suricata
|
#include "detect.h"
Go to the source code of this file.
Data Structures | |
struct | PrefilterMpmListId |
struct | MpmListIdDataArgs |
Typedefs | |
typedef int(* | PrefilterRegisterFunc) (DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id) |
typedef struct PrefilterMpmListId | PrefilterMpmListId |
Functions | |
void | DetectMpmInitializeFrameMpms (DetectEngineCtx *de_ctx) |
int | DetectMpmPrepareFrameMpms (DetectEngineCtx *de_ctx) |
initialize mpm contexts for applayer buffers that are in "single or "shared" mode. More... | |
void | DetectMpmInitializePktMpms (DetectEngineCtx *de_ctx) |
int | DetectMpmPreparePktMpms (DetectEngineCtx *de_ctx) |
initialize mpm contexts for applayer buffers that are in "single or "shared" mode. More... | |
void | DetectMpmInitializeAppMpms (DetectEngineCtx *de_ctx) |
int | DetectMpmPrepareAppMpms (DetectEngineCtx *de_ctx) |
initialize mpm contexts for applayer buffers that are in "single or "shared" mode. More... | |
void | DetectMpmInitializeBuiltinMpms (DetectEngineCtx *de_ctx) |
int | DetectMpmPrepareBuiltinMpms (DetectEngineCtx *de_ctx) |
initialize mpm contexts for builtin buffers that are in "single or "shared" mode. More... | |
uint32_t | PatternStrength (uint8_t *, uint16_t) |
Predict a strength value for patterns. More... | |
uint8_t | PatternMatchDefaultMatcher (void) |
Function to return the multi pattern matcher algorithm to be used by the engine, based on the mpm-algo setting in yaml Use the default mpm if none is specified in the yaml file. More... | |
void | PatternMatchPrepare (MpmCtx *, uint16_t) |
void | PatternMatchThreadPrepare (MpmThreadCtx *, uint16_t type) |
void | PatternMatchDestroy (MpmCtx *, uint16_t) |
void | PatternMatchThreadDestroy (MpmThreadCtx *mpm_thread_ctx, uint16_t) |
int | PatternMatchPrepareGroup (DetectEngineCtx *, SigGroupHead *) |
Prepare the pattern matcher ctx in a sig group head. More... | |
TmEcode | DetectEngineThreadCtxInit (ThreadVars *, void *, void **) |
initialize thread specific detection engine context More... | |
TmEcode | DetectEngineThreadCtxDeinit (ThreadVars *, void *) |
int | SignatureHasPacketContent (const Signature *) |
check if a signature has patterns that are to be inspected against a packets payload (as opposed to the stream payload) More... | |
int | SignatureHasStreamContent (const Signature *) |
check if a signature has patterns that are to be inspected against the stream payload (as opposed to the individual packets payload(s)) More... | |
void | RetrieveFPForSig (const DetectEngineCtx *de_ctx, Signature *s) |
int | MpmStoreInit (DetectEngineCtx *) |
Initializes the MpmStore mpm hash table to be used by the detection engine context. More... | |
void | MpmStoreFree (DetectEngineCtx *) |
Frees the hash table - DetectEngineCtx->mpm_hash_table, allocated by MpmStoreInit() function. More... | |
void | MpmStoreReportStats (const DetectEngineCtx *de_ctx) |
MpmStore * | MpmStorePrepareBuffer (DetectEngineCtx *de_ctx, SigGroupHead *sgh, enum MpmBuiltinBuffers buf) |
Get MpmStore for a built-in buffer type. More... | |
int | DetectSetFastPatternAndItsId (DetectEngineCtx *de_ctx) |
Figure out the FP and their respective content ids for all the sigs in the engine. More... | |
void | DetectAppLayerMpmRegister (const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress) |
register an app layer keyword for mpm More... | |
void | DetectAppLayerMpmMultiRegister (const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionMultiBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress) |
void | DetectAppLayerMpmRegisterByParentId (DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms) |
copy a mpm engine from parent_id, add in transforms More... | |
void | DetectPktMpmRegister (const char *name, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetPktDataPtr GetData) |
void | DetectPktMpmRegisterByParentId (DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms) |
copy a mpm engine from parent_id, add in transforms More... | |
void | DetectFrameMpmRegister (const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), AppProto alproto, uint8_t type) |
register a MPM engine More... | |
void | DetectFrameMpmRegisterByParentId (DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms) |
copy a mpm engine from parent_id, add in transforms More... | |
void | DetectEngineFrameMpmRegister (DetectEngineCtx *de_ctx, const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), AppProto alproto, uint8_t type) |
int | PrefilterGenericMpmPktRegister (DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id) |
int | PrefilterGenericMpmFrameRegister (DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id) |
void | EngineAnalysisAddAllRulePatterns (DetectEngineCtx *de_ctx, const Signature *s) |
add all patterns on our stats hash Used to fill the hash later used by DumpPatterns() More... | |
Definition in file detect-engine-mpm.h.
typedef struct PrefilterMpmListId PrefilterMpmListId |
typedef int(* PrefilterRegisterFunc) (DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id) |
Definition at line 75 of file detect-engine-mpm.h.
void DetectAppLayerMpmMultiRegister | ( | const char * | name, |
int | direction, | ||
int | priority, | ||
PrefilterRegisterFunc | PrefilterRegister, | ||
InspectionMultiBufferGetDataPtr | GetData, | ||
AppProto | alproto, | ||
int | tx_min_progress | ||
) |
Definition at line 159 of file detect-engine-mpm.c.
void DetectAppLayerMpmRegister | ( | const char * | name, |
int | direction, | ||
int | priority, | ||
PrefilterRegisterFunc | PrefilterRegister, | ||
InspectionBufferGetDataPtr | GetData, | ||
AppProto | alproto, | ||
int | tx_min_progress | ||
) |
register an app layer keyword for mpm
name | buffer name |
direction | SIG_FLAG_TOSERVER or SIG_FLAG_TOCLIENT |
priority | mpm keyword priority |
PrefilterRegister | Prefilter api registration function |
GetData | callback to setup a InspectBuffer. May be NULL. |
alproto | AppProto this MPM engine inspects |
tx_min_progress | min tx progress needed to invoke this engine. |
Definition at line 151 of file detect-engine-mpm.c.
Referenced by DetectFileRegisterFileProtocols().
void DetectAppLayerMpmRegisterByParentId | ( | DetectEngineCtx * | de_ctx, |
const int | id, | ||
const int | parent_id, | ||
DetectEngineTransforms * | transforms | ||
) |
copy a mpm engine from parent_id, add in transforms
Definition at line 168 of file detect-engine-mpm.c.
References DetectEngineCtx_::app_mpms_list, DetectEngineCtx_::app_mpms_list_cnt, DetectBufferMpmRegistry_::app_v2, BUG_ON, DetectEngineTransforms::cnt, de_ctx, DEBUG_VALIDATE_BUG_ON, DETECT_BUFFER_MPM_TYPE_APP, DetectEngineRegisterFastPatternForId(), DetectBufferMpmRegistry_::direction, DetectBufferMpmRegistry_::id, MpmFactoryRegisterMpmCtxProfile(), DetectBufferMpmRegistry_::name, SigTableElmt_::name, DetectBufferMpmRegistry_::next, DetectBufferMpmRegistry_::pname, DetectBufferMpmRegistry_::PrefilterRegisterWithListId, DetectBufferMpmRegistry_::priority, SCCalloc, SCLogDebug, DetectBufferMpmRegistry_::sgh_mpm_context, ShortenString(), sigmatch_table, DetectBufferMpmRegistry_::sm_list, DetectBufferMpmRegistry_::sm_list_base, strlcat(), strlcpy(), TransformData_::transform, DetectEngineTransforms::transforms, DetectBufferMpmRegistry_::transforms, and DetectBufferMpmRegistry_::type.
Referenced by DetectEngineBufferTypeGetByIdTransforms().
void DetectEngineFrameMpmRegister | ( | DetectEngineCtx * | de_ctx, |
const char * | name, | ||
int | direction, | ||
int | priority, | ||
int(*)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id) | PrefilterRegister, | ||
AppProto | alproto, | ||
uint8_t | type | ||
) |
Definition at line 398 of file detect-engine-mpm.c.
References AppProtoToString(), BUG_ON, ConfGetBool(), de_ctx, DETECT_BUFFER_MPM_TYPE_FRAME, DetectEngineBufferTypeRegister(), DetectEngineBufferTypeSupportsFrames(), DetectEngineBufferTypeSupportsMpm(), DetectEngineBufferTypeSupportsTransformations(), DetectEngineRegisterFastPatternForId(), DetectBufferMpmRegistry_::direction, ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE, FatalError, DetectEngineCtx_::frame_mpms_list, DetectEngineCtx_::frame_mpms_list_cnt, DetectBufferMpmRegistry_::frame_v1, MPM_CTX_FACTORY_UNIQUE_CONTEXT, MpmFactoryRegisterMpmCtxProfile(), DetectBufferMpmRegistry_::name, DetectBufferMpmRegistry_::next, DetectBufferMpmRegistry_::pname, DetectBufferMpmRegistry_::PrefilterRegisterWithListId, DetectBufferMpmRegistry_::priority, SCCalloc, SCLogDebug, DetectBufferMpmRegistry_::sgh_mpm_context, DetectEngineCtx_::sgh_mpm_ctx_cnf, DetectBufferMpmRegistry_::sm_list, type, and DetectBufferMpmRegistry_::type.
TmEcode DetectEngineThreadCtxDeinit | ( | ThreadVars * | , |
void * | |||
) |
Definition at line 3550 of file detect-engine.c.
Referenced by UTHMatchPackets(), UTHMatchPacketsWithResults(), UTHPacketMatchSig(), and UTHPacketMatchSigMpm().
TmEcode DetectEngineThreadCtxInit | ( | ThreadVars * | tv, |
void * | initdata, | ||
void ** | data | ||
) |
initialize thread specific detection engine context
tv | ThreadVars for this thread |
initdata | pointer to de_ctx |
data[out] | pointer to store our thread detection ctx |
TM_ECODE_OK | if all went well |
TM_ECODE_FAILED | on serious errors |
alert counter setup
Definition at line 3323 of file detect-engine.c.
Referenced by UTHMatchPackets(), UTHMatchPacketsWithResults(), UTHPacketMatchSig(), and UTHPacketMatchSigMpm().
void DetectFrameMpmRegister | ( | const char * | name, |
int | direction, | ||
int | priority, | ||
int(*)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id) | PrefilterRegister, | ||
AppProto | alproto, | ||
uint8_t | type | ||
) |
register a MPM engine
Definition at line 311 of file detect-engine-mpm.c.
References AppProtoToString(), BUG_ON, DETECT_BUFFER_MPM_TYPE_FRAME, DetectBufferTypeGetByName(), DetectBufferTypeSupportsFrames(), DetectBufferTypeSupportsMpm(), DetectBufferTypeSupportsTransformations(), DetectBufferMpmRegistry_::direction, FatalError, DetectBufferMpmRegistry_::frame_v1, DetectBufferMpmRegistry_::name, DetectBufferMpmRegistry_::pname, DetectBufferMpmRegistry_::PrefilterRegisterWithListId, DetectBufferMpmRegistry_::priority, SCCalloc, SCLogDebug, DetectBufferMpmRegistry_::sm_list, type, and DetectBufferMpmRegistry_::type.
void DetectFrameMpmRegisterByParentId | ( | DetectEngineCtx * | de_ctx, |
const int | id, | ||
const int | parent_id, | ||
DetectEngineTransforms * | transforms | ||
) |
copy a mpm engine from parent_id, add in transforms
Definition at line 359 of file detect-engine-mpm.c.
References BUG_ON, de_ctx, DEBUG_VALIDATE_BUG_ON, DETECT_BUFFER_MPM_TYPE_FRAME, DetectEngineRegisterFastPatternForId(), DetectBufferMpmRegistry_::direction, DetectEngineCtx_::frame_mpms_list, DetectEngineCtx_::frame_mpms_list_cnt, DetectBufferMpmRegistry_::frame_v1, DetectBufferMpmRegistry_::id, DetectBufferMpmRegistry_::name, DetectBufferMpmRegistry_::next, DetectBufferMpmRegistry_::pname, DetectBufferMpmRegistry_::PrefilterRegisterWithListId, DetectBufferMpmRegistry_::priority, SCCalloc, SCLogDebug, DetectBufferMpmRegistry_::sgh_mpm_context, DetectBufferMpmRegistry_::sm_list, DetectBufferMpmRegistry_::sm_list_base, DetectBufferMpmRegistry_::transforms, and DetectBufferMpmRegistry_::type.
Referenced by DetectEngineBufferTypeGetByIdTransforms().
void DetectMpmInitializeAppMpms | ( | DetectEngineCtx * | de_ctx | ) |
Definition at line 236 of file detect-engine-mpm.c.
void DetectMpmInitializeBuiltinMpms | ( | DetectEngineCtx * | de_ctx | ) |
Definition at line 726 of file detect-engine-mpm.c.
References de_ctx, and DetectEngineCtx_::sgh_mpm_context_proto_tcp_packet.
void DetectMpmInitializeFrameMpms | ( | DetectEngineCtx * | de_ctx | ) |
Definition at line 461 of file detect-engine-mpm.c.
void DetectMpmInitializePktMpms | ( | DetectEngineCtx * | de_ctx | ) |
Definition at line 628 of file detect-engine-mpm.c.
int DetectMpmPrepareAppMpms | ( | DetectEngineCtx * | de_ctx | ) |
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
Definition at line 286 of file detect-engine-mpm.c.
References DetectEngineCtx_::app_mpms_list, de_ctx, DetectBufferMpmRegistry_::direction, MPM_CTX_FACTORY_UNIQUE_CONTEXT, DetectEngineCtx_::mpm_matcher, mpm_table, MpmFactoryGetMpmCtxForProfile(), DetectBufferMpmRegistry_::next, MpmTableElmt_::Prepare, DetectBufferMpmRegistry_::sgh_mpm_context, and SIG_FLAG_TOSERVER.
int DetectMpmPrepareBuiltinMpms | ( | DetectEngineCtx * | de_ctx | ) |
initialize mpm contexts for builtin buffers that are in "single or "shared" mode.
Definition at line 739 of file detect-engine-mpm.c.
References de_ctx, MPM_CTX_FACTORY_UNIQUE_CONTEXT, DetectEngineCtx_::mpm_matcher, mpm_table, MpmFactoryGetMpmCtxForProfile(), MpmTableElmt_::Prepare, DetectEngineCtx_::sgh_mpm_context_proto_other_packet, DetectEngineCtx_::sgh_mpm_context_proto_tcp_packet, DetectEngineCtx_::sgh_mpm_context_proto_udp_packet, and DetectEngineCtx_::sgh_mpm_context_stream.
int DetectMpmPrepareFrameMpms | ( | DetectEngineCtx * | de_ctx | ) |
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
Definition at line 513 of file detect-engine-mpm.c.
References de_ctx, DetectBufferMpmRegistry_::direction, DetectEngineCtx_::frame_mpms_list, MPM_CTX_FACTORY_UNIQUE_CONTEXT, DetectEngineCtx_::mpm_matcher, mpm_table, MpmFactoryGetMpmCtxForProfile(), DetectBufferMpmRegistry_::name, DetectBufferMpmRegistry_::next, MpmTableElmt_::Prepare, SCLogDebug, DetectBufferMpmRegistry_::sgh_mpm_context, and SIG_FLAG_TOSERVER.
int DetectMpmPreparePktMpms | ( | DetectEngineCtx * | de_ctx | ) |
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
Definition at line 680 of file detect-engine-mpm.c.
References de_ctx, MPM_CTX_FACTORY_UNIQUE_CONTEXT, DetectEngineCtx_::mpm_matcher, mpm_table, MpmFactoryGetMpmCtxForProfile(), DetectBufferMpmRegistry_::name, DetectBufferMpmRegistry_::next, DetectEngineCtx_::pkt_mpms_list, MpmTableElmt_::Prepare, SCLogDebug, and DetectBufferMpmRegistry_::sgh_mpm_context.
void DetectPktMpmRegister | ( | const char * | name, |
int | priority, | ||
PrefilterRegisterFunc | PrefilterRegister, | ||
InspectionBufferGetPktDataPtr | GetData | ||
) |
void DetectPktMpmRegisterByParentId | ( | DetectEngineCtx * | de_ctx, |
const int | id, | ||
const int | parent_id, | ||
DetectEngineTransforms * | transforms | ||
) |
copy a mpm engine from parent_id, add in transforms
Definition at line 590 of file detect-engine-mpm.c.
References BUG_ON, de_ctx, DEBUG_VALIDATE_BUG_ON, DETECT_BUFFER_MPM_TYPE_PKT, DetectEngineRegisterFastPatternForId(), DetectBufferMpmRegistry_::id, DetectBufferMpmRegistry_::name, DetectBufferMpmRegistry_::next, DetectEngineCtx_::pkt_mpms_list, DetectEngineCtx_::pkt_mpms_list_cnt, DetectBufferMpmRegistry_::pkt_v1, DetectBufferMpmRegistry_::pname, DetectBufferMpmRegistry_::PrefilterRegisterWithListId, DetectBufferMpmRegistry_::priority, SCCalloc, SCLogDebug, DetectBufferMpmRegistry_::sgh_mpm_context, DetectBufferMpmRegistry_::sm_list, DetectBufferMpmRegistry_::sm_list_base, DetectBufferMpmRegistry_::transforms, and DetectBufferMpmRegistry_::type.
Referenced by DetectEngineBufferTypeGetByIdTransforms().
int DetectSetFastPatternAndItsId | ( | DetectEngineCtx * | de_ctx | ) |
Figure out the FP and their respective content ids for all the sigs in the engine.
de_ctx | Detection engine context. |
0 | On success. |
-1 | On failure. |
Definition at line 2414 of file detect-engine-mpm.c.
References cnt, de_ctx, Signature_::flags, HashListTableInit(), Signature_::init_data, SignatureInitData_::mpm_sm, Signature_::next, RetrieveFPForSig(), SIG_FLAG_PREFILTER, and DetectEngineCtx_::sig_list.
Referenced by SigGroupBuild().
void EngineAnalysisAddAllRulePatterns | ( | DetectEngineCtx * | de_ctx, |
const Signature * | s | ||
) |
add all patterns on our stats hash Used to fill the hash later used by DumpPatterns()
Definition at line 2476 of file detect-engine-mpm.c.
References de_ctx, HashListTableInit(), and DetectEngineCtx_::pattern_hash_table.
void MpmStoreFree | ( | DetectEngineCtx * | de_ctx | ) |
Frees the hash table - DetectEngineCtx->mpm_hash_table, allocated by MpmStoreInit() function.
de_ctx | Pointer to the detection engine context. |
Definition at line 1526 of file detect-engine-mpm.c.
References de_ctx, HashListTableFree(), and DetectEngineCtx_::mpm_hash_table.
Referenced by DetectEngineCtxFree().
int MpmStoreInit | ( | DetectEngineCtx * | de_ctx | ) |
Initializes the MpmStore mpm hash table to be used by the detection engine context.
de_ctx | Pointer to the detection engine context. |
0 | On success. |
-1 | On failure. |
Definition at line 1363 of file detect-engine-mpm.c.
References de_ctx, HashListTableInit(), and DetectEngineCtx_::mpm_hash_table.
MpmStore* MpmStorePrepareBuffer | ( | DetectEngineCtx * | de_ctx, |
SigGroupHead * | sgh, | ||
enum MpmBuiltinBuffers | buf | ||
) |
Get MpmStore for a built-in buffer type.
Definition at line 1631 of file detect-engine-mpm.c.
References BUG_ON, cnt, de_ctx, DETECT_SM_LIST_PMATCH, DetectEngineGetMaxSigId, SigGroupHead_::init, Signature_::init_data, SigGroupHeadInitData_::match_array, SignatureInitData_::mpm_sm, MPMB_MAX, MPMB_OTHERIP, MPMB_TCP_PKT_TC, MPMB_TCP_PKT_TS, MPMB_TCP_STREAM_TC, MPMB_TCP_STREAM_TS, MPMB_UDP_TC, MPMB_UDP_TS, DetectEngineCtx_::sgh_mpm_context_proto_other_packet, DetectEngineCtx_::sgh_mpm_context_proto_tcp_packet, DetectEngineCtx_::sgh_mpm_context_proto_udp_packet, DetectEngineCtx_::sgh_mpm_context_stream, SigGroupHeadInitData_::sig_cnt, SIG_FLAG_TOCLIENT, and SIG_FLAG_TOSERVER.
Referenced by PatternMatchPrepareGroup().
void MpmStoreReportStats | ( | const DetectEngineCtx * | de_ctx | ) |
Definition at line 1429 of file detect-engine-mpm.c.
References MpmStore_::buffer, DetectEngineCtx_::buffer_type_id, de_ctx, DETECT_SM_LIST_PMATCH, HashListTableGetListData, HashListTableGetListHead(), HashListTableGetListNext, MpmStore_::mpm_ctx, DetectEngineCtx_::mpm_hash_table, MPMB_MAX, and MpmStore_::sm_list.
Referenced by SigPrepareStage4().
uint8_t PatternMatchDefaultMatcher | ( | void | ) |
Function to return the multi pattern matcher algorithm to be used by the engine, based on the mpm-algo setting in yaml Use the default mpm if none is specified in the yaml file.
mpm | algo value |
Definition at line 854 of file detect-engine-mpm.c.
References ConfGet(), FatalError, mpm_default_matcher, mpm_table, MPM_TABLE_SIZE, and SCLogWarning.
void PatternMatchDestroy | ( | MpmCtx * | , |
uint16_t | |||
) |
Definition at line 900 of file detect-engine-mpm.c.
References MpmTableElmt_::DestroyCtx, mpm_table, and SCLogDebug.
void PatternMatchPrepare | ( | MpmCtx * | , |
uint16_t | |||
) |
int PatternMatchPrepareGroup | ( | DetectEngineCtx * | de_ctx, |
SigGroupHead * | sh | ||
) |
Prepare the pattern matcher ctx in a sig group head.
Definition at line 2223 of file detect-engine-mpm.c.
References de_ctx, MpmStore_::mpm_ctx, MPMB_TCP_PKT_TS, MPMB_TCP_STREAM_TS, MpmStorePrepareBuffer(), PrefilterPktPayloadRegister(), PrefilterPktStreamRegister(), SGH_DIRECTION_TS, and SGH_PROTO.
Referenced by PrefilterSetupRuleGroup().
void PatternMatchThreadDestroy | ( | MpmThreadCtx * | mpm_thread_ctx, |
uint16_t | |||
) |
Definition at line 906 of file detect-engine-mpm.c.
References MpmDestroyThreadCtx(), and SCLogDebug.
void PatternMatchThreadPrepare | ( | MpmThreadCtx * | , |
uint16_t | type | ||
) |
Definition at line 911 of file detect-engine-mpm.c.
References MpmInitThreadCtx(), and SCLogDebug.
uint32_t PatternStrength | ( | uint8_t * | pat, |
uint16_t | patlen | ||
) |
Predict a strength value for patterns.
Patterns with high character diversity score higher. Alpha chars score not so high Other printable + a few common codes a little higher Everything else highest. Longer patterns score better than short patters.
pat | pattern |
patlen | length of the pattern |
s | pattern score |
Definition at line 930 of file detect-engine-mpm.c.
int PrefilterGenericMpmFrameRegister | ( | DetectEngineCtx * | de_ctx, |
SigGroupHead * | sgh, | ||
MpmCtx * | mpm_ctx, | ||
const DetectBufferMpmRegistry * | mpm_reg, | ||
int | list_id | ||
) |
Definition at line 207 of file detect-engine-frame.c.
References ALPROTO_UNKNOWN, BUG_ON, de_ctx, DetectBufferMpmRegistry_::frame_v1, FrameStreamData::list_id, PrefilterMpmFrameCtx::list_id, FrameStreamData::mpm_ctx, PrefilterMpmFrameCtx::mpm_ctx, PrefilterAppendFrameEngine(), SCCalloc, SCEnter, PrefilterMpmFrameCtx::transforms, and DetectBufferMpmRegistry_::transforms.
int PrefilterGenericMpmPktRegister | ( | DetectEngineCtx * | de_ctx, |
SigGroupHead * | sgh, | ||
MpmCtx * | mpm_ctx, | ||
const DetectBufferMpmRegistry * | mpm_reg, | ||
int | list_id | ||
) |
Definition at line 873 of file detect-engine-prefilter.c.
void RetrieveFPForSig | ( | const DetectEngineCtx * | de_ctx, |
Signature * | s | ||
) |
Definition at line 1074 of file detect-engine-mpm.c.
References de_ctx, DETECT_CONTENT, DETECT_CONTENT_FAST_PATTERN, DETECT_SM_LIST_PMATCH, FastPatternSupportEnabledForSigMatchList(), DetectContentData_::flags, g_skip_prefilter, Signature_::init_data, SignatureInitData_::max_content_list_id, SignatureInitData_::mpm_sm, SigMatch_::next, and SignatureInitData_::smlists.
Referenced by DetectSetFastPatternAndItsId().
int SignatureHasPacketContent | ( | const Signature * | s | ) |
check if a signature has patterns that are to be inspected against a packets payload (as opposed to the stream payload)
s | signature |
1 | true |
0 | false |
Definition at line 796 of file detect-engine-mpm.c.
References DETECT_SM_LIST_PMATCH, Signature_::flags, Signature_::init_data, DetectProto_::proto, Signature_::proto, SCEnter, SCLogDebug, SCReturnInt, SIG_FLAG_REQUIRE_PACKET, and SignatureInitData_::smlists.
int SignatureHasStreamContent | ( | const Signature * | s | ) |
check if a signature has patterns that are to be inspected against the stream payload (as opposed to the individual packets payload(s))
s | signature |
1 | true |
0 | false |
Definition at line 826 of file detect-engine-mpm.c.
References DETECT_SM_LIST_PMATCH, Signature_::flags, Signature_::init_data, DetectProto_::proto, Signature_::proto, SCEnter, SCLogDebug, SCReturnInt, SIG_FLAG_REQUIRE_STREAM, and SignatureInitData_::smlists.