Go to the documentation of this file.
67 "toserver TCP packet",
68 "toclient TCP packet",
69 "toserver TCP stream",
70 "toclient TCP stream",
71 "toserver UDP packet",
72 "toclient UDP packet",
90 int direction,
int priority,
95 AppProto alproto,
int tx_min_progress)
97 SCLogDebug(
"registering %s/%d/%d/%p/%p/%u/%d", name, direction, priority,
98 PrefilterRegister, GetData, alproto, tx_min_progress);
100 BUG_ON(tx_min_progress >= 48);
111 FatalError(
"MPM engine registration for %s failed", name);
120 am->
sm_list = (int16_t)sm_list;
126 am->
app_v2.GetData = GetData;
127 am->
app_v2.alproto = alproto;
128 am->
app_v2.tx_min_progress = tx_min_progress;
134 while (t->
next != NULL) {
148 const int id,
const int parent_id,
151 SCLogDebug(
"registering %d/%d",
id, parent_id);
174 memcpy(&am->
transforms, transforms,
sizeof(*transforms));
179 char xforms[1024] =
"";
180 for (
int i = 0; i < transforms->
cnt; i++) {
182 (void)snprintf(ttstr,
sizeof(ttstr),
"%s,",
184 strlcat(xforms, ttstr,
sizeof(xforms));
186 xforms[strlen(xforms)-1] =
'\0';
188 size_t space =
sizeof(am->
pname) - strlen(am->
name) - 3;
189 char toprint[space + 1];
190 memset(toprint, 0x00, space + 1);
191 if (space < strlen(xforms)) {
194 strlcpy(toprint, xforms,
sizeof(toprint));
196 (void)snprintf(am->
pname,
sizeof(am->
pname),
"%s#%d (%s)",
197 am->
name, id, toprint);
199 (void)snprintf(am->
pname,
sizeof(am->
pname),
"%s#%d",
206 SCLogDebug(
"copied mpm registration for %s id %u "
207 "with parent %u and GetData %p",
219 while (list != NULL) {
239 char confstring[256] =
"detect.mpm.";
241 strlcat(confstring,
".shared",
sizeof(confstring));
275 if (mpm_ctx != NULL) {
295 SCLogDebug(
"registering %s/%d/%p/%s/%u", name, priority, PrefilterRegister,
302 if (sm_list < 0 || sm_list > UINT16_MAX) {
303 FatalError(
"MPM engine registration for %s failed", name);
310 am->
sm_list = (uint16_t)sm_list;
325 while (t->
next != NULL) {
341 SCLogDebug(
"registering %d/%d",
id, parent_id);
362 memcpy(&am->
transforms, transforms,
sizeof(*transforms));
368 SCLogDebug(
"copied mpm registration for %s id %u "
370 t->
name,
id, parent_id);
383 SCLogDebug(
"registering %s/%d/%p/%s/%u", name, priority, PrefilterRegister,
387 if (sm_list < 0 || sm_list > UINT16_MAX) {
388 FatalError(
"MPM engine registration for %s failed", name);
399 am->
sm_list = (uint16_t)sm_list;
414 if (
ConfGetBool(
"detect.mpm.frame.shared", &confshared) == 1)
428 while (t->
next != NULL) {
443 while (list != NULL) {
454 while (t->
next != NULL) {
466 char confstring[256] =
"detect.mpm.";
468 strlcat(confstring,
".shared",
sizeof(confstring));
504 if (mpm_ctx != NULL) {
527 SCLogDebug(
"registering %s/%d/%p/%p", name, priority,
528 PrefilterRegister, GetData);
539 FatalError(
"MPM engine registration for %s failed", name);
547 am->
sm_list = (uint16_t)sm_list;
552 am->
pkt_v1.GetData = GetData;
558 while (t->
next != NULL) {
572 const int id,
const int parent_id,
575 SCLogDebug(
"registering %d/%d",
id, parent_id);
594 memcpy(&am->
transforms, transforms,
sizeof(*transforms));
600 SCLogDebug(
"copied mpm registration for %s id %u "
601 "with parent %u and GetData %p",
612 while (list != NULL) {
623 while (t->
next != NULL) {
635 char confstring[256] =
"detect.mpm.";
637 strlcat(confstring,
".shared",
sizeof(confstring));
671 if (mpm_ctx != NULL) {
690 char confstring[256] =
"detect.mpm.";
691 strlcat(confstring, name,
sizeof(confstring));
692 strlcat(confstring,
".shared",
sizeof(confstring));
699 SCLogDebug(
"using unique mpm ctx' for %s", name);
702 SCLogDebug(
"using shared mpm ctx' for %s", name);
785 if (!(s->
proto.
proto[IPPROTO_TCP / 8] & 1 << (IPPROTO_TCP % 8))) {
821 if (!(s->
proto.
proto[IPPROTO_TCP / 8] & 1 << (IPPROTO_TCP % 8))) {
849 const char *mpm_algo;
853 if ((
ConfGet(
"mpm-algo", &mpm_algo)) == 1) {
854 if (mpm_algo != NULL) {
855 #if __BYTE_ORDER == __BIG_ENDIAN
856 if (strcmp(mpm_algo,
"ac-ks") == 0) {
858 "not work on big endian systems at this time.");
861 if (strcmp(
"auto", mpm_algo) == 0) {
868 if (strcmp(
mpm_table[u].name, mpm_algo) == 0) {
874 #ifndef BUILD_HYPERSCAN
875 if ((strcmp(mpm_algo,
"hs") == 0)) {
876 FatalError(
"Hyperscan (hs) support for mpm-algo is "
877 "not compiled into Suricata.");
882 "in the yaml conf file: \"%s\"",
892 SCLogDebug(
"mpm_ctx %p, mpm_matcher %"PRIu16
"", mpm_ctx, mpm_matcher);
898 SCLogDebug(
"mpm_thread_ctx %p, mpm_matcher %"PRIu16
" defunct", mpm_thread_ctx, mpm_matcher);
903 SCLogDebug(
"mpm_thread_ctx %p, mpm_matcher %"PRIu16
"", mpm_thread_ctx, mpm_matcher);
904 if (
mpm_table[mpm_matcher].DestroyThreadCtx != NULL)
909 SCLogDebug(
"mpm_thread_ctx %p, type %"PRIu16, mpm_thread_ctx, mpm_matcher);
929 memset(&a, 0 ,
sizeof(a));
933 for (u = 0; u < patlen; u++) {
934 if (a[pat[u]] == 0) {
937 else if (isprint(pat[u]) || pat[u] == 0x00 || pat[u] == 0x01 || pat[u] == 0xFF)
951 static void PopulateMpmHelperAddPattern(
MpmCtx *mpm_ctx,
956 uint16_t pat_offset = cd->
offset;
957 uint16_t pat_depth = cd->
depth;
960 if (chop && (pat_depth || pat_offset)) {
972 pat_depth = pat_offset = 0;
979 pat_offset, pat_depth,
984 pat_offset, pat_depth,
991 pat_offset, pat_depth,
996 pat_offset, pat_depth,
1004 #define SGH_PROTO(sgh, p) ((sgh)->init->protos[(p)] == 1)
1005 #define SGH_DIRECTION_TS(sgh) ((sgh)->init->direction & SIG_FLAG_TOSERVER)
1006 #define SGH_DIRECTION_TC(sgh) ((sgh)->init->direction & SIG_FLAG_TOCLIENT)
1010 if (s == NULL || mpm_sm == NULL)
1037 uint16_t max_len,
bool skip_negated_content)
1051 if (mpm_sm == NULL) {
1060 }
else if (ls == ss) {
1078 int pos_sm_list[nlists];
1079 int neg_sm_list[nlists];
1080 memset(pos_sm_list, 0, nlists *
sizeof(
int));
1081 memset(neg_sm_list, 0, nlists *
sizeof(
int));
1082 int pos_sm_list_cnt = 0;
1083 int neg_sm_list_cnt = 0;
1105 SetMpm(s, sm, list_id);
1110 neg_sm_list[list_id] = 1;
1113 pos_sm_list[list_id] = 1;
1120 int *curr_sm_list = NULL;
1121 int skip_negated_content = 1;
1122 if (pos_sm_list_cnt > 0) {
1123 curr_sm_list = pos_sm_list;
1124 }
else if (neg_sm_list_cnt > 0) {
1125 curr_sm_list = neg_sm_list;
1126 skip_negated_content = 0;
1131 int final_sm_list[nlists];
1132 memset(&final_sm_list, 0, (nlists *
sizeof(
int)));
1134 int count_final_sm_list = 0;
1138 while (tmp != NULL) {
1140 tmp != NULL && priority == tmp->
priority;
1146 if (curr_sm_list[tmp->
list_id] == 0)
1148 final_sm_list[count_final_sm_list++] = tmp->
list_id;
1150 if (count_final_sm_list != 0)
1154 BUG_ON(count_final_sm_list == 0);
1156 uint16_t max_len = 0;
1157 for (
int i = 0; i < count_final_sm_list; i++) {
1170 if (max_len < cd->content_len)
1176 int mpm_sm_list = -1;
1177 for (
int i = 0; i < count_final_sm_list; i++) {
1183 mpm_sm = GetMpmForList(s, final_sm_list[i], mpm_sm, max_len, skip_negated_content);
1184 if (mpm_sm != prev_mpm_sm) {
1185 mpm_sm_list = final_sm_list[i];
1190 if (mpm_sm != NULL) {
1191 BUG_ON(mpm_sm_list == -1);
1193 BUG_ON(check_list != mpm_sm_list);
1197 SetMpm(s, mpm_sm, mpm_sm_list);
1210 static uint32_t MpmStoreHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
1232 static char MpmStoreCompareFunc(
void *data1, uint16_t len1,
void *data2,
1262 static void MpmStoreFreeFunc(
void *ptr)
1292 MpmStoreCompareFunc,
1337 while (am != NULL) {
1345 while (am != NULL) {
1360 uint32_t appstats[app_mpms_cnt + 1];
1361 memset(&appstats, 0x00,
sizeof(appstats));
1363 uint32_t pktstats[pkt_mpms_cnt + 1];
1364 memset(&pktstats, 0x00,
sizeof(pktstats));
1366 uint32_t framestats[frame_mpms_cnt + 1];
1367 memset(&framestats, 0x00,
sizeof(framestats));
1374 if (ms == NULL || ms->
mpm_ctx == NULL) {
1384 SCLogDebug(
"%s: %u patterns. Min %u, Max %u. Ctx %p",
1392 SCLogDebug(
"%s %s %s: %u patterns. Min %u, Max %u. Ctx %p",
1413 for (
int x = 0; x <
MPMB_MAX; x++) {
1417 while (am != NULL) {
1418 if (appstats[am->
sm_list] > 0) {
1419 const char *name = am->
name;
1421 SCLogPerf(
"AppLayer MPM \"%s %s (%s)\": %u", direction, name,
1427 while (pm != NULL) {
1428 if (pktstats[pm->
sm_list] > 0) {
1429 const char *name = pm->
name;
1435 while (um != NULL) {
1436 if (framestats[um->
sm_list] > 0) {
1437 const char *name = um->
name;
1505 if (ms->
sid_array[sig / 8] & (1 << (sig % 8))) {
1535 SCLogDebug(
"not adding negated mpm as it's not 'single'");
1539 PopulateMpmHelperAddPattern(ms->
mpm_ctx,
1569 uint8_t sids_array[max_sid];
1570 memset(sids_array, 0x00, max_sid);
1571 int sgh_mpm_context = 0;
1636 sids_array[s->
num / 8] |= 1 << (s->
num % 8);
1644 sids_array[s->
num / 8] |= 1 << (s->
num % 8);
1650 sids_array[s->
num / 8] |= 1 << (s->
num % 8);
1654 sids_array[s->
num / 8] |= 1 << (s->
num % 8);
1665 MpmStore lookup = { sids_array, max_sid, direction, buf, sm_list, 0, 0, NULL };
1668 if (result == NULL) {
1672 uint8_t *sids =
SCCalloc(1, max_sid);
1678 memcpy(sids, sids_array, max_sid);
1686 MpmStoreSetup(
de_ctx, copy);
1687 MpmStoreAdd(
de_ctx, copy);
1714 0, am->
app_v2.alproto, NULL };
1719 if (result == NULL) {
1741 MpmStoreSetup(
de_ctx, copy);
1742 MpmStoreAdd(
de_ctx, copy);
1765 if (result == NULL) {
1785 MpmStoreSetup(
de_ctx, copy);
1786 MpmStoreAdd(
de_ctx, copy);
1808 if (result == NULL) {
1829 MpmStoreSetup(
de_ctx, copy);
1830 MpmStoreAdd(
de_ctx, copy);
1851 SCLogDebug(
"rule group %p has SIG_GROUP_HEAD_HAVERAWSTREAM set", sgh);
1855 SCLogDebug(
"rule group %p does NOT have SIG_GROUP_HEAD_HAVERAWSTREAM set", sgh);
1867 static uint32_t DetectBufferInstanceHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
1874 static char DetectBufferInstanceCompareFunc(
void *data1, uint16_t len1,
void *data2, uint16_t len2)
1881 static void DetectBufferInstanceFreeFunc(
void *ptr)
1893 return HashListTableInit(4096, DetectBufferInstanceHashFunc, DetectBufferInstanceCompareFunc,
1894 DetectBufferInstanceFreeFunc);
1906 memset(engines, 0,
sizeof(engines));
1907 int engines_idx[max_buffer_id];
1908 memset(engines_idx, 0,
sizeof(engines_idx));
1909 int types[max_buffer_id];
1910 memset(types, 0,
sizeof(types));
1914 types[a->sm_list] = a->type;
1918 if (instance == NULL) {
1919 instance =
SCCalloc(1,
sizeof(*instance));
1920 BUG_ON(instance == NULL);
1921 instance->
list = a->sm_list;
1931 if (add_ts || add_tc) {
1932 types[a->sm_list] = a->type;
1933 engines[a->sm_list][engines_idx[a->sm_list]++] = a->frame_v1.alproto;
1937 if (instance == NULL) {
1938 instance =
SCCalloc(1,
sizeof(*instance));
1939 BUG_ON(instance == NULL);
1940 instance->
list = a->sm_list;
1941 instance->
alproto = a->frame_v1.alproto;
1951 if (add_ts || add_tc) {
1952 types[a->sm_list] = a->type;
1953 engines[a->sm_list][engines_idx[a->sm_list]++] = a->app_v2.alproto;
1957 if (instance == NULL) {
1958 instance =
SCCalloc(1,
sizeof(*instance));
1959 BUG_ON(instance == NULL);
1960 instance->
list = a->sm_list;
1961 instance->
alproto = a->app_v2.alproto;
1969 for (uint32_t sig = 0; sig < sh->
init->
sig_cnt; sig++) {
1981 switch (types[list]) {
1985 for (
int e = 0; e < engines_idx[list]; e++) {
1986 const AppProto alproto = engines[list][e];
1992 if (instance == NULL)
2025 if (instance == NULL)
2056 if (instance == NULL) {
2063 MpmStore *mpm_store = MpmStorePrepareBufferPkt(
de_ctx, sh, a, sa);
2064 if (mpm_store != NULL) {
2067 SCLogDebug(
"a %p a->name %s a->reg->PrefilterRegisterWithListId %p "
2068 "mpm_store->mpm_ctx %p", a, a->name,
2069 a->PrefilterRegisterWithListId, mpm_store->
mpm_ctx);
2073 if (a->PrefilterRegisterWithListId && mpm_store->
mpm_ctx) {
2076 a, a->sm_list) != 0);
2077 SCLogDebug(
"mpm %s %d set up", a->name, a->sm_list);
2086 if (instance == NULL) {
2094 SCLogDebug(
"a %s direction %d PrefilterRegisterWithListId %p", a->name, a->direction,
2095 a->PrefilterRegisterWithListId);
2096 MpmStore *mpm_store = MpmStorePrepareBufferFrame(
de_ctx, sh, a, sa);
2097 if (mpm_store != NULL) {
2100 SCLogDebug(
"a %p a->name %s a->reg->PrefilterRegisterWithListId %p "
2101 "mpm_store->mpm_ctx %p",
2102 a, a->name, a->PrefilterRegisterWithListId, mpm_store->
mpm_ctx);
2107 if (a->PrefilterRegisterWithListId && mpm_store->
mpm_ctx) {
2108 BUG_ON(a->PrefilterRegisterWithListId(
2110 SCLogDebug(
"mpm %s %d set up", a->name, a->sm_list);
2121 if (instance == NULL) {
2129 MpmStore *mpm_store = MpmStorePrepareBufferAppLayer(
de_ctx, sh, a, sa);
2130 if (mpm_store != NULL) {
2133 SCLogDebug(
"a %p a->name %s a->PrefilterRegisterWithListId %p "
2134 "mpm_store->mpm_ctx %p",
2135 a, a->name, a->PrefilterRegisterWithListId, mpm_store->
mpm_ctx);
2139 if (a->PrefilterRegisterWithListId && mpm_store->
mpm_ctx) {
2140 BUG_ON(a->PrefilterRegisterWithListId(
2142 SCLogDebug(
"mpm %s %d set up", a->name, a->sm_list);
2159 if (mpm_store != NULL) {
2164 if (mpm_store != NULL) {
2168 SetRawReassemblyFlag(
de_ctx, sh);
2172 if (mpm_store != NULL) {
2177 if (mpm_store != NULL) {
2181 SetRawReassemblyFlag(
de_ctx, sh);
2183 }
else if (
SGH_PROTO(sh, IPPROTO_UDP)) {
2186 if (mpm_store != NULL) {
2192 if (mpm_store != NULL) {
2198 if (mpm_store != NULL) {
2222 static uint32_t PatternChopHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
2225 uint32_t hash = p->
sm_list + ContentFlagsForHash(p->
cd);
2227 const uint8_t *content = p->
cd->
content;
2245 static uint32_t PatternNoChopHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
2248 uint32_t hash = p->
sm_list + ContentFlagsForHash(p->
cd);
2264 static char PatternChopCompareFunc(
void *data1, uint16_t len1,
void *data2, uint16_t len2)
2272 if (ContentFlagsForHash(p1->
cd) != ContentFlagsForHash(p2->
cd))
2288 if (p1_content_len != p2_content_len)
2291 if (memcmp(p1_content, p2_content, p1_content_len) != 0) {
2309 static char PatternNoChopCompareFunc(
void *data1, uint16_t len1,
void *data2, uint16_t len2)
2317 if (ContentFlagsForHash(p1->
cd) != ContentFlagsForHash(p2->
cd))
2330 static void PatternFreeFunc(
void *ptr)
2362 HashListTableInit(4096, PatternChopHashFunc, PatternChopCompareFunc, PatternFreeFunc);
2393 SCLogDebug(
"%u: add id %u cnt %u", s->
id, add->cd->id, add->cnt);
2412 4096, PatternNoChopHashFunc, PatternNoChopCompareFunc, PatternFreeFunc);
2418 switch (smd->
type) {
2448 for (; app != NULL; app = app->
next) {
2451 switch (smd->
type) {
2456 .
cd = cd, .sm_list = app->
sm_list, .cnt = 0, .mpm = 0
2481 for (; pkt != NULL; pkt = pkt->
next) {
2488 switch (smd->
type) {
2493 .
cd = cd, .sm_list = pkt->
sm_list, .cnt = 0, .mpm = 0
2518 for (; frame != NULL; frame = frame->
next) {
2525 switch (smd->
type) {
2530 .
cd = cd, .sm_list = frame->
sm_list, .cnt = 0, .mpm = 0
void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t matcher)
#define DETECT_CONTENT_NOCASE
int SignatureHasPacketContent(const Signature *s)
check if a signature has patterns that are to be inspected against a packets payload (as opposed to t...
uint32_t pkt_mpms_list_cnt
#define HashListTableGetListData(hb)
uint32_t frame_mpms_list_cnt
#define SGH_DIRECTION_TC(sgh)
#define DETECT_CONTENT_FAST_PATTERN_CHOP
void PatternMatchDestroy(MpmCtx *mpm_ctx, uint16_t mpm_matcher)
int32_t sgh_mpm_context_proto_tcp_packet
int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
Prepare the pattern matcher ctx in a sig group head.
struct SCFPSupportSMList_ * next
void DetectPktMpmRegister(const char *name, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id), InspectionBufferGetPktDataPtr GetData)
register a MPM engine
struct DetectEngineAppInspectionEngine_ * next
void MpmStoreFree(DetectEngineCtx *de_ctx)
Frees the hash table - DetectEngineCtx->mpm_hash_table, allocated by MpmStoreInit() function.
void DetectFrameMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as an boolen.
Container for matching data for a signature group.
HashListTable * pattern_hash_table
void MpmFactoryReClaimMpmCtx(const DetectEngineCtx *de_ctx, MpmCtx *mpm_ctx)
void MpmStoreReportStats(const DetectEngineCtx *de_ctx)
void DetectBufferTypeSupportsFrames(const char *name)
void DetectMpmInitializeFrameMpms(DetectEngineCtx *de_ctx)
@ DETECT_SM_LIST_DYNAMIC_START
DetectEngineTransforms transforms
#define DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED
uint32_t PatternStrength(uint8_t *pat, uint16_t patlen)
Predict a strength value for patterns.
@ DETECT_BUFFER_MPM_TYPE_FRAME
@ DETECT_SM_LIST_THRESHOLD
@ ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE
int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx)
Figure out the FP and their respective content ids for all the sigs in the engine.
InspectionBuffer *(* InspectionBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id)
int PrefilterGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id)
DetectBufferMpmRegistery * frame_mpms_list
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
struct DetectBufferMpmRegistery_::@87::@89 app_v2
main detection engine ctx
enum DetectBufferMpmType type
#define DETECT_CONTENT_MPM_IS_CONCLUSIVE(c)
HashListTableBucket * HashListTableGetListHead(HashListTable *ht)
#define DETECT_CONTENT_DEPTH_VAR
InspectionBuffer *(* InspectionBufferGetPktDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Packet *p, const int list_id)
void DetectMpmInitializeBuiltinMpms(DetectEngineCtx *de_ctx)
#define SIG_FLAG_REQUIRE_STREAM
const struct DetectContentData_ * cd
one time registration of keywords at start up
#define SIG_GROUP_HEAD_HAVERAWSTREAM
uint8_t mpm_default_matcher
SigMatchData * sm_arrays[DETECT_SM_LIST_MAX]
void * HashListTableLookup(HashListTable *ht, void *data, uint16_t datalen)
#define SIG_FLAG_TOCLIENT
int32_t sgh_mpm_context_proto_udp_packet
void ShortenString(const char *input, char *output, size_t output_size, char c)
void DetectEngineRegisterFastPatternForId(DetectEngineCtx *de_ctx, int list_id, int priority)
void EngineAnalysisAddAllRulePatterns(DetectEngineCtx *de_ctx, const Signature *s)
add all patterns on our stats hash Used to fill the hash later used by DumpPatterns()
DetectEngineFrameInspectionEngine * frame_inspect
struct DetectBufferMpmRegistery_::@87::@91 frame_v1
DetectBufferMpmRegistery * app_mpms_list
int DetectBufferTypeGetByName(const char *name)
int HashListTableAdd(HashListTable *ht, void *data, uint16_t datalen)
size_t strlcpy(char *dst, const char *src, size_t siz)
void DetectAppLayerMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
void MpmInitCtx(MpmCtx *mpm_ctx, uint8_t matcher)
int32_t sgh_mpm_context_proto_other_packet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
#define HashListTableGetListNext(hb)
@ DETECT_SM_LIST_POSTMATCH
void DetectEngineFrameMpmRegister(DetectEngineCtx *de_ctx, const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id), AppProto alproto, uint8_t type)
#define SIG_FLAG_TOSERVER
HashListTable * HashListTableInit(uint32_t size, uint32_t(*Hash)(struct HashListTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
#define DETECT_CONTENT_ENDS_WITH
MpmCtx * MpmFactoryGetMpmCtxForProfile(const DetectEngineCtx *de_ctx, int32_t id, int direction)
void DetectMpmInitializePktMpms(DetectEngineCtx *de_ctx)
#define MPM_PATTERN_CTX_OWNS_ID
size_t strlcat(char *, const char *src, size_t siz)
int(* PrefilterRegisterWithListId)(struct DetectEngineCtx_ *de_ctx, struct SigGroupHead_ *sgh, MpmCtx *mpm_ctx, const struct DetectBufferMpmRegistery_ *mpm_reg, int list_id)
#define DetectEngineGetMaxSigId(de_ctx)
#define DETECT_CONTENT_DEPTH
DetectEnginePktInspectionEngine * pkt_inspect
#define DETECT_CONTENT_IS_SINGLE(c)
#define DETECT_CONTENT_NEGATED
void PatternMatchThreadPrepare(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
int DetectEngineBufferTypeRegister(DetectEngineCtx *de_ctx, const char *name)
SigGroupHeadInitData * init
DetectEngineAppInspectionEngine * app_inspect
#define MPMCTX_FLAGS_GLOBAL
void DetectFrameMpmRegister(const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id), AppProto alproto, uint8_t type)
register a MPM engine
int32_t MpmFactoryRegisterMpmCtxProfile(DetectEngineCtx *de_ctx, const char *name, const int sm_list, const AppProto alproto)
Register a new Mpm Context.
void PatternMatchThreadPrint(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
int32_t sgh_mpm_context_stream
void DetectEngineBufferTypeSupportsFrames(DetectEngineCtx *de_ctx, const char *name)
int PrefilterPktPayloadRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx)
@ DETECT_BUFFER_MPM_TYPE_PKT
int(* Prepare)(struct MpmCtx_ *)
SignatureInitData * init_data
int FastPatternSupportEnabledForSigMatchList(const DetectEngineCtx *de_ctx, const int list_id)
Checks if a particular list(Signature->sm_lists[]) is in the list of lists that need to be searched f...
struct SigMatch_ ** smlists
enum DetectBufferMpmType type
int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
void DetectEngineBufferTypeSupportsTransformations(DetectEngineCtx *de_ctx, const char *name)
#define SGH_DIRECTION_TS(sgh)
MpmStore * MpmStorePrepareBuffer(DetectEngineCtx *de_ctx, SigGroupHead *sgh, enum MpmBuiltinBuffers buf)
Get MpmStore for a built-in buffer type.
void DetectAppLayerMpmRegister2(const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id), InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
register a MPM engine
int DetectMpmPrepareFrameMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
int SignatureHasStreamContent(const Signature *s)
check if a signature has patterns that are to be inspected against the stream payload (as opposed to ...
int MpmStoreInit(DetectEngineCtx *de_ctx)
Initializes the MpmStore mpm hash table to be used by the detection engine context.
@ DETECT_BUFFER_MPM_TYPE_APP
void DetectBufferTypeSupportsMpm(const char *name)
void HashListTableFree(HashListTable *ht)
void SupportFastPatternForSigMatchList(int list_id, int priority)
Lets one add a sm list id to be searched for potential fp supported keywords later.
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
struct DetectEngineFrameInspectionEngine * next
struct DetectEnginePktInspectionEngine * next
uint8_t PatternMatchDefaultMatcher(void)
Function to return the multi pattern matcher algorithm to be used by the engine, based on the mpm-alg...
int DetectMpmPreparePktMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
void DetectEngineBufferTypeSupportsMpm(DetectEngineCtx *de_ctx, const char *name)
uint32_t app_mpms_list_cnt
void DetectBufferTypeSupportsTransformations(const char *name)
const char * builtin_mpms[]
HashListTable * mpm_hash_table
void(* DestroyCtx)(struct MpmCtx_ *)
int SigMatchListSMBelongsTo(const Signature *s, const SigMatch *key_sm)
#define MPM_CTX_FACTORY_UNIQUE_CONTEXT
int DetectMpmPrepareBuiltinMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for builtin buffers that are in "single or "shared" mode.
#define DETECT_CONTENT_OFFSET
#define DETECT_CONTENT_MPM
a single match condition for a signature
struct DetectBufferMpmRegistery_::@87::@90 pkt_v1
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
DetectBufferMpmRegistery * pkt_mpms_list
void DetectMpmInitializeAppMpms(DetectEngineCtx *de_ctx)
@ DETECT_BUFFER_MPM_TYPE_SIZE
int PrefilterGenericMpmPktRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id)
void(* DestroyThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *)
#define SGH_PROTO(sgh, p)
#define DETECT_CONTENT_REPLACE
void DetectPktMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
#define DETECT_CONTENT_FAST_PATTERN
struct DetectBufferInstance DetectBufferInstance
int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
#define SCMemcmp(a, b, c)
int DetectMpmPrepareAppMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
@ DETECT_SM_LIST_SUPPRESS
SCFPSupportSMList * fp_support_smlist_list
#define DEBUG_VALIDATE_BUG_ON(exp)
#define SIG_FLAG_PREFILTER
void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
enum MpmBuiltinBuffers buffer
void RetrieveFPForSig(const DetectEngineCtx *de_ctx, Signature *s)
uint32_t StringHashDjb2(const uint8_t *data, uint32_t datalen)
int PrefilterPktStreamRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx)
struct DetectBufferMpmRegistery_ * next
#define DETECT_CONTENT_OFFSET_VAR
uint32_t smlists_array_size
#define SIG_FLAG_REQUIRE_PACKET