suricata
detect-engine-mpm.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef SURICATA_DETECT_ENGINE_MPM_H
25 #define SURICATA_DETECT_ENGINE_MPM_H
26 
27 #include "detect.h"
28 
29 
38 
39 uint32_t PatternStrength(uint8_t *, uint16_t);
40 
41 uint8_t PatternMatchDefaultMatcher(void);
42 
43 void PatternMatchPrepare(MpmCtx *, uint16_t);
45 
46 void PatternMatchDestroy(MpmCtx *, uint16_t);
47 void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t);
48 
50 
51 TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **);
53 
56 
58 
63 
64 /**
65  * \brief Figure out the FP and their respective content ids for all the
66  * sigs in the engine.
67  *
68  * \param de_ctx Detection engine context.
69  *
70  * \retval 0 On success.
71  * \retval -1 On failure.
72  */
74 
76  const DetectBufferMpmRegistry *mpm_reg, int list_id);
77 
78 /** \brief register an app layer keyword for mpm
79  * \param name buffer name
80  * \param direction SIG_FLAG_TOSERVER or SIG_FLAG_TOCLIENT
81  * \param priority mpm keyword priority
82  * \param PrefilterRegister Prefilter api registration function
83  * \param GetData callback to setup a InspectBuffer. May be NULL.
84  * \param alproto AppProto this MPM engine inspects
85  * \param tx_min_progress min tx progress needed to invoke this engine.
86  *
87  * \note direction must be set to either toserver or toclient.
88  * If both are needed, register the keyword twice.
89  */
90 void DetectAppLayerMpmRegister(const char *name, int direction, int priority,
91  PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData,
92  AppProto alproto, int tx_min_progress);
93 void DetectAppLayerMpmMultiRegister(const char *name, int direction, int priority,
94  PrefilterRegisterFunc PrefilterRegister, InspectionMultiBufferGetDataPtr GetData,
95  AppProto alproto, int tx_min_progress);
98  const int id, const int parent_id,
99  DetectEngineTransforms *transforms);
100 
101 void DetectPktMpmRegister(const char *name, int priority, PrefilterRegisterFunc PrefilterRegister,
104  const int id, const int parent_id,
105  DetectEngineTransforms *transforms);
106 
107 void DetectFrameMpmRegister(const char *name, int direction, int priority,
108  int (*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx,
109  const DetectBufferMpmRegistry *mpm_reg, int list_id),
110  AppProto alproto, uint8_t type);
111 void DetectFrameMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id,
112  DetectEngineTransforms *transforms);
113 void DetectEngineFrameMpmRegister(DetectEngineCtx *de_ctx, const char *name, int direction,
114  int priority,
115  int (*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx,
116  const DetectBufferMpmRegistry *mpm_reg, int list_id),
117  AppProto alproto, uint8_t type);
118 
120  const DetectBufferMpmRegistry *mpm_reg, int list_id);
121 
123  const DetectBufferMpmRegistry *mpm_reg, int list_id);
124 
125 typedef struct PrefilterMpmListId {
126  int list_id;
127  const MpmCtx *mpm_ctx;
131 
133  uint32_t local_id; /**< used as index into thread inspect array */
134  void *txv;
135 };
136 
138 
139 #endif /* SURICATA_DETECT_ENGINE_MPM_H */
DetectEngineFrameMpmRegister
void DetectEngineFrameMpmRegister(DetectEngineCtx *de_ctx, const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), AppProto alproto, uint8_t type)
Definition: detect-engine-mpm.c:393
SignatureHasStreamContent
int SignatureHasStreamContent(const Signature *)
check if a signature has patterns that are to be inspected against the stream payload (as opposed to ...
Definition: detect-engine-mpm.c:821
DetectMpmInitializeBuiltinMpms
void DetectMpmInitializeBuiltinMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:721
MpmThreadCtx_
Definition: util-mpm.h:46
MpmListIdDataArgs
Definition: detect-engine-mpm.h:132
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1460
DetectEngineTransforms
Definition: detect.h:409
RetrieveFPForSig
void RetrieveFPForSig(const DetectEngineCtx *de_ctx, Signature *s)
Definition: detect-engine-mpm.c:1072
DetectSetFastPatternAndItsId
int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx)
Figure out the FP and their respective content ids for all the sigs in the engine.
Definition: detect-engine-mpm.c:2414
DetectPktMpmRegister
void DetectPktMpmRegister(const char *name, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetPktDataPtr GetData)
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:82
DetectAppLayerMpmMultiRegister
void DetectAppLayerMpmMultiRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionMultiBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
Definition: detect-engine-mpm.c:154
SignatureHasPacketContent
int SignatureHasPacketContent(const Signature *)
check if a signature has patterns that are to be inspected against a packets payload (as opposed to t...
Definition: detect-engine-mpm.c:791
InspectionMultiBufferGetDataPtr
InspectionBuffer *(* InspectionMultiBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id, const uint32_t local_id)
Definition: detect.h:420
InspectionBufferGetDataPtr
InspectionBuffer *(* InspectionBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id)
Definition: detect.h:415
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:848
DetectMpmInitializeFrameMpms
void DetectMpmInitializeFrameMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:456
PatternMatchPrepareGroup
int PatternMatchPrepareGroup(DetectEngineCtx *, SigGroupHead *)
Prepare the pattern matcher ctx in a sig group head.
Definition: detect-engine-mpm.c:2223
MpmListIdDataArgs::local_id
uint32_t local_id
Definition: detect-engine-mpm.h:133
InspectionBufferGetPktDataPtr
InspectionBuffer *(* InspectionBufferGetPktDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Packet *p, const int list_id)
Definition: detect.h:482
MpmListIdDataArgs::txv
void * txv
Definition: detect-engine-mpm.h:134
DetectBufferMpmRegistry_
one time registration of keywords at start up
Definition: detect.h:686
EngineAnalysisAddAllRulePatterns
void EngineAnalysisAddAllRulePatterns(DetectEngineCtx *de_ctx, const Signature *s)
add all patterns on our stats hash Used to fill the hash later used by DumpPatterns()
Definition: detect-engine-mpm.c:2476
PrefilterMpmListId
struct PrefilterMpmListId PrefilterMpmListId
MpmBuiltinBuffers
MpmBuiltinBuffers
Definition: detect.h:1343
PrefilterMpmListId
Definition: detect-engine-mpm.h:125
PatternMatchDestroy
void PatternMatchDestroy(MpmCtx *, uint16_t)
Definition: detect-engine-mpm.c:895
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
MpmStore_
Definition: detect.h:1354
DetectMpmPrepareFrameMpms
int DetectMpmPrepareFrameMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
Definition: detect-engine-mpm.c:508
DetectMpmInitializeAppMpms
void DetectMpmInitializeAppMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:231
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
PrefilterMpmListId::transforms
const DetectEngineTransforms * transforms
Definition: detect-engine-mpm.h:129
DetectFrameMpmRegisterByParentId
void DetectFrameMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Definition: detect-engine-mpm.c:354
PrefilterRegisterFunc
int(* PrefilterRegisterFunc)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-mpm.h:75
PrefilterMpmListId::mpm_ctx
const MpmCtx * mpm_ctx
Definition: detect-engine-mpm.h:127
type
uint16_t type
Definition: decode-vlan.c:107
DetectMpmInitializePktMpms
void DetectMpmInitializePktMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:623
TmEcode
TmEcode
Definition: tm-threads-common.h:83
PatternStrength
uint32_t PatternStrength(uint8_t *, uint16_t)
Predict a strength value for patterns.
Definition: detect-engine-mpm.c:925
PrefilterGenericMpmPktRegister
int PrefilterGenericMpmPktRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-prefilter.c:868
PatternMatchThreadPrepare
void PatternMatchThreadPrepare(MpmThreadCtx *, uint16_t type)
Definition: detect-engine-mpm.c:906
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **)
initialize thread specific detection engine context
Definition: detect-engine.c:3299
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *)
Definition: detect-engine.c:3513
DetectMpmPrepareAppMpms
int DetectMpmPrepareAppMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
Definition: detect-engine-mpm.c:281
PrefilterMpmListId::GetData
InspectionMultiBufferGetDataPtr GetData
Definition: detect-engine-mpm.h:128
PatternMatchDefaultMatcher
uint8_t PatternMatchDefaultMatcher(void)
Function to return the multi pattern matcher algorithm to be used by the engine, based on the mpm-alg...
Definition: detect-engine-mpm.c:849
MpmStorePrepareBuffer
MpmStore * MpmStorePrepareBuffer(DetectEngineCtx *de_ctx, SigGroupHead *sgh, enum MpmBuiltinBuffers buf)
Get MpmStore for a built-in buffer type.
Definition: detect-engine-mpm.c:1631
DetectFrameMpmRegister
void DetectFrameMpmRegister(const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), AppProto alproto, uint8_t type)
register a MPM engine
Definition: detect-engine-mpm.c:306
Signature_
Signature container.
Definition: detect.h:602
PrefilterMpmListId::list_id
int list_id
Definition: detect-engine-mpm.h:126
MpmStoreInit
int MpmStoreInit(DetectEngineCtx *)
Initializes the MpmStore mpm hash table to be used by the detection engine context.
Definition: detect-engine-mpm.c:1362
DetectMpmPrepareBuiltinMpms
int DetectMpmPrepareBuiltinMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for builtin buffers that are in "single or "shared" mode.
Definition: detect-engine-mpm.c:734
PrefilterGenericMpmFrameRegister
int PrefilterGenericMpmFrameRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-frame.c:207
DetectMpmPreparePktMpms
int DetectMpmPreparePktMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
Definition: detect-engine-mpm.c:675
DetectPktMpmRegisterByParentId
void DetectPktMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Definition: detect-engine-mpm.c:585
MpmStoreReportStats
void MpmStoreReportStats(const DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:1428
MpmStoreFree
void MpmStoreFree(DetectEngineCtx *)
Frees the hash table - DetectEngineCtx->mpm_hash_table, allocated by MpmStoreInit() function.
Definition: detect-engine-mpm.c:1525
MpmCtx_
Definition: util-mpm.h:88
DetectAppLayerMpmRegister
void DetectAppLayerMpmRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
register an app layer keyword for mpm
Definition: detect-engine-mpm.c:146
DetectAppLayerMpmRegisterByParentId
void DetectAppLayerMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Definition: detect-engine-mpm.c:163
PatternMatchThreadDestroy
void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t)
Definition: detect-engine-mpm.c:901
PatternMatchPrepare
void PatternMatchPrepare(MpmCtx *, uint16_t)