Go to the documentation of this file.
67 "toserver TCP packet",
68 "toclient TCP packet",
69 "toserver TCP stream",
70 "toclient TCP stream",
71 "toserver UDP packet",
72 "toclient UDP packet",
89 static void RegisterInternal(
const char *
name,
int direction,
int priority,
94 SCLogDebug(
"registering %s/%d/%d/%p/%p/%u/%d",
name, direction, priority,
95 PrefilterRegister, GetData, alproto, tx_min_progress);
97 BUG_ON(tx_min_progress >= 48);
113 RegisterInternal(
name, direction, priority, PrefilterRegister, GetData, GetDataSingle,
122 am->
sm_list = (int16_t)sm_list;
128 if (GetData != NULL) {
129 am->
app_v2.GetData = GetData;
130 }
else if (GetDataSingle != NULL) {
131 am->
app_v2.GetDataSingle = GetDataSingle;
132 }
else if (GetMultiData != NULL) {
133 am->
app_v2.GetMultiData = GetMultiData;
135 am->
app_v2.alproto = alproto;
136 am->
app_v2.tx_min_progress = tx_min_progress;
142 while (t->
next != NULL) {
156 AppProto alproto,
int tx_min_progress)
158 RegisterInternal(
name, direction, priority, PrefilterRegister, GetData, NULL, NULL, alproto,
164 AppProto alproto,
int tx_min_progress)
166 RegisterInternal(
name, direction, priority, PrefilterRegister, NULL, GetData, NULL, alproto,
172 AppProto alproto,
int tx_min_progress)
174 RegisterInternal(
name, direction, priority, PrefilterRegister, NULL, NULL, GetData, alproto,
180 const int id,
const int parent_id,
183 SCLogDebug(
"registering %d/%d",
id, parent_id);
206 memcpy(&am->
transforms, transforms,
sizeof(*transforms));
211 char xforms[1024] =
"";
212 for (
int i = 0; i < transforms->
cnt; i++) {
214 (void)snprintf(ttstr,
sizeof(ttstr),
"%s,",
216 strlcat(xforms, ttstr,
sizeof(xforms));
218 xforms[strlen(xforms)-1] =
'\0';
220 size_t space =
sizeof(am->
pname) - strlen(am->
name) - 3;
221 char toprint[space + 1];
222 memset(toprint, 0x00, space + 1);
223 if (space < strlen(xforms)) {
226 strlcpy(toprint, xforms,
sizeof(toprint));
228 (void)snprintf(am->
pname,
sizeof(am->
pname),
"%s#%d (%s)",
231 (void)snprintf(am->
pname,
sizeof(am->
pname),
"%s#%d",
238 SCLogDebug(
"copied mpm registration for %s id %u "
239 "with parent %u and GetData %p",
251 while (list != NULL) {
271 char confstring[256] =
"detect.mpm.";
273 strlcat(confstring,
".shared",
sizeof(confstring));
307 if (mpm_ctx != NULL) {
327 SCLogDebug(
"registering %s/%d/%p/%s/%u",
name, priority, PrefilterRegister,
334 if (sm_list < 0 || sm_list > UINT16_MAX) {
342 am->
sm_list = (uint16_t)sm_list;
357 while (t->
next != NULL) {
373 SCLogDebug(
"registering %d/%d",
id, parent_id);
394 memcpy(&am->
transforms, transforms,
sizeof(*transforms));
400 SCLogDebug(
"copied mpm registration for %s id %u "
402 t->
name,
id, parent_id);
415 SCLogDebug(
"registering %s/%d/%p/%s/%u",
name, priority, PrefilterRegister,
419 if (sm_list < 0 || sm_list > UINT16_MAX) {
431 am->
sm_list = (uint16_t)sm_list;
446 if (
SCConfGetBool(
"detect.mpm.frame.shared", &confshared) == 1)
460 while (t->
next != NULL) {
475 while (list != NULL) {
486 while (t->
next != NULL) {
498 char confstring[256] =
"detect.mpm.";
500 strlcat(confstring,
".shared",
sizeof(confstring));
536 if (mpm_ctx != NULL) {
558 PrefilterRegister, GetData);
577 am->
sm_list = (uint16_t)sm_list;
582 am->
pkt_v1.GetData = GetData;
588 while (t->
next != NULL) {
602 const int id,
const int parent_id,
605 SCLogDebug(
"registering %d/%d",
id, parent_id);
624 memcpy(&am->
transforms, transforms,
sizeof(*transforms));
630 SCLogDebug(
"copied mpm registration for %s id %u "
631 "with parent %u and GetData %p",
642 while (list != NULL) {
653 while (t->
next != NULL) {
665 char confstring[256] =
"detect.mpm.";
667 strlcat(confstring,
".shared",
sizeof(confstring));
701 if (mpm_ctx != NULL) {
720 char confstring[256] =
"detect.mpm.";
722 strlcat(confstring,
".shared",
sizeof(confstring));
811 if (!(s->
proto.
proto[IPPROTO_TCP / 8] & 1 << (IPPROTO_TCP % 8))) {
841 if (!(s->
proto.
proto[IPPROTO_TCP / 8] & 1 << (IPPROTO_TCP % 8))) {
867 const char *mpm_algo;
871 if ((
SCConfGet(
"mpm-algo", &mpm_algo)) == 1) {
872 if (mpm_algo != NULL) {
873 #if __BYTE_ORDER == __BIG_ENDIAN
874 if (strcmp(mpm_algo,
"ac-ks") == 0) {
876 "not work on big endian systems at this time.");
879 if (strcmp(
"auto", mpm_algo) == 0) {
881 }
else if (strcmp(
"ac-bs", mpm_algo) == 0) {
882 SCLogWarning(
"mpm-algo \"ac-bs\" has been removed. See ticket #6586.");
895 #ifndef BUILD_HYPERSCAN
896 if ((strcmp(mpm_algo,
"hs") == 0)) {
897 FatalError(
"Hyperscan (hs) support for mpm-algo is "
898 "not compiled into Suricata.");
903 "in the yaml conf file: \"%s\"",
913 SCLogDebug(
"mpm_ctx %p, mpm_matcher %"PRIu16
"", mpm_ctx, mpm_matcher);
919 SCLogDebug(
"mpm_thread_ctx %p, mpm_matcher %"PRIu16
"", mpm_thread_ctx, mpm_matcher);
924 SCLogDebug(
"mpm_thread_ctx %p, type %"PRIu16, mpm_thread_ctx, mpm_matcher);
944 memset(&a, 0 ,
sizeof(a));
948 for (u = 0; u < patlen; u++) {
949 if (a[pat[u]] == 0) {
952 else if (isprint(pat[u]) || pat[u] == 0x00 || pat[u] == 0x01 || pat[u] == 0xFF)
969 uint16_t pat_offset = cd->
offset;
970 uint16_t pat_depth = cd->
depth;
973 if (chop && (pat_depth || pat_offset)) {
985 pat_depth = pat_offset = 0;
1007 #define SGH_PROTO(sgh, p) ((sgh)->init->protos[(p)] == 1)
1008 #define SGH_DIRECTION_TS(sgh) ((sgh)->init->direction & SIG_FLAG_TOSERVER)
1009 #define SGH_DIRECTION_TC(sgh) ((sgh)->init->direction & SIG_FLAG_TOCLIENT)
1013 if (s == NULL || mpm_sm == NULL)
1039 uint16_t max_len,
bool skip_negated_content)
1054 if (mpm_sm == NULL) {
1063 }
else if (ls == ss) {
1082 for (; app != NULL; app = app->
next) {
1085 if (app->
dir == 1) {
1106 int pos_sm_list[nlists];
1107 int neg_sm_list[nlists];
1108 memset(pos_sm_list, 0, nlists *
sizeof(
int));
1109 memset(neg_sm_list, 0, nlists *
sizeof(
int));
1110 int pos_sm_list_cnt = 0;
1111 int neg_sm_list_cnt = 0;
1160 SetMpm(s, sm, list_id);
1165 neg_sm_list[list_id] = 1;
1168 pos_sm_list[list_id] = 1;
1176 SCLogDebug(
"neg_sm_list_cnt %d pos_sm_list_cnt %d", neg_sm_list_cnt, pos_sm_list_cnt);
1179 int *curr_sm_list = NULL;
1180 int skip_negated_content = 1;
1181 if (pos_sm_list_cnt > 0) {
1182 curr_sm_list = pos_sm_list;
1183 }
else if (neg_sm_list_cnt > 0) {
1184 curr_sm_list = neg_sm_list;
1185 skip_negated_content = 0;
1190 int final_sm_list[nlists];
1191 memset(&final_sm_list, 0, (nlists *
sizeof(
int)));
1193 int count_final_sm_list = 0;
1194 int count_txbidir_toclient_sm_list = 0;
1198 while (tmp != NULL) {
1200 tmp != NULL && priority == tmp->
priority;
1206 if (curr_sm_list[tmp->
list_id] == 0)
1211 if (count_final_sm_list == 0) {
1213 final_sm_list[count_txbidir_toclient_sm_list++] = tmp->
list_id;
1219 final_sm_list[count_final_sm_list++] = tmp->
list_id;
1222 if (count_final_sm_list != 0)
1228 count_final_sm_list = count_txbidir_toclient_sm_list;
1230 BUG_ON(count_final_sm_list == 0);
1231 SCLogDebug(
"count_final_sm_list %d skip_negated_content %d", count_final_sm_list,
1232 skip_negated_content);
1234 uint16_t max_len = 0;
1235 for (
int i = 0; i < count_final_sm_list; i++) {
1236 SCLogDebug(
"i %d final_sm_list[i] %d", i, final_sm_list[i]);
1259 if (final_sm_list[i] == list_id) {
1280 int mpm_sm_list = -1;
1281 for (
int i = 0; i < count_final_sm_list; i++) {
1287 skip_negated_content);
1288 if (mpm_sm != prev_mpm_sm) {
1289 mpm_sm_list = final_sm_list[i];
1296 if (final_sm_list[i] == list_id) {
1302 skip_negated_content);
1304 if (mpm_sm != prev_mpm_sm) {
1305 mpm_sm_list = list_id;
1313 if (mpm_sm != NULL) {
1314 BUG_ON(mpm_sm_list == -1);
1316 BUG_ON(check_list != mpm_sm_list);
1320 SetMpm(s, mpm_sm, mpm_sm_list);
1332 static uint32_t MpmStoreHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
1354 static char MpmStoreCompareFunc(
void *data1, uint16_t len1,
void *data2,
1384 static void MpmStoreFreeFunc(
void *ptr)
1414 MpmStoreCompareFunc,
1459 while (am != NULL) {
1467 while (am != NULL) {
1482 uint32_t appstats[app_mpms_cnt + 1];
1483 memset(&appstats, 0x00,
sizeof(appstats));
1485 uint32_t pktstats[pkt_mpms_cnt + 1];
1486 memset(&pktstats, 0x00,
sizeof(pktstats));
1488 uint32_t framestats[frame_mpms_cnt + 1];
1489 memset(&framestats, 0x00,
sizeof(framestats));
1496 if (ms == NULL || ms->
mpm_ctx == NULL) {
1506 SCLogDebug(
"%s: %u patterns. Min %u, Max %u. Ctx %p",
1514 SCLogDebug(
"%s %s %s: %u patterns. Min %u, Max %u. Ctx %p",
1535 for (
int x = 0; x <
MPMB_MAX; x++) {
1539 while (am != NULL) {
1540 if (appstats[am->
sm_list] > 0) {
1543 SCLogPerf(
"AppLayer MPM \"%s %s (%s)\": %u", direction,
name,
1549 while (pm != NULL) {
1550 if (pktstats[pm->
sm_list] > 0) {
1557 while (um != NULL) {
1558 if (framestats[um->
sm_list] > 0) {
1627 const bool mpm_supports_endswith =
1632 if (ms->
sid_array[sig / 8] & (1 << (sig % 8))) {
1652 SCLogDebug(
"not adding negated mpm as it's not 'single'");
1689 uint8_t sids_array[max_sid];
1690 memset(sids_array, 0x00, max_sid);
1691 int sgh_mpm_context = 0;
1756 sids_array[s->
iid / 8] |= 1 << (s->
iid % 8);
1764 sids_array[s->
iid / 8] |= 1 << (s->
iid % 8);
1770 sids_array[s->
iid / 8] |= 1 << (s->
iid % 8);
1774 sids_array[s->
iid / 8] |= 1 << (s->
iid % 8);
1785 MpmStore lookup = { sids_array, max_sid, direction, buf, sm_list, 0, 0, NULL };
1788 if (result == NULL) {
1792 uint8_t *sids =
SCCalloc(1, max_sid);
1798 memcpy(sids, sids_array, max_sid);
1806 MpmStoreSetup(
de_ctx, copy);
1807 MpmStoreAdd(
de_ctx, copy);
1834 0, am->
app_v2.alproto, NULL };
1839 if (result == NULL) {
1861 MpmStoreSetup(
de_ctx, copy);
1862 MpmStoreAdd(
de_ctx, copy);
1885 if (result == NULL) {
1905 MpmStoreSetup(
de_ctx, copy);
1906 MpmStoreAdd(
de_ctx, copy);
1928 if (result == NULL) {
1949 MpmStoreSetup(
de_ctx, copy);
1950 MpmStoreAdd(
de_ctx, copy);
1971 SCLogDebug(
"rule group %p has SIG_GROUP_HEAD_HAVERAWSTREAM set", sgh);
1975 SCLogDebug(
"rule group %p does NOT have SIG_GROUP_HEAD_HAVERAWSTREAM set", sgh);
1987 static uint32_t DetectBufferInstanceHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
1994 static char DetectBufferInstanceCompareFunc(
void *data1, uint16_t len1,
void *data2, uint16_t len2)
2001 static void DetectBufferInstanceFreeFunc(
void *ptr)
2013 return HashListTableInit(4096, DetectBufferInstanceHashFunc, DetectBufferInstanceCompareFunc,
2014 DetectBufferInstanceFreeFunc);
2026 memset(engines, 0,
sizeof(engines));
2027 int engines_idx[max_buffer_id];
2028 memset(engines_idx, 0,
sizeof(engines_idx));
2029 int types[max_buffer_id];
2030 memset(types, 0,
sizeof(types));
2034 types[a->sm_list] = a->type;
2038 if (instance == NULL) {
2039 instance =
SCCalloc(1,
sizeof(*instance));
2040 BUG_ON(instance == NULL);
2041 instance->
list = a->sm_list;
2051 if (add_ts || add_tc) {
2052 types[a->sm_list] = a->type;
2053 engines[a->sm_list][engines_idx[a->sm_list]++] = a->frame_v1.alproto;
2057 if (instance == NULL) {
2058 instance =
SCCalloc(1,
sizeof(*instance));
2059 BUG_ON(instance == NULL);
2060 instance->
list = a->sm_list;
2061 instance->
alproto = a->frame_v1.alproto;
2071 if (add_ts || add_tc) {
2072 types[a->sm_list] = a->type;
2073 engines[a->sm_list][engines_idx[a->sm_list]++] = a->app_v2.alproto;
2077 if (instance == NULL) {
2078 instance =
SCCalloc(1,
sizeof(*instance));
2079 BUG_ON(instance == NULL);
2080 instance->
list = a->sm_list;
2081 instance->
alproto = a->app_v2.alproto;
2089 for (uint32_t sig = 0; sig < sh->
init->
sig_cnt; sig++) {
2101 switch (types[list]) {
2105 for (
int e = 0; e < engines_idx[list]; e++) {
2106 const AppProto alproto = engines[list][e];
2112 if (instance == NULL)
2145 if (instance == NULL)
2176 if (instance == NULL) {
2183 MpmStore *mpm_store = MpmStorePrepareBufferPkt(
de_ctx, sh, a, sa);
2184 if (mpm_store != NULL) {
2187 SCLogDebug(
"a %p a->name %s a->reg->PrefilterRegisterWithListId %p "
2188 "mpm_store->mpm_ctx %p", a, a->name,
2189 a->PrefilterRegisterWithListId, mpm_store->
mpm_ctx);
2193 if (a->PrefilterRegisterWithListId && mpm_store->
mpm_ctx) {
2196 a, a->sm_list) != 0);
2197 SCLogDebug(
"mpm %s %d set up", a->name, a->sm_list);
2206 if (instance == NULL) {
2214 SCLogDebug(
"a %s direction %d PrefilterRegisterWithListId %p", a->name, a->direction,
2215 a->PrefilterRegisterWithListId);
2216 MpmStore *mpm_store = MpmStorePrepareBufferFrame(
de_ctx, sh, a, sa);
2217 if (mpm_store != NULL) {
2220 SCLogDebug(
"a %p a->name %s a->reg->PrefilterRegisterWithListId %p "
2221 "mpm_store->mpm_ctx %p",
2222 a, a->name, a->PrefilterRegisterWithListId, mpm_store->
mpm_ctx);
2227 if (a->PrefilterRegisterWithListId && mpm_store->
mpm_ctx) {
2228 BUG_ON(a->PrefilterRegisterWithListId(
2230 SCLogDebug(
"mpm %s %d set up", a->name, a->sm_list);
2241 if (instance == NULL) {
2249 MpmStore *mpm_store = MpmStorePrepareBufferAppLayer(
de_ctx, sh, a, sa);
2250 if (mpm_store != NULL) {
2253 SCLogDebug(
"a %p a->name %s a->PrefilterRegisterWithListId %p "
2254 "mpm_store->mpm_ctx %p",
2255 a, a->name, a->PrefilterRegisterWithListId, mpm_store->
mpm_ctx);
2259 if (a->PrefilterRegisterWithListId && mpm_store->
mpm_ctx) {
2260 BUG_ON(a->PrefilterRegisterWithListId(
2262 SCLogDebug(
"mpm %s %d set up", a->name, a->sm_list);
2279 if (mpm_store != NULL) {
2284 if (mpm_store != NULL) {
2288 SetRawReassemblyFlag(
de_ctx, sh);
2292 if (mpm_store != NULL) {
2297 if (mpm_store != NULL) {
2301 SetRawReassemblyFlag(
de_ctx, sh);
2303 }
else if (
SGH_PROTO(sh, IPPROTO_UDP)) {
2306 if (mpm_store != NULL) {
2312 if (mpm_store != NULL) {
2318 if (mpm_store != NULL) {
2342 static uint32_t PatternChopHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
2345 uint32_t hash = p->
sm_list + ContentFlagsForHash(p->
cd);
2347 const uint8_t *content = p->
cd->
content;
2365 static uint32_t PatternNoChopHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
2368 uint32_t hash = p->
sm_list + ContentFlagsForHash(p->
cd);
2384 static char PatternChopCompareFunc(
void *data1, uint16_t len1,
void *data2, uint16_t len2)
2392 if (ContentFlagsForHash(p1->
cd) != ContentFlagsForHash(p2->
cd))
2408 if (p1_content_len != p2_content_len)
2411 if (memcmp(p1_content, p2_content, p1_content_len) != 0) {
2429 static char PatternNoChopCompareFunc(
void *data1, uint16_t len1,
void *data2, uint16_t len2)
2437 if (ContentFlagsForHash(p1->
cd) != ContentFlagsForHash(p2->
cd))
2450 static void PatternFreeFunc(
void *ptr)
2477 HashListTableInit(4096, PatternChopHashFunc, PatternChopCompareFunc, PatternFreeFunc);
2508 SCLogDebug(
"%u: add id %u cnt %u", s->
id, add->cd->id, add->cnt);
2525 4096, PatternNoChopHashFunc, PatternNoChopCompareFunc, PatternFreeFunc);
2531 switch (smd->
type) {
2561 for (; app != NULL; app = app->
next) {
2564 switch (smd->
type) {
2569 .
cd = cd, .sm_list = app->
sm_list, .cnt = 0, .mpm = 0
2594 for (; pkt != NULL; pkt = pkt->
next) {
2601 switch (smd->
type) {
2606 .
cd = cd, .sm_list = pkt->
sm_list, .cnt = 0, .mpm = 0
2631 for (; frame != NULL; frame = frame->
next) {
2638 switch (smd->
type) {
2643 .
cd = cd, .sm_list = frame->
sm_list, .cnt = 0, .mpm = 0
void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t matcher)
#define DETECT_CONTENT_NOCASE
int SignatureHasPacketContent(const Signature *s)
check if a signature has patterns that are to be inspected against a packets payload (as opposed to t...
uint32_t pkt_mpms_list_cnt
#define HashListTableGetListData(hb)
uint32_t frame_mpms_list_cnt
uint32_t max_content_list_id
int PrefilterGenericMpmPktRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
void DetectAppLayerMpmMultiRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionMultiBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
#define SGH_DIRECTION_TC(sgh)
#define DETECT_CONTENT_FAST_PATTERN_CHOP
struct SigMatch_ * smlists[DETECT_SM_LIST_MAX]
void PatternMatchDestroy(MpmCtx *mpm_ctx, uint16_t mpm_matcher)
SigTableElmt * sigmatch_table
int32_t sgh_mpm_context_proto_tcp_packet
int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
Prepare the pattern matcher ctx in a sig group head.
struct SCFPSupportSMList_ * next
struct DetectEngineAppInspectionEngine_ * next
void MpmStoreFree(DetectEngineCtx *de_ctx)
Frees the hash table - DetectEngineCtx->mpm_hash_table, allocated by MpmStoreInit() function.
void DetectFrameMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Container for matching data for a signature group.
HashListTable * pattern_hash_table
void MpmFactoryReClaimMpmCtx(const DetectEngineCtx *de_ctx, MpmCtx *mpm_ctx)
void MpmStoreReportStats(const DetectEngineCtx *de_ctx)
void DetectPktMpmRegister(const char *name, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), InspectionBufferGetPktDataPtr GetData)
register a MPM engine
void DetectBufferTypeSupportsFrames(const char *name)
struct DetectBufferMpmRegistry_::@88::@92 frame_v1
void DetectMpmInitializeFrameMpms(DetectEngineCtx *de_ctx)
@ DETECT_SM_LIST_DYNAMIC_START
#define DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED
uint32_t PatternStrength(uint8_t *pat, uint16_t patlen)
Predict a strength value for patterns.
DetectBufferMpmRegistry * pkt_mpms_list
@ DETECT_BUFFER_MPM_TYPE_FRAME
int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx)
Figure out the FP and their respective content ids for all the sigs in the engine.
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
main detection engine ctx
int SCConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
#define DETECT_CONTENT_MPM_IS_CONCLUSIVE(c)
HashListTableBucket * HashListTableGetListHead(HashListTable *ht)
#define DETECT_CONTENT_DEPTH_VAR
InspectionBuffer *(* InspectionBufferGetPktDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Packet *p, const int list_id)
const char * DetectEngineBufferTypeGetNameById(const DetectEngineCtx *de_ctx, const int id)
void DetectMpmInitializeBuiltinMpms(DetectEngineCtx *de_ctx)
struct DetectBufferMpmRegistry_ * next
#define SIG_FLAG_REQUIRE_STREAM
#define SIG_FLAG_TXBOTHDIR
int SCConfGetBool(const char *name, int *val)
Retrieve a configuration value as a boolean.
one time registration of keywords at start up
const struct DetectContentData_ * cd
#define SIG_GROUP_HEAD_HAVERAWSTREAM
uint8_t mpm_default_matcher
SigMatchData * sm_arrays[DETECT_SM_LIST_MAX]
struct DetectBufferMpmRegistry_::@88::@90 app_v2
void * HashListTableLookup(HashListTable *ht, void *data, uint16_t datalen)
#define SIG_FLAG_TOCLIENT
int32_t sgh_mpm_context_proto_udp_packet
DetectEngineTransforms transforms
void ShortenString(const char *input, char *output, size_t output_size, char c)
void DetectEngineRegisterFastPatternForId(DetectEngineCtx *de_ctx, int list_id, int priority)
void EngineAnalysisAddAllRulePatterns(DetectEngineCtx *de_ctx, const Signature *s)
add all patterns on our stats hash Used to fill the hash later used by DumpPatterns()
DetectEngineFrameInspectionEngine * frame_inspect
const char * cache_dir_path
int DetectBufferTypeGetByName(const char *name)
int HashListTableAdd(HashListTable *ht, void *data, uint16_t datalen)
size_t strlcpy(char *dst, const char *src, size_t siz)
void DetectAppLayerMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
void MpmInitCtx(MpmCtx *mpm_ctx, uint8_t matcher)
int32_t sgh_mpm_context_proto_other_packet
#define HashListTableGetListNext(hb)
#define SIG_FLAG_TOSERVER
HashListTable * HashListTableInit(uint32_t size, uint32_t(*Hash)(struct HashListTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
void MpmDestroyThreadCtx(MpmThreadCtx *mpm_thread_ctx, const uint16_t matcher)
#define DETECT_CONTENT_ENDS_WITH
MpmCtx * MpmFactoryGetMpmCtxForProfile(const DetectEngineCtx *de_ctx, int32_t id, int direction)
void DetectMpmInitializePktMpms(DetectEngineCtx *de_ctx)
#define MPM_PATTERN_CTX_OWNS_ID
size_t strlcat(char *, const char *src, size_t siz)
#define DetectEngineGetMaxSigId(de_ctx)
#define DETECT_CONTENT_DEPTH
DetectEnginePktInspectionEngine * pkt_inspect
bool(* InspectionSingleBufferGetDataPtr)(const void *txv, const uint8_t flow_flags, const uint8_t **buf, uint32_t *buf_len)
#define DETECT_CONTENT_IS_SINGLE(c)
#define DETECT_CONTENT_NEGATED
int PrefilterGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
void PatternMatchThreadPrepare(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
#define SCLogWarning(...)
Macro used to log WARNING messages.
int DetectEngineBufferTypeRegister(DetectEngineCtx *de_ctx, const char *name)
SigGroupHeadInitData * init
struct DetectBufferMpmRegistry_::@88::@91 pkt_v1
void DetectAppLayerMpmRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
register an app layer keyword for mpm
DetectEngineAppInspectionEngine * app_inspect
bool DetectBufferToClient(const DetectEngineCtx *de_ctx, int buf_id, AppProto alproto)
#define MPMCTX_FLAGS_GLOBAL
int(* PrefilterRegisterFunc)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
int32_t MpmFactoryRegisterMpmCtxProfile(DetectEngineCtx *de_ctx, const char *name, const int sm_list, const AppProto alproto)
Register a new Mpm Context.
@ ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE
int32_t sgh_mpm_context_stream
void DetectEngineBufferTypeSupportsFrames(DetectEngineCtx *de_ctx, const char *name)
DetectBufferMpmRegistry * frame_mpms_list
int PrefilterPktPayloadRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx)
@ DETECT_BUFFER_MPM_TYPE_PKT
SignatureInitData * init_data
int FastPatternSupportEnabledForSigMatchList(const DetectEngineCtx *de_ctx, const int list_id)
Checks if a particular buffer is in the list of lists that need to be searched for a keyword that has...
enum DetectBufferMpmType type
int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
void DetectEngineBufferTypeSupportsTransformations(DetectEngineCtx *de_ctx, const char *name)
bool(* InspectionMultiBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const void *txv, const uint8_t flow_flags, uint32_t local_id, const uint8_t **buf, uint32_t *buf_len)
#define SGH_DIRECTION_TS(sgh)
#define MPM_FEATURE_FLAG_ENDSWITH
MpmStore * MpmStorePrepareBuffer(DetectEngineCtx *de_ctx, SigGroupHead *sgh, enum MpmBuiltinBuffers buf)
Get MpmStore for a built-in buffer type.
int DetectMpmPrepareFrameMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
void DetectEngineFrameMpmRegister(DetectEngineCtx *de_ctx, const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), AppProto alproto, uint8_t type)
int SignatureHasStreamContent(const Signature *s)
check if a signature has patterns that are to be inspected against the stream payload (as opposed to ...
enum DetectBufferMpmType type
int MpmStoreInit(DetectEngineCtx *de_ctx)
Initializes the MpmStore mpm hash table to be used by the detection engine context.
void DetectAppLayerMpmRegisterSingle(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionSingleBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
DetectBufferMpmRegistry * app_mpms_list
@ DETECT_BUFFER_MPM_TYPE_APP
void DetectBufferTypeSupportsMpm(const char *name)
void HashListTableFree(HashListTable *ht)
void SupportFastPatternForSigMatchList(int list_id, int priority)
Lets one add a sm list id to be searched for potential fp supported keywords later.
struct DetectEngineFrameInspectionEngine * next
struct DetectEnginePktInspectionEngine * next
uint8_t PatternMatchDefaultMatcher(void)
Function to return the multi pattern matcher algorithm to be used by the engine, based on the mpm-alg...
int DetectMpmPreparePktMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
void DetectEngineBufferTypeSupportsMpm(DetectEngineCtx *de_ctx, const char *name)
uint32_t app_mpms_list_cnt
void DetectBufferTypeSupportsTransformations(const char *name)
#define MPM_PATTERN_FLAG_ENDSWITH
const char * builtin_mpms[]
SignatureInitDataBuffer * buffers
DetectEngineAppInspectionEngine * app_inspect_engines
HashListTable * mpm_hash_table
int(* Prepare)(MpmConfig *, struct MpmCtx_ *)
void(* DestroyCtx)(struct MpmCtx_ *)
int SigMatchListSMBelongsTo(const Signature *s, const SigMatch *key_sm)
#define MPM_CTX_FACTORY_UNIQUE_CONTEXT
int DetectMpmPrepareBuiltinMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for builtin buffers that are in "single or "shared" mode.
#define DETECT_CONTENT_OFFSET
int(* PrefilterRegisterWithListId)(struct DetectEngineCtx_ *de_ctx, struct SigGroupHead_ *sgh, MpmCtx *mpm_ctx, const struct DetectBufferMpmRegistry_ *mpm_reg, int list_id)
#define DETECT_CONTENT_MPM
a single match condition for a signature
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
void DetectMpmInitializeAppMpms(DetectEngineCtx *de_ctx)
InspectionBuffer *(* InspectionBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id)
@ DETECT_BUFFER_MPM_TYPE_SIZE
#define SGH_PROTO(sgh, p)
#define DETECT_CONTENT_REPLACE
void DetectPktMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
#define DETECT_CONTENT_FAST_PATTERN
#define MPMCTX_FLAGS_CACHE_TO_DISK
void DetectFrameMpmRegister(const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), AppProto alproto, uint8_t type)
register a MPM engine
struct DetectBufferInstance DetectBufferInstance
int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
#define SCMemcmp(a, b, c)
int DetectMpmPrepareAppMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
SCFPSupportSMList * fp_support_smlist_list
#define DEBUG_VALIDATE_BUG_ON(exp)
void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
enum MpmBuiltinBuffers buffer
void RetrieveFPForSig(const DetectEngineCtx *de_ctx, Signature *s)
uint32_t StringHashDjb2(const uint8_t *data, uint32_t datalen)
int PrefilterPktStreamRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx)
#define DETECT_CONTENT_OFFSET_VAR
#define SIG_FLAG_REQUIRE_PACKET