suricata
detect-engine-mpm.h File Reference
#include "tm-threads.h"
#include "detect.h"
#include "detect-content.h"
#include "detect-uricontent.h"
#include "stream.h"
Include dependency graph for detect-engine-mpm.h:

Go to the source code of this file.

Functions

void DetectMpmInitializeAppMpms (DetectEngineCtx *de_ctx)
 
void DetectMpmSetupAppMpms (DetectEngineCtx *de_ctx)
 
int DetectMpmPrepareAppMpms (DetectEngineCtx *de_ctx)
 initialize mpm contexts for applayer buffers that are in "single or "shared" mode. More...
 
void DetectMpmInitializeBuiltinMpms (DetectEngineCtx *de_ctx)
 
int DetectMpmPrepareBuiltinMpms (DetectEngineCtx *de_ctx)
 initialize mpm contexts for builtin buffers that are in "single or "shared" mode. More...
 
uint32_t PatternStrength (uint8_t *, uint16_t)
 Predict a strength value for patterns. More...
 
uint16_t PatternMatchDefaultMatcher (void)
 Function to return the multi pattern matcher algorithm to be used by the engine, based on the mpm-algo setting in yaml Use the default mpm if none is specified in the yaml file. More...
 
uint32_t DnsQueryPatternSearch (DetectEngineThreadCtx *det_ctx, uint8_t *buffer, uint32_t buffer_len, uint8_t flags)
 
void PacketPatternCleanup (DetectEngineThreadCtx *)
 cleans up the mpm instance after a match More...
 
void PatternMatchPrepare (MpmCtx *, uint16_t)
 
void PatternMatchThreadPrepare (MpmThreadCtx *, uint16_t type)
 
void PatternMatchDestroy (MpmCtx *, uint16_t)
 
void PatternMatchThreadDestroy (MpmThreadCtx *mpm_thread_ctx, uint16_t)
 
void PatternMatchThreadPrint (MpmThreadCtx *, uint16_t)
 
int PatternMatchPrepareGroup (DetectEngineCtx *, SigGroupHead *)
 Prepare the pattern matcher ctx in a sig group head. More...
 
void DetectEngineThreadCtxInfo (ThreadVars *, DetectEngineThreadCtx *)
 
TmEcode DetectEngineThreadCtxInit (ThreadVars *, void *, void **)
 initialize thread specific detection engine context More...
 
TmEcode DetectEngineThreadCtxDeinit (ThreadVars *, void *)
 
int SignatureHasPacketContent (const Signature *)
 check if a signature has patterns that are to be inspected against a packets payload (as opposed to the stream payload) More...
 
int SignatureHasStreamContent (const Signature *)
 check if a signature has patterns that are to be inspected against the stream payload (as opposed to the individual packets payload(s)) More...
 
void RetrieveFPForSig (const DetectEngineCtx *de_ctx, Signature *s)
 
int MpmStoreInit (DetectEngineCtx *)
 Initializes the MpmStore mpm hash table to be used by the detection engine context. More...
 
void MpmStoreFree (DetectEngineCtx *)
 Frees the hash table - DetectEngineCtx->mpm_hash_table, allocated by MpmStoreInit() function. More...
 
void MpmStoreReportStats (const DetectEngineCtx *de_ctx)
 
MpmStoreMpmStorePrepareBuffer (DetectEngineCtx *de_ctx, SigGroupHead *sgh, enum MpmBuiltinBuffers buf)
 Get MpmStore for a built-in buffer type. More...
 
int DetectSetFastPatternAndItsId (DetectEngineCtx *de_ctx)
 Figured out the FP and their respective content ids for all the sigs in the engine. More...
 
void DetectAppLayerMpmRegister (const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx)) __attribute__((deprecated))
 register an app layer keyword for mpm More...
 
void DetectAppLayerMpmRegister2 (const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectMpmAppLayerRegistery *mpm_reg, int list_id), InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
 register an app layer keyword for mpm More...
 
void DetectAppLayerMpmRegisterByParentId (DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
 copy a mpm engine from parent_id, add in transforms More...
 

Detailed Description

Function Documentation

void DetectAppLayerMpmRegister ( const char *  name,
int  direction,
int  priority,
int(*)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx)  PrefilterRegister 
)

register an app layer keyword for mpm

Parameters
namekeyword name
directionSIG_FLAG_TOSERVER or SIG_FLAG_TOCLIENT
PrefilterRegisterPrefilter api registration function
Note
direction must be set to either toserver or toclient. If both are needed, register the keyword twice.
Deprecated:
since 5.0.0

Definition at line 138 of file detect-engine-mpm.c.

References BUG_ON, DetectBufferTypeGetByName(), DetectBufferTypeSupportsMpm(), DetectMpmAppLayerRegistery_::direction, DetectMpmAppLayerRegistery_::id, DetectMpmAppLayerRegistery_::name, DetectMpmAppLayerRegistery_::next, DetectMpmAppLayerRegistery_::pname, DetectMpmAppLayerRegistery_::PrefilterRegister, DetectMpmAppLayerRegistery_::priority, SCCalloc, SCLogDebug, DetectMpmAppLayerRegistery_::sm_list, and SupportFastPatternForSigMatchList().

Here is the call graph for this function:

void DetectAppLayerMpmRegister2 ( const char *  name,
int  direction,
int  priority,
int(*)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectMpmAppLayerRegistery *mpm_reg, int list_id)  PrefilterRegister,
InspectionBufferGetDataPtr  GetData,
AppProto  alproto,
int  tx_min_progress 
)

register an app layer keyword for mpm

Parameters
namebuffer name
directionSIG_FLAG_TOSERVER or SIG_FLAG_TOCLIENT
prioritympm keyword priority
PrefilterRegisterPrefilter api registration function
GetDatacallback to setup a InspectBuffer. May be NULL.
alprotoAppProto this MPM engine inspects
tx_min_progressmin tx progress needed to invoke this engine.
Note
direction must be set to either toserver or toclient. If both are needed, register the keyword twice.

register an app layer keyword for mpm

Note
to be used at start up / registration only. Errors are fatal.

Definition at line 85 of file detect-engine-mpm.c.

References DetectMpmAppLayerRegistery_::alproto, BUG_ON, DetectBufferTypeGetByName(), DetectBufferTypeSupportsMpm(), DetectBufferTypeSupportsTransformations(), DetectMpmAppLayerRegistery_::direction, FatalError, DetectMpmAppLayerRegistery_::GetData, DetectMpmAppLayerRegistery_::id, DetectMpmAppLayerRegistery_::name, DetectMpmAppLayerRegistery_::next, DetectMpmAppLayerRegistery_::pname, PrefilterGenericMpmRegister(), DetectMpmAppLayerRegistery_::PrefilterRegisterWithListId, DetectMpmAppLayerRegistery_::priority, SC_ERR_INITIALIZATION, SCCalloc, SCLogDebug, DetectMpmAppLayerRegistery_::sm_list, SupportFastPatternForSigMatchList(), DetectMpmAppLayerRegistery_::tx_min_progress, and DetectMpmAppLayerRegistery_::v2.

Referenced by DetectDceStubDataRegister(), DetectDnsQueryRegister(), DetectFiledataRegister(), DetectFilemagicRegister(), DetectFilenameRegister(), DetectHttpClientBodyRegister(), DetectHttpCookieRegister(), DetectHttpHeaderNamesRegister(), DetectHttpHeaderRegister(), DetectHttpHHRegister(), DetectHttpMethodRegister(), DetectHttpProtocolRegister(), DetectHttpRawHeaderRegister(), DetectHttpRequestLineRegister(), DetectHttpResponseLineRegister(), DetectHttpStartRegister(), DetectHttpStatCodeRegister(), DetectHttpStatMsgRegister(), DetectHttpUARegister(), DetectHttpUriRegister(), DetectKrb5CNameRegister(), DetectKrb5SNameRegister(), DetectSmbNamedPipeRegister(), DetectSmbShareRegister(), DetectSNMPCommunityRegister(), DetectSshProtocolRegister(), DetectSshSoftwareRegister(), DetectTemplateBufferRegister(), DetectTlsCertsRegister(), DetectTlsFingerprintRegister(), DetectTlsIssuerRegister(), DetectTlsJa3HashRegister(), DetectTlsJa3SHashRegister(), DetectTlsJa3SStringRegister(), DetectTlsJa3StringRegister(), DetectTlsSerialRegister(), DetectTlsSniRegister(), and DetectTlsSubjectRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode DetectEngineThreadCtxDeinit ( ThreadVars ,
void *   
)
void DetectEngineThreadCtxInfo ( ThreadVars ,
DetectEngineThreadCtx  
)
TmEcode DetectEngineThreadCtxInit ( ThreadVars tv,
void *  initdata,
void **  data 
)

initialize thread specific detection engine context

Note
there is a special case when using delayed detect. In this case the function is called twice per thread. The first time the rules are not yet loaded. de_ctx->delayed_detect_initialized will be 0. The 2nd time they will be loaded. de_ctx->delayed_detect_initialized will be 1. This is needed to do the per thread counter registration before the packet runtime starts. In delayed detect mode, the first call will return a NULL ptr through the data ptr.
Parameters
tvThreadVars for this thread
initdatapointer to de_ctx
data[out]pointer to store our thread detection ctx
Return values
TM_ECODE_OKif all went well
TM_ECODE_FAILEDon serious erro

alert counter setup

Definition at line 2384 of file detect-engine.c.

Referenced by AlertFastLogInitCtx(), DetectAckRegister(), DetectBase64DecodeDoMatch(), DetectBypassRegister(), DetectDceIfaceRegister(), DetectDceOpnumRegister(), DetectDceStubDataRegister(), DetectDetectionFilterRegister(), DetectDNP3Register(), DetectDnsQueryRegister(), DetectEngineInspectENIP(), DetectEngineInspectModbus(), DetectEngineInspectStream(), DetectEngineStateResetTxs(), DetectFastPatternRegister(), DetectFlowbitsAnalyze(), DetectFlowFree(), DetectFlowintFree(), DetectFragOffsetFree(), DetectFtpbounceRegister(), DetectGeoipRegister(), DetectHostbitFree(), DetectHttpRequestLineRegister(), DetectHttpResponseLineRegister(), DetectIcmpIdFree(), DetectIcmpSeqFree(), DetectICodeFree(), DetectIPProtoRemoveAllSMs(), DetectIPRepFree(), DetectITypeFree(), DetectL3ProtoRegister(), DetectLuaRegister(), DetectPcrePayloadMatch(), DetectProtoContainsProto(), DetectReplaceFreeInternal(), DetectRpcFree(), DetectSameipRegister(), DetectSetupParseRegexes(), DetectSshSoftwareVersionRegister(), DetectSshVersionRegister(), DetectTemplateRustBufferRegister(), DetectThresholdRegister(), DetectTransformCompressWhitespaceRegister(), DetectTransformStripWhitespaceRegister(), DetectUricontentRegister(), DetectUrilenValidateContent(), DetectXbitFree(), MpmACRegister(), MpmACTileRegister(), RegisterModbusParsers(), SCACBSPrintInfo(), SCThresholdConfParseFile(), SigGroupHeadContainsSigId(), SigParseApplyDsizeToContent(), SMTPParserCleanup(), TagTimeoutCheck(), UTHMatchPackets(), UTHMatchPacketsWithResults(), UTHPacketMatchSig(), and UTHPacketMatchSigMpm().

void DetectMpmInitializeAppMpms ( DetectEngineCtx de_ctx)
void DetectMpmInitializeBuiltinMpms ( DetectEngineCtx de_ctx)
int DetectMpmPrepareBuiltinMpms ( DetectEngineCtx de_ctx)

initialize mpm contexts for builtin buffers that are in "single or "shared" mode.

Definition at line 345 of file detect-engine-mpm.c.

References MPM_CTX_FACTORY_UNIQUE_CONTEXT, DetectEngineCtx_::mpm_matcher, mpm_table, MpmFactoryGetMpmCtxForProfile(), MpmTableElmt_::Prepare, DetectEngineCtx_::sgh_mpm_context_proto_other_packet, DetectEngineCtx_::sgh_mpm_context_proto_tcp_packet, DetectEngineCtx_::sgh_mpm_context_proto_udp_packet, and DetectEngineCtx_::sgh_mpm_context_stream.

Referenced by SigGroupBuild().

Here is the call graph for this function:

Here is the caller graph for this function:

uint32_t DnsQueryPatternSearch ( DetectEngineThreadCtx det_ctx,
uint8_t *  buffer,
uint32_t  buffer_len,
uint8_t  flags 
)
int MpmStoreInit ( DetectEngineCtx de_ctx)

Initializes the MpmStore mpm hash table to be used by the detection engine context.

Parameters
de_ctxPointer to the detection engine context.
Return values
0On success.
-1On failure.

Definition at line 888 of file detect-engine-mpm.c.

References HashListTableAdd(), HashListTableInit(), HashListTableLookup(), and DetectEngineCtx_::mpm_hash_table.

Referenced by DetectEngineInspectBufferGeneric().

Here is the call graph for this function:

Here is the caller graph for this function:

void PacketPatternCleanup ( DetectEngineThreadCtx )

cleans up the mpm instance after a match

Definition at line 513 of file detect-engine-mpm.c.

References DetectEngineThreadCtx_::pmq, and PmqReset().

Referenced by SigMatchSignaturesGetSgh().

Here is the call graph for this function:

Here is the caller graph for this function:

uint16_t PatternMatchDefaultMatcher ( void  )

Function to return the multi pattern matcher algorithm to be used by the engine, based on the mpm-algo setting in yaml Use the default mpm if none is specified in the yaml file.

Return values
mpmalgo value

Definition at line 472 of file detect-engine-mpm.c.

References ConfGet(), mpm_default_matcher, mpm_table, MPM_TABLE_SIZE, SC_ERR_INVALID_YAML_CONF_ENTRY, and SCLogError.

Referenced by AppLayerProtoDetectSetup(), and DetectEngineInspectBufferGeneric().

Here is the call graph for this function:

Here is the caller graph for this function:

void PatternMatchDestroy ( MpmCtx ,
uint16_t   
)

Definition at line 518 of file detect-engine-mpm.c.

References MpmTableElmt_::DestroyCtx, mpm_table, and SCLogDebug.

void PatternMatchPrepare ( MpmCtx ,
uint16_t   
)
void PatternMatchThreadDestroy ( MpmThreadCtx mpm_thread_ctx,
uint16_t   
)

Definition at line 529 of file detect-engine-mpm.c.

References MpmTableElmt_::DestroyThreadCtx, mpm_table, and SCLogDebug.

Referenced by DetectEngineThreadCtxInit().

Here is the caller graph for this function:

void PatternMatchThreadPrepare ( MpmThreadCtx ,
uint16_t  type 
)

Definition at line 535 of file detect-engine-mpm.c.

References MpmInitThreadCtx(), and SCLogDebug.

Referenced by DetectEngineResetMaxSigId().

Here is the call graph for this function:

Here is the caller graph for this function:

void PatternMatchThreadPrint ( MpmThreadCtx ,
uint16_t   
)

Definition at line 524 of file detect-engine-mpm.c.

References SCLogDebug.

Referenced by DetectEngineThreadCtxInfo().

Here is the caller graph for this function:

uint32_t PatternStrength ( uint8_t *  pat,
uint16_t  patlen 
)

Predict a strength value for patterns.

Patterns with high character diversity score higher. Alpha chars score not so high Other printable + a few common codes a little higher Everything else highest. Longer patterns score better than short patters.

Parameters
patpattern
patlenlength of the patternn
Return values
spattern score

Definition at line 554 of file detect-engine-mpm.c.

References DetectContentData_::content, DetectContentData_::content_len, DetectContentData_::depth, DETECT_CONTENT_NOCASE, DetectContentData_::flags, flags, DetectContentData_::fp_chop_len, DetectContentData_::fp_chop_offset, DetectContentData_::id, MPM_PATTERN_CTX_OWNS_ID, MpmAddPatternCI(), MpmAddPatternCS(), Signature_::num, and DetectContentData_::offset.

Referenced by PacketCreateMask().

Here is the call graph for this function:

Here is the caller graph for this function:

int SignatureHasPacketContent ( const Signature s)

check if a signature has patterns that are to be inspected against a packets payload (as opposed to the stream payload)

Parameters
ssignature
Return values
1true
0false

Definition at line 402 of file detect-engine-mpm.c.

References DETECT_SM_LIST_PMATCH, Signature_::flags, Signature_::init_data, DetectProto_::proto, Signature_::proto, SCEnter, SCLogDebug, SCReturnInt, SIG_FLAG_REQUIRE_PACKET, Signature_::sm_arrays, and SignatureInitData_::smlists.

Referenced by MpmStorePrepareBuffer(), and PerCentEncodingMatch().

Here is the caller graph for this function:

int SignatureHasStreamContent ( const Signature s)

check if a signature has patterns that are to be inspected against the stream payload (as opposed to the individual packets payload(s))

Parameters
ssignature
Return values
1true
0false

Definition at line 438 of file detect-engine-mpm.c.

References DETECT_SM_LIST_PMATCH, Signature_::flags, Signature_::init_data, DetectProto_::proto, Signature_::proto, SCEnter, SCLogDebug, SCReturnInt, SIG_FLAG_REQUIRE_STREAM, Signature_::sm_arrays, and SignatureInitData_::smlists.

Referenced by MpmStorePrepareBuffer(), and PerCentEncodingMatch().

Here is the caller graph for this function: