Go to the documentation of this file.
67 "toserver TCP packet",
68 "toclient TCP packet",
69 "toserver TCP stream",
70 "toclient TCP stream",
71 "toserver UDP packet",
72 "toclient UDP packet",
89 static void RegisterInternal(
const char *
name,
int direction,
int priority,
94 SCLogDebug(
"registering %s/%d/%d/%p/%p/%u/%d",
name, direction, priority,
95 PrefilterRegister, GetData, alproto, tx_min_progress);
97 BUG_ON(tx_min_progress >= 48);
111 RegisterInternal(
name, direction, priority, PrefilterRegister, GetData, GetDataSingle,
120 am->
sm_list = (int16_t)sm_list;
126 if (GetData != NULL) {
127 am->
app_v2.GetData = GetData;
128 }
else if (GetDataSingle != NULL) {
129 am->
app_v2.GetDataSingle = GetDataSingle;
130 }
else if (GetMultiData != NULL) {
131 am->
app_v2.GetMultiData = GetMultiData;
133 am->
app_v2.alproto = alproto;
134 am->
app_v2.tx_min_progress = tx_min_progress;
140 while (t->
next != NULL) {
154 AppProto alproto,
int tx_min_progress)
156 RegisterInternal(
name, direction, priority, PrefilterRegister, GetData, NULL, NULL, alproto,
162 AppProto alproto,
int tx_min_progress)
164 RegisterInternal(
name, direction, priority, PrefilterRegister, NULL, GetData, NULL, alproto,
170 AppProto alproto,
int tx_min_progress)
172 RegisterInternal(
name, direction, priority, PrefilterRegister, NULL, NULL, GetData, alproto,
179 static void BuildBasicPname(
char *out,
const size_t out_size,
const char *
name,
const uint16_t
id)
192 size_t name_space = out_size - (id_space + 1);
193 char pname[name_space];
194 if (strlen(
name) >= name_space) {
197 snprintf(pname,
sizeof(pname),
"%s",
name);
199 snprintf(out, out_size,
"%s#%u", pname,
id);
207 static void AppendTransformsToPname(
210 if (transforms == NULL || transforms->
cnt == 0)
216 char xforms[1024] =
"";
217 for (
int i = 0; i < transforms->
cnt; i++) {
219 (void)snprintf(ttstr,
sizeof(ttstr),
"%s,",
221 strlcat(xforms, ttstr,
sizeof(xforms));
223 xforms[strlen(xforms) - 1] =
'\0';
225 ssize_t left = (ssize_t)out_size - (ssize_t)strlen(out) - (ssize_t)4;
226 SCLogDebug(
"left %d '%s' %d", (
int)left, xforms, (
int)strlen(xforms));
229 char xforms_print[out_size];
230 if ((
size_t)left >= strlen(xforms)) {
231 snprintf(xforms_print,
sizeof(xforms_print),
" (%s)", xforms);
233 char xforms_short[out_size];
235 snprintf(xforms_print,
sizeof(xforms_print),
" (%s)", xforms_short);
237 strlcat(out, xforms_print, out_size);
243 const int id,
const int parent_id,
246 SCLogDebug(
"registering %d/%d",
id, parent_id);
269 BuildBasicPname(am->
pname,
sizeof(am->
pname), am->
name, (uint16_t)
id);
271 memcpy(&am->
transforms, transforms,
sizeof(*transforms));
272 AppendTransformsToPname(am->
pname,
sizeof(am->
pname), transforms);
279 SCLogDebug(
"copied mpm registration for %s id %u "
280 "with parent %u and GetData %p",
292 while (list != NULL) {
312 char confstring[256] =
"detect.mpm.";
314 strlcat(confstring,
".shared",
sizeof(confstring));
348 if (mpm_ctx != NULL) {
368 SCLogDebug(
"registering %s/%d/%p/%s/%u",
name, priority, PrefilterRegister,
375 if (sm_list < 0 || sm_list > UINT16_MAX) {
383 am->
sm_list = (uint16_t)sm_list;
398 while (t->
next != NULL) {
414 SCLogDebug(
"registering %d/%d",
id, parent_id);
434 BuildBasicPname(am->
pname,
sizeof(am->
pname), am->
name, (uint16_t)
id);
436 memcpy(&am->
transforms, transforms,
sizeof(*transforms));
437 AppendTransformsToPname(am->
pname,
sizeof(am->
pname), transforms);
443 SCLogDebug(
"copied mpm registration for %s id %u "
445 t->
name,
id, parent_id);
458 SCLogDebug(
"registering %s/%d/%p/%s/%u",
name, priority, PrefilterRegister,
462 if (sm_list < 0 || sm_list > UINT16_MAX) {
474 am->
sm_list = (uint16_t)sm_list;
489 if (
SCConfGetBool(
"detect.mpm.frame.shared", &confshared) == 1)
503 while (t->
next != NULL) {
518 while (list != NULL) {
529 while (t->
next != NULL) {
541 char confstring[256] =
"detect.mpm.";
543 strlcat(confstring,
".shared",
sizeof(confstring));
579 if (mpm_ctx != NULL) {
601 PrefilterRegister, GetData);
618 am->
sm_list = (uint16_t)sm_list;
623 am->
pkt_v1.GetData = GetData;
629 while (t->
next != NULL) {
643 const int id,
const int parent_id,
646 SCLogDebug(
"registering %d/%d",
id, parent_id);
664 BuildBasicPname(am->
pname,
sizeof(am->
pname), am->
name, (uint16_t)
id);
666 memcpy(&am->
transforms, transforms,
sizeof(*transforms));
667 AppendTransformsToPname(am->
pname,
sizeof(am->
pname), transforms);
673 SCLogDebug(
"copied mpm registration for %s id %u "
674 "with parent %u and GetData %p",
685 while (list != NULL) {
696 while (t->
next != NULL) {
708 char confstring[256] =
"detect.mpm.";
710 strlcat(confstring,
".shared",
sizeof(confstring));
744 if (mpm_ctx != NULL) {
763 char confstring[256] =
"detect.mpm.";
765 strlcat(confstring,
".shared",
sizeof(confstring));
854 if (!(s->
proto.
proto[IPPROTO_TCP / 8] & 1 << (IPPROTO_TCP % 8))) {
884 if (!(s->
proto.
proto[IPPROTO_TCP / 8] & 1 << (IPPROTO_TCP % 8))) {
910 const char *mpm_algo;
914 if ((
SCConfGet(
"mpm-algo", &mpm_algo)) == 1) {
915 if (mpm_algo != NULL) {
916 #if __BYTE_ORDER == __BIG_ENDIAN
917 if (strcmp(mpm_algo,
"ac-ks") == 0) {
919 "not work on big endian systems at this time.");
922 if (strcmp(
"auto", mpm_algo) == 0) {
924 }
else if (strcmp(
"ac-bs", mpm_algo) == 0) {
925 SCLogWarning(
"mpm-algo \"ac-bs\" has been removed. See ticket #6586.");
938 #ifndef BUILD_HYPERSCAN
939 if ((strcmp(mpm_algo,
"hs") == 0)) {
940 FatalError(
"Hyperscan (hs) support for mpm-algo is "
941 "not compiled into Suricata.");
946 "in the yaml conf file: \"%s\"",
956 SCLogDebug(
"mpm_ctx %p, mpm_matcher %"PRIu16
"", mpm_ctx, mpm_matcher);
962 SCLogDebug(
"mpm_thread_ctx %p, mpm_matcher %"PRIu16
"", mpm_thread_ctx, mpm_matcher);
967 SCLogDebug(
"mpm_thread_ctx %p, type %"PRIu16, mpm_thread_ctx, mpm_matcher);
987 memset(&a, 0 ,
sizeof(a));
991 for (u = 0; u < patlen; u++) {
992 if (a[pat[u]] == 0) {
995 else if (isprint(pat[u]) || pat[u] == 0x00 || pat[u] == 0x01 || pat[u] == 0xFF)
1012 uint16_t pat_offset = cd->
offset;
1013 uint16_t pat_depth = cd->
depth;
1016 if (chop && (pat_depth || pat_offset)) {
1028 pat_depth = pat_offset = 0;
1050 #define SGH_PROTO(sgh, p) ((sgh)->init->protos[(p)] == 1)
1051 #define SGH_DIRECTION_TS(sgh) ((sgh)->init->direction & SIG_FLAG_TOSERVER)
1052 #define SGH_DIRECTION_TC(sgh) ((sgh)->init->direction & SIG_FLAG_TOCLIENT)
1056 if (s == NULL || mpm_sm == NULL)
1082 uint16_t max_len,
bool skip_negated_content)
1097 if (mpm_sm == NULL) {
1106 }
else if (ls == ss) {
1125 for (; app != NULL; app = app->
next) {
1128 if (app->
dir == 1) {
1149 int pos_sm_list[nlists];
1150 int neg_sm_list[nlists];
1151 memset(pos_sm_list, 0, nlists *
sizeof(
int));
1152 memset(neg_sm_list, 0, nlists *
sizeof(
int));
1153 int pos_sm_list_cnt = 0;
1154 int neg_sm_list_cnt = 0;
1203 SetMpm(s, sm, list_id);
1208 neg_sm_list[list_id] = 1;
1211 pos_sm_list[list_id] = 1;
1219 SCLogDebug(
"neg_sm_list_cnt %d pos_sm_list_cnt %d", neg_sm_list_cnt, pos_sm_list_cnt);
1222 int *curr_sm_list = NULL;
1223 int skip_negated_content = 1;
1224 if (pos_sm_list_cnt > 0) {
1225 curr_sm_list = pos_sm_list;
1226 }
else if (neg_sm_list_cnt > 0) {
1227 curr_sm_list = neg_sm_list;
1228 skip_negated_content = 0;
1233 int final_sm_list[nlists];
1234 memset(&final_sm_list, 0, (nlists *
sizeof(
int)));
1236 int count_final_sm_list = 0;
1237 int count_txbidir_toclient_sm_list = 0;
1241 while (tmp != NULL) {
1243 tmp != NULL && priority == tmp->
priority;
1249 if (curr_sm_list[tmp->
list_id] == 0)
1254 if (count_final_sm_list == 0) {
1256 final_sm_list[count_txbidir_toclient_sm_list++] = tmp->
list_id;
1262 final_sm_list[count_final_sm_list++] = tmp->
list_id;
1265 if (count_final_sm_list != 0)
1271 count_final_sm_list = count_txbidir_toclient_sm_list;
1273 BUG_ON(count_final_sm_list == 0);
1274 SCLogDebug(
"count_final_sm_list %d skip_negated_content %d", count_final_sm_list,
1275 skip_negated_content);
1277 uint16_t max_len = 0;
1278 for (
int i = 0; i < count_final_sm_list; i++) {
1279 SCLogDebug(
"i %d final_sm_list[i] %d", i, final_sm_list[i]);
1302 if (final_sm_list[i] == list_id) {
1323 int mpm_sm_list = -1;
1324 for (
int i = 0; i < count_final_sm_list; i++) {
1330 skip_negated_content);
1331 if (mpm_sm != prev_mpm_sm) {
1332 mpm_sm_list = final_sm_list[i];
1339 if (final_sm_list[i] == list_id) {
1345 skip_negated_content);
1347 if (mpm_sm != prev_mpm_sm) {
1348 mpm_sm_list = list_id;
1356 if (mpm_sm != NULL) {
1357 BUG_ON(mpm_sm_list == -1);
1359 BUG_ON(check_list != mpm_sm_list);
1363 SetMpm(s, mpm_sm, mpm_sm_list);
1375 static uint32_t MpmStoreHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
1397 static char MpmStoreCompareFunc(
void *data1, uint16_t len1,
void *data2,
1427 static void MpmStoreFreeFunc(
void *ptr)
1457 MpmStoreCompareFunc,
1502 while (am != NULL) {
1510 while (am != NULL) {
1525 uint32_t appstats[app_mpms_cnt + 1];
1526 memset(&appstats, 0x00,
sizeof(appstats));
1528 uint32_t pktstats[pkt_mpms_cnt + 1];
1529 memset(&pktstats, 0x00,
sizeof(pktstats));
1531 uint32_t framestats[frame_mpms_cnt + 1];
1532 memset(&framestats, 0x00,
sizeof(framestats));
1539 if (ms == NULL || ms->
mpm_ctx == NULL) {
1549 SCLogDebug(
"%s: %u patterns. Min %u, Max %u. Ctx %p",
1557 SCLogDebug(
"%s %s %s: %u patterns. Min %u, Max %u. Ctx %p",
1578 for (
int x = 0; x <
MPMB_MAX; x++) {
1582 while (am != NULL) {
1583 if (appstats[am->
sm_list] > 0) {
1586 SCLogPerf(
"AppLayer MPM \"%s %s (%s)\": %u", direction,
name,
1592 while (pm != NULL) {
1593 if (pktstats[pm->
sm_list] > 0) {
1600 while (um != NULL) {
1601 if (framestats[um->
sm_list] > 0) {
1670 const bool mpm_supports_endswith =
1675 if (ms->
sid_array[sig / 8] & (1 << (sig % 8))) {
1695 SCLogDebug(
"not adding negated mpm as it's not 'single'");
1732 uint8_t sids_array[max_sid];
1733 memset(sids_array, 0x00, max_sid);
1734 int sgh_mpm_context = 0;
1799 sids_array[s->
iid / 8] |= 1 << (s->
iid % 8);
1807 sids_array[s->
iid / 8] |= 1 << (s->
iid % 8);
1813 sids_array[s->
iid / 8] |= 1 << (s->
iid % 8);
1817 sids_array[s->
iid / 8] |= 1 << (s->
iid % 8);
1828 MpmStore lookup = { sids_array, max_sid, direction, buf, sm_list, 0, 0, NULL };
1831 if (result == NULL) {
1835 uint8_t *sids =
SCCalloc(1, max_sid);
1841 memcpy(sids, sids_array, max_sid);
1849 MpmStoreSetup(
de_ctx, copy);
1850 MpmStoreAdd(
de_ctx, copy);
1877 0, am->
app_v2.alproto, NULL };
1882 if (result == NULL) {
1904 MpmStoreSetup(
de_ctx, copy);
1905 MpmStoreAdd(
de_ctx, copy);
1928 if (result == NULL) {
1948 MpmStoreSetup(
de_ctx, copy);
1949 MpmStoreAdd(
de_ctx, copy);
1971 if (result == NULL) {
1992 MpmStoreSetup(
de_ctx, copy);
1993 MpmStoreAdd(
de_ctx, copy);
2014 SCLogDebug(
"rule group %p has SIG_GROUP_HEAD_HAVERAWSTREAM set", sgh);
2018 SCLogDebug(
"rule group %p does NOT have SIG_GROUP_HEAD_HAVERAWSTREAM set", sgh);
2030 static uint32_t DetectBufferInstanceHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
2037 static char DetectBufferInstanceCompareFunc(
void *data1, uint16_t len1,
void *data2, uint16_t len2)
2044 static void DetectBufferInstanceFreeFunc(
void *ptr)
2056 return HashListTableInit(4096, DetectBufferInstanceHashFunc, DetectBufferInstanceCompareFunc,
2057 DetectBufferInstanceFreeFunc);
2069 memset(engines, 0,
sizeof(engines));
2070 int engines_idx[max_buffer_id];
2071 memset(engines_idx, 0,
sizeof(engines_idx));
2072 int types[max_buffer_id];
2073 memset(types, 0,
sizeof(types));
2077 types[a->sm_list] = a->type;
2081 if (instance == NULL) {
2082 instance =
SCCalloc(1,
sizeof(*instance));
2083 BUG_ON(instance == NULL);
2084 instance->
list = a->sm_list;
2094 if (add_ts || add_tc) {
2095 types[a->sm_list] = a->type;
2096 engines[a->sm_list][engines_idx[a->sm_list]++] = a->frame_v1.alproto;
2100 if (instance == NULL) {
2101 instance =
SCCalloc(1,
sizeof(*instance));
2102 BUG_ON(instance == NULL);
2103 instance->
list = a->sm_list;
2104 instance->
alproto = a->frame_v1.alproto;
2114 if (add_ts || add_tc) {
2115 types[a->sm_list] = a->type;
2116 engines[a->sm_list][engines_idx[a->sm_list]++] = a->app_v2.alproto;
2120 if (instance == NULL) {
2121 instance =
SCCalloc(1,
sizeof(*instance));
2122 BUG_ON(instance == NULL);
2123 instance->
list = a->sm_list;
2124 instance->
alproto = a->app_v2.alproto;
2132 for (uint32_t sig = 0; sig < sh->
init->
sig_cnt; sig++) {
2144 switch (types[list]) {
2148 for (
int e = 0; e < engines_idx[list]; e++) {
2149 const AppProto alproto = engines[list][e];
2155 if (instance == NULL)
2188 if (instance == NULL)
2218 if (instance == NULL) {
2225 MpmStore *mpm_store = MpmStorePrepareBufferPkt(
de_ctx, sh, a, sa);
2226 if (mpm_store != NULL) {
2229 SCLogDebug(
"a %p a->name %s a->reg->PrefilterRegisterWithListId %p "
2230 "mpm_store->mpm_ctx %p", a, a->name,
2231 a->PrefilterRegisterWithListId, mpm_store->
mpm_ctx);
2235 if (a->PrefilterRegisterWithListId && mpm_store->
mpm_ctx) {
2238 a, a->sm_list) != 0);
2239 SCLogDebug(
"mpm %s %d set up", a->name, a->sm_list);
2248 if (instance == NULL) {
2256 SCLogDebug(
"a %s direction %d PrefilterRegisterWithListId %p", a->name, a->direction,
2257 a->PrefilterRegisterWithListId);
2258 MpmStore *mpm_store = MpmStorePrepareBufferFrame(
de_ctx, sh, a, sa);
2259 if (mpm_store != NULL) {
2262 SCLogDebug(
"a %p a->name %s a->reg->PrefilterRegisterWithListId %p "
2263 "mpm_store->mpm_ctx %p",
2264 a, a->name, a->PrefilterRegisterWithListId, mpm_store->
mpm_ctx);
2269 if (a->PrefilterRegisterWithListId && mpm_store->
mpm_ctx) {
2270 BUG_ON(a->PrefilterRegisterWithListId(
2272 SCLogDebug(
"mpm %s %d set up", a->name, a->sm_list);
2283 if (instance == NULL) {
2291 MpmStore *mpm_store = MpmStorePrepareBufferAppLayer(
de_ctx, sh, a, sa);
2292 if (mpm_store != NULL) {
2295 SCLogDebug(
"a %p a->name %s a->PrefilterRegisterWithListId %p "
2296 "mpm_store->mpm_ctx %p",
2297 a, a->name, a->PrefilterRegisterWithListId, mpm_store->
mpm_ctx);
2301 if (a->PrefilterRegisterWithListId && mpm_store->
mpm_ctx) {
2302 BUG_ON(a->PrefilterRegisterWithListId(
2304 SCLogDebug(
"mpm %s %d set up", a->name, a->sm_list);
2321 if (mpm_store != NULL) {
2326 if (mpm_store != NULL) {
2330 SetRawReassemblyFlag(
de_ctx, sh);
2334 if (mpm_store != NULL) {
2339 if (mpm_store != NULL) {
2343 SetRawReassemblyFlag(
de_ctx, sh);
2345 }
else if (
SGH_PROTO(sh, IPPROTO_UDP)) {
2348 if (mpm_store != NULL) {
2354 if (mpm_store != NULL) {
2360 if (mpm_store != NULL) {
2384 static uint32_t PatternChopHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
2387 uint32_t hash = p->
sm_list + ContentFlagsForHash(p->
cd);
2389 const uint8_t *content = p->
cd->
content;
2407 static uint32_t PatternNoChopHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
2410 uint32_t hash = p->
sm_list + ContentFlagsForHash(p->
cd);
2426 static char PatternChopCompareFunc(
void *data1, uint16_t len1,
void *data2, uint16_t len2)
2434 if (ContentFlagsForHash(p1->
cd) != ContentFlagsForHash(p2->
cd))
2450 if (p1_content_len != p2_content_len)
2453 if (memcmp(p1_content, p2_content, p1_content_len) != 0) {
2471 static char PatternNoChopCompareFunc(
void *data1, uint16_t len1,
void *data2, uint16_t len2)
2479 if (ContentFlagsForHash(p1->
cd) != ContentFlagsForHash(p2->
cd))
2492 static void PatternFreeFunc(
void *ptr)
2519 HashListTableInit(4096, PatternChopHashFunc, PatternChopCompareFunc, PatternFreeFunc);
2550 SCLogDebug(
"%u: add id %u cnt %u", s->
id, add->cd->id, add->cnt);
2567 4096, PatternNoChopHashFunc, PatternNoChopCompareFunc, PatternFreeFunc);
2573 switch (smd->
type) {
2603 for (; app != NULL; app = app->
next) {
2606 switch (smd->
type) {
2611 .
cd = cd, .sm_list = app->
sm_list, .cnt = 0, .mpm = 0
2636 for (; pkt != NULL; pkt = pkt->
next) {
2643 switch (smd->
type) {
2648 .
cd = cd, .sm_list = pkt->
sm_list, .cnt = 0, .mpm = 0
2673 for (; frame != NULL; frame = frame->
next) {
2680 switch (smd->
type) {
2685 .
cd = cd, .sm_list = frame->
sm_list, .cnt = 0, .mpm = 0
void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t matcher)
#define DETECT_CONTENT_NOCASE
int SignatureHasPacketContent(const Signature *s)
check if a signature has patterns that are to be inspected against a packets payload (as opposed to t...
uint32_t pkt_mpms_list_cnt
#define HashListTableGetListData(hb)
uint32_t frame_mpms_list_cnt
uint32_t max_content_list_id
int PrefilterGenericMpmPktRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
void DetectAppLayerMpmMultiRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionMultiBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
#define SGH_DIRECTION_TC(sgh)
#define DETECT_CONTENT_FAST_PATTERN_CHOP
struct SigMatch_ * smlists[DETECT_SM_LIST_MAX]
void PatternMatchDestroy(MpmCtx *mpm_ctx, uint16_t mpm_matcher)
SigTableElmt * sigmatch_table
int32_t sgh_mpm_context_proto_tcp_packet
@ ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE
int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
Prepare the pattern matcher ctx in a sig group head.
struct SCFPSupportSMList_ * next
struct DetectEngineAppInspectionEngine_ * next
void MpmStoreFree(DetectEngineCtx *de_ctx)
Frees the hash table - DetectEngineCtx->mpm_hash_table, allocated by MpmStoreInit() function.
void DetectFrameMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Container for matching data for a signature group.
HashListTable * pattern_hash_table
void MpmFactoryReClaimMpmCtx(const DetectEngineCtx *de_ctx, MpmCtx *mpm_ctx)
void MpmStoreReportStats(const DetectEngineCtx *de_ctx)
void DetectPktMpmRegister(const char *name, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), InspectionBufferGetPktDataPtr GetData)
register a MPM engine
void DetectBufferTypeSupportsFrames(const char *name)
void DetectMpmInitializeFrameMpms(DetectEngineCtx *de_ctx)
@ DETECT_SM_LIST_DYNAMIC_START
#define DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED
uint32_t PatternStrength(uint8_t *pat, uint16_t patlen)
Predict a strength value for patterns.
DetectBufferMpmRegistry * pkt_mpms_list
@ DETECT_BUFFER_MPM_TYPE_FRAME
int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx)
Figure out the FP and their respective content ids for all the sigs in the engine.
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
main detection engine ctx
int SCConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
#define DETECT_CONTENT_MPM_IS_CONCLUSIVE(c)
HashListTableBucket * HashListTableGetListHead(HashListTable *ht)
#define DETECT_CONTENT_DEPTH_VAR
InspectionBuffer *(* InspectionBufferGetPktDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Packet *p, const int list_id)
const char * DetectEngineBufferTypeGetNameById(const DetectEngineCtx *de_ctx, const int id)
void DetectMpmInitializeBuiltinMpms(DetectEngineCtx *de_ctx)
struct DetectBufferMpmRegistry_::@98::@101 pkt_v1
struct DetectBufferMpmRegistry_ * next
#define SIG_FLAG_REQUIRE_STREAM
#define SIG_FLAG_TXBOTHDIR
int SCConfGetBool(const char *name, int *val)
Retrieve a configuration value as a boolean.
one time registration of keywords at start up
const struct DetectContentData_ * cd
#define SIG_GROUP_HEAD_HAVERAWSTREAM
uint8_t mpm_default_matcher
SigMatchData * sm_arrays[DETECT_SM_LIST_MAX]
void * HashListTableLookup(HashListTable *ht, void *data, uint16_t datalen)
#define SIG_FLAG_TOCLIENT
int32_t sgh_mpm_context_proto_udp_packet
DetectEngineTransforms transforms
void ShortenString(const char *input, char *output, size_t output_size, char c)
void DetectEngineRegisterFastPatternForId(DetectEngineCtx *de_ctx, int list_id, int priority)
void EngineAnalysisAddAllRulePatterns(DetectEngineCtx *de_ctx, const Signature *s)
add all patterns on our stats hash Used to fill the hash later used by DumpPatterns()
DetectEngineFrameInspectionEngine * frame_inspect
const char * cache_dir_path
int DetectBufferTypeGetByName(const char *name)
int HashListTableAdd(HashListTable *ht, void *data, uint16_t datalen)
void DetectAppLayerMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
void MpmInitCtx(MpmCtx *mpm_ctx, uint8_t matcher)
int32_t sgh_mpm_context_proto_other_packet
#define HashListTableGetListNext(hb)
#define SIG_FLAG_TOSERVER
HashListTable * HashListTableInit(uint32_t size, uint32_t(*Hash)(struct HashListTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
void MpmDestroyThreadCtx(MpmThreadCtx *mpm_thread_ctx, const uint16_t matcher)
#define DETECT_CONTENT_ENDS_WITH
MpmCtx * MpmFactoryGetMpmCtxForProfile(const DetectEngineCtx *de_ctx, int32_t id, int direction)
void DetectMpmInitializePktMpms(DetectEngineCtx *de_ctx)
#define MPM_PATTERN_CTX_OWNS_ID
size_t strlcat(char *, const char *src, size_t siz)
#define DetectEngineGetMaxSigId(de_ctx)
#define DETECT_CONTENT_DEPTH
DetectEnginePktInspectionEngine * pkt_inspect
bool(* InspectionSingleBufferGetDataPtr)(const void *txv, const uint8_t flow_flags, const uint8_t **buf, uint32_t *buf_len)
#define DETECT_CONTENT_IS_SINGLE(c)
#define DETECT_CONTENT_NEGATED
int PrefilterGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
void PatternMatchThreadPrepare(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
#define SCLogWarning(...)
Macro used to log WARNING messages.
int DetectEngineBufferTypeRegister(DetectEngineCtx *de_ctx, const char *name)
SigGroupHeadInitData * init
void DetectAppLayerMpmRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
register an app layer keyword for mpm
DetectEngineAppInspectionEngine * app_inspect
bool DetectBufferToClient(const DetectEngineCtx *de_ctx, int buf_id, AppProto alproto)
#define MPMCTX_FLAGS_GLOBAL
int(* PrefilterRegisterFunc)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
int32_t MpmFactoryRegisterMpmCtxProfile(DetectEngineCtx *de_ctx, const char *name, const int sm_list, const AppProto alproto)
Register a new Mpm Context.
int32_t sgh_mpm_context_stream
void DetectEngineBufferTypeSupportsFrames(DetectEngineCtx *de_ctx, const char *name)
DetectBufferMpmRegistry * frame_mpms_list
int MpmAddPatternCI(MpmCtx *mpm_ctx, const uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
int PrefilterPktPayloadRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx)
@ DETECT_BUFFER_MPM_TYPE_PKT
SignatureInitData * init_data
int FastPatternSupportEnabledForSigMatchList(const DetectEngineCtx *de_ctx, const int list_id)
Checks if a particular buffer is in the list of lists that need to be searched for a keyword that has...
enum DetectBufferMpmType type
int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
void DetectEngineBufferTypeSupportsTransformations(DetectEngineCtx *de_ctx, const char *name)
bool(* InspectionMultiBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const void *txv, const uint8_t flow_flags, uint32_t local_id, const uint8_t **buf, uint32_t *buf_len)
#define SGH_DIRECTION_TS(sgh)
#define MPM_FEATURE_FLAG_ENDSWITH
MpmStore * MpmStorePrepareBuffer(DetectEngineCtx *de_ctx, SigGroupHead *sgh, enum MpmBuiltinBuffers buf)
Get MpmStore for a built-in buffer type.
struct DetectBufferMpmRegistry_::@98::@100 app_v2
int DetectMpmPrepareFrameMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
void DetectEngineFrameMpmRegister(DetectEngineCtx *de_ctx, const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), AppProto alproto, uint8_t type)
struct DetectBufferMpmRegistry_::@98::@102 frame_v1
int SignatureHasStreamContent(const Signature *s)
check if a signature has patterns that are to be inspected against the stream payload (as opposed to ...
enum DetectBufferMpmType type
int MpmStoreInit(DetectEngineCtx *de_ctx)
Initializes the MpmStore mpm hash table to be used by the detection engine context.
void DetectAppLayerMpmRegisterSingle(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionSingleBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
DetectBufferMpmRegistry * app_mpms_list
@ DETECT_BUFFER_MPM_TYPE_APP
void DetectBufferTypeSupportsMpm(const char *name)
void HashListTableFree(HashListTable *ht)
void SupportFastPatternForSigMatchList(int list_id, int priority)
Lets one add a sm list id to be searched for potential fp supported keywords later.
struct DetectEngineFrameInspectionEngine * next
struct DetectEnginePktInspectionEngine * next
uint8_t PatternMatchDefaultMatcher(void)
Function to return the multi pattern matcher algorithm to be used by the engine, based on the mpm-alg...
int DetectMpmPreparePktMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
void DetectEngineBufferTypeSupportsMpm(DetectEngineCtx *de_ctx, const char *name)
uint32_t app_mpms_list_cnt
void DetectBufferTypeSupportsTransformations(const char *name)
#define MPM_PATTERN_FLAG_ENDSWITH
const char * builtin_mpms[]
SignatureInitDataBuffer * buffers
DetectEngineAppInspectionEngine * app_inspect_engines
HashListTable * mpm_hash_table
int(* Prepare)(MpmConfig *, struct MpmCtx_ *)
void(* DestroyCtx)(struct MpmCtx_ *)
int SigMatchListSMBelongsTo(const Signature *s, const SigMatch *key_sm)
#define MPM_CTX_FACTORY_UNIQUE_CONTEXT
int DetectMpmPrepareBuiltinMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for builtin buffers that are in "single or "shared" mode.
#define DETECT_CONTENT_OFFSET
int(* PrefilterRegisterWithListId)(struct DetectEngineCtx_ *de_ctx, struct SigGroupHead_ *sgh, MpmCtx *mpm_ctx, const struct DetectBufferMpmRegistry_ *mpm_reg, int list_id)
#define DETECT_CONTENT_MPM
a single match condition for a signature
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
void DetectMpmInitializeAppMpms(DetectEngineCtx *de_ctx)
InspectionBuffer *(* InspectionBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id)
@ DETECT_BUFFER_MPM_TYPE_SIZE
#define SGH_PROTO(sgh, p)
#define DETECT_CONTENT_REPLACE
void DetectPktMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
#define DETECT_CONTENT_FAST_PATTERN
#define MPMCTX_FLAGS_CACHE_TO_DISK
void DetectFrameMpmRegister(const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), AppProto alproto, uint8_t type)
register a MPM engine
struct DetectBufferInstance DetectBufferInstance
#define SCMemcmp(a, b, c)
int DetectMpmPrepareAppMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
SCFPSupportSMList * fp_support_smlist_list
#define DEBUG_VALIDATE_BUG_ON(exp)
void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
enum MpmBuiltinBuffers buffer
void RetrieveFPForSig(const DetectEngineCtx *de_ctx, Signature *s)
uint32_t StringHashDjb2(const uint8_t *data, uint32_t datalen)
int PrefilterPktStreamRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx)
#define DETECT_CONTENT_OFFSET_VAR
#define SIG_FLAG_REQUIRE_PACKET