Go to the documentation of this file.
67 "toserver TCP packet",
68 "toclient TCP packet",
69 "toserver TCP stream",
70 "toclient TCP stream",
71 "toserver UDP packet",
72 "toclient UDP packet",
89 static void RegisterInternal(
const char *
name,
int direction,
int priority,
93 SCLogDebug(
"registering %s/%d/%d/%p/%p/%u/%d",
name, direction, priority,
94 PrefilterRegister, GetData, alproto, tx_min_progress);
96 BUG_ON(tx_min_progress >= 48);
112 RegisterInternal(
name, direction, priority, PrefilterRegister, GetData, GetMultiData,
121 am->
sm_list = (int16_t)sm_list;
127 if (GetData != NULL) {
128 am->
app_v2.GetData = GetData;
129 }
else if (GetMultiData != NULL) {
130 am->
app_v2.GetMultiData = GetMultiData;
132 am->
app_v2.alproto = alproto;
133 am->
app_v2.tx_min_progress = tx_min_progress;
139 while (t->
next != NULL) {
153 AppProto alproto,
int tx_min_progress)
156 name, direction, priority, PrefilterRegister, GetData, NULL, alproto, tx_min_progress);
161 AppProto alproto,
int tx_min_progress)
164 name, direction, priority, PrefilterRegister, NULL, GetData, alproto, tx_min_progress);
169 const int id,
const int parent_id,
172 SCLogDebug(
"registering %d/%d",
id, parent_id);
195 memcpy(&am->
transforms, transforms,
sizeof(*transforms));
200 char xforms[1024] =
"";
201 for (
int i = 0; i < transforms->
cnt; i++) {
203 (void)snprintf(ttstr,
sizeof(ttstr),
"%s,",
205 strlcat(xforms, ttstr,
sizeof(xforms));
207 xforms[strlen(xforms)-1] =
'\0';
209 size_t space =
sizeof(am->
pname) - strlen(am->
name) - 3;
210 char toprint[space + 1];
211 memset(toprint, 0x00, space + 1);
212 if (space < strlen(xforms)) {
215 strlcpy(toprint, xforms,
sizeof(toprint));
217 (void)snprintf(am->
pname,
sizeof(am->
pname),
"%s#%d (%s)",
220 (void)snprintf(am->
pname,
sizeof(am->
pname),
"%s#%d",
227 SCLogDebug(
"copied mpm registration for %s id %u "
228 "with parent %u and GetData %p",
240 while (list != NULL) {
260 char confstring[256] =
"detect.mpm.";
262 strlcat(confstring,
".shared",
sizeof(confstring));
296 if (mpm_ctx != NULL) {
316 SCLogDebug(
"registering %s/%d/%p/%s/%u",
name, priority, PrefilterRegister,
323 if (sm_list < 0 || sm_list > UINT16_MAX) {
331 am->
sm_list = (uint16_t)sm_list;
346 while (t->
next != NULL) {
362 SCLogDebug(
"registering %d/%d",
id, parent_id);
383 memcpy(&am->
transforms, transforms,
sizeof(*transforms));
389 SCLogDebug(
"copied mpm registration for %s id %u "
391 t->
name,
id, parent_id);
404 SCLogDebug(
"registering %s/%d/%p/%s/%u",
name, priority, PrefilterRegister,
408 if (sm_list < 0 || sm_list > UINT16_MAX) {
420 am->
sm_list = (uint16_t)sm_list;
435 if (
SCConfGetBool(
"detect.mpm.frame.shared", &confshared) == 1)
449 while (t->
next != NULL) {
464 while (list != NULL) {
475 while (t->
next != NULL) {
487 char confstring[256] =
"detect.mpm.";
489 strlcat(confstring,
".shared",
sizeof(confstring));
525 if (mpm_ctx != NULL) {
547 PrefilterRegister, GetData);
566 am->
sm_list = (uint16_t)sm_list;
571 am->
pkt_v1.GetData = GetData;
577 while (t->
next != NULL) {
591 const int id,
const int parent_id,
594 SCLogDebug(
"registering %d/%d",
id, parent_id);
613 memcpy(&am->
transforms, transforms,
sizeof(*transforms));
619 SCLogDebug(
"copied mpm registration for %s id %u "
620 "with parent %u and GetData %p",
631 while (list != NULL) {
642 while (t->
next != NULL) {
654 char confstring[256] =
"detect.mpm.";
656 strlcat(confstring,
".shared",
sizeof(confstring));
690 if (mpm_ctx != NULL) {
709 char confstring[256] =
"detect.mpm.";
711 strlcat(confstring,
".shared",
sizeof(confstring));
800 if (!(s->
proto.
proto[IPPROTO_TCP / 8] & 1 << (IPPROTO_TCP % 8))) {
830 if (!(s->
proto.
proto[IPPROTO_TCP / 8] & 1 << (IPPROTO_TCP % 8))) {
856 const char *mpm_algo;
860 if ((
SCConfGet(
"mpm-algo", &mpm_algo)) == 1) {
861 if (mpm_algo != NULL) {
862 #if __BYTE_ORDER == __BIG_ENDIAN
863 if (strcmp(mpm_algo,
"ac-ks") == 0) {
865 "not work on big endian systems at this time.");
868 if (strcmp(
"auto", mpm_algo) == 0) {
870 }
else if (strcmp(
"ac-bs", mpm_algo) == 0) {
871 SCLogWarning(
"mpm-algo \"ac-bs\" has been removed. See ticket #6586.");
884 #ifndef BUILD_HYPERSCAN
885 if ((strcmp(mpm_algo,
"hs") == 0)) {
886 FatalError(
"Hyperscan (hs) support for mpm-algo is "
887 "not compiled into Suricata.");
892 "in the yaml conf file: \"%s\"",
902 SCLogDebug(
"mpm_ctx %p, mpm_matcher %"PRIu16
"", mpm_ctx, mpm_matcher);
908 SCLogDebug(
"mpm_thread_ctx %p, mpm_matcher %"PRIu16
"", mpm_thread_ctx, mpm_matcher);
913 SCLogDebug(
"mpm_thread_ctx %p, type %"PRIu16, mpm_thread_ctx, mpm_matcher);
933 memset(&a, 0 ,
sizeof(a));
937 for (u = 0; u < patlen; u++) {
938 if (a[pat[u]] == 0) {
941 else if (isprint(pat[u]) || pat[u] == 0x00 || pat[u] == 0x01 || pat[u] == 0xFF)
958 uint16_t pat_offset = cd->
offset;
959 uint16_t pat_depth = cd->
depth;
962 if (chop && (pat_depth || pat_offset)) {
974 pat_depth = pat_offset = 0;
981 pat_offset, pat_depth,
986 pat_offset, pat_depth,
993 pat_offset, pat_depth,
998 pat_offset, pat_depth,
1004 #define SGH_PROTO(sgh, p) ((sgh)->init->protos[(p)] == 1)
1005 #define SGH_DIRECTION_TS(sgh) ((sgh)->init->direction & SIG_FLAG_TOSERVER)
1006 #define SGH_DIRECTION_TC(sgh) ((sgh)->init->direction & SIG_FLAG_TOCLIENT)
1010 if (s == NULL || mpm_sm == NULL)
1036 uint16_t max_len,
bool skip_negated_content)
1051 if (mpm_sm == NULL) {
1060 }
else if (ls == ss) {
1079 for (; app != NULL; app = app->
next) {
1082 if (app->
dir == 1) {
1103 int pos_sm_list[nlists];
1104 int neg_sm_list[nlists];
1105 memset(pos_sm_list, 0, nlists *
sizeof(
int));
1106 memset(neg_sm_list, 0, nlists *
sizeof(
int));
1107 int pos_sm_list_cnt = 0;
1108 int neg_sm_list_cnt = 0;
1157 SetMpm(s, sm, list_id);
1162 neg_sm_list[list_id] = 1;
1165 pos_sm_list[list_id] = 1;
1173 SCLogDebug(
"neg_sm_list_cnt %d pos_sm_list_cnt %d", neg_sm_list_cnt, pos_sm_list_cnt);
1176 int *curr_sm_list = NULL;
1177 int skip_negated_content = 1;
1178 if (pos_sm_list_cnt > 0) {
1179 curr_sm_list = pos_sm_list;
1180 }
else if (neg_sm_list_cnt > 0) {
1181 curr_sm_list = neg_sm_list;
1182 skip_negated_content = 0;
1187 int final_sm_list[nlists];
1188 memset(&final_sm_list, 0, (nlists *
sizeof(
int)));
1190 int count_final_sm_list = 0;
1191 int count_txbidir_toclient_sm_list = 0;
1195 while (tmp != NULL) {
1197 tmp != NULL && priority == tmp->
priority;
1203 if (curr_sm_list[tmp->
list_id] == 0)
1208 if (count_final_sm_list == 0) {
1210 final_sm_list[count_txbidir_toclient_sm_list++] = tmp->
list_id;
1216 final_sm_list[count_final_sm_list++] = tmp->
list_id;
1219 if (count_final_sm_list != 0)
1225 count_final_sm_list = count_txbidir_toclient_sm_list;
1227 BUG_ON(count_final_sm_list == 0);
1228 SCLogDebug(
"count_final_sm_list %d skip_negated_content %d", count_final_sm_list,
1229 skip_negated_content);
1231 uint16_t max_len = 0;
1232 for (
int i = 0; i < count_final_sm_list; i++) {
1233 SCLogDebug(
"i %d final_sm_list[i] %d", i, final_sm_list[i]);
1256 if (final_sm_list[i] == list_id) {
1277 int mpm_sm_list = -1;
1278 for (
int i = 0; i < count_final_sm_list; i++) {
1284 skip_negated_content);
1285 if (mpm_sm != prev_mpm_sm) {
1286 mpm_sm_list = final_sm_list[i];
1293 if (final_sm_list[i] == list_id) {
1299 skip_negated_content);
1301 if (mpm_sm != prev_mpm_sm) {
1302 mpm_sm_list = list_id;
1310 if (mpm_sm != NULL) {
1311 BUG_ON(mpm_sm_list == -1);
1313 BUG_ON(check_list != mpm_sm_list);
1317 SetMpm(s, mpm_sm, mpm_sm_list);
1329 static uint32_t MpmStoreHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
1351 static char MpmStoreCompareFunc(
void *data1, uint16_t len1,
void *data2,
1381 static void MpmStoreFreeFunc(
void *ptr)
1411 MpmStoreCompareFunc,
1456 while (am != NULL) {
1464 while (am != NULL) {
1479 uint32_t appstats[app_mpms_cnt + 1];
1480 memset(&appstats, 0x00,
sizeof(appstats));
1482 uint32_t pktstats[pkt_mpms_cnt + 1];
1483 memset(&pktstats, 0x00,
sizeof(pktstats));
1485 uint32_t framestats[frame_mpms_cnt + 1];
1486 memset(&framestats, 0x00,
sizeof(framestats));
1493 if (ms == NULL || ms->
mpm_ctx == NULL) {
1503 SCLogDebug(
"%s: %u patterns. Min %u, Max %u. Ctx %p",
1511 SCLogDebug(
"%s %s %s: %u patterns. Min %u, Max %u. Ctx %p",
1532 for (
int x = 0; x <
MPMB_MAX; x++) {
1536 while (am != NULL) {
1537 if (appstats[am->
sm_list] > 0) {
1540 SCLogPerf(
"AppLayer MPM \"%s %s (%s)\": %u", direction,
name,
1546 while (pm != NULL) {
1547 if (pktstats[pm->
sm_list] > 0) {
1554 while (um != NULL) {
1555 if (framestats[um->
sm_list] > 0) {
1624 const bool mpm_supports_endswith =
1629 if (ms->
sid_array[sig / 8] & (1 << (sig % 8))) {
1649 SCLogDebug(
"not adding negated mpm as it's not 'single'");
1686 uint8_t sids_array[max_sid];
1687 memset(sids_array, 0x00, max_sid);
1688 int sgh_mpm_context = 0;
1753 sids_array[s->
num / 8] |= 1 << (s->
num % 8);
1761 sids_array[s->
num / 8] |= 1 << (s->
num % 8);
1767 sids_array[s->
num / 8] |= 1 << (s->
num % 8);
1771 sids_array[s->
num / 8] |= 1 << (s->
num % 8);
1782 MpmStore lookup = { sids_array, max_sid, direction, buf, sm_list, 0, 0, NULL };
1785 if (result == NULL) {
1789 uint8_t *sids =
SCCalloc(1, max_sid);
1795 memcpy(sids, sids_array, max_sid);
1803 MpmStoreSetup(
de_ctx, copy);
1804 MpmStoreAdd(
de_ctx, copy);
1831 0, am->
app_v2.alproto, NULL };
1836 if (result == NULL) {
1858 MpmStoreSetup(
de_ctx, copy);
1859 MpmStoreAdd(
de_ctx, copy);
1882 if (result == NULL) {
1902 MpmStoreSetup(
de_ctx, copy);
1903 MpmStoreAdd(
de_ctx, copy);
1925 if (result == NULL) {
1946 MpmStoreSetup(
de_ctx, copy);
1947 MpmStoreAdd(
de_ctx, copy);
1968 SCLogDebug(
"rule group %p has SIG_GROUP_HEAD_HAVERAWSTREAM set", sgh);
1972 SCLogDebug(
"rule group %p does NOT have SIG_GROUP_HEAD_HAVERAWSTREAM set", sgh);
1984 static uint32_t DetectBufferInstanceHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
1991 static char DetectBufferInstanceCompareFunc(
void *data1, uint16_t len1,
void *data2, uint16_t len2)
1998 static void DetectBufferInstanceFreeFunc(
void *ptr)
2010 return HashListTableInit(4096, DetectBufferInstanceHashFunc, DetectBufferInstanceCompareFunc,
2011 DetectBufferInstanceFreeFunc);
2023 memset(engines, 0,
sizeof(engines));
2024 int engines_idx[max_buffer_id];
2025 memset(engines_idx, 0,
sizeof(engines_idx));
2026 int types[max_buffer_id];
2027 memset(types, 0,
sizeof(types));
2031 types[a->sm_list] = a->type;
2035 if (instance == NULL) {
2036 instance =
SCCalloc(1,
sizeof(*instance));
2037 BUG_ON(instance == NULL);
2038 instance->
list = a->sm_list;
2048 if (add_ts || add_tc) {
2049 types[a->sm_list] = a->type;
2050 engines[a->sm_list][engines_idx[a->sm_list]++] = a->frame_v1.alproto;
2054 if (instance == NULL) {
2055 instance =
SCCalloc(1,
sizeof(*instance));
2056 BUG_ON(instance == NULL);
2057 instance->
list = a->sm_list;
2058 instance->
alproto = a->frame_v1.alproto;
2068 if (add_ts || add_tc) {
2069 types[a->sm_list] = a->type;
2070 engines[a->sm_list][engines_idx[a->sm_list]++] = a->app_v2.alproto;
2074 if (instance == NULL) {
2075 instance =
SCCalloc(1,
sizeof(*instance));
2076 BUG_ON(instance == NULL);
2077 instance->
list = a->sm_list;
2078 instance->
alproto = a->app_v2.alproto;
2086 for (uint32_t sig = 0; sig < sh->
init->
sig_cnt; sig++) {
2098 switch (types[list]) {
2102 for (
int e = 0; e < engines_idx[list]; e++) {
2103 const AppProto alproto = engines[list][e];
2109 if (instance == NULL)
2142 if (instance == NULL)
2173 if (instance == NULL) {
2180 MpmStore *mpm_store = MpmStorePrepareBufferPkt(
de_ctx, sh, a, sa);
2181 if (mpm_store != NULL) {
2184 SCLogDebug(
"a %p a->name %s a->reg->PrefilterRegisterWithListId %p "
2185 "mpm_store->mpm_ctx %p", a, a->name,
2186 a->PrefilterRegisterWithListId, mpm_store->
mpm_ctx);
2190 if (a->PrefilterRegisterWithListId && mpm_store->
mpm_ctx) {
2193 a, a->sm_list) != 0);
2194 SCLogDebug(
"mpm %s %d set up", a->name, a->sm_list);
2203 if (instance == NULL) {
2211 SCLogDebug(
"a %s direction %d PrefilterRegisterWithListId %p", a->name, a->direction,
2212 a->PrefilterRegisterWithListId);
2213 MpmStore *mpm_store = MpmStorePrepareBufferFrame(
de_ctx, sh, a, sa);
2214 if (mpm_store != NULL) {
2217 SCLogDebug(
"a %p a->name %s a->reg->PrefilterRegisterWithListId %p "
2218 "mpm_store->mpm_ctx %p",
2219 a, a->name, a->PrefilterRegisterWithListId, mpm_store->
mpm_ctx);
2224 if (a->PrefilterRegisterWithListId && mpm_store->
mpm_ctx) {
2225 BUG_ON(a->PrefilterRegisterWithListId(
2227 SCLogDebug(
"mpm %s %d set up", a->name, a->sm_list);
2238 if (instance == NULL) {
2246 MpmStore *mpm_store = MpmStorePrepareBufferAppLayer(
de_ctx, sh, a, sa);
2247 if (mpm_store != NULL) {
2250 SCLogDebug(
"a %p a->name %s a->PrefilterRegisterWithListId %p "
2251 "mpm_store->mpm_ctx %p",
2252 a, a->name, a->PrefilterRegisterWithListId, mpm_store->
mpm_ctx);
2256 if (a->PrefilterRegisterWithListId && mpm_store->
mpm_ctx) {
2257 BUG_ON(a->PrefilterRegisterWithListId(
2259 SCLogDebug(
"mpm %s %d set up", a->name, a->sm_list);
2276 if (mpm_store != NULL) {
2281 if (mpm_store != NULL) {
2285 SetRawReassemblyFlag(
de_ctx, sh);
2289 if (mpm_store != NULL) {
2294 if (mpm_store != NULL) {
2298 SetRawReassemblyFlag(
de_ctx, sh);
2300 }
else if (
SGH_PROTO(sh, IPPROTO_UDP)) {
2303 if (mpm_store != NULL) {
2309 if (mpm_store != NULL) {
2315 if (mpm_store != NULL) {
2339 static uint32_t PatternChopHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
2342 uint32_t hash = p->
sm_list + ContentFlagsForHash(p->
cd);
2344 const uint8_t *content = p->
cd->
content;
2362 static uint32_t PatternNoChopHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
2365 uint32_t hash = p->
sm_list + ContentFlagsForHash(p->
cd);
2381 static char PatternChopCompareFunc(
void *data1, uint16_t len1,
void *data2, uint16_t len2)
2389 if (ContentFlagsForHash(p1->
cd) != ContentFlagsForHash(p2->
cd))
2405 if (p1_content_len != p2_content_len)
2408 if (memcmp(p1_content, p2_content, p1_content_len) != 0) {
2426 static char PatternNoChopCompareFunc(
void *data1, uint16_t len1,
void *data2, uint16_t len2)
2434 if (ContentFlagsForHash(p1->
cd) != ContentFlagsForHash(p2->
cd))
2447 static void PatternFreeFunc(
void *ptr)
2474 HashListTableInit(4096, PatternChopHashFunc, PatternChopCompareFunc, PatternFreeFunc);
2505 SCLogDebug(
"%u: add id %u cnt %u", s->
id, add->cd->id, add->cnt);
2522 4096, PatternNoChopHashFunc, PatternNoChopCompareFunc, PatternFreeFunc);
2528 switch (smd->
type) {
2558 for (; app != NULL; app = app->
next) {
2561 switch (smd->
type) {
2566 .
cd = cd, .sm_list = app->
sm_list, .cnt = 0, .mpm = 0
2591 for (; pkt != NULL; pkt = pkt->
next) {
2598 switch (smd->
type) {
2603 .
cd = cd, .sm_list = pkt->
sm_list, .cnt = 0, .mpm = 0
2628 for (; frame != NULL; frame = frame->
next) {
2635 switch (smd->
type) {
2640 .
cd = cd, .sm_list = frame->
sm_list, .cnt = 0, .mpm = 0
void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t matcher)
#define DETECT_CONTENT_NOCASE
int SignatureHasPacketContent(const Signature *s)
check if a signature has patterns that are to be inspected against a packets payload (as opposed to t...
uint32_t pkt_mpms_list_cnt
#define HashListTableGetListData(hb)
uint32_t frame_mpms_list_cnt
uint32_t max_content_list_id
int PrefilterGenericMpmPktRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
void DetectAppLayerMpmMultiRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionMultiBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
#define SGH_DIRECTION_TC(sgh)
#define DETECT_CONTENT_FAST_PATTERN_CHOP
struct SigMatch_ * smlists[DETECT_SM_LIST_MAX]
struct DetectBufferMpmRegistry_::@87::@91 frame_v1
void PatternMatchDestroy(MpmCtx *mpm_ctx, uint16_t mpm_matcher)
SigTableElmt * sigmatch_table
int32_t sgh_mpm_context_proto_tcp_packet
int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
Prepare the pattern matcher ctx in a sig group head.
struct SCFPSupportSMList_ * next
struct DetectEngineAppInspectionEngine_ * next
void MpmStoreFree(DetectEngineCtx *de_ctx)
Frees the hash table - DetectEngineCtx->mpm_hash_table, allocated by MpmStoreInit() function.
void DetectFrameMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Container for matching data for a signature group.
HashListTable * pattern_hash_table
void MpmFactoryReClaimMpmCtx(const DetectEngineCtx *de_ctx, MpmCtx *mpm_ctx)
void MpmStoreReportStats(const DetectEngineCtx *de_ctx)
void DetectPktMpmRegister(const char *name, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), InspectionBufferGetPktDataPtr GetData)
register a MPM engine
void DetectBufferTypeSupportsFrames(const char *name)
void DetectMpmInitializeFrameMpms(DetectEngineCtx *de_ctx)
@ DETECT_SM_LIST_DYNAMIC_START
#define DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED
struct DetectBufferMpmRegistry_::@87::@90 pkt_v1
InspectionBuffer *(* InspectionMultiBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id, const uint32_t local_id)
uint32_t PatternStrength(uint8_t *pat, uint16_t patlen)
Predict a strength value for patterns.
DetectBufferMpmRegistry * pkt_mpms_list
@ DETECT_BUFFER_MPM_TYPE_FRAME
int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx)
Figure out the FP and their respective content ids for all the sigs in the engine.
InspectionBuffer *(* InspectionBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id)
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
main detection engine ctx
int SCConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
#define DETECT_CONTENT_MPM_IS_CONCLUSIVE(c)
HashListTableBucket * HashListTableGetListHead(HashListTable *ht)
#define DETECT_CONTENT_DEPTH_VAR
InspectionBuffer *(* InspectionBufferGetPktDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Packet *p, const int list_id)
const char * DetectEngineBufferTypeGetNameById(const DetectEngineCtx *de_ctx, const int id)
void DetectMpmInitializeBuiltinMpms(DetectEngineCtx *de_ctx)
struct DetectBufferMpmRegistry_ * next
#define SIG_FLAG_REQUIRE_STREAM
#define SIG_FLAG_TXBOTHDIR
int SCConfGetBool(const char *name, int *val)
Retrieve a configuration value as a boolean.
one time registration of keywords at start up
const struct DetectContentData_ * cd
#define SIG_GROUP_HEAD_HAVERAWSTREAM
uint8_t mpm_default_matcher
SigMatchData * sm_arrays[DETECT_SM_LIST_MAX]
void * HashListTableLookup(HashListTable *ht, void *data, uint16_t datalen)
#define SIG_FLAG_TOCLIENT
int32_t sgh_mpm_context_proto_udp_packet
DetectEngineTransforms transforms
void ShortenString(const char *input, char *output, size_t output_size, char c)
void DetectEngineRegisterFastPatternForId(DetectEngineCtx *de_ctx, int list_id, int priority)
void EngineAnalysisAddAllRulePatterns(DetectEngineCtx *de_ctx, const Signature *s)
add all patterns on our stats hash Used to fill the hash later used by DumpPatterns()
DetectEngineFrameInspectionEngine * frame_inspect
const char * cache_dir_path
int DetectBufferTypeGetByName(const char *name)
int HashListTableAdd(HashListTable *ht, void *data, uint16_t datalen)
size_t strlcpy(char *dst, const char *src, size_t siz)
void DetectAppLayerMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
void MpmInitCtx(MpmCtx *mpm_ctx, uint8_t matcher)
int32_t sgh_mpm_context_proto_other_packet
#define HashListTableGetListNext(hb)
#define SIG_FLAG_TOSERVER
HashListTable * HashListTableInit(uint32_t size, uint32_t(*Hash)(struct HashListTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
void MpmDestroyThreadCtx(MpmThreadCtx *mpm_thread_ctx, const uint16_t matcher)
#define DETECT_CONTENT_ENDS_WITH
MpmCtx * MpmFactoryGetMpmCtxForProfile(const DetectEngineCtx *de_ctx, int32_t id, int direction)
void DetectMpmInitializePktMpms(DetectEngineCtx *de_ctx)
@ ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE
#define MPM_PATTERN_CTX_OWNS_ID
size_t strlcat(char *, const char *src, size_t siz)
#define DetectEngineGetMaxSigId(de_ctx)
#define DETECT_CONTENT_DEPTH
DetectEnginePktInspectionEngine * pkt_inspect
struct DetectBufferMpmRegistry_::@87::@89 app_v2
#define DETECT_CONTENT_IS_SINGLE(c)
#define DETECT_CONTENT_NEGATED
int PrefilterGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
void PatternMatchThreadPrepare(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
#define SCLogWarning(...)
Macro used to log WARNING messages.
int DetectEngineBufferTypeRegister(DetectEngineCtx *de_ctx, const char *name)
SigGroupHeadInitData * init
void DetectAppLayerMpmRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
register an app layer keyword for mpm
DetectEngineAppInspectionEngine * app_inspect
bool DetectBufferToClient(const DetectEngineCtx *de_ctx, int buf_id, AppProto alproto)
#define MPMCTX_FLAGS_GLOBAL
int(* PrefilterRegisterFunc)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
int32_t MpmFactoryRegisterMpmCtxProfile(DetectEngineCtx *de_ctx, const char *name, const int sm_list, const AppProto alproto)
Register a new Mpm Context.
int32_t sgh_mpm_context_stream
void DetectEngineBufferTypeSupportsFrames(DetectEngineCtx *de_ctx, const char *name)
DetectBufferMpmRegistry * frame_mpms_list
int PrefilterPktPayloadRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx)
@ DETECT_BUFFER_MPM_TYPE_PKT
SignatureInitData * init_data
int FastPatternSupportEnabledForSigMatchList(const DetectEngineCtx *de_ctx, const int list_id)
Checks if a particular buffer is in the list of lists that need to be searched for a keyword that has...
enum DetectBufferMpmType type
int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
void DetectEngineBufferTypeSupportsTransformations(DetectEngineCtx *de_ctx, const char *name)
#define SGH_DIRECTION_TS(sgh)
#define MPM_FEATURE_FLAG_ENDSWITH
MpmStore * MpmStorePrepareBuffer(DetectEngineCtx *de_ctx, SigGroupHead *sgh, enum MpmBuiltinBuffers buf)
Get MpmStore for a built-in buffer type.
int DetectMpmPrepareFrameMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
void DetectEngineFrameMpmRegister(DetectEngineCtx *de_ctx, const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), AppProto alproto, uint8_t type)
int SignatureHasStreamContent(const Signature *s)
check if a signature has patterns that are to be inspected against the stream payload (as opposed to ...
enum DetectBufferMpmType type
int MpmStoreInit(DetectEngineCtx *de_ctx)
Initializes the MpmStore mpm hash table to be used by the detection engine context.
DetectBufferMpmRegistry * app_mpms_list
@ DETECT_BUFFER_MPM_TYPE_APP
void DetectBufferTypeSupportsMpm(const char *name)
void HashListTableFree(HashListTable *ht)
void SupportFastPatternForSigMatchList(int list_id, int priority)
Lets one add a sm list id to be searched for potential fp supported keywords later.
struct DetectEngineFrameInspectionEngine * next
struct DetectEnginePktInspectionEngine * next
uint8_t PatternMatchDefaultMatcher(void)
Function to return the multi pattern matcher algorithm to be used by the engine, based on the mpm-alg...
int DetectMpmPreparePktMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
void DetectEngineBufferTypeSupportsMpm(DetectEngineCtx *de_ctx, const char *name)
uint32_t app_mpms_list_cnt
void DetectBufferTypeSupportsTransformations(const char *name)
#define MPM_PATTERN_FLAG_ENDSWITH
const char * builtin_mpms[]
SignatureInitDataBuffer * buffers
DetectEngineAppInspectionEngine * app_inspect_engines
HashListTable * mpm_hash_table
int(* Prepare)(MpmConfig *, struct MpmCtx_ *)
void(* DestroyCtx)(struct MpmCtx_ *)
int SigMatchListSMBelongsTo(const Signature *s, const SigMatch *key_sm)
#define MPM_CTX_FACTORY_UNIQUE_CONTEXT
int DetectMpmPrepareBuiltinMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for builtin buffers that are in "single or "shared" mode.
#define DETECT_CONTENT_OFFSET
int(* PrefilterRegisterWithListId)(struct DetectEngineCtx_ *de_ctx, struct SigGroupHead_ *sgh, MpmCtx *mpm_ctx, const struct DetectBufferMpmRegistry_ *mpm_reg, int list_id)
#define DETECT_CONTENT_MPM
a single match condition for a signature
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
void DetectMpmInitializeAppMpms(DetectEngineCtx *de_ctx)
@ DETECT_BUFFER_MPM_TYPE_SIZE
#define SGH_PROTO(sgh, p)
#define DETECT_CONTENT_REPLACE
void DetectPktMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
#define DETECT_CONTENT_FAST_PATTERN
#define MPMCTX_FLAGS_CACHE_TO_DISK
void DetectFrameMpmRegister(const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), AppProto alproto, uint8_t type)
register a MPM engine
struct DetectBufferInstance DetectBufferInstance
int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
#define SCMemcmp(a, b, c)
int DetectMpmPrepareAppMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
SCFPSupportSMList * fp_support_smlist_list
#define DEBUG_VALIDATE_BUG_ON(exp)
void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
enum MpmBuiltinBuffers buffer
void RetrieveFPForSig(const DetectEngineCtx *de_ctx, Signature *s)
uint32_t StringHashDjb2(const uint8_t *data, uint32_t datalen)
int PrefilterPktStreamRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx)
#define DETECT_CONTENT_OFFSET_VAR
#define SIG_FLAG_REQUIRE_PACKET