suricata
detect-engine-mpm.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef __DETECT_ENGINE_MPM_H__
25 #define __DETECT_ENGINE_MPM_H__
26 
27 #include "tm-threads.h"
28 
29 #include "detect.h"
30 #include "detect-content.h"
31 #include "detect-uricontent.h"
32 
33 #include "stream.h"
34 
41 
42 uint32_t PatternStrength(uint8_t *, uint16_t);
43 
44 uint16_t PatternMatchDefaultMatcher(void);
45 uint32_t DnsQueryPatternSearch(DetectEngineThreadCtx *det_ctx, uint8_t *buffer, uint32_t buffer_len, uint8_t flags);
46 
47 void PatternMatchPrepare(MpmCtx *, uint16_t);
49 
50 void PatternMatchDestroy(MpmCtx *, uint16_t);
51 void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t);
52 void PatternMatchThreadPrint(MpmThreadCtx *, uint16_t);
53 
56 
57 TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **);
59 
62 
64 
69 
70 /**
71  * \brief Figured out the FP and their respective content ids for all the
72  * sigs in the engine.
73  *
74  * \param de_ctx Detection engine context.
75  *
76  * \retval 0 On success.
77  * \retval -1 On failure.
78  */
80 
81 /** \brief register an app layer keyword for mpm
82  * \param name buffer name
83  * \param direction SIG_FLAG_TOSERVER or SIG_FLAG_TOCLIENT
84  * \param priority mpm keyword priority
85  * \param PrefilterRegister Prefilter api registration function
86  * \param GetData callback to setup a InspectBuffer. May be NULL.
87  * \param alproto AppProto this MPM engine inspects
88  * \param tx_min_progress min tx progress needed to invoke this engine.
89  *
90  * \note direction must be set to either toserver or toclient.
91  * If both are needed, register the keyword twice.
92  */
93 void DetectAppLayerMpmRegister2(const char *name,
94  int direction, int priority,
95  int (*PrefilterRegister)(DetectEngineCtx *de_ctx,
96  SigGroupHead *sgh, MpmCtx *mpm_ctx,
97  const DetectBufferMpmRegistery *mpm_reg, int list_id),
99  AppProto alproto, int tx_min_progress);
102  const int id, const int parent_id,
103  DetectEngineTransforms *transforms);
104 
105 void DetectPktMpmRegister(const char *name,
106  int priority,
107  int (*PrefilterRegister)(DetectEngineCtx *de_ctx,
108  SigGroupHead *sgh, MpmCtx *mpm_ctx,
109  const DetectBufferMpmRegistery *mpm_reg, int list_id),
112  const int id, const int parent_id,
113  DetectEngineTransforms *transforms);
114 
115 
117  SigGroupHead *sgh, MpmCtx *mpm_ctx,
118  const DetectBufferMpmRegistery *mpm_reg, int list_id);
119 
120 
121 typedef struct PrefilterMpmListId {
122  int list_id;
123  const MpmCtx *mpm_ctx;
126 
128  int local_id; /**< used as index into thread inspect array */
129  void *txv;
130 };
131 
132 #endif /* __DETECT_ENGINE_MPM_H__ */
133 
tm-threads.h
detect-content.h
SignatureHasStreamContent
int SignatureHasStreamContent(const Signature *)
check if a signature has patterns that are to be inspected against the stream payload (as opposed to ...
Definition: detect-engine-mpm.c:585
DetectMpmInitializeBuiltinMpms
void DetectMpmInitializeBuiltinMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:479
MpmThreadCtx_
Definition: util-mpm.h:46
MpmListIdDataArgs
Definition: detect-engine-mpm.h:127
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1336
DetectEngineTransforms
Definition: detect.h:376
RetrieveFPForSig
void RetrieveFPForSig(const DetectEngineCtx *de_ctx, Signature *s)
Definition: detect-engine-mpm.c:842
DetectSetFastPatternAndItsId
int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx)
Figured out the FP and their respective content ids for all the sigs in the engine.
Definition: detect-engine-mpm.c:1735
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:77
SignatureHasPacketContent
int SignatureHasPacketContent(const Signature *)
check if a signature has patterns that are to be inspected against a packets payload (as opposed to t...
Definition: detect-engine-mpm.c:549
InspectionBufferGetDataPtr
InspectionBuffer *(* InspectionBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id)
Definition: detect.h:382
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:755
PatternMatchPrepareGroup
int PatternMatchPrepareGroup(DetectEngineCtx *, SigGroupHead *)
Prepare the pattern matcher ctx in a sig group head.
Definition: detect-engine-mpm.c:1662
InspectionBufferGetPktDataPtr
InspectionBuffer *(* InspectionBufferGetPktDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Packet *p, const int list_id)
Definition: detect.h:442
MpmListIdDataArgs::txv
void * txv
Definition: detect-engine-mpm.h:129
DetectBufferMpmRegistery_
one time registration of keywords at start up
Definition: detect.h:598
PrefilterMpmListId
struct PrefilterMpmListId PrefilterMpmListId
MpmBuiltinBuffers
MpmBuiltinBuffers
Definition: detect.h:1237
PrefilterMpmListId
Definition: detect-engine-mpm.h:121
PatternMatchDestroy
void PatternMatchDestroy(MpmCtx *, uint16_t)
Definition: detect-engine-mpm.c:661
PatternMatchThreadPrint
void PatternMatchThreadPrint(MpmThreadCtx *, uint16_t)
Definition: detect-engine-mpm.c:667
type
uint8_t type
Definition: decode-icmpv4.h:0
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectEngineThreadCtx_
Definition: detect.h:999
MpmStore_
Definition: detect.h:1248
DetectMpmInitializeAppMpms
void DetectMpmInitializeAppMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:211
DetectEngineThreadCtxInfo
void DetectEngineThreadCtxInfo(ThreadVars *, DetectEngineThreadCtx *)
Definition: detect-engine.c:2970
MpmListIdDataArgs::local_id
int local_id
Definition: detect-engine-mpm.h:128
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
PatternMatchDefaultMatcher
uint16_t PatternMatchDefaultMatcher(void)
Function to return the multi pattern matcher algorithm to be used by the engine, based on the mpm-alg...
Definition: detect-engine-mpm.c:619
PrefilterMpmListId::transforms
const DetectEngineTransforms * transforms
Definition: detect-engine-mpm.h:124
stream.h
PrefilterMpmListId::mpm_ctx
const MpmCtx * mpm_ctx
Definition: detect-engine-mpm.h:123
DetectMpmInitializePktMpms
void DetectMpmInitializePktMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:378
TmEcode
TmEcode
Definition: tm-threads-common.h:79
PatternStrength
uint32_t PatternStrength(uint8_t *, uint16_t)
Predict a strength value for patterns.
Definition: detect-engine-mpm.c:697
PatternMatchThreadPrepare
void PatternMatchThreadPrepare(MpmThreadCtx *, uint16_t type)
Definition: detect-engine-mpm.c:678
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **)
initialize thread specific detection engine context
Definition: detect-engine.c:2744
flags
uint8_t flags
Definition: decode-gre.h:0
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *)
Definition: detect-engine.c:2952
DetectMpmPrepareAppMpms
int DetectMpmPrepareAppMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
Definition: detect-engine-mpm.c:265
MpmStorePrepareBuffer
MpmStore * MpmStorePrepareBuffer(DetectEngineCtx *de_ctx, SigGroupHead *sgh, enum MpmBuiltinBuffers buf)
Get MpmStore for a built-in buffer type.
Definition: detect-engine-mpm.c:1292
Signature_
Signature container.
Definition: detect.h:515
PrefilterMpmListId::list_id
int list_id
Definition: detect-engine-mpm.h:122
MpmStoreInit
int MpmStoreInit(DetectEngineCtx *)
Initializes the MpmStore mpm hash table to be used by the detection engine context.
Definition: detect-engine-mpm.c:1038
DetectMpmPrepareBuiltinMpms
int DetectMpmPrepareBuiltinMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for builtin buffers that are in "single or "shared" mode.
Definition: detect-engine-mpm.c:492
DetectPktMpmRegister
void DetectPktMpmRegister(const char *name, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id), InspectionBufferGetPktDataPtr GetData)
register a MPM engine
Definition: detect-engine-mpm.c:290
DetectMpmPreparePktMpms
int DetectMpmPreparePktMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
Definition: detect-engine-mpm.c:433
detect-uricontent.h
DetectPktMpmRegisterByParentId
void DetectPktMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Definition: detect-engine-mpm.c:341
PrefilterGenericMpmPktRegister
int PrefilterGenericMpmPktRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id)
Definition: detect-engine-prefilter.c:681
DetectAppLayerMpmRegister2
void DetectAppLayerMpmRegister2(const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id), InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
register an app layer keyword for mpm
Definition: detect-engine-mpm.c:89
MpmStoreReportStats
void MpmStoreReportStats(const DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:1104
MpmStoreFree
void MpmStoreFree(DetectEngineCtx *)
Frees the hash table - DetectEngineCtx->mpm_hash_table, allocated by MpmStoreInit() function.
Definition: detect-engine-mpm.c:1185
MpmCtx_
Definition: util-mpm.h:88
DnsQueryPatternSearch
uint32_t DnsQueryPatternSearch(DetectEngineThreadCtx *det_ctx, uint8_t *buffer, uint32_t buffer_len, uint8_t flags)
DetectAppLayerMpmRegisterByParentId
void DetectAppLayerMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Definition: detect-engine-mpm.c:145
PatternMatchThreadDestroy
void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t)
Definition: detect-engine-mpm.c:672
PatternMatchPrepare
void PatternMatchPrepare(MpmCtx *, uint16_t)