Go to the documentation of this file.
67 "toserver TCP packet",
68 "toclient TCP packet",
69 "toserver TCP stream",
70 "toclient TCP stream",
71 "toserver UDP packet",
72 "toclient UDP packet",
89 static void RegisterInternal(
const char *
name,
int direction,
int priority,
94 SCLogDebug(
"registering %s/%d/%d/%p/%p/%u/%d",
name, direction, priority,
95 PrefilterRegister, GetData, alproto, tx_min_progress);
97 BUG_ON(tx_min_progress >= 48);
111 RegisterInternal(
name, direction, priority, PrefilterRegister, GetData, GetDataSingle,
120 am->
sm_list = (int16_t)sm_list;
126 if (GetData != NULL) {
127 am->
app_v2.GetData = GetData;
128 }
else if (GetDataSingle != NULL) {
129 am->
app_v2.GetDataSingle = GetDataSingle;
130 }
else if (GetMultiData != NULL) {
131 am->
app_v2.GetMultiData = GetMultiData;
133 am->
app_v2.alproto = alproto;
134 am->
app_v2.tx_min_progress = tx_min_progress;
140 while (t->
next != NULL) {
154 AppProto alproto,
int tx_min_progress)
156 RegisterInternal(
name, direction, priority, PrefilterRegister, GetData, NULL, NULL, alproto,
162 AppProto alproto,
int tx_min_progress)
164 RegisterInternal(
name, direction, priority, PrefilterRegister, NULL, GetData, NULL, alproto,
170 AppProto alproto,
int tx_min_progress)
172 RegisterInternal(
name, direction, priority, PrefilterRegister, NULL, NULL, GetData, alproto,
179 static void BuildBasicPname(
char *out,
const size_t out_size,
const char *
name,
const uint16_t
id)
192 size_t name_space = out_size - (id_space + 1);
193 char pname[name_space];
194 if (strlen(
name) >= name_space) {
199 snprintf(out, out_size,
"%s#%u", pname,
id);
207 static void AppendTransformsToPname(
210 if (transforms == NULL || transforms->
cnt == 0)
213 ssize_t left = (ssize_t)out_size - (ssize_t)strlen(out) - (ssize_t)4;
219 char xforms[left + 1];
220 memset(xforms, 0, left + 1);
221 for (
int i = 0; i < transforms->
cnt; i++) {
223 (void)snprintf(ttstr,
sizeof(ttstr),
"%s,",
225 strlcat(xforms, ttstr,
sizeof(xforms));
227 if (strlen(xforms) == 0)
229 xforms[strlen(xforms) - 1] =
'\0';
230 SCLogDebug(
"left %d '%s' %d", (
int)left, xforms, (
int)strlen(xforms));
232 char xforms_print[out_size];
233 if ((
size_t)left >= strlen(xforms)) {
234 snprintf(xforms_print,
sizeof(xforms_print),
" (%s)", xforms);
236 char xforms_short[out_size];
238 snprintf(xforms_print,
sizeof(xforms_print),
" (%s)", xforms_short);
240 strlcat(out, xforms_print, out_size);
246 const int id,
const int parent_id,
249 SCLogDebug(
"registering %d/%d",
id, parent_id);
272 BuildBasicPname(am->
pname,
sizeof(am->
pname), am->
name, (uint16_t)
id);
274 memcpy(&am->
transforms, transforms,
sizeof(*transforms));
275 AppendTransformsToPname(am->
pname,
sizeof(am->
pname), transforms);
282 SCLogDebug(
"copied mpm registration for %s id %u "
283 "with parent %u and GetData %p",
295 while (list != NULL) {
315 char confstring[256] =
"detect.mpm.";
317 strlcat(confstring,
".shared",
sizeof(confstring));
351 if (mpm_ctx != NULL) {
371 SCLogDebug(
"registering %s/%d/%p/%s/%u",
name, priority, PrefilterRegister,
378 if (sm_list < 0 || sm_list > UINT16_MAX) {
386 am->
sm_list = (uint16_t)sm_list;
401 while (t->
next != NULL) {
417 SCLogDebug(
"registering %d/%d",
id, parent_id);
437 BuildBasicPname(am->
pname,
sizeof(am->
pname), am->
name, (uint16_t)
id);
439 memcpy(&am->
transforms, transforms,
sizeof(*transforms));
440 AppendTransformsToPname(am->
pname,
sizeof(am->
pname), transforms);
446 SCLogDebug(
"copied mpm registration for %s id %u "
448 t->
name,
id, parent_id);
461 SCLogDebug(
"registering %s/%d/%p/%s/%u",
name, priority, PrefilterRegister,
465 if (sm_list < 0 || sm_list > UINT16_MAX) {
477 am->
sm_list = (uint16_t)sm_list;
492 if (
SCConfGetBool(
"detect.mpm.frame.shared", &confshared) == 1)
506 while (t->
next != NULL) {
521 while (list != NULL) {
532 while (t->
next != NULL) {
544 char confstring[256] =
"detect.mpm.";
546 strlcat(confstring,
".shared",
sizeof(confstring));
582 if (mpm_ctx != NULL) {
604 PrefilterRegister, GetData);
621 am->
sm_list = (uint16_t)sm_list;
626 am->
pkt_v1.GetData = GetData;
632 while (t->
next != NULL) {
646 const int id,
const int parent_id,
649 SCLogDebug(
"registering %d/%d",
id, parent_id);
667 BuildBasicPname(am->
pname,
sizeof(am->
pname), am->
name, (uint16_t)
id);
669 memcpy(&am->
transforms, transforms,
sizeof(*transforms));
670 AppendTransformsToPname(am->
pname,
sizeof(am->
pname), transforms);
676 SCLogDebug(
"copied mpm registration for %s id %u "
677 "with parent %u and GetData %p",
688 while (list != NULL) {
699 while (t->
next != NULL) {
711 char confstring[256] =
"detect.mpm.";
713 strlcat(confstring,
".shared",
sizeof(confstring));
747 if (mpm_ctx != NULL) {
766 char confstring[256] =
"detect.mpm.";
768 strlcat(confstring,
".shared",
sizeof(confstring));
857 if (!(s->
proto.
proto[IPPROTO_TCP / 8] & 1 << (IPPROTO_TCP % 8))) {
887 if (!(s->
proto.
proto[IPPROTO_TCP / 8] & 1 << (IPPROTO_TCP % 8))) {
913 const char *mpm_algo;
917 if ((
SCConfGet(
"mpm-algo", &mpm_algo)) == 1) {
918 if (mpm_algo != NULL) {
919 #if __BYTE_ORDER == __BIG_ENDIAN
920 if (strcmp(mpm_algo,
"ac-ks") == 0) {
922 "not work on big endian systems at this time.");
925 if (strcmp(
"auto", mpm_algo) == 0) {
927 }
else if (strcmp(
"ac-bs", mpm_algo) == 0) {
928 SCLogWarning(
"mpm-algo \"ac-bs\" has been removed. See ticket #6586.");
941 #ifndef BUILD_HYPERSCAN
942 if ((strcmp(mpm_algo,
"hs") == 0)) {
943 FatalError(
"Hyperscan (hs) support for mpm-algo is "
944 "not compiled into Suricata.");
949 "in the yaml conf file: \"%s\"",
959 SCLogDebug(
"mpm_ctx %p, mpm_matcher %"PRIu16
"", mpm_ctx, mpm_matcher);
965 SCLogDebug(
"mpm_thread_ctx %p, mpm_matcher %"PRIu16
"", mpm_thread_ctx, mpm_matcher);
970 SCLogDebug(
"mpm_thread_ctx %p, type %"PRIu16, mpm_thread_ctx, mpm_matcher);
990 memset(&a, 0 ,
sizeof(a));
994 for (u = 0; u < patlen; u++) {
995 if (a[pat[u]] == 0) {
998 else if (isprint(pat[u]) || pat[u] == 0x00 || pat[u] == 0x01 || pat[u] == 0xFF)
1015 uint16_t pat_offset = cd->
offset;
1016 uint16_t pat_depth = cd->
depth;
1019 if (chop && (pat_depth || pat_offset)) {
1031 pat_depth = pat_offset = 0;
1053 #define SGH_PROTO(sgh, p) ((sgh)->init->protos[(p)] == 1)
1054 #define SGH_DIRECTION_TS(sgh) ((sgh)->init->direction & SIG_FLAG_TOSERVER)
1055 #define SGH_DIRECTION_TC(sgh) ((sgh)->init->direction & SIG_FLAG_TOCLIENT)
1059 if (s == NULL || mpm_sm == NULL)
1085 uint16_t max_len,
bool skip_negated_content)
1100 if (mpm_sm == NULL) {
1109 }
else if (ls == ss) {
1128 for (; app != NULL; app = app->
next) {
1131 if (app->
dir == 1) {
1152 int pos_sm_list[nlists];
1153 int neg_sm_list[nlists];
1154 memset(pos_sm_list, 0, nlists *
sizeof(
int));
1155 memset(neg_sm_list, 0, nlists *
sizeof(
int));
1156 int pos_sm_list_cnt = 0;
1157 int neg_sm_list_cnt = 0;
1206 SetMpm(s, sm, list_id);
1211 neg_sm_list[list_id] = 1;
1214 pos_sm_list[list_id] = 1;
1222 SCLogDebug(
"neg_sm_list_cnt %d pos_sm_list_cnt %d", neg_sm_list_cnt, pos_sm_list_cnt);
1225 int *curr_sm_list = NULL;
1226 int skip_negated_content = 1;
1227 if (pos_sm_list_cnt > 0) {
1228 curr_sm_list = pos_sm_list;
1229 }
else if (neg_sm_list_cnt > 0) {
1230 curr_sm_list = neg_sm_list;
1231 skip_negated_content = 0;
1236 int final_sm_list[nlists];
1237 memset(&final_sm_list, 0, (nlists *
sizeof(
int)));
1239 int count_final_sm_list = 0;
1240 int count_txbidir_toclient_sm_list = 0;
1244 while (tmp != NULL) {
1246 tmp != NULL && priority == tmp->
priority;
1252 if (curr_sm_list[tmp->
list_id] == 0)
1257 if (count_final_sm_list == 0) {
1259 final_sm_list[count_txbidir_toclient_sm_list++] = tmp->
list_id;
1265 final_sm_list[count_final_sm_list++] = tmp->
list_id;
1268 if (count_final_sm_list != 0)
1274 count_final_sm_list = count_txbidir_toclient_sm_list;
1276 BUG_ON(count_final_sm_list == 0);
1277 SCLogDebug(
"count_final_sm_list %d skip_negated_content %d", count_final_sm_list,
1278 skip_negated_content);
1280 uint16_t max_len = 0;
1281 for (
int i = 0; i < count_final_sm_list; i++) {
1282 SCLogDebug(
"i %d final_sm_list[i] %d", i, final_sm_list[i]);
1305 if (final_sm_list[i] == list_id) {
1326 int mpm_sm_list = -1;
1327 for (
int i = 0; i < count_final_sm_list; i++) {
1333 skip_negated_content);
1334 if (mpm_sm != prev_mpm_sm) {
1335 mpm_sm_list = final_sm_list[i];
1342 if (final_sm_list[i] == list_id) {
1348 skip_negated_content);
1350 if (mpm_sm != prev_mpm_sm) {
1351 mpm_sm_list = list_id;
1359 if (mpm_sm != NULL) {
1360 BUG_ON(mpm_sm_list == -1);
1362 BUG_ON(check_list != mpm_sm_list);
1366 SetMpm(s, mpm_sm, mpm_sm_list);
1378 static uint32_t MpmStoreHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
1400 static char MpmStoreCompareFunc(
void *data1, uint16_t len1,
void *data2,
1430 static void MpmStoreFreeFunc(
void *ptr)
1460 MpmStoreCompareFunc,
1505 while (am != NULL) {
1513 while (am != NULL) {
1528 uint32_t appstats[app_mpms_cnt + 1];
1529 memset(&appstats, 0x00,
sizeof(appstats));
1531 uint32_t pktstats[pkt_mpms_cnt + 1];
1532 memset(&pktstats, 0x00,
sizeof(pktstats));
1534 uint32_t framestats[frame_mpms_cnt + 1];
1535 memset(&framestats, 0x00,
sizeof(framestats));
1542 if (ms == NULL || ms->
mpm_ctx == NULL) {
1552 SCLogDebug(
"%s: %u patterns. Min %u, Max %u. Ctx %p",
1560 SCLogDebug(
"%s %s %s: %u patterns. Min %u, Max %u. Ctx %p",
1581 for (
int x = 0; x <
MPMB_MAX; x++) {
1585 while (am != NULL) {
1586 if (appstats[am->
sm_list] > 0) {
1589 SCLogPerf(
"AppLayer MPM \"%s %s (%s)\": %u", direction,
name,
1595 while (pm != NULL) {
1596 if (pktstats[pm->
sm_list] > 0) {
1603 while (um != NULL) {
1604 if (framestats[um->
sm_list] > 0) {
1673 const bool mpm_supports_endswith =
1678 if (ms->
sid_array[sig / 8] & (1 << (sig % 8))) {
1698 SCLogDebug(
"not adding negated mpm as it's not 'single'");
1735 uint8_t sids_array[max_sid];
1736 memset(sids_array, 0x00, max_sid);
1737 int sgh_mpm_context = 0;
1802 sids_array[s->
iid / 8] |= 1 << (s->
iid % 8);
1810 sids_array[s->
iid / 8] |= 1 << (s->
iid % 8);
1816 sids_array[s->
iid / 8] |= 1 << (s->
iid % 8);
1820 sids_array[s->
iid / 8] |= 1 << (s->
iid % 8);
1831 MpmStore lookup = { sids_array, max_sid, direction, buf, sm_list, 0, 0, NULL };
1834 if (result == NULL) {
1838 uint8_t *sids =
SCCalloc(1, max_sid);
1844 memcpy(sids, sids_array, max_sid);
1852 MpmStoreSetup(
de_ctx, copy);
1853 MpmStoreAdd(
de_ctx, copy);
1880 0, am->
app_v2.alproto, NULL };
1885 if (result == NULL) {
1907 MpmStoreSetup(
de_ctx, copy);
1908 MpmStoreAdd(
de_ctx, copy);
1931 if (result == NULL) {
1951 MpmStoreSetup(
de_ctx, copy);
1952 MpmStoreAdd(
de_ctx, copy);
1974 if (result == NULL) {
1995 MpmStoreSetup(
de_ctx, copy);
1996 MpmStoreAdd(
de_ctx, copy);
2017 SCLogDebug(
"rule group %p has SIG_GROUP_HEAD_HAVERAWSTREAM set", sgh);
2021 SCLogDebug(
"rule group %p does NOT have SIG_GROUP_HEAD_HAVERAWSTREAM set", sgh);
2033 static uint32_t DetectBufferInstanceHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
2040 static char DetectBufferInstanceCompareFunc(
void *data1, uint16_t len1,
void *data2, uint16_t len2)
2047 static void DetectBufferInstanceFreeFunc(
void *ptr)
2059 return HashListTableInit(4096, DetectBufferInstanceHashFunc, DetectBufferInstanceCompareFunc,
2060 DetectBufferInstanceFreeFunc);
2072 memset(engines, 0,
sizeof(engines));
2073 int engines_idx[max_buffer_id];
2074 memset(engines_idx, 0,
sizeof(engines_idx));
2075 int types[max_buffer_id];
2076 memset(types, 0,
sizeof(types));
2080 types[a->sm_list] = a->type;
2084 if (instance == NULL) {
2085 instance =
SCCalloc(1,
sizeof(*instance));
2086 BUG_ON(instance == NULL);
2087 instance->
list = a->sm_list;
2097 if (add_ts || add_tc) {
2098 types[a->sm_list] = a->type;
2099 engines[a->sm_list][engines_idx[a->sm_list]++] = a->frame_v1.alproto;
2103 if (instance == NULL) {
2104 instance =
SCCalloc(1,
sizeof(*instance));
2105 BUG_ON(instance == NULL);
2106 instance->
list = a->sm_list;
2107 instance->
alproto = a->frame_v1.alproto;
2117 if (add_ts || add_tc) {
2118 types[a->sm_list] = a->type;
2119 engines[a->sm_list][engines_idx[a->sm_list]++] = a->app_v2.alproto;
2123 if (instance == NULL) {
2124 instance =
SCCalloc(1,
sizeof(*instance));
2125 BUG_ON(instance == NULL);
2126 instance->
list = a->sm_list;
2127 instance->
alproto = a->app_v2.alproto;
2135 for (uint32_t sig = 0; sig < sh->
init->
sig_cnt; sig++) {
2147 switch (types[list]) {
2151 for (
int e = 0; e < engines_idx[list]; e++) {
2152 const AppProto alproto = engines[list][e];
2158 if (instance == NULL)
2191 if (instance == NULL)
2221 if (instance == NULL) {
2228 MpmStore *mpm_store = MpmStorePrepareBufferPkt(
de_ctx, sh, a, sa);
2229 if (mpm_store != NULL) {
2232 SCLogDebug(
"a %p a->name %s a->reg->PrefilterRegisterWithListId %p "
2233 "mpm_store->mpm_ctx %p", a, a->name,
2234 a->PrefilterRegisterWithListId, mpm_store->
mpm_ctx);
2238 if (a->PrefilterRegisterWithListId && mpm_store->
mpm_ctx) {
2241 a, a->sm_list) != 0);
2242 SCLogDebug(
"mpm %s %d set up", a->name, a->sm_list);
2251 if (instance == NULL) {
2259 SCLogDebug(
"a %s direction %d PrefilterRegisterWithListId %p", a->name, a->direction,
2260 a->PrefilterRegisterWithListId);
2261 MpmStore *mpm_store = MpmStorePrepareBufferFrame(
de_ctx, sh, a, sa);
2262 if (mpm_store != NULL) {
2265 SCLogDebug(
"a %p a->name %s a->reg->PrefilterRegisterWithListId %p "
2266 "mpm_store->mpm_ctx %p",
2267 a, a->name, a->PrefilterRegisterWithListId, mpm_store->
mpm_ctx);
2272 if (a->PrefilterRegisterWithListId && mpm_store->
mpm_ctx) {
2273 BUG_ON(a->PrefilterRegisterWithListId(
2275 SCLogDebug(
"mpm %s %d set up", a->name, a->sm_list);
2286 if (instance == NULL) {
2294 MpmStore *mpm_store = MpmStorePrepareBufferAppLayer(
de_ctx, sh, a, sa);
2295 if (mpm_store != NULL) {
2298 SCLogDebug(
"a %p a->name %s a->PrefilterRegisterWithListId %p "
2299 "mpm_store->mpm_ctx %p",
2300 a, a->name, a->PrefilterRegisterWithListId, mpm_store->
mpm_ctx);
2304 if (a->PrefilterRegisterWithListId && mpm_store->
mpm_ctx) {
2305 BUG_ON(a->PrefilterRegisterWithListId(
2307 SCLogDebug(
"mpm %s %d set up", a->name, a->sm_list);
2324 if (mpm_store != NULL) {
2329 if (mpm_store != NULL) {
2333 SetRawReassemblyFlag(
de_ctx, sh);
2337 if (mpm_store != NULL) {
2342 if (mpm_store != NULL) {
2346 SetRawReassemblyFlag(
de_ctx, sh);
2348 }
else if (
SGH_PROTO(sh, IPPROTO_UDP)) {
2351 if (mpm_store != NULL) {
2357 if (mpm_store != NULL) {
2363 if (mpm_store != NULL) {
2387 static uint32_t PatternChopHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
2390 uint32_t hash = p->
sm_list + ContentFlagsForHash(p->
cd);
2392 const uint8_t *content = p->
cd->
content;
2410 static uint32_t PatternNoChopHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
2413 uint32_t hash = p->
sm_list + ContentFlagsForHash(p->
cd);
2429 static char PatternChopCompareFunc(
void *data1, uint16_t len1,
void *data2, uint16_t len2)
2437 if (ContentFlagsForHash(p1->
cd) != ContentFlagsForHash(p2->
cd))
2453 if (p1_content_len != p2_content_len)
2456 if (memcmp(p1_content, p2_content, p1_content_len) != 0) {
2474 static char PatternNoChopCompareFunc(
void *data1, uint16_t len1,
void *data2, uint16_t len2)
2482 if (ContentFlagsForHash(p1->
cd) != ContentFlagsForHash(p2->
cd))
2495 static void PatternFreeFunc(
void *ptr)
2522 HashListTableInit(4096, PatternChopHashFunc, PatternChopCompareFunc, PatternFreeFunc);
2553 SCLogDebug(
"%u: add id %u cnt %u", s->
id, add->cd->id, add->cnt);
2570 4096, PatternNoChopHashFunc, PatternNoChopCompareFunc, PatternFreeFunc);
2576 switch (smd->
type) {
2606 for (; app != NULL; app = app->
next) {
2609 switch (smd->
type) {
2614 .
cd = cd, .sm_list = app->
sm_list, .cnt = 0, .mpm = 0
2639 for (; pkt != NULL; pkt = pkt->
next) {
2646 switch (smd->
type) {
2651 .
cd = cd, .sm_list = pkt->
sm_list, .cnt = 0, .mpm = 0
2676 for (; frame != NULL; frame = frame->
next) {
2683 switch (smd->
type) {
2688 .
cd = cd, .sm_list = frame->
sm_list, .cnt = 0, .mpm = 0
void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t matcher)
#define DETECT_CONTENT_NOCASE
int SignatureHasPacketContent(const Signature *s)
check if a signature has patterns that are to be inspected against a packets payload (as opposed to t...
uint32_t pkt_mpms_list_cnt
#define HashListTableGetListData(hb)
uint32_t frame_mpms_list_cnt
uint32_t max_content_list_id
int PrefilterGenericMpmPktRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
void DetectAppLayerMpmMultiRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionMultiBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
#define SGH_DIRECTION_TC(sgh)
#define DETECT_CONTENT_FAST_PATTERN_CHOP
struct SigMatch_ * smlists[DETECT_SM_LIST_MAX]
void PatternMatchDestroy(MpmCtx *mpm_ctx, uint16_t mpm_matcher)
SigTableElmt * sigmatch_table
int32_t sgh_mpm_context_proto_tcp_packet
int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
Prepare the pattern matcher ctx in a sig group head.
struct SCFPSupportSMList_ * next
struct DetectEngineAppInspectionEngine_ * next
void MpmStoreFree(DetectEngineCtx *de_ctx)
Frees the hash table - DetectEngineCtx->mpm_hash_table, allocated by MpmStoreInit() function.
void DetectFrameMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Container for matching data for a signature group.
HashListTable * pattern_hash_table
void MpmFactoryReClaimMpmCtx(const DetectEngineCtx *de_ctx, MpmCtx *mpm_ctx)
void MpmStoreReportStats(const DetectEngineCtx *de_ctx)
void DetectPktMpmRegister(const char *name, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), InspectionBufferGetPktDataPtr GetData)
register a MPM engine
void DetectBufferTypeSupportsFrames(const char *name)
void DetectMpmInitializeFrameMpms(DetectEngineCtx *de_ctx)
@ DETECT_SM_LIST_DYNAMIC_START
#define DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED
uint32_t PatternStrength(uint8_t *pat, uint16_t patlen)
Predict a strength value for patterns.
DetectBufferMpmRegistry * pkt_mpms_list
@ DETECT_BUFFER_MPM_TYPE_FRAME
int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx)
Figure out the FP and their respective content ids for all the sigs in the engine.
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
main detection engine ctx
int SCConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
#define DETECT_CONTENT_MPM_IS_CONCLUSIVE(c)
HashListTableBucket * HashListTableGetListHead(HashListTable *ht)
#define DETECT_CONTENT_DEPTH_VAR
@ ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE
InspectionBuffer *(* InspectionBufferGetPktDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Packet *p, const int list_id)
const char * DetectEngineBufferTypeGetNameById(const DetectEngineCtx *de_ctx, const int id)
void DetectMpmInitializeBuiltinMpms(DetectEngineCtx *de_ctx)
struct DetectBufferMpmRegistry_ * next
#define SIG_FLAG_REQUIRE_STREAM
#define SIG_FLAG_TXBOTHDIR
int SCConfGetBool(const char *name, int *val)
Retrieve a configuration value as a boolean.
one time registration of keywords at start up
const struct DetectContentData_ * cd
#define SIG_GROUP_HEAD_HAVERAWSTREAM
uint8_t mpm_default_matcher
SigMatchData * sm_arrays[DETECT_SM_LIST_MAX]
void * HashListTableLookup(HashListTable *ht, void *data, uint16_t datalen)
#define SIG_FLAG_TOCLIENT
int32_t sgh_mpm_context_proto_udp_packet
DetectEngineTransforms transforms
void ShortenString(const char *input, char *output, size_t output_size, char c)
void DetectEngineRegisterFastPatternForId(DetectEngineCtx *de_ctx, int list_id, int priority)
void EngineAnalysisAddAllRulePatterns(DetectEngineCtx *de_ctx, const Signature *s)
add all patterns on our stats hash Used to fill the hash later used by DumpPatterns()
DetectEngineFrameInspectionEngine * frame_inspect
const char * cache_dir_path
int DetectBufferTypeGetByName(const char *name)
int HashListTableAdd(HashListTable *ht, void *data, uint16_t datalen)
size_t strlcpy(char *dst, const char *src, size_t siz)
void DetectAppLayerMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
void MpmInitCtx(MpmCtx *mpm_ctx, uint8_t matcher)
int32_t sgh_mpm_context_proto_other_packet
#define HashListTableGetListNext(hb)
#define SIG_FLAG_TOSERVER
HashListTable * HashListTableInit(uint32_t size, uint32_t(*Hash)(struct HashListTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
void MpmDestroyThreadCtx(MpmThreadCtx *mpm_thread_ctx, const uint16_t matcher)
#define DETECT_CONTENT_ENDS_WITH
MpmCtx * MpmFactoryGetMpmCtxForProfile(const DetectEngineCtx *de_ctx, int32_t id, int direction)
void DetectMpmInitializePktMpms(DetectEngineCtx *de_ctx)
#define MPM_PATTERN_CTX_OWNS_ID
size_t strlcat(char *, const char *src, size_t siz)
#define DetectEngineGetMaxSigId(de_ctx)
int SCMpmAddPatternCI(MpmCtx *mpm_ctx, const uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
#define DETECT_CONTENT_DEPTH
DetectEnginePktInspectionEngine * pkt_inspect
bool(* InspectionSingleBufferGetDataPtr)(const void *txv, const uint8_t flow_flags, const uint8_t **buf, uint32_t *buf_len)
#define DETECT_CONTENT_IS_SINGLE(c)
#define DETECT_CONTENT_NEGATED
int PrefilterGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
void PatternMatchThreadPrepare(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
#define SCLogWarning(...)
Macro used to log WARNING messages.
int DetectEngineBufferTypeRegister(DetectEngineCtx *de_ctx, const char *name)
SigGroupHeadInitData * init
void DetectAppLayerMpmRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
register an app layer keyword for mpm
DetectEngineAppInspectionEngine * app_inspect
bool DetectBufferToClient(const DetectEngineCtx *de_ctx, int buf_id, AppProto alproto)
#define MPMCTX_FLAGS_GLOBAL
int(* PrefilterRegisterFunc)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
int32_t MpmFactoryRegisterMpmCtxProfile(DetectEngineCtx *de_ctx, const char *name, const int sm_list, const AppProto alproto)
Register a new Mpm Context.
int32_t sgh_mpm_context_stream
void DetectEngineBufferTypeSupportsFrames(DetectEngineCtx *de_ctx, const char *name)
DetectBufferMpmRegistry * frame_mpms_list
int PrefilterPktPayloadRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx)
@ DETECT_BUFFER_MPM_TYPE_PKT
SignatureInitData * init_data
int FastPatternSupportEnabledForSigMatchList(const DetectEngineCtx *de_ctx, const int list_id)
Checks if a particular buffer is in the list of lists that need to be searched for a keyword that has...
enum DetectBufferMpmType type
int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
void DetectEngineBufferTypeSupportsTransformations(DetectEngineCtx *de_ctx, const char *name)
bool(* InspectionMultiBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const void *txv, const uint8_t flow_flags, uint32_t local_id, const uint8_t **buf, uint32_t *buf_len)
#define SGH_DIRECTION_TS(sgh)
#define MPM_FEATURE_FLAG_ENDSWITH
struct DetectBufferMpmRegistry_::@96::@100 frame_v1
MpmStore * MpmStorePrepareBuffer(DetectEngineCtx *de_ctx, SigGroupHead *sgh, enum MpmBuiltinBuffers buf)
Get MpmStore for a built-in buffer type.
int DetectMpmPrepareFrameMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
void DetectEngineFrameMpmRegister(DetectEngineCtx *de_ctx, const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), AppProto alproto, uint8_t type)
int SignatureHasStreamContent(const Signature *s)
check if a signature has patterns that are to be inspected against the stream payload (as opposed to ...
enum DetectBufferMpmType type
int MpmStoreInit(DetectEngineCtx *de_ctx)
Initializes the MpmStore mpm hash table to be used by the detection engine context.
void DetectAppLayerMpmRegisterSingle(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionSingleBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
DetectBufferMpmRegistry * app_mpms_list
@ DETECT_BUFFER_MPM_TYPE_APP
void DetectBufferTypeSupportsMpm(const char *name)
void HashListTableFree(HashListTable *ht)
void SupportFastPatternForSigMatchList(int list_id, int priority)
Lets one add a sm list id to be searched for potential fp supported keywords later.
struct DetectEngineFrameInspectionEngine * next
struct DetectEnginePktInspectionEngine * next
struct DetectBufferMpmRegistry_::@96::@98 app_v2
uint8_t PatternMatchDefaultMatcher(void)
Function to return the multi pattern matcher algorithm to be used by the engine, based on the mpm-alg...
int DetectMpmPreparePktMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
void DetectEngineBufferTypeSupportsMpm(DetectEngineCtx *de_ctx, const char *name)
uint32_t app_mpms_list_cnt
void DetectBufferTypeSupportsTransformations(const char *name)
#define MPM_PATTERN_FLAG_ENDSWITH
const char * builtin_mpms[]
SignatureInitDataBuffer * buffers
DetectEngineAppInspectionEngine * app_inspect_engines
HashListTable * mpm_hash_table
int(* Prepare)(MpmConfig *, struct MpmCtx_ *)
void(* DestroyCtx)(struct MpmCtx_ *)
int SigMatchListSMBelongsTo(const Signature *s, const SigMatch *key_sm)
#define MPM_CTX_FACTORY_UNIQUE_CONTEXT
int DetectMpmPrepareBuiltinMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for builtin buffers that are in "single or "shared" mode.
#define DETECT_CONTENT_OFFSET
int(* PrefilterRegisterWithListId)(struct DetectEngineCtx_ *de_ctx, struct SigGroupHead_ *sgh, MpmCtx *mpm_ctx, const struct DetectBufferMpmRegistry_ *mpm_reg, int list_id)
#define DETECT_CONTENT_MPM
a single match condition for a signature
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
void DetectMpmInitializeAppMpms(DetectEngineCtx *de_ctx)
InspectionBuffer *(* InspectionBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id)
@ DETECT_BUFFER_MPM_TYPE_SIZE
#define SGH_PROTO(sgh, p)
#define DETECT_CONTENT_REPLACE
void DetectPktMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
#define DETECT_CONTENT_FAST_PATTERN
#define MPMCTX_FLAGS_CACHE_TO_DISK
void DetectFrameMpmRegister(const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), AppProto alproto, uint8_t type)
register a MPM engine
struct DetectBufferInstance DetectBufferInstance
#define SCMemcmp(a, b, c)
int DetectMpmPrepareAppMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
SCFPSupportSMList * fp_support_smlist_list
#define DEBUG_VALIDATE_BUG_ON(exp)
struct DetectBufferMpmRegistry_::@96::@99 pkt_v1
void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
enum MpmBuiltinBuffers buffer
void RetrieveFPForSig(const DetectEngineCtx *de_ctx, Signature *s)
uint32_t StringHashDjb2(const uint8_t *data, uint32_t datalen)
int PrefilterPktStreamRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx)
#define DETECT_CONTENT_OFFSET_VAR
#define SIG_FLAG_REQUIRE_PACKET