suricata
detect-engine-mpm.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef __DETECT_ENGINE_MPM_H__
25 #define __DETECT_ENGINE_MPM_H__
26 
27 #include "tm-threads.h"
28 
29 #include "detect.h"
30 #include "detect-content.h"
31 #include "detect-uricontent.h"
32 
33 #include "stream.h"
34 
41 
42 uint32_t PatternStrength(uint8_t *, uint16_t);
43 
44 uint16_t PatternMatchDefaultMatcher(void);
45 uint32_t DnsQueryPatternSearch(DetectEngineThreadCtx *det_ctx, uint8_t *buffer, uint32_t buffer_len, uint8_t flags);
46 
48 
49 void PatternMatchPrepare(MpmCtx *, uint16_t);
51 
52 void PatternMatchDestroy(MpmCtx *, uint16_t);
53 void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t);
54 void PatternMatchThreadPrint(MpmThreadCtx *, uint16_t);
55 
58 
59 TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **);
61 
64 
65 void RetrieveFPForSig(const DetectEngineCtx *de_ctx, Signature *s);
66 
69 void MpmStoreReportStats(const DetectEngineCtx *de_ctx);
71 
72 /**
73  * \brief Figured out the FP and their respective content ids for all the
74  * sigs in the engine.
75  *
76  * \param de_ctx Detection engine context.
77  *
78  * \retval 0 On success.
79  * \retval -1 On failure.
80  */
82 
83 /** \brief register an app layer keyword for mpm
84  * \param name buffer name
85  * \param direction SIG_FLAG_TOSERVER or SIG_FLAG_TOCLIENT
86  * \param priority mpm keyword priority
87  * \param PrefilterRegister Prefilter api registration function
88  * \param GetData callback to setup a InspectBuffer. May be NULL.
89  * \param alproto AppProto this MPM engine inspects
90  * \param tx_min_progress min tx progress needed to invoke this engine.
91  *
92  * \note direction must be set to either toserver or toclient.
93  * If both are needed, register the keyword twice.
94  */
95 void DetectAppLayerMpmRegister2(const char *name,
96  int direction, int priority,
97  int (*PrefilterRegister)(DetectEngineCtx *de_ctx,
98  SigGroupHead *sgh, MpmCtx *mpm_ctx,
99  const DetectBufferMpmRegistery *mpm_reg, int list_id),
101  AppProto alproto, int tx_min_progress);
103  DetectEngineCtx *de_ctx,
104  const int id, const int parent_id,
105  DetectEngineTransforms *transforms);
106 
107 void DetectPktMpmRegister(const char *name,
108  int priority,
109  int (*PrefilterRegister)(DetectEngineCtx *de_ctx,
110  SigGroupHead *sgh, MpmCtx *mpm_ctx,
111  const DetectBufferMpmRegistery *mpm_reg, int list_id),
114  const int id, const int parent_id,
115  DetectEngineTransforms *transforms);
116 
117 
119  SigGroupHead *sgh, MpmCtx *mpm_ctx,
120  const DetectBufferMpmRegistery *mpm_reg, int list_id);
121 
122 
123 #endif /* __DETECT_ENGINE_MPM_H__ */
124 
int PatternMatchPrepareGroup(DetectEngineCtx *, SigGroupHead *)
Prepare the pattern matcher ctx in a sig group head.
int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx)
Figured out the FP and their respective content ids for all the sigs in the engine.
uint16_t flags
MpmStore * MpmStorePrepareBuffer(DetectEngineCtx *de_ctx, SigGroupHead *sgh, enum MpmBuiltinBuffers buf)
Get MpmStore for a built-in buffer type.
InspectionBuffer *(* InspectionBufferGetPktDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Packet *p, const int list_id)
Definition: detect.h:444
void DetectEngineThreadCtxInfo(ThreadVars *, DetectEngineThreadCtx *)
int SignatureHasPacketContent(const Signature *)
check if a signature has patterns that are to be inspected against a packets payload (as opposed to t...
Container for matching data for a signature group.
Definition: detect.h:1329
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **)
initialize thread specific detection engine context
void RetrieveFPForSig(const DetectEngineCtx *de_ctx, Signature *s)
uint16_t AppProto
void DetectPktMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Signature container.
Definition: detect.h:517
void DetectAppLayerMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
main detection engine ctx
Definition: detect.h:756
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *)
MpmBuiltinBuffers
Definition: detect.h:1230
int MpmStoreInit(DetectEngineCtx *)
Initializes the MpmStore mpm hash table to be used by the detection engine context.
int DetectMpmPrepareAppMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t)
void PatternMatchThreadPrint(MpmThreadCtx *, uint16_t)
int DetectMpmPreparePktMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
uint32_t DnsQueryPatternSearch(DetectEngineThreadCtx *det_ctx, uint8_t *buffer, uint32_t buffer_len, uint8_t flags)
uint8_t type
one time registration of keywords at start up
Definition: detect.h:600
void PatternMatchThreadPrepare(MpmThreadCtx *, uint16_t type)
void DetectAppLayerMpmRegister2(const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id), InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
register an app layer keyword for mpm
void PatternMatchDestroy(MpmCtx *, uint16_t)
void MpmStoreFree(DetectEngineCtx *)
Frees the hash table - DetectEngineCtx->mpm_hash_table, allocated by MpmStoreInit() function...
void PacketPatternCleanup(DetectEngineThreadCtx *)
cleans up the mpm instance after a match
void DetectMpmInitializeBuiltinMpms(DetectEngineCtx *de_ctx)
void PatternMatchPrepare(MpmCtx *, uint16_t)
int DetectMpmPrepareBuiltinMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for builtin buffers that are in "single or "shared" mode. ...
int SignatureHasStreamContent(const Signature *)
check if a signature has patterns that are to be inspected against the stream payload (as opposed to ...
int PrefilterGenericMpmPktRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id)
void DetectMpmInitializePktMpms(DetectEngineCtx *de_ctx)
void DetectMpmInitializeAppMpms(DetectEngineCtx *de_ctx)
uint32_t PatternStrength(uint8_t *, uint16_t)
Predict a strength value for patterns.
Per thread variable structure.
Definition: threadvars.h:57
void MpmStoreReportStats(const DetectEngineCtx *de_ctx)
InspectionBuffer *(* InspectionBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id)
Definition: detect.h:370
uint16_t PatternMatchDefaultMatcher(void)
Function to return the multi pattern matcher algorithm to be used by the engine, based on the mpm-alg...
void DetectPktMpmRegister(const char *name, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id), InspectionBufferGetPktDataPtr GetData)
register a MPM engine