Go to the documentation of this file.
67 "toserver TCP packet",
68 "toclient TCP packet",
69 "toserver TCP stream",
70 "toclient TCP stream",
71 "toserver UDP packet",
72 "toclient UDP packet",
89 static void RegisterInternal(
const char *
name,
int direction,
int priority,
94 SCLogDebug(
"registering %s/%d/%d/%p/%p/%u/%d",
name, direction, priority,
95 PrefilterRegister, GetData, alproto, tx_min_progress);
97 BUG_ON(tx_min_progress >= 48);
111 RegisterInternal(
name, direction, priority, PrefilterRegister, GetData, GetDataSingle,
120 am->
sm_list = (int16_t)sm_list;
126 if (GetData != NULL) {
127 am->
app_v2.GetData = GetData;
128 }
else if (GetDataSingle != NULL) {
129 am->
app_v2.GetDataSingle = GetDataSingle;
130 }
else if (GetMultiData != NULL) {
131 am->
app_v2.GetMultiData = GetMultiData;
133 am->
app_v2.alproto = alproto;
134 am->
app_v2.tx_min_progress = tx_min_progress;
140 while (t->
next != NULL) {
154 AppProto alproto,
int tx_min_progress)
156 RegisterInternal(
name, direction, priority, PrefilterRegister, GetData, NULL, NULL, alproto,
162 AppProto alproto,
int tx_min_progress)
164 RegisterInternal(
name, direction, priority, PrefilterRegister, NULL, GetData, NULL, alproto,
170 AppProto alproto,
int tx_min_progress)
172 RegisterInternal(
name, direction, priority, PrefilterRegister, NULL, NULL, GetData, alproto,
178 const int id,
const int parent_id,
181 SCLogDebug(
"registering %d/%d",
id, parent_id);
204 memcpy(&am->
transforms, transforms,
sizeof(*transforms));
209 char xforms[1024] =
"";
210 for (
int i = 0; i < transforms->
cnt; i++) {
212 (void)snprintf(ttstr,
sizeof(ttstr),
"%s,",
214 strlcat(xforms, ttstr,
sizeof(xforms));
216 xforms[strlen(xforms)-1] =
'\0';
218 size_t space =
sizeof(am->
pname) - strlen(am->
name) - 3;
219 char toprint[space + 1];
220 memset(toprint, 0x00, space + 1);
221 if (space < strlen(xforms)) {
224 strlcpy(toprint, xforms,
sizeof(toprint));
226 (void)snprintf(am->
pname,
sizeof(am->
pname),
"%s#%d (%s)",
229 (void)snprintf(am->
pname,
sizeof(am->
pname),
"%s#%d",
236 SCLogDebug(
"copied mpm registration for %s id %u "
237 "with parent %u and GetData %p",
249 while (list != NULL) {
269 char confstring[256] =
"detect.mpm.";
271 strlcat(confstring,
".shared",
sizeof(confstring));
305 if (mpm_ctx != NULL) {
325 SCLogDebug(
"registering %s/%d/%p/%s/%u",
name, priority, PrefilterRegister,
332 if (sm_list < 0 || sm_list > UINT16_MAX) {
340 am->
sm_list = (uint16_t)sm_list;
355 while (t->
next != NULL) {
371 SCLogDebug(
"registering %d/%d",
id, parent_id);
392 memcpy(&am->
transforms, transforms,
sizeof(*transforms));
398 SCLogDebug(
"copied mpm registration for %s id %u "
400 t->
name,
id, parent_id);
413 SCLogDebug(
"registering %s/%d/%p/%s/%u",
name, priority, PrefilterRegister,
417 if (sm_list < 0 || sm_list > UINT16_MAX) {
429 am->
sm_list = (uint16_t)sm_list;
444 if (
SCConfGetBool(
"detect.mpm.frame.shared", &confshared) == 1)
458 while (t->
next != NULL) {
473 while (list != NULL) {
484 while (t->
next != NULL) {
496 char confstring[256] =
"detect.mpm.";
498 strlcat(confstring,
".shared",
sizeof(confstring));
534 if (mpm_ctx != NULL) {
556 PrefilterRegister, GetData);
573 am->
sm_list = (uint16_t)sm_list;
578 am->
pkt_v1.GetData = GetData;
584 while (t->
next != NULL) {
598 const int id,
const int parent_id,
601 SCLogDebug(
"registering %d/%d",
id, parent_id);
620 memcpy(&am->
transforms, transforms,
sizeof(*transforms));
626 SCLogDebug(
"copied mpm registration for %s id %u "
627 "with parent %u and GetData %p",
638 while (list != NULL) {
649 while (t->
next != NULL) {
661 char confstring[256] =
"detect.mpm.";
663 strlcat(confstring,
".shared",
sizeof(confstring));
697 if (mpm_ctx != NULL) {
716 char confstring[256] =
"detect.mpm.";
718 strlcat(confstring,
".shared",
sizeof(confstring));
807 if (!(s->
proto.
proto[IPPROTO_TCP / 8] & 1 << (IPPROTO_TCP % 8))) {
837 if (!(s->
proto.
proto[IPPROTO_TCP / 8] & 1 << (IPPROTO_TCP % 8))) {
863 const char *mpm_algo;
867 if ((
SCConfGet(
"mpm-algo", &mpm_algo)) == 1) {
868 if (mpm_algo != NULL) {
869 #if __BYTE_ORDER == __BIG_ENDIAN
870 if (strcmp(mpm_algo,
"ac-ks") == 0) {
872 "not work on big endian systems at this time.");
875 if (strcmp(
"auto", mpm_algo) == 0) {
877 }
else if (strcmp(
"ac-bs", mpm_algo) == 0) {
878 SCLogWarning(
"mpm-algo \"ac-bs\" has been removed. See ticket #6586.");
891 #ifndef BUILD_HYPERSCAN
892 if ((strcmp(mpm_algo,
"hs") == 0)) {
893 FatalError(
"Hyperscan (hs) support for mpm-algo is "
894 "not compiled into Suricata.");
899 "in the yaml conf file: \"%s\"",
909 SCLogDebug(
"mpm_ctx %p, mpm_matcher %"PRIu16
"", mpm_ctx, mpm_matcher);
915 SCLogDebug(
"mpm_thread_ctx %p, mpm_matcher %"PRIu16
"", mpm_thread_ctx, mpm_matcher);
920 SCLogDebug(
"mpm_thread_ctx %p, type %"PRIu16, mpm_thread_ctx, mpm_matcher);
940 memset(&a, 0 ,
sizeof(a));
944 for (u = 0; u < patlen; u++) {
945 if (a[pat[u]] == 0) {
948 else if (isprint(pat[u]) || pat[u] == 0x00 || pat[u] == 0x01 || pat[u] == 0xFF)
965 uint16_t pat_offset = cd->
offset;
966 uint16_t pat_depth = cd->
depth;
969 if (chop && (pat_depth || pat_offset)) {
981 pat_depth = pat_offset = 0;
1003 #define SGH_PROTO(sgh, p) ((sgh)->init->protos[(p)] == 1)
1004 #define SGH_DIRECTION_TS(sgh) ((sgh)->init->direction & SIG_FLAG_TOSERVER)
1005 #define SGH_DIRECTION_TC(sgh) ((sgh)->init->direction & SIG_FLAG_TOCLIENT)
1009 if (s == NULL || mpm_sm == NULL)
1035 uint16_t max_len,
bool skip_negated_content)
1050 if (mpm_sm == NULL) {
1059 }
else if (ls == ss) {
1078 for (; app != NULL; app = app->
next) {
1081 if (app->
dir == 1) {
1102 int pos_sm_list[nlists];
1103 int neg_sm_list[nlists];
1104 memset(pos_sm_list, 0, nlists *
sizeof(
int));
1105 memset(neg_sm_list, 0, nlists *
sizeof(
int));
1106 int pos_sm_list_cnt = 0;
1107 int neg_sm_list_cnt = 0;
1156 SetMpm(s, sm, list_id);
1161 neg_sm_list[list_id] = 1;
1164 pos_sm_list[list_id] = 1;
1172 SCLogDebug(
"neg_sm_list_cnt %d pos_sm_list_cnt %d", neg_sm_list_cnt, pos_sm_list_cnt);
1175 int *curr_sm_list = NULL;
1176 int skip_negated_content = 1;
1177 if (pos_sm_list_cnt > 0) {
1178 curr_sm_list = pos_sm_list;
1179 }
else if (neg_sm_list_cnt > 0) {
1180 curr_sm_list = neg_sm_list;
1181 skip_negated_content = 0;
1186 int final_sm_list[nlists];
1187 memset(&final_sm_list, 0, (nlists *
sizeof(
int)));
1189 int count_final_sm_list = 0;
1190 int count_txbidir_toclient_sm_list = 0;
1194 while (tmp != NULL) {
1196 tmp != NULL && priority == tmp->
priority;
1202 if (curr_sm_list[tmp->
list_id] == 0)
1207 if (count_final_sm_list == 0) {
1209 final_sm_list[count_txbidir_toclient_sm_list++] = tmp->
list_id;
1215 final_sm_list[count_final_sm_list++] = tmp->
list_id;
1218 if (count_final_sm_list != 0)
1224 count_final_sm_list = count_txbidir_toclient_sm_list;
1226 BUG_ON(count_final_sm_list == 0);
1227 SCLogDebug(
"count_final_sm_list %d skip_negated_content %d", count_final_sm_list,
1228 skip_negated_content);
1230 uint16_t max_len = 0;
1231 for (
int i = 0; i < count_final_sm_list; i++) {
1232 SCLogDebug(
"i %d final_sm_list[i] %d", i, final_sm_list[i]);
1255 if (final_sm_list[i] == list_id) {
1276 int mpm_sm_list = -1;
1277 for (
int i = 0; i < count_final_sm_list; i++) {
1283 skip_negated_content);
1284 if (mpm_sm != prev_mpm_sm) {
1285 mpm_sm_list = final_sm_list[i];
1292 if (final_sm_list[i] == list_id) {
1298 skip_negated_content);
1300 if (mpm_sm != prev_mpm_sm) {
1301 mpm_sm_list = list_id;
1309 if (mpm_sm != NULL) {
1310 BUG_ON(mpm_sm_list == -1);
1312 BUG_ON(check_list != mpm_sm_list);
1316 SetMpm(s, mpm_sm, mpm_sm_list);
1328 static uint32_t MpmStoreHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
1350 static char MpmStoreCompareFunc(
void *data1, uint16_t len1,
void *data2,
1380 static void MpmStoreFreeFunc(
void *ptr)
1410 MpmStoreCompareFunc,
1455 while (am != NULL) {
1463 while (am != NULL) {
1478 uint32_t appstats[app_mpms_cnt + 1];
1479 memset(&appstats, 0x00,
sizeof(appstats));
1481 uint32_t pktstats[pkt_mpms_cnt + 1];
1482 memset(&pktstats, 0x00,
sizeof(pktstats));
1484 uint32_t framestats[frame_mpms_cnt + 1];
1485 memset(&framestats, 0x00,
sizeof(framestats));
1492 if (ms == NULL || ms->
mpm_ctx == NULL) {
1502 SCLogDebug(
"%s: %u patterns. Min %u, Max %u. Ctx %p",
1510 SCLogDebug(
"%s %s %s: %u patterns. Min %u, Max %u. Ctx %p",
1531 for (
int x = 0; x <
MPMB_MAX; x++) {
1535 while (am != NULL) {
1536 if (appstats[am->
sm_list] > 0) {
1539 SCLogPerf(
"AppLayer MPM \"%s %s (%s)\": %u", direction,
name,
1545 while (pm != NULL) {
1546 if (pktstats[pm->
sm_list] > 0) {
1553 while (um != NULL) {
1554 if (framestats[um->
sm_list] > 0) {
1623 const bool mpm_supports_endswith =
1628 if (ms->
sid_array[sig / 8] & (1 << (sig % 8))) {
1648 SCLogDebug(
"not adding negated mpm as it's not 'single'");
1685 uint8_t sids_array[max_sid];
1686 memset(sids_array, 0x00, max_sid);
1687 int sgh_mpm_context = 0;
1752 sids_array[s->
iid / 8] |= 1 << (s->
iid % 8);
1760 sids_array[s->
iid / 8] |= 1 << (s->
iid % 8);
1766 sids_array[s->
iid / 8] |= 1 << (s->
iid % 8);
1770 sids_array[s->
iid / 8] |= 1 << (s->
iid % 8);
1781 MpmStore lookup = { sids_array, max_sid, direction, buf, sm_list, 0, 0, NULL };
1784 if (result == NULL) {
1788 uint8_t *sids =
SCCalloc(1, max_sid);
1794 memcpy(sids, sids_array, max_sid);
1802 MpmStoreSetup(
de_ctx, copy);
1803 MpmStoreAdd(
de_ctx, copy);
1830 0, am->
app_v2.alproto, NULL };
1835 if (result == NULL) {
1857 MpmStoreSetup(
de_ctx, copy);
1858 MpmStoreAdd(
de_ctx, copy);
1881 if (result == NULL) {
1901 MpmStoreSetup(
de_ctx, copy);
1902 MpmStoreAdd(
de_ctx, copy);
1924 if (result == NULL) {
1945 MpmStoreSetup(
de_ctx, copy);
1946 MpmStoreAdd(
de_ctx, copy);
1967 SCLogDebug(
"rule group %p has SIG_GROUP_HEAD_HAVERAWSTREAM set", sgh);
1971 SCLogDebug(
"rule group %p does NOT have SIG_GROUP_HEAD_HAVERAWSTREAM set", sgh);
1983 static uint32_t DetectBufferInstanceHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
1990 static char DetectBufferInstanceCompareFunc(
void *data1, uint16_t len1,
void *data2, uint16_t len2)
1997 static void DetectBufferInstanceFreeFunc(
void *ptr)
2009 return HashListTableInit(4096, DetectBufferInstanceHashFunc, DetectBufferInstanceCompareFunc,
2010 DetectBufferInstanceFreeFunc);
2022 memset(engines, 0,
sizeof(engines));
2023 int engines_idx[max_buffer_id];
2024 memset(engines_idx, 0,
sizeof(engines_idx));
2025 int types[max_buffer_id];
2026 memset(types, 0,
sizeof(types));
2030 types[a->sm_list] = a->type;
2034 if (instance == NULL) {
2035 instance =
SCCalloc(1,
sizeof(*instance));
2036 BUG_ON(instance == NULL);
2037 instance->
list = a->sm_list;
2047 if (add_ts || add_tc) {
2048 types[a->sm_list] = a->type;
2049 engines[a->sm_list][engines_idx[a->sm_list]++] = a->frame_v1.alproto;
2053 if (instance == NULL) {
2054 instance =
SCCalloc(1,
sizeof(*instance));
2055 BUG_ON(instance == NULL);
2056 instance->
list = a->sm_list;
2057 instance->
alproto = a->frame_v1.alproto;
2067 if (add_ts || add_tc) {
2068 types[a->sm_list] = a->type;
2069 engines[a->sm_list][engines_idx[a->sm_list]++] = a->app_v2.alproto;
2073 if (instance == NULL) {
2074 instance =
SCCalloc(1,
sizeof(*instance));
2075 BUG_ON(instance == NULL);
2076 instance->
list = a->sm_list;
2077 instance->
alproto = a->app_v2.alproto;
2085 for (uint32_t sig = 0; sig < sh->
init->
sig_cnt; sig++) {
2097 switch (types[list]) {
2101 for (
int e = 0; e < engines_idx[list]; e++) {
2102 const AppProto alproto = engines[list][e];
2108 if (instance == NULL)
2141 if (instance == NULL)
2171 if (instance == NULL) {
2178 MpmStore *mpm_store = MpmStorePrepareBufferPkt(
de_ctx, sh, a, sa);
2179 if (mpm_store != NULL) {
2182 SCLogDebug(
"a %p a->name %s a->reg->PrefilterRegisterWithListId %p "
2183 "mpm_store->mpm_ctx %p", a, a->name,
2184 a->PrefilterRegisterWithListId, mpm_store->
mpm_ctx);
2188 if (a->PrefilterRegisterWithListId && mpm_store->
mpm_ctx) {
2191 a, a->sm_list) != 0);
2192 SCLogDebug(
"mpm %s %d set up", a->name, a->sm_list);
2201 if (instance == NULL) {
2209 SCLogDebug(
"a %s direction %d PrefilterRegisterWithListId %p", a->name, a->direction,
2210 a->PrefilterRegisterWithListId);
2211 MpmStore *mpm_store = MpmStorePrepareBufferFrame(
de_ctx, sh, a, sa);
2212 if (mpm_store != NULL) {
2215 SCLogDebug(
"a %p a->name %s a->reg->PrefilterRegisterWithListId %p "
2216 "mpm_store->mpm_ctx %p",
2217 a, a->name, a->PrefilterRegisterWithListId, mpm_store->
mpm_ctx);
2222 if (a->PrefilterRegisterWithListId && mpm_store->
mpm_ctx) {
2223 BUG_ON(a->PrefilterRegisterWithListId(
2225 SCLogDebug(
"mpm %s %d set up", a->name, a->sm_list);
2236 if (instance == NULL) {
2244 MpmStore *mpm_store = MpmStorePrepareBufferAppLayer(
de_ctx, sh, a, sa);
2245 if (mpm_store != NULL) {
2248 SCLogDebug(
"a %p a->name %s a->PrefilterRegisterWithListId %p "
2249 "mpm_store->mpm_ctx %p",
2250 a, a->name, a->PrefilterRegisterWithListId, mpm_store->
mpm_ctx);
2254 if (a->PrefilterRegisterWithListId && mpm_store->
mpm_ctx) {
2255 BUG_ON(a->PrefilterRegisterWithListId(
2257 SCLogDebug(
"mpm %s %d set up", a->name, a->sm_list);
2274 if (mpm_store != NULL) {
2279 if (mpm_store != NULL) {
2283 SetRawReassemblyFlag(
de_ctx, sh);
2287 if (mpm_store != NULL) {
2292 if (mpm_store != NULL) {
2296 SetRawReassemblyFlag(
de_ctx, sh);
2298 }
else if (
SGH_PROTO(sh, IPPROTO_UDP)) {
2301 if (mpm_store != NULL) {
2307 if (mpm_store != NULL) {
2313 if (mpm_store != NULL) {
2337 static uint32_t PatternChopHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
2340 uint32_t hash = p->
sm_list + ContentFlagsForHash(p->
cd);
2342 const uint8_t *content = p->
cd->
content;
2360 static uint32_t PatternNoChopHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
2363 uint32_t hash = p->
sm_list + ContentFlagsForHash(p->
cd);
2379 static char PatternChopCompareFunc(
void *data1, uint16_t len1,
void *data2, uint16_t len2)
2387 if (ContentFlagsForHash(p1->
cd) != ContentFlagsForHash(p2->
cd))
2403 if (p1_content_len != p2_content_len)
2406 if (memcmp(p1_content, p2_content, p1_content_len) != 0) {
2424 static char PatternNoChopCompareFunc(
void *data1, uint16_t len1,
void *data2, uint16_t len2)
2432 if (ContentFlagsForHash(p1->
cd) != ContentFlagsForHash(p2->
cd))
2445 static void PatternFreeFunc(
void *ptr)
2472 HashListTableInit(4096, PatternChopHashFunc, PatternChopCompareFunc, PatternFreeFunc);
2503 SCLogDebug(
"%u: add id %u cnt %u", s->
id, add->cd->id, add->cnt);
2520 4096, PatternNoChopHashFunc, PatternNoChopCompareFunc, PatternFreeFunc);
2526 switch (smd->
type) {
2556 for (; app != NULL; app = app->
next) {
2559 switch (smd->
type) {
2564 .
cd = cd, .sm_list = app->
sm_list, .cnt = 0, .mpm = 0
2589 for (; pkt != NULL; pkt = pkt->
next) {
2596 switch (smd->
type) {
2601 .
cd = cd, .sm_list = pkt->
sm_list, .cnt = 0, .mpm = 0
2626 for (; frame != NULL; frame = frame->
next) {
2633 switch (smd->
type) {
2638 .
cd = cd, .sm_list = frame->
sm_list, .cnt = 0, .mpm = 0
void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t matcher)
#define DETECT_CONTENT_NOCASE
int SignatureHasPacketContent(const Signature *s)
check if a signature has patterns that are to be inspected against a packets payload (as opposed to t...
uint32_t pkt_mpms_list_cnt
#define HashListTableGetListData(hb)
uint32_t frame_mpms_list_cnt
uint32_t max_content_list_id
int PrefilterGenericMpmPktRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
void DetectAppLayerMpmMultiRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionMultiBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
#define SGH_DIRECTION_TC(sgh)
#define DETECT_CONTENT_FAST_PATTERN_CHOP
struct SigMatch_ * smlists[DETECT_SM_LIST_MAX]
void PatternMatchDestroy(MpmCtx *mpm_ctx, uint16_t mpm_matcher)
SigTableElmt * sigmatch_table
int32_t sgh_mpm_context_proto_tcp_packet
@ ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE
int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
Prepare the pattern matcher ctx in a sig group head.
struct SCFPSupportSMList_ * next
struct DetectEngineAppInspectionEngine_ * next
void MpmStoreFree(DetectEngineCtx *de_ctx)
Frees the hash table - DetectEngineCtx->mpm_hash_table, allocated by MpmStoreInit() function.
void DetectFrameMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Container for matching data for a signature group.
HashListTable * pattern_hash_table
void MpmFactoryReClaimMpmCtx(const DetectEngineCtx *de_ctx, MpmCtx *mpm_ctx)
void MpmStoreReportStats(const DetectEngineCtx *de_ctx)
void DetectPktMpmRegister(const char *name, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), InspectionBufferGetPktDataPtr GetData)
register a MPM engine
void DetectBufferTypeSupportsFrames(const char *name)
void DetectMpmInitializeFrameMpms(DetectEngineCtx *de_ctx)
@ DETECT_SM_LIST_DYNAMIC_START
#define DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED
uint32_t PatternStrength(uint8_t *pat, uint16_t patlen)
Predict a strength value for patterns.
DetectBufferMpmRegistry * pkt_mpms_list
@ DETECT_BUFFER_MPM_TYPE_FRAME
int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx)
Figure out the FP and their respective content ids for all the sigs in the engine.
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
main detection engine ctx
int SCConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
#define DETECT_CONTENT_MPM_IS_CONCLUSIVE(c)
HashListTableBucket * HashListTableGetListHead(HashListTable *ht)
#define DETECT_CONTENT_DEPTH_VAR
InspectionBuffer *(* InspectionBufferGetPktDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Packet *p, const int list_id)
const char * DetectEngineBufferTypeGetNameById(const DetectEngineCtx *de_ctx, const int id)
void DetectMpmInitializeBuiltinMpms(DetectEngineCtx *de_ctx)
struct DetectBufferMpmRegistry_::@98::@101 pkt_v1
struct DetectBufferMpmRegistry_ * next
#define SIG_FLAG_REQUIRE_STREAM
#define SIG_FLAG_TXBOTHDIR
int SCConfGetBool(const char *name, int *val)
Retrieve a configuration value as a boolean.
one time registration of keywords at start up
const struct DetectContentData_ * cd
#define SIG_GROUP_HEAD_HAVERAWSTREAM
uint8_t mpm_default_matcher
SigMatchData * sm_arrays[DETECT_SM_LIST_MAX]
void * HashListTableLookup(HashListTable *ht, void *data, uint16_t datalen)
#define SIG_FLAG_TOCLIENT
int32_t sgh_mpm_context_proto_udp_packet
DetectEngineTransforms transforms
void ShortenString(const char *input, char *output, size_t output_size, char c)
void DetectEngineRegisterFastPatternForId(DetectEngineCtx *de_ctx, int list_id, int priority)
void EngineAnalysisAddAllRulePatterns(DetectEngineCtx *de_ctx, const Signature *s)
add all patterns on our stats hash Used to fill the hash later used by DumpPatterns()
DetectEngineFrameInspectionEngine * frame_inspect
const char * cache_dir_path
int DetectBufferTypeGetByName(const char *name)
int HashListTableAdd(HashListTable *ht, void *data, uint16_t datalen)
size_t strlcpy(char *dst, const char *src, size_t siz)
void DetectAppLayerMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
void MpmInitCtx(MpmCtx *mpm_ctx, uint8_t matcher)
int32_t sgh_mpm_context_proto_other_packet
#define HashListTableGetListNext(hb)
#define SIG_FLAG_TOSERVER
HashListTable * HashListTableInit(uint32_t size, uint32_t(*Hash)(struct HashListTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
void MpmDestroyThreadCtx(MpmThreadCtx *mpm_thread_ctx, const uint16_t matcher)
#define DETECT_CONTENT_ENDS_WITH
MpmCtx * MpmFactoryGetMpmCtxForProfile(const DetectEngineCtx *de_ctx, int32_t id, int direction)
void DetectMpmInitializePktMpms(DetectEngineCtx *de_ctx)
#define MPM_PATTERN_CTX_OWNS_ID
size_t strlcat(char *, const char *src, size_t siz)
#define DetectEngineGetMaxSigId(de_ctx)
#define DETECT_CONTENT_DEPTH
DetectEnginePktInspectionEngine * pkt_inspect
bool(* InspectionSingleBufferGetDataPtr)(const void *txv, const uint8_t flow_flags, const uint8_t **buf, uint32_t *buf_len)
#define DETECT_CONTENT_IS_SINGLE(c)
#define DETECT_CONTENT_NEGATED
int PrefilterGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
void PatternMatchThreadPrepare(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
#define SCLogWarning(...)
Macro used to log WARNING messages.
int DetectEngineBufferTypeRegister(DetectEngineCtx *de_ctx, const char *name)
SigGroupHeadInitData * init
void DetectAppLayerMpmRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
register an app layer keyword for mpm
DetectEngineAppInspectionEngine * app_inspect
bool DetectBufferToClient(const DetectEngineCtx *de_ctx, int buf_id, AppProto alproto)
#define MPMCTX_FLAGS_GLOBAL
int(* PrefilterRegisterFunc)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
int32_t MpmFactoryRegisterMpmCtxProfile(DetectEngineCtx *de_ctx, const char *name, const int sm_list, const AppProto alproto)
Register a new Mpm Context.
int32_t sgh_mpm_context_stream
void DetectEngineBufferTypeSupportsFrames(DetectEngineCtx *de_ctx, const char *name)
DetectBufferMpmRegistry * frame_mpms_list
int MpmAddPatternCI(MpmCtx *mpm_ctx, const uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
int PrefilterPktPayloadRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx)
@ DETECT_BUFFER_MPM_TYPE_PKT
SignatureInitData * init_data
int FastPatternSupportEnabledForSigMatchList(const DetectEngineCtx *de_ctx, const int list_id)
Checks if a particular buffer is in the list of lists that need to be searched for a keyword that has...
enum DetectBufferMpmType type
int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
void DetectEngineBufferTypeSupportsTransformations(DetectEngineCtx *de_ctx, const char *name)
bool(* InspectionMultiBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const void *txv, const uint8_t flow_flags, uint32_t local_id, const uint8_t **buf, uint32_t *buf_len)
#define SGH_DIRECTION_TS(sgh)
#define MPM_FEATURE_FLAG_ENDSWITH
MpmStore * MpmStorePrepareBuffer(DetectEngineCtx *de_ctx, SigGroupHead *sgh, enum MpmBuiltinBuffers buf)
Get MpmStore for a built-in buffer type.
struct DetectBufferMpmRegistry_::@98::@100 app_v2
int DetectMpmPrepareFrameMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
void DetectEngineFrameMpmRegister(DetectEngineCtx *de_ctx, const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), AppProto alproto, uint8_t type)
struct DetectBufferMpmRegistry_::@98::@102 frame_v1
int SignatureHasStreamContent(const Signature *s)
check if a signature has patterns that are to be inspected against the stream payload (as opposed to ...
enum DetectBufferMpmType type
int MpmStoreInit(DetectEngineCtx *de_ctx)
Initializes the MpmStore mpm hash table to be used by the detection engine context.
void DetectAppLayerMpmRegisterSingle(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionSingleBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
DetectBufferMpmRegistry * app_mpms_list
@ DETECT_BUFFER_MPM_TYPE_APP
void DetectBufferTypeSupportsMpm(const char *name)
void HashListTableFree(HashListTable *ht)
void SupportFastPatternForSigMatchList(int list_id, int priority)
Lets one add a sm list id to be searched for potential fp supported keywords later.
struct DetectEngineFrameInspectionEngine * next
struct DetectEnginePktInspectionEngine * next
uint8_t PatternMatchDefaultMatcher(void)
Function to return the multi pattern matcher algorithm to be used by the engine, based on the mpm-alg...
int DetectMpmPreparePktMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
void DetectEngineBufferTypeSupportsMpm(DetectEngineCtx *de_ctx, const char *name)
uint32_t app_mpms_list_cnt
void DetectBufferTypeSupportsTransformations(const char *name)
#define MPM_PATTERN_FLAG_ENDSWITH
const char * builtin_mpms[]
SignatureInitDataBuffer * buffers
DetectEngineAppInspectionEngine * app_inspect_engines
HashListTable * mpm_hash_table
int(* Prepare)(MpmConfig *, struct MpmCtx_ *)
void(* DestroyCtx)(struct MpmCtx_ *)
int SigMatchListSMBelongsTo(const Signature *s, const SigMatch *key_sm)
#define MPM_CTX_FACTORY_UNIQUE_CONTEXT
int DetectMpmPrepareBuiltinMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for builtin buffers that are in "single or "shared" mode.
#define DETECT_CONTENT_OFFSET
int(* PrefilterRegisterWithListId)(struct DetectEngineCtx_ *de_ctx, struct SigGroupHead_ *sgh, MpmCtx *mpm_ctx, const struct DetectBufferMpmRegistry_ *mpm_reg, int list_id)
#define DETECT_CONTENT_MPM
a single match condition for a signature
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
void DetectMpmInitializeAppMpms(DetectEngineCtx *de_ctx)
InspectionBuffer *(* InspectionBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id)
@ DETECT_BUFFER_MPM_TYPE_SIZE
#define SGH_PROTO(sgh, p)
#define DETECT_CONTENT_REPLACE
void DetectPktMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
#define DETECT_CONTENT_FAST_PATTERN
#define MPMCTX_FLAGS_CACHE_TO_DISK
void DetectFrameMpmRegister(const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), AppProto alproto, uint8_t type)
register a MPM engine
struct DetectBufferInstance DetectBufferInstance
#define SCMemcmp(a, b, c)
int DetectMpmPrepareAppMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
SCFPSupportSMList * fp_support_smlist_list
#define DEBUG_VALIDATE_BUG_ON(exp)
void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
enum MpmBuiltinBuffers buffer
void RetrieveFPForSig(const DetectEngineCtx *de_ctx, Signature *s)
uint32_t StringHashDjb2(const uint8_t *data, uint32_t datalen)
int PrefilterPktStreamRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx)
#define DETECT_CONTENT_OFFSET_VAR
#define SIG_FLAG_REQUIRE_PACKET