suricata
detect-engine-mpm.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef __DETECT_ENGINE_MPM_H__
25 #define __DETECT_ENGINE_MPM_H__
26 
27 
28 #include "detect.h"
29 
30 
39 
40 uint32_t PatternStrength(uint8_t *, uint16_t);
41 
42 uint8_t PatternMatchDefaultMatcher(void);
43 
44 void PatternMatchPrepare(MpmCtx *, uint16_t);
46 
47 void PatternMatchDestroy(MpmCtx *, uint16_t);
48 void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t);
49 void PatternMatchThreadPrint(MpmThreadCtx *, uint16_t);
50 
53 
54 TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **);
56 
59 
61 
66 
67 /**
68  * \brief Figure out the FP and their respective content ids for all the
69  * sigs in the engine.
70  *
71  * \param de_ctx Detection engine context.
72  *
73  * \retval 0 On success.
74  * \retval -1 On failure.
75  */
77 
79  const DetectBufferMpmRegistry *mpm_reg, int list_id);
80 
81 /** \brief register an app layer keyword for mpm
82  * \param name buffer name
83  * \param direction SIG_FLAG_TOSERVER or SIG_FLAG_TOCLIENT
84  * \param priority mpm keyword priority
85  * \param PrefilterRegister Prefilter api registration function
86  * \param GetData callback to setup a InspectBuffer. May be NULL.
87  * \param alproto AppProto this MPM engine inspects
88  * \param tx_min_progress min tx progress needed to invoke this engine.
89  *
90  * \note direction must be set to either toserver or toclient.
91  * If both are needed, register the keyword twice.
92  */
93 void DetectAppLayerMpmRegister2(const char *name, int direction, int priority,
94  PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData,
95  AppProto alproto, int tx_min_progress);
98  const int id, const int parent_id,
99  DetectEngineTransforms *transforms);
100 
101 void DetectPktMpmRegister(const char *name, int priority, PrefilterRegisterFunc PrefilterRegister,
104  const int id, const int parent_id,
105  DetectEngineTransforms *transforms);
106 
107 void DetectFrameMpmRegister(const char *name, int direction, int priority,
108  int (*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx,
109  const DetectBufferMpmRegistry *mpm_reg, int list_id),
110  AppProto alproto, uint8_t type);
111 void DetectFrameMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id,
112  DetectEngineTransforms *transforms);
113 void DetectEngineFrameMpmRegister(DetectEngineCtx *de_ctx, const char *name, int direction,
114  int priority,
115  int (*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx,
116  const DetectBufferMpmRegistry *mpm_reg, int list_id),
117  AppProto alproto, uint8_t type);
118 
120  const DetectBufferMpmRegistry *mpm_reg, int list_id);
121 
123  const DetectBufferMpmRegistry *mpm_reg, int list_id);
124 
125 typedef struct PrefilterMpmListId {
126  int list_id;
127  const MpmCtx *mpm_ctx;
130 
132  uint32_t local_id; /**< used as index into thread inspect array */
133  void *txv;
134 };
135 
137 
138 #endif /* __DETECT_ENGINE_MPM_H__ */
139 
DetectEngineFrameMpmRegister
void DetectEngineFrameMpmRegister(DetectEngineCtx *de_ctx, const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), AppProto alproto, uint8_t type)
Definition: detect-engine-mpm.c:373
SignatureHasStreamContent
int SignatureHasStreamContent(const Signature *)
check if a signature has patterns that are to be inspected against the stream payload (as opposed to ...
Definition: detect-engine-mpm.c:807
DetectMpmInitializeBuiltinMpms
void DetectMpmInitializeBuiltinMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:701
MpmThreadCtx_
Definition: util-mpm.h:47
MpmListIdDataArgs
Definition: detect-engine-mpm.h:131
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1438
DetectEngineTransforms
Definition: detect.h:399
RetrieveFPForSig
void RetrieveFPForSig(const DetectEngineCtx *de_ctx, Signature *s)
Definition: detect-engine-mpm.c:1067
DetectSetFastPatternAndItsId
int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx)
Figure out the FP and their respective content ids for all the sigs in the engine.
Definition: detect-engine-mpm.c:2400
DetectPktMpmRegister
void DetectPktMpmRegister(const char *name, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetPktDataPtr GetData)
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:80
SignatureHasPacketContent
int SignatureHasPacketContent(const Signature *)
check if a signature has patterns that are to be inspected against a packets payload (as opposed to t...
Definition: detect-engine-mpm.c:771
DetectAppLayerMpmRegister2
void DetectAppLayerMpmRegister2(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
register an app layer keyword for mpm
Definition: detect-engine-mpm.c:89
InspectionBufferGetDataPtr
InspectionBuffer *(* InspectionBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id)
Definition: detect.h:405
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:826
DetectMpmInitializeFrameMpms
void DetectMpmInitializeFrameMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:436
PatternMatchPrepareGroup
int PatternMatchPrepareGroup(DetectEngineCtx *, SigGroupHead *)
Prepare the pattern matcher ctx in a sig group head.
Definition: detect-engine-mpm.c:2209
MpmListIdDataArgs::local_id
uint32_t local_id
Definition: detect-engine-mpm.h:132
InspectionBufferGetPktDataPtr
InspectionBuffer *(* InspectionBufferGetPktDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Packet *p, const int list_id)
Definition: detect.h:466
MpmListIdDataArgs::txv
void * txv
Definition: detect-engine-mpm.h:133
DetectBufferMpmRegistry_
one time registration of keywords at start up
Definition: detect.h:668
EngineAnalysisAddAllRulePatterns
void EngineAnalysisAddAllRulePatterns(DetectEngineCtx *de_ctx, const Signature *s)
add all patterns on our stats hash Used to fill the hash later used by DumpPatterns()
Definition: detect-engine-mpm.c:2462
PrefilterMpmListId
struct PrefilterMpmListId PrefilterMpmListId
MpmBuiltinBuffers
MpmBuiltinBuffers
Definition: detect.h:1319
PrefilterMpmListId
Definition: detect-engine-mpm.h:125
PatternMatchDestroy
void PatternMatchDestroy(MpmCtx *, uint16_t)
Definition: detect-engine-mpm.c:884
PatternMatchThreadPrint
void PatternMatchThreadPrint(MpmThreadCtx *, uint16_t)
Definition: detect-engine-mpm.c:890
type
uint8_t type
Definition: decode-icmpv4.h:0
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectEngineThreadCtx_
Definition: detect.h:1074
MpmStore_
Definition: detect.h:1330
DetectMpmPrepareFrameMpms
int DetectMpmPrepareFrameMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
Definition: detect-engine-mpm.c:488
DetectMpmInitializeAppMpms
void DetectMpmInitializeAppMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:211
DetectEngineThreadCtxInfo
void DetectEngineThreadCtxInfo(ThreadVars *, DetectEngineThreadCtx *)
Definition: detect-engine.c:3540
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
PrefilterMpmListId::transforms
const DetectEngineTransforms * transforms
Definition: detect-engine-mpm.h:128
DetectFrameMpmRegisterByParentId
void DetectFrameMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Definition: detect-engine-mpm.c:334
PrefilterRegisterFunc
int(* PrefilterRegisterFunc)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-mpm.h:78
PrefilterMpmListId::mpm_ctx
const MpmCtx * mpm_ctx
Definition: detect-engine-mpm.h:127
DetectMpmInitializePktMpms
void DetectMpmInitializePktMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:603
TmEcode
TmEcode
Definition: tm-threads-common.h:83
PatternStrength
uint32_t PatternStrength(uint8_t *, uint16_t)
Predict a strength value for patterns.
Definition: detect-engine-mpm.c:920
PrefilterGenericMpmPktRegister
int PrefilterGenericMpmPktRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-prefilter.c:815
PatternMatchThreadPrepare
void PatternMatchThreadPrepare(MpmThreadCtx *, uint16_t type)
Definition: detect-engine-mpm.c:901
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **)
initialize thread specific detection engine context
Definition: detect-engine.c:3308
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *)
Definition: detect-engine.c:3522
DetectMpmPrepareAppMpms
int DetectMpmPrepareAppMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
Definition: detect-engine-mpm.c:261
PatternMatchDefaultMatcher
uint8_t PatternMatchDefaultMatcher(void)
Function to return the multi pattern matcher algorithm to be used by the engine, based on the mpm-alg...
Definition: detect-engine-mpm.c:841
MpmStorePrepareBuffer
MpmStore * MpmStorePrepareBuffer(DetectEngineCtx *de_ctx, SigGroupHead *sgh, enum MpmBuiltinBuffers buf)
Get MpmStore for a built-in buffer type.
Definition: detect-engine-mpm.c:1617
DetectFrameMpmRegister
void DetectFrameMpmRegister(const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), AppProto alproto, uint8_t type)
register a MPM engine
Definition: detect-engine-mpm.c:286
Signature_
Signature container.
Definition: detect.h:581
PrefilterMpmListId::list_id
int list_id
Definition: detect-engine-mpm.h:126
MpmStoreInit
int MpmStoreInit(DetectEngineCtx *)
Initializes the MpmStore mpm hash table to be used by the detection engine context.
Definition: detect-engine-mpm.c:1354
DetectMpmPrepareBuiltinMpms
int DetectMpmPrepareBuiltinMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for builtin buffers that are in "single or "shared" mode.
Definition: detect-engine-mpm.c:714
PrefilterGenericMpmFrameRegister
int PrefilterGenericMpmFrameRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-frame.c:207
DetectMpmPreparePktMpms
int DetectMpmPreparePktMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
Definition: detect-engine-mpm.c:655
DetectPktMpmRegisterByParentId
void DetectPktMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Definition: detect-engine-mpm.c:565
MpmStoreReportStats
void MpmStoreReportStats(const DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:1420
MpmStoreFree
void MpmStoreFree(DetectEngineCtx *)
Frees the hash table - DetectEngineCtx->mpm_hash_table, allocated by MpmStoreInit() function.
Definition: detect-engine-mpm.c:1517
MpmCtx_
Definition: util-mpm.h:89
DetectAppLayerMpmRegisterByParentId
void DetectAppLayerMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Definition: detect-engine-mpm.c:143
PatternMatchThreadDestroy
void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t)
Definition: detect-engine-mpm.c:895
PatternMatchPrepare
void PatternMatchPrepare(MpmCtx *, uint16_t)