suricata
detect-engine-mpm.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  *
24  * Multi pattern matcher
25  */
26 
27 #include "suricata.h"
28 #include "suricata-common.h"
29 
30 #include "app-layer-protos.h"
31 
32 #include "decode.h"
33 #include "detect.h"
34 #include "detect-engine.h"
35 #include "detect-engine-siggroup.h"
36 #include "detect-engine-mpm.h"
37 #include "detect-engine-iponly.h"
38 #include "detect-parse.h"
39 #include "detect-engine-prefilter.h"
40 #include "util-mpm.h"
41 #include "util-memcmp.h"
42 #include "util-memcpy.h"
43 #include "conf.h"
44 #include "detect-fast-pattern.h"
45 
46 #include "detect-tcphdr.h"
47 #include "detect-udphdr.h"
48 
49 #include "flow.h"
50 #include "flow-var.h"
51 #include "detect-flow.h"
52 
53 #include "detect-content.h"
54 
55 #include "detect-engine-payload.h"
56 
57 #include "stream.h"
58 
59 #include "util-misc.h"
60 #include "util-enum.h"
61 #include "util-debug.h"
62 #include "util-print.h"
63 #include "util-validate.h"
64 #include "util-hash-string.h"
65 
66 const char *builtin_mpms[] = {
67  "toserver TCP packet",
68  "toclient TCP packet",
69  "toserver TCP stream",
70  "toclient TCP stream",
71  "toserver UDP packet",
72  "toclient UDP packet",
73  "other IP packet",
74 
75  NULL };
76 
77 /* Registry for mpm keywords
78  *
79  * Keywords are registered at engine start up
80  */
81 
82 static DetectBufferMpmRegistry *g_mpm_list[DETECT_BUFFER_MPM_TYPE_SIZE] = { NULL, NULL, NULL };
83 static int g_mpm_list_cnt[DETECT_BUFFER_MPM_TYPE_SIZE] = { 0, 0, 0 };
84 
85 /** \brief register a MPM engine
86  *
87  * \note to be used at start up / registration only. Errors are fatal.
88  */
89 static void RegisterInternal(const char *name, int direction, int priority,
90  PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData,
91  InspectionMultiBufferGetDataPtr GetMultiData, AppProto alproto, int tx_min_progress)
92 {
93  SCLogDebug("registering %s/%d/%d/%p/%p/%u/%d", name, direction, priority,
94  PrefilterRegister, GetData, alproto, tx_min_progress);
95 
96  BUG_ON(tx_min_progress >= 48);
97 
98  if (PrefilterRegister == PrefilterGenericMpmRegister && GetData == NULL) {
99  // must register GetData with PrefilterGenericMpmRegister
100  abort();
101  }
102 
103  DetectBufferTypeSupportsMpm(name);
104  DetectBufferTypeSupportsTransformations(name);
105  int sm_list = DetectBufferTypeGetByName(name);
106  if (sm_list == -1) {
107  FatalError("MPM engine registration for %s failed", name);
108  }
109 
110  // every HTTP2 can be accessed from DOH2
111  if (alproto == ALPROTO_HTTP2 || alproto == ALPROTO_DNS) {
112  RegisterInternal(name, direction, priority, PrefilterRegister, GetData, GetMultiData,
113  ALPROTO_DOH2, tx_min_progress);
114  }
115  DetectBufferMpmRegistry *am = SCCalloc(1, sizeof(*am));
116  BUG_ON(am == NULL);
117  am->name = name;
118  snprintf(am->pname, sizeof(am->pname), "%s", am->name);
119  am->direction = direction;
120  DEBUG_VALIDATE_BUG_ON(sm_list < 0 || sm_list > INT16_MAX);
121  am->sm_list = (int16_t)sm_list;
122  am->sm_list_base = (int16_t)sm_list;
123  am->priority = priority;
124  am->type = DETECT_BUFFER_MPM_TYPE_APP;
125 
126  am->PrefilterRegisterWithListId = PrefilterRegister;
127  if (GetData != NULL) {
128  am->app_v2.GetData = GetData;
129  } else if (GetMultiData != NULL) {
130  am->app_v2.GetMultiData = GetMultiData;
131  }
132  am->app_v2.alproto = alproto;
133  am->app_v2.tx_min_progress = tx_min_progress;
134 
135  if (g_mpm_list[DETECT_BUFFER_MPM_TYPE_APP] == NULL) {
136  g_mpm_list[DETECT_BUFFER_MPM_TYPE_APP] = am;
137  } else {
138  DetectBufferMpmRegistry *t = g_mpm_list[DETECT_BUFFER_MPM_TYPE_APP];
139  while (t->next != NULL) {
140  t = t->next;
141  }
142 
143  t->next = am;
144  am->id = t->id + 1;
145  }
146  g_mpm_list_cnt[DETECT_BUFFER_MPM_TYPE_APP]++;
147 
148  SupportFastPatternForSigMatchList(sm_list, priority);
149 }
150 
151 void DetectAppLayerMpmRegister(const char *name, int direction, int priority,
152  PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData,
153  AppProto alproto, int tx_min_progress)
154 {
155  RegisterInternal(
156  name, direction, priority, PrefilterRegister, GetData, NULL, alproto, tx_min_progress);
157 }
158 
159 void DetectAppLayerMpmMultiRegister(const char *name, int direction, int priority,
160  PrefilterRegisterFunc PrefilterRegister, InspectionMultiBufferGetDataPtr GetData,
161  AppProto alproto, int tx_min_progress)
162 {
163  RegisterInternal(
164  name, direction, priority, PrefilterRegister, NULL, GetData, alproto, tx_min_progress);
165 }
166 
167 /** \brief copy a mpm engine from parent_id, add in transforms */
168 void DetectAppLayerMpmRegisterByParentId(DetectEngineCtx *de_ctx,
169  const int id, const int parent_id,
170  DetectEngineTransforms *transforms)
171 {
172  SCLogDebug("registering %d/%d", id, parent_id);
173 
174  DetectBufferMpmRegistry *t = de_ctx->app_mpms_list;
175  while (t) {
176  if (t->sm_list == parent_id) {
177  DetectBufferMpmRegistry *am = SCCalloc(1, sizeof(*am));
178  BUG_ON(am == NULL);
179  am->name = t->name;
180  am->direction = t->direction;
181  DEBUG_VALIDATE_BUG_ON(id < 0 || id > INT16_MAX);
182  am->sm_list = (uint16_t)id; // use new id
183  am->sm_list_base = t->sm_list;
184  am->type = DETECT_BUFFER_MPM_TYPE_APP;
185  am->PrefilterRegisterWithListId = t->PrefilterRegisterWithListId;
186  am->app_v2.GetData = t->app_v2.GetData;
187  am->app_v2.alproto = t->app_v2.alproto;
188  am->app_v2.tx_min_progress = t->app_v2.tx_min_progress;
189  am->priority = t->priority;
190  am->sgh_mpm_context = t->sgh_mpm_context;
191  am->sgh_mpm_context = MpmFactoryRegisterMpmCtxProfile(
192  de_ctx, am->name, am->sm_list, am->app_v2.alproto);
193  am->next = t->next;
194  if (transforms) {
195  memcpy(&am->transforms, transforms, sizeof(*transforms));
196 
197  /* create comma separated string of the names of the
198  * transforms and then shorten it if necessary. Finally
199  * use it to construct the 'profile' name for the engine */
200  char xforms[1024] = "";
201  for (int i = 0; i < transforms->cnt; i++) {
202  char ttstr[64];
203  (void)snprintf(ttstr,sizeof(ttstr), "%s,",
204  sigmatch_table[transforms->transforms[i].transform].name);
205  strlcat(xforms, ttstr, sizeof(xforms));
206  }
207  xforms[strlen(xforms)-1] = '\0';
208 
209  size_t space = sizeof(am->pname) - strlen(am->name) - 3;
210  char toprint[space + 1];
211  memset(toprint, 0x00, space + 1);
212  if (space < strlen(xforms)) {
213  ShortenString(xforms, toprint, space, '~');
214  } else {
215  strlcpy(toprint, xforms,sizeof(toprint));
216  }
217  (void)snprintf(am->pname, sizeof(am->pname), "%s#%d (%s)",
218  am->name, id, toprint);
219  } else {
220  (void)snprintf(am->pname, sizeof(am->pname), "%s#%d",
221  am->name, id);
222  }
223  am->id = de_ctx->app_mpms_list_cnt++;
224 
225  DetectEngineRegisterFastPatternForId(de_ctx, am->sm_list, am->priority);
226  t->next = am;
227  SCLogDebug("copied mpm registration for %s id %u "
228  "with parent %u and GetData %p",
229  t->name, id, parent_id, am->app_v2.GetData);
230  t = am;
231  }
232  t = t->next;
233  }
234 }
235 
236 void DetectMpmInitializeAppMpms(DetectEngineCtx *de_ctx)
237 {
238  const DetectBufferMpmRegistry *list = g_mpm_list[DETECT_BUFFER_MPM_TYPE_APP];
239  DetectBufferMpmRegistry *toadd = de_ctx->app_mpms_list;
240  while (list != NULL) {
241  DetectBufferMpmRegistry *n = SCCalloc(1, sizeof(*n));
242  BUG_ON(n == NULL);
243 
244  *n = *list;
245  n->next = NULL;
246 
247  if (toadd == NULL) {
248  toadd = n;
249  de_ctx->app_mpms_list = n;
250  } else {
251  toadd->next = n;
252  toadd = toadd->next;
253  }
254 
255  /* default to whatever the global setting is */
256  int shared = (de_ctx->sgh_mpm_ctx_cnf == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE);
257 
258  /* see if we use a unique or shared mpm ctx for this type */
259  int confshared = 0;
260  char confstring[256] = "detect.mpm.";
261  strlcat(confstring, n->name, sizeof(confstring));
262  strlcat(confstring, ".shared", sizeof(confstring));
263  if (ConfGetBool(confstring, &confshared) == 1)
264  shared = confshared;
265 
266  if (shared == 0) {
267  SCLogDebug("using unique mpm ctx' for %s", n->name);
268  n->sgh_mpm_context = MPM_CTX_FACTORY_UNIQUE_CONTEXT;
269  } else {
270  SCLogDebug("using shared mpm ctx' for %s", n->name);
271  n->sgh_mpm_context =
272  MpmFactoryRegisterMpmCtxProfile(de_ctx, n->name, n->sm_list, n->app_v2.alproto);
273  }
274 
275  list = list->next;
276  }
277  de_ctx->app_mpms_list_cnt = g_mpm_list_cnt[DETECT_BUFFER_MPM_TYPE_APP];
278  SCLogDebug("mpm: de_ctx app_mpms_list %p %u",
279  de_ctx->app_mpms_list, de_ctx->app_mpms_list_cnt);
280 }
281 
282 /**
283  * \brief initialize mpm contexts for applayer buffers that are in
284  * "single or "shared" mode.
285  */
286 int DetectMpmPrepareAppMpms(DetectEngineCtx *de_ctx)
287 {
288  int r = 0;
289  const DetectBufferMpmRegistry *am = de_ctx->app_mpms_list;
290  while (am != NULL) {
291  int dir = (am->direction == SIG_FLAG_TOSERVER) ? 1 : 0;
292 
293  if (am->sgh_mpm_context != MPM_CTX_FACTORY_UNIQUE_CONTEXT)
294  {
295  MpmCtx *mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, am->sgh_mpm_context, dir);
296  if (mpm_ctx != NULL) {
297  if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
298  r |= mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
299  }
300  }
301  }
302  am = am->next;
303  }
304  return r;
305 }
306 
307 /** \brief register a MPM engine
308  *
309  * \note to be used at start up / registration only. Errors are fatal.
310  */
311 void DetectFrameMpmRegister(const char *name, int direction, int priority,
312  int (*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx,
313  const DetectBufferMpmRegistry *mpm_reg, int list_id),
314  AppProto alproto, uint8_t type)
315 {
316  SCLogDebug("registering %s/%d/%p/%s/%u", name, priority, PrefilterRegister,
317  AppProtoToString(alproto), type);
318 
319  DetectBufferTypeSupportsMpm(name);
320  DetectBufferTypeSupportsFrames(name);
321  DetectBufferTypeSupportsTransformations(name);
322  int sm_list = DetectBufferTypeGetByName(name);
323  if (sm_list < 0 || sm_list > UINT16_MAX) {
324  FatalError("MPM engine registration for %s failed", name);
325  }
326 
327  DetectBufferMpmRegistry *am = SCCalloc(1, sizeof(*am));
328  BUG_ON(am == NULL);
329  am->name = name;
330  snprintf(am->pname, sizeof(am->pname), "%s", am->name);
331  am->sm_list = (uint16_t)sm_list;
332  am->direction = direction;
333  am->priority = priority;
334  am->type = DETECT_BUFFER_MPM_TYPE_FRAME;
335 
336  am->PrefilterRegisterWithListId = PrefilterRegister;
337  am->frame_v1.alproto = alproto;
338  am->frame_v1.type = type;
339  SCLogDebug("type %u", type);
340  SCLogDebug("am type %u", am->frame_v1.type);
341 
342  if (g_mpm_list[DETECT_BUFFER_MPM_TYPE_FRAME] == NULL) {
343  g_mpm_list[DETECT_BUFFER_MPM_TYPE_FRAME] = am;
344  } else {
345  DetectBufferMpmRegistry *t = g_mpm_list[DETECT_BUFFER_MPM_TYPE_FRAME];
346  while (t->next != NULL) {
347  t = t->next;
348  }
349  t->next = am;
350  am->id = t->id + 1;
351  }
352  g_mpm_list_cnt[DETECT_BUFFER_MPM_TYPE_FRAME]++;
353 
354  SupportFastPatternForSigMatchList(sm_list, priority);
355  SCLogDebug("%s/%d done", name, sm_list);
356 }
357 
358 /** \brief copy a mpm engine from parent_id, add in transforms */
359 void DetectFrameMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id,
360  DetectEngineTransforms *transforms)
361 {
362  SCLogDebug("registering %d/%d", id, parent_id);
363 
364  DetectBufferMpmRegistry *t = de_ctx->frame_mpms_list;
365  while (t) {
366  if (t->sm_list == parent_id) {
367  DetectBufferMpmRegistry *am = SCCalloc(1, sizeof(*am));
368  BUG_ON(am == NULL);
369  am->name = t->name;
370  snprintf(am->pname, sizeof(am->pname), "%s#%d", am->name, id);
371  DEBUG_VALIDATE_BUG_ON(id < 0 || id > UINT16_MAX);
372  am->sm_list = (uint16_t)id; // use new id
373  am->sm_list_base = t->sm_list;
374  am->type = DETECT_BUFFER_MPM_TYPE_FRAME;
375  am->PrefilterRegisterWithListId = t->PrefilterRegisterWithListId;
376  am->frame_v1 = t->frame_v1;
377  SCLogDebug("am type %u", am->frame_v1.type);
378  am->priority = t->priority;
379  am->direction = t->direction;
380  am->sgh_mpm_context = t->sgh_mpm_context;
381  am->next = t->next;
382  if (transforms) {
383  memcpy(&am->transforms, transforms, sizeof(*transforms));
384  }
385  am->id = de_ctx->frame_mpms_list_cnt++;
386 
387  DetectEngineRegisterFastPatternForId(de_ctx, am->sm_list, am->priority);
388  t->next = am;
389  SCLogDebug("copied mpm registration for %s id %u "
390  "with parent %u",
391  t->name, id, parent_id);
392  t = am;
393  }
394  t = t->next;
395  }
396 }
397 
398 void DetectEngineFrameMpmRegister(DetectEngineCtx *de_ctx, const char *name, int direction,
399  int priority,
400  int (*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx,
401  const DetectBufferMpmRegistry *mpm_reg, int list_id),
402  AppProto alproto, uint8_t type)
403 {
404  SCLogDebug("registering %s/%d/%p/%s/%u", name, priority, PrefilterRegister,
405  AppProtoToString(alproto), type);
406 
407  const int sm_list = DetectEngineBufferTypeRegister(de_ctx, name);
408  if (sm_list < 0 || sm_list > UINT16_MAX) {
409  FatalError("MPM engine registration for %s failed", name);
410  }
411 
412  DetectEngineBufferTypeSupportsMpm(de_ctx, name);
413  DetectEngineBufferTypeSupportsFrames(de_ctx, name);
414  DetectEngineBufferTypeSupportsTransformations(de_ctx, name);
415 
416  DetectBufferMpmRegistry *am = SCCalloc(1, sizeof(*am));
417  BUG_ON(am == NULL);
418  am->name = name;
419  snprintf(am->pname, sizeof(am->pname), "%s", am->name);
420  am->sm_list = (uint16_t)sm_list;
421  am->direction = direction;
422  am->priority = priority;
423  am->type = DETECT_BUFFER_MPM_TYPE_FRAME;
424 
425  am->PrefilterRegisterWithListId = PrefilterRegister;
426  am->frame_v1.alproto = alproto;
427  am->frame_v1.type = type;
428 
429  // TODO is it ok to do this here?
430 
431  /* default to whatever the global setting is */
432  int shared = (de_ctx->sgh_mpm_ctx_cnf == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE);
433  /* see if we use a unique or shared mpm ctx for this type */
434  int confshared = 0;
435  if (ConfGetBool("detect.mpm.frame.shared", &confshared) == 1)
436  shared = confshared;
437 
438  if (shared == 0) {
439  am->sgh_mpm_context = MPM_CTX_FACTORY_UNIQUE_CONTEXT;
440  } else {
441  am->sgh_mpm_context =
442  MpmFactoryRegisterMpmCtxProfile(de_ctx, am->name, am->sm_list, alproto);
443  }
444 
445  if (de_ctx->frame_mpms_list == NULL) {
446  de_ctx->frame_mpms_list = am;
447  } else {
448  DetectBufferMpmRegistry *t = de_ctx->frame_mpms_list;
449  while (t->next != NULL) {
450  t = t->next;
451  }
452 
453  t->next = am;
454  }
455  de_ctx->frame_mpms_list_cnt++;
456 
457  DetectEngineRegisterFastPatternForId(de_ctx, sm_list, priority);
458  SCLogDebug("%s/%d done", name, sm_list);
459 }
460 
461 void DetectMpmInitializeFrameMpms(DetectEngineCtx *de_ctx)
462 {
463  const DetectBufferMpmRegistry *list = g_mpm_list[DETECT_BUFFER_MPM_TYPE_FRAME];
464  while (list != NULL) {
465  DetectBufferMpmRegistry *n = SCCalloc(1, sizeof(*n));
466  BUG_ON(n == NULL);
467 
468  *n = *list;
469  n->next = NULL;
470 
471  if (de_ctx->frame_mpms_list == NULL) {
472  de_ctx->frame_mpms_list = n;
473  } else {
474  DetectBufferMpmRegistry *t = de_ctx->frame_mpms_list;
475  while (t->next != NULL) {
476  t = t->next;
477  }
478 
479  t->next = n;
480  }
481 
482  /* default to whatever the global setting is */
483  int shared = (de_ctx->sgh_mpm_ctx_cnf == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE);
484 
485  /* see if we use a unique or shared mpm ctx for this type */
486  int confshared = 0;
487  char confstring[256] = "detect.mpm.";
488  strlcat(confstring, n->name, sizeof(confstring));
489  strlcat(confstring, ".shared", sizeof(confstring));
490  if (ConfGetBool(confstring, &confshared) == 1)
491  shared = confshared;
492 
493  if (shared == 0) {
494  SCLogDebug("using unique mpm ctx' for %s", n->name);
495  n->sgh_mpm_context = MPM_CTX_FACTORY_UNIQUE_CONTEXT;
496  } else {
497  SCLogDebug("using shared mpm ctx' for %s", n->name);
498  n->sgh_mpm_context = MpmFactoryRegisterMpmCtxProfile(
499  de_ctx, n->name, n->sm_list, n->frame_v1.alproto);
500  }
501 
502  list = list->next;
503  }
504  de_ctx->frame_mpms_list_cnt = g_mpm_list_cnt[DETECT_BUFFER_MPM_TYPE_FRAME];
505  SCLogDebug("mpm: de_ctx frame_mpms_list %p %u", de_ctx->frame_mpms_list,
506  de_ctx->frame_mpms_list_cnt);
507 }
508 
509 /**
510  * \brief initialize mpm contexts for applayer buffers that are in
511  * "single or "shared" mode.
512  */
513 int DetectMpmPrepareFrameMpms(DetectEngineCtx *de_ctx)
514 {
515  SCLogDebug("preparing frame mpm");
516  int r = 0;
517  const DetectBufferMpmRegistry *am = de_ctx->frame_mpms_list;
518  while (am != NULL) {
519  SCLogDebug("am %p %s sgh_mpm_context %d", am, am->name, am->sgh_mpm_context);
520  SCLogDebug("%s", am->name);
521  if (am->sgh_mpm_context != MPM_CTX_FACTORY_UNIQUE_CONTEXT) {
522  int dir = (am->direction == SIG_FLAG_TOSERVER) ? 1 : 0;
523  MpmCtx *mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, am->sgh_mpm_context, dir);
524  SCLogDebug("%s: %d mpm_Ctx %p", am->name, r, mpm_ctx);
525  if (mpm_ctx != NULL) {
526  if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
527  r |= mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
528  SCLogDebug("%s: %d", am->name, r);
529  }
530  }
531  }
532  am = am->next;
533  }
534  return r;
535 }
536 
537 /** \brief register a MPM engine
538  *
539  * \note to be used at start up / registration only. Errors are fatal.
540  */
541 void DetectPktMpmRegister(const char *name, int priority,
542  int (*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx,
543  const DetectBufferMpmRegistry *mpm_reg, int list_id),
544  InspectionBufferGetPktDataPtr GetData)
545 {
546  SCLogDebug("registering %s/%d/%p/%p", name, priority,
547  PrefilterRegister, GetData);
548 
549  if (PrefilterRegister == PrefilterGenericMpmPktRegister && GetData == NULL) {
550  // must register GetData with PrefilterGenericMpmRegister
551  abort();
552  }
553 
554  DetectBufferTypeSupportsMpm(name);
555  DetectBufferTypeSupportsTransformations(name);
556  int sm_list = DetectBufferTypeGetByName(name);
557  if (sm_list == -1) {
558  FatalError("MPM engine registration for %s failed", name);
559  }
560 
561  DetectBufferMpmRegistry *am = SCCalloc(1, sizeof(*am));
562  BUG_ON(am == NULL);
563  am->name = name;
564  snprintf(am->pname, sizeof(am->pname), "%s", am->name);
565  DEBUG_VALIDATE_BUG_ON(sm_list < 0 || sm_list > INT16_MAX);
566  am->sm_list = (uint16_t)sm_list;
567  am->priority = priority;
568  am->type = DETECT_BUFFER_MPM_TYPE_PKT;
569 
570  am->PrefilterRegisterWithListId = PrefilterRegister;
571  am->pkt_v1.GetData = GetData;
572 
573  if (g_mpm_list[DETECT_BUFFER_MPM_TYPE_PKT] == NULL) {
574  g_mpm_list[DETECT_BUFFER_MPM_TYPE_PKT] = am;
575  } else {
576  DetectBufferMpmRegistry *t = g_mpm_list[DETECT_BUFFER_MPM_TYPE_PKT];
577  while (t->next != NULL) {
578  t = t->next;
579  }
580  t->next = am;
581  am->id = t->id + 1;
582  }
583  g_mpm_list_cnt[DETECT_BUFFER_MPM_TYPE_PKT]++;
584 
585  SupportFastPatternForSigMatchList(sm_list, priority);
586  SCLogDebug("%s/%d done", name, sm_list);
587 }
588 
589 /** \brief copy a mpm engine from parent_id, add in transforms */
590 void DetectPktMpmRegisterByParentId(DetectEngineCtx *de_ctx,
591  const int id, const int parent_id,
592  DetectEngineTransforms *transforms)
593 {
594  SCLogDebug("registering %d/%d", id, parent_id);
595 
596  DetectBufferMpmRegistry *t = de_ctx->pkt_mpms_list;
597  while (t) {
598  if (t->sm_list == parent_id) {
599  DetectBufferMpmRegistry *am = SCCalloc(1, sizeof(*am));
600  BUG_ON(am == NULL);
601  am->name = t->name;
602  snprintf(am->pname, sizeof(am->pname), "%s#%d", am->name, id);
603  DEBUG_VALIDATE_BUG_ON(id < 0 || id > INT16_MAX);
604  am->sm_list = (uint16_t)id; // use new id
605  am->sm_list_base = t->sm_list;
606  am->type = DETECT_BUFFER_MPM_TYPE_PKT;
607  am->PrefilterRegisterWithListId = t->PrefilterRegisterWithListId;
608  am->pkt_v1.GetData = t->pkt_v1.GetData;
609  am->priority = t->priority;
610  am->sgh_mpm_context = t->sgh_mpm_context;
611  am->next = t->next;
612  if (transforms) {
613  memcpy(&am->transforms, transforms, sizeof(*transforms));
614  }
615  am->id = de_ctx->pkt_mpms_list_cnt++;
616 
617  DetectEngineRegisterFastPatternForId(de_ctx, am->sm_list, am->priority);
618  t->next = am;
619  SCLogDebug("copied mpm registration for %s id %u "
620  "with parent %u and GetData %p",
621  t->name, id, parent_id, am->pkt_v1.GetData);
622  t = am;
623  }
624  t = t->next;
625  }
626 }
627 
628 void DetectMpmInitializePktMpms(DetectEngineCtx *de_ctx)
629 {
630  const DetectBufferMpmRegistry *list = g_mpm_list[DETECT_BUFFER_MPM_TYPE_PKT];
631  while (list != NULL) {
632  DetectBufferMpmRegistry *n = SCCalloc(1, sizeof(*n));
633  BUG_ON(n == NULL);
634 
635  *n = *list;
636  n->next = NULL;
637 
638  if (de_ctx->pkt_mpms_list == NULL) {
639  de_ctx->pkt_mpms_list = n;
640  } else {
641  DetectBufferMpmRegistry *t = de_ctx->pkt_mpms_list;
642  while (t->next != NULL) {
643  t = t->next;
644  }
645 
646  t->next = n;
647  }
648 
649  /* default to whatever the global setting is */
650  int shared = (de_ctx->sgh_mpm_ctx_cnf == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE);
651 
652  /* see if we use a unique or shared mpm ctx for this type */
653  int confshared = 0;
654  char confstring[256] = "detect.mpm.";
655  strlcat(confstring, n->name, sizeof(confstring));
656  strlcat(confstring, ".shared", sizeof(confstring));
657  if (ConfGetBool(confstring, &confshared) == 1)
658  shared = confshared;
659 
660  if (shared == 0) {
661  SCLogDebug("using unique mpm ctx' for %s", n->name);
662  n->sgh_mpm_context = MPM_CTX_FACTORY_UNIQUE_CONTEXT;
663  } else {
664  SCLogDebug("using shared mpm ctx' for %s", n->name);
665  n->sgh_mpm_context =
666  MpmFactoryRegisterMpmCtxProfile(de_ctx, n->name, n->sm_list, ALPROTO_UNKNOWN);
667  }
668 
669  list = list->next;
670  }
671  de_ctx->pkt_mpms_list_cnt = g_mpm_list_cnt[DETECT_BUFFER_MPM_TYPE_PKT];
672  SCLogDebug("mpm: de_ctx pkt_mpms_list %p %u",
673  de_ctx->pkt_mpms_list, de_ctx->pkt_mpms_list_cnt);
674 }
675 
676 /**
677  * \brief initialize mpm contexts for applayer buffers that are in
678  * "single or "shared" mode.
679  */
680 int DetectMpmPreparePktMpms(DetectEngineCtx *de_ctx)
681 {
682  SCLogDebug("preparing pkt mpm");
683  int r = 0;
684  const DetectBufferMpmRegistry *am = de_ctx->pkt_mpms_list;
685  while (am != NULL) {
686  SCLogDebug("%s", am->name);
687  if (am->sgh_mpm_context != MPM_CTX_FACTORY_UNIQUE_CONTEXT)
688  {
689  MpmCtx *mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, am->sgh_mpm_context, 0);
690  if (mpm_ctx != NULL) {
691  if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
692  r |= mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
693  SCLogDebug("%s: %d", am->name, r);
694  }
695  }
696  }
697  am = am->next;
698  }
699  return r;
700 }
701 
702 static int32_t SetupBuiltinMpm(DetectEngineCtx *de_ctx, const char *name)
703 {
704  /* default to whatever the global setting is */
705  int shared = (de_ctx->sgh_mpm_ctx_cnf == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE);
706 
707  /* see if we use a unique or shared mpm ctx for this type */
708  int confshared = 0;
709  char confstring[256] = "detect.mpm.";
710  strlcat(confstring, name, sizeof(confstring));
711  strlcat(confstring, ".shared", sizeof(confstring));
712  if (ConfGetBool(confstring, &confshared) == 1)
713  shared = confshared;
714 
715  int32_t ctx;
716  if (shared == 0) {
717  ctx = MPM_CTX_FACTORY_UNIQUE_CONTEXT;
718  SCLogDebug("using unique mpm ctx' for %s", name);
719  } else {
720  ctx = MpmFactoryRegisterMpmCtxProfile(de_ctx, name, DETECT_SM_LIST_PMATCH, ALPROTO_UNKNOWN);
721  SCLogDebug("using shared mpm ctx' for %s", name);
722  }
723  return ctx;
724 }
725 
726 void DetectMpmInitializeBuiltinMpms(DetectEngineCtx *de_ctx)
727 {
728  de_ctx->sgh_mpm_context_proto_tcp_packet = SetupBuiltinMpm(de_ctx, "tcp-packet");
729  de_ctx->sgh_mpm_context_stream = SetupBuiltinMpm(de_ctx, "tcp-stream");
730 
731  de_ctx->sgh_mpm_context_proto_udp_packet = SetupBuiltinMpm(de_ctx, "udp-packet");
732  de_ctx->sgh_mpm_context_proto_other_packet = SetupBuiltinMpm(de_ctx, "other-ip");
733 }
734 
735 /**
736  * \brief initialize mpm contexts for builtin buffers that are in
737  * "single or "shared" mode.
738  */
739 int DetectMpmPrepareBuiltinMpms(DetectEngineCtx *de_ctx)
740 {
741  int r = 0;
742  MpmCtx *mpm_ctx = NULL;
743 
744  if (de_ctx->sgh_mpm_context_proto_tcp_packet != MPM_CTX_FACTORY_UNIQUE_CONTEXT) {
745  mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_proto_tcp_packet, 0);
746  if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
747  r |= mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
748  }
749  mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_proto_tcp_packet, 1);
750  if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
751  r |= mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
752  }
753  }
754 
755  if (de_ctx->sgh_mpm_context_proto_udp_packet != MPM_CTX_FACTORY_UNIQUE_CONTEXT) {
756  mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_proto_udp_packet, 0);
757  if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
758  r |= mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
759  }
760  mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_proto_udp_packet, 1);
761  if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
762  r |= mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
763  }
764  }
765 
766  if (de_ctx->sgh_mpm_context_proto_other_packet != MPM_CTX_FACTORY_UNIQUE_CONTEXT) {
767  mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_proto_other_packet, 0);
768  if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
769  r |= mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
770  }
771  }
772 
773  if (de_ctx->sgh_mpm_context_stream != MPM_CTX_FACTORY_UNIQUE_CONTEXT) {
774  mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_stream, 0);
775  if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
776  r |= mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
777  }
778  mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_stream, 1);
779  if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
780  r |= mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
781  }
782  }
783 
784  return r;
785 }
786 
787 /**
788  * \brief check if a signature has patterns that are to be inspected
789  * against a packets payload (as opposed to the stream payload)
790  *
791  * \param s signature
792  *
793  * \retval 1 true
794  * \retval 0 false
795  */
796 int SignatureHasPacketContent(const Signature *s)
797 {
798  SCEnter();
799 
800  if (!(s->proto.proto[IPPROTO_TCP / 8] & 1 << (IPPROTO_TCP % 8))) {
801  SCReturnInt(1);
802  }
803 
804  if (s->init_data->smlists[DETECT_SM_LIST_PMATCH] == NULL) {
805  SCLogDebug("no PMATCH");
806  SCReturnInt(0);
807  }
808 
809  if (!(s->flags & SIG_FLAG_REQUIRE_PACKET)) {
810  SCReturnInt(0);
811  }
812 
813  SCReturnInt(1);
814 }
815 
816 /**
817  * \brief check if a signature has patterns that are to be inspected
818  * against the stream payload (as opposed to the individual packets
819  * payload(s))
820  *
821  * \param s signature
822  *
823  * \retval 1 true
824  * \retval 0 false
825  */
826 int SignatureHasStreamContent(const Signature *s)
827 {
828  SCEnter();
829 
830  if (!(s->proto.proto[IPPROTO_TCP / 8] & 1 << (IPPROTO_TCP % 8))) {
831  SCReturnInt(0);
832  }
833 
834  if (s->init_data->smlists[DETECT_SM_LIST_PMATCH] == NULL) {
835  SCLogDebug("no PMATCH");
836  SCReturnInt(0);
837  }
838 
839  if (!(s->flags & SIG_FLAG_REQUIRE_STREAM)) {
840  SCReturnInt(0);
841  }
842 
843  SCReturnInt(1);
844 }
845 
846 
847 /**
848  * \brief Function to return the multi pattern matcher algorithm to be
849  * used by the engine, based on the mpm-algo setting in yaml
850  * Use the default mpm if none is specified in the yaml file.
851  *
852  * \retval mpm algo value
853  */
854 uint8_t PatternMatchDefaultMatcher(void)
855 {
856  const char *mpm_algo;
857  uint8_t mpm_algo_val = mpm_default_matcher;
858 
859  /* Get the mpm algo defined in config file by the user */
860  if ((ConfGet("mpm-algo", &mpm_algo)) == 1) {
861  if (mpm_algo != NULL) {
862 #if __BYTE_ORDER == __BIG_ENDIAN
863  if (strcmp(mpm_algo, "ac-ks") == 0) {
864  FatalError("ac-ks does "
865  "not work on big endian systems at this time.");
866  }
867 #endif
868  if (strcmp("auto", mpm_algo) == 0) {
869  goto done;
870  } else if (strcmp("ac-bs", mpm_algo) == 0) {
871  SCLogWarning("mpm-algo \"ac-bs\" has been removed. See ticket #6586.");
872  goto done;
873  }
874  for (uint8_t u = 0; u < MPM_TABLE_SIZE; u++) {
875  if (mpm_table[u].name == NULL)
876  continue;
877 
878  if (strcmp(mpm_table[u].name, mpm_algo) == 0) {
879  mpm_algo_val = u;
880  goto done;
881  }
882  }
883 
884 #ifndef BUILD_HYPERSCAN
885  if ((strcmp(mpm_algo, "hs") == 0)) {
886  FatalError("Hyperscan (hs) support for mpm-algo is "
887  "not compiled into Suricata.");
888  }
889 #endif
890  }
891  FatalError("Invalid mpm algo supplied "
892  "in the yaml conf file: \"%s\"",
893  mpm_algo);
894  }
895 
896  done:
897  return mpm_algo_val;
898 }
899 
900 void PatternMatchDestroy(MpmCtx *mpm_ctx, uint16_t mpm_matcher)
901 {
902  SCLogDebug("mpm_ctx %p, mpm_matcher %"PRIu16"", mpm_ctx, mpm_matcher);
903  mpm_table[mpm_matcher].DestroyCtx(mpm_ctx);
904 }
905 
906 void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
907 {
908  SCLogDebug("mpm_thread_ctx %p, mpm_matcher %"PRIu16"", mpm_thread_ctx, mpm_matcher);
909  MpmDestroyThreadCtx(mpm_thread_ctx, mpm_matcher);
910 }
911 void PatternMatchThreadPrepare(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
912 {
913  SCLogDebug("mpm_thread_ctx %p, type %"PRIu16, mpm_thread_ctx, mpm_matcher);
914  MpmInitThreadCtx(mpm_thread_ctx, mpm_matcher);
915 }
916 
917 /** \brief Predict a strength value for patterns
918  *
919  * Patterns with high character diversity score higher.
920  * Alpha chars score not so high
921  * Other printable + a few common codes a little higher
922  * Everything else highest.
923  * Longer patterns score better than short patters.
924  *
925  * \param pat pattern
926  * \param patlen length of the pattern
927  *
928  * \retval s pattern score
929  */
930 uint32_t PatternStrength(uint8_t *pat, uint16_t patlen)
931 {
932  uint8_t a[256];
933  memset(&a, 0 ,sizeof(a));
934 
935  uint32_t s = 0;
936  uint16_t u = 0;
937  for (u = 0; u < patlen; u++) {
938  if (a[pat[u]] == 0) {
939  if (isalpha(pat[u]))
940  s += 3;
941  else if (isprint(pat[u]) || pat[u] == 0x00 || pat[u] == 0x01 || pat[u] == 0xFF)
942  s += 4;
943  else
944  s += 6;
945 
946  a[pat[u]] = 1;
947  } else {
948  s++;
949  }
950  }
951 
952  return s;
953 }
954 
955 static void PopulateMpmHelperAddPattern(MpmCtx *mpm_ctx, const DetectContentData *cd,
956  const Signature *s, const uint8_t flags, const int chop)
957 {
958  uint16_t pat_offset = cd->offset;
959  uint16_t pat_depth = cd->depth;
960 
961  /* recompute offset/depth to cope with chop */
962  if (chop && (pat_depth || pat_offset)) {
963  pat_offset += cd->fp_chop_offset;
964  if (pat_depth) {
965  pat_depth -= cd->content_len;
966  pat_depth += cd->fp_chop_offset + cd->fp_chop_len;
967  }
968  }
969 
970  /* We have to effectively "wild card" values that will be coming from
971  * byte_extract variables
972  */
973  if (cd->flags & (DETECT_CONTENT_DEPTH_VAR | DETECT_CONTENT_OFFSET_VAR)) {
974  pat_depth = pat_offset = 0;
975  }
976 
977  if (cd->flags & DETECT_CONTENT_NOCASE) {
978  if (chop) {
979  MpmAddPatternCI(mpm_ctx,
980  cd->content + cd->fp_chop_offset, cd->fp_chop_len,
981  pat_offset, pat_depth,
982  cd->id, s->num, flags|MPM_PATTERN_CTX_OWNS_ID);
983  } else {
984  MpmAddPatternCI(mpm_ctx,
985  cd->content, cd->content_len,
986  pat_offset, pat_depth,
987  cd->id, s->num, flags|MPM_PATTERN_CTX_OWNS_ID);
988  }
989  } else {
990  if (chop) {
991  MpmAddPatternCS(mpm_ctx,
992  cd->content + cd->fp_chop_offset, cd->fp_chop_len,
993  pat_offset, pat_depth,
994  cd->id, s->num, flags|MPM_PATTERN_CTX_OWNS_ID);
995  } else {
996  MpmAddPatternCS(mpm_ctx,
997  cd->content, cd->content_len,
998  pat_offset, pat_depth,
999  cd->id, s->num, flags|MPM_PATTERN_CTX_OWNS_ID);
1000  }
1001  }
1002 }
1003 
1004 #define SGH_PROTO(sgh, p) ((sgh)->init->protos[(p)] == 1)
1005 #define SGH_DIRECTION_TS(sgh) ((sgh)->init->direction & SIG_FLAG_TOSERVER)
1006 #define SGH_DIRECTION_TC(sgh) ((sgh)->init->direction & SIG_FLAG_TOCLIENT)
1007 
1008 static void SetMpm(Signature *s, SigMatch *mpm_sm, const int mpm_sm_list)
1009 {
1010  if (s == NULL || mpm_sm == NULL)
1011  return;
1012 
1013  DetectContentData *cd = (DetectContentData *)mpm_sm->ctx;
1014  if (cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) {
1015  if (DETECT_CONTENT_IS_SINGLE(cd) &&
1016  !(cd->flags & DETECT_CONTENT_NEGATED) &&
1017  !(cd->flags & DETECT_CONTENT_REPLACE) &&
1018  cd->content_len == cd->fp_chop_len)
1019  {
1020  cd->flags |= DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED;
1021  }
1022  } else {
1023  if (DETECT_CONTENT_IS_SINGLE(cd) &&
1024  !(cd->flags & DETECT_CONTENT_NEGATED) &&
1025  !(cd->flags & DETECT_CONTENT_REPLACE))
1026  {
1027  cd->flags |= DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED;
1028  }
1029  }
1030  cd->flags |= DETECT_CONTENT_MPM;
1031  s->init_data->mpm_sm_list = mpm_sm_list;
1032  s->init_data->mpm_sm = mpm_sm;
1033 }
1034 
1035 static SigMatch *GetMpmForList(const Signature *s, SigMatch *list, SigMatch *mpm_sm,
1036  uint16_t max_len, bool skip_negated_content)
1037 {
1038  for (SigMatch *sm = list; sm != NULL; sm = sm->next) {
1039  if (sm->type != DETECT_CONTENT)
1040  continue;
1041 
1042  const DetectContentData *cd = (DetectContentData *)sm->ctx;
1043  /* skip_negated_content is only set if there's absolutely no
1044  * non-negated content present in the sig */
1045  if ((cd->flags & DETECT_CONTENT_NEGATED) && skip_negated_content)
1046  continue;
1047  if (cd->content_len != max_len) {
1048  SCLogDebug("content_len %u != max_len %u", cd->content_len, max_len);
1049  continue;
1050  }
1051  if (mpm_sm == NULL) {
1052  mpm_sm = sm;
1053  } else {
1054  DetectContentData *data1 = (DetectContentData *)sm->ctx;
1055  DetectContentData *data2 = (DetectContentData *)mpm_sm->ctx;
1056  uint32_t ls = PatternStrength(data1->content, data1->content_len);
1057  uint32_t ss = PatternStrength(data2->content, data2->content_len);
1058  if (ls > ss) {
1059  mpm_sm = sm;
1060  } else if (ls == ss) {
1061  /* if 2 patterns are of equal strength, we pick the longest */
1062  if (data1->content_len > data2->content_len)
1063  mpm_sm = sm;
1064  } else {
1065  SCLogDebug("sticking with mpm_sm");
1066  }
1067  }
1068  }
1069  return mpm_sm;
1070 }
1071 
1072 int g_skip_prefilter = 0;
1073 
1074 void RetrieveFPForSig(const DetectEngineCtx *de_ctx, Signature *s)
1075 {
1076  if (g_skip_prefilter)
1077  return;
1078 
1079  if (s->init_data->mpm_sm != NULL)
1080  return;
1081 
1082  const int nlists = s->init_data->max_content_list_id + 1;
1083  int pos_sm_list[nlists];
1084  int neg_sm_list[nlists];
1085  memset(pos_sm_list, 0, nlists * sizeof(int));
1086  memset(neg_sm_list, 0, nlists * sizeof(int));
1087  int pos_sm_list_cnt = 0;
1088  int neg_sm_list_cnt = 0;
1089 
1090  /* inspect rule to see if we have the fast_pattern reg to
1091  * force using a sig, otherwise keep stats about the patterns */
1092  if (s->init_data->smlists[DETECT_SM_LIST_PMATCH] != NULL) {
1093  if (FastPatternSupportEnabledForSigMatchList(de_ctx, DETECT_SM_LIST_PMATCH)) {
1094  for (SigMatch *sm = s->init_data->smlists[DETECT_SM_LIST_PMATCH]; sm != NULL;
1095  sm = sm->next) {
1096  if (sm->type != DETECT_CONTENT)
1097  continue;
1098 
1099  const DetectContentData *cd = (DetectContentData *)sm->ctx;
1100  /* fast_pattern set in rule, so using this pattern */
1101  if ((cd->flags & DETECT_CONTENT_FAST_PATTERN)) {
1102  SetMpm(s, sm, DETECT_SM_LIST_PMATCH);
1103  return;
1104  }
1105 
1106  if (cd->flags & DETECT_CONTENT_NEGATED) {
1107  neg_sm_list[DETECT_SM_LIST_PMATCH] = 1;
1108  neg_sm_list_cnt++;
1109  } else {
1110  pos_sm_list[DETECT_SM_LIST_PMATCH] = 1;
1111  pos_sm_list_cnt++;
1112  }
1113  }
1114  }
1115  }
1116  for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
1117  const int list_id = s->init_data->buffers[x].id;
1118 
1119  SCLogDebug("%u: list_id %d: %s", s->id, list_id,
1120  DetectEngineBufferTypeGetNameById(de_ctx, list_id));
1121 
1122  if (!FastPatternSupportEnabledForSigMatchList(de_ctx, list_id)) {
1123  SCLogDebug("skip");
1124  continue;
1125  }
1126 
1127  for (SigMatch *sm = s->init_data->buffers[x].head; sm != NULL; sm = sm->next) {
1128  // a buffer with absent keyword cannot be used as fast_pattern
1129  if (sm->type == DETECT_ABSENT)
1130  break;
1131  if (sm->type != DETECT_CONTENT)
1132  continue;
1133 
1134  const DetectContentData *cd = (DetectContentData *)sm->ctx;
1135  /* fast_pattern set in rule, so using this pattern */
1136  if ((cd->flags & DETECT_CONTENT_FAST_PATTERN)) {
1137  SetMpm(s, sm, list_id);
1138  return;
1139  }
1140 
1141  if (cd->flags & DETECT_CONTENT_NEGATED) {
1142  neg_sm_list[list_id] = 1;
1143  neg_sm_list_cnt++;
1144  } else {
1145  pos_sm_list[list_id] = 1;
1146  pos_sm_list_cnt++;
1147  SCLogDebug("pos added for %d", list_id);
1148  }
1149  }
1150  SCLogDebug("ok");
1151  }
1152 
1153  SCLogDebug("neg_sm_list_cnt %d pos_sm_list_cnt %d", neg_sm_list_cnt, pos_sm_list_cnt);
1154 
1155  /* prefer normal not-negated over negated */
1156  int *curr_sm_list = NULL;
1157  int skip_negated_content = 1;
1158  if (pos_sm_list_cnt > 0) {
1159  curr_sm_list = pos_sm_list;
1160  } else if (neg_sm_list_cnt > 0) {
1161  curr_sm_list = neg_sm_list;
1162  skip_negated_content = 0;
1163  } else {
1164  return;
1165  }
1166 
1167  int final_sm_list[nlists];
1168  memset(&final_sm_list, 0, (nlists * sizeof(int)));
1169 
1170  int count_final_sm_list = 0;
1171  int priority;
1172 
1173  const SCFPSupportSMList *tmp = de_ctx->fp_support_smlist_list;
1174  while (tmp != NULL) {
1175  for (priority = tmp->priority;
1176  tmp != NULL && priority == tmp->priority;
1177  tmp = tmp->next)
1178  {
1179  SCLogDebug("tmp->list_id %d tmp->priority %d", tmp->list_id, tmp->priority);
1180  if (tmp->list_id >= nlists)
1181  continue;
1182  if (curr_sm_list[tmp->list_id] == 0)
1183  continue;
1184  final_sm_list[count_final_sm_list++] = tmp->list_id;
1185  SCLogDebug("tmp->list_id %d", tmp->list_id);
1186  }
1187  if (count_final_sm_list != 0)
1188  break;
1189  }
1190 
1191  BUG_ON(count_final_sm_list == 0);
1192  SCLogDebug("count_final_sm_list %d skip_negated_content %d", count_final_sm_list,
1193  skip_negated_content);
1194 
1195  uint16_t max_len = 0;
1196  for (int i = 0; i < count_final_sm_list; i++) {
1197  SCLogDebug("i %d final_sm_list[i] %d", i, final_sm_list[i]);
1198 
1199  if (final_sm_list[i] == DETECT_SM_LIST_PMATCH) {
1200  for (SigMatch *sm = s->init_data->smlists[DETECT_SM_LIST_PMATCH]; sm != NULL;
1201  sm = sm->next) {
1202  if (sm->type != DETECT_CONTENT)
1203  continue;
1204 
1205  const DetectContentData *cd = (DetectContentData *)sm->ctx;
1206  /* skip_negated_content is only set if there's absolutely no
1207  * non-negated content present in the sig */
1208  if ((cd->flags & DETECT_CONTENT_NEGATED) && skip_negated_content)
1209  continue;
1210  max_len = MAX(max_len, cd->content_len);
1211  }
1212  } else {
1213  for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
1214  const int list_id = s->init_data->buffers[x].id;
1215  if (final_sm_list[i] == list_id) {
1216  SCLogDebug("%u: list_id %d: %s", s->id, list_id,
1217  DetectEngineBufferTypeGetNameById(de_ctx, list_id));
1218 
1219  for (SigMatch *sm = s->init_data->buffers[x].head; sm != NULL; sm = sm->next) {
1220  if (sm->type != DETECT_CONTENT)
1221  continue;
1222 
1223  const DetectContentData *cd = (DetectContentData *)sm->ctx;
1224  /* skip_negated_content is only set if there's absolutely no
1225  * non-negated content present in the sig */
1226  if ((cd->flags & DETECT_CONTENT_NEGATED) && skip_negated_content)
1227  continue;
1228  max_len = MAX(max_len, cd->content_len);
1229  }
1230  }
1231  }
1232  }
1233  }
1234 
1235  SigMatch *mpm_sm = NULL;
1236  int mpm_sm_list = -1;
1237  for (int i = 0; i < count_final_sm_list; i++) {
1238  SCLogDebug("i %d", i);
1239  if (final_sm_list[i] == DETECT_SM_LIST_PMATCH) {
1240  /* GetMpmForList may keep `mpm_sm` the same, so track if it changed */
1241  SigMatch *prev_mpm_sm = mpm_sm;
1242  mpm_sm = GetMpmForList(s, s->init_data->smlists[DETECT_SM_LIST_PMATCH], mpm_sm, max_len,
1243  skip_negated_content);
1244  if (mpm_sm != prev_mpm_sm) {
1245  mpm_sm_list = final_sm_list[i];
1246  }
1247  } else {
1248  SCLogDebug(
1249  "%u: %s", s->id, DetectEngineBufferTypeGetNameById(de_ctx, final_sm_list[i]));
1250  for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
1251  const int list_id = s->init_data->buffers[x].id;
1252  if (final_sm_list[i] == list_id) {
1253  SCLogDebug("%u: list_id %d: %s", s->id, list_id,
1254  DetectEngineBufferTypeGetNameById(de_ctx, list_id));
1255  /* GetMpmForList may keep `mpm_sm` the same, so track if it changed */
1256  SigMatch *prev_mpm_sm = mpm_sm;
1257  mpm_sm = GetMpmForList(s, s->init_data->buffers[x].head, mpm_sm, max_len,
1258  skip_negated_content);
1259  SCLogDebug("mpm_sm %p from %p", mpm_sm, s->init_data->buffers[x].head);
1260  if (mpm_sm != prev_mpm_sm) {
1261  mpm_sm_list = list_id;
1262  }
1263  }
1264  }
1265  }
1266  }
1267 
1268 #ifdef DEBUG
1269  if (mpm_sm != NULL) {
1270  BUG_ON(mpm_sm_list == -1);
1271  int check_list = SigMatchListSMBelongsTo(s, mpm_sm);
1272  BUG_ON(check_list != mpm_sm_list);
1273  }
1274 #endif
1275  /* assign to signature */
1276  SetMpm(s, mpm_sm, mpm_sm_list);
1277 }
1278 
1279 /** \internal
1280  * \brief The hash function for MpmStore
1281  *
1282  * \param ht Pointer to the hash table.
1283  * \param data Pointer to the MpmStore.
1284  * \param datalen Not used in our case.
1285  *
1286  * \retval hash The generated hash value.
1287  */
1288 static uint32_t MpmStoreHashFunc(HashListTable *ht, void *data, uint16_t datalen)
1289 {
1290  const MpmStore *ms = (MpmStore *)data;
1291  uint32_t hash = ms->alproto;
1292 
1293  for (uint32_t b = 0; b < ms->sid_array_size; b++)
1294  hash += ms->sid_array[b];
1295 
1296  return hash % ht->array_size;
1297 }
1298 
1299 /**
1300  * \brief The Compare function for MpmStore
1301  *
1302  * \param data1 Pointer to the first MpmStore.
1303  * \param len1 Not used.
1304  * \param data2 Pointer to the second MpmStore.
1305  * \param len2 Not used.
1306  *
1307  * \retval 1 If the 2 MpmStores sent as args match.
1308  * \retval 0 If the 2 MpmStores sent as args do not match.
1309  */
1310 static char MpmStoreCompareFunc(void *data1, uint16_t len1, void *data2,
1311  uint16_t len2)
1312 {
1313  const MpmStore *ms1 = (MpmStore *)data1;
1314  const MpmStore *ms2 = (MpmStore *)data2;
1315 
1316  if (ms1->alproto != ms2->alproto)
1317  return 0;
1318 
1319  if (ms1->sid_array_size != ms2->sid_array_size)
1320  return 0;
1321 
1322  if (ms1->buffer != ms2->buffer)
1323  return 0;
1324 
1325  if (ms1->direction != ms2->direction)
1326  return 0;
1327 
1328  if (ms1->sm_list != ms2->sm_list)
1329  return 0;
1330 
1331  if (SCMemcmp(ms1->sid_array, ms2->sid_array,
1332  ms1->sid_array_size) != 0)
1333  {
1334  return 0;
1335  }
1336 
1337  return 1;
1338 }
1339 
1340 static void MpmStoreFreeFunc(void *ptr)
1341 {
1342  MpmStore *ms = ptr;
1343  if (ms != NULL) {
1344  if (ms->mpm_ctx != NULL && !(ms->mpm_ctx->flags & MPMCTX_FLAGS_GLOBAL))
1345  {
1346  SCLogDebug("destroying mpm_ctx %p", ms->mpm_ctx);
1347  mpm_table[ms->mpm_ctx->mpm_type].DestroyCtx(ms->mpm_ctx);
1348  SCFree(ms->mpm_ctx);
1349  }
1350  ms->mpm_ctx = NULL;
1351 
1352  SCFree(ms->sid_array);
1353  SCFree(ms);
1354  }
1355 }
1356 
1357 /**
1358  * \brief Initializes the MpmStore mpm hash table to be used by the detection
1359  * engine context.
1360  *
1361  * \param de_ctx Pointer to the detection engine context.
1362  *
1363  * \retval 0 On success.
1364  * \retval -1 On failure.
1365  */
1366 int MpmStoreInit(DetectEngineCtx *de_ctx)
1367 {
1368  de_ctx->mpm_hash_table = HashListTableInit(4096,
1369  MpmStoreHashFunc,
1370  MpmStoreCompareFunc,
1371  MpmStoreFreeFunc);
1372  if (de_ctx->mpm_hash_table == NULL)
1373  goto error;
1374 
1375  return 0;
1376 
1377 error:
1378  return -1;
1379 }
1380 
1381 /**
1382  * \brief Adds a MpmStore to the detection engine context MpmStore
1383  *
1384  * \param de_ctx Pointer to the detection engine context.
1385  * \param sgh Pointer to the MpmStore.
1386  *
1387  * \retval ret 0 on Successfully adding the argument sgh; -1 on failure.
1388  */
1389 static int MpmStoreAdd(DetectEngineCtx *de_ctx, MpmStore *s)
1390 {
1391  int ret = HashListTableAdd(de_ctx->mpm_hash_table, (void *)s, 0);
1392  return ret;
1393 }
1394 
1395 /**
1396  * \brief Used to lookup a MpmStore from the MpmStore
1397  *
1398  * \param de_ctx Pointer to the detection engine context.
1399  * \param sgh Pointer to the MpmStore.
1400  *
1401  * \retval rsgh On success a pointer to the MpmStore if the MpmStore is
1402  * found in the hash table; NULL on failure.
1403  */
1404 static MpmStore *MpmStoreLookup(DetectEngineCtx *de_ctx, MpmStore *s)
1405 {
1406  MpmStore *rs = HashListTableLookup(de_ctx->mpm_hash_table,
1407  (void *)s, 0);
1408  return rs;
1409 }
1410 
1411 static const DetectBufferMpmRegistry *GetByMpmStore(
1412  const DetectEngineCtx *de_ctx, const MpmStore *ms)
1413 {
1414  const DetectBufferMpmRegistry *am = de_ctx->app_mpms_list;
1415  while (am != NULL) {
1416  if (ms->sm_list == am->sm_list &&
1417  ms->direction == am->direction) {
1418  return am;
1419  }
1420  am = am->next;
1421  }
1422  am = de_ctx->pkt_mpms_list;
1423  while (am != NULL) {
1424  if (ms->sm_list == am->sm_list) {
1425  return am;
1426  }
1427  am = am->next;
1428  }
1429  return NULL;
1430 }
1431 
1432 void MpmStoreReportStats(const DetectEngineCtx *de_ctx)
1433 {
1434  HashListTableBucket *htb = NULL;
1435 
1436  uint32_t stats[MPMB_MAX] = {0};
1437  int app_mpms_cnt = de_ctx->buffer_type_id;
1438  uint32_t appstats[app_mpms_cnt + 1]; // +1 to silence scan-build
1439  memset(&appstats, 0x00, sizeof(appstats));
1440  int pkt_mpms_cnt = de_ctx->buffer_type_id;
1441  uint32_t pktstats[pkt_mpms_cnt + 1]; // +1 to silence scan-build
1442  memset(&pktstats, 0x00, sizeof(pktstats));
1443  int frame_mpms_cnt = de_ctx->buffer_type_id;
1444  uint32_t framestats[frame_mpms_cnt + 1]; // +1 to silence scan-build
1445  memset(&framestats, 0x00, sizeof(framestats));
1446 
1447  for (htb = HashListTableGetListHead(de_ctx->mpm_hash_table);
1448  htb != NULL;
1449  htb = HashListTableGetListNext(htb))
1450  {
1451  const MpmStore *ms = (MpmStore *)HashListTableGetListData(htb);
1452  if (ms == NULL || ms->mpm_ctx == NULL) {
1453  continue;
1454  }
1455  if (ms->buffer < MPMB_MAX)
1456  stats[ms->buffer]++;
1457  else if (ms->sm_list != DETECT_SM_LIST_PMATCH) {
1458  const DetectBufferMpmRegistry *am = GetByMpmStore(de_ctx, ms);
1459  if (am != NULL) {
1460  switch (am->type) {
1461  case DETECT_BUFFER_MPM_TYPE_PKT:
1462  SCLogDebug("%s: %u patterns. Min %u, Max %u. Ctx %p",
1463  am->name,
1464  ms->mpm_ctx->pattern_cnt,
1465  ms->mpm_ctx->minlen, ms->mpm_ctx->maxlen,
1466  ms->mpm_ctx);
1467  pktstats[am->sm_list]++;
1468  break;
1469  case DETECT_BUFFER_MPM_TYPE_APP:
1470  SCLogDebug("%s %s %s: %u patterns. Min %u, Max %u. Ctx %p",
1471  AppProtoToString(ms->alproto), am->name,
1472  am->direction == SIG_FLAG_TOSERVER ? "toserver" : "toclient",
1473  ms->mpm_ctx->pattern_cnt, ms->mpm_ctx->minlen, ms->mpm_ctx->maxlen,
1474  ms->mpm_ctx);
1475  appstats[am->sm_list]++;
1476  break;
1477  case DETECT_BUFFER_MPM_TYPE_FRAME:
1478  SCLogDebug("%s: %u patterns. Min %u, Max %u. Ctx %p", am->name,
1479  ms->mpm_ctx->pattern_cnt, ms->mpm_ctx->minlen, ms->mpm_ctx->maxlen,
1480  ms->mpm_ctx);
1481  framestats[am->sm_list]++;
1482  break;
1483  case DETECT_BUFFER_MPM_TYPE_SIZE:
1484  break;
1485  }
1486  }
1487  }
1488  }
1489 
1490  if (!(de_ctx->flags & DE_QUIET)) {
1491  for (int x = 0; x < MPMB_MAX; x++) {
1492  SCLogPerf("Builtin MPM \"%s\": %u", builtin_mpms[x], stats[x]);
1493  }
1494  const DetectBufferMpmRegistry *am = de_ctx->app_mpms_list;
1495  while (am != NULL) {
1496  if (appstats[am->sm_list] > 0) {
1497  const char *name = am->name;
1498  const char *direction = am->direction == SIG_FLAG_TOSERVER ? "toserver" : "toclient";
1499  SCLogPerf("AppLayer MPM \"%s %s (%s)\": %u", direction, name,
1500  AppProtoToString(am->app_v2.alproto), appstats[am->sm_list]);
1501  }
1502  am = am->next;
1503  }
1504  const DetectBufferMpmRegistry *pm = de_ctx->pkt_mpms_list;
1505  while (pm != NULL) {
1506  if (pktstats[pm->sm_list] > 0) {
1507  const char *name = pm->name;
1508  SCLogPerf("Pkt MPM \"%s\": %u", name, pktstats[pm->sm_list]);
1509  }
1510  pm = pm->next;
1511  }
1512  const DetectBufferMpmRegistry *um = de_ctx->frame_mpms_list;
1513  while (um != NULL) {
1514  if (framestats[um->sm_list] > 0) {
1515  const char *name = um->name;
1516  SCLogPerf("Frame MPM \"%s\": %u", name, framestats[um->sm_list]);
1517  }
1518  um = um->next;
1519  }
1520  }
1521 }
1522 
1523 /**
1524  * \brief Frees the hash table - DetectEngineCtx->mpm_hash_table, allocated by
1525  * MpmStoreInit() function.
1526  *
1527  * \param de_ctx Pointer to the detection engine context.
1528  */
1529 void MpmStoreFree(DetectEngineCtx *de_ctx)
1530 {
1531  if (de_ctx->mpm_hash_table == NULL)
1532  return;
1533 
1534  HashListTableFree(de_ctx->mpm_hash_table);
1535  de_ctx->mpm_hash_table = NULL;
1536 }
1537 
1538 static void MpmStoreSetup(const DetectEngineCtx *de_ctx, MpmStore *ms)
1539 {
1540  const Signature *s = NULL;
1541  uint32_t sig;
1542  int dir = 0;
1543 
1544  if (ms->buffer != MPMB_MAX) {
1545  BUG_ON(ms->sm_list != DETECT_SM_LIST_PMATCH);
1546 
1547  switch (ms->buffer) {
1548  /* TS is 1 */
1549  case MPMB_TCP_PKT_TS:
1550  case MPMB_TCP_STREAM_TS:
1551  case MPMB_UDP_TS:
1552  dir = 1;
1553  break;
1554 
1555  /* TC is 0 */
1556  default:
1557  case MPMB_UDP_TC:
1558  case MPMB_TCP_STREAM_TC:
1559  case MPMB_TCP_PKT_TC:
1560  case MPMB_OTHERIP: /**< use 0 for other */
1561  dir = 0;
1562  break;
1563  }
1564  } else {
1565  BUG_ON(ms->sm_list == DETECT_SM_LIST_PMATCH);
1566 
1567  if (ms->direction == SIG_FLAG_TOSERVER)
1568  dir = 1;
1569  else
1570  dir = 0;
1571  }
1572 
1573  ms->mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, ms->sgh_mpm_context, dir);
1574  if (ms->mpm_ctx == NULL) {
1575  return;
1576  }
1577 
1578  MpmInitCtx(ms->mpm_ctx, de_ctx->mpm_matcher);
1579 
1580  const bool mpm_supports_endswith =
1581  (mpm_table[de_ctx->mpm_matcher].feature_flags & MPM_FEATURE_FLAG_ENDSWITH) != 0;
1582 
1583  /* add the patterns */
1584  for (sig = 0; sig < (ms->sid_array_size * 8); sig++) {
1585  if (ms->sid_array[sig / 8] & (1 << (sig % 8))) {
1586  s = de_ctx->sig_array[sig];
1587  DEBUG_VALIDATE_BUG_ON(s == NULL);
1588  if (s == NULL)
1589  continue;
1590 
1591  SCLogDebug("%p: direction %d adding %u", ms, ms->direction, s->id);
1592 
1593  const DetectContentData *cd = (DetectContentData *)s->init_data->mpm_sm->ctx;
1594 
1595  int skip = 0;
1596  /* negated logic: if mpm match can't be used to be sure about this
1597  * pattern, we have to inspect the rule fully regardless of mpm
1598  * match. So in this case there is no point of adding it at all.
1599  * The non-mpm list entry for the sig will make sure the sig is
1600  * inspected. */
1601  if ((cd->flags & DETECT_CONTENT_NEGATED) &&
1602  !(DETECT_CONTENT_MPM_IS_CONCLUSIVE(cd)))
1603  {
1604  skip = 1;
1605  SCLogDebug("not adding negated mpm as it's not 'single'");
1606  }
1607 
1608  if (!skip) {
1609  uint8_t flags = 0;
1610  if ((cd->flags & DETECT_CONTENT_ENDS_WITH) && mpm_supports_endswith)
1611  flags = MPM_PATTERN_FLAG_ENDSWITH;
1612  PopulateMpmHelperAddPattern(
1613  ms->mpm_ctx, cd, s, flags, (cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP));
1614  }
1615  }
1616  }
1617 
1618  if (ms->mpm_ctx->pattern_cnt == 0) {
1619  MpmFactoryReClaimMpmCtx(de_ctx, ms->mpm_ctx);
1620  ms->mpm_ctx = NULL;
1621  } else {
1622  if (ms->sgh_mpm_context == MPM_CTX_FACTORY_UNIQUE_CONTEXT) {
1623  if (mpm_table[ms->mpm_ctx->mpm_type].Prepare != NULL) {
1624  mpm_table[ms->mpm_ctx->mpm_type].Prepare(ms->mpm_ctx);
1625  }
1626  }
1627  }
1628 }
1629 
1630 
1631 /** \brief Get MpmStore for a built-in buffer type
1632  *
1633  */
1634 MpmStore *MpmStorePrepareBuffer(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
1635  enum MpmBuiltinBuffers buf)
1636 {
1637  const Signature *s = NULL;
1638  uint32_t sig;
1639  uint32_t cnt = 0;
1640  int direction = 0;
1641  uint32_t max_sid = DetectEngineGetMaxSigId(de_ctx) / 8 + 1;
1642  uint8_t sids_array[max_sid];
1643  memset(sids_array, 0x00, max_sid);
1644  int sgh_mpm_context = 0;
1645  int sm_list = DETECT_SM_LIST_PMATCH;
1646 
1647  switch (buf) {
1648  case MPMB_TCP_PKT_TS:
1649  case MPMB_TCP_PKT_TC:
1650  sgh_mpm_context = de_ctx->sgh_mpm_context_proto_tcp_packet;
1651  break;
1652  case MPMB_TCP_STREAM_TS:
1653  case MPMB_TCP_STREAM_TC:
1654  sgh_mpm_context = de_ctx->sgh_mpm_context_stream;
1655  break;
1656  case MPMB_UDP_TS:
1657  case MPMB_UDP_TC:
1658  sgh_mpm_context = de_ctx->sgh_mpm_context_proto_udp_packet;
1659  break;
1660  case MPMB_OTHERIP:
1661  sgh_mpm_context = de_ctx->sgh_mpm_context_proto_other_packet;
1662  break;
1663  default:
1664  break;
1665  }
1666 
1667  switch(buf) {
1668  case MPMB_TCP_PKT_TS:
1669  case MPMB_TCP_STREAM_TS:
1670  case MPMB_UDP_TS:
1671  direction = SIG_FLAG_TOSERVER;
1672  break;
1673 
1674  case MPMB_TCP_PKT_TC:
1675  case MPMB_TCP_STREAM_TC:
1676  case MPMB_UDP_TC:
1677  direction = SIG_FLAG_TOCLIENT;
1678  break;
1679 
1680  case MPMB_OTHERIP:
1681  direction = (SIG_FLAG_TOCLIENT|SIG_FLAG_TOSERVER);
1682  break;
1683 
1684  case MPMB_MAX:
1685  BUG_ON(1);
1686  break;
1687  }
1688 
1689  for (sig = 0; sig < sgh->init->sig_cnt; sig++) {
1690  s = sgh->init->match_array[sig];
1691  if (s == NULL)
1692  continue;
1693 
1694  if (s->init_data->mpm_sm == NULL)
1695  continue;
1696 
1697  int list = s->init_data->mpm_sm_list;
1698  if (list < 0)
1699  continue;
1700 
1701  if (list != DETECT_SM_LIST_PMATCH)
1702  continue;
1703 
1704  switch (buf) {
1705  case MPMB_TCP_PKT_TS:
1706  case MPMB_TCP_PKT_TC:
1707  if (SignatureHasPacketContent(s) == 1)
1708  {
1709  sids_array[s->num / 8] |= 1 << (s->num % 8);
1710  cnt++;
1711  }
1712  break;
1713  case MPMB_TCP_STREAM_TS:
1714  case MPMB_TCP_STREAM_TC:
1715  if (SignatureHasStreamContent(s) == 1)
1716  {
1717  sids_array[s->num / 8] |= 1 << (s->num % 8);
1718  cnt++;
1719  }
1720  break;
1721  case MPMB_UDP_TS:
1722  case MPMB_UDP_TC:
1723  sids_array[s->num / 8] |= 1 << (s->num % 8);
1724  cnt++;
1725  break;
1726  case MPMB_OTHERIP:
1727  sids_array[s->num / 8] |= 1 << (s->num % 8);
1728  cnt++;
1729  break;
1730  default:
1731  break;
1732  }
1733  }
1734 
1735  if (cnt == 0)
1736  return NULL;
1737 
1738  MpmStore lookup = { sids_array, max_sid, direction, buf, sm_list, 0, 0, NULL };
1739 
1740  MpmStore *result = MpmStoreLookup(de_ctx, &lookup);
1741  if (result == NULL) {
1742  MpmStore *copy = SCCalloc(1, sizeof(MpmStore));
1743  if (copy == NULL)
1744  return NULL;
1745  uint8_t *sids = SCCalloc(1, max_sid);
1746  if (sids == NULL) {
1747  SCFree(copy);
1748  return NULL;
1749  }
1750 
1751  memcpy(sids, sids_array, max_sid);
1752  copy->sid_array = sids;
1753  copy->sid_array_size = max_sid;
1754  copy->buffer = buf;
1755  copy->direction = direction;
1756  copy->sm_list = sm_list;
1757  copy->sgh_mpm_context = sgh_mpm_context;
1758 
1759  MpmStoreSetup(de_ctx, copy);
1760  MpmStoreAdd(de_ctx, copy);
1761  return copy;
1762  } else {
1763  return result;
1764  }
1765 }
1766 
1767 struct SidsArray {
1768  uint8_t *sids_array;
1769  uint32_t sids_array_size;
1770  /* indicates this has an active engine */
1771  bool active;
1772 
1773  enum DetectBufferMpmType type;
1774 };
1775 
1776 static MpmStore *MpmStorePrepareBufferAppLayer(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
1777  const DetectBufferMpmRegistry *am, const struct SidsArray *sa)
1778 {
1779  if (sa->sids_array_size == 0 || sa->sids_array == NULL)
1780  return NULL;
1781 
1782  SCLogDebug("handling %s direction %s for list %d", am->name,
1783  am->direction == SIG_FLAG_TOSERVER ? "toserver" : "toclient",
1784  am->sm_list);
1785 
1786  MpmStore lookup = { sa->sids_array, sa->sids_array_size, am->direction, MPMB_MAX, am->sm_list,
1787  0, am->app_v2.alproto, NULL };
1788  SCLogDebug("am->direction %d am->sm_list %d sgh_mpm_context %d", am->direction, am->sm_list,
1789  am->sgh_mpm_context);
1790 
1791  MpmStore *result = MpmStoreLookup(de_ctx, &lookup);
1792  if (result == NULL) {
1793  SCLogDebug("new unique mpm for %s %s", am->name,
1794  am->direction == SIG_FLAG_TOSERVER ? "toserver" : "toclient");
1795 
1796  MpmStore *copy = SCCalloc(1, sizeof(MpmStore));
1797  if (copy == NULL)
1798  return NULL;
1799  uint8_t *sids = SCCalloc(1, sa->sids_array_size);
1800  if (sids == NULL) {
1801  SCFree(copy);
1802  return NULL;
1803  }
1804 
1805  memcpy(sids, sa->sids_array, sa->sids_array_size);
1806  copy->sid_array = sids;
1807  copy->sid_array_size = sa->sids_array_size;
1808  copy->buffer = MPMB_MAX;
1809  copy->direction = am->direction;
1810  copy->sm_list = am->sm_list;
1811  copy->sgh_mpm_context = am->sgh_mpm_context;
1812  copy->alproto = am->app_v2.alproto;
1813 
1814  MpmStoreSetup(de_ctx, copy);
1815  MpmStoreAdd(de_ctx, copy);
1816  return copy;
1817  } else {
1818  SCLogDebug("using existing mpm %p", result);
1819  return result;
1820  }
1821  return NULL;
1822 }
1823 
1824 static MpmStore *MpmStorePrepareBufferPkt(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
1825  const DetectBufferMpmRegistry *am, const struct SidsArray *sa)
1826 {
1827  SCLogDebug("handling %s for list %d", am->name,
1828  am->sm_list);
1829 
1830  if (sa->sids_array_size == 0 || sa->sids_array == NULL)
1831  return NULL;
1832 
1833  MpmStore lookup = { sa->sids_array, sa->sids_array_size, SIG_FLAG_TOSERVER | SIG_FLAG_TOCLIENT,
1834  MPMB_MAX, am->sm_list, 0, 0, NULL };
1835  SCLogDebug("am->sm_list %d", am->sm_list);
1836 
1837  MpmStore *result = MpmStoreLookup(de_ctx, &lookup);
1838  if (result == NULL) {
1839  SCLogDebug("new unique mpm for %s", am->name);
1840 
1841  MpmStore *copy = SCCalloc(1, sizeof(MpmStore));
1842  if (copy == NULL)
1843  return NULL;
1844  uint8_t *sids = SCCalloc(1, sa->sids_array_size);
1845  if (sids == NULL) {
1846  SCFree(copy);
1847  return NULL;
1848  }
1849 
1850  memcpy(sids, sa->sids_array, sa->sids_array_size);
1851  copy->sid_array = sids;
1852  copy->sid_array_size = sa->sids_array_size;
1853  copy->buffer = MPMB_MAX;
1854  copy->direction = SIG_FLAG_TOSERVER|SIG_FLAG_TOCLIENT;
1855  copy->sm_list = am->sm_list;
1856  copy->sgh_mpm_context = am->sgh_mpm_context;
1857 
1858  MpmStoreSetup(de_ctx, copy);
1859  MpmStoreAdd(de_ctx, copy);
1860  return copy;
1861  } else {
1862  SCLogDebug("using existing mpm %p", result);
1863  return result;
1864  }
1865  return NULL;
1866 }
1867 
1868 static MpmStore *MpmStorePrepareBufferFrame(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
1869  const DetectBufferMpmRegistry *am, const struct SidsArray *sa)
1870 {
1871  SCLogDebug("handling %s for list %d", am->name, am->sm_list);
1872 
1873  if (sa->sids_array_size == 0 || sa->sids_array == NULL)
1874  return NULL;
1875 
1876  MpmStore lookup = { sa->sids_array, sa->sids_array_size, am->direction, MPMB_MAX, am->sm_list,
1877  0, am->frame_v1.alproto, NULL };
1878  SCLogDebug("am->sm_list %d", am->sm_list);
1879 
1880  MpmStore *result = MpmStoreLookup(de_ctx, &lookup);
1881  if (result == NULL) {
1882  SCLogDebug("new unique mpm for %s", am->name);
1883 
1884  MpmStore *copy = SCCalloc(1, sizeof(MpmStore));
1885  if (copy == NULL)
1886  return NULL;
1887  uint8_t *sids = SCCalloc(1, sa->sids_array_size);
1888  if (sids == NULL) {
1889  SCFree(copy);
1890  return NULL;
1891  }
1892 
1893  memcpy(sids, sa->sids_array, sa->sids_array_size);
1894  copy->sid_array = sids;
1895  copy->sid_array_size = sa->sids_array_size;
1896  copy->buffer = MPMB_MAX;
1897  copy->direction = am->direction;
1898  copy->sm_list = am->sm_list;
1899  copy->sgh_mpm_context = am->sgh_mpm_context;
1900  copy->alproto = am->frame_v1.alproto;
1901 
1902  MpmStoreSetup(de_ctx, copy);
1903  MpmStoreAdd(de_ctx, copy);
1904  return copy;
1905  } else {
1906  SCLogDebug("using existing mpm %p", result);
1907  return result;
1908  }
1909  return NULL;
1910 }
1911 
1912 static void SetRawReassemblyFlag(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
1913 {
1914  const Signature *s = NULL;
1915  uint32_t sig;
1916 
1917  for (sig = 0; sig < sgh->init->sig_cnt; sig++) {
1918  s = sgh->init->match_array[sig];
1919  if (s == NULL)
1920  continue;
1921 
1922  if (SignatureHasStreamContent(s) == 1) {
1923  sgh->flags |= SIG_GROUP_HEAD_HAVERAWSTREAM;
1924  SCLogDebug("rule group %p has SIG_GROUP_HEAD_HAVERAWSTREAM set", sgh);
1925  return;
1926  }
1927  }
1928  SCLogDebug("rule group %p does NOT have SIG_GROUP_HEAD_HAVERAWSTREAM set", sgh);
1929 }
1930 
1931 typedef struct DetectBufferInstance {
1932  // key
1933  int list;
1934  AppProto alproto;
1935 
1936  struct SidsArray ts;
1937  struct SidsArray tc;
1938 } DetectBufferInstance;
1939 
1940 static uint32_t DetectBufferInstanceHashFunc(HashListTable *ht, void *data, uint16_t datalen)
1941 {
1942  const DetectBufferInstance *ms = (const DetectBufferInstance *)data;
1943  uint32_t hash = ms->list + ms->alproto;
1944  return hash % ht->array_size;
1945 }
1946 
1947 static char DetectBufferInstanceCompareFunc(void *data1, uint16_t len1, void *data2, uint16_t len2)
1948 {
1949  const DetectBufferInstance *ms1 = (DetectBufferInstance *)data1;
1950  const DetectBufferInstance *ms2 = (DetectBufferInstance *)data2;
1951  return (ms1->list == ms2->list && ms1->alproto == ms2->alproto);
1952 }
1953 
1954 static void DetectBufferInstanceFreeFunc(void *ptr)
1955 {
1956  DetectBufferInstance *ms = ptr;
1957  if (ms->ts.sids_array != NULL)
1958  SCFree(ms->ts.sids_array);
1959  if (ms->tc.sids_array != NULL)
1960  SCFree(ms->tc.sids_array);
1961  SCFree(ms);
1962 }
1963 
1964 static HashListTable *DetectBufferInstanceInit(void)
1965 {
1966  return HashListTableInit(4096, DetectBufferInstanceHashFunc, DetectBufferInstanceCompareFunc,
1967  DetectBufferInstanceFreeFunc);
1968 }
1969 
1970 static void PrepareMpms(DetectEngineCtx *de_ctx, SigGroupHead *sh)
1971 {
1972  HashListTable *bufs = DetectBufferInstanceInit();
1973  BUG_ON(bufs == NULL);
1974 
1975  const int max_buffer_id = de_ctx->buffer_type_id + 1;
1976  const uint32_t max_sid = DetectEngineGetMaxSigId(de_ctx) / 8 + 1;
1977 
1978  AppProto engines[max_buffer_id][ALPROTO_MAX];
1979  memset(engines, 0, sizeof(engines));
1980  int engines_idx[max_buffer_id];
1981  memset(engines_idx, 0, sizeof(engines_idx));
1982  int types[max_buffer_id];
1983  memset(types, 0, sizeof(types));
1984 
1985  /* flag the list+directions we have engines for as active */
1986  for (DetectBufferMpmRegistry *a = de_ctx->pkt_mpms_list; a != NULL; a = a->next) {
1987  types[a->sm_list] = a->type;
1988 
1989  DetectBufferInstance lookup = { .list = a->sm_list, .alproto = ALPROTO_UNKNOWN };
1990  DetectBufferInstance *instance = HashListTableLookup(bufs, &lookup, 0);
1991  if (instance == NULL) {
1992  instance = SCCalloc(1, sizeof(*instance));
1993  BUG_ON(instance == NULL);
1994  instance->list = a->sm_list;
1995  instance->alproto = ALPROTO_UNKNOWN;
1996  HashListTableAdd(bufs, instance, 0);
1997  }
1998  instance->ts.active = true;
1999  instance->tc.active = true;
2000  }
2001  for (DetectBufferMpmRegistry *a = de_ctx->frame_mpms_list; a != NULL; a = a->next) {
2002  const bool add_ts = ((a->direction == SIG_FLAG_TOSERVER) && SGH_DIRECTION_TS(sh));
2003  const bool add_tc = ((a->direction == SIG_FLAG_TOCLIENT) && SGH_DIRECTION_TC(sh));
2004  if (add_ts || add_tc) {
2005  types[a->sm_list] = a->type;
2006  engines[a->sm_list][engines_idx[a->sm_list]++] = a->frame_v1.alproto;
2007 
2008  DetectBufferInstance lookup = { .list = a->sm_list, .alproto = a->frame_v1.alproto };
2009  DetectBufferInstance *instance = HashListTableLookup(bufs, &lookup, 0);
2010  if (instance == NULL) {
2011  instance = SCCalloc(1, sizeof(*instance));
2012  BUG_ON(instance == NULL);
2013  instance->list = a->sm_list;
2014  instance->alproto = a->frame_v1.alproto;
2015  HashListTableAdd(bufs, instance, 0);
2016  }
2017  instance->ts.active |= add_ts;
2018  instance->tc.active |= add_tc;
2019  }
2020  }
2021  for (DetectBufferMpmRegistry *a = de_ctx->app_mpms_list; a != NULL; a = a->next) {
2022  const bool add_ts = ((a->direction == SIG_FLAG_TOSERVER) && SGH_DIRECTION_TS(sh));
2023  const bool add_tc = ((a->direction == SIG_FLAG_TOCLIENT) && SGH_DIRECTION_TC(sh));
2024  if (add_ts || add_tc) {
2025  types[a->sm_list] = a->type;
2026  engines[a->sm_list][engines_idx[a->sm_list]++] = a->app_v2.alproto;
2027 
2028  DetectBufferInstance lookup = { .list = a->sm_list, .alproto = a->app_v2.alproto };
2029  DetectBufferInstance *instance = HashListTableLookup(bufs, &lookup, 0);
2030  if (instance == NULL) {
2031  instance = SCCalloc(1, sizeof(*instance));
2032  BUG_ON(instance == NULL);
2033  instance->list = a->sm_list;
2034  instance->alproto = a->app_v2.alproto;
2035  HashListTableAdd(bufs, instance, 0);
2036  }
2037  instance->ts.active |= add_ts;
2038  instance->tc.active |= add_tc;
2039  }
2040  }
2041 
2042  for (uint32_t sig = 0; sig < sh->init->sig_cnt; sig++) {
2043  const Signature *s = sh->init->match_array[sig];
2044  if (s == NULL)
2045  continue;
2046  if (s->init_data->mpm_sm == NULL)
2047  continue;
2048  const int list = s->init_data->mpm_sm_list;
2049  if (list < 0)
2050  continue;
2051  if (list == DETECT_SM_LIST_PMATCH)
2052  continue;
2053 
2054  switch (types[list]) {
2055  /* app engines are direction aware */
2056  case DETECT_BUFFER_MPM_TYPE_FRAME:
2057  case DETECT_BUFFER_MPM_TYPE_APP: {
2058  for (int e = 0; e < engines_idx[list]; e++) {
2059  const AppProto alproto = engines[list][e];
2060  if (!(AppProtoEquals(s->alproto, alproto) || s->alproto == 0))
2061  continue;
2062 
2063  DetectBufferInstance lookup = { .list = list, .alproto = alproto };
2064  DetectBufferInstance *instance = HashListTableLookup(bufs, &lookup, 0);
2065  if (instance == NULL)
2066  continue;
2067  if (s->flags & SIG_FLAG_TOSERVER) {
2068  struct SidsArray *sa = &instance->ts;
2069  if (sa->active) {
2070  if (sa->sids_array == NULL) {
2071  sa->sids_array = SCCalloc(1, max_sid);
2072  sa->sids_array_size = max_sid;
2073  BUG_ON(sa->sids_array == NULL); // TODO
2074  }
2075  sa->sids_array[s->num / 8] |= 1 << (s->num % 8);
2076  SCLogDebug("instance %p: stored %u/%u ts", instance, s->id, s->num);
2077  }
2078  }
2079  if (s->flags & SIG_FLAG_TOCLIENT) {
2080  struct SidsArray *sa = &instance->tc;
2081  if (sa->active) {
2082  if (sa->sids_array == NULL) {
2083  sa->sids_array = SCCalloc(1, max_sid);
2084  sa->sids_array_size = max_sid;
2085  BUG_ON(sa->sids_array == NULL); // TODO
2086  }
2087  sa->sids_array[s->num / 8] |= 1 << (s->num % 8);
2088  SCLogDebug("instance %p: stored %u/%u tc", instance, s->id, s->num);
2089  }
2090  }
2091  }
2092  break;
2093  }
2094  /* pkt engines are directionless, so only use ts */
2095  case DETECT_BUFFER_MPM_TYPE_PKT: {
2096  DetectBufferInstance lookup = { .list = list, .alproto = ALPROTO_UNKNOWN };
2097  DetectBufferInstance *instance = HashListTableLookup(bufs, &lookup, 0);
2098  if (instance == NULL)
2099  continue;
2100  struct SidsArray *sa = &instance->ts;
2101  if (sa->active) {
2102  if (sa->sids_array == NULL) {
2103  sa->sids_array = SCCalloc(1, max_sid);
2104  sa->sids_array_size = max_sid;
2105  BUG_ON(sa->sids_array == NULL); // TODO
2106  }
2107  sa->sids_array[s->num / 8] |= 1 << (s->num % 8);
2108  }
2109  break;
2110  }
2111  default:
2112  abort();
2113  break;
2114  }
2115  }
2116 
2117  sh->init->app_mpms = SCCalloc(de_ctx->app_mpms_list_cnt, sizeof(MpmCtx *));
2118  BUG_ON(sh->init->app_mpms == NULL);
2119 
2120  sh->init->pkt_mpms = SCCalloc(de_ctx->pkt_mpms_list_cnt, sizeof(MpmCtx *));
2121  BUG_ON(sh->init->pkt_mpms == NULL);
2122 
2123  sh->init->frame_mpms = SCCalloc(de_ctx->frame_mpms_list_cnt, sizeof(MpmCtx *));
2124  BUG_ON(sh->init->frame_mpms == NULL);
2125 
2126  for (DetectBufferMpmRegistry *a = de_ctx->pkt_mpms_list; a != NULL; a = a->next) {
2127  DetectBufferInstance lookup = { .list = a->sm_list, .alproto = ALPROTO_UNKNOWN };
2128  DetectBufferInstance *instance = HashListTableLookup(bufs, &lookup, 0);
2129  if (instance == NULL) {
2130  continue;
2131  }
2132  struct SidsArray *sa = &instance->ts;
2133  if (!sa->active)
2134  continue;
2135 
2136  MpmStore *mpm_store = MpmStorePrepareBufferPkt(de_ctx, sh, a, sa);
2137  if (mpm_store != NULL) {
2138  sh->init->pkt_mpms[a->id] = mpm_store->mpm_ctx;
2139 
2140  SCLogDebug("a %p a->name %s a->reg->PrefilterRegisterWithListId %p "
2141  "mpm_store->mpm_ctx %p", a, a->name,
2142  a->PrefilterRegisterWithListId, mpm_store->mpm_ctx);
2143 
2144  /* if we have just certain types of negated patterns,
2145  * mpm_ctx can be NULL */
2146  if (a->PrefilterRegisterWithListId && mpm_store->mpm_ctx) {
2147  BUG_ON(a->PrefilterRegisterWithListId(de_ctx,
2148  sh, mpm_store->mpm_ctx,
2149  a, a->sm_list) != 0);
2150  SCLogDebug("mpm %s %d set up", a->name, a->sm_list);
2151  }
2152  }
2153  }
2154  for (DetectBufferMpmRegistry *a = de_ctx->frame_mpms_list; a != NULL; a = a->next) {
2155  if ((a->direction == SIG_FLAG_TOSERVER && SGH_DIRECTION_TS(sh)) ||
2156  (a->direction == SIG_FLAG_TOCLIENT && SGH_DIRECTION_TC(sh))) {
2157  DetectBufferInstance lookup = { .list = a->sm_list, .alproto = a->frame_v1.alproto };
2158  DetectBufferInstance *instance = HashListTableLookup(bufs, &lookup, 0);
2159  if (instance == NULL) {
2160  continue;
2161  }
2162  struct SidsArray *sa =
2163  (a->direction == SIG_FLAG_TOSERVER) ? &instance->ts : &instance->tc;
2164  if (!sa->active)
2165  continue;
2166 
2167  SCLogDebug("a %s direction %d PrefilterRegisterWithListId %p", a->name, a->direction,
2168  a->PrefilterRegisterWithListId);
2169  MpmStore *mpm_store = MpmStorePrepareBufferFrame(de_ctx, sh, a, sa);
2170  if (mpm_store != NULL) {
2171  sh->init->frame_mpms[a->id] = mpm_store->mpm_ctx;
2172 
2173  SCLogDebug("a %p a->name %s a->reg->PrefilterRegisterWithListId %p "
2174  "mpm_store->mpm_ctx %p",
2175  a, a->name, a->PrefilterRegisterWithListId, mpm_store->mpm_ctx);
2176 
2177  /* if we have just certain types of negated patterns,
2178  * mpm_ctx can be NULL */
2179  SCLogDebug("mpm_store %p mpm_ctx %p", mpm_store, mpm_store->mpm_ctx);
2180  if (a->PrefilterRegisterWithListId && mpm_store->mpm_ctx) {
2181  BUG_ON(a->PrefilterRegisterWithListId(
2182  de_ctx, sh, mpm_store->mpm_ctx, a, a->sm_list) != 0);
2183  SCLogDebug("mpm %s %d set up", a->name, a->sm_list);
2184  }
2185  }
2186  }
2187  }
2188  for (DetectBufferMpmRegistry *a = de_ctx->app_mpms_list; a != NULL; a = a->next) {
2189  if ((a->direction == SIG_FLAG_TOSERVER && SGH_DIRECTION_TS(sh)) ||
2190  (a->direction == SIG_FLAG_TOCLIENT && SGH_DIRECTION_TC(sh))) {
2191 
2192  DetectBufferInstance lookup = { .list = a->sm_list, .alproto = a->app_v2.alproto };
2193  DetectBufferInstance *instance = HashListTableLookup(bufs, &lookup, 0);
2194  if (instance == NULL) {
2195  continue;
2196  }
2197  struct SidsArray *sa =
2198  (a->direction == SIG_FLAG_TOSERVER) ? &instance->ts : &instance->tc;
2199  if (!sa->active)
2200  continue;
2201 
2202  MpmStore *mpm_store = MpmStorePrepareBufferAppLayer(de_ctx, sh, a, sa);
2203  if (mpm_store != NULL) {
2204  sh->init->app_mpms[a->id] = mpm_store->mpm_ctx;
2205 
2206  SCLogDebug("a %p a->name %s a->PrefilterRegisterWithListId %p "
2207  "mpm_store->mpm_ctx %p",
2208  a, a->name, a->PrefilterRegisterWithListId, mpm_store->mpm_ctx);
2209 
2210  /* if we have just certain types of negated patterns,
2211  * mpm_ctx can be NULL */
2212  if (a->PrefilterRegisterWithListId && mpm_store->mpm_ctx) {
2213  BUG_ON(a->PrefilterRegisterWithListId(
2214  de_ctx, sh, mpm_store->mpm_ctx, a, a->sm_list) != 0);
2215  SCLogDebug("mpm %s %d set up", a->name, a->sm_list);
2216  }
2217  }
2218  }
2219  }
2220  HashListTableFree(bufs);
2221 }
2222 
2223 /** \brief Prepare the pattern matcher ctx in a sig group head.
2224  *
2225  */
2226 int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
2227 {
2228  MpmStore *mpm_store = NULL;
2229  if (SGH_PROTO(sh, IPPROTO_TCP)) {
2230  if (SGH_DIRECTION_TS(sh)) {
2231  mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_TCP_PKT_TS);
2232  if (mpm_store != NULL) {
2233  PrefilterPktPayloadRegister(de_ctx, sh, mpm_store->mpm_ctx);
2234  }
2235 
2236  mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_TCP_STREAM_TS);
2237  if (mpm_store != NULL) {
2238  PrefilterPktStreamRegister(de_ctx, sh, mpm_store->mpm_ctx);
2239  }
2240 
2241  SetRawReassemblyFlag(de_ctx, sh);
2242  }
2243  if (SGH_DIRECTION_TC(sh)) {
2244  mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_TCP_PKT_TC);
2245  if (mpm_store != NULL) {
2246  PrefilterPktPayloadRegister(de_ctx, sh, mpm_store->mpm_ctx);
2247  }
2248 
2249  mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_TCP_STREAM_TC);
2250  if (mpm_store != NULL) {
2251  PrefilterPktStreamRegister(de_ctx, sh, mpm_store->mpm_ctx);
2252  }
2253 
2254  SetRawReassemblyFlag(de_ctx, sh);
2255  }
2256  } else if (SGH_PROTO(sh, IPPROTO_UDP)) {
2257  if (SGH_DIRECTION_TS(sh)) {
2258  mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_UDP_TS);
2259  if (mpm_store != NULL) {
2260  PrefilterPktPayloadRegister(de_ctx, sh, mpm_store->mpm_ctx);
2261  }
2262  }
2263  if (SGH_DIRECTION_TC(sh)) {
2264  mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_UDP_TC);
2265  if (mpm_store != NULL) {
2266  PrefilterPktPayloadRegister(de_ctx, sh, mpm_store->mpm_ctx);
2267  }
2268  }
2269  } else {
2270  mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_OTHERIP);
2271  if (mpm_store != NULL) {
2272  PrefilterPktPayloadRegister(de_ctx, sh, mpm_store->mpm_ctx);
2273  }
2274  }
2275 
2276  PrepareMpms(de_ctx, sh);
2277  return 0;
2278 }
2279 
2280 static inline uint32_t ContentFlagsForHash(const DetectContentData *cd)
2281 {
2282  return cd->flags & (DETECT_CONTENT_NOCASE | DETECT_CONTENT_OFFSET | DETECT_CONTENT_DEPTH |
2283  DETECT_CONTENT_NEGATED | DETECT_CONTENT_ENDS_WITH);
2284 }
2285 
2286 /** \internal
2287  * \brief The hash function for Pattern. Hashes pattern after chop is applied.
2288  *
2289  * \param ht Pointer to the hash table.
2290  * \param data Pointer to the Pattern.
2291  * \param datalen Not used in our case.
2292  *
2293  * \retval hash The generated hash value.
2294  */
2295 static uint32_t PatternChopHashFunc(HashListTable *ht, void *data, uint16_t datalen)
2296 {
2297  const DetectPatternTracker *p = (DetectPatternTracker *)data;
2298  uint32_t hash = p->sm_list + ContentFlagsForHash(p->cd);
2299  uint16_t content_len = p->cd->content_len;
2300  const uint8_t *content = p->cd->content;
2301  if (p->cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) {
2302  content += p->cd->fp_chop_offset;
2303  content_len = p->cd->fp_chop_len;
2304  }
2305  hash += StringHashDjb2(content, content_len);
2306  return hash % ht->array_size;
2307 }
2308 
2309 /** \internal
2310  * \brief The hash function for Pattern. Ignores chop.
2311  *
2312  * \param ht Pointer to the hash table.
2313  * \param data Pointer to the Pattern.
2314  * \param datalen Not used in our case.
2315  *
2316  * \retval hash The generated hash value.
2317  */
2318 static uint32_t PatternNoChopHashFunc(HashListTable *ht, void *data, uint16_t datalen)
2319 {
2320  const DetectPatternTracker *p = (DetectPatternTracker *)data;
2321  uint32_t hash = p->sm_list + ContentFlagsForHash(p->cd);
2322  hash += StringHashDjb2(p->cd->content, p->cd->content_len);
2323  return hash % ht->array_size;
2324 }
2325 
2326 /**
2327  * \brief The Compare function for Pattern. Compares patterns after chop is applied.
2328  *
2329  * \param data1 Pointer to the first Pattern.
2330  * \param len1 Not used.
2331  * \param data2 Pointer to the second Pattern.
2332  * \param len2 Not used.
2333  *
2334  * \retval 1 If the 2 Patterns sent as args match.
2335  * \retval 0 If the 2 Patterns sent as args do not match.
2336  */
2337 static char PatternChopCompareFunc(void *data1, uint16_t len1, void *data2, uint16_t len2)
2338 {
2339  const DetectPatternTracker *p1 = (DetectPatternTracker *)data1;
2340  const DetectPatternTracker *p2 = (DetectPatternTracker *)data2;
2341 
2342  if (p1->sm_list != p2->sm_list)
2343  return 0;
2344 
2345  if (ContentFlagsForHash(p1->cd) != ContentFlagsForHash(p2->cd))
2346  return 0;
2347 
2348  uint16_t p1_content_len = p1->cd->content_len;
2349  uint8_t *p1_content = p1->cd->content;
2350  if (p1->cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) {
2351  p1_content += p1->cd->fp_chop_offset;
2352  p1_content_len = p1->cd->fp_chop_len;
2353  }
2354  uint16_t p2_content_len = p2->cd->content_len;
2355  uint8_t *p2_content = p2->cd->content;
2356  if (p2->cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) {
2357  p2_content += p2->cd->fp_chop_offset;
2358  p2_content_len = p2->cd->fp_chop_len;
2359  }
2360 
2361  if (p1_content_len != p2_content_len)
2362  return 0;
2363 
2364  if (memcmp(p1_content, p2_content, p1_content_len) != 0) {
2365  return 0;
2366  }
2367 
2368  return 1;
2369 }
2370 
2371 /**
2372  * \brief The Compare function for Pattern. Ignores chop settings
2373  *
2374  * \param data1 Pointer to the first Pattern.
2375  * \param len1 Not used.
2376  * \param data2 Pointer to the second Pattern.
2377  * \param len2 Not used.
2378  *
2379  * \retval 1 If the 2 Patterns sent as args match.
2380  * \retval 0 If the 2 Patterns sent as args do not match.
2381  */
2382 static char PatternNoChopCompareFunc(void *data1, uint16_t len1, void *data2, uint16_t len2)
2383 {
2384  const DetectPatternTracker *p1 = (DetectPatternTracker *)data1;
2385  const DetectPatternTracker *p2 = (DetectPatternTracker *)data2;
2386 
2387  if (p1->sm_list != p2->sm_list)
2388  return 0;
2389 
2390  if (ContentFlagsForHash(p1->cd) != ContentFlagsForHash(p2->cd))
2391  return 0;
2392 
2393  if (p1->cd->content_len != p2->cd->content_len)
2394  return 0;
2395 
2396  if (memcmp(p1->cd->content, p2->cd->content, p1->cd->content_len) != 0) {
2397  return 0;
2398  }
2399 
2400  return 1;
2401 }
2402 
2403 static void PatternFreeFunc(void *ptr)
2404 {
2405  SCFree(ptr);
2406 }
2407 
2408 /**
2409  * \brief Figure out the FP and their respective content ids for all the
2410  * sigs in the engine.
2411  *
2412  * \param de_ctx Detection engine context.
2413  *
2414  * \retval 0 On success.
2415  * \retval -1 On failure.
2416  */
2417 int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx)
2418 {
2419  uint32_t cnt = 0;
2420  for (Signature *s = de_ctx->sig_list; s != NULL; s = s->next) {
2421  if (s->flags & SIG_FLAG_PREFILTER)
2422  continue;
2423 
2424  RetrieveFPForSig(de_ctx, s);
2425  if (s->init_data->mpm_sm != NULL) {
2426  s->flags |= SIG_FLAG_PREFILTER;
2427  cnt++;
2428  }
2429  }
2430  /* no mpm rules */
2431  if (cnt == 0)
2432  return 0;
2433 
2434  HashListTable *ht =
2435  HashListTableInit(4096, PatternChopHashFunc, PatternChopCompareFunc, PatternFreeFunc);
2436  BUG_ON(ht == NULL);
2437  PatIntId max_id = 0;
2438 
2439  for (Signature *s = de_ctx->sig_list; s != NULL; s = s->next) {
2440  if (s->init_data->mpm_sm == NULL)
2441  continue;
2442 
2443  const int sm_list = s->init_data->mpm_sm_list;
2444  BUG_ON(sm_list == -1);
2445 
2446  DetectContentData *cd = (DetectContentData *)s->init_data->mpm_sm->ctx;
2447 
2448  DetectPatternTracker lookup = { .cd = cd, .sm_list = sm_list, .cnt = 0, .mpm = 0 };
2449  DetectPatternTracker *res = HashListTableLookup(ht, &lookup, 0);
2450  if (res) {
2451  res->cnt++;
2452  res->mpm += ((cd->flags & DETECT_CONTENT_MPM) != 0);
2453 
2454  cd->id = res->cd->id;
2455  SCLogDebug("%u: res id %u cnt %u", s->id, res->cd->id, res->cnt);
2456  } else {
2457  DetectPatternTracker *add = SCCalloc(1, sizeof(*add));
2458  BUG_ON(add == NULL);
2459  add->cd = cd;
2460  add->sm_list = sm_list;
2461  add->cnt = 1;
2462  add->mpm = ((cd->flags & DETECT_CONTENT_MPM) != 0);
2463  HashListTableAdd(ht, (void *)add, 0);
2464 
2465  cd->id = max_id++;
2466  SCLogDebug("%u: add id %u cnt %u", s->id, add->cd->id, add->cnt);
2467  }
2468  }
2469 
2470  HashListTableFree(ht);
2471 
2472  return 0;
2473 }
2474 
2475 /** \brief add all patterns on our stats hash
2476  * Used to fill the hash later used by DumpPatterns()
2477  * \note sets up the hash table on first call
2478  */
2479 void EngineAnalysisAddAllRulePatterns(DetectEngineCtx *de_ctx, const Signature *s)
2480 {
2481  if (de_ctx->pattern_hash_table == NULL) {
2482  de_ctx->pattern_hash_table = HashListTableInit(
2483  4096, PatternNoChopHashFunc, PatternNoChopCompareFunc, PatternFreeFunc);
2484  BUG_ON(de_ctx->pattern_hash_table == NULL);
2485  }
2486  if (s->sm_arrays[DETECT_SM_LIST_PMATCH]) {
2487  SigMatchData *smd = s->sm_arrays[DETECT_SM_LIST_PMATCH];
2488  do {
2489  switch (smd->type) {
2490  case DETECT_CONTENT: {
2491  const DetectContentData *cd = (const DetectContentData *)smd->ctx;
2492  DetectPatternTracker lookup = {
2493  .cd = cd, .sm_list = DETECT_SM_LIST_PMATCH, .cnt = 0, .mpm = 0
2494  };
2495  DetectPatternTracker *res =
2496  HashListTableLookup(de_ctx->pattern_hash_table, &lookup, 0);
2497  if (res) {
2498  res->cnt++;
2499  res->mpm += ((cd->flags & DETECT_CONTENT_MPM) != 0);
2500  } else {
2501  DetectPatternTracker *add = SCCalloc(1, sizeof(*add));
2502  BUG_ON(add == NULL);
2503  add->cd = cd;
2504  add->sm_list = DETECT_SM_LIST_PMATCH;
2505  add->cnt = 1;
2506  add->mpm = ((cd->flags & DETECT_CONTENT_MPM) != 0);
2507  HashListTableAdd(de_ctx->pattern_hash_table, (void *)add, 0);
2508  }
2509  break;
2510  }
2511  }
2512  if (smd->is_last)
2513  break;
2514  smd++;
2515  } while (1);
2516  }
2517 
2518  const DetectEngineAppInspectionEngine *app = s->app_inspect;
2519  for (; app != NULL; app = app->next) {
2520  DEBUG_VALIDATE_BUG_ON(app->smd == NULL);
2521  SigMatchData *smd = app->smd;
2522  do {
2523  switch (smd->type) {
2524  case DETECT_CONTENT: {
2525  const DetectContentData *cd = (const DetectContentData *)smd->ctx;
2526 
2527  DetectPatternTracker lookup = {
2528  .cd = cd, .sm_list = app->sm_list, .cnt = 0, .mpm = 0
2529  };
2530  DetectPatternTracker *res =
2531  HashListTableLookup(de_ctx->pattern_hash_table, &lookup, 0);
2532  if (res) {
2533  res->cnt++;
2534  res->mpm += ((cd->flags & DETECT_CONTENT_MPM) != 0);
2535  } else {
2536  DetectPatternTracker *add = SCCalloc(1, sizeof(*add));
2537  BUG_ON(add == NULL);
2538  add->cd = cd;
2539  add->sm_list = app->sm_list;
2540  add->cnt = 1;
2541  add->mpm = ((cd->flags & DETECT_CONTENT_MPM) != 0);
2542  HashListTableAdd(de_ctx->pattern_hash_table, (void *)add, 0);
2543  }
2544  break;
2545  }
2546  }
2547  if (smd->is_last)
2548  break;
2549  smd++;
2550  } while (1);
2551  }
2552  const DetectEnginePktInspectionEngine *pkt = s->pkt_inspect;
2553  for (; pkt != NULL; pkt = pkt->next) {
2554  SigMatchData *smd = pkt->smd;
2555  do {
2556  if (smd == NULL) {
2557  BUG_ON(!(pkt->sm_list < DETECT_SM_LIST_DYNAMIC_START));
2558  smd = s->sm_arrays[pkt->sm_list];
2559  }
2560  switch (smd->type) {
2561  case DETECT_CONTENT: {
2562  const DetectContentData *cd = (const DetectContentData *)smd->ctx;
2563 
2564  DetectPatternTracker lookup = {
2565  .cd = cd, .sm_list = pkt->sm_list, .cnt = 0, .mpm = 0
2566  };
2567  DetectPatternTracker *res =
2568  HashListTableLookup(de_ctx->pattern_hash_table, &lookup, 0);
2569  if (res) {
2570  res->cnt++;
2571  res->mpm += ((cd->flags & DETECT_CONTENT_MPM) != 0);
2572  } else {
2573  DetectPatternTracker *add = SCCalloc(1, sizeof(*add));
2574  BUG_ON(add == NULL);
2575  add->cd = cd;
2576  add->sm_list = pkt->sm_list;
2577  add->cnt = 1;
2578  add->mpm = ((cd->flags & DETECT_CONTENT_MPM) != 0);
2579  HashListTableAdd(de_ctx->pattern_hash_table, (void *)add, 0);
2580  }
2581  break;
2582  }
2583  }
2584  if (smd->is_last)
2585  break;
2586  smd++;
2587  } while (1);
2588  }
2589  const DetectEngineFrameInspectionEngine *frame = s->frame_inspect;
2590  for (; frame != NULL; frame = frame->next) {
2591  SigMatchData *smd = frame->smd;
2592  do {
2593  if (smd == NULL) {
2594  BUG_ON(!(frame->sm_list < DETECT_SM_LIST_DYNAMIC_START));
2595  smd = s->sm_arrays[frame->sm_list];
2596  }
2597  switch (smd->type) {
2598  case DETECT_CONTENT: {
2599  const DetectContentData *cd = (const DetectContentData *)smd->ctx;
2600 
2601  DetectPatternTracker lookup = {
2602  .cd = cd, .sm_list = frame->sm_list, .cnt = 0, .mpm = 0
2603  };
2604  DetectPatternTracker *res =
2605  HashListTableLookup(de_ctx->pattern_hash_table, &lookup, 0);
2606  if (res) {
2607  res->cnt++;
2608  res->mpm += ((cd->flags & DETECT_CONTENT_MPM) != 0);
2609  } else {
2610  DetectPatternTracker *add = SCCalloc(1, sizeof(*add));
2611  BUG_ON(add == NULL);
2612  add->cd = cd;
2613  add->sm_list = frame->sm_list;
2614  add->cnt = 1;
2615  add->mpm = ((cd->flags & DETECT_CONTENT_MPM) != 0);
2616  HashListTableAdd(de_ctx->pattern_hash_table, (void *)add, 0);
2617  }
2618  break;
2619  }
2620  }
2621  if (smd->is_last)
2622  break;
2623  smd++;
2624  } while (1);
2625  }
2626 }
MpmInitThreadCtx
void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t matcher)
Definition: util-mpm.c:196
DETECT_CONTENT_NOCASE
#define DETECT_CONTENT_NOCASE
Definition: detect-content.h:29
SignatureHasPacketContent
int SignatureHasPacketContent(const Signature *s)
check if a signature has patterns that are to be inspected against a packets payload (as opposed to t...
Definition: detect-engine-mpm.c:796
DetectEngineCtx_::pkt_mpms_list_cnt
uint32_t pkt_mpms_list_cnt
Definition: detect.h:1004
HashListTableGetListData
#define HashListTableGetListData(hb)
Definition: util-hashlist.h:56
DetectEngineCtx_::frame_mpms_list_cnt
uint32_t frame_mpms_list_cnt
Definition: detect.h:1007
DetectContentData_::offset
uint16_t offset
Definition: detect-content.h:107
SignatureInitData_::max_content_list_id
uint32_t max_content_list_id
Definition: detect.h:599
PrefilterGenericMpmPktRegister
int PrefilterGenericMpmPktRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-prefilter.c:873
DetectAppLayerMpmMultiRegister
void DetectAppLayerMpmMultiRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionMultiBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
Definition: detect-engine-mpm.c:159
DetectPatternTracker
Definition: detect.h:732
SCFPSupportSMList_
Definition: detect.h:762
DetectEngineAppInspectionEngine_
Definition: detect.h:429
util-hash-string.h
MPMB_UDP_TS
@ MPMB_UDP_TS
Definition: detect.h:1349
SignatureInitDataBuffer_::head
SigMatch * head
Definition: detect.h:537
detect-content.h
SGH_DIRECTION_TC
#define SGH_DIRECTION_TC(sgh)
Definition: detect-engine-mpm.c:1006
MpmCtx_::mpm_type
uint8_t mpm_type
Definition: util-mpm.h:90
detect-engine.h
DETECT_SM_LIST_PMATCH
@ DETECT_SM_LIST_PMATCH
Definition: detect.h:116
DetectBufferMpmRegistry_::direction
int direction
Definition: detect.h:690
DETECT_CONTENT_FAST_PATTERN_CHOP
#define DETECT_CONTENT_FAST_PATTERN_CHOP
Definition: detect-content.h:36
SignatureInitData_::smlists
struct SigMatch_ * smlists[DETECT_SM_LIST_MAX]
Definition: detect.h:588
PatternMatchDestroy
void PatternMatchDestroy(MpmCtx *mpm_ctx, uint16_t mpm_matcher)
Definition: detect-engine-mpm.c:900
MpmStore_::sid_array_size
uint32_t sid_array_size
Definition: detect.h:1357
DetectContentData_::fp_chop_len
uint16_t fp_chop_len
Definition: detect-content.h:98
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:128
MpmStore_::sid_array
uint8_t * sid_array
Definition: detect.h:1356
DetectEngineCtx_::sgh_mpm_context_proto_tcp_packet
int32_t sgh_mpm_context_proto_tcp_packet
Definition: detect.h:918
PatternMatchPrepareGroup
int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
Prepare the pattern matcher ctx in a sig group head.
Definition: detect-engine-mpm.c:2226
SCFPSupportSMList_::next
struct SCFPSupportSMList_ * next
Definition: detect.h:765
DetectEnginePktInspectionEngine
Definition: detect.h:488
ALPROTO_DNS
@ ALPROTO_DNS
Definition: app-layer-protos.h:41
DetectEngineAppInspectionEngine_::next
struct DetectEngineAppInspectionEngine_ * next
Definition: detect.h:453
detect-engine-siggroup.h
SigGroupHead_::flags
uint16_t flags
Definition: detect.h:1466
SCFPSupportSMList_::list_id
int list_id
Definition: detect.h:763
SigTableElmt_::name
const char * name
Definition: detect.h:1309
MpmStoreFree
void MpmStoreFree(DetectEngineCtx *de_ctx)
Frees the hash table - DetectEngineCtx->mpm_hash_table, allocated by MpmStoreInit() function.
Definition: detect-engine-mpm.c:1529
DetectFrameMpmRegisterByParentId
void DetectFrameMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Definition: detect-engine-mpm.c:359
MpmThreadCtx_
Definition: util-mpm.h:46
DetectPatternTracker::mpm
uint32_t mpm
Definition: detect.h:736
Signature_::num
SigIntId num
Definition: detect.h:615
ConfGetBool
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as a boolean.
Definition: conf.c:482
DETECT_ABSENT
@ DETECT_ABSENT
Definition: detect-engine-register.h:98
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1465
DetectEngineCtx_::pattern_hash_table
HashListTable * pattern_hash_table
Definition: detect.h:879
DetectEngineTransforms
Definition: detect.h:408
DetectBufferMpmRegistry_::sm_list_base
int16_t sm_list_base
Definition: detect.h:692
MpmFactoryReClaimMpmCtx
void MpmFactoryReClaimMpmCtx(const DetectEngineCtx *de_ctx, MpmCtx *mpm_ctx)
Definition: util-mpm.c:157
DETECT_CONTENT
@ DETECT_CONTENT
Definition: detect-engine-register.h:72
MpmStoreReportStats
void MpmStoreReportStats(const DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:1432
Signature_::alproto
AppProto alproto
Definition: detect.h:608
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
MPMB_OTHERIP
@ MPMB_OTHERIP
Definition: detect.h:1351
DetectPktMpmRegister
void DetectPktMpmRegister(const char *name, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), InspectionBufferGetPktDataPtr GetData)
register a MPM engine
Definition: detect-engine-mpm.c:541
SigMatchData_::is_last
bool is_last
Definition: detect.h:360
DetectBufferTypeSupportsFrames
void DetectBufferTypeSupportsFrames(const char *name)
Definition: detect-engine.c:1054
DetectMpmInitializeFrameMpms
void DetectMpmInitializeFrameMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:461
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:81
DETECT_SM_LIST_DYNAMIC_START
@ DETECT_SM_LIST_DYNAMIC_START
Definition: detect.h:135
SigMatchData_::ctx
SigMatchCtx * ctx
Definition: detect.h:361
DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED
#define DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED
Definition: detect-content.h:55
InspectionMultiBufferGetDataPtr
InspectionBuffer *(* InspectionMultiBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id, const uint32_t local_id)
Definition: detect.h:419
MpmStore_::sm_list
int sm_list
Definition: detect.h:1361
PatternStrength
uint32_t PatternStrength(uint8_t *pat, uint16_t patlen)
Predict a strength value for patterns.
Definition: detect-engine-mpm.c:930
DetectEngineCtx_::pkt_mpms_list
DetectBufferMpmRegistry * pkt_mpms_list
Definition: detect.h:1003
DETECT_BUFFER_MPM_TYPE_FRAME
@ DETECT_BUFFER_MPM_TYPE_FRAME
Definition: detect.h:681
DetectSetFastPatternAndItsId
int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx)
Figure out the FP and their respective content ids for all the sigs in the engine.
Definition: detect-engine-mpm.c:2417
InspectionBufferGetDataPtr
InspectionBuffer *(* InspectionBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id)
Definition: detect.h:414
DetectBufferMpmRegistry_::app_v2
struct DetectBufferMpmRegistry_::@84::@86 app_v2
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:75
ctx
struct Thresholds ctx
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:843
DetectEnginePktInspectionEngine::smd
SigMatchData * smd
Definition: detect.h:489
util-memcpy.h
DETECT_CONTENT_MPM_IS_CONCLUSIVE
#define DETECT_CONTENT_MPM_IS_CONCLUSIVE(c)
Definition: detect-content.h:78
HashListTableGetListHead
HashListTableBucket * HashListTableGetListHead(HashListTable *ht)
Definition: util-hashlist.c:287
DETECT_CONTENT_DEPTH_VAR
#define DETECT_CONTENT_DEPTH_VAR
Definition: detect-content.h:46
InspectionBufferGetPktDataPtr
InspectionBuffer *(* InspectionBufferGetPktDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Packet *p, const int list_id)
Definition: detect.h:483
DetectEngineBufferTypeGetNameById
const char * DetectEngineBufferTypeGetNameById(const DetectEngineCtx *de_ctx, const int id)
Definition: detect-engine.c:1124
MPM_TABLE_SIZE
@ MPM_TABLE_SIZE
Definition: util-mpm.h:40
DetectMpmInitializeBuiltinMpms
void DetectMpmInitializeBuiltinMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:726
DetectBufferMpmRegistry_::next
struct DetectBufferMpmRegistry_ * next
Definition: detect.h:728
SIG_FLAG_REQUIRE_STREAM
#define SIG_FLAG_REQUIRE_STREAM
Definition: detect.h:251
DetectPatternTracker::cnt
uint32_t cnt
Definition: detect.h:735
DetectBufferMpmRegistry_
one time registration of keywords at start up
Definition: detect.h:687
DE_QUIET
#define DE_QUIET
Definition: detect.h:323
MpmCtx_::maxlen
uint16_t maxlen
Definition: util-mpm.h:100
MPMB_TCP_STREAM_TS
@ MPMB_TCP_STREAM_TS
Definition: detect.h:1347
DetectPatternTracker::cd
const struct DetectContentData_ * cd
Definition: detect.h:733
PatIntId
#define PatIntId
Definition: suricata-common.h:318
SIG_GROUP_HEAD_HAVERAWSTREAM
#define SIG_GROUP_HEAD_HAVERAWSTREAM
Definition: detect.h:1335
MpmTableElmt_::feature_flags
uint8_t feature_flags
Definition: util-mpm.h:174
mpm_default_matcher
uint8_t mpm_default_matcher
Definition: util-mpm.c:48
Signature_::sm_arrays
SigMatchData * sm_arrays[DETECT_SM_LIST_MAX]
Definition: detect.h:656
DetectContentData_
Definition: detect-content.h:93
DetectContentData_::fp_chop_offset
uint16_t fp_chop_offset
Definition: detect-content.h:100
HashListTableLookup
void * HashListTableLookup(HashListTable *ht, void *data, uint16_t datalen)
Definition: util-hashlist.c:245
detect-engine-payload.h
SIG_FLAG_TOCLIENT
#define SIG_FLAG_TOCLIENT
Definition: detect.h:268
MAX
#define MAX(x, y)
Definition: suricata-common.h:395
ALPROTO_MAX
@ ALPROTO_MAX
Definition: app-layer-protos.h:76
MPMB_MAX
@ MPMB_MAX
Definition: detect.h:1352
SigMatchData_
Data needed for Match()
Definition: detect.h:358
DetectEngineCtx_::sgh_mpm_context_proto_udp_packet
int32_t sgh_mpm_context_proto_udp_packet
Definition: detect.h:919
DetectBufferMpmRegistry_::transforms
DetectEngineTransforms transforms
Definition: detect.h:700
ShortenString
void ShortenString(const char *input, char *output, size_t output_size, char c)
Definition: util-misc.c:207
SigMatchData_::type
uint16_t type
Definition: detect.h:359
DetectEngineRegisterFastPatternForId
void DetectEngineRegisterFastPatternForId(DetectEngineCtx *de_ctx, int list_id, int priority)
Definition: detect-fast-pattern.c:134
SidsArray
Definition: detect-engine-mpm.c:1767
MPMB_TCP_STREAM_TC
@ MPMB_TCP_STREAM_TC
Definition: detect.h:1348
detect-engine-prefilter.h
EngineAnalysisAddAllRulePatterns
void EngineAnalysisAddAllRulePatterns(DetectEngineCtx *de_ctx, const Signature *s)
add all patterns on our stats hash Used to fill the hash later used by DumpPatterns()
Definition: detect-engine-mpm.c:2479
Signature_::frame_inspect
DetectEngineFrameInspectionEngine * frame_inspect
Definition: detect.h:652
MpmBuiltinBuffers
MpmBuiltinBuffers
Definition: detect.h:1344
DetectBufferTypeGetByName
int DetectBufferTypeGetByName(const char *name)
Definition: detect-engine.c:1094
HashListTableAdd
int HashListTableAdd(HashListTable *ht, void *data, uint16_t datalen)
Definition: util-hashlist.c:114
detect-udphdr.h
strlcpy
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
HashListTable_::array_size
uint32_t array_size
Definition: util-hashlist.h:41
DetectAppLayerMpmRegisterByParentId
void DetectAppLayerMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Definition: detect-engine-mpm.c:168
util-memcmp.h
SigGroupHeadInitData_::pkt_mpms
MpmCtx ** pkt_mpms
Definition: detect.h:1449
MpmInitCtx
void MpmInitCtx(MpmCtx *mpm_ctx, uint8_t matcher)
Definition: util-mpm.c:210
Signature_::next
struct Signature_ * next
Definition: detect.h:675
DetectEngineCtx_::sgh_mpm_context_proto_other_packet
int32_t sgh_mpm_context_proto_other_packet
Definition: detect.h:920
DetectEngineAppInspectionEngine_::sm_list
uint16_t sm_list
Definition: detect.h:437
DetectBufferInstance::alproto
AppProto alproto
Definition: detect-engine-mpm.c:1934
ConfGet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:335
HashListTableGetListNext
#define HashListTableGetListNext(hb)
Definition: util-hashlist.h:55
DetectBufferMpmType
DetectBufferMpmType
Definition: detect.h:678
SIG_FLAG_TOSERVER
#define SIG_FLAG_TOSERVER
Definition: detect.h:267
HashListTableInit
HashListTable * HashListTableInit(uint32_t size, uint32_t(*Hash)(struct HashListTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
Definition: util-hashlist.c:35
decode.h
MpmDestroyThreadCtx
void MpmDestroyThreadCtx(MpmThreadCtx *mpm_thread_ctx, const uint16_t matcher)
Definition: util-mpm.c:203
util-debug.h
DetectBufferInstance::ts
struct SidsArray ts
Definition: detect-engine-mpm.c:1936
SigGroupHeadInitData_::sig_cnt
SigIntId sig_cnt
Definition: detect.h:1458
SidsArray::sids_array_size
uint32_t sids_array_size
Definition: detect-engine-mpm.c:1769
DETECT_CONTENT_ENDS_WITH
#define DETECT_CONTENT_ENDS_WITH
Definition: detect-content.h:42
DetectBufferMpmRegistry_::sgh_mpm_context
int sgh_mpm_context
Definition: detect.h:696
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
MpmFactoryGetMpmCtxForProfile
MpmCtx * MpmFactoryGetMpmCtxForProfile(const DetectEngineCtx *de_ctx, int32_t id, int direction)
Definition: util-mpm.c:132
DetectEnginePktInspectionEngine::sm_list
uint16_t sm_list
Definition: detect.h:491
DetectMpmInitializePktMpms
void DetectMpmInitializePktMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:628
ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE
@ ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE
Definition: detect.h:1067
MPM_PATTERN_CTX_OWNS_ID
#define MPM_PATTERN_CTX_OWNS_ID
Definition: util-mpm.h:139
strlcat
size_t strlcat(char *, const char *src, size_t siz)
Definition: util-strlcatu.c:45
MpmStore_
Definition: detect.h:1355
SignatureInitData_::mpm_sm
SigMatch * mpm_sm
Definition: detect.h:567
DetectBufferMpmRegistry_::sm_list
int16_t sm_list
Definition: detect.h:691
DetectEngineGetMaxSigId
#define DetectEngineGetMaxSigId(de_ctx)
Definition: detect-engine.h:105
SignatureInitData_::mpm_sm_list
int mpm_sm_list
Definition: detect.h:565
SidsArray::sids_array
uint8_t * sids_array
Definition: detect-engine-mpm.c:1768
DETECT_CONTENT_DEPTH
#define DETECT_CONTENT_DEPTH
Definition: detect-content.h:33
Signature_::pkt_inspect
DetectEnginePktInspectionEngine * pkt_inspect
Definition: detect.h:651
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
detect-engine-mpm.h
detect.h
DetectEngineFrameInspectionEngine::sm_list
uint16_t sm_list
Definition: detect.h:518
DetectBufferMpmRegistry_::pkt_v1
struct DetectBufferMpmRegistry_::@84::@87 pkt_v1
SigMatch_::next
struct SigMatch_ * next
Definition: detect.h:353
DetectEngineCtx_::mpm_matcher
uint8_t mpm_matcher
Definition: detect.h:846
DETECT_CONTENT_IS_SINGLE
#define DETECT_CONTENT_IS_SINGLE(c)
Definition: detect-content.h:68
DETECT_CONTENT_NEGATED
#define DETECT_CONTENT_NEGATED
Definition: detect-content.h:40
PrefilterGenericMpmRegister
int PrefilterGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-prefilter.c:750
DetectBufferMpmRegistry_::priority
int priority
Definition: detect.h:693
PatternMatchThreadPrepare
void PatternMatchThreadPrepare(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
Definition: detect-engine-mpm.c:911
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
DetectEngineBufferTypeRegister
int DetectEngineBufferTypeRegister(DetectEngineCtx *de_ctx, const char *name)
Definition: detect-engine.c:1181
SigGroupHead_::init
SigGroupHeadInitData * init
Definition: detect.h:1488
DetectContentData_::id
PatIntId id
Definition: detect-content.h:105
DetectAppLayerMpmRegister
void DetectAppLayerMpmRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
register an app layer keyword for mpm
Definition: detect-engine-mpm.c:151
Signature_::app_inspect
DetectEngineAppInspectionEngine * app_inspect
Definition: detect.h:650
MpmCtx_::minlen
uint16_t minlen
Definition: util-mpm.h:99
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:352
DetectProto_::proto
uint8_t proto[256/8]
Definition: detect-engine-proto.h:36
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:300
MpmStore_::direction
int direction
Definition: detect.h:1359
MPMCTX_FLAGS_GLOBAL
#define MPMCTX_FLAGS_GLOBAL
Definition: util-mpm.h:85
PrefilterRegisterFunc
int(* PrefilterRegisterFunc)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-mpm.h:72
Signature_::flags
uint32_t flags
Definition: detect.h:604
DetectContentData_::depth
uint16_t depth
Definition: detect-content.h:106
stream.h
MpmFactoryRegisterMpmCtxProfile
int32_t MpmFactoryRegisterMpmCtxProfile(DetectEngineCtx *de_ctx, const char *name, const int sm_list, const AppProto alproto)
Register a new Mpm Context.
Definition: util-mpm.c:59
DetectEngineCtx_::sgh_mpm_context_stream
int32_t sgh_mpm_context_stream
Definition: detect.h:921
type
uint16_t type
Definition: decode-vlan.c:107
DetectEngineBufferTypeSupportsFrames
void DetectEngineBufferTypeSupportsFrames(DetectEngineCtx *de_ctx, const char *name)
Definition: detect-engine.c:1220
DetectEngineCtx_::frame_mpms_list
DetectBufferMpmRegistry * frame_mpms_list
Definition: detect.h:1006
conf.h
DetectEngineCtx_::sgh_mpm_ctx_cnf
uint8_t sgh_mpm_ctx_cnf
Definition: detect.h:947
DetectContentData_::flags
uint32_t flags
Definition: detect-content.h:104
PrefilterPktPayloadRegister
int PrefilterPktPayloadRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx)
Definition: detect-engine-payload.c:132
MpmStore_::alproto
AppProto alproto
Definition: detect.h:1363
DetectEngineFrameInspectionEngine
Definition: detect.h:513
DETECT_BUFFER_MPM_TYPE_PKT
@ DETECT_BUFFER_MPM_TYPE_PKT
Definition: detect.h:679
MpmTableElmt_::Prepare
int(* Prepare)(struct MpmCtx_ *)
Definition: util-mpm.h:166
ALPROTO_DOH2
@ ALPROTO_DOH2
Definition: app-layer-protos.h:61
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:672
FastPatternSupportEnabledForSigMatchList
int FastPatternSupportEnabledForSigMatchList(const DetectEngineCtx *de_ctx, const int list_id)
Checks if a particular buffer is in the list of lists that need to be searched for a keyword that has...
Definition: detect-fast-pattern.c:64
SCFPSupportSMList_::priority
int priority
Definition: detect.h:764
HashListTable_
Definition: util-hashlist.h:37
DetectEngineTransforms::transforms
TransformData transforms[DETECT_TRANSFORMS_MAX]
Definition: detect.h:409
ALPROTO_HTTP2
@ ALPROTO_HTTP2
Definition: app-layer-protos.h:64
SidsArray::type
enum DetectBufferMpmType type
Definition: detect-engine-mpm.c:1773
SigGroupHeadInitData_::app_mpms
MpmCtx ** app_mpms
Definition: detect.h:1448
MpmAddPatternCS
int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:250
DetectEngineBufferTypeSupportsTransformations
void DetectEngineBufferTypeSupportsTransformations(DetectEngineCtx *de_ctx, const char *name)
Definition: detect-engine.c:1244
SGH_DIRECTION_TS
#define SGH_DIRECTION_TS(sgh)
Definition: detect-engine-mpm.c:1005
DetectPatternTracker::sm_list
int sm_list
Definition: detect.h:734
DetectEngineAppInspectionEngine_::smd
SigMatchData * smd
Definition: detect.h:451
DetectBufferInstance
Definition: detect-engine-mpm.c:1931
MpmStore_::mpm_ctx
MpmCtx * mpm_ctx
Definition: detect.h:1364
MPM_FEATURE_FLAG_ENDSWITH
#define MPM_FEATURE_FLAG_ENDSWITH
Definition: util-mpm.h:144
detect-fast-pattern.h
MpmStorePrepareBuffer
MpmStore * MpmStorePrepareBuffer(DetectEngineCtx *de_ctx, SigGroupHead *sgh, enum MpmBuiltinBuffers buf)
Get MpmStore for a built-in buffer type.
Definition: detect-engine-mpm.c:1634
MPMB_TCP_PKT_TC
@ MPMB_TCP_PKT_TC
Definition: detect.h:1346
cnt
uint32_t cnt
Definition: tmqh-packetpool.h:7
DetectMpmPrepareFrameMpms
int DetectMpmPrepareFrameMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
Definition: detect-engine-mpm.c:513
DetectEngineFrameMpmRegister
void DetectEngineFrameMpmRegister(DetectEngineCtx *de_ctx, const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), AppProto alproto, uint8_t type)
Definition: detect-engine-mpm.c:398
SignatureHasStreamContent
int SignatureHasStreamContent(const Signature *s)
check if a signature has patterns that are to be inspected against the stream payload (as opposed to ...
Definition: detect-engine-mpm.c:826
util-mpm.h
flags
uint8_t flags
Definition: decode-gre.h:0
Signature_::proto
DetectProto proto
Definition: detect.h:622
DetectBufferMpmRegistry_::type
enum DetectBufferMpmType type
Definition: detect.h:695
MpmStoreInit
int MpmStoreInit(DetectEngineCtx *de_ctx)
Initializes the MpmStore mpm hash table to be used by the detection engine context.
Definition: detect-engine-mpm.c:1366
DetectEngineCtx_::app_mpms_list
DetectBufferMpmRegistry * app_mpms_list
Definition: detect.h:998
suricata-common.h
MpmCtx_::pattern_cnt
uint32_t pattern_cnt
Definition: util-mpm.h:97
DETECT_BUFFER_MPM_TYPE_APP
@ DETECT_BUFFER_MPM_TYPE_APP
Definition: detect.h:680
DetectBufferTypeSupportsMpm
void DetectBufferTypeSupportsMpm(const char *name)
Definition: detect-engine.c:1074
DetectBufferInstance::list
int list
Definition: detect-engine-mpm.c:1933
HashListTableFree
void HashListTableFree(HashListTable *ht)
Definition: util-hashlist.c:88
SigGroupHeadInitData_::match_array
Signature ** match_array
Definition: detect.h:1461
DetectBufferMpmRegistry_::name
const char * name
Definition: detect.h:688
SupportFastPatternForSigMatchList
void SupportFastPatternForSigMatchList(int list_id, int priority)
Lets one add a sm list id to be searched for potential fp supported keywords later.
Definition: detect-fast-pattern.c:129
DetectEngineFrameInspectionEngine::next
struct DetectEngineFrameInspectionEngine * next
Definition: detect.h:526
SCLogPerf
#define SCLogPerf(...)
Definition: util-debug.h:230
DetectEnginePktInspectionEngine::next
struct DetectEnginePktInspectionEngine * next
Definition: detect.h:499
DetectContentData_::content
uint8_t * content
Definition: detect-content.h:94
PatternMatchDefaultMatcher
uint8_t PatternMatchDefaultMatcher(void)
Function to return the multi pattern matcher algorithm to be used by the engine, based on the mpm-alg...
Definition: detect-engine-mpm.c:854
FatalError
#define FatalError(...)
Definition: util-debug.h:502
DetectEngineCtx_::sig_list
Signature * sig_list
Definition: detect.h:851
DetectMpmPreparePktMpms
int DetectMpmPreparePktMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
Definition: detect-engine-mpm.c:680
TransformData_::transform
int transform
Definition: detect.h:404
DetectEngineBufferTypeSupportsMpm
void DetectEngineBufferTypeSupportsMpm(DetectEngineCtx *de_ctx, const char *name)
Definition: detect-engine.c:1236
util-validate.h
detect-flow.h
DetectEngineCtx_::app_mpms_list_cnt
uint32_t app_mpms_list_cnt
Definition: detect.h:997
DetectBufferTypeSupportsTransformations
void DetectBufferTypeSupportsTransformations(const char *name)
Definition: detect-engine.c:1084
MPM_PATTERN_FLAG_ENDSWITH
#define MPM_PATTERN_FLAG_ENDSWITH
Definition: util-mpm.h:140
builtin_mpms
const char * builtin_mpms[]
Definition: detect-engine-mpm.c:66
SignatureInitData_::buffers
SignatureInitDataBuffer * buffers
Definition: detect.h:593
g_skip_prefilter
int g_skip_prefilter
Definition: detect-engine-mpm.c:1072
DetectEngineCtx_::mpm_hash_table
HashListTable * mpm_hash_table
Definition: detect.h:878
MPMB_UDP_TC
@ MPMB_UDP_TC
Definition: detect.h:1350
MpmTableElmt_::DestroyCtx
void(* DestroyCtx)(struct MpmCtx_ *)
Definition: util-mpm.h:150
DetectBufferMpmRegistry_::id
int id
Definition: detect.h:694
SigMatchListSMBelongsTo
int SigMatchListSMBelongsTo(const Signature *s, const SigMatch *key_sm)
Definition: detect-parse.c:806
SCFree
#define SCFree(p)
Definition: util-mem.h:61
MPM_CTX_FACTORY_UNIQUE_CONTEXT
#define MPM_CTX_FACTORY_UNIQUE_CONTEXT
Definition: util-mpm.h:113
DetectMpmPrepareBuiltinMpms
int DetectMpmPrepareBuiltinMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for builtin buffers that are in "single or "shared" mode.
Definition: detect-engine-mpm.c:739
Signature_::id
uint32_t id
Definition: detect.h:638
DETECT_CONTENT_OFFSET
#define DETECT_CONTENT_OFFSET
Definition: detect-content.h:32
HashListTableBucket_
Definition: util-hashlist.h:28
DetectBufferMpmRegistry_::PrefilterRegisterWithListId
int(* PrefilterRegisterWithListId)(struct DetectEngineCtx_ *de_ctx, struct SigGroupHead_ *sgh, MpmCtx *mpm_ctx, const struct DetectBufferMpmRegistry_ *mpm_reg, int list_id)
Definition: detect.h:698
detect-tcphdr.h
DETECT_CONTENT_MPM
#define DETECT_CONTENT_MPM
Definition: detect-content.h:61
detect-engine-iponly.h
detect-parse.h
SignatureInitDataBuffer_::id
uint32_t id
Definition: detect.h:530
Signature_
Signature container.
Definition: detect.h:603
SigMatch_
a single match condition for a signature
Definition: detect.h:349
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
MPMB_TCP_PKT_TS
@ MPMB_TCP_PKT_TS
Definition: detect.h:1345
mpm_table
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
Definition: util-mpm.c:47
app-layer-protos.h
DetectMpmInitializeAppMpms
void DetectMpmInitializeAppMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:236
DetectEngineTransforms::cnt
int cnt
Definition: detect.h:410
suricata.h
DetectEngineCtx_::sig_array
Signature ** sig_array
Definition: detect.h:860
DETECT_BUFFER_MPM_TYPE_SIZE
@ DETECT_BUFFER_MPM_TYPE_SIZE
Definition: detect.h:683
DetectContentData_::content_len
uint16_t content_len
Definition: detect-content.h:95
DetectBufferInstance::tc
struct SidsArray tc
Definition: detect-engine-mpm.c:1937
DetectEngineCtx_::buffer_type_id
uint32_t buffer_type_id
Definition: detect.h:995
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:845
MpmCtx_
Definition: util-mpm.h:88
SGH_PROTO
#define SGH_PROTO(sgh, p)
Definition: detect-engine-mpm.c:1004
DETECT_CONTENT_REPLACE
#define DETECT_CONTENT_REPLACE
Definition: detect-content.h:51
util-misc.h
DetectBufferMpmRegistry_::frame_v1
struct DetectBufferMpmRegistry_::@84::@88 frame_v1
flow.h
MpmCtx_::flags
uint8_t flags
Definition: util-mpm.h:92
DetectPktMpmRegisterByParentId
void DetectPktMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Definition: detect-engine-mpm.c:590
DETECT_CONTENT_FAST_PATTERN
#define DETECT_CONTENT_FAST_PATTERN
Definition: detect-content.h:34
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
DetectFrameMpmRegister
void DetectFrameMpmRegister(const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), AppProto alproto, uint8_t type)
register a MPM engine
Definition: detect-engine-mpm.c:311
util-enum.h
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275
DetectBufferInstance
struct DetectBufferInstance DetectBufferInstance
SidsArray::active
bool active
Definition: detect-engine-mpm.c:1771
SignatureInitData_::buffer_index
uint32_t buffer_index
Definition: detect.h:594
MpmAddPatternCI
int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:259
flow-var.h
SCMemcmp
#define SCMemcmp(a, b, c)
Definition: util-memcmp.h:290
DetectMpmPrepareAppMpms
int DetectMpmPrepareAppMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
Definition: detect-engine-mpm.c:286
DetectEngineCtx_::fp_support_smlist_list
SCFPSupportSMList * fp_support_smlist_list
Definition: detect.h:1020
MpmStore_::sgh_mpm_context
int32_t sgh_mpm_context
Definition: detect.h:1362
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
SIG_FLAG_PREFILTER
#define SIG_FLAG_PREFILTER
Definition: detect.h:274
PatternMatchThreadDestroy
void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
Definition: detect-engine-mpm.c:906
MpmStore_::buffer
enum MpmBuiltinBuffers buffer
Definition: detect.h:1360
RetrieveFPForSig
void RetrieveFPForSig(const DetectEngineCtx *de_ctx, Signature *s)
Definition: detect-engine-mpm.c:1074
StringHashDjb2
uint32_t StringHashDjb2(const uint8_t *data, uint32_t datalen)
Definition: util-hash-string.c:22
PrefilterPktStreamRegister
int PrefilterPktStreamRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx)
Definition: detect-engine-payload.c:109
DETECT_CONTENT_OFFSET_VAR
#define DETECT_CONTENT_OFFSET_VAR
Definition: detect-content.h:45
SigGroupHeadInitData_::frame_mpms
MpmCtx ** frame_mpms
Definition: detect.h:1450
DetectBufferMpmRegistry_::pname
char pname[32]
Definition: detect.h:689
SIG_FLAG_REQUIRE_PACKET
#define SIG_FLAG_REQUIRE_PACKET
Definition: detect.h:250
DetectEngineFrameInspectionEngine::smd
SigMatchData * smd
Definition: detect.h:525