suricata
detect-engine-mpm.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  *
24  * Multi pattern matcher
25  */
26 
27 #include "suricata.h"
28 #include "suricata-common.h"
29 
30 #include "app-layer-protos.h"
31 
32 #include "decode.h"
33 #include "detect.h"
34 #include "detect-engine.h"
35 #include "detect-engine-siggroup.h"
36 #include "detect-engine-mpm.h"
37 #include "detect-engine-iponly.h"
38 #include "detect-parse.h"
40 #include "util-mpm.h"
41 #include "util-memcmp.h"
42 #include "util-memcpy.h"
43 #include "conf.h"
44 #include "detect-fast-pattern.h"
45 
46 #include "detect-tcphdr.h"
47 #include "detect-udphdr.h"
48 
49 #include "flow.h"
50 #include "flow-var.h"
51 #include "detect-flow.h"
52 
53 #include "detect-content.h"
54 
55 #include "detect-engine-payload.h"
56 
57 #include "stream.h"
58 
59 #include "util-misc.h"
60 #include "util-enum.h"
61 #include "util-debug.h"
62 #include "util-print.h"
63 #include "util-validate.h"
64 #include "util-hash-string.h"
65 
66 const char *builtin_mpms[] = {
67  "toserver TCP packet",
68  "toclient TCP packet",
69  "toserver TCP stream",
70  "toclient TCP stream",
71  "toserver UDP packet",
72  "toclient UDP packet",
73  "other IP packet",
74 
75  NULL };
76 
77 /* Registry for mpm keywords
78  *
79  * Keywords are registered at engine start up
80  */
81 
82 static DetectBufferMpmRegistry *g_mpm_list[DETECT_BUFFER_MPM_TYPE_SIZE] = { NULL, NULL, NULL };
83 static int g_mpm_list_cnt[DETECT_BUFFER_MPM_TYPE_SIZE] = { 0, 0, 0 };
84 
85 /** \brief register a MPM engine
86  *
87  * \note to be used at start up / registration only. Errors are fatal.
88  */
89 static void RegisterInternal(const char *name, int direction, int priority,
90  PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData,
92  InspectionMultiBufferGetDataPtr GetMultiData, AppProto alproto, int tx_min_progress)
93 {
94  SCLogDebug("registering %s/%d/%d/%p/%p/%u/%d", name, direction, priority,
95  PrefilterRegister, GetData, alproto, tx_min_progress);
96 
97  BUG_ON(tx_min_progress >= 48);
98 
99  // must register GetData with PrefilterGenericMpmRegister
100  BUG_ON(PrefilterRegister == PrefilterGenericMpmRegister && GetData == NULL);
101 
104  int sm_list = DetectBufferTypeGetByName(name);
105  if (sm_list == -1) {
106  FatalError("MPM engine registration for %s failed", name);
107  }
108 
109  // every HTTP2 can be accessed from DOH2
110  if (alproto == ALPROTO_HTTP2 || alproto == ALPROTO_DNS) {
111  RegisterInternal(name, direction, priority, PrefilterRegister, GetData, GetDataSingle,
112  GetMultiData, ALPROTO_DOH2, tx_min_progress);
113  }
114  DetectBufferMpmRegistry *am = SCCalloc(1, sizeof(*am));
115  BUG_ON(am == NULL);
116  am->name = name;
117  snprintf(am->pname, sizeof(am->pname), "%s", am->name);
118  am->direction = direction;
119  DEBUG_VALIDATE_BUG_ON(sm_list < 0 || sm_list > INT16_MAX);
120  am->sm_list = (int16_t)sm_list;
121  am->sm_list_base = (int16_t)sm_list;
122  am->priority = priority;
124 
125  am->PrefilterRegisterWithListId = PrefilterRegister;
126  if (GetData != NULL) {
127  am->app_v2.GetData = GetData;
128  } else if (GetDataSingle != NULL) {
129  am->app_v2.GetDataSingle = GetDataSingle;
130  } else if (GetMultiData != NULL) {
131  am->app_v2.GetMultiData = GetMultiData;
132  }
133  am->app_v2.alproto = alproto;
134  am->app_v2.tx_min_progress = tx_min_progress;
135 
136  if (g_mpm_list[DETECT_BUFFER_MPM_TYPE_APP] == NULL) {
137  g_mpm_list[DETECT_BUFFER_MPM_TYPE_APP] = am;
138  } else {
140  while (t->next != NULL) {
141  t = t->next;
142  }
143 
144  t->next = am;
145  am->id = t->id + 1;
146  }
147  g_mpm_list_cnt[DETECT_BUFFER_MPM_TYPE_APP]++;
148 
149  SupportFastPatternForSigMatchList(sm_list, priority);
150 }
151 
152 void DetectAppLayerMpmRegister(const char *name, int direction, int priority,
153  PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData,
154  AppProto alproto, int tx_min_progress)
155 {
156  RegisterInternal(name, direction, priority, PrefilterRegister, GetData, NULL, NULL, alproto,
157  tx_min_progress);
158 }
159 
160 void DetectAppLayerMpmRegisterSingle(const char *name, int direction, int priority,
161  PrefilterRegisterFunc PrefilterRegister, InspectionSingleBufferGetDataPtr GetData,
162  AppProto alproto, int tx_min_progress)
163 {
164  RegisterInternal(name, direction, priority, PrefilterRegister, NULL, GetData, NULL, alproto,
165  tx_min_progress);
166 }
167 
168 void DetectAppLayerMpmMultiRegister(const char *name, int direction, int priority,
169  PrefilterRegisterFunc PrefilterRegister, InspectionMultiBufferGetDataPtr GetData,
170  AppProto alproto, int tx_min_progress)
171 {
172  RegisterInternal(name, direction, priority, PrefilterRegister, NULL, NULL, GetData, alproto,
173  tx_min_progress);
174 }
175 
176 /** \internal
177  * \brief build basic profiling name (pname) making sure the id is always fully printed
178  */
179 static void BuildBasicPname(char *out, const size_t out_size, const char *name, const uint16_t id)
180 {
181  size_t id_space;
182  if (id < 10)
183  id_space = 1;
184  else if (id < 100)
185  id_space = 2;
186  else if (id < 1000)
187  id_space = 3;
188  else if (id < 10000)
189  id_space = 4;
190  else
191  id_space = 5;
192  size_t name_space = out_size - (id_space + 1);
193  char pname[name_space];
194  if (strlen(name) >= name_space) {
195  ShortenString(name, pname, name_space, '~');
196  } else {
197  strlcpy(pname, name, sizeof(pname));
198  }
199  snprintf(out, out_size, "%s#%u", pname, id);
200 }
201 
202 /** \internal
203  * \brief add transforms to the profiling name, as space permits
204  * \param out contains basic profiling name (pname), to be appended to
205  * \note out will be untouched if there isn't enough space left of if there are no transforms
206  */
207 static void AppendTransformsToPname(
208  char *out, const size_t out_size, const DetectEngineTransforms *transforms)
209 {
210  if (transforms == NULL || transforms->cnt == 0)
211  return;
212 
213  ssize_t left = (ssize_t)out_size - (ssize_t)strlen(out) - (ssize_t)4;
214  /* only append xform if we can add least 5 chars */
215  if (left >= 5) {
216  /* create comma separated string of the names of the
217  * transforms and then shorten it if necessary. Finally
218  * use it to construct the 'profile' name for the engine */
219  char xforms[left + 1];
220  memset(xforms, 0, left + 1);
221  for (int i = 0; i < transforms->cnt; i++) {
222  char ttstr[64];
223  (void)snprintf(ttstr, sizeof(ttstr), "%s,",
224  sigmatch_table[transforms->transforms[i].transform].name);
225  strlcat(xforms, ttstr, sizeof(xforms));
226  }
227  if (strlen(xforms) == 0)
228  return;
229  xforms[strlen(xforms) - 1] = '\0';
230  SCLogDebug("left %d '%s' %d", (int)left, xforms, (int)strlen(xforms));
231 
232  char xforms_print[out_size];
233  if ((size_t)left >= strlen(xforms)) {
234  snprintf(xforms_print, sizeof(xforms_print), " (%s)", xforms);
235  } else {
236  char xforms_short[out_size];
237  ShortenString(xforms, xforms_short, left, '~');
238  snprintf(xforms_print, sizeof(xforms_print), " (%s)", xforms_short);
239  }
240  strlcat(out, xforms_print, out_size);
241  }
242 }
243 
244 /** \brief copy a mpm engine from parent_id, add in transforms */
246  const int id, const int parent_id,
247  DetectEngineTransforms *transforms)
248 {
249  SCLogDebug("registering %d/%d", id, parent_id);
250 
252  while (t) {
253  if (t->sm_list == parent_id) {
254  DetectBufferMpmRegistry *am = SCCalloc(1, sizeof(*am));
255  BUG_ON(am == NULL);
256  am->name = t->name;
257  am->direction = t->direction;
258  DEBUG_VALIDATE_BUG_ON(id < 0 || id > INT16_MAX);
259  am->sm_list = (uint16_t)id; // use new id
260  am->sm_list_base = t->sm_list;
263  am->app_v2.GetData = t->app_v2.GetData;
264  am->app_v2.alproto = t->app_v2.alproto;
265  am->app_v2.tx_min_progress = t->app_v2.tx_min_progress;
266  am->priority = t->priority;
269  de_ctx, am->name, am->sm_list, am->app_v2.alproto);
270  am->next = t->next;
271 
272  BuildBasicPname(am->pname, sizeof(am->pname), am->name, (uint16_t)id);
273  if (transforms) {
274  memcpy(&am->transforms, transforms, sizeof(*transforms));
275  AppendTransformsToPname(am->pname, sizeof(am->pname), transforms);
276  }
277  SCLogDebug("am->pname '%s' (%u)", am->pname, (uint32_t)strlen(am->pname));
278  am->id = de_ctx->app_mpms_list_cnt++;
279 
281  t->next = am;
282  SCLogDebug("copied mpm registration for %s id %u "
283  "with parent %u and GetData %p",
284  t->name, id, parent_id, am->app_v2.GetData);
285  t = am;
286  }
287  t = t->next;
288  }
289 }
290 
292 {
293  const DetectBufferMpmRegistry *list = g_mpm_list[DETECT_BUFFER_MPM_TYPE_APP];
295  while (list != NULL) {
296  DetectBufferMpmRegistry *n = SCCalloc(1, sizeof(*n));
297  BUG_ON(n == NULL);
298 
299  *n = *list;
300  n->next = NULL;
301 
302  if (toadd == NULL) {
303  toadd = n;
304  de_ctx->app_mpms_list = n;
305  } else {
306  toadd->next = n;
307  toadd = toadd->next;
308  }
309 
310  /* default to whatever the global setting is */
312 
313  /* see if we use a unique or shared mpm ctx for this type */
314  int confshared = 0;
315  char confstring[256] = "detect.mpm.";
316  strlcat(confstring, n->name, sizeof(confstring));
317  strlcat(confstring, ".shared", sizeof(confstring));
318  if (SCConfGetBool(confstring, &confshared) == 1)
319  shared = confshared;
320 
321  if (shared == 0) {
322  SCLogDebug("using unique mpm ctx' for %s", n->name);
324  } else {
325  SCLogDebug("using shared mpm ctx' for %s", n->name);
326  n->sgh_mpm_context =
328  }
329 
330  list = list->next;
331  }
333  SCLogDebug("mpm: de_ctx app_mpms_list %p %u",
335 }
336 
337 /**
338  * \brief initialize mpm contexts for applayer buffers that are in
339  * "single or "shared" mode.
340  */
342 {
343  int r = 0;
345  while (am != NULL) {
346  int dir = (am->direction == SIG_FLAG_TOSERVER) ? 1 : 0;
347 
349  {
351  if (mpm_ctx != NULL) {
352  if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
353  r |= mpm_table[de_ctx->mpm_matcher].Prepare(de_ctx->mpm_cfg, mpm_ctx);
354  }
355  }
356  }
357  am = am->next;
358  }
359  return r;
360 }
361 
362 /** \brief register a MPM engine
363  *
364  * \note to be used at start up / registration only. Errors are fatal.
365  */
366 void DetectFrameMpmRegister(const char *name, int direction, int priority,
367  int (*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx,
368  const DetectBufferMpmRegistry *mpm_reg, int list_id),
369  AppProto alproto, uint8_t type)
370 {
371  SCLogDebug("registering %s/%d/%p/%s/%u", name, priority, PrefilterRegister,
372  AppProtoToString(alproto), type);
373 
377  int sm_list = DetectBufferTypeGetByName(name);
378  if (sm_list < 0 || sm_list > UINT16_MAX) {
379  FatalError("MPM engine registration for %s failed", name);
380  }
381 
382  DetectBufferMpmRegistry *am = SCCalloc(1, sizeof(*am));
383  BUG_ON(am == NULL);
384  am->name = name;
385  snprintf(am->pname, sizeof(am->pname), "%s", am->name);
386  am->sm_list = (uint16_t)sm_list;
387  am->direction = direction;
388  am->priority = priority;
390 
391  am->PrefilterRegisterWithListId = PrefilterRegister;
392  am->frame_v1.alproto = alproto;
393  am->frame_v1.type = type;
394  SCLogDebug("type %u", type);
395  SCLogDebug("am type %u", am->frame_v1.type);
396 
397  if (g_mpm_list[DETECT_BUFFER_MPM_TYPE_FRAME] == NULL) {
398  g_mpm_list[DETECT_BUFFER_MPM_TYPE_FRAME] = am;
399  } else {
401  while (t->next != NULL) {
402  t = t->next;
403  }
404  t->next = am;
405  am->id = t->id + 1;
406  }
407  g_mpm_list_cnt[DETECT_BUFFER_MPM_TYPE_FRAME]++;
408 
409  SupportFastPatternForSigMatchList(sm_list, priority);
410  SCLogDebug("%s/%d done", name, sm_list);
411 }
412 
413 /** \brief copy a mpm engine from parent_id, add in transforms */
414 void DetectFrameMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id,
415  DetectEngineTransforms *transforms)
416 {
417  SCLogDebug("registering %d/%d", id, parent_id);
418 
420  while (t) {
421  if (t->sm_list == parent_id) {
422  DetectBufferMpmRegistry *am = SCCalloc(1, sizeof(*am));
423  BUG_ON(am == NULL);
424  am->name = t->name;
425  DEBUG_VALIDATE_BUG_ON(id < 0 || id > UINT16_MAX);
426  am->sm_list = (uint16_t)id; // use new id
427  am->sm_list_base = t->sm_list;
430  am->frame_v1 = t->frame_v1;
431  SCLogDebug("am type %u", am->frame_v1.type);
432  am->priority = t->priority;
433  am->direction = t->direction;
435  am->next = t->next;
436 
437  BuildBasicPname(am->pname, sizeof(am->pname), am->name, (uint16_t)id);
438  if (transforms) {
439  memcpy(&am->transforms, transforms, sizeof(*transforms));
440  AppendTransformsToPname(am->pname, sizeof(am->pname), transforms);
441  }
442  am->id = de_ctx->frame_mpms_list_cnt++;
443 
445  t->next = am;
446  SCLogDebug("copied mpm registration for %s id %u "
447  "with parent %u",
448  t->name, id, parent_id);
449  t = am;
450  }
451  t = t->next;
452  }
453 }
454 
455 void DetectEngineFrameMpmRegister(DetectEngineCtx *de_ctx, const char *name, int direction,
456  int priority,
457  int (*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx,
458  const DetectBufferMpmRegistry *mpm_reg, int list_id),
459  AppProto alproto, uint8_t type)
460 {
461  SCLogDebug("registering %s/%d/%p/%s/%u", name, priority, PrefilterRegister,
462  AppProtoToString(alproto), type);
463 
464  const int sm_list = DetectEngineBufferTypeRegister(de_ctx, name);
465  if (sm_list < 0 || sm_list > UINT16_MAX) {
466  FatalError("MPM engine registration for %s failed", name);
467  }
468 
472 
473  DetectBufferMpmRegistry *am = SCCalloc(1, sizeof(*am));
474  BUG_ON(am == NULL);
475  am->name = name;
476  snprintf(am->pname, sizeof(am->pname), "%s", am->name);
477  am->sm_list = (uint16_t)sm_list;
478  am->direction = direction;
479  am->priority = priority;
481 
482  am->PrefilterRegisterWithListId = PrefilterRegister;
483  am->frame_v1.alproto = alproto;
484  am->frame_v1.type = type;
485 
486  // TODO is it ok to do this here?
487 
488  /* default to whatever the global setting is */
490  /* see if we use a unique or shared mpm ctx for this type */
491  int confshared = 0;
492  if (SCConfGetBool("detect.mpm.frame.shared", &confshared) == 1)
493  shared = confshared;
494 
495  if (shared == 0) {
497  } else {
498  am->sgh_mpm_context =
500  }
501 
502  if (de_ctx->frame_mpms_list == NULL) {
503  de_ctx->frame_mpms_list = am;
504  } else {
506  while (t->next != NULL) {
507  t = t->next;
508  }
509 
510  t->next = am;
511  }
513 
514  DetectEngineRegisterFastPatternForId(de_ctx, sm_list, priority);
515  SCLogDebug("%s/%d done", name, sm_list);
516 }
517 
519 {
520  const DetectBufferMpmRegistry *list = g_mpm_list[DETECT_BUFFER_MPM_TYPE_FRAME];
521  while (list != NULL) {
522  DetectBufferMpmRegistry *n = SCCalloc(1, sizeof(*n));
523  BUG_ON(n == NULL);
524 
525  *n = *list;
526  n->next = NULL;
527 
528  if (de_ctx->frame_mpms_list == NULL) {
529  de_ctx->frame_mpms_list = n;
530  } else {
532  while (t->next != NULL) {
533  t = t->next;
534  }
535 
536  t->next = n;
537  }
538 
539  /* default to whatever the global setting is */
541 
542  /* see if we use a unique or shared mpm ctx for this type */
543  int confshared = 0;
544  char confstring[256] = "detect.mpm.";
545  strlcat(confstring, n->name, sizeof(confstring));
546  strlcat(confstring, ".shared", sizeof(confstring));
547  if (SCConfGetBool(confstring, &confshared) == 1)
548  shared = confshared;
549 
550  if (shared == 0) {
551  SCLogDebug("using unique mpm ctx' for %s", n->name);
553  } else {
554  SCLogDebug("using shared mpm ctx' for %s", n->name);
556  de_ctx, n->name, n->sm_list, n->frame_v1.alproto);
557  }
558 
559  list = list->next;
560  }
562  SCLogDebug("mpm: de_ctx frame_mpms_list %p %u", de_ctx->frame_mpms_list,
564 }
565 
566 /**
567  * \brief initialize mpm contexts for applayer buffers that are in
568  * "single or "shared" mode.
569  */
571 {
572  SCLogDebug("preparing frame mpm");
573  int r = 0;
575  while (am != NULL) {
576  SCLogDebug("am %p %s sgh_mpm_context %d", am, am->name, am->sgh_mpm_context);
577  SCLogDebug("%s", am->name);
579  int dir = (am->direction == SIG_FLAG_TOSERVER) ? 1 : 0;
581  SCLogDebug("%s: %d mpm_Ctx %p", am->name, r, mpm_ctx);
582  if (mpm_ctx != NULL) {
583  if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
584  r |= mpm_table[de_ctx->mpm_matcher].Prepare(de_ctx->mpm_cfg, mpm_ctx);
585  SCLogDebug("%s: %d", am->name, r);
586  }
587  }
588  }
589  am = am->next;
590  }
591  return r;
592 }
593 
594 /** \brief register a MPM engine
595  *
596  * \note to be used at start up / registration only. Errors are fatal.
597  */
598 void DetectPktMpmRegister(const char *name, int priority,
599  int (*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx,
600  const DetectBufferMpmRegistry *mpm_reg, int list_id),
602 {
603  SCLogDebug("registering %s/%d/%p/%p", name, priority,
604  PrefilterRegister, GetData);
605 
606  // must register GetData with PrefilterGenericMpmRegister
607  BUG_ON(PrefilterRegister == PrefilterGenericMpmPktRegister && GetData == NULL);
608 
611  int sm_list = DetectBufferTypeGetByName(name);
612  if (sm_list == -1) {
613  FatalError("MPM engine registration for %s failed", name);
614  }
615 
616  DetectBufferMpmRegistry *am = SCCalloc(1, sizeof(*am));
617  BUG_ON(am == NULL);
618  am->name = name;
619  snprintf(am->pname, sizeof(am->pname), "%s", am->name);
620  DEBUG_VALIDATE_BUG_ON(sm_list < 0 || sm_list > INT16_MAX);
621  am->sm_list = (uint16_t)sm_list;
622  am->priority = priority;
624 
625  am->PrefilterRegisterWithListId = PrefilterRegister;
626  am->pkt_v1.GetData = GetData;
627 
628  if (g_mpm_list[DETECT_BUFFER_MPM_TYPE_PKT] == NULL) {
629  g_mpm_list[DETECT_BUFFER_MPM_TYPE_PKT] = am;
630  } else {
632  while (t->next != NULL) {
633  t = t->next;
634  }
635  t->next = am;
636  am->id = t->id + 1;
637  }
638  g_mpm_list_cnt[DETECT_BUFFER_MPM_TYPE_PKT]++;
639 
640  SupportFastPatternForSigMatchList(sm_list, priority);
641  SCLogDebug("%s/%d done", name, sm_list);
642 }
643 
644 /** \brief copy a mpm engine from parent_id, add in transforms */
646  const int id, const int parent_id,
647  DetectEngineTransforms *transforms)
648 {
649  SCLogDebug("registering %d/%d", id, parent_id);
650 
652  while (t) {
653  if (t->sm_list == parent_id) {
654  DetectBufferMpmRegistry *am = SCCalloc(1, sizeof(*am));
655  BUG_ON(am == NULL);
656  am->name = t->name;
657  DEBUG_VALIDATE_BUG_ON(id < 0 || id > INT16_MAX);
658  am->sm_list = (uint16_t)id; // use new id
659  am->sm_list_base = t->sm_list;
662  am->pkt_v1.GetData = t->pkt_v1.GetData;
663  am->priority = t->priority;
665  am->next = t->next;
666 
667  BuildBasicPname(am->pname, sizeof(am->pname), am->name, (uint16_t)id);
668  if (transforms) {
669  memcpy(&am->transforms, transforms, sizeof(*transforms));
670  AppendTransformsToPname(am->pname, sizeof(am->pname), transforms);
671  }
672  am->id = de_ctx->pkt_mpms_list_cnt++;
673 
675  t->next = am;
676  SCLogDebug("copied mpm registration for %s id %u "
677  "with parent %u and GetData %p",
678  t->name, id, parent_id, am->pkt_v1.GetData);
679  t = am;
680  }
681  t = t->next;
682  }
683 }
684 
686 {
687  const DetectBufferMpmRegistry *list = g_mpm_list[DETECT_BUFFER_MPM_TYPE_PKT];
688  while (list != NULL) {
689  DetectBufferMpmRegistry *n = SCCalloc(1, sizeof(*n));
690  BUG_ON(n == NULL);
691 
692  *n = *list;
693  n->next = NULL;
694 
695  if (de_ctx->pkt_mpms_list == NULL) {
696  de_ctx->pkt_mpms_list = n;
697  } else {
699  while (t->next != NULL) {
700  t = t->next;
701  }
702 
703  t->next = n;
704  }
705 
706  /* default to whatever the global setting is */
708 
709  /* see if we use a unique or shared mpm ctx for this type */
710  int confshared = 0;
711  char confstring[256] = "detect.mpm.";
712  strlcat(confstring, n->name, sizeof(confstring));
713  strlcat(confstring, ".shared", sizeof(confstring));
714  if (SCConfGetBool(confstring, &confshared) == 1)
715  shared = confshared;
716 
717  if (shared == 0) {
718  SCLogDebug("using unique mpm ctx' for %s", n->name);
720  } else {
721  SCLogDebug("using shared mpm ctx' for %s", n->name);
722  n->sgh_mpm_context =
724  }
725 
726  list = list->next;
727  }
729  SCLogDebug("mpm: de_ctx pkt_mpms_list %p %u",
731 }
732 
733 /**
734  * \brief initialize mpm contexts for applayer buffers that are in
735  * "single or "shared" mode.
736  */
738 {
739  SCLogDebug("preparing pkt mpm");
740  int r = 0;
742  while (am != NULL) {
743  SCLogDebug("%s", am->name);
745  {
747  if (mpm_ctx != NULL) {
748  if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
749  r |= mpm_table[de_ctx->mpm_matcher].Prepare(de_ctx->mpm_cfg, mpm_ctx);
750  SCLogDebug("%s: %d", am->name, r);
751  }
752  }
753  }
754  am = am->next;
755  }
756  return r;
757 }
758 
759 static int32_t SetupBuiltinMpm(DetectEngineCtx *de_ctx, const char *name)
760 {
761  /* default to whatever the global setting is */
763 
764  /* see if we use a unique or shared mpm ctx for this type */
765  int confshared = 0;
766  char confstring[256] = "detect.mpm.";
767  strlcat(confstring, name, sizeof(confstring));
768  strlcat(confstring, ".shared", sizeof(confstring));
769  if (SCConfGetBool(confstring, &confshared) == 1)
770  shared = confshared;
771 
772  int32_t ctx;
773  if (shared == 0) {
775  SCLogDebug("using unique mpm ctx' for %s", name);
776  } else {
778  SCLogDebug("using shared mpm ctx' for %s", name);
779  }
780  return ctx;
781 }
782 
784 {
785  de_ctx->sgh_mpm_context_proto_tcp_packet = SetupBuiltinMpm(de_ctx, "tcp-packet");
786  de_ctx->sgh_mpm_context_stream = SetupBuiltinMpm(de_ctx, "tcp-stream");
787 
788  de_ctx->sgh_mpm_context_proto_udp_packet = SetupBuiltinMpm(de_ctx, "udp-packet");
789  de_ctx->sgh_mpm_context_proto_other_packet = SetupBuiltinMpm(de_ctx, "other-ip");
790 }
791 
792 /**
793  * \brief initialize mpm contexts for builtin buffers that are in
794  * "single or "shared" mode.
795  */
797 {
798  int r = 0;
799  MpmCtx *mpm_ctx = NULL;
800 
803  if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
804  r |= mpm_table[de_ctx->mpm_matcher].Prepare(de_ctx->mpm_cfg, mpm_ctx);
805  }
807  if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
808  r |= mpm_table[de_ctx->mpm_matcher].Prepare(de_ctx->mpm_cfg, mpm_ctx);
809  }
810  }
811 
814  if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
815  r |= mpm_table[de_ctx->mpm_matcher].Prepare(de_ctx->mpm_cfg, mpm_ctx);
816  }
818  if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
819  r |= mpm_table[de_ctx->mpm_matcher].Prepare(de_ctx->mpm_cfg, mpm_ctx);
820  }
821  }
822 
825  if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
826  r |= mpm_table[de_ctx->mpm_matcher].Prepare(de_ctx->mpm_cfg, mpm_ctx);
827  }
828  }
829 
832  if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
833  r |= mpm_table[de_ctx->mpm_matcher].Prepare(de_ctx->mpm_cfg, mpm_ctx);
834  }
836  if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
837  r |= mpm_table[de_ctx->mpm_matcher].Prepare(de_ctx->mpm_cfg, mpm_ctx);
838  }
839  }
840 
841  return r;
842 }
843 
844 /**
845  * \brief check if a signature has patterns that are to be inspected
846  * against a packets payload (as opposed to the stream payload)
847  *
848  * \param s signature
849  *
850  * \retval 1 true
851  * \retval 0 false
852  */
854 {
855  SCEnter();
856 
857  if (!(s->proto.proto[IPPROTO_TCP / 8] & 1 << (IPPROTO_TCP % 8))) {
858  SCReturnInt(1);
859  }
860 
861  if (s->init_data->smlists[DETECT_SM_LIST_PMATCH] == NULL) {
862  SCLogDebug("no PMATCH");
863  SCReturnInt(0);
864  }
865 
866  if (!(s->flags & SIG_FLAG_REQUIRE_PACKET)) {
867  SCReturnInt(0);
868  }
869 
870  SCReturnInt(1);
871 }
872 
873 /**
874  * \brief check if a signature has patterns that are to be inspected
875  * against the stream payload (as opposed to the individual packets
876  * payload(s))
877  *
878  * \param s signature
879  *
880  * \retval 1 true
881  * \retval 0 false
882  */
884 {
885  SCEnter();
886 
887  if (!(s->proto.proto[IPPROTO_TCP / 8] & 1 << (IPPROTO_TCP % 8))) {
888  SCReturnInt(0);
889  }
890 
891  if (s->init_data->smlists[DETECT_SM_LIST_PMATCH] == NULL) {
892  SCLogDebug("no PMATCH");
893  SCReturnInt(0);
894  }
895 
896  if (!(s->flags & SIG_FLAG_REQUIRE_STREAM)) {
897  SCReturnInt(0);
898  }
899 
900  SCReturnInt(1);
901 }
902 
903 
904 /**
905  * \brief Function to return the multi pattern matcher algorithm to be
906  * used by the engine, based on the mpm-algo setting in yaml
907  * Use the default mpm if none is specified in the yaml file.
908  *
909  * \retval mpm algo value
910  */
912 {
913  const char *mpm_algo;
914  uint8_t mpm_algo_val = mpm_default_matcher;
915 
916  /* Get the mpm algo defined in config file by the user */
917  if ((SCConfGet("mpm-algo", &mpm_algo)) == 1) {
918  if (mpm_algo != NULL) {
919 #if __BYTE_ORDER == __BIG_ENDIAN
920  if (strcmp(mpm_algo, "ac-ks") == 0) {
921  FatalError("ac-ks does "
922  "not work on big endian systems at this time.");
923  }
924 #endif
925  if (strcmp("auto", mpm_algo) == 0) {
926  goto done;
927  } else if (strcmp("ac-bs", mpm_algo) == 0) {
928  SCLogWarning("mpm-algo \"ac-bs\" has been removed. See ticket #6586.");
929  goto done;
930  }
931  for (uint8_t u = 0; u < MPM_TABLE_SIZE; u++) {
932  if (mpm_table[u].name == NULL)
933  continue;
934 
935  if (strcmp(mpm_table[u].name, mpm_algo) == 0) {
936  mpm_algo_val = u;
937  goto done;
938  }
939  }
940 
941 #ifndef BUILD_HYPERSCAN
942  if ((strcmp(mpm_algo, "hs") == 0)) {
943  FatalError("Hyperscan (hs) support for mpm-algo is "
944  "not compiled into Suricata.");
945  }
946 #endif
947  }
948  FatalError("Invalid mpm algo supplied "
949  "in the yaml conf file: \"%s\"",
950  mpm_algo);
951  }
952 
953  done:
954  return mpm_algo_val;
955 }
956 
957 void PatternMatchDestroy(MpmCtx *mpm_ctx, uint16_t mpm_matcher)
958 {
959  SCLogDebug("mpm_ctx %p, mpm_matcher %"PRIu16"", mpm_ctx, mpm_matcher);
960  mpm_table[mpm_matcher].DestroyCtx(mpm_ctx);
961 }
962 
963 void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
964 {
965  SCLogDebug("mpm_thread_ctx %p, mpm_matcher %"PRIu16"", mpm_thread_ctx, mpm_matcher);
966  MpmDestroyThreadCtx(mpm_thread_ctx, mpm_matcher);
967 }
968 void PatternMatchThreadPrepare(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
969 {
970  SCLogDebug("mpm_thread_ctx %p, type %"PRIu16, mpm_thread_ctx, mpm_matcher);
971  MpmInitThreadCtx(mpm_thread_ctx, mpm_matcher);
972 }
973 
974 /** \brief Predict a strength value for patterns
975  *
976  * Patterns with high character diversity score higher.
977  * Alpha chars score not so high
978  * Other printable + a few common codes a little higher
979  * Everything else highest.
980  * Longer patterns score better than short patters.
981  *
982  * \param pat pattern
983  * \param patlen length of the pattern
984  *
985  * \retval s pattern score
986  */
987 uint32_t PatternStrength(uint8_t *pat, uint16_t patlen)
988 {
989  uint8_t a[256];
990  memset(&a, 0 ,sizeof(a));
991 
992  uint32_t s = 0;
993  uint16_t u = 0;
994  for (u = 0; u < patlen; u++) {
995  if (a[pat[u]] == 0) {
996  if (isalpha(pat[u]))
997  s += 3;
998  else if (isprint(pat[u]) || pat[u] == 0x00 || pat[u] == 0x01 || pat[u] == 0xFF)
999  s += 4;
1000  else
1001  s += 6;
1002 
1003  a[pat[u]] = 1;
1004  } else {
1005  s++;
1006  }
1007  }
1008 
1009  return s;
1010 }
1011 
1012 static void PopulateMpmHelperAddPattern(MpmCtx *mpm_ctx, const DetectContentData *cd,
1013  const Signature *s, const uint8_t flags, const int chop)
1014 {
1015  uint16_t pat_offset = cd->offset;
1016  uint16_t pat_depth = cd->depth;
1017 
1018  /* recompute offset/depth to cope with chop */
1019  if (chop && (pat_depth || pat_offset)) {
1020  pat_offset += cd->fp_chop_offset;
1021  if (pat_depth) {
1022  pat_depth -= cd->content_len;
1023  pat_depth += cd->fp_chop_offset + cd->fp_chop_len;
1024  }
1025  }
1026 
1027  /* We have to effectively "wild card" values that will be coming from
1028  * byte_extract variables
1029  */
1031  pat_depth = pat_offset = 0;
1032  }
1033 
1034  if (cd->flags & DETECT_CONTENT_NOCASE) {
1035  if (chop) {
1036  SCMpmAddPatternCI(mpm_ctx, cd->content + cd->fp_chop_offset, cd->fp_chop_len,
1037  pat_offset, pat_depth, cd->id, s->iid, flags | MPM_PATTERN_CTX_OWNS_ID);
1038  } else {
1039  SCMpmAddPatternCI(mpm_ctx, cd->content, cd->content_len, pat_offset, pat_depth, cd->id,
1041  }
1042  } else {
1043  if (chop) {
1044  MpmAddPatternCS(mpm_ctx, cd->content + cd->fp_chop_offset, cd->fp_chop_len, pat_offset,
1045  pat_depth, cd->id, s->iid, flags | MPM_PATTERN_CTX_OWNS_ID);
1046  } else {
1047  MpmAddPatternCS(mpm_ctx, cd->content, cd->content_len, pat_offset, pat_depth, cd->id,
1049  }
1050  }
1051 }
1052 
1053 #define SGH_PROTO(sgh, p) ((sgh)->init->protos[(p)] == 1)
1054 #define SGH_DIRECTION_TS(sgh) ((sgh)->init->direction & SIG_FLAG_TOSERVER)
1055 #define SGH_DIRECTION_TC(sgh) ((sgh)->init->direction & SIG_FLAG_TOCLIENT)
1057 static void SetMpm(Signature *s, SigMatch *mpm_sm, const int mpm_sm_list)
1058 {
1059  if (s == NULL || mpm_sm == NULL)
1060  return;
1061 
1062  DetectContentData *cd = (DetectContentData *)mpm_sm->ctx;
1064  if (DETECT_CONTENT_IS_SINGLE(cd) &&
1065  !(cd->flags & DETECT_CONTENT_NEGATED) &&
1066  !(cd->flags & DETECT_CONTENT_REPLACE) &&
1067  cd->content_len == cd->fp_chop_len)
1068  {
1070  }
1071  } else {
1072  if (DETECT_CONTENT_IS_SINGLE(cd) &&
1073  !(cd->flags & DETECT_CONTENT_NEGATED) &&
1074  !(cd->flags & DETECT_CONTENT_REPLACE))
1075  {
1077  }
1078  }
1079  cd->flags |= DETECT_CONTENT_MPM;
1080  s->init_data->mpm_sm_list = mpm_sm_list;
1081  s->init_data->mpm_sm = mpm_sm;
1082 }
1083 
1084 static SigMatch *GetMpmForList(const Signature *s, SigMatch *list, SigMatch *mpm_sm,
1085  uint16_t max_len, bool skip_negated_content)
1086 {
1087  for (SigMatch *sm = list; sm != NULL; sm = sm->next) {
1088  if (sm->type != DETECT_CONTENT)
1089  continue;
1090 
1091  const DetectContentData *cd = (DetectContentData *)sm->ctx;
1092  /* skip_negated_content is only set if there's absolutely no
1093  * non-negated content present in the sig */
1094  if ((cd->flags & DETECT_CONTENT_NEGATED) && skip_negated_content)
1095  continue;
1096  if (cd->content_len != max_len) {
1097  SCLogDebug("content_len %u != max_len %u", cd->content_len, max_len);
1098  continue;
1099  }
1100  if (mpm_sm == NULL) {
1101  mpm_sm = sm;
1102  } else {
1103  DetectContentData *data1 = (DetectContentData *)sm->ctx;
1104  DetectContentData *data2 = (DetectContentData *)mpm_sm->ctx;
1105  uint32_t ls = PatternStrength(data1->content, data1->content_len);
1106  uint32_t ss = PatternStrength(data2->content, data2->content_len);
1107  if (ls > ss) {
1108  mpm_sm = sm;
1109  } else if (ls == ss) {
1110  /* if 2 patterns are of equal strength, we pick the longest */
1111  if (data1->content_len > data2->content_len)
1112  mpm_sm = sm;
1113  } else {
1114  SCLogDebug("sticking with mpm_sm");
1115  }
1116  }
1117  }
1118  return mpm_sm;
1119 }
1120 
1122 
1123 // tells if a buffer id is only used to client
1124 bool DetectBufferToClient(const DetectEngineCtx *de_ctx, int buf_id, AppProto alproto)
1125 {
1126  bool r = false;
1128  for (; app != NULL; app = app->next) {
1129  if (app->sm_list == buf_id &&
1130  (AppProtoEquals(alproto, app->alproto) || alproto == ALPROTO_UNKNOWN)) {
1131  if (app->dir == 1) {
1132  // do not return yet in case we have app engines on both sides
1133  r = true;
1134  } else {
1135  // ambiguous keywords have a app-engine to server
1136  return false;
1137  }
1138  }
1139  }
1140  return r;
1141 }
1142 
1144 {
1145  if (g_skip_prefilter)
1146  return;
1147 
1148  if (s->init_data->mpm_sm != NULL)
1149  return;
1150 
1151  const int nlists = s->init_data->max_content_list_id + 1;
1152  int pos_sm_list[nlists];
1153  int neg_sm_list[nlists];
1154  memset(pos_sm_list, 0, nlists * sizeof(int));
1155  memset(neg_sm_list, 0, nlists * sizeof(int));
1156  int pos_sm_list_cnt = 0;
1157  int neg_sm_list_cnt = 0;
1158 
1159  /* inspect rule to see if we have the fast_pattern reg to
1160  * force using a sig, otherwise keep stats about the patterns */
1161  if (s->init_data->smlists[DETECT_SM_LIST_PMATCH] != NULL) {
1163  for (SigMatch *sm = s->init_data->smlists[DETECT_SM_LIST_PMATCH]; sm != NULL;
1164  sm = sm->next) {
1165  if (sm->type != DETECT_CONTENT)
1166  continue;
1167 
1168  const DetectContentData *cd = (DetectContentData *)sm->ctx;
1169  /* fast_pattern set in rule, so using this pattern */
1170  if ((cd->flags & DETECT_CONTENT_FAST_PATTERN)) {
1171  SetMpm(s, sm, DETECT_SM_LIST_PMATCH);
1172  return;
1173  }
1174 
1175  if (cd->flags & DETECT_CONTENT_NEGATED) {
1176  neg_sm_list[DETECT_SM_LIST_PMATCH] = 1;
1177  neg_sm_list_cnt++;
1178  } else {
1179  pos_sm_list[DETECT_SM_LIST_PMATCH] = 1;
1180  pos_sm_list_cnt++;
1181  }
1182  }
1183  }
1184  }
1185  for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
1186  const int list_id = s->init_data->buffers[x].id;
1187 
1188  SCLogDebug("%u: list_id %d: %s", s->id, list_id,
1190 
1192  SCLogDebug("skip");
1193  continue;
1194  }
1195 
1196  for (SigMatch *sm = s->init_data->buffers[x].head; sm != NULL; sm = sm->next) {
1197  // a buffer with absent keyword cannot be used as fast_pattern
1198  if (sm->type == DETECT_ABSENT)
1199  break;
1200  if (sm->type != DETECT_CONTENT)
1201  continue;
1202 
1203  const DetectContentData *cd = (DetectContentData *)sm->ctx;
1204  /* fast_pattern set in rule, so using this pattern */
1205  if ((cd->flags & DETECT_CONTENT_FAST_PATTERN)) {
1206  SetMpm(s, sm, list_id);
1207  return;
1208  }
1209 
1210  if (cd->flags & DETECT_CONTENT_NEGATED) {
1211  neg_sm_list[list_id] = 1;
1212  neg_sm_list_cnt++;
1213  } else {
1214  pos_sm_list[list_id] = 1;
1215  pos_sm_list_cnt++;
1216  SCLogDebug("pos added for %d", list_id);
1217  }
1218  }
1219  SCLogDebug("ok");
1220  }
1221 
1222  SCLogDebug("neg_sm_list_cnt %d pos_sm_list_cnt %d", neg_sm_list_cnt, pos_sm_list_cnt);
1223 
1224  /* prefer normal not-negated over negated */
1225  int *curr_sm_list = NULL;
1226  int skip_negated_content = 1;
1227  if (pos_sm_list_cnt > 0) {
1228  curr_sm_list = pos_sm_list;
1229  } else if (neg_sm_list_cnt > 0) {
1230  curr_sm_list = neg_sm_list;
1231  skip_negated_content = 0;
1232  } else {
1233  return;
1234  }
1235 
1236  int final_sm_list[nlists];
1237  memset(&final_sm_list, 0, (nlists * sizeof(int)));
1238 
1239  int count_final_sm_list = 0;
1240  int count_txbidir_toclient_sm_list = 0;
1241  int priority;
1242 
1244  while (tmp != NULL) {
1245  for (priority = tmp->priority;
1246  tmp != NULL && priority == tmp->priority;
1247  tmp = tmp->next)
1248  {
1249  SCLogDebug("tmp->list_id %d tmp->priority %d", tmp->list_id, tmp->priority);
1250  if (tmp->list_id >= nlists)
1251  continue;
1252  if (curr_sm_list[tmp->list_id] == 0)
1253  continue;
1254  if (s->flags & SIG_FLAG_TXBOTHDIR) {
1255  // prefer to choose a fast_pattern to server by default
1256  if (DetectBufferToClient(de_ctx, tmp->list_id, s->alproto)) {
1257  if (count_final_sm_list == 0) {
1258  // still put it in in the case we do not have toserver buffer
1259  final_sm_list[count_txbidir_toclient_sm_list++] = tmp->list_id;
1260  }
1261  continue;
1262  }
1263  }
1264  // we may erase tx bidir toclient buffers here as intended if we have a better choice
1265  final_sm_list[count_final_sm_list++] = tmp->list_id;
1266  SCLogDebug("tmp->list_id %d", tmp->list_id);
1267  }
1268  if (count_final_sm_list != 0)
1269  break;
1270  }
1271 
1272  if ((s->flags & SIG_FLAG_TXBOTHDIR) && count_final_sm_list == 0) {
1273  // forced to pick a fast_pattern to client for tx bidir signature
1274  count_final_sm_list = count_txbidir_toclient_sm_list;
1275  }
1276  BUG_ON(count_final_sm_list == 0);
1277  SCLogDebug("count_final_sm_list %d skip_negated_content %d", count_final_sm_list,
1278  skip_negated_content);
1279 
1280  uint16_t max_len = 0;
1281  for (int i = 0; i < count_final_sm_list; i++) {
1282  SCLogDebug("i %d final_sm_list[i] %d", i, final_sm_list[i]);
1283 
1284  if (final_sm_list[i] == DETECT_SM_LIST_PMATCH) {
1285  for (SigMatch *sm = s->init_data->smlists[DETECT_SM_LIST_PMATCH]; sm != NULL;
1286  sm = sm->next) {
1287  if (sm->type != DETECT_CONTENT)
1288  continue;
1289 
1290  const DetectContentData *cd = (DetectContentData *)sm->ctx;
1291  /* skip_negated_content is only set if there's absolutely no
1292  * non-negated content present in the sig */
1293  if ((cd->flags & DETECT_CONTENT_NEGATED) && skip_negated_content)
1294  continue;
1295  max_len = MAX(max_len, cd->content_len);
1296  }
1297  } else {
1298  for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
1299  if (s->init_data->buffers[x].only_tc) {
1300  // prefer to choose a fast_pattern to server by default
1301  continue;
1302  }
1303  const int list_id = s->init_data->buffers[x].id;
1304 
1305  if (final_sm_list[i] == list_id) {
1306  SCLogDebug("%u: list_id %d: %s", s->id, list_id,
1308 
1309  for (SigMatch *sm = s->init_data->buffers[x].head; sm != NULL; sm = sm->next) {
1310  if (sm->type != DETECT_CONTENT)
1311  continue;
1312 
1313  const DetectContentData *cd = (DetectContentData *)sm->ctx;
1314  /* skip_negated_content is only set if there's absolutely no
1315  * non-negated content present in the sig */
1316  if ((cd->flags & DETECT_CONTENT_NEGATED) && skip_negated_content)
1317  continue;
1318  max_len = MAX(max_len, cd->content_len);
1319  }
1320  }
1321  }
1322  }
1323  }
1324 
1325  SigMatch *mpm_sm = NULL;
1326  int mpm_sm_list = -1;
1327  for (int i = 0; i < count_final_sm_list; i++) {
1328  SCLogDebug("i %d", i);
1329  if (final_sm_list[i] == DETECT_SM_LIST_PMATCH) {
1330  /* GetMpmForList may keep `mpm_sm` the same, so track if it changed */
1331  SigMatch *prev_mpm_sm = mpm_sm;
1332  mpm_sm = GetMpmForList(s, s->init_data->smlists[DETECT_SM_LIST_PMATCH], mpm_sm, max_len,
1333  skip_negated_content);
1334  if (mpm_sm != prev_mpm_sm) {
1335  mpm_sm_list = final_sm_list[i];
1336  }
1337  } else {
1338  SCLogDebug(
1339  "%u: %s", s->id, DetectEngineBufferTypeGetNameById(de_ctx, final_sm_list[i]));
1340  for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
1341  const int list_id = s->init_data->buffers[x].id;
1342  if (final_sm_list[i] == list_id) {
1343  SCLogDebug("%u: list_id %d: %s", s->id, list_id,
1345  /* GetMpmForList may keep `mpm_sm` the same, so track if it changed */
1346  SigMatch *prev_mpm_sm = mpm_sm;
1347  mpm_sm = GetMpmForList(s, s->init_data->buffers[x].head, mpm_sm, max_len,
1348  skip_negated_content);
1349  SCLogDebug("mpm_sm %p from %p", mpm_sm, s->init_data->buffers[x].head);
1350  if (mpm_sm != prev_mpm_sm) {
1351  mpm_sm_list = list_id;
1352  }
1353  }
1354  }
1355  }
1356  }
1357 
1358 #ifdef DEBUG
1359  if (mpm_sm != NULL) {
1360  BUG_ON(mpm_sm_list == -1);
1361  int check_list = SigMatchListSMBelongsTo(s, mpm_sm);
1362  BUG_ON(check_list != mpm_sm_list);
1363  }
1364 #endif
1365  /* assign to signature */
1366  SetMpm(s, mpm_sm, mpm_sm_list);
1367 }
1368 
1369 /** \internal
1370  * \brief The hash function for MpmStore
1371  *
1372  * \param ht Pointer to the hash table.
1373  * \param data Pointer to the MpmStore.
1374  * \param datalen Not used in our case.
1375  *
1376  * \retval hash The generated hash value.
1377  */
1378 static uint32_t MpmStoreHashFunc(HashListTable *ht, void *data, uint16_t datalen)
1379 {
1380  const MpmStore *ms = (MpmStore *)data;
1381  uint32_t hash = ms->alproto;
1382 
1383  for (uint32_t b = 0; b < ms->sid_array_size; b++)
1384  hash += ms->sid_array[b];
1385 
1386  return hash % ht->array_size;
1387 }
1388 
1389 /**
1390  * \brief The Compare function for MpmStore
1391  *
1392  * \param data1 Pointer to the first MpmStore.
1393  * \param len1 Not used.
1394  * \param data2 Pointer to the second MpmStore.
1395  * \param len2 Not used.
1396  *
1397  * \retval 1 If the 2 MpmStores sent as args match.
1398  * \retval 0 If the 2 MpmStores sent as args do not match.
1399  */
1400 static char MpmStoreCompareFunc(void *data1, uint16_t len1, void *data2,
1401  uint16_t len2)
1402 {
1403  const MpmStore *ms1 = (MpmStore *)data1;
1404  const MpmStore *ms2 = (MpmStore *)data2;
1405 
1406  if (ms1->alproto != ms2->alproto)
1407  return 0;
1408 
1409  if (ms1->sid_array_size != ms2->sid_array_size)
1410  return 0;
1411 
1412  if (ms1->buffer != ms2->buffer)
1413  return 0;
1414 
1415  if (ms1->direction != ms2->direction)
1416  return 0;
1417 
1418  if (ms1->sm_list != ms2->sm_list)
1419  return 0;
1420 
1421  if (SCMemcmp(ms1->sid_array, ms2->sid_array,
1422  ms1->sid_array_size) != 0)
1423  {
1424  return 0;
1425  }
1426 
1427  return 1;
1428 }
1429 
1430 static void MpmStoreFreeFunc(void *ptr)
1431 {
1432  MpmStore *ms = ptr;
1433  if (ms != NULL) {
1434  if (ms->mpm_ctx != NULL && !(ms->mpm_ctx->flags & MPMCTX_FLAGS_GLOBAL))
1435  {
1436  SCLogDebug("destroying mpm_ctx %p", ms->mpm_ctx);
1438  SCFree(ms->mpm_ctx);
1439  }
1440  ms->mpm_ctx = NULL;
1441 
1442  SCFree(ms->sid_array);
1443  SCFree(ms);
1444  }
1445 }
1446 
1447 /**
1448  * \brief Initializes the MpmStore mpm hash table to be used by the detection
1449  * engine context.
1450  *
1451  * \param de_ctx Pointer to the detection engine context.
1452  *
1453  * \retval 0 On success.
1454  * \retval -1 On failure.
1455  */
1457 {
1459  MpmStoreHashFunc,
1460  MpmStoreCompareFunc,
1461  MpmStoreFreeFunc);
1462  if (de_ctx->mpm_hash_table == NULL)
1463  goto error;
1464 
1465  return 0;
1466 
1467 error:
1468  return -1;
1469 }
1470 
1471 /**
1472  * \brief Adds a MpmStore to the detection engine context MpmStore
1473  *
1474  * \param de_ctx Pointer to the detection engine context.
1475  * \param sgh Pointer to the MpmStore.
1476  *
1477  * \retval ret 0 on Successfully adding the argument sgh; -1 on failure.
1478  */
1479 static int MpmStoreAdd(DetectEngineCtx *de_ctx, MpmStore *s)
1480 {
1481  int ret = HashListTableAdd(de_ctx->mpm_hash_table, (void *)s, 0);
1482  return ret;
1483 }
1484 
1485 /**
1486  * \brief Used to lookup a MpmStore from the MpmStore
1487  *
1488  * \param de_ctx Pointer to the detection engine context.
1489  * \param sgh Pointer to the MpmStore.
1490  *
1491  * \retval rsgh On success a pointer to the MpmStore if the MpmStore is
1492  * found in the hash table; NULL on failure.
1493  */
1494 static MpmStore *MpmStoreLookup(DetectEngineCtx *de_ctx, MpmStore *s)
1495 {
1497  (void *)s, 0);
1498  return rs;
1499 }
1500 
1501 static const DetectBufferMpmRegistry *GetByMpmStore(
1502  const DetectEngineCtx *de_ctx, const MpmStore *ms)
1503 {
1505  while (am != NULL) {
1506  if (ms->sm_list == am->sm_list &&
1507  ms->direction == am->direction) {
1508  return am;
1509  }
1510  am = am->next;
1511  }
1512  am = de_ctx->pkt_mpms_list;
1513  while (am != NULL) {
1514  if (ms->sm_list == am->sm_list) {
1515  return am;
1516  }
1517  am = am->next;
1518  }
1519  return NULL;
1520 }
1521 
1523 {
1524  HashListTableBucket *htb = NULL;
1525 
1526  uint32_t stats[MPMB_MAX] = {0};
1527  int app_mpms_cnt = de_ctx->buffer_type_id;
1528  uint32_t appstats[app_mpms_cnt + 1]; // +1 to silence scan-build
1529  memset(&appstats, 0x00, sizeof(appstats));
1530  int pkt_mpms_cnt = de_ctx->buffer_type_id;
1531  uint32_t pktstats[pkt_mpms_cnt + 1]; // +1 to silence scan-build
1532  memset(&pktstats, 0x00, sizeof(pktstats));
1533  int frame_mpms_cnt = de_ctx->buffer_type_id;
1534  uint32_t framestats[frame_mpms_cnt + 1]; // +1 to silence scan-build
1535  memset(&framestats, 0x00, sizeof(framestats));
1536 
1538  htb != NULL;
1539  htb = HashListTableGetListNext(htb))
1540  {
1541  const MpmStore *ms = (MpmStore *)HashListTableGetListData(htb);
1542  if (ms == NULL || ms->mpm_ctx == NULL) {
1543  continue;
1544  }
1545  if (ms->buffer < MPMB_MAX)
1546  stats[ms->buffer]++;
1547  else if (ms->sm_list != DETECT_SM_LIST_PMATCH) {
1548  const DetectBufferMpmRegistry *am = GetByMpmStore(de_ctx, ms);
1549  if (am != NULL) {
1550  switch (am->type) {
1552  SCLogDebug("%s: %u patterns. Min %u, Max %u. Ctx %p",
1553  am->name,
1554  ms->mpm_ctx->pattern_cnt,
1555  ms->mpm_ctx->minlen, ms->mpm_ctx->maxlen,
1556  ms->mpm_ctx);
1557  pktstats[am->sm_list]++;
1558  break;
1560  SCLogDebug("%s %s %s: %u patterns. Min %u, Max %u. Ctx %p",
1561  AppProtoToString(ms->alproto), am->name,
1562  am->direction == SIG_FLAG_TOSERVER ? "toserver" : "toclient",
1563  ms->mpm_ctx->pattern_cnt, ms->mpm_ctx->minlen, ms->mpm_ctx->maxlen,
1564  ms->mpm_ctx);
1565  appstats[am->sm_list]++;
1566  break;
1568  SCLogDebug("%s: %u patterns. Min %u, Max %u. Ctx %p", am->name,
1569  ms->mpm_ctx->pattern_cnt, ms->mpm_ctx->minlen, ms->mpm_ctx->maxlen,
1570  ms->mpm_ctx);
1571  framestats[am->sm_list]++;
1572  break;
1574  break;
1575  }
1576  }
1577  }
1578  }
1579 
1580  if (!(de_ctx->flags & DE_QUIET)) {
1581  for (int x = 0; x < MPMB_MAX; x++) {
1582  SCLogPerf("Builtin MPM \"%s\": %u", builtin_mpms[x], stats[x]);
1583  }
1585  while (am != NULL) {
1586  if (appstats[am->sm_list] > 0) {
1587  const char *name = am->name;
1588  const char *direction = am->direction == SIG_FLAG_TOSERVER ? "toserver" : "toclient";
1589  SCLogPerf("AppLayer MPM \"%s %s (%s)\": %u", direction, name,
1590  AppProtoToString(am->app_v2.alproto), appstats[am->sm_list]);
1591  }
1592  am = am->next;
1593  }
1595  while (pm != NULL) {
1596  if (pktstats[pm->sm_list] > 0) {
1597  const char *name = pm->name;
1598  SCLogPerf("Pkt MPM \"%s\": %u", name, pktstats[pm->sm_list]);
1599  }
1600  pm = pm->next;
1601  }
1603  while (um != NULL) {
1604  if (framestats[um->sm_list] > 0) {
1605  const char *name = um->name;
1606  SCLogPerf("Frame MPM \"%s\": %u", name, framestats[um->sm_list]);
1607  }
1608  um = um->next;
1609  }
1610  }
1611 }
1612 
1613 /**
1614  * \brief Frees the hash table - DetectEngineCtx->mpm_hash_table, allocated by
1615  * MpmStoreInit() function.
1616  *
1617  * \param de_ctx Pointer to the detection engine context.
1618  */
1620 {
1621  if (de_ctx->mpm_hash_table == NULL)
1622  return;
1623 
1625  de_ctx->mpm_hash_table = NULL;
1626 }
1627 
1628 static void MpmStoreSetup(const DetectEngineCtx *de_ctx, MpmStore *ms)
1629 {
1630  const Signature *s = NULL;
1631  uint32_t sig;
1632  int dir = 0;
1633 
1634  if (ms->buffer != MPMB_MAX) {
1636 
1637  switch (ms->buffer) {
1638  /* TS is 1 */
1639  case MPMB_TCP_PKT_TS:
1640  case MPMB_TCP_STREAM_TS:
1641  case MPMB_UDP_TS:
1642  dir = 1;
1643  break;
1644 
1645  /* TC is 0 */
1646  default:
1647  case MPMB_UDP_TC:
1648  case MPMB_TCP_STREAM_TC:
1649  case MPMB_TCP_PKT_TC:
1650  case MPMB_OTHERIP: /**< use 0 for other */
1651  dir = 0;
1652  break;
1653  }
1654  } else {
1656 
1657  if (ms->direction == SIG_FLAG_TOSERVER)
1658  dir = 1;
1659  else
1660  dir = 0;
1661  }
1662 
1664  if (ms->mpm_ctx == NULL) {
1665  return;
1666  }
1667 
1669 
1672 
1673  const bool mpm_supports_endswith =
1675 
1676  /* add the patterns */
1677  for (sig = 0; sig < (ms->sid_array_size * 8); sig++) {
1678  if (ms->sid_array[sig / 8] & (1 << (sig % 8))) {
1679  s = de_ctx->sig_array[sig];
1680  DEBUG_VALIDATE_BUG_ON(s == NULL);
1681  if (s == NULL)
1682  continue;
1683 
1684  SCLogDebug("%p: direction %d adding %u", ms, ms->direction, s->id);
1685 
1687 
1688  int skip = 0;
1689  /* negated logic: if mpm match can't be used to be sure about this
1690  * pattern, we have to inspect the rule fully regardless of mpm
1691  * match. So in this case there is no point of adding it at all.
1692  * The non-mpm list entry for the sig will make sure the sig is
1693  * inspected. */
1694  if ((cd->flags & DETECT_CONTENT_NEGATED) &&
1696  {
1697  skip = 1;
1698  SCLogDebug("not adding negated mpm as it's not 'single'");
1699  }
1700 
1701  if (!skip) {
1702  uint8_t flags = 0;
1703  if ((cd->flags & DETECT_CONTENT_ENDS_WITH) && mpm_supports_endswith)
1705  PopulateMpmHelperAddPattern(ms->mpm_ctx, cd, s, flags,
1707  }
1708  }
1709  }
1710 
1711  if (ms->mpm_ctx->pattern_cnt == 0) {
1713  ms->mpm_ctx = NULL;
1714  } else {
1716  if (mpm_table[ms->mpm_ctx->mpm_type].Prepare != NULL) {
1718  }
1719  }
1720  }
1721 }
1722 
1723 
1724 /** \brief Get MpmStore for a built-in buffer type
1725  *
1726  */
1728  enum MpmBuiltinBuffers buf)
1729 {
1730  const Signature *s = NULL;
1731  uint32_t sig;
1732  uint32_t cnt = 0;
1733  int direction = 0;
1734  uint32_t max_sid = DetectEngineGetMaxSigId(de_ctx) / 8 + 1;
1735  uint8_t sids_array[max_sid];
1736  memset(sids_array, 0x00, max_sid);
1737  int sgh_mpm_context = 0;
1738  int sm_list = DETECT_SM_LIST_PMATCH;
1739 
1740  switch (buf) {
1741  case MPMB_TCP_PKT_TS:
1742  case MPMB_TCP_PKT_TC:
1743  sgh_mpm_context = de_ctx->sgh_mpm_context_proto_tcp_packet;
1744  break;
1745  case MPMB_TCP_STREAM_TS:
1746  case MPMB_TCP_STREAM_TC:
1747  sgh_mpm_context = de_ctx->sgh_mpm_context_stream;
1748  break;
1749  case MPMB_UDP_TS:
1750  case MPMB_UDP_TC:
1751  sgh_mpm_context = de_ctx->sgh_mpm_context_proto_udp_packet;
1752  break;
1753  case MPMB_OTHERIP:
1754  sgh_mpm_context = de_ctx->sgh_mpm_context_proto_other_packet;
1755  break;
1756  default:
1757  break;
1758  }
1759 
1760  switch(buf) {
1761  case MPMB_TCP_PKT_TS:
1762  case MPMB_TCP_STREAM_TS:
1763  case MPMB_UDP_TS:
1764  direction = SIG_FLAG_TOSERVER;
1765  break;
1766 
1767  case MPMB_TCP_PKT_TC:
1768  case MPMB_TCP_STREAM_TC:
1769  case MPMB_UDP_TC:
1770  direction = SIG_FLAG_TOCLIENT;
1771  break;
1772 
1773  case MPMB_OTHERIP:
1774  direction = (SIG_FLAG_TOCLIENT|SIG_FLAG_TOSERVER);
1775  break;
1776 
1777  case MPMB_MAX:
1778  BUG_ON(1);
1779  break;
1780  }
1781 
1782  for (sig = 0; sig < sgh->init->sig_cnt; sig++) {
1783  s = sgh->init->match_array[sig];
1784  if (s == NULL)
1785  continue;
1786 
1787  if (s->init_data->mpm_sm == NULL)
1788  continue;
1789 
1790  int list = s->init_data->mpm_sm_list;
1791  if (list < 0)
1792  continue;
1793 
1794  if (list != DETECT_SM_LIST_PMATCH)
1795  continue;
1796 
1797  switch (buf) {
1798  case MPMB_TCP_PKT_TS:
1799  case MPMB_TCP_PKT_TC:
1800  if (SignatureHasPacketContent(s) == 1)
1801  {
1802  sids_array[s->iid / 8] |= 1 << (s->iid % 8);
1803  cnt++;
1804  }
1805  break;
1806  case MPMB_TCP_STREAM_TS:
1807  case MPMB_TCP_STREAM_TC:
1808  if (SignatureHasStreamContent(s) == 1)
1809  {
1810  sids_array[s->iid / 8] |= 1 << (s->iid % 8);
1811  cnt++;
1812  }
1813  break;
1814  case MPMB_UDP_TS:
1815  case MPMB_UDP_TC:
1816  sids_array[s->iid / 8] |= 1 << (s->iid % 8);
1817  cnt++;
1818  break;
1819  case MPMB_OTHERIP:
1820  sids_array[s->iid / 8] |= 1 << (s->iid % 8);
1821  cnt++;
1822  break;
1823  default:
1824  break;
1825  }
1826  }
1827 
1828  if (cnt == 0)
1829  return NULL;
1830 
1831  MpmStore lookup = { sids_array, max_sid, direction, buf, sm_list, 0, 0, NULL };
1832 
1833  MpmStore *result = MpmStoreLookup(de_ctx, &lookup);
1834  if (result == NULL) {
1835  MpmStore *copy = SCCalloc(1, sizeof(MpmStore));
1836  if (copy == NULL)
1837  return NULL;
1838  uint8_t *sids = SCCalloc(1, max_sid);
1839  if (sids == NULL) {
1840  SCFree(copy);
1841  return NULL;
1842  }
1843 
1844  memcpy(sids, sids_array, max_sid);
1845  copy->sid_array = sids;
1846  copy->sid_array_size = max_sid;
1847  copy->buffer = buf;
1848  copy->direction = direction;
1849  copy->sm_list = sm_list;
1850  copy->sgh_mpm_context = sgh_mpm_context;
1851 
1852  MpmStoreSetup(de_ctx, copy);
1853  MpmStoreAdd(de_ctx, copy);
1854  return copy;
1855  } else {
1856  return result;
1857  }
1858 }
1859 
1860 struct SidsArray {
1861  uint8_t *sids_array;
1863  /* indicates this has an active engine */
1864  bool active;
1865 
1867 };
1868 
1869 static MpmStore *MpmStorePrepareBufferAppLayer(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
1870  const DetectBufferMpmRegistry *am, const struct SidsArray *sa)
1871 {
1872  if (sa->sids_array_size == 0 || sa->sids_array == NULL)
1873  return NULL;
1874 
1875  SCLogDebug("handling %s direction %s for list %d", am->name,
1876  am->direction == SIG_FLAG_TOSERVER ? "toserver" : "toclient",
1877  am->sm_list);
1878 
1879  MpmStore lookup = { sa->sids_array, sa->sids_array_size, am->direction, MPMB_MAX, am->sm_list,
1880  0, am->app_v2.alproto, NULL };
1881  SCLogDebug("am->direction %d am->sm_list %d sgh_mpm_context %d", am->direction, am->sm_list,
1882  am->sgh_mpm_context);
1883 
1884  MpmStore *result = MpmStoreLookup(de_ctx, &lookup);
1885  if (result == NULL) {
1886  SCLogDebug("new unique mpm for %s %s", am->name,
1887  am->direction == SIG_FLAG_TOSERVER ? "toserver" : "toclient");
1888 
1889  MpmStore *copy = SCCalloc(1, sizeof(MpmStore));
1890  if (copy == NULL)
1891  return NULL;
1892  uint8_t *sids = SCCalloc(1, sa->sids_array_size);
1893  if (sids == NULL) {
1894  SCFree(copy);
1895  return NULL;
1896  }
1897 
1898  memcpy(sids, sa->sids_array, sa->sids_array_size);
1899  copy->sid_array = sids;
1900  copy->sid_array_size = sa->sids_array_size;
1901  copy->buffer = MPMB_MAX;
1902  copy->direction = am->direction;
1903  copy->sm_list = am->sm_list;
1904  copy->sgh_mpm_context = am->sgh_mpm_context;
1905  copy->alproto = am->app_v2.alproto;
1906 
1907  MpmStoreSetup(de_ctx, copy);
1908  MpmStoreAdd(de_ctx, copy);
1909  return copy;
1910  } else {
1911  SCLogDebug("using existing mpm %p", result);
1912  return result;
1913  }
1914  return NULL;
1915 }
1916 
1917 static MpmStore *MpmStorePrepareBufferPkt(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
1918  const DetectBufferMpmRegistry *am, const struct SidsArray *sa)
1919 {
1920  SCLogDebug("handling %s for list %d", am->name,
1921  am->sm_list);
1922 
1923  if (sa->sids_array_size == 0 || sa->sids_array == NULL)
1924  return NULL;
1925 
1927  MPMB_MAX, am->sm_list, 0, 0, NULL };
1928  SCLogDebug("am->sm_list %d", am->sm_list);
1929 
1930  MpmStore *result = MpmStoreLookup(de_ctx, &lookup);
1931  if (result == NULL) {
1932  SCLogDebug("new unique mpm for %s", am->name);
1933 
1934  MpmStore *copy = SCCalloc(1, sizeof(MpmStore));
1935  if (copy == NULL)
1936  return NULL;
1937  uint8_t *sids = SCCalloc(1, sa->sids_array_size);
1938  if (sids == NULL) {
1939  SCFree(copy);
1940  return NULL;
1941  }
1942 
1943  memcpy(sids, sa->sids_array, sa->sids_array_size);
1944  copy->sid_array = sids;
1945  copy->sid_array_size = sa->sids_array_size;
1946  copy->buffer = MPMB_MAX;
1948  copy->sm_list = am->sm_list;
1949  copy->sgh_mpm_context = am->sgh_mpm_context;
1950 
1951  MpmStoreSetup(de_ctx, copy);
1952  MpmStoreAdd(de_ctx, copy);
1953  return copy;
1954  } else {
1955  SCLogDebug("using existing mpm %p", result);
1956  return result;
1957  }
1958  return NULL;
1959 }
1960 
1961 static MpmStore *MpmStorePrepareBufferFrame(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
1962  const DetectBufferMpmRegistry *am, const struct SidsArray *sa)
1963 {
1964  SCLogDebug("handling %s for list %d", am->name, am->sm_list);
1965 
1966  if (sa->sids_array_size == 0 || sa->sids_array == NULL)
1967  return NULL;
1968 
1969  MpmStore lookup = { sa->sids_array, sa->sids_array_size, am->direction, MPMB_MAX, am->sm_list,
1970  0, am->frame_v1.alproto, NULL };
1971  SCLogDebug("am->sm_list %d", am->sm_list);
1972 
1973  MpmStore *result = MpmStoreLookup(de_ctx, &lookup);
1974  if (result == NULL) {
1975  SCLogDebug("new unique mpm for %s", am->name);
1976 
1977  MpmStore *copy = SCCalloc(1, sizeof(MpmStore));
1978  if (copy == NULL)
1979  return NULL;
1980  uint8_t *sids = SCCalloc(1, sa->sids_array_size);
1981  if (sids == NULL) {
1982  SCFree(copy);
1983  return NULL;
1984  }
1985 
1986  memcpy(sids, sa->sids_array, sa->sids_array_size);
1987  copy->sid_array = sids;
1988  copy->sid_array_size = sa->sids_array_size;
1989  copy->buffer = MPMB_MAX;
1990  copy->direction = am->direction;
1991  copy->sm_list = am->sm_list;
1992  copy->sgh_mpm_context = am->sgh_mpm_context;
1993  copy->alproto = am->frame_v1.alproto;
1994 
1995  MpmStoreSetup(de_ctx, copy);
1996  MpmStoreAdd(de_ctx, copy);
1997  return copy;
1998  } else {
1999  SCLogDebug("using existing mpm %p", result);
2000  return result;
2001  }
2002  return NULL;
2003 }
2004 
2005 static void SetRawReassemblyFlag(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
2006 {
2007  const Signature *s = NULL;
2008  uint32_t sig;
2009 
2010  for (sig = 0; sig < sgh->init->sig_cnt; sig++) {
2011  s = sgh->init->match_array[sig];
2012  if (s == NULL)
2013  continue;
2014 
2015  if (SignatureHasStreamContent(s) == 1) {
2017  SCLogDebug("rule group %p has SIG_GROUP_HEAD_HAVERAWSTREAM set", sgh);
2018  return;
2019  }
2020  }
2021  SCLogDebug("rule group %p does NOT have SIG_GROUP_HEAD_HAVERAWSTREAM set", sgh);
2022 }
2023 
2024 typedef struct DetectBufferInstance {
2025  // key
2026  int list;
2028 
2029  struct SidsArray ts;
2030  struct SidsArray tc;
2032 
2033 static uint32_t DetectBufferInstanceHashFunc(HashListTable *ht, void *data, uint16_t datalen)
2034 {
2035  const DetectBufferInstance *ms = (const DetectBufferInstance *)data;
2036  uint32_t hash = ms->list + ms->alproto;
2037  return hash % ht->array_size;
2038 }
2039 
2040 static char DetectBufferInstanceCompareFunc(void *data1, uint16_t len1, void *data2, uint16_t len2)
2041 {
2042  const DetectBufferInstance *ms1 = (DetectBufferInstance *)data1;
2043  const DetectBufferInstance *ms2 = (DetectBufferInstance *)data2;
2044  return (ms1->list == ms2->list && ms1->alproto == ms2->alproto);
2045 }
2046 
2047 static void DetectBufferInstanceFreeFunc(void *ptr)
2048 {
2049  DetectBufferInstance *ms = ptr;
2050  if (ms->ts.sids_array != NULL)
2051  SCFree(ms->ts.sids_array);
2052  if (ms->tc.sids_array != NULL)
2053  SCFree(ms->tc.sids_array);
2054  SCFree(ms);
2055 }
2056 
2057 static HashListTable *DetectBufferInstanceInit(void)
2058 {
2059  return HashListTableInit(4096, DetectBufferInstanceHashFunc, DetectBufferInstanceCompareFunc,
2060  DetectBufferInstanceFreeFunc);
2061 }
2062 
2063 static void PrepareMpms(DetectEngineCtx *de_ctx, SigGroupHead *sh)
2064 {
2065  HashListTable *bufs = DetectBufferInstanceInit();
2066  BUG_ON(bufs == NULL);
2067 
2068  const int max_buffer_id = de_ctx->buffer_type_id + 1;
2069  const uint32_t max_sid = DetectEngineGetMaxSigId(de_ctx) / 8 + 1;
2070 
2071  AppProto engines[max_buffer_id][g_alproto_max];
2072  memset(engines, 0, sizeof(engines));
2073  int engines_idx[max_buffer_id];
2074  memset(engines_idx, 0, sizeof(engines_idx));
2075  int types[max_buffer_id];
2076  memset(types, 0, sizeof(types));
2077 
2078  /* flag the list+directions we have engines for as active */
2079  for (DetectBufferMpmRegistry *a = de_ctx->pkt_mpms_list; a != NULL; a = a->next) {
2080  types[a->sm_list] = a->type;
2081 
2082  DetectBufferInstance lookup = { .list = a->sm_list, .alproto = ALPROTO_UNKNOWN };
2083  DetectBufferInstance *instance = HashListTableLookup(bufs, &lookup, 0);
2084  if (instance == NULL) {
2085  instance = SCCalloc(1, sizeof(*instance));
2086  BUG_ON(instance == NULL);
2087  instance->list = a->sm_list;
2088  instance->alproto = ALPROTO_UNKNOWN;
2089  HashListTableAdd(bufs, instance, 0);
2090  }
2091  instance->ts.active = true;
2092  instance->tc.active = true;
2093  }
2094  for (DetectBufferMpmRegistry *a = de_ctx->frame_mpms_list; a != NULL; a = a->next) {
2095  const bool add_ts = ((a->direction == SIG_FLAG_TOSERVER) && SGH_DIRECTION_TS(sh));
2096  const bool add_tc = ((a->direction == SIG_FLAG_TOCLIENT) && SGH_DIRECTION_TC(sh));
2097  if (add_ts || add_tc) {
2098  types[a->sm_list] = a->type;
2099  engines[a->sm_list][engines_idx[a->sm_list]++] = a->frame_v1.alproto;
2100 
2101  DetectBufferInstance lookup = { .list = a->sm_list, .alproto = a->frame_v1.alproto };
2102  DetectBufferInstance *instance = HashListTableLookup(bufs, &lookup, 0);
2103  if (instance == NULL) {
2104  instance = SCCalloc(1, sizeof(*instance));
2105  BUG_ON(instance == NULL);
2106  instance->list = a->sm_list;
2107  instance->alproto = a->frame_v1.alproto;
2108  HashListTableAdd(bufs, instance, 0);
2109  }
2110  instance->ts.active |= add_ts;
2111  instance->tc.active |= add_tc;
2112  }
2113  }
2114  for (DetectBufferMpmRegistry *a = de_ctx->app_mpms_list; a != NULL; a = a->next) {
2115  const bool add_ts = ((a->direction == SIG_FLAG_TOSERVER) && SGH_DIRECTION_TS(sh));
2116  const bool add_tc = ((a->direction == SIG_FLAG_TOCLIENT) && SGH_DIRECTION_TC(sh));
2117  if (add_ts || add_tc) {
2118  types[a->sm_list] = a->type;
2119  engines[a->sm_list][engines_idx[a->sm_list]++] = a->app_v2.alproto;
2120 
2121  DetectBufferInstance lookup = { .list = a->sm_list, .alproto = a->app_v2.alproto };
2122  DetectBufferInstance *instance = HashListTableLookup(bufs, &lookup, 0);
2123  if (instance == NULL) {
2124  instance = SCCalloc(1, sizeof(*instance));
2125  BUG_ON(instance == NULL);
2126  instance->list = a->sm_list;
2127  instance->alproto = a->app_v2.alproto;
2128  HashListTableAdd(bufs, instance, 0);
2129  }
2130  instance->ts.active |= add_ts;
2131  instance->tc.active |= add_tc;
2132  }
2133  }
2134 
2135  for (uint32_t sig = 0; sig < sh->init->sig_cnt; sig++) {
2136  const Signature *s = sh->init->match_array[sig];
2137  if (s == NULL)
2138  continue;
2139  if (s->init_data->mpm_sm == NULL)
2140  continue;
2141  const int list = s->init_data->mpm_sm_list;
2142  if (list < 0)
2143  continue;
2144  if (list == DETECT_SM_LIST_PMATCH)
2145  continue;
2146 
2147  switch (types[list]) {
2148  /* app engines are direction aware */
2151  for (int e = 0; e < engines_idx[list]; e++) {
2152  const AppProto alproto = engines[list][e];
2153  if (!(AppProtoEquals(s->alproto, alproto) || s->alproto == 0))
2154  continue;
2155 
2156  DetectBufferInstance lookup = { .list = list, .alproto = alproto };
2157  DetectBufferInstance *instance = HashListTableLookup(bufs, &lookup, 0);
2158  if (instance == NULL)
2159  continue;
2160  if (s->flags & SIG_FLAG_TOSERVER) {
2161  struct SidsArray *sa = &instance->ts;
2162  if (sa->active) {
2163  if (sa->sids_array == NULL) {
2164  sa->sids_array = SCCalloc(1, max_sid);
2165  sa->sids_array_size = max_sid;
2166  BUG_ON(sa->sids_array == NULL); // TODO
2167  }
2168  sa->sids_array[s->iid / 8] |= 1 << (s->iid % 8);
2169  SCLogDebug("instance %p: stored %u/%u ts", instance, s->id, s->iid);
2170  }
2171  }
2172  if (s->flags & SIG_FLAG_TOCLIENT) {
2173  struct SidsArray *sa = &instance->tc;
2174  if (sa->active) {
2175  if (sa->sids_array == NULL) {
2176  sa->sids_array = SCCalloc(1, max_sid);
2177  sa->sids_array_size = max_sid;
2178  BUG_ON(sa->sids_array == NULL); // TODO
2179  }
2180  sa->sids_array[s->iid / 8] |= 1 << (s->iid % 8);
2181  SCLogDebug("instance %p: stored %u/%u tc", instance, s->id, s->iid);
2182  }
2183  }
2184  }
2185  break;
2186  }
2187  /* pkt engines are directionless, so only use ts */
2189  DetectBufferInstance lookup = { .list = list, .alproto = ALPROTO_UNKNOWN };
2190  DetectBufferInstance *instance = HashListTableLookup(bufs, &lookup, 0);
2191  if (instance == NULL)
2192  continue;
2193  struct SidsArray *sa = &instance->ts;
2194  if (sa->active) {
2195  if (sa->sids_array == NULL) {
2196  sa->sids_array = SCCalloc(1, max_sid);
2197  sa->sids_array_size = max_sid;
2198  BUG_ON(sa->sids_array == NULL); // TODO
2199  }
2200  sa->sids_array[s->iid / 8] |= 1 << (s->iid % 8);
2201  }
2202  break;
2203  }
2204  default:
2205  BUG_ON(1);
2206  }
2207  }
2208 
2209  sh->init->app_mpms = SCCalloc(de_ctx->app_mpms_list_cnt, sizeof(MpmCtx *));
2210  BUG_ON(sh->init->app_mpms == NULL);
2211 
2212  sh->init->pkt_mpms = SCCalloc(de_ctx->pkt_mpms_list_cnt, sizeof(MpmCtx *));
2213  BUG_ON(sh->init->pkt_mpms == NULL);
2214 
2216  BUG_ON(sh->init->frame_mpms == NULL);
2217 
2218  for (DetectBufferMpmRegistry *a = de_ctx->pkt_mpms_list; a != NULL; a = a->next) {
2219  DetectBufferInstance lookup = { .list = a->sm_list, .alproto = ALPROTO_UNKNOWN };
2220  DetectBufferInstance *instance = HashListTableLookup(bufs, &lookup, 0);
2221  if (instance == NULL) {
2222  continue;
2223  }
2224  struct SidsArray *sa = &instance->ts;
2225  if (!sa->active)
2226  continue;
2227 
2228  MpmStore *mpm_store = MpmStorePrepareBufferPkt(de_ctx, sh, a, sa);
2229  if (mpm_store != NULL) {
2230  sh->init->pkt_mpms[a->id] = mpm_store->mpm_ctx;
2231 
2232  SCLogDebug("a %p a->name %s a->reg->PrefilterRegisterWithListId %p "
2233  "mpm_store->mpm_ctx %p", a, a->name,
2234  a->PrefilterRegisterWithListId, mpm_store->mpm_ctx);
2235 
2236  /* if we have just certain types of negated patterns,
2237  * mpm_ctx can be NULL */
2238  if (a->PrefilterRegisterWithListId && mpm_store->mpm_ctx) {
2239  BUG_ON(a->PrefilterRegisterWithListId(de_ctx,
2240  sh, mpm_store->mpm_ctx,
2241  a, a->sm_list) != 0);
2242  SCLogDebug("mpm %s %d set up", a->name, a->sm_list);
2243  }
2244  }
2245  }
2246  for (DetectBufferMpmRegistry *a = de_ctx->frame_mpms_list; a != NULL; a = a->next) {
2247  if ((a->direction == SIG_FLAG_TOSERVER && SGH_DIRECTION_TS(sh)) ||
2248  (a->direction == SIG_FLAG_TOCLIENT && SGH_DIRECTION_TC(sh))) {
2249  DetectBufferInstance lookup = { .list = a->sm_list, .alproto = a->frame_v1.alproto };
2250  DetectBufferInstance *instance = HashListTableLookup(bufs, &lookup, 0);
2251  if (instance == NULL) {
2252  continue;
2253  }
2254  struct SidsArray *sa =
2255  (a->direction == SIG_FLAG_TOSERVER) ? &instance->ts : &instance->tc;
2256  if (!sa->active)
2257  continue;
2258 
2259  SCLogDebug("a %s direction %d PrefilterRegisterWithListId %p", a->name, a->direction,
2260  a->PrefilterRegisterWithListId);
2261  MpmStore *mpm_store = MpmStorePrepareBufferFrame(de_ctx, sh, a, sa);
2262  if (mpm_store != NULL) {
2263  sh->init->frame_mpms[a->id] = mpm_store->mpm_ctx;
2264 
2265  SCLogDebug("a %p a->name %s a->reg->PrefilterRegisterWithListId %p "
2266  "mpm_store->mpm_ctx %p",
2267  a, a->name, a->PrefilterRegisterWithListId, mpm_store->mpm_ctx);
2268 
2269  /* if we have just certain types of negated patterns,
2270  * mpm_ctx can be NULL */
2271  SCLogDebug("mpm_store %p mpm_ctx %p", mpm_store, mpm_store->mpm_ctx);
2272  if (a->PrefilterRegisterWithListId && mpm_store->mpm_ctx) {
2273  BUG_ON(a->PrefilterRegisterWithListId(
2274  de_ctx, sh, mpm_store->mpm_ctx, a, a->sm_list) != 0);
2275  SCLogDebug("mpm %s %d set up", a->name, a->sm_list);
2276  }
2277  }
2278  }
2279  }
2280  for (DetectBufferMpmRegistry *a = de_ctx->app_mpms_list; a != NULL; a = a->next) {
2281  if ((a->direction == SIG_FLAG_TOSERVER && SGH_DIRECTION_TS(sh)) ||
2282  (a->direction == SIG_FLAG_TOCLIENT && SGH_DIRECTION_TC(sh))) {
2283 
2284  DetectBufferInstance lookup = { .list = a->sm_list, .alproto = a->app_v2.alproto };
2285  DetectBufferInstance *instance = HashListTableLookup(bufs, &lookup, 0);
2286  if (instance == NULL) {
2287  continue;
2288  }
2289  struct SidsArray *sa =
2290  (a->direction == SIG_FLAG_TOSERVER) ? &instance->ts : &instance->tc;
2291  if (!sa->active)
2292  continue;
2293 
2294  MpmStore *mpm_store = MpmStorePrepareBufferAppLayer(de_ctx, sh, a, sa);
2295  if (mpm_store != NULL) {
2296  sh->init->app_mpms[a->id] = mpm_store->mpm_ctx;
2297 
2298  SCLogDebug("a %p a->name %s a->PrefilterRegisterWithListId %p "
2299  "mpm_store->mpm_ctx %p",
2300  a, a->name, a->PrefilterRegisterWithListId, mpm_store->mpm_ctx);
2301 
2302  /* if we have just certain types of negated patterns,
2303  * mpm_ctx can be NULL */
2304  if (a->PrefilterRegisterWithListId && mpm_store->mpm_ctx) {
2305  BUG_ON(a->PrefilterRegisterWithListId(
2306  de_ctx, sh, mpm_store->mpm_ctx, a, a->sm_list) != 0);
2307  SCLogDebug("mpm %s %d set up", a->name, a->sm_list);
2308  }
2309  }
2310  }
2311  }
2312  HashListTableFree(bufs);
2313 }
2314 
2315 /** \brief Prepare the pattern matcher ctx in a sig group head.
2316  *
2317  */
2319 {
2320  MpmStore *mpm_store = NULL;
2321  if (SGH_PROTO(sh, IPPROTO_TCP)) {
2322  if (SGH_DIRECTION_TS(sh)) {
2323  mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_TCP_PKT_TS);
2324  if (mpm_store != NULL) {
2325  PrefilterPktPayloadRegister(de_ctx, sh, mpm_store->mpm_ctx);
2326  }
2327 
2329  if (mpm_store != NULL) {
2330  PrefilterPktStreamRegister(de_ctx, sh, mpm_store->mpm_ctx);
2331  }
2332 
2333  SetRawReassemblyFlag(de_ctx, sh);
2334  }
2335  if (SGH_DIRECTION_TC(sh)) {
2336  mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_TCP_PKT_TC);
2337  if (mpm_store != NULL) {
2338  PrefilterPktPayloadRegister(de_ctx, sh, mpm_store->mpm_ctx);
2339  }
2340 
2342  if (mpm_store != NULL) {
2343  PrefilterPktStreamRegister(de_ctx, sh, mpm_store->mpm_ctx);
2344  }
2345 
2346  SetRawReassemblyFlag(de_ctx, sh);
2347  }
2348  } else if (SGH_PROTO(sh, IPPROTO_UDP)) {
2349  if (SGH_DIRECTION_TS(sh)) {
2350  mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_UDP_TS);
2351  if (mpm_store != NULL) {
2352  PrefilterPktPayloadRegister(de_ctx, sh, mpm_store->mpm_ctx);
2353  }
2354  }
2355  if (SGH_DIRECTION_TC(sh)) {
2356  mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_UDP_TC);
2357  if (mpm_store != NULL) {
2358  PrefilterPktPayloadRegister(de_ctx, sh, mpm_store->mpm_ctx);
2359  }
2360  }
2361  } else {
2362  mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_OTHERIP);
2363  if (mpm_store != NULL) {
2364  PrefilterPktPayloadRegister(de_ctx, sh, mpm_store->mpm_ctx);
2365  }
2366  }
2367 
2368  PrepareMpms(de_ctx, sh);
2369  return 0;
2370 }
2371 
2372 static inline uint32_t ContentFlagsForHash(const DetectContentData *cd)
2373 {
2376 }
2377 
2378 /** \internal
2379  * \brief The hash function for Pattern. Hashes pattern after chop is applied.
2380  *
2381  * \param ht Pointer to the hash table.
2382  * \param data Pointer to the Pattern.
2383  * \param datalen Not used in our case.
2384  *
2385  * \retval hash The generated hash value.
2386  */
2387 static uint32_t PatternChopHashFunc(HashListTable *ht, void *data, uint16_t datalen)
2388 {
2389  const DetectPatternTracker *p = (DetectPatternTracker *)data;
2390  uint32_t hash = p->sm_list + ContentFlagsForHash(p->cd);
2391  uint16_t content_len = p->cd->content_len;
2392  const uint8_t *content = p->cd->content;
2394  content += p->cd->fp_chop_offset;
2395  content_len = p->cd->fp_chop_len;
2396  }
2397  hash += StringHashDjb2(content, content_len);
2398  return hash % ht->array_size;
2399 }
2400 
2401 /** \internal
2402  * \brief The hash function for Pattern. Ignores chop.
2403  *
2404  * \param ht Pointer to the hash table.
2405  * \param data Pointer to the Pattern.
2406  * \param datalen Not used in our case.
2407  *
2408  * \retval hash The generated hash value.
2409  */
2410 static uint32_t PatternNoChopHashFunc(HashListTable *ht, void *data, uint16_t datalen)
2411 {
2412  const DetectPatternTracker *p = (DetectPatternTracker *)data;
2413  uint32_t hash = p->sm_list + ContentFlagsForHash(p->cd);
2414  hash += StringHashDjb2(p->cd->content, p->cd->content_len);
2415  return hash % ht->array_size;
2416 }
2417 
2418 /**
2419  * \brief The Compare function for Pattern. Compares patterns after chop is applied.
2420  *
2421  * \param data1 Pointer to the first Pattern.
2422  * \param len1 Not used.
2423  * \param data2 Pointer to the second Pattern.
2424  * \param len2 Not used.
2425  *
2426  * \retval 1 If the 2 Patterns sent as args match.
2427  * \retval 0 If the 2 Patterns sent as args do not match.
2428  */
2429 static char PatternChopCompareFunc(void *data1, uint16_t len1, void *data2, uint16_t len2)
2430 {
2431  const DetectPatternTracker *p1 = (DetectPatternTracker *)data1;
2432  const DetectPatternTracker *p2 = (DetectPatternTracker *)data2;
2433 
2434  if (p1->sm_list != p2->sm_list)
2435  return 0;
2436 
2437  if (ContentFlagsForHash(p1->cd) != ContentFlagsForHash(p2->cd))
2438  return 0;
2439 
2440  uint16_t p1_content_len = p1->cd->content_len;
2441  uint8_t *p1_content = p1->cd->content;
2443  p1_content += p1->cd->fp_chop_offset;
2444  p1_content_len = p1->cd->fp_chop_len;
2445  }
2446  uint16_t p2_content_len = p2->cd->content_len;
2447  uint8_t *p2_content = p2->cd->content;
2449  p2_content += p2->cd->fp_chop_offset;
2450  p2_content_len = p2->cd->fp_chop_len;
2451  }
2452 
2453  if (p1_content_len != p2_content_len)
2454  return 0;
2455 
2456  if (memcmp(p1_content, p2_content, p1_content_len) != 0) {
2457  return 0;
2458  }
2459 
2460  return 1;
2461 }
2462 
2463 /**
2464  * \brief The Compare function for Pattern. Ignores chop settings
2465  *
2466  * \param data1 Pointer to the first Pattern.
2467  * \param len1 Not used.
2468  * \param data2 Pointer to the second Pattern.
2469  * \param len2 Not used.
2470  *
2471  * \retval 1 If the 2 Patterns sent as args match.
2472  * \retval 0 If the 2 Patterns sent as args do not match.
2473  */
2474 static char PatternNoChopCompareFunc(void *data1, uint16_t len1, void *data2, uint16_t len2)
2475 {
2476  const DetectPatternTracker *p1 = (DetectPatternTracker *)data1;
2477  const DetectPatternTracker *p2 = (DetectPatternTracker *)data2;
2478 
2479  if (p1->sm_list != p2->sm_list)
2480  return 0;
2481 
2482  if (ContentFlagsForHash(p1->cd) != ContentFlagsForHash(p2->cd))
2483  return 0;
2484 
2485  if (p1->cd->content_len != p2->cd->content_len)
2486  return 0;
2487 
2488  if (memcmp(p1->cd->content, p2->cd->content, p1->cd->content_len) != 0) {
2489  return 0;
2490  }
2491 
2492  return 1;
2493 }
2494 
2495 static void PatternFreeFunc(void *ptr)
2496 {
2497  SCFree(ptr);
2498 }
2499 
2500 /**
2501  * \brief Figure out the FP and their respective content ids for all the
2502  * sigs in the engine.
2503  *
2504  * \param de_ctx Detection engine context.
2505  *
2506  * \retval 0 On success.
2507  * \retval -1 On failure.
2508  */
2510 {
2511  uint32_t cnt = 0;
2512  for (Signature *s = de_ctx->sig_list; s != NULL; s = s->next) {
2513  if (s->init_data->mpm_sm != NULL) {
2514  cnt++;
2515  }
2516  }
2517  /* no mpm rules */
2518  if (cnt == 0)
2519  return 0;
2520 
2521  HashListTable *ht =
2522  HashListTableInit(4096, PatternChopHashFunc, PatternChopCompareFunc, PatternFreeFunc);
2523  BUG_ON(ht == NULL);
2524  PatIntId max_id = 0;
2525 
2526  for (Signature *s = de_ctx->sig_list; s != NULL; s = s->next) {
2527  if (s->init_data->mpm_sm == NULL)
2528  continue;
2529 
2530  const int sm_list = s->init_data->mpm_sm_list;
2531  BUG_ON(sm_list == -1);
2532 
2534 
2535  DetectPatternTracker lookup = { .cd = cd, .sm_list = sm_list, .cnt = 0, .mpm = 0 };
2536  DetectPatternTracker *res = HashListTableLookup(ht, &lookup, 0);
2537  if (res) {
2538  res->cnt++;
2539  res->mpm += ((cd->flags & DETECT_CONTENT_MPM) != 0);
2540 
2541  cd->id = res->cd->id;
2542  SCLogDebug("%u: res id %u cnt %u", s->id, res->cd->id, res->cnt);
2543  } else {
2544  DetectPatternTracker *add = SCCalloc(1, sizeof(*add));
2545  BUG_ON(add == NULL);
2546  add->cd = cd;
2547  add->sm_list = sm_list;
2548  add->cnt = 1;
2549  add->mpm = ((cd->flags & DETECT_CONTENT_MPM) != 0);
2550  HashListTableAdd(ht, (void *)add, 0);
2551 
2552  cd->id = max_id++;
2553  SCLogDebug("%u: add id %u cnt %u", s->id, add->cd->id, add->cnt);
2554  }
2555  }
2556 
2557  HashListTableFree(ht);
2558 
2559  return 0;
2560 }
2561 
2562 /** \brief add all patterns on our stats hash
2563  * Used to fill the hash later used by DumpPatterns()
2564  * \note sets up the hash table on first call
2565  */
2567 {
2568  if (de_ctx->pattern_hash_table == NULL) {
2570  4096, PatternNoChopHashFunc, PatternNoChopCompareFunc, PatternFreeFunc);
2571  BUG_ON(de_ctx->pattern_hash_table == NULL);
2572  }
2573  if (s->sm_arrays[DETECT_SM_LIST_PMATCH]) {
2575  do {
2576  switch (smd->type) {
2577  case DETECT_CONTENT: {
2578  const DetectContentData *cd = (const DetectContentData *)smd->ctx;
2579  DetectPatternTracker lookup = {
2580  .cd = cd, .sm_list = DETECT_SM_LIST_PMATCH, .cnt = 0, .mpm = 0
2581  };
2582  DetectPatternTracker *res =
2584  if (res) {
2585  res->cnt++;
2586  res->mpm += ((cd->flags & DETECT_CONTENT_MPM) != 0);
2587  } else {
2588  DetectPatternTracker *add = SCCalloc(1, sizeof(*add));
2589  BUG_ON(add == NULL);
2590  add->cd = cd;
2592  add->cnt = 1;
2593  add->mpm = ((cd->flags & DETECT_CONTENT_MPM) != 0);
2594  HashListTableAdd(de_ctx->pattern_hash_table, (void *)add, 0);
2595  }
2596  break;
2597  }
2598  }
2599  if (smd->is_last)
2600  break;
2601  smd++;
2602  } while (1);
2603  }
2604 
2606  for (; app != NULL; app = app->next) {
2607  SigMatchData *smd = app->smd;
2608  while (smd) {
2609  switch (smd->type) {
2610  case DETECT_CONTENT: {
2611  const DetectContentData *cd = (const DetectContentData *)smd->ctx;
2612 
2613  DetectPatternTracker lookup = {
2614  .cd = cd, .sm_list = app->sm_list, .cnt = 0, .mpm = 0
2615  };
2616  DetectPatternTracker *res =
2618  if (res) {
2619  res->cnt++;
2620  res->mpm += ((cd->flags & DETECT_CONTENT_MPM) != 0);
2621  } else {
2622  DetectPatternTracker *add = SCCalloc(1, sizeof(*add));
2623  BUG_ON(add == NULL);
2624  add->cd = cd;
2625  add->sm_list = app->sm_list;
2626  add->cnt = 1;
2627  add->mpm = ((cd->flags & DETECT_CONTENT_MPM) != 0);
2628  HashListTableAdd(de_ctx->pattern_hash_table, (void *)add, 0);
2629  }
2630  break;
2631  }
2632  }
2633  if (smd->is_last)
2634  break;
2635  smd++;
2636  }
2637  }
2639  for (; pkt != NULL; pkt = pkt->next) {
2640  SigMatchData *smd = pkt->smd;
2641  do {
2642  if (smd == NULL) {
2644  smd = s->sm_arrays[pkt->sm_list];
2645  }
2646  switch (smd->type) {
2647  case DETECT_CONTENT: {
2648  const DetectContentData *cd = (const DetectContentData *)smd->ctx;
2649 
2650  DetectPatternTracker lookup = {
2651  .cd = cd, .sm_list = pkt->sm_list, .cnt = 0, .mpm = 0
2652  };
2653  DetectPatternTracker *res =
2655  if (res) {
2656  res->cnt++;
2657  res->mpm += ((cd->flags & DETECT_CONTENT_MPM) != 0);
2658  } else {
2659  DetectPatternTracker *add = SCCalloc(1, sizeof(*add));
2660  BUG_ON(add == NULL);
2661  add->cd = cd;
2662  add->sm_list = pkt->sm_list;
2663  add->cnt = 1;
2664  add->mpm = ((cd->flags & DETECT_CONTENT_MPM) != 0);
2665  HashListTableAdd(de_ctx->pattern_hash_table, (void *)add, 0);
2666  }
2667  break;
2668  }
2669  }
2670  if (smd->is_last)
2671  break;
2672  smd++;
2673  } while (1);
2674  }
2676  for (; frame != NULL; frame = frame->next) {
2677  SigMatchData *smd = frame->smd;
2678  do {
2679  if (smd == NULL) {
2681  smd = s->sm_arrays[frame->sm_list];
2682  }
2683  switch (smd->type) {
2684  case DETECT_CONTENT: {
2685  const DetectContentData *cd = (const DetectContentData *)smd->ctx;
2686 
2687  DetectPatternTracker lookup = {
2688  .cd = cd, .sm_list = frame->sm_list, .cnt = 0, .mpm = 0
2689  };
2690  DetectPatternTracker *res =
2692  if (res) {
2693  res->cnt++;
2694  res->mpm += ((cd->flags & DETECT_CONTENT_MPM) != 0);
2695  } else {
2696  DetectPatternTracker *add = SCCalloc(1, sizeof(*add));
2697  BUG_ON(add == NULL);
2698  add->cd = cd;
2699  add->sm_list = frame->sm_list;
2700  add->cnt = 1;
2701  add->mpm = ((cd->flags & DETECT_CONTENT_MPM) != 0);
2702  HashListTableAdd(de_ctx->pattern_hash_table, (void *)add, 0);
2703  }
2704  break;
2705  }
2706  }
2707  if (smd->is_last)
2708  break;
2709  smd++;
2710  } while (1);
2711  }
2712 }
MpmInitThreadCtx
void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t matcher)
Definition: util-mpm.c:195
DETECT_CONTENT_NOCASE
#define DETECT_CONTENT_NOCASE
Definition: detect-content.h:29
SignatureHasPacketContent
int SignatureHasPacketContent(const Signature *s)
check if a signature has patterns that are to be inspected against a packets payload (as opposed to t...
Definition: detect-engine-mpm.c:853
DetectEngineCtx_::pkt_mpms_list_cnt
uint32_t pkt_mpms_list_cnt
Definition: detect.h:1090
HashListTableGetListData
#define HashListTableGetListData(hb)
Definition: util-hashlist.h:56
DetectEngineCtx_::frame_mpms_list_cnt
uint32_t frame_mpms_list_cnt
Definition: detect.h:1093
DetectContentData_::offset
uint16_t offset
Definition: detect-content.h:107
SignatureInitData_::max_content_list_id
uint32_t max_content_list_id
Definition: detect.h:653
PrefilterGenericMpmPktRegister
int PrefilterGenericMpmPktRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-prefilter.c:1720
DetectAppLayerMpmMultiRegister
void DetectAppLayerMpmMultiRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionMultiBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
Definition: detect-engine-mpm.c:168
DetectPatternTracker
Definition: detect.h:808
SCFPSupportSMList_
Definition: detect.h:839
DetectEngineAppInspectionEngine_
Definition: detect.h:416
util-hash-string.h
MPMB_UDP_TS
@ MPMB_UDP_TS
Definition: detect.h:1500
SignatureInitDataBuffer_::head
SigMatch * head
Definition: detect.h:534
detect-content.h
SGH_DIRECTION_TC
#define SGH_DIRECTION_TC(sgh)
Definition: detect-engine-mpm.c:1055
MpmCtx_::mpm_type
uint8_t mpm_type
Definition: util-mpm.h:97
detect-engine.h
DETECT_SM_LIST_PMATCH
@ DETECT_SM_LIST_PMATCH
Definition: detect.h:119
DetectBufferMpmRegistry_::direction
int direction
Definition: detect.h:765
DETECT_CONTENT_FAST_PATTERN_CHOP
#define DETECT_CONTENT_FAST_PATTERN_CHOP
Definition: detect-content.h:36
SignatureInitData_::smlists
struct SigMatch_ * smlists[DETECT_SM_LIST_MAX]
Definition: detect.h:642
PatternMatchDestroy
void PatternMatchDestroy(MpmCtx *mpm_ctx, uint16_t mpm_matcher)
Definition: detect-engine-mpm.c:957
MpmStore_::sid_array_size
uint32_t sid_array_size
Definition: detect.h:1508
DetectContentData_::fp_chop_len
uint16_t fp_chop_len
Definition: detect-content.h:98
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:79
MpmStore_::sid_array
uint8_t * sid_array
Definition: detect.h:1507
DetectEngineCtx_::sgh_mpm_context_proto_tcp_packet
int32_t sgh_mpm_context_proto_tcp_packet
Definition: detect.h:1004
PatternMatchPrepareGroup
int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
Prepare the pattern matcher ctx in a sig group head.
Definition: detect-engine-mpm.c:2318
SCFPSupportSMList_::next
struct SCFPSupportSMList_ * next
Definition: detect.h:842
DetectEnginePktInspectionEngine
Definition: detect.h:483
ALPROTO_DNS
@ ALPROTO_DNS
Definition: app-layer-protos.h:47
DetectEngineAppInspectionEngine_::next
struct DetectEngineAppInspectionEngine_ * next
Definition: detect.h:441
detect-engine-siggroup.h
SigGroupHead_::flags
uint16_t flags
Definition: detect.h:1628
SCFPSupportSMList_::list_id
int list_id
Definition: detect.h:840
SigTableElmt_::name
const char * name
Definition: detect.h:1457
MpmStoreFree
void MpmStoreFree(DetectEngineCtx *de_ctx)
Frees the hash table - DetectEngineCtx->mpm_hash_table, allocated by MpmStoreInit() function.
Definition: detect-engine-mpm.c:1619
DetectFrameMpmRegisterByParentId
void DetectFrameMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Definition: detect-engine-mpm.c:414
MpmThreadCtx_
Definition: util-mpm.h:48
DetectPatternTracker::mpm
uint32_t mpm
Definition: detect.h:812
DETECT_ABSENT
@ DETECT_ABSENT
Definition: detect-engine-register.h:95
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1627
DetectEngineCtx_::pattern_hash_table
HashListTable * pattern_hash_table
Definition: detect.h:965
DetectEngineTransforms
Definition: detect.h:391
DetectBufferMpmRegistry_::sm_list_base
int16_t sm_list_base
Definition: detect.h:767
MpmFactoryReClaimMpmCtx
void MpmFactoryReClaimMpmCtx(const DetectEngineCtx *de_ctx, MpmCtx *mpm_ctx)
Definition: util-mpm.c:156
DETECT_CONTENT
@ DETECT_CONTENT
Definition: detect-engine-register.h:69
MpmStoreReportStats
void MpmStoreReportStats(const DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:1522
Signature_::alproto
AppProto alproto
Definition: detect.h:673
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:279
MPMB_OTHERIP
@ MPMB_OTHERIP
Definition: detect.h:1502
DetectPktMpmRegister
void DetectPktMpmRegister(const char *name, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), InspectionBufferGetPktDataPtr GetData)
register a MPM engine
Definition: detect-engine-mpm.c:598
SigMatchData_::is_last
bool is_last
Definition: detect.h:367
DetectBufferTypeSupportsFrames
void DetectBufferTypeSupportsFrames(const char *name)
Definition: detect-engine.c:1238
DetectMpmInitializeFrameMpms
void DetectMpmInitializeFrameMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:518
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:86
DETECT_SM_LIST_DYNAMIC_START
@ DETECT_SM_LIST_DYNAMIC_START
Definition: detect.h:138
SigMatchData_::ctx
SigMatchCtx * ctx
Definition: detect.h:368
DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED
#define DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED
Definition: detect-content.h:55
MpmStore_::sm_list
int sm_list
Definition: detect.h:1512
PatternStrength
uint32_t PatternStrength(uint8_t *pat, uint16_t patlen)
Predict a strength value for patterns.
Definition: detect-engine-mpm.c:987
DetectEngineCtx_::pkt_mpms_list
DetectBufferMpmRegistry * pkt_mpms_list
Definition: detect.h:1089
DETECT_BUFFER_MPM_TYPE_FRAME
@ DETECT_BUFFER_MPM_TYPE_FRAME
Definition: detect.h:756
DetectSetFastPatternAndItsId
int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx)
Figure out the FP and their respective content ids for all the sigs in the engine.
Definition: detect-engine-mpm.c:2509
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:40
ctx
struct Thresholds ctx
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:932
DetectEnginePktInspectionEngine::smd
SigMatchData * smd
Definition: detect.h:484
SCConfGet
int SCConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:350
util-memcpy.h
DETECT_CONTENT_MPM_IS_CONCLUSIVE
#define DETECT_CONTENT_MPM_IS_CONCLUSIVE(c)
Definition: detect-content.h:78
HashListTableGetListHead
HashListTableBucket * HashListTableGetListHead(HashListTable *ht)
Definition: util-hashlist.c:287
DETECT_CONTENT_DEPTH_VAR
#define DETECT_CONTENT_DEPTH_VAR
Definition: detect-content.h:46
ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE
@ ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE
Definition: detect.h:1184
DetectEngineCtx_::mpm_cfg
MpmConfig * mpm_cfg
Definition: detect.h:936
InspectionBufferGetPktDataPtr
InspectionBuffer *(* InspectionBufferGetPktDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Packet *p, const int list_id)
Definition: detect.h:478
DetectEngineBufferTypeGetNameById
const char * DetectEngineBufferTypeGetNameById(const DetectEngineCtx *de_ctx, const int id)
Definition: detect-engine.c:1308
DetectMpmInitializeBuiltinMpms
void DetectMpmInitializeBuiltinMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:783
DetectBufferMpmRegistry_::next
struct DetectBufferMpmRegistry_ * next
Definition: detect.h:804
SIG_FLAG_REQUIRE_STREAM
#define SIG_FLAG_REQUIRE_STREAM
Definition: detect.h:255
DetectPatternTracker::cnt
uint32_t cnt
Definition: detect.h:811
SIG_FLAG_TXBOTHDIR
#define SIG_FLAG_TXBOTHDIR
Definition: detect.h:250
SCConfGetBool
int SCConfGetBool(const char *name, int *val)
Retrieve a configuration value as a boolean.
Definition: conf.c:497
DetectBufferMpmRegistry_
one time registration of keywords at start up
Definition: detect.h:762
DE_QUIET
#define DE_QUIET
Definition: detect.h:330
MpmCtx_::maxlen
uint16_t maxlen
Definition: util-mpm.h:107
MPMB_TCP_STREAM_TS
@ MPMB_TCP_STREAM_TS
Definition: detect.h:1498
DetectPatternTracker::cd
const struct DetectContentData_ * cd
Definition: detect.h:809
PatIntId
#define PatIntId
Definition: suricata-common.h:335
SIG_GROUP_HEAD_HAVERAWSTREAM
#define SIG_GROUP_HEAD_HAVERAWSTREAM
Definition: detect.h:1486
MpmTableElmt_::feature_flags
uint8_t feature_flags
Definition: util-mpm.h:186
mpm_default_matcher
uint8_t mpm_default_matcher
Definition: util-mpm.c:48
Signature_::sm_arrays
SigMatchData * sm_arrays[DETECT_SM_LIST_MAX]
Definition: detect.h:731
DetectContentData_
Definition: detect-content.h:93
DetectContentData_::fp_chop_offset
uint16_t fp_chop_offset
Definition: detect-content.h:100
HashListTableLookup
void * HashListTableLookup(HashListTable *ht, void *data, uint16_t datalen)
Definition: util-hashlist.c:245
detect-engine-payload.h
SIG_FLAG_TOCLIENT
#define SIG_FLAG_TOCLIENT
Definition: detect.h:272
MAX
#define MAX(x, y)
Definition: suricata-common.h:412
MPMB_MAX
@ MPMB_MAX
Definition: detect.h:1503
SigMatchData_
Data needed for Match()
Definition: detect.h:365
DetectEngineCtx_::sgh_mpm_context_proto_udp_packet
int32_t sgh_mpm_context_proto_udp_packet
Definition: detect.h:1005
DetectBufferMpmRegistry_::transforms
DetectEngineTransforms transforms
Definition: detect.h:775
ShortenString
void ShortenString(const char *input, char *output, size_t output_size, char c)
Definition: util-misc.c:208
SigMatchData_::type
uint16_t type
Definition: detect.h:366
DetectEngineRegisterFastPatternForId
void DetectEngineRegisterFastPatternForId(DetectEngineCtx *de_ctx, int list_id, int priority)
Definition: detect-fast-pattern.c:134
SidsArray
Definition: detect-engine-mpm.c:1860
MPMB_TCP_STREAM_TC
@ MPMB_TCP_STREAM_TC
Definition: detect.h:1499
detect-engine-prefilter.h
EngineAnalysisAddAllRulePatterns
void EngineAnalysisAddAllRulePatterns(DetectEngineCtx *de_ctx, const Signature *s)
add all patterns on our stats hash Used to fill the hash later used by DumpPatterns()
Definition: detect-engine-mpm.c:2566
Signature_::frame_inspect
DetectEngineFrameInspectionEngine * frame_inspect
Definition: detect.h:727
MpmBuiltinBuffers
MpmBuiltinBuffers
Definition: detect.h:1495
MpmConfig_::cache_dir_path
const char * cache_dir_path
Definition: util-mpm.h:92
DetectBufferTypeGetByName
int DetectBufferTypeGetByName(const char *name)
Definition: detect-engine.c:1278
HashListTableAdd
int HashListTableAdd(HashListTable *ht, void *data, uint16_t datalen)
Definition: util-hashlist.c:114
detect-udphdr.h
strlcpy
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
HashListTable_::array_size
uint32_t array_size
Definition: util-hashlist.h:41
DetectAppLayerMpmRegisterByParentId
void DetectAppLayerMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Definition: detect-engine-mpm.c:245
util-memcmp.h
SigGroupHeadInitData_::pkt_mpms
MpmCtx ** pkt_mpms
Definition: detect.h:1610
MpmInitCtx
void MpmInitCtx(MpmCtx *mpm_ctx, uint8_t matcher)
Definition: util-mpm.c:209
Signature_::next
struct Signature_ * next
Definition: detect.h:750
DetectEngineCtx_::sgh_mpm_context_proto_other_packet
int32_t sgh_mpm_context_proto_other_packet
Definition: detect.h:1006
DetectEngineAppInspectionEngine_::sm_list
uint16_t sm_list
Definition: detect.h:424
DetectBufferInstance::alproto
AppProto alproto
Definition: detect-engine-mpm.c:2027
HashListTableGetListNext
#define HashListTableGetListNext(hb)
Definition: util-hashlist.h:55
DetectBufferMpmType
DetectBufferMpmType
Definition: detect.h:753
SIG_FLAG_TOSERVER
#define SIG_FLAG_TOSERVER
Definition: detect.h:271
HashListTableInit
HashListTable * HashListTableInit(uint32_t size, uint32_t(*Hash)(struct HashListTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
Definition: util-hashlist.c:35
decode.h
MpmDestroyThreadCtx
void MpmDestroyThreadCtx(MpmThreadCtx *mpm_thread_ctx, const uint16_t matcher)
Definition: util-mpm.c:202
util-debug.h
DetectBufferInstance::ts
struct SidsArray ts
Definition: detect-engine-mpm.c:2029
SigGroupHeadInitData_::sig_cnt
SigIntId sig_cnt
Definition: detect.h:1620
SidsArray::sids_array_size
uint32_t sids_array_size
Definition: detect-engine-mpm.c:1862
DETECT_CONTENT_ENDS_WITH
#define DETECT_CONTENT_ENDS_WITH
Definition: detect-content.h:42
DetectBufferMpmRegistry_::sgh_mpm_context
int sgh_mpm_context
Definition: detect.h:771
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:18
MpmFactoryGetMpmCtxForProfile
MpmCtx * MpmFactoryGetMpmCtxForProfile(const DetectEngineCtx *de_ctx, int32_t id, int direction)
Definition: util-mpm.c:131
DetectEnginePktInspectionEngine::sm_list
uint16_t sm_list
Definition: detect.h:486
g_alproto_max
AppProto g_alproto_max
Definition: app-layer-protos.c:29
DetectMpmInitializePktMpms
void DetectMpmInitializePktMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:685
MPM_PATTERN_CTX_OWNS_ID
#define MPM_PATTERN_CTX_OWNS_ID
Definition: util-mpm.h:145
strlcat
size_t strlcat(char *, const char *src, size_t siz)
Definition: util-strlcatu.c:45
MpmStore_
Definition: detect.h:1506
SignatureInitData_::mpm_sm
SigMatch * mpm_sm
Definition: detect.h:623
DetectBufferMpmRegistry_::sm_list
int16_t sm_list
Definition: detect.h:766
DetectEngineGetMaxSigId
#define DetectEngineGetMaxSigId(de_ctx)
Definition: detect-engine.h:92
SignatureInitData_::mpm_sm_list
int mpm_sm_list
Definition: detect.h:621
SidsArray::sids_array
uint8_t * sids_array
Definition: detect-engine-mpm.c:1861
SCMpmAddPatternCI
int SCMpmAddPatternCI(MpmCtx *mpm_ctx, const uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:258
DETECT_CONTENT_DEPTH
#define DETECT_CONTENT_DEPTH
Definition: detect-content.h:33
Signature_::pkt_inspect
DetectEnginePktInspectionEngine * pkt_inspect
Definition: detect.h:726
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:281
detect-engine-mpm.h
detect.h
DetectEngineFrameInspectionEngine::sm_list
uint16_t sm_list
Definition: detect.h:513
InspectionSingleBufferGetDataPtr
bool(* InspectionSingleBufferGetDataPtr)(const void *txv, const uint8_t flow_flags, const uint8_t **buf, uint32_t *buf_len)
Definition: detect-engine-helper.h:45
SigMatch_::next
struct SigMatch_ * next
Definition: detect.h:360
DetectEngineCtx_::mpm_matcher
uint8_t mpm_matcher
Definition: detect.h:935
DETECT_CONTENT_IS_SINGLE
#define DETECT_CONTENT_IS_SINGLE(c)
Definition: detect-content.h:68
DETECT_CONTENT_NEGATED
#define DETECT_CONTENT_NEGATED
Definition: detect-content.h:40
PrefilterGenericMpmRegister
int PrefilterGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-prefilter.c:1577
DetectBufferMpmRegistry_::priority
int priority
Definition: detect.h:768
PatternMatchThreadPrepare
void PatternMatchThreadPrepare(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
Definition: detect-engine-mpm.c:968
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:259
DetectEngineBufferTypeRegister
int DetectEngineBufferTypeRegister(DetectEngineCtx *de_ctx, const char *name)
Definition: detect-engine.c:1365
SigGroupHead_::init
SigGroupHeadInitData * init
Definition: detect.h:1644
DetectContentData_::id
PatIntId id
Definition: detect-content.h:105
DetectAppLayerMpmRegister
void DetectAppLayerMpmRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
register an app layer keyword for mpm
Definition: detect-engine-mpm.c:152
Signature_::app_inspect
DetectEngineAppInspectionEngine * app_inspect
Definition: detect.h:725
MpmCtx_::minlen
uint16_t minlen
Definition: util-mpm.h:106
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:359
DetectProto_::proto
uint8_t proto[256/8]
Definition: detect-engine-proto.h:36
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:317
MpmStore_::direction
int direction
Definition: detect.h:1510
DetectBufferToClient
bool DetectBufferToClient(const DetectEngineCtx *de_ctx, int buf_id, AppProto alproto)
Definition: detect-engine-mpm.c:1124
MPMCTX_FLAGS_GLOBAL
#define MPMCTX_FLAGS_GLOBAL
Definition: util-mpm.h:87
PrefilterRegisterFunc
int(* PrefilterRegisterFunc)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-mpm.h:72
Signature_::flags
uint32_t flags
Definition: detect.h:669
DetectContentData_::depth
uint16_t depth
Definition: detect-content.h:106
stream.h
MpmFactoryRegisterMpmCtxProfile
int32_t MpmFactoryRegisterMpmCtxProfile(DetectEngineCtx *de_ctx, const char *name, const int sm_list, const AppProto alproto)
Register a new Mpm Context.
Definition: util-mpm.c:59
DetectEngineCtx_::sgh_mpm_context_stream
int32_t sgh_mpm_context_stream
Definition: detect.h:1007
type
uint16_t type
Definition: decode-vlan.c:106
DetectEngineBufferTypeSupportsFrames
void DetectEngineBufferTypeSupportsFrames(DetectEngineCtx *de_ctx, const char *name)
Definition: detect-engine.c:1395
DetectEngineCtx_::frame_mpms_list
DetectBufferMpmRegistry * frame_mpms_list
Definition: detect.h:1092
conf.h
DetectEngineCtx_::sgh_mpm_ctx_cnf
uint8_t sgh_mpm_ctx_cnf
Definition: detect.h:1033
DetectContentData_::flags
uint32_t flags
Definition: detect-content.h:104
PrefilterPktPayloadRegister
int PrefilterPktPayloadRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx)
Definition: detect-engine-payload.c:132
MpmStore_::alproto
AppProto alproto
Definition: detect.h:1514
DetectEngineFrameInspectionEngine
Definition: detect.h:508
DETECT_BUFFER_MPM_TYPE_PKT
@ DETECT_BUFFER_MPM_TYPE_PKT
Definition: detect.h:754
ALPROTO_DOH2
@ ALPROTO_DOH2
Definition: app-layer-protos.h:66
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:747
name
const char * name
Definition: tm-threads.c:2163
FastPatternSupportEnabledForSigMatchList
int FastPatternSupportEnabledForSigMatchList(const DetectEngineCtx *de_ctx, const int list_id)
Checks if a particular buffer is in the list of lists that need to be searched for a keyword that has...
Definition: detect-fast-pattern.c:64
SCFPSupportSMList_::priority
int priority
Definition: detect.h:841
HashListTable_
Definition: util-hashlist.h:37
DetectEngineTransforms::transforms
TransformData transforms[DETECT_TRANSFORMS_MAX]
Definition: detect.h:392
ALPROTO_HTTP2
@ ALPROTO_HTTP2
Definition: app-layer-protos.h:69
SidsArray::type
enum DetectBufferMpmType type
Definition: detect-engine-mpm.c:1866
SigGroupHeadInitData_::app_mpms
MpmCtx ** app_mpms
Definition: detect.h:1609
MpmAddPatternCS
int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:249
DetectEngineBufferTypeSupportsTransformations
void DetectEngineBufferTypeSupportsTransformations(DetectEngineCtx *de_ctx, const char *name)
Definition: detect-engine.c:1419
InspectionMultiBufferGetDataPtr
bool(* InspectionMultiBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const void *txv, const uint8_t flow_flags, uint32_t local_id, const uint8_t **buf, uint32_t *buf_len)
Definition: detect-engine-helper.h:42
SGH_DIRECTION_TS
#define SGH_DIRECTION_TS(sgh)
Definition: detect-engine-mpm.c:1054
DetectEngineAppInspectionEngine_::alproto
AppProto alproto
Definition: detect.h:417
DetectPatternTracker::sm_list
int sm_list
Definition: detect.h:810
DetectEngineAppInspectionEngine_::smd
SigMatchData * smd
Definition: detect.h:439
DetectBufferInstance
Definition: detect-engine-mpm.c:2024
MpmStore_::mpm_ctx
MpmCtx * mpm_ctx
Definition: detect.h:1515
MPM_FEATURE_FLAG_ENDSWITH
#define MPM_FEATURE_FLAG_ENDSWITH
Definition: util-mpm.h:150
DetectBufferMpmRegistry_::frame_v1
struct DetectBufferMpmRegistry_::@96::@100 frame_v1
detect-fast-pattern.h
MpmStorePrepareBuffer
MpmStore * MpmStorePrepareBuffer(DetectEngineCtx *de_ctx, SigGroupHead *sgh, enum MpmBuiltinBuffers buf)
Get MpmStore for a built-in buffer type.
Definition: detect-engine-mpm.c:1727
MPMB_TCP_PKT_TC
@ MPMB_TCP_PKT_TC
Definition: detect.h:1497
cnt
uint32_t cnt
Definition: tmqh-packetpool.h:7
DetectMpmPrepareFrameMpms
int DetectMpmPrepareFrameMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
Definition: detect-engine-mpm.c:570
DetectEngineFrameMpmRegister
void DetectEngineFrameMpmRegister(DetectEngineCtx *de_ctx, const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), AppProto alproto, uint8_t type)
Definition: detect-engine-mpm.c:455
SignatureHasStreamContent
int SignatureHasStreamContent(const Signature *s)
check if a signature has patterns that are to be inspected against the stream payload (as opposed to ...
Definition: detect-engine-mpm.c:883
util-mpm.h
flags
uint8_t flags
Definition: decode-gre.h:0
Signature_::proto
DetectProto proto
Definition: detect.h:687
DetectBufferMpmRegistry_::type
enum DetectBufferMpmType type
Definition: detect.h:770
MpmStoreInit
int MpmStoreInit(DetectEngineCtx *de_ctx)
Initializes the MpmStore mpm hash table to be used by the detection engine context.
Definition: detect-engine-mpm.c:1456
DetectAppLayerMpmRegisterSingle
void DetectAppLayerMpmRegisterSingle(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionSingleBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
Definition: detect-engine-mpm.c:160
DetectEngineCtx_::app_mpms_list
DetectBufferMpmRegistry * app_mpms_list
Definition: detect.h:1084
suricata-common.h
MpmCtx_::pattern_cnt
uint32_t pattern_cnt
Definition: util-mpm.h:104
DETECT_BUFFER_MPM_TYPE_APP
@ DETECT_BUFFER_MPM_TYPE_APP
Definition: detect.h:755
DetectBufferTypeSupportsMpm
void DetectBufferTypeSupportsMpm(const char *name)
Definition: detect-engine.c:1258
DetectBufferInstance::list
int list
Definition: detect-engine-mpm.c:2026
HashListTableFree
void HashListTableFree(HashListTable *ht)
Definition: util-hashlist.c:88
SigGroupHeadInitData_::match_array
Signature ** match_array
Definition: detect.h:1623
DetectBufferMpmRegistry_::name
const char * name
Definition: detect.h:763
SupportFastPatternForSigMatchList
void SupportFastPatternForSigMatchList(int list_id, int priority)
Lets one add a sm list id to be searched for potential fp supported keywords later.
Definition: detect-fast-pattern.c:129
DetectEngineFrameInspectionEngine::next
struct DetectEngineFrameInspectionEngine * next
Definition: detect.h:521
MPM_TABLE_SIZE
@ MPM_TABLE_SIZE
Definition: util-mpm.h:42
SCLogPerf
#define SCLogPerf(...)
Definition: util-debug.h:238
DetectEnginePktInspectionEngine::next
struct DetectEnginePktInspectionEngine * next
Definition: detect.h:494
DetectContentData_::content
uint8_t * content
Definition: detect-content.h:94
DetectBufferMpmRegistry_::app_v2
struct DetectBufferMpmRegistry_::@96::@98 app_v2
PatternMatchDefaultMatcher
uint8_t PatternMatchDefaultMatcher(void)
Function to return the multi pattern matcher algorithm to be used by the engine, based on the mpm-alg...
Definition: detect-engine-mpm.c:911
FatalError
#define FatalError(...)
Definition: util-debug.h:514
DetectEngineCtx_::sig_list
Signature * sig_list
Definition: detect.h:941
DetectMpmPreparePktMpms
int DetectMpmPreparePktMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
Definition: detect-engine-mpm.c:737
TransformData_::transform
int transform
Definition: detect.h:387
DetectEngineBufferTypeSupportsMpm
void DetectEngineBufferTypeSupportsMpm(DetectEngineCtx *de_ctx, const char *name)
Definition: detect-engine.c:1411
util-validate.h
detect-flow.h
DetectEngineCtx_::app_mpms_list_cnt
uint32_t app_mpms_list_cnt
Definition: detect.h:1083
DetectBufferTypeSupportsTransformations
void DetectBufferTypeSupportsTransformations(const char *name)
Definition: detect-engine.c:1268
MPM_PATTERN_FLAG_ENDSWITH
#define MPM_PATTERN_FLAG_ENDSWITH
Definition: util-mpm.h:146
builtin_mpms
const char * builtin_mpms[]
Definition: detect-engine-mpm.c:66
SignatureInitData_::buffers
SignatureInitDataBuffer * buffers
Definition: detect.h:647
DetectEngineCtx_::app_inspect_engines
DetectEngineAppInspectionEngine * app_inspect_engines
Definition: detect.h:1087
g_skip_prefilter
int g_skip_prefilter
Definition: detect-engine-mpm.c:1121
DetectEngineCtx_::mpm_hash_table
HashListTable * mpm_hash_table
Definition: detect.h:964
MpmTableElmt_::Prepare
int(* Prepare)(MpmConfig *, struct MpmCtx_ *)
Definition: util-mpm.h:177
MPMB_UDP_TC
@ MPMB_UDP_TC
Definition: detect.h:1501
MpmTableElmt_::DestroyCtx
void(* DestroyCtx)(struct MpmCtx_ *)
Definition: util-mpm.h:156
Signature_::iid
SigIntId iid
Definition: detect.h:680
DetectBufferMpmRegistry_::id
int id
Definition: detect.h:769
SigMatchListSMBelongsTo
int SigMatchListSMBelongsTo(const Signature *s, const SigMatch *key_sm)
Definition: detect-parse.c:763
SCFree
#define SCFree(p)
Definition: util-mem.h:61
MPM_CTX_FACTORY_UNIQUE_CONTEXT
#define MPM_CTX_FACTORY_UNIQUE_CONTEXT
Definition: util-mpm.h:120
DetectMpmPrepareBuiltinMpms
int DetectMpmPrepareBuiltinMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for builtin buffers that are in "single or "shared" mode.
Definition: detect-engine-mpm.c:796
Signature_::id
uint32_t id
Definition: detect.h:713
DETECT_CONTENT_OFFSET
#define DETECT_CONTENT_OFFSET
Definition: detect-content.h:32
HashListTableBucket_
Definition: util-hashlist.h:28
DetectBufferMpmRegistry_::PrefilterRegisterWithListId
int(* PrefilterRegisterWithListId)(struct DetectEngineCtx_ *de_ctx, struct SigGroupHead_ *sgh, MpmCtx *mpm_ctx, const struct DetectBufferMpmRegistry_ *mpm_reg, int list_id)
Definition: detect.h:773
detect-tcphdr.h
DETECT_CONTENT_MPM
#define DETECT_CONTENT_MPM
Definition: detect-content.h:61
detect-engine-iponly.h
detect-parse.h
SignatureInitDataBuffer_::id
uint32_t id
Definition: detect.h:525
Signature_
Signature container.
Definition: detect.h:668
SigMatch_
a single match condition for a signature
Definition: detect.h:356
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
MPMB_TCP_PKT_TS
@ MPMB_TCP_PKT_TS
Definition: detect.h:1496
mpm_table
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
Definition: util-mpm.c:47
app-layer-protos.h
DetectMpmInitializeAppMpms
void DetectMpmInitializeAppMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:291
DetectEngineTransforms::cnt
int cnt
Definition: detect.h:393
suricata.h
DetectEngineCtx_::sig_array
Signature ** sig_array
Definition: detect.h:950
InspectionBufferGetDataPtr
InspectionBuffer *(* InspectionBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id)
Definition: detect-engine-helper.h:39
DetectEngineAppInspectionEngine_::dir
uint8_t dir
Definition: detect.h:418
DETECT_BUFFER_MPM_TYPE_SIZE
@ DETECT_BUFFER_MPM_TYPE_SIZE
Definition: detect.h:758
DetectContentData_::content_len
uint16_t content_len
Definition: detect-content.h:95
DetectBufferInstance::tc
struct SidsArray tc
Definition: detect-engine-mpm.c:2030
SignatureInitDataBuffer_::only_tc
bool only_tc
Definition: detect.h:531
DetectEngineCtx_::buffer_type_id
uint32_t buffer_type_id
Definition: detect.h:1081
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:934
MpmCtx_
Definition: util-mpm.h:95
SGH_PROTO
#define SGH_PROTO(sgh, p)
Definition: detect-engine-mpm.c:1053
DETECT_CONTENT_REPLACE
#define DETECT_CONTENT_REPLACE
Definition: detect-content.h:51
util-misc.h
flow.h
MpmCtx_::flags
uint8_t flags
Definition: util-mpm.h:99
DetectPktMpmRegisterByParentId
void DetectPktMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Definition: detect-engine-mpm.c:645
DETECT_CONTENT_FAST_PATTERN
#define DETECT_CONTENT_FAST_PATTERN
Definition: detect-content.h:34
MPMCTX_FLAGS_CACHE_TO_DISK
#define MPMCTX_FLAGS_CACHE_TO_DISK
Definition: util-mpm.h:89
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
DetectFrameMpmRegister
void DetectFrameMpmRegister(const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), AppProto alproto, uint8_t type)
register a MPM engine
Definition: detect-engine-mpm.c:366
util-enum.h
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:285
DetectBufferInstance
struct DetectBufferInstance DetectBufferInstance
SidsArray::active
bool active
Definition: detect-engine-mpm.c:1864
SignatureInitData_::buffer_index
uint32_t buffer_index
Definition: detect.h:648
flow-var.h
SCMemcmp
#define SCMemcmp(a, b, c)
Definition: util-memcmp.h:290
DetectMpmPrepareAppMpms
int DetectMpmPrepareAppMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
Definition: detect-engine-mpm.c:341
DetectEngineCtx_::fp_support_smlist_list
SCFPSupportSMList * fp_support_smlist_list
Definition: detect.h:1106
MpmStore_::sgh_mpm_context
int32_t sgh_mpm_context
Definition: detect.h:1513
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
DetectBufferMpmRegistry_::pkt_v1
struct DetectBufferMpmRegistry_::@96::@99 pkt_v1
PatternMatchThreadDestroy
void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
Definition: detect-engine-mpm.c:963
MpmStore_::buffer
enum MpmBuiltinBuffers buffer
Definition: detect.h:1511
RetrieveFPForSig
void RetrieveFPForSig(const DetectEngineCtx *de_ctx, Signature *s)
Definition: detect-engine-mpm.c:1143
StringHashDjb2
uint32_t StringHashDjb2(const uint8_t *data, uint32_t datalen)
Definition: util-hash-string.c:22
PrefilterPktStreamRegister
int PrefilterPktStreamRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx)
Definition: detect-engine-payload.c:109
DETECT_CONTENT_OFFSET_VAR
#define DETECT_CONTENT_OFFSET_VAR
Definition: detect-content.h:45
SigGroupHeadInitData_::frame_mpms
MpmCtx ** frame_mpms
Definition: detect.h:1611
DetectBufferMpmRegistry_::pname
char pname[32]
Definition: detect.h:764
SIG_FLAG_REQUIRE_PACKET
#define SIG_FLAG_REQUIRE_PACKET
Definition: detect.h:254
DetectEngineFrameInspectionEngine::smd
SigMatchData * smd
Definition: detect.h:520