suricata
detect-engine-mpm.c File Reference
#include "suricata.h"
#include "suricata-common.h"
#include "app-layer-protos.h"
#include "decode.h"
#include "detect.h"
#include "detect-engine.h"
#include "detect-engine-siggroup.h"
#include "detect-engine-mpm.h"
#include "detect-engine-iponly.h"
#include "detect-parse.h"
#include "detect-engine-prefilter.h"
#include "util-mpm.h"
#include "util-memcmp.h"
#include "util-memcpy.h"
#include "conf.h"
#include "detect-fast-pattern.h"
#include "detect-tcphdr.h"
#include "detect-udphdr.h"
#include "flow.h"
#include "flow-var.h"
#include "detect-flow.h"
#include "detect-content.h"
#include "detect-engine-payload.h"
#include "detect-engine-dns.h"
#include "stream.h"
#include "util-misc.h"
#include "util-enum.h"
#include "util-debug.h"
#include "util-print.h"
#include "util-validate.h"
Include dependency graph for detect-engine-mpm.c:

Go to the source code of this file.

Data Structures

struct  DetectFPAndItsId_
 

Macros

#define SGH_PROTO(sgh, p)   ((sgh)->init->protos[(p)] == 1)
 
#define SGH_DIRECTION_TS(sgh)   ((sgh)->init->direction & SIG_FLAG_TOSERVER)
 
#define SGH_DIRECTION_TC(sgh)   ((sgh)->init->direction & SIG_FLAG_TOCLIENT)
 

Typedefs

typedef struct DetectFPAndItsId_ DetectFPAndItsId
 

Functions

void DetectAppLayerMpmRegister2 (const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id), InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
 register a MPM engine More...
 
void DetectAppLayerMpmRegisterByParentId (DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
 copy a mpm engine from parent_id, add in transforms More...
 
void DetectMpmInitializeAppMpms (DetectEngineCtx *de_ctx)
 
int DetectMpmPrepareAppMpms (DetectEngineCtx *de_ctx)
 initialize mpm contexts for applayer buffers that are in "single or "shared" mode. More...
 
void DetectPktMpmRegister (const char *name, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id), InspectionBufferGetPktDataPtr GetData)
 register a MPM engine More...
 
void DetectPktMpmRegisterByParentId (DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
 copy a mpm engine from parent_id, add in transforms More...
 
void DetectMpmInitializePktMpms (DetectEngineCtx *de_ctx)
 
int DetectMpmPreparePktMpms (DetectEngineCtx *de_ctx)
 initialize mpm contexts for applayer buffers that are in "single or "shared" mode. More...
 
void DetectMpmInitializeBuiltinMpms (DetectEngineCtx *de_ctx)
 
int DetectMpmPrepareBuiltinMpms (DetectEngineCtx *de_ctx)
 initialize mpm contexts for builtin buffers that are in "single or "shared" mode. More...
 
int SignatureHasPacketContent (const Signature *s)
 check if a signature has patterns that are to be inspected against a packets payload (as opposed to the stream payload) More...
 
int SignatureHasStreamContent (const Signature *s)
 check if a signature has patterns that are to be inspected against the stream payload (as opposed to the individual packets payload(s)) More...
 
uint16_t PatternMatchDefaultMatcher (void)
 Function to return the multi pattern matcher algorithm to be used by the engine, based on the mpm-algo setting in yaml Use the default mpm if none is specified in the yaml file. More...
 
void PacketPatternCleanup (DetectEngineThreadCtx *det_ctx)
 cleans up the mpm instance after a match More...
 
void PatternMatchDestroy (MpmCtx *mpm_ctx, uint16_t mpm_matcher)
 
void PatternMatchThreadPrint (MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
 
void PatternMatchThreadDestroy (MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
 
void PatternMatchThreadPrepare (MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
 
uint32_t PatternStrength (uint8_t *pat, uint16_t patlen)
 Predict a strength value for patterns. More...
 
void RetrieveFPForSig (const DetectEngineCtx *de_ctx, Signature *s)
 
int MpmStoreInit (DetectEngineCtx *de_ctx)
 Initializes the MpmStore mpm hash table to be used by the detection engine context. More...
 
void MpmStoreReportStats (const DetectEngineCtx *de_ctx)
 
void MpmStoreFree (DetectEngineCtx *de_ctx)
 Frees the hash table - DetectEngineCtx->mpm_hash_table, allocated by MpmStoreInit() function. More...
 
MpmStoreMpmStorePrepareBuffer (DetectEngineCtx *de_ctx, SigGroupHead *sgh, enum MpmBuiltinBuffers buf)
 Get MpmStore for a built-in buffer type. More...
 
int PatternMatchPrepareGroup (DetectEngineCtx *de_ctx, SigGroupHead *sh)
 Prepare the pattern matcher ctx in a sig group head. More...
 
int DetectSetFastPatternAndItsId (DetectEngineCtx *de_ctx)
 Figured out the FP and their respective content ids for all the sigs in the engine. More...
 

Variables

const char * builtin_mpms []
 

Detailed Description

Macro Definition Documentation

#define SGH_DIRECTION_TC (   sgh)    ((sgh)->init->direction & SIG_FLAG_TOCLIENT)

Definition at line 777 of file detect-engine-mpm.c.

Referenced by MpmStorePrepareBuffer(), and PatternMatchPrepareGroup().

#define SGH_DIRECTION_TS (   sgh)    ((sgh)->init->direction & SIG_FLAG_TOSERVER)

Definition at line 776 of file detect-engine-mpm.c.

Referenced by MpmStorePrepareBuffer(), and PatternMatchPrepareGroup().

#define SGH_PROTO (   sgh,
 
)    ((sgh)->init->protos[(p)] == 1)

Definition at line 775 of file detect-engine-mpm.c.

Referenced by PatternMatchPrepareGroup().

Typedef Documentation

Function Documentation

void DetectAppLayerMpmRegister2 ( const char *  name,
int  direction,
int  priority,
int(*)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id)  PrefilterRegister,
InspectionBufferGetDataPtr  GetData,
AppProto  alproto,
int  tx_min_progress 
)

register a MPM engine

register an app layer keyword for mpm

Note
to be used at start up / registration only. Errors are fatal.

Definition at line 89 of file detect-engine-mpm.c.

References DetectBufferMpmRegistery_::app_v2, BUG_ON, DETECT_BUFFER_MPM_TYPE_APP, DetectBufferTypeGetByName(), DetectBufferTypeSupportsMpm(), DetectBufferTypeSupportsTransformations(), DetectBufferMpmRegistery_::direction, FatalError, DetectBufferMpmRegistery_::id, DetectBufferMpmRegistery_::name, DetectBufferMpmRegistery_::next, DetectBufferMpmRegistery_::pname, PrefilterGenericMpmRegister(), DetectBufferMpmRegistery_::PrefilterRegisterWithListId, DetectBufferMpmRegistery_::priority, SC_ERR_INITIALIZATION, SCCalloc, SCLogDebug, DetectBufferMpmRegistery_::sm_list, SupportFastPatternForSigMatchList(), and DetectBufferMpmRegistery_::type.

Referenced by DetectDceStubDataRegister(), DetectDnsQueryRegister(), DetectFiledataRegister(), DetectFilemagicRegister(), DetectFilenameRegister(), DetectHttpClientBodyRegister(), DetectHttpCookieRegister(), DetectHttpHeaderNamesRegister(), DetectHttpHeaderRegister(), DetectHttpHHRegister(), DetectHttpMethodRegister(), DetectHttpProtocolRegister(), DetectHttpRawHeaderRegister(), DetectHttpRequestLineRegister(), DetectHttpResponseLineRegister(), DetectHttpStartRegister(), DetectHttpStatCodeRegister(), DetectHttpStatMsgRegister(), DetectHttpUARegister(), DetectHttpUriRegister(), DetectKrb5CNameRegister(), DetectKrb5SNameRegister(), DetectSipMethodRegister(), DetectSipProtocolRegister(), DetectSipRequestLineRegister(), DetectSipResponseLineRegister(), DetectSipStatCodeRegister(), DetectSipStatMsgRegister(), DetectSipUriRegister(), DetectSmbNamedPipeRegister(), DetectSmbShareRegister(), DetectSNMPCommunityRegister(), DetectSshProtocolRegister(), DetectSshSoftwareRegister(), DetectTemplateBufferRegister(), DetectTlsCertsRegister(), DetectTlsFingerprintRegister(), DetectTlsIssuerRegister(), DetectTlsJa3HashRegister(), DetectTlsJa3SHashRegister(), DetectTlsJa3SStringRegister(), DetectTlsJa3StringRegister(), DetectTlsSerialRegister(), DetectTlsSniRegister(), and DetectTlsSubjectRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

void DetectMpmInitializeBuiltinMpms ( DetectEngineCtx de_ctx)
int DetectMpmPrepareAppMpms ( DetectEngineCtx de_ctx)

initialize mpm contexts for applayer buffers that are in "single or "shared" mode.

Definition at line 262 of file detect-engine-mpm.c.

References DetectEngineCtx_::app_mpms_list, DetectBufferMpmRegistery_::direction, MPM_CTX_FACTORY_UNIQUE_CONTEXT, DetectEngineCtx_::mpm_matcher, mpm_table, MpmFactoryGetMpmCtxForProfile(), DetectBufferMpmRegistery_::next, MpmTableElmt_::Prepare, DetectBufferMpmRegistery_::sgh_mpm_context, and SIG_FLAG_TOSERVER.

Referenced by SigGroupBuild().

Here is the call graph for this function:

Here is the caller graph for this function:

int DetectMpmPrepareBuiltinMpms ( DetectEngineCtx de_ctx)

initialize mpm contexts for builtin buffers that are in "single or "shared" mode.

Definition at line 488 of file detect-engine-mpm.c.

References MPM_CTX_FACTORY_UNIQUE_CONTEXT, DetectEngineCtx_::mpm_matcher, mpm_table, MpmFactoryGetMpmCtxForProfile(), MpmTableElmt_::Prepare, DetectEngineCtx_::sgh_mpm_context_proto_other_packet, DetectEngineCtx_::sgh_mpm_context_proto_tcp_packet, DetectEngineCtx_::sgh_mpm_context_proto_udp_packet, and DetectEngineCtx_::sgh_mpm_context_stream.

Referenced by SigGroupBuild().

Here is the call graph for this function:

Here is the caller graph for this function:

int DetectMpmPreparePktMpms ( DetectEngineCtx de_ctx)
int MpmStoreInit ( DetectEngineCtx de_ctx)

Initializes the MpmStore mpm hash table to be used by the detection engine context.

Parameters
de_ctxPointer to the detection engine context.
Return values
0On success.
-1On failure.

Definition at line 1038 of file detect-engine-mpm.c.

References DetectEngineCtx_::app_mpms_list, DetectBufferMpmRegistery_::direction, MpmStore_::direction, HashListTableAdd(), HashListTableInit(), HashListTableLookup(), DetectEngineCtx_::mpm_hash_table, DetectBufferMpmRegistery_::next, DetectEngineCtx_::pkt_mpms_list, DetectBufferMpmRegistery_::sm_list, and MpmStore_::sm_list.

Referenced by DetectEngineInspectPktBufferGeneric().

Here is the call graph for this function:

Here is the caller graph for this function:

MpmStore* MpmStorePrepareBuffer ( DetectEngineCtx de_ctx,
SigGroupHead sgh,
enum MpmBuiltinBuffers  buf 
)

Get MpmStore for a built-in buffer type.

Definition at line 1292 of file detect-engine-mpm.c.

References SigGroupHeadInitData_::app_mpms, DetectEngineCtx_::app_mpms_list, DetectEngineCtx_::app_mpms_list_cnt, MpmStore_::buffer, BUG_ON, DETECT_SM_LIST_PMATCH, DetectEngineGetMaxSigId, DetectBufferMpmRegistery_::direction, MpmStore_::direction, Signature_::flags, SigGroupHead_::flags, DetectBufferMpmRegistery_::id, SigGroupHead_::init, Signature_::init_data, SigGroupHead_::match_array, MpmStore_::mpm_ctx, SignatureInitData_::mpm_sm, MPMB_MAX, MPMB_OTHERIP, MPMB_TCP_PKT_TC, MPMB_TCP_PKT_TS, MPMB_TCP_STREAM_TC, MPMB_TCP_STREAM_TS, MPMB_UDP_TC, MPMB_UDP_TS, DetectBufferMpmRegistery_::name, DetectBufferMpmRegistery_::next, Signature_::num, SigGroupHeadInitData_::pkt_mpms, DetectEngineCtx_::pkt_mpms_list, DetectEngineCtx_::pkt_mpms_list_cnt, DetectBufferMpmRegistery_::PrefilterRegisterWithListId, SCCalloc, SCFree, SCLogDebug, SGH_DIRECTION_TC, SGH_DIRECTION_TS, DetectBufferMpmRegistery_::sgh_mpm_context, MpmStore_::sgh_mpm_context, DetectEngineCtx_::sgh_mpm_context_proto_other_packet, DetectEngineCtx_::sgh_mpm_context_proto_tcp_packet, DetectEngineCtx_::sgh_mpm_context_proto_udp_packet, DetectEngineCtx_::sgh_mpm_context_stream, MpmStore_::sid_array, MpmStore_::sid_array_size, SigGroupHead_::sig_cnt, SIG_FLAG_TOCLIENT, SIG_FLAG_TOSERVER, SIG_GROUP_HEAD_HAVERAWSTREAM, SigMatchListSMBelongsTo(), SignatureHasPacketContent(), SignatureHasStreamContent(), DetectBufferMpmRegistery_::sm_list, and MpmStore_::sm_list.

Referenced by PatternMatchPrepareGroup().

Here is the call graph for this function:

Here is the caller graph for this function:

void PacketPatternCleanup ( DetectEngineThreadCtx det_ctx)

cleans up the mpm instance after a match

Definition at line 656 of file detect-engine-mpm.c.

References DetectEngineThreadCtx_::pmq, and PmqReset().

Referenced by SigMatchSignaturesGetSgh().

Here is the call graph for this function:

Here is the caller graph for this function:

uint16_t PatternMatchDefaultMatcher ( void  )

Function to return the multi pattern matcher algorithm to be used by the engine, based on the mpm-algo setting in yaml Use the default mpm if none is specified in the yaml file.

Return values
mpmalgo value

Definition at line 615 of file detect-engine-mpm.c.

References ConfGet(), mpm_default_matcher, mpm_table, MPM_TABLE_SIZE, SC_ERR_INVALID_YAML_CONF_ENTRY, and SCLogError.

Referenced by AppLayerProtoDetectSetup(), and DetectEngineInspectPktBufferGeneric().

Here is the call graph for this function:

Here is the caller graph for this function:

void PatternMatchDestroy ( MpmCtx mpm_ctx,
uint16_t  mpm_matcher 
)

Definition at line 661 of file detect-engine-mpm.c.

References MpmTableElmt_::DestroyCtx, mpm_table, and SCLogDebug.

int PatternMatchPrepareGroup ( DetectEngineCtx de_ctx,
SigGroupHead sh 
)

Prepare the pattern matcher ctx in a sig group head.

Definition at line 1662 of file detect-engine-mpm.c.

References MpmStore_::mpm_ctx, MPMB_OTHERIP, MPMB_TCP_PKT_TC, MPMB_TCP_PKT_TS, MPMB_TCP_STREAM_TC, MPMB_TCP_STREAM_TS, MPMB_UDP_TC, MPMB_UDP_TS, MpmStorePrepareBuffer(), PrefilterPktPayloadRegister(), PrefilterPktStreamRegister(), SGH_DIRECTION_TC, SGH_DIRECTION_TS, and SGH_PROTO.

Referenced by PrefilterSetupRuleGroup().

Here is the call graph for this function:

Here is the caller graph for this function:

void PatternMatchThreadDestroy ( MpmThreadCtx mpm_thread_ctx,
uint16_t  mpm_matcher 
)

Definition at line 672 of file detect-engine-mpm.c.

References MpmTableElmt_::DestroyThreadCtx, mpm_table, and SCLogDebug.

Referenced by DetectEngineThreadCtxInit().

Here is the caller graph for this function:

void PatternMatchThreadPrepare ( MpmThreadCtx mpm_thread_ctx,
uint16_t  mpm_matcher 
)

Definition at line 678 of file detect-engine-mpm.c.

References MpmInitThreadCtx(), and SCLogDebug.

Referenced by DetectEngineResetMaxSigId().

Here is the call graph for this function:

Here is the caller graph for this function:

void PatternMatchThreadPrint ( MpmThreadCtx mpm_thread_ctx,
uint16_t  mpm_matcher 
)

Definition at line 667 of file detect-engine-mpm.c.

References SCLogDebug.

Referenced by DetectEngineThreadCtxInfo().

Here is the caller graph for this function:

uint32_t PatternStrength ( uint8_t *  pat,
uint16_t  patlen 
)

Predict a strength value for patterns.

Patterns with high character diversity score higher. Alpha chars score not so high Other printable + a few common codes a little higher Everything else highest. Longer patterns score better than short patters.

Parameters
patpattern
patlenlength of the pattern
Return values
spattern score

Definition at line 697 of file detect-engine-mpm.c.

References DetectContentData_::content, DetectContentData_::content_len, DetectContentData_::depth, DETECT_CONTENT_DEPTH_BE, DETECT_CONTENT_NOCASE, DETECT_CONTENT_OFFSET_BE, DetectContentData_::flags, flags, DetectContentData_::fp_chop_len, DetectContentData_::fp_chop_offset, DetectContentData_::id, MPM_PATTERN_CTX_OWNS_ID, MpmAddPatternCI(), MpmAddPatternCS(), Signature_::num, and DetectContentData_::offset.

Referenced by PacketCreateMask().

Here is the call graph for this function:

Here is the caller graph for this function:

int SignatureHasPacketContent ( const Signature s)

check if a signature has patterns that are to be inspected against a packets payload (as opposed to the stream payload)

Parameters
ssignature
Return values
1true
0false

Definition at line 545 of file detect-engine-mpm.c.

References DETECT_SM_LIST_PMATCH, Signature_::flags, Signature_::init_data, DetectProto_::proto, Signature_::proto, SCEnter, SCLogDebug, SCReturnInt, SIG_FLAG_REQUIRE_PACKET, Signature_::sm_arrays, and SignatureInitData_::smlists.

Referenced by MpmStorePrepareBuffer(), and PerCentEncodingMatch().

Here is the caller graph for this function:

int SignatureHasStreamContent ( const Signature s)

check if a signature has patterns that are to be inspected against the stream payload (as opposed to the individual packets payload(s))

Parameters
ssignature
Return values
1true
0false

Definition at line 581 of file detect-engine-mpm.c.

References DETECT_SM_LIST_PMATCH, Signature_::flags, Signature_::init_data, DetectProto_::proto, Signature_::proto, SCEnter, SCLogDebug, SCReturnInt, SIG_FLAG_REQUIRE_STREAM, Signature_::sm_arrays, and SignatureInitData_::smlists.

Referenced by MpmStorePrepareBuffer(), and PerCentEncodingMatch().

Here is the caller graph for this function:

Variable Documentation

const char* builtin_mpms[]
Initial value:
= {
"toserver TCP packet",
"toclient TCP packet",
"toserver TCP stream",
"toclient TCP stream",
"toserver UDP packet",
"toclient UDP packet",
"other IP packet",
NULL }

Definition at line 66 of file detect-engine-mpm.c.

Referenced by MpmStoreReportStats().