suricata
detect-engine-mpm.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef __DETECT_ENGINE_MPM_H__
25 #define __DETECT_ENGINE_MPM_H__
26 
27 #include "tm-threads.h"
28 
29 #include "detect.h"
30 #include "detect-content.h"
31 #include "detect-uricontent.h"
32 
33 #include "stream.h"
34 
40 
41 uint32_t PatternStrength(uint8_t *, uint16_t);
42 
43 uint16_t PatternMatchDefaultMatcher(void);
44 uint32_t DnsQueryPatternSearch(DetectEngineThreadCtx *det_ctx, uint8_t *buffer, uint32_t buffer_len, uint8_t flags);
45 
47 
48 void PatternMatchPrepare(MpmCtx *, uint16_t);
50 
51 void PatternMatchDestroy(MpmCtx *, uint16_t);
52 void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t);
53 void PatternMatchThreadPrint(MpmThreadCtx *, uint16_t);
54 
57 
58 TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **);
60 
63 
64 void RetrieveFPForSig(const DetectEngineCtx *de_ctx, Signature *s);
65 
68 void MpmStoreReportStats(const DetectEngineCtx *de_ctx);
70 
71 /**
72  * \brief Figured out the FP and their respective content ids for all the
73  * sigs in the engine.
74  *
75  * \param de_ctx Detection engine context.
76  *
77  * \retval 0 On success.
78  * \retval -1 On failure.
79  */
81 
82 /** \brief register an app layer keyword for mpm
83  * \param name keyword name
84  * \param direction SIG_FLAG_TOSERVER or SIG_FLAG_TOCLIENT
85  * \param PrefilterRegister Prefilter api registration function
86  *
87  * \note direction must be set to either toserver or toclient.
88  * If both are needed, register the keyword twice.
89  */
90 void DetectAppLayerMpmRegister(const char *name,
91  int direction, int priority,
92  int (*PrefilterRegister)(DetectEngineCtx *de_ctx,
93  SigGroupHead *sgh, MpmCtx *mpm_ctx));
94 void DetectAppLayerMpmRegister2(const char *name,
95  int direction, int priority,
96  int (*PrefilterRegister)(DetectEngineCtx *de_ctx,
97  SigGroupHead *sgh, MpmCtx *mpm_ctx,
98  const DetectMpmAppLayerRegistery *mpm_reg, int list_id),
100  AppProto alproto, int tx_min_progress);
102  DetectEngineCtx *de_ctx,
103  const int id, const int parent_id,
104  DetectEngineTransforms *transforms);
105 
106 #endif /* __DETECT_ENGINE_MPM_H__ */
107 
int PatternMatchPrepareGroup(DetectEngineCtx *, SigGroupHead *)
Prepare the pattern matcher ctx in a sig group head.
int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx)
Figured out the FP and their respective content ids for all the sigs in the engine.
uint16_t flags
MpmStore * MpmStorePrepareBuffer(DetectEngineCtx *de_ctx, SigGroupHead *sgh, enum MpmBuiltinBuffers buf)
Get MpmStore for a built-in buffer type.
void DetectEngineThreadCtxInfo(ThreadVars *, DetectEngineThreadCtx *)
one time registration of keywords at start up
Definition: detect.h:567
int SignatureHasPacketContent(const Signature *)
check if a signature has patterns that are to be inspected against a packets payload (as opposed to t...
Container for matching data for a signature group.
Definition: detect.h:1295
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **)
initialize thread specific detection engine context
void RetrieveFPForSig(const DetectEngineCtx *de_ctx, Signature *s)
uint16_t AppProto
Signature container.
Definition: detect.h:492
void DetectAppLayerMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
main detection engine ctx
Definition: detect.h:720
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *)
MpmBuiltinBuffers
Definition: detect.h:1197
int MpmStoreInit(DetectEngineCtx *)
Initializes the MpmStore mpm hash table to be used by the detection engine context.
int DetectMpmPrepareAppMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t)
uint16_t type
void PatternMatchThreadPrint(MpmThreadCtx *, uint16_t)
uint32_t DnsQueryPatternSearch(DetectEngineThreadCtx *det_ctx, uint8_t *buffer, uint32_t buffer_len, uint8_t flags)
void PatternMatchThreadPrepare(MpmThreadCtx *, uint16_t type)
void PatternMatchDestroy(MpmCtx *, uint16_t)
void DetectAppLayerMpmRegister2(const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectMpmAppLayerRegistery *mpm_reg, int list_id), InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
register a MPM engine
void MpmStoreFree(DetectEngineCtx *)
Frees the hash table - DetectEngineCtx->mpm_hash_table, allocated by MpmStoreInit() function...
void PacketPatternCleanup(DetectEngineThreadCtx *)
cleans up the mpm instance after a match
void DetectMpmInitializeBuiltinMpms(DetectEngineCtx *de_ctx)
void PatternMatchPrepare(MpmCtx *, uint16_t)
int DetectMpmPrepareBuiltinMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for builtin buffers that are in "single or "shared" mode. ...
int SignatureHasStreamContent(const Signature *)
check if a signature has patterns that are to be inspected against the stream payload (as opposed to ...
void DetectMpmInitializeAppMpms(DetectEngineCtx *de_ctx)
uint32_t PatternStrength(uint8_t *, uint16_t)
Predict a strength value for patterns.
Per thread variable structure.
Definition: threadvars.h:57
void DetectAppLayerMpmRegister(const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx))
register an app layer keyword for mpm
void MpmStoreReportStats(const DetectEngineCtx *de_ctx)
InspectionBuffer *(* InspectionBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id)
Definition: detect.h:380
uint16_t PatternMatchDefaultMatcher(void)
Function to return the multi pattern matcher algorithm to be used by the engine, based on the mpm-alg...
void DetectMpmSetupAppMpms(DetectEngineCtx *de_ctx)