint64_t input_offset)
103 {
104  struct FrameStreamData *fsd = cb_data;
105  SCLogDebug("prefilter: fsd %p { det_ctx:%p, transforms:%p, frame:%p, list_id:%d, idx:%u, "
106  "data_offset:%" PRIu64 "}, input: %p, input_len:%u, input_offset:%" PRIu64,
107  fsd, fsd->det_ctx, fsd->transforms, fsd->frame, fsd->list_id, fsd->idx,
108  fsd->requested_stream_offset, input, input_len, input_offset);
109  // PrintRawDataFp(stdout, input, input_len);
110 
111  InspectionBuffer *buffer =
113  if (buffer == NULL) {
114  return 0;
115  }
116  SCLogDebug("buffer %p idx %u", buffer, fsd->idx);
117 
118  const int more_chunks = BufferSetup(fsd, buffer, input, input_len, input_offset);
119 
120  const uint32_t data_len = buffer->inspect_len;
121  const uint8_t *data = buffer->inspect;
123  const MpmCtx *mpm_ctx = fsd->mpm_ctx;
124 
125  if (data != NULL && data_len >= mpm_ctx->minlen) {
126  // PrintRawDataFp(stdout, data, data_len);
127 
129  mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, data, data_len);
130  SCLogDebug("det_ctx->pmq.rule_id_array_cnt %u", det_ctx->pmq.rule_id_array_cnt);
132  }
133  return more_chunks;
134 }
135 
136 /** \brief Generic Mpm prefilter callback
137  *
138  * \param det_ctx detection engine thread ctx
139  * \param frames container for the frames
140  * \param frame frame to inspect
141  * \param pectx inspection context
142  */
143 static void PrefilterMpmFrame(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p,
144  const Frames *frames, const Frame *frame)
145 {
146  SCEnter();
147 
148  const PrefilterMpmFrameCtx *ctx = (const PrefilterMpmFrameCtx *)pectx;
149  const MpmCtx *mpm_ctx = ctx->mpm_ctx;
150 
151  SCLogDebug("packet:%" PRIu64 ", prefilter running on list %d -> frame field type %u",
152  p->pcap_cnt, ctx->list_id, frame->type);
153  if (p->proto == IPPROTO_UDP) {
154  // TODO can we use single here? Could it conflict with TCP?
156  if (buffer == NULL)
157  return;
159  if (frame->offset >= p->payload_len)
160  return;
161 
162  BufferSetupUdp(buffer, frame, p, ctx->transforms);
163  const uint32_t data_len = buffer->inspect_len;
164  const uint8_t *data = buffer->inspect;
165 
166  // PrintRawDataFp(stdout, data, data_len);
167 
168  if (data != NULL && data_len >= mpm_ctx->minlen) {
170  mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, data, data_len);
171  SCLogDebug("det_ctx->pmq.rule_id_array_cnt %u", det_ctx->pmq.rule_id_array_cnt);
173  }
174  } else if (p->proto == IPPROTO_TCP) {
175  BUG_ON(p->flow->protoctx == NULL);
176  TcpSession *ssn = p->flow->protoctx;
177  TcpStream *stream;
178  if (PKT_IS_TOSERVER(p)) {
179  stream = &ssn->client;
180  } else {
181  stream = &ssn->server;
182  }
183  const bool eof = ssn->state == TCP_CLOSED || PKT_IS_PSEUDOPKT(p);
184 
185  struct FrameStreamData fsd;
186  memset(&fsd, 0, sizeof(fsd));
187  fsd.mpm_ctx = mpm_ctx;
188 
189  if (SetupStreamCallbackData(&fsd, ssn, stream, det_ctx, ctx->transforms, frames, frame,
190  ctx->list_id, eof) == true) {
191  StreamReassembleForFrame(ssn, stream, FrameStreamDataPrefilterFunc, &fsd,
192  fsd.requested_stream_offset, eof);
193  }
194  } else {
196  }
197  SCLogDebug("packet:%" PRIu64
198  ", prefilter done running on list %d -> frame field type %u; have %u matches",
200 }
201 
202 static void PrefilterMpmFrameFree(void *ptr)
203 {
204  SCFree(ptr);
205 }
206 
208  const DetectBufferMpmRegistry *mpm_reg, int list_id)
209 {
210  SCEnter();
211  PrefilterMpmFrameCtx *pectx = SCCalloc(1, sizeof(*pectx));
212  if (pectx == NULL)
213  return -1;
214  pectx->list_id = list_id;
215  BUG_ON(mpm_reg->frame_v1.alproto == ALPROTO_UNKNOWN);
216  pectx->mpm_ctx = mpm_ctx;
217  pectx->transforms = &mpm_reg->transforms;
218 
219  int r = PrefilterAppendFrameEngine(de_ctx, sgh, PrefilterMpmFrame, mpm_reg->frame_v1.alproto,
220  mpm_reg->frame_v1.type, pectx, PrefilterMpmFrameFree, mpm_reg->pname);
221  if (r != 0) {
222  SCFree(pectx);
223  }
224  return r;
225 }
226 
228  Flow *f, Packet *p, const Frames *frames, const Frame *frame)
229 {
230  BUG_ON(s->frame_inspect == NULL);
231 
232  SCLogDebug("inspecting rule %u against frame %p/%" PRIi64 "/%s", s->id, frame, frame->id,
234 
235  for (DetectEngineFrameInspectionEngine *e = s->frame_inspect; e != NULL; e = e->next) {
236  if (frame->type == e->type) {
237  // TODO check alproto, direction?
238 
239  // TODO there should be only one inspect engine for this frame, ever?
240 
241  if (e->v1.Callback(det_ctx, e, s, p, frames, frame) == true) {
242  SCLogDebug("sid %u: e %p Callback returned true", s->id, e);
243  return true;
244  }
245  SCLogDebug("sid %u: e %p Callback returned false", s->id, e);
246  } else {
247  SCLogDebug(
248  "sid %u: e %p not for frame type %u (want %u)", s->id, e, frame->type, e->type);
249  }
250  }
251  return false;
252 }
253 
254 static void BufferSetupUdp(InspectionBuffer *buffer, const Frame *frame, const Packet *p,
256 {
257  uint8_t ci_flags = DETECT_CI_FLAGS_START;
258  uint32_t frame_len;
259  if (frame->len == -1) {
260  frame_len = p->payload_len - frame->offset;
261  } else {
262  frame_len = (uint32_t)frame->len;
263  }
264  if (frame->offset + frame_len > p->payload_len) {
265  frame_len = p->payload_len - frame->offset;
266  } else {
267  ci_flags |= DETECT_CI_FLAGS_END;
268  }
269  const uint8_t *data = p->payload + frame->offset;
270  const uint32_t data_len = frame_len;
271 
272  SCLogDebug("packet %" PRIu64 " -> frame %p/%" PRIi64 "/%s offset %" PRIu64
273  " type %u len %" PRIi64,
274  p->pcap_cnt, frame, frame->id,
276  frame->offset, frame->type, frame->len);
277 
278  InspectionBufferSetupMulti(buffer, transforms, data, data_len);
279  buffer->inspect_offset = 0;
280  buffer->flags = ci_flags;
281 }
282 
283 /** \internal
284  * \brief setup buffer based on frame in UDP payload
285  */
286 static int DetectFrameInspectUdp(DetectEngineThreadCtx *det_ctx,
287  const DetectEngineFrameInspectionEngine *engine, const Signature *s,
288  const DetectEngineTransforms *transforms, Packet *p, const Frames *_frames,
289  const Frame *frame, const int list_id)
290 {
291  SCLogDebug("packet:%" PRIu64 ", inspect: s:%p s->id:%u, transforms:%p", p->pcap_cnt, s, s->id,
292  transforms);
293 
294  // TODO can we use single here? Could it conflict with TCP?
296  if (buffer == NULL)
298 
300  if (frame->offset >= p->payload_len)
302 
303  if (!buffer->initialized)
304  BufferSetupUdp(buffer, frame, p, transforms);
306  if (buffer->inspect == NULL)
308 
309  const uint32_t data_len = buffer->inspect_len;
310  const uint8_t *data = buffer->inspect;
311 
312  // PrintRawDataFp(stdout, data, data_len);
313 
315  (uint8_t *)data, data_len, 0, buffer->flags,
317  if (r == 1) {
318  SCLogDebug("match!");
320  } else {
322  }
323 }
324 
325 /**
326  * \retval bool true if callback should run again */
327 static bool BufferSetup(struct FrameStreamData *fsd, InspectionBuffer *buffer, const uint8_t *input,
328  const uint32_t input_len, const uint64_t input_offset)
329 {
330  const Frame *frame = fsd->frame;
331  /* so: relative to start of stream */
332  const uint64_t so_input_re = input_offset + input_len;
333  const uint64_t so_frame_re =
334  frame->offset + (uint64_t)frame->len; // TODO if eof, set to available data?
335  SCLogDebug("frame offset:%" PRIu64, frame->offset);
336  const uint8_t *data = input;
337  uint8_t ci_flags = 0;
338  uint32_t data_len;
339 
340  /* fo: frame offset; offset relative to start of the frame */
341  uint64_t fo_inspect_offset = 0;
342 
343  if (frame->offset == 0 && input_offset == 0) {
344  ci_flags |= DETECT_CI_FLAGS_START;
345  SCLogDebug("have frame data start");
346 
347  if (frame->len >= 0) {
348  data_len = MIN(input_len, frame->len);
349  if (data_len == frame->len) {
350  ci_flags |= DETECT_CI_FLAGS_END;
351  SCLogDebug("have frame data end");
352  }
353  } else {
354  data_len = input_len;
355  }
356  } else {
357  const uint64_t so_frame_inspect_offset = frame->inspect_progress + frame->offset;
358  const uint64_t so_inspect_offset = MAX(input_offset, so_frame_inspect_offset);
359  fo_inspect_offset = so_inspect_offset - frame->offset;
360 
361  if (frame->offset >= input_offset) {
362  ci_flags |= DETECT_CI_FLAGS_START;
363  SCLogDebug("have frame data start");
364  }
365  if (frame->len >= 0) {
366  if (fo_inspect_offset >= (uint64_t)frame->len) {
367  SCLogDebug("data entirely past frame (%" PRIu64 " > %" PRIi64 ")",
368  fo_inspect_offset, frame->len);
370  return false;
371  }
372 
373  /* in: relative to start of input data */
374  BUG_ON(so_inspect_offset < input_offset);
375  const uint32_t in_data_offset = so_inspect_offset - input_offset;
376  data += in_data_offset;
377 
378  uint32_t in_data_excess = 0;
379  if (so_input_re >= so_frame_re) {
380  ci_flags |= DETECT_CI_FLAGS_END;
381  SCLogDebug("have frame data end");
382  in_data_excess = so_input_re - so_frame_re;
383  }
384  data_len = input_len - in_data_offset - in_data_excess;
385  } else {
386  /* in: relative to start of input data */
387  BUG_ON(so_inspect_offset < input_offset);
388  const uint32_t in_data_offset = so_inspect_offset - input_offset;
389  data += in_data_offset;
390  data_len = input_len - in_data_offset;
391  }
392  }
393  // PrintRawDataFp(stdout, data, data_len);
394  SCLogDebug("fsd->transforms %p", fsd->transforms);
395  InspectionBufferSetupMulti(buffer, fsd->transforms, data, data_len);
396  SCLogDebug("inspect_offset %" PRIu64, fo_inspect_offset);
397  buffer->inspect_offset = fo_inspect_offset;
398  buffer->flags = ci_flags;
399 
400  if (frame->len >= 0 && so_input_re >= so_frame_re) {
401  SCLogDebug("have the full frame, we can set progress accordingly (%" PRIu64 " > %" PRIu64
402  ")",
403  so_input_re, so_frame_re);
405  MAX(fo_inspect_offset + data_len, fsd->det_ctx->frame_inspect_progress);
406  } else {
408  MAX(fo_inspect_offset + data_len, fsd->det_ctx->frame_inspect_progress);
409  /* in IPS mode keep a sliding window */
410  const bool ips = StreamTcpInlineMode();
411  if (ips) {
412  if (fsd->det_ctx->frame_inspect_progress < 2500)
414  else
415  fsd->det_ctx->frame_inspect_progress -= 2500;
416  }
417  SCLogDebug("ips %s inspect_progress %" PRIu64, BOOL2STR(ips),
419  }
420 
421  /* keep going as long as there is possibly still data for this frame */
422  const bool ret = (frame->len >= 0 && so_input_re >= so_frame_re);
423  SCLogDebug("buffer set up, more to do: %s", BOOL2STR(ret));
424  return ret;
425 }
426 
427 static int FrameStreamDataInspectFunc(
428  void *cb_data, const uint8_t *input, const uint32_t input_len, const uint64_t input_offset)
429 {
430  struct FrameStreamData *fsd = cb_data;
431  SCLogDebug("inspect: fsd %p { det_ctx:%p, transforms:%p, s:%p, s->id:%u, frame:%p, list_id:%d, "
432  "idx:%u, "
433  "requested_stream_offset:%" PRIu64
434  "}, input: %p, input_len:%u, input_offset:%" PRIu64,
435  fsd, fsd->det_ctx, fsd->transforms, fsd->s, fsd->s->id, fsd->frame, fsd->list_id,
436  fsd->idx, fsd->requested_stream_offset, input, input_len, input_offset);
437  // PrintRawDataFp(stdout, input, input_len);
438 
439  InspectionBuffer *buffer =
441  if (buffer == NULL) {
442  return 0;
443  }
444  SCLogDebug("buffer %p idx %u", buffer, fsd->idx);
445 
446  /* if we've not done so already, set up the buffer */
447  int more_chunks = 1;
448  if (!buffer->initialized) {
449  more_chunks = BufferSetup(fsd, buffer, input, input_len, input_offset);
450  }
452  if (buffer->inspect == NULL) {
453  return more_chunks;
454  }
455 
456  const uint32_t data_len = buffer->inspect_len;
457  const uint8_t *data = buffer->inspect;
458  const uint64_t data_offset = buffer->inspect_offset;
461  det_ctx->buffer_offset = 0;
463 
465  const Signature *s = fsd->s;
466  Packet *p = fsd->p;
467 
468 #ifdef DEBUG
469  const uint8_t ci_flags = buffer->flags;
470  SCLogDebug("frame %p offset %" PRIu64 " type %u len %" PRIi64
471  " ci_flags %02x (start:%s, end:%s)",
472  fsd->frame, fsd->frame->offset, fsd->frame->type, fsd->frame->len, ci_flags,
473  (ci_flags & DETECT_CI_FLAGS_START) ? "true" : "false",
474  (ci_flags & DETECT_CI_FLAGS_END) ? "true" : "false");
475  SCLogDebug("buffer %p offset %" PRIu64 " len %u ci_flags %02x (start:%s, end:%s)", buffer,
476  buffer->inspect_offset, buffer->inspect_len, ci_flags,
477  (ci_flags & DETECT_CI_FLAGS_START) ? "true" : "false",
478  (ci_flags & DETECT_CI_FLAGS_END) ? "true" : "false");
479  // PrintRawDataFp(stdout, data, data_len);
480  // PrintRawDataFp(stdout, data, MIN(64, data_len));
481 #endif
482  BUG_ON(fsd->frame->len > 0 && (int64_t)data_len > fsd->frame->len);
483 
485  (uint8_t *)data, data_len, data_offset, buffer->flags,
487  if (r == 1) {
488  SCLogDebug("DETECT_ENGINE_INSPECT_SIG_MATCH");
490  } else {
491  SCLogDebug("DETECT_ENGINE_INSPECT_SIG_NO_MATCH");
492  }
493  return more_chunks;
494 }
495 
496 static bool SetupStreamCallbackData(struct FrameStreamData *dst, const TcpSession *ssn,
497  const TcpStream *stream, DetectEngineThreadCtx *det_ctx,
498  const DetectEngineTransforms *transforms, const Frames *_frames, const Frame *frame,
499  const int list_id, const bool eof)
500 {
501  SCLogDebug("frame %" PRIi64 ", len %" PRIi64 ", offset %" PRIu64 ", inspect_progress %" PRIu64,
503 
504  const uint64_t frame_offset = frame->offset;
505  const uint64_t usable = StreamDataRightEdge(stream, eof);
506  if (usable <= frame_offset)
507  return false;
508 
509  uint64_t want = frame->inspect_progress;
510  if (frame->len == -1) {
511  if (eof) {
512  want = usable;
513  } else {
514  want += 2500;
515  }
516  } else {
517  /* don't have the full frame yet */
518  if (frame->offset + frame->len > usable) {
519  want += 2500;
520  } else {
521  want = frame->offset + frame->len;
522  }
523  }
524 
525  const bool ips = StreamTcpInlineMode();
526 
527  const uint64_t have = usable;
528  if (!ips && have < want) {
529  SCLogDebug("wanted %" PRIu64 " bytes, got %" PRIu64, want, have);
530  return false;
531  }
532 
533  const uint64_t available_data = usable - STREAM_BASE_OFFSET(stream);
534  SCLogDebug("check inspection for having 2500 bytes: %" PRIu64, available_data);
535  if (!ips && !eof && available_data < 2500 &&
536  (frame->len < 0 || frame->len > (int64_t)available_data)) {
537  SCLogDebug("skip inspection until we have 2500 bytes (have %" PRIu64 ")", available_data);
538  return false;
539  }
540 
541  const uint64_t offset =
543 
544  dst->det_ctx = det_ctx;
545  dst->transforms = transforms;
546  dst->frame = frame;
547  dst->list_id = list_id;
548  dst->requested_stream_offset = offset;
549  return true;
550 }
551 
552 /**
553  * \brief Do the content inspection & validation for a signature
554  *
555  * \param de_ctx Detection engine context
556  * \param det_ctx Detection engine thread context
557  * \param s Signature to inspect
558  * \param p Packet
559  * \param frame stream frame to inspect
560  *
561  * \retval 0 no match.
562  * \retval 1 match.
563  */
565  const DetectEngineFrameInspectionEngine *engine, const Signature *s, Packet *p,
566  const Frames *frames, const Frame *frame)
567 {
568  /* if prefilter didn't already run, we need to consider transformations */
569  const DetectEngineTransforms *transforms = NULL;
570  if (!engine->mpm) {
571  transforms = engine->v1.transforms;
572  }
573  const int list_id = engine->sm_list;
574  SCLogDebug("running inspect on %d", list_id);
575 
576  if (p->proto == IPPROTO_UDP) {
577  return DetectFrameInspectUdp(det_ctx, engine, s, transforms, p, frames, frame, list_id);
578  }
579  DEBUG_VALIDATE_BUG_ON(p->proto != IPPROTO_TCP);
580 
581  SCLogDebug("packet:%" PRIu64 ", frame->id:%" PRIu64
582  ", list:%d, transforms:%p, s:%p, s->id:%u, engine:%p",
583  p->pcap_cnt, frame->id, engine->sm_list, engine->v1.transforms, s, s->id, engine);
584 
585  BUG_ON(p->flow->protoctx == NULL);
586  TcpSession *ssn = p->flow->protoctx;
587  TcpStream *stream;
588  if (PKT_IS_TOSERVER(p)) {
589  stream = &ssn->client;
590  } else {
591  stream = &ssn->server;
592  }
593  const bool eof = ssn->state == TCP_CLOSED || PKT_IS_PSEUDOPKT(p);
594 
595  struct FrameStreamData fsd;
596  memset(&fsd, 0, sizeof(fsd));
597  fsd.inspect_engine = engine;
598  fsd.s = s;
600  fsd.p = p;
601 
602  if (SetupStreamCallbackData(
603  &fsd, ssn, stream, det_ctx, transforms, frames, frame, list_id, eof) == false) {
605  }
607  ssn, stream, FrameStreamDataInspectFunc, &fsd, fsd.requested_stream_offset, eof);
608 
609  return fsd.inspect_result;
610 }
PrefilterMpmFrameCtx
struct PrefilterMpmFrameCtx PrefilterMpmFrameCtx
PrefilterMpmFrameCtx::list_id
int list_id
Definition: detect-engine-frame.c:96
Packet_::proto
uint8_t proto
Definition: decode.h:451
TcpStream_
Definition: stream-tcp-private.h:106
Frame::inspect_progress
uint64_t inspect_progress
Definition: app-layer-frames.h:55
MpmCtx_::mpm_type
uint8_t mpm_type
Definition: util-mpm.h:91
DetectEngineThreadCtx_::buffer_offset
uint32_t buffer_offset
Definition: detect.h:1086
detect-engine.h
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
DETECT_CI_FLAGS_START
#define DETECT_CI_FLAGS_START
Definition: detect-engine-content-inspection.h:39
PrefilterEngine_::ctx
union PrefilterEngine_::@99 ctx
PKT_IS_PSEUDOPKT
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Definition: decode.h:1063
PREFILTER_PROFILING_END
#define PREFILTER_PROFILING_END(ctx, profile_id)
Definition: util-profiling.h:277
InspectionBuffer::initialized
bool initialized
Definition: detect.h:369
stream-tcp.h
PrefilterRuleStore_::rule_id_array_cnt
uint32_t rule_id_array_cnt
Definition: util-prefilter.h:40
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1425
DetectEngineTransforms
Definition: detect.h:400
FrameStreamData::requested_stream_offset
uint64_t requested_stream_offset
Definition: detect-engine-frame.c:60
FrameStreamData::frame
const Frame * frame
Definition: detect-engine-frame.c:47
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:595
Flow_::proto
uint8_t proto
Definition: flow.h:365
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:80
Packet_::payload
uint8_t * payload
Definition: decode.h:574
StreamTcpInlineMode
int StreamTcpInlineMode(void)
See if stream engine is operating in inline mode.
Definition: stream-tcp.c:6850
InspectionBuffer
Definition: detect.h:365
Frame::offset
uint64_t offset
Definition: app-layer-frames.h:51
FrameStreamData::list_id
int list_id
Definition: detect-engine-frame.c:48
Frame
Definition: app-layer-frames.h:45
Flow_
Flow data structure.
Definition: flow.h:343
PREFILTER_PROFILING_START
#define PREFILTER_PROFILING_START(det_ctx)
Definition: util-profiling.h:261
DetectEngineThreadCtx_::pmq
PrefilterRuleStore pmq
Definition: detect.h:1165
DetectEngineFrameInspectionEngine::transforms
const DetectEngineTransforms * transforms
Definition: detect.h:507
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:827
DetectEngineFrameInspectionEngine::mpm
bool mpm
Definition: detect.h:501
Frame::id
int64_t id
Definition: app-layer-frames.h:53
FrameStreamData::mpm_ctx
const MpmCtx * mpm_ctx
Definition: detect-engine-frame.c:58
FrameStreamData::det_ctx
DetectEngineThreadCtx * det_ctx
Definition: detect-engine-frame.c:45
PrefilterMpmFrameCtx::mpm_ctx
const MpmCtx * mpm_ctx
Definition: detect-engine-frame.c:97
MIN
#define MIN(x, y)
Definition: suricata-common.h:386
Frames
Definition: app-layer-frames.h:60
DetectBufferMpmRegistry_
one time registration of keywords at start up
Definition: detect.h:669
InspectionBuffer::flags
uint8_t flags
Definition: detect.h:370
detect-engine-frame.h
FrameStreamData::inspect_engine
const DetectEngineFrameInspectionEngine * inspect_engine
Definition: detect-engine-frame.c:52
PrefilterGenericMpmFrameRegister
int PrefilterGenericMpmFrameRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-frame.c:207
MAX
#define MAX(x, y)
Definition: suricata-common.h:390
Flow_::protoctx
void * protoctx
Definition: flow.h:433
PrefilterAppendFrameEngine
int PrefilterAppendFrameEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh, PrefilterFrameFn PrefilterFrameFunc, AppProto alproto, uint8_t frame_type, void *pectx, void(*FreeFunc)(void *pectx), const char *name)
Definition: detect-engine-prefilter.c:307
DetectBufferMpmRegistry_::transforms
DetectEngineTransforms transforms
Definition: detect.h:682
Packet_::payload_len
uint16_t payload_len
Definition: decode.h:575
detect-engine-prefilter.h
DetectRunPrefilterFrame
void DetectRunPrefilterFrame(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const Frames *frames, const Frame *frame, const AppProto alproto)
Definition: detect-engine-frame.c:73
DetectEngineThreadCtx_::mtcu
MpmThreadCtx mtcu
Definition: detect.h:1163
Signature_::frame_inspect
DetectEngineFrameInspectionEngine * frame_inspect
Definition: detect.h:634
PrefilterMpmFrameCtx::transforms
const DetectEngineTransforms * transforms
Definition: detect-engine-frame.c:98
InspectionBufferSetupMultiEmpty
void InspectionBufferSetupMultiEmpty(InspectionBuffer *buffer)
setup the buffer empty
Definition: detect-engine.c:1616
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
PKT_IS_TOSERVER
#define PKT_IS_TOSERVER(p)
Definition: decode.h:252
AppLayerParserGetFrameNameById
const char * AppLayerParserGetFrameNameById(uint8_t ipproto, AppProto alproto, const uint8_t id)
Definition: app-layer-parser.c:1625
FrameStreamData::idx
uint32_t idx
Definition: detect-engine-frame.c:49
DetectEngineThreadCtx_
Definition: detect.h:1058
PrefilterEngine_
Definition: detect.h:1366
STREAM_BASE_OFFSET
#define STREAM_BASE_OFFSET(stream)
Definition: stream-tcp-private.h:144
BOOL2STR
#define BOOL2STR(b)
Definition: util-debug.h:527
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
detect-engine-mpm.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
DetectEngineFrameInspectionEngine::sm_list
uint16_t sm_list
Definition: detect.h:502
DETECT_ENGINE_INSPECT_SIG_MATCH
#define DETECT_ENGINE_INSPECT_SIG_MATCH
Definition: detect-engine-state.h:39
TcpSession_::state
uint8_t state
Definition: stream-tcp-private.h:285
FrameStreamData::transforms
const DetectEngineTransforms * transforms
Definition: detect-engine-frame.c:46
InspectionBuffer::inspect_offset
uint64_t inspect_offset
Definition: detect.h:367
app-layer-parser.h
MpmCtx_::minlen
uint16_t minlen
Definition: util-mpm.h:100
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:295
util-profiling.h
PrefilterEngine_::alproto
AppProto alproto
Definition: detect.h:1370
Packet_
Definition: decode.h:429
DETECT_CI_FLAGS_END
#define DETECT_CI_FLAGS_END
Definition: detect-engine-content-inspection.h:40
DetectEngineFrameInspectionEngine
Definition: detect.h:497
Frame::len
int64_t len
Definition: app-layer-frames.h:52
PrefilterEngine_::PrefilterFrame
PrefilterFrameFn PrefilterFrame
Definition: detect.h:1386
PrefilterEngine_::frame_type
uint8_t frame_type
Definition: detect.h:1376
MpmTableElmt_::Search
uint32_t(* Search)(const struct MpmCtx_ *, struct MpmThreadCtx_ *, PrefilterRuleStore *, const uint8_t *, uint32_t)
Definition: util-mpm.h:163
SigGroupHead_::frame_engines
PrefilterEngine * frame_engines
Definition: detect.h:1445
DETECT_ENGINE_CONTENT_INSPECTION_MODE_FRAME
@ DETECT_ENGINE_CONTENT_INSPECTION_MODE_FRAME
Definition: detect-engine-content-inspection.h:35
detect-engine-content-inspection.h
DetectEngineThreadCtx_::discontinue_matching
uint16_t discontinue_matching
Definition: detect.h:1123
DetectEngineFrameInspectionEngine::v1
struct DetectEngineFrameInspectionEngine::@85 v1
DetectEngineContentInspection
uint8_t DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const Signature *s, const SigMatchData *smd, Packet *p, Flow *f, const uint8_t *buffer, uint32_t buffer_len, uint32_t stream_start_offset, uint8_t flags, uint8_t inspection_mode)
Run the actual payload match functions.
Definition: detect-engine-content-inspection.c:106
TCP_CLOSED
@ TCP_CLOSED
Definition: stream-tcp-private.h:162
PrefilterMpmFrameCtx
Definition: detect-engine-frame.c:95
PREFILTER_PROFILING_ADD_BYTES
#define PREFILTER_PROFILING_ADD_BYTES(det_ctx, bytes)
Definition: util-profiling.h:287
app-layer-frames.h
Packet_::flow
struct Flow_ * flow
Definition: decode.h:466
Frame::type
uint8_t type
Definition: app-layer-frames.h:46
suricata-common.h
DetectEngineFrameInspectionEngine::next
struct DetectEngineFrameInspectionEngine * next
Definition: detect.h:510
DetectEngineThreadCtx_::inspection_recursion_counter
int inspection_recursion_counter
Definition: detect.h:1142
DetectEngineInspectFrameBufferGeneric
int DetectEngineInspectFrameBufferGeneric(DetectEngineThreadCtx *det_ctx, const DetectEngineFrameInspectionEngine *engine, const Signature *s, Packet *p, const Frames *frames, const Frame *frame)
Do the content inspection & validation for a signature.
Definition: detect-engine-frame.c:564
DetectEngineThreadCtx_::frame_inspect_progress
uint64_t frame_inspect_progress
Definition: detect.h:1131
FrameStreamData::inspect_result
int inspect_result
Definition: detect-engine-frame.c:54
PrefilterEngine_::gid
uint32_t gid
Definition: detect.h:1390
InspectionBufferSetupMulti
void InspectionBufferSetupMulti(InspectionBuffer *buffer, const DetectEngineTransforms *transforms, const uint8_t *data, const uint32_t data_len)
setup the buffer with our initial data
Definition: detect-engine.c:1629
TcpSession_::client
TcpStream client
Definition: stream-tcp-private.h:295
DETECT_ENGINE_INSPECT_SIG_NO_MATCH
#define DETECT_ENGINE_INSPECT_SIG_NO_MATCH
Definition: detect-engine-state.h:38
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
util-validate.h
InspectionBuffer::inspect_len
uint32_t inspect_len
Definition: detect.h:368
PrefilterEngine_::pectx
void * pectx
Definition: detect.h:1381
TcpSession_::server
TcpStream server
Definition: stream-tcp-private.h:294
InspectionBuffer::inspect
const uint8_t * inspect
Definition: detect.h:366
SCFree
#define SCFree(p)
Definition: util-mem.h:61
Signature_::id
uint32_t id
Definition: detect.h:617
Signature_
Signature container.
Definition: detect.h:582
FrameStreamData::s
const Signature * s
Definition: detect-engine-frame.c:53
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
mpm_table
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
Definition: util-mpm.c:48
StreamDataRightEdge
uint64_t StreamDataRightEdge(const TcpStream *stream, const bool eof)
Definition: stream-tcp-reassemble.c:415
PrefilterEngine_::is_last
bool is_last
Definition: detect.h:1391
DetectEngineThreadCtx_::de_ctx
DetectEngineCtx * de_ctx
Definition: detect.h:1187
suricata.h
InspectionBufferMultipleForListGet
InspectionBuffer * InspectionBufferMultipleForListGet(DetectEngineThreadCtx *det_ctx, const int list_id, const uint32_t local_id)
for a InspectionBufferMultipleForList get a InspectionBuffer
Definition: detect-engine.c:1569
dst
uint16_t dst
Definition: app-layer-dnp3.h:4
MpmCtx_
Definition: util-mpm.h:89
TcpSession_
Definition: stream-tcp-private.h:283
PrefilterEngine_::cb
union PrefilterEngine_::@100 cb
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:442
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
FrameStreamData::p
Packet * p
Definition: detect-engine-frame.c:55
StreamReassembleForFrame
int StreamReassembleForFrame(TcpSession *ssn, TcpStream *stream, StreamReassembleRawFunc Callback, void *cb_data, const uint64_t offset, const bool eof)
Definition: stream-tcp-reassemble.c:1841
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:104
DetectBufferMpmRegistry_::frame_v1
struct DetectBufferMpmRegistry_::@86::@90 frame_v1
DetectRunFrameInspectRule
int DetectRunFrameInspectRule(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, const Signature *s, Flow *f, Packet *p, const Frames *frames, const Frame *frame)
Definition: detect-engine-frame.c:227
DetectBufferMpmRegistry_::pname
char pname[32]
Definition: detect.h:671
DetectEngineFrameInspectionEngine::smd
SigMatchData * smd
Definition: detect.h:509
FrameStreamData
Definition: detect-engine-frame.c:43