Go to the documentation of this file.
67 "toserver TCP packet",
68 "toclient TCP packet",
69 "toserver TCP stream",
70 "toclient TCP stream",
71 "toserver UDP packet",
72 "toclient UDP packet",
91 AppProto alproto,
int tx_min_progress)
93 SCLogDebug(
"registering %s/%d/%d/%p/%p/%u/%d", name, direction, priority,
94 PrefilterRegister, GetData, alproto, tx_min_progress);
96 BUG_ON(tx_min_progress >= 48);
107 FatalError(
"MPM engine registration for %s failed", name);
116 am->
sm_list = (int16_t)sm_list;
122 am->
app_v2.GetData = GetData;
123 am->
app_v2.alproto = alproto;
124 am->
app_v2.tx_min_progress = tx_min_progress;
130 while (t->
next != NULL) {
144 const int id,
const int parent_id,
147 SCLogDebug(
"registering %d/%d",
id, parent_id);
170 memcpy(&am->
transforms, transforms,
sizeof(*transforms));
175 char xforms[1024] =
"";
176 for (
int i = 0; i < transforms->
cnt; i++) {
178 (void)snprintf(ttstr,
sizeof(ttstr),
"%s,",
180 strlcat(xforms, ttstr,
sizeof(xforms));
182 xforms[strlen(xforms)-1] =
'\0';
184 size_t space =
sizeof(am->
pname) - strlen(am->
name) - 3;
185 char toprint[space + 1];
186 memset(toprint, 0x00, space + 1);
187 if (space < strlen(xforms)) {
190 strlcpy(toprint, xforms,
sizeof(toprint));
192 (void)snprintf(am->
pname,
sizeof(am->
pname),
"%s#%d (%s)",
193 am->
name, id, toprint);
195 (void)snprintf(am->
pname,
sizeof(am->
pname),
"%s#%d",
202 SCLogDebug(
"copied mpm registration for %s id %u "
203 "with parent %u and GetData %p",
215 while (list != NULL) {
235 char confstring[256] =
"detect.mpm.";
237 strlcat(confstring,
".shared",
sizeof(confstring));
271 if (mpm_ctx != NULL) {
291 SCLogDebug(
"registering %s/%d/%p/%s/%u", name, priority, PrefilterRegister,
298 if (sm_list < 0 || sm_list > UINT16_MAX) {
299 FatalError(
"MPM engine registration for %s failed", name);
306 am->
sm_list = (uint16_t)sm_list;
321 while (t->
next != NULL) {
337 SCLogDebug(
"registering %d/%d",
id, parent_id);
358 memcpy(&am->
transforms, transforms,
sizeof(*transforms));
364 SCLogDebug(
"copied mpm registration for %s id %u "
366 t->
name,
id, parent_id);
379 SCLogDebug(
"registering %s/%d/%p/%s/%u", name, priority, PrefilterRegister,
383 if (sm_list < 0 || sm_list > UINT16_MAX) {
384 FatalError(
"MPM engine registration for %s failed", name);
395 am->
sm_list = (uint16_t)sm_list;
410 if (
ConfGetBool(
"detect.mpm.frame.shared", &confshared) == 1)
424 while (t->
next != NULL) {
439 while (list != NULL) {
450 while (t->
next != NULL) {
462 char confstring[256] =
"detect.mpm.";
464 strlcat(confstring,
".shared",
sizeof(confstring));
500 if (mpm_ctx != NULL) {
521 SCLogDebug(
"registering %s/%d/%p/%p", name, priority,
522 PrefilterRegister, GetData);
533 FatalError(
"MPM engine registration for %s failed", name);
541 am->
sm_list = (uint16_t)sm_list;
546 am->
pkt_v1.GetData = GetData;
552 while (t->
next != NULL) {
566 const int id,
const int parent_id,
569 SCLogDebug(
"registering %d/%d",
id, parent_id);
588 memcpy(&am->
transforms, transforms,
sizeof(*transforms));
594 SCLogDebug(
"copied mpm registration for %s id %u "
595 "with parent %u and GetData %p",
606 while (list != NULL) {
617 while (t->
next != NULL) {
629 char confstring[256] =
"detect.mpm.";
631 strlcat(confstring,
".shared",
sizeof(confstring));
665 if (mpm_ctx != NULL) {
684 char confstring[256] =
"detect.mpm.";
685 strlcat(confstring, name,
sizeof(confstring));
686 strlcat(confstring,
".shared",
sizeof(confstring));
693 SCLogDebug(
"using unique mpm ctx' for %s", name);
696 SCLogDebug(
"using shared mpm ctx' for %s", name);
775 if (!(s->
proto.
proto[IPPROTO_TCP / 8] & 1 << (IPPROTO_TCP % 8))) {
805 if (!(s->
proto.
proto[IPPROTO_TCP / 8] & 1 << (IPPROTO_TCP % 8))) {
831 const char *mpm_algo;
835 if ((
ConfGet(
"mpm-algo", &mpm_algo)) == 1) {
836 if (mpm_algo != NULL) {
837 #if __BYTE_ORDER == __BIG_ENDIAN
838 if (strcmp(mpm_algo,
"ac-ks") == 0) {
840 "not work on big endian systems at this time.");
843 if (strcmp(
"auto", mpm_algo) == 0) {
845 }
else if (strcmp(
"ac-bs", mpm_algo) == 0) {
846 SCLogWarning(
"mpm-algo \"ac-bs\" has been removed. See ticket #6586.");
853 if (strcmp(
mpm_table[u].name, mpm_algo) == 0) {
859 #ifndef BUILD_HYPERSCAN
860 if ((strcmp(mpm_algo,
"hs") == 0)) {
861 FatalError(
"Hyperscan (hs) support for mpm-algo is "
862 "not compiled into Suricata.");
867 "in the yaml conf file: \"%s\"",
877 SCLogDebug(
"mpm_ctx %p, mpm_matcher %"PRIu16
"", mpm_ctx, mpm_matcher);
883 SCLogDebug(
"mpm_thread_ctx %p, mpm_matcher %"PRIu16
" defunct", mpm_thread_ctx, mpm_matcher);
888 SCLogDebug(
"mpm_thread_ctx %p, mpm_matcher %"PRIu16
"", mpm_thread_ctx, mpm_matcher);
893 SCLogDebug(
"mpm_thread_ctx %p, type %"PRIu16, mpm_thread_ctx, mpm_matcher);
913 memset(&a, 0 ,
sizeof(a));
917 for (u = 0; u < patlen; u++) {
918 if (a[pat[u]] == 0) {
921 else if (isprint(pat[u]) || pat[u] == 0x00 || pat[u] == 0x01 || pat[u] == 0xFF)
938 uint16_t pat_offset = cd->
offset;
939 uint16_t pat_depth = cd->
depth;
942 if (chop && (pat_depth || pat_offset)) {
954 pat_depth = pat_offset = 0;
961 pat_offset, pat_depth,
966 pat_offset, pat_depth,
973 pat_offset, pat_depth,
978 pat_offset, pat_depth,
986 #define SGH_PROTO(sgh, p) ((sgh)->init->protos[(p)] == 1)
987 #define SGH_DIRECTION_TS(sgh) ((sgh)->init->direction & SIG_FLAG_TOSERVER)
988 #define SGH_DIRECTION_TC(sgh) ((sgh)->init->direction & SIG_FLAG_TOCLIENT)
992 if (s == NULL || mpm_sm == NULL)
1019 uint16_t max_len,
bool skip_negated_content)
1034 if (mpm_sm == NULL) {
1043 }
else if (ls == ss) {
1066 int pos_sm_list[nlists];
1067 int neg_sm_list[nlists];
1068 memset(pos_sm_list, 0, nlists *
sizeof(
int));
1069 memset(neg_sm_list, 0, nlists *
sizeof(
int));
1070 int pos_sm_list_cnt = 0;
1071 int neg_sm_list_cnt = 0;
1117 SetMpm(s, sm, list_id);
1122 neg_sm_list[list_id] = 1;
1125 pos_sm_list[list_id] = 1;
1133 SCLogDebug(
"neg_sm_list_cnt %d pos_sm_list_cnt %d", neg_sm_list_cnt, pos_sm_list_cnt);
1136 int *curr_sm_list = NULL;
1137 int skip_negated_content = 1;
1138 if (pos_sm_list_cnt > 0) {
1139 curr_sm_list = pos_sm_list;
1140 }
else if (neg_sm_list_cnt > 0) {
1141 curr_sm_list = neg_sm_list;
1142 skip_negated_content = 0;
1147 int final_sm_list[nlists];
1148 memset(&final_sm_list, 0, (nlists *
sizeof(
int)));
1150 int count_final_sm_list = 0;
1154 while (tmp != NULL) {
1156 tmp != NULL && priority == tmp->
priority;
1162 if (curr_sm_list[tmp->
list_id] == 0)
1164 final_sm_list[count_final_sm_list++] = tmp->
list_id;
1167 if (count_final_sm_list != 0)
1171 BUG_ON(count_final_sm_list == 0);
1172 SCLogDebug(
"count_final_sm_list %d skip_negated_content %d", count_final_sm_list,
1173 skip_negated_content);
1175 uint16_t max_len = 0;
1176 for (
int i = 0; i < count_final_sm_list; i++) {
1177 SCLogDebug(
"i %d final_sm_list[i] %d", i, final_sm_list[i]);
1195 if (final_sm_list[i] == list_id) {
1216 int mpm_sm_list = -1;
1217 for (
int i = 0; i < count_final_sm_list; i++) {
1223 skip_negated_content);
1224 if (mpm_sm != prev_mpm_sm) {
1225 mpm_sm_list = final_sm_list[i];
1232 if (final_sm_list[i] == list_id) {
1238 skip_negated_content);
1240 if (mpm_sm != prev_mpm_sm) {
1241 mpm_sm_list = list_id;
1249 if (mpm_sm != NULL) {
1250 BUG_ON(mpm_sm_list == -1);
1252 BUG_ON(check_list != mpm_sm_list);
1256 SetMpm(s, mpm_sm, mpm_sm_list);
1269 static uint32_t MpmStoreHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
1291 static char MpmStoreCompareFunc(
void *data1, uint16_t len1,
void *data2,
1321 static void MpmStoreFreeFunc(
void *ptr)
1351 MpmStoreCompareFunc,
1396 while (am != NULL) {
1404 while (am != NULL) {
1419 uint32_t appstats[app_mpms_cnt + 1];
1420 memset(&appstats, 0x00,
sizeof(appstats));
1422 uint32_t pktstats[pkt_mpms_cnt + 1];
1423 memset(&pktstats, 0x00,
sizeof(pktstats));
1425 uint32_t framestats[frame_mpms_cnt + 1];
1426 memset(&framestats, 0x00,
sizeof(framestats));
1433 if (ms == NULL || ms->
mpm_ctx == NULL) {
1443 SCLogDebug(
"%s: %u patterns. Min %u, Max %u. Ctx %p",
1451 SCLogDebug(
"%s %s %s: %u patterns. Min %u, Max %u. Ctx %p",
1472 for (
int x = 0; x <
MPMB_MAX; x++) {
1476 while (am != NULL) {
1477 if (appstats[am->
sm_list] > 0) {
1478 const char *name = am->
name;
1480 SCLogPerf(
"AppLayer MPM \"%s %s (%s)\": %u", direction, name,
1486 while (pm != NULL) {
1487 if (pktstats[pm->
sm_list] > 0) {
1488 const char *name = pm->
name;
1494 while (um != NULL) {
1495 if (framestats[um->
sm_list] > 0) {
1496 const char *name = um->
name;
1562 const bool mpm_supports_endswith =
1567 if (ms->
sid_array[sig / 8] & (1 << (sig % 8))) {
1587 SCLogDebug(
"not adding negated mpm as it's not 'single'");
1594 PopulateMpmHelperAddPattern(
1624 uint8_t sids_array[max_sid];
1625 memset(sids_array, 0x00, max_sid);
1626 int sgh_mpm_context = 0;
1691 sids_array[s->
num / 8] |= 1 << (s->
num % 8);
1699 sids_array[s->
num / 8] |= 1 << (s->
num % 8);
1705 sids_array[s->
num / 8] |= 1 << (s->
num % 8);
1709 sids_array[s->
num / 8] |= 1 << (s->
num % 8);
1720 MpmStore lookup = { sids_array, max_sid, direction, buf, sm_list, 0, 0, NULL };
1723 if (result == NULL) {
1727 uint8_t *sids =
SCCalloc(1, max_sid);
1733 memcpy(sids, sids_array, max_sid);
1741 MpmStoreSetup(
de_ctx, copy);
1742 MpmStoreAdd(
de_ctx, copy);
1769 0, am->
app_v2.alproto, NULL };
1774 if (result == NULL) {
1796 MpmStoreSetup(
de_ctx, copy);
1797 MpmStoreAdd(
de_ctx, copy);
1820 if (result == NULL) {
1840 MpmStoreSetup(
de_ctx, copy);
1841 MpmStoreAdd(
de_ctx, copy);
1863 if (result == NULL) {
1884 MpmStoreSetup(
de_ctx, copy);
1885 MpmStoreAdd(
de_ctx, copy);
1906 SCLogDebug(
"rule group %p has SIG_GROUP_HEAD_HAVERAWSTREAM set", sgh);
1910 SCLogDebug(
"rule group %p does NOT have SIG_GROUP_HEAD_HAVERAWSTREAM set", sgh);
1922 static uint32_t DetectBufferInstanceHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
1929 static char DetectBufferInstanceCompareFunc(
void *data1, uint16_t len1,
void *data2, uint16_t len2)
1936 static void DetectBufferInstanceFreeFunc(
void *ptr)
1948 return HashListTableInit(4096, DetectBufferInstanceHashFunc, DetectBufferInstanceCompareFunc,
1949 DetectBufferInstanceFreeFunc);
1961 memset(engines, 0,
sizeof(engines));
1962 int engines_idx[max_buffer_id];
1963 memset(engines_idx, 0,
sizeof(engines_idx));
1964 int types[max_buffer_id];
1965 memset(types, 0,
sizeof(types));
1969 types[a->sm_list] = a->type;
1973 if (instance == NULL) {
1974 instance =
SCCalloc(1,
sizeof(*instance));
1975 BUG_ON(instance == NULL);
1976 instance->
list = a->sm_list;
1986 if (add_ts || add_tc) {
1987 types[a->sm_list] = a->type;
1988 engines[a->sm_list][engines_idx[a->sm_list]++] = a->frame_v1.alproto;
1992 if (instance == NULL) {
1993 instance =
SCCalloc(1,
sizeof(*instance));
1994 BUG_ON(instance == NULL);
1995 instance->
list = a->sm_list;
1996 instance->
alproto = a->frame_v1.alproto;
2006 if (add_ts || add_tc) {
2007 types[a->sm_list] = a->type;
2008 engines[a->sm_list][engines_idx[a->sm_list]++] = a->app_v2.alproto;
2012 if (instance == NULL) {
2013 instance =
SCCalloc(1,
sizeof(*instance));
2014 BUG_ON(instance == NULL);
2015 instance->
list = a->sm_list;
2016 instance->
alproto = a->app_v2.alproto;
2024 for (uint32_t sig = 0; sig < sh->
init->
sig_cnt; sig++) {
2036 switch (types[list]) {
2040 for (
int e = 0; e < engines_idx[list]; e++) {
2041 const AppProto alproto = engines[list][e];
2047 if (instance == NULL)
2080 if (instance == NULL)
2111 if (instance == NULL) {
2118 MpmStore *mpm_store = MpmStorePrepareBufferPkt(
de_ctx, sh, a, sa);
2119 if (mpm_store != NULL) {
2122 SCLogDebug(
"a %p a->name %s a->reg->PrefilterRegisterWithListId %p "
2123 "mpm_store->mpm_ctx %p", a, a->name,
2124 a->PrefilterRegisterWithListId, mpm_store->
mpm_ctx);
2128 if (a->PrefilterRegisterWithListId && mpm_store->
mpm_ctx) {
2131 a, a->sm_list) != 0);
2132 SCLogDebug(
"mpm %s %d set up", a->name, a->sm_list);
2141 if (instance == NULL) {
2149 SCLogDebug(
"a %s direction %d PrefilterRegisterWithListId %p", a->name, a->direction,
2150 a->PrefilterRegisterWithListId);
2151 MpmStore *mpm_store = MpmStorePrepareBufferFrame(
de_ctx, sh, a, sa);
2152 if (mpm_store != NULL) {
2155 SCLogDebug(
"a %p a->name %s a->reg->PrefilterRegisterWithListId %p "
2156 "mpm_store->mpm_ctx %p",
2157 a, a->name, a->PrefilterRegisterWithListId, mpm_store->
mpm_ctx);
2162 if (a->PrefilterRegisterWithListId && mpm_store->
mpm_ctx) {
2163 BUG_ON(a->PrefilterRegisterWithListId(
2165 SCLogDebug(
"mpm %s %d set up", a->name, a->sm_list);
2176 if (instance == NULL) {
2184 MpmStore *mpm_store = MpmStorePrepareBufferAppLayer(
de_ctx, sh, a, sa);
2185 if (mpm_store != NULL) {
2188 SCLogDebug(
"a %p a->name %s a->PrefilterRegisterWithListId %p "
2189 "mpm_store->mpm_ctx %p",
2190 a, a->name, a->PrefilterRegisterWithListId, mpm_store->
mpm_ctx);
2194 if (a->PrefilterRegisterWithListId && mpm_store->
mpm_ctx) {
2195 BUG_ON(a->PrefilterRegisterWithListId(
2197 SCLogDebug(
"mpm %s %d set up", a->name, a->sm_list);
2214 if (mpm_store != NULL) {
2219 if (mpm_store != NULL) {
2223 SetRawReassemblyFlag(
de_ctx, sh);
2227 if (mpm_store != NULL) {
2232 if (mpm_store != NULL) {
2236 SetRawReassemblyFlag(
de_ctx, sh);
2238 }
else if (
SGH_PROTO(sh, IPPROTO_UDP)) {
2241 if (mpm_store != NULL) {
2247 if (mpm_store != NULL) {
2253 if (mpm_store != NULL) {
2277 static uint32_t PatternChopHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
2280 uint32_t hash = p->
sm_list + ContentFlagsForHash(p->
cd);
2282 const uint8_t *content = p->
cd->
content;
2300 static uint32_t PatternNoChopHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
2303 uint32_t hash = p->
sm_list + ContentFlagsForHash(p->
cd);
2319 static char PatternChopCompareFunc(
void *data1, uint16_t len1,
void *data2, uint16_t len2)
2327 if (ContentFlagsForHash(p1->
cd) != ContentFlagsForHash(p2->
cd))
2343 if (p1_content_len != p2_content_len)
2346 if (memcmp(p1_content, p2_content, p1_content_len) != 0) {
2364 static char PatternNoChopCompareFunc(
void *data1, uint16_t len1,
void *data2, uint16_t len2)
2372 if (ContentFlagsForHash(p1->
cd) != ContentFlagsForHash(p2->
cd))
2385 static void PatternFreeFunc(
void *ptr)
2417 HashListTableInit(4096, PatternChopHashFunc, PatternChopCompareFunc, PatternFreeFunc);
2448 SCLogDebug(
"%u: add id %u cnt %u", s->
id, add->cd->id, add->cnt);
2465 4096, PatternNoChopHashFunc, PatternNoChopCompareFunc, PatternFreeFunc);
2471 switch (smd->
type) {
2501 for (; app != NULL; app = app->
next) {
2505 switch (smd->
type) {
2510 .
cd = cd, .sm_list = app->
sm_list, .cnt = 0, .mpm = 0
2535 for (; pkt != NULL; pkt = pkt->
next) {
2542 switch (smd->
type) {
2547 .
cd = cd, .sm_list = pkt->
sm_list, .cnt = 0, .mpm = 0
2572 for (; frame != NULL; frame = frame->
next) {
2579 switch (smd->
type) {
2584 .
cd = cd, .sm_list = frame->
sm_list, .cnt = 0, .mpm = 0
void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t matcher)
#define DETECT_CONTENT_NOCASE
int SignatureHasPacketContent(const Signature *s)
check if a signature has patterns that are to be inspected against a packets payload (as opposed to t...
uint32_t pkt_mpms_list_cnt
#define HashListTableGetListData(hb)
uint32_t frame_mpms_list_cnt
uint32_t max_content_list_id
#define SGH_DIRECTION_TC(sgh)
#define DETECT_CONTENT_FAST_PATTERN_CHOP
struct SigMatch_ * smlists[DETECT_SM_LIST_MAX]
void PatternMatchDestroy(MpmCtx *mpm_ctx, uint16_t mpm_matcher)
int32_t sgh_mpm_context_proto_tcp_packet
int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
Prepare the pattern matcher ctx in a sig group head.
struct SCFPSupportSMList_ * next
struct DetectEngineAppInspectionEngine_ * next
void MpmStoreFree(DetectEngineCtx *de_ctx)
Frees the hash table - DetectEngineCtx->mpm_hash_table, allocated by MpmStoreInit() function.
void DetectFrameMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as a boolean.
Container for matching data for a signature group.
HashListTable * pattern_hash_table
void MpmFactoryReClaimMpmCtx(const DetectEngineCtx *de_ctx, MpmCtx *mpm_ctx)
void MpmStoreReportStats(const DetectEngineCtx *de_ctx)
void DetectPktMpmRegister(const char *name, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), InspectionBufferGetPktDataPtr GetData)
register a MPM engine
void DetectBufferTypeSupportsFrames(const char *name)
struct DetectBufferMpmRegistry_::@88::@92 frame_v1
void DetectMpmInitializeFrameMpms(DetectEngineCtx *de_ctx)
@ DETECT_SM_LIST_DYNAMIC_START
#define DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED
uint32_t PatternStrength(uint8_t *pat, uint16_t patlen)
Predict a strength value for patterns.
DetectBufferMpmRegistry * pkt_mpms_list
@ DETECT_BUFFER_MPM_TYPE_FRAME
int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx)
Figure out the FP and their respective content ids for all the sigs in the engine.
InspectionBuffer *(* InspectionBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id)
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
main detection engine ctx
#define DETECT_CONTENT_MPM_IS_CONCLUSIVE(c)
HashListTableBucket * HashListTableGetListHead(HashListTable *ht)
#define DETECT_CONTENT_DEPTH_VAR
InspectionBuffer *(* InspectionBufferGetPktDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Packet *p, const int list_id)
const char * DetectEngineBufferTypeGetNameById(const DetectEngineCtx *de_ctx, const int id)
void DetectMpmInitializeBuiltinMpms(DetectEngineCtx *de_ctx)
struct DetectBufferMpmRegistry_ * next
#define SIG_FLAG_REQUIRE_STREAM
one time registration of keywords at start up
const struct DetectContentData_ * cd
#define SIG_GROUP_HEAD_HAVERAWSTREAM
uint8_t mpm_default_matcher
SigMatchData * sm_arrays[DETECT_SM_LIST_MAX]
struct DetectBufferMpmRegistry_::@88::@90 app_v2
void * HashListTableLookup(HashListTable *ht, void *data, uint16_t datalen)
#define SIG_FLAG_TOCLIENT
int32_t sgh_mpm_context_proto_udp_packet
DetectEngineTransforms transforms
void ShortenString(const char *input, char *output, size_t output_size, char c)
void DetectEngineRegisterFastPatternForId(DetectEngineCtx *de_ctx, int list_id, int priority)
void EngineAnalysisAddAllRulePatterns(DetectEngineCtx *de_ctx, const Signature *s)
add all patterns on our stats hash Used to fill the hash later used by DumpPatterns()
DetectEngineFrameInspectionEngine * frame_inspect
int DetectBufferTypeGetByName(const char *name)
int HashListTableAdd(HashListTable *ht, void *data, uint16_t datalen)
size_t strlcpy(char *dst, const char *src, size_t siz)
void DetectAppLayerMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
void MpmInitCtx(MpmCtx *mpm_ctx, uint8_t matcher)
int32_t sgh_mpm_context_proto_other_packet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
#define HashListTableGetListNext(hb)
#define SIG_FLAG_TOSERVER
HashListTable * HashListTableInit(uint32_t size, uint32_t(*Hash)(struct HashListTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
void MpmDestroyThreadCtx(MpmThreadCtx *mpm_thread_ctx, const uint16_t matcher)
#define DETECT_CONTENT_ENDS_WITH
MpmCtx * MpmFactoryGetMpmCtxForProfile(const DetectEngineCtx *de_ctx, int32_t id, int direction)
void DetectMpmInitializePktMpms(DetectEngineCtx *de_ctx)
#define MPM_PATTERN_CTX_OWNS_ID
size_t strlcat(char *, const char *src, size_t siz)
#define DetectEngineGetMaxSigId(de_ctx)
#define DETECT_CONTENT_DEPTH
DetectEnginePktInspectionEngine * pkt_inspect
#define DETECT_CONTENT_IS_SINGLE(c)
#define DETECT_CONTENT_NEGATED
int PrefilterGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
void PatternMatchThreadPrepare(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
#define SCLogWarning(...)
Macro used to log WARNING messages.
int DetectEngineBufferTypeRegister(DetectEngineCtx *de_ctx, const char *name)
SigGroupHeadInitData * init
struct DetectBufferMpmRegistry_::@88::@91 pkt_v1
void DetectAppLayerMpmRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
register a MPM engine
DetectEngineAppInspectionEngine * app_inspect
#define MPMCTX_FLAGS_GLOBAL
int(* PrefilterRegisterFunc)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
int32_t MpmFactoryRegisterMpmCtxProfile(DetectEngineCtx *de_ctx, const char *name, const int sm_list, const AppProto alproto)
Register a new Mpm Context.
void PatternMatchThreadPrint(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
int32_t sgh_mpm_context_stream
void DetectEngineBufferTypeSupportsFrames(DetectEngineCtx *de_ctx, const char *name)
DetectBufferMpmRegistry * frame_mpms_list
int PrefilterPktPayloadRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx)
@ DETECT_BUFFER_MPM_TYPE_PKT
int(* Prepare)(struct MpmCtx_ *)
SignatureInitData * init_data
int FastPatternSupportEnabledForSigMatchList(const DetectEngineCtx *de_ctx, const int list_id)
Checks if a particular buffer is in the list of lists that need to be searched for a keyword that has...
enum DetectBufferMpmType type
int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
void DetectEngineBufferTypeSupportsTransformations(DetectEngineCtx *de_ctx, const char *name)
#define SGH_DIRECTION_TS(sgh)
int PrefilterGenericMpmPktRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
#define MPM_FEATURE_FLAG_ENDSWITH
MpmStore * MpmStorePrepareBuffer(DetectEngineCtx *de_ctx, SigGroupHead *sgh, enum MpmBuiltinBuffers buf)
Get MpmStore for a built-in buffer type.
int DetectMpmPrepareFrameMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
void DetectEngineFrameMpmRegister(DetectEngineCtx *de_ctx, const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), AppProto alproto, uint8_t type)
int SignatureHasStreamContent(const Signature *s)
check if a signature has patterns that are to be inspected against the stream payload (as opposed to ...
enum DetectBufferMpmType type
int MpmStoreInit(DetectEngineCtx *de_ctx)
Initializes the MpmStore mpm hash table to be used by the detection engine context.
DetectBufferMpmRegistry * app_mpms_list
@ DETECT_BUFFER_MPM_TYPE_APP
void DetectBufferTypeSupportsMpm(const char *name)
void HashListTableFree(HashListTable *ht)
void SupportFastPatternForSigMatchList(int list_id, int priority)
Lets one add a sm list id to be searched for potential fp supported keywords later.
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
struct DetectEngineFrameInspectionEngine * next
struct DetectEnginePktInspectionEngine * next
uint8_t PatternMatchDefaultMatcher(void)
Function to return the multi pattern matcher algorithm to be used by the engine, based on the mpm-alg...
int DetectMpmPreparePktMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
void DetectEngineBufferTypeSupportsMpm(DetectEngineCtx *de_ctx, const char *name)
uint32_t app_mpms_list_cnt
void DetectBufferTypeSupportsTransformations(const char *name)
#define MPM_PATTERN_FLAG_ENDSWITH
const char * builtin_mpms[]
SignatureInitDataBuffer * buffers
HashListTable * mpm_hash_table
void(* DestroyCtx)(struct MpmCtx_ *)
int SigMatchListSMBelongsTo(const Signature *s, const SigMatch *key_sm)
#define MPM_CTX_FACTORY_UNIQUE_CONTEXT
int DetectMpmPrepareBuiltinMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for builtin buffers that are in "single or "shared" mode.
#define DETECT_CONTENT_OFFSET
int(* PrefilterRegisterWithListId)(struct DetectEngineCtx_ *de_ctx, struct SigGroupHead_ *sgh, MpmCtx *mpm_ctx, const struct DetectBufferMpmRegistry_ *mpm_reg, int list_id)
#define DETECT_CONTENT_MPM
a single match condition for a signature
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
void DetectMpmInitializeAppMpms(DetectEngineCtx *de_ctx)
@ DETECT_BUFFER_MPM_TYPE_SIZE
#define SGH_PROTO(sgh, p)
#define DETECT_CONTENT_REPLACE
void DetectPktMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
#define DETECT_CONTENT_FAST_PATTERN
void DetectFrameMpmRegister(const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), AppProto alproto, uint8_t type)
register a MPM engine
struct DetectBufferInstance DetectBufferInstance
int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
#define SCMemcmp(a, b, c)
int DetectMpmPrepareAppMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
SCFPSupportSMList * fp_support_smlist_list
#define DEBUG_VALIDATE_BUG_ON(exp)
#define SIG_FLAG_PREFILTER
void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
enum MpmBuiltinBuffers buffer
@ ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE
void RetrieveFPForSig(const DetectEngineCtx *de_ctx, Signature *s)
uint32_t StringHashDjb2(const uint8_t *data, uint32_t datalen)
int PrefilterPktStreamRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx)
#define DETECT_CONTENT_OFFSET_VAR
#define SIG_FLAG_REQUIRE_PACKET