suricata
detect-engine-mpm.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef __DETECT_ENGINE_MPM_H__
25 #define __DETECT_ENGINE_MPM_H__
26 
27 
28 #include "detect.h"
29 
30 
39 
40 uint32_t PatternStrength(uint8_t *, uint16_t);
41 
42 uint8_t PatternMatchDefaultMatcher(void);
43 uint32_t DnsQueryPatternSearch(DetectEngineThreadCtx *det_ctx, uint8_t *buffer, uint32_t buffer_len, uint8_t flags);
44 
45 void PatternMatchPrepare(MpmCtx *, uint16_t);
47 
48 void PatternMatchDestroy(MpmCtx *, uint16_t);
49 void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t);
50 void PatternMatchThreadPrint(MpmThreadCtx *, uint16_t);
51 
54 
55 TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **);
57 
60 
62 
67 
68 /**
69  * \brief Figure out the FP and their respective content ids for all the
70  * sigs in the engine.
71  *
72  * \param de_ctx Detection engine context.
73  *
74  * \retval 0 On success.
75  * \retval -1 On failure.
76  */
78 
79 /** \brief register an app layer keyword for mpm
80  * \param name buffer name
81  * \param direction SIG_FLAG_TOSERVER or SIG_FLAG_TOCLIENT
82  * \param priority mpm keyword priority
83  * \param PrefilterRegister Prefilter api registration function
84  * \param GetData callback to setup a InspectBuffer. May be NULL.
85  * \param alproto AppProto this MPM engine inspects
86  * \param tx_min_progress min tx progress needed to invoke this engine.
87  *
88  * \note direction must be set to either toserver or toclient.
89  * If both are needed, register the keyword twice.
90  */
91 void DetectAppLayerMpmRegister2(const char *name,
92  int direction, int priority,
93  int (*PrefilterRegister)(DetectEngineCtx *de_ctx,
94  SigGroupHead *sgh, MpmCtx *mpm_ctx,
95  const DetectBufferMpmRegistery *mpm_reg, int list_id),
97  AppProto alproto, int tx_min_progress);
100  const int id, const int parent_id,
101  DetectEngineTransforms *transforms);
102 
103 void DetectPktMpmRegister(const char *name,
104  int priority,
105  int (*PrefilterRegister)(DetectEngineCtx *de_ctx,
106  SigGroupHead *sgh, MpmCtx *mpm_ctx,
107  const DetectBufferMpmRegistery *mpm_reg, int list_id),
110  const int id, const int parent_id,
111  DetectEngineTransforms *transforms);
112 
113 void DetectFrameMpmRegister(const char *name, int direction, int priority,
114  int (*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx,
115  const DetectBufferMpmRegistery *mpm_reg, int list_id),
116  AppProto alproto, uint8_t type);
117 void DetectFrameMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id,
118  DetectEngineTransforms *transforms);
119 void DetectEngineFrameMpmRegister(DetectEngineCtx *de_ctx, const char *name, int direction,
120  int priority,
121  int (*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx,
122  const DetectBufferMpmRegistery *mpm_reg, int list_id),
123  AppProto alproto, uint8_t type);
124 
126  SigGroupHead *sgh, MpmCtx *mpm_ctx,
127  const DetectBufferMpmRegistery *mpm_reg, int list_id);
128 
130  const DetectBufferMpmRegistery *mpm_reg, int list_id);
131 
132 typedef struct PrefilterMpmListId {
133  int list_id;
134  const MpmCtx *mpm_ctx;
137 
139  uint32_t local_id; /**< used as index into thread inspect array */
140  void *txv;
141 };
142 
144 
145 #endif /* __DETECT_ENGINE_MPM_H__ */
146 
SignatureHasStreamContent
int SignatureHasStreamContent(const Signature *)
check if a signature has patterns that are to be inspected against the stream payload (as opposed to ...
Definition: detect-engine-mpm.c:808
DetectMpmInitializeBuiltinMpms
void DetectMpmInitializeBuiltinMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:702
MpmThreadCtx_
Definition: util-mpm.h:46
MpmListIdDataArgs
Definition: detect-engine-mpm.h:138
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1397
DetectEngineTransforms
Definition: detect.h:374
RetrieveFPForSig
void RetrieveFPForSig(const DetectEngineCtx *de_ctx, Signature *s)
Definition: detect-engine-mpm.c:1067
DetectSetFastPatternAndItsId
int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx)
Figure out the FP and their respective content ids for all the sigs in the engine.
Definition: detect-engine-mpm.c:2233
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:80
SignatureHasPacketContent
int SignatureHasPacketContent(const Signature *)
check if a signature has patterns that are to be inspected against a packets payload (as opposed to t...
Definition: detect-engine-mpm.c:772
InspectionBufferGetDataPtr
InspectionBuffer *(* InspectionBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id)
Definition: detect.h:380
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:787
DetectMpmInitializeFrameMpms
void DetectMpmInitializeFrameMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:437
PatternMatchPrepareGroup
int PatternMatchPrepareGroup(DetectEngineCtx *, SigGroupHead *)
Prepare the pattern matcher ctx in a sig group head.
Definition: detect-engine-mpm.c:2042
MpmListIdDataArgs::local_id
uint32_t local_id
Definition: detect-engine-mpm.h:139
InspectionBufferGetPktDataPtr
InspectionBuffer *(* InspectionBufferGetPktDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Packet *p, const int list_id)
Definition: detect.h:440
MpmListIdDataArgs::txv
void * txv
Definition: detect-engine-mpm.h:140
DetectBufferMpmRegistery_
one time registration of keywords at start up
Definition: detect.h:628
EngineAnalysisAddAllRulePatterns
void EngineAnalysisAddAllRulePatterns(DetectEngineCtx *de_ctx, const Signature *s)
add all patterns on our stats hash Used to fill the hash later used by DumpPatterns()
Definition: detect-engine-mpm.c:2297
PrefilterMpmListId
struct PrefilterMpmListId PrefilterMpmListId
MpmBuiltinBuffers
MpmBuiltinBuffers
Definition: detect.h:1278
DetectEngineFrameMpmRegister
void DetectEngineFrameMpmRegister(DetectEngineCtx *de_ctx, const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id), AppProto alproto, uint8_t type)
Definition: detect-engine-mpm.c:375
PrefilterMpmListId
Definition: detect-engine-mpm.h:132
PatternMatchDestroy
void PatternMatchDestroy(MpmCtx *, uint16_t)
Definition: detect-engine-mpm.c:885
PatternMatchThreadPrint
void PatternMatchThreadPrint(MpmThreadCtx *, uint16_t)
Definition: detect-engine-mpm.c:891
type
uint8_t type
Definition: decode-icmpv4.h:0
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectEngineThreadCtx_
Definition: detect.h:1027
MpmStore_
Definition: detect.h:1289
DetectMpmPrepareFrameMpms
int DetectMpmPrepareFrameMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
Definition: detect-engine-mpm.c:488
DetectMpmInitializeAppMpms
void DetectMpmInitializeAppMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:214
DetectEngineThreadCtxInfo
void DetectEngineThreadCtxInfo(ThreadVars *, DetectEngineThreadCtx *)
Definition: detect-engine.c:3398
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
PrefilterMpmListId::transforms
const DetectEngineTransforms * transforms
Definition: detect-engine-mpm.h:135
DetectFrameMpmRegisterByParentId
void DetectFrameMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Definition: detect-engine-mpm.c:336
PrefilterMpmListId::mpm_ctx
const MpmCtx * mpm_ctx
Definition: detect-engine-mpm.h:134
DetectMpmInitializePktMpms
void DetectMpmInitializePktMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:605
TmEcode
TmEcode
Definition: tm-threads-common.h:83
PatternStrength
uint32_t PatternStrength(uint8_t *, uint16_t)
Predict a strength value for patterns.
Definition: detect-engine-mpm.c:921
PatternMatchThreadPrepare
void PatternMatchThreadPrepare(MpmThreadCtx *, uint16_t type)
Definition: detect-engine-mpm.c:902
DetectFrameMpmRegister
void DetectFrameMpmRegister(const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id), AppProto alproto, uint8_t type)
register a MPM engine
Definition: detect-engine-mpm.c:288
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **)
initialize thread specific detection engine context
Definition: detect-engine.c:3166
flags
uint8_t flags
Definition: decode-gre.h:0
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *)
Definition: detect-engine.c:3380
DetectMpmPrepareAppMpms
int DetectMpmPrepareAppMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
Definition: detect-engine-mpm.c:263
PatternMatchDefaultMatcher
uint8_t PatternMatchDefaultMatcher(void)
Function to return the multi pattern matcher algorithm to be used by the engine, based on the mpm-alg...
Definition: detect-engine-mpm.c:842
MpmStorePrepareBuffer
MpmStore * MpmStorePrepareBuffer(DetectEngineCtx *de_ctx, SigGroupHead *sgh, enum MpmBuiltinBuffers buf)
Get MpmStore for a built-in buffer type.
Definition: detect-engine-mpm.c:1556
Signature_
Signature container.
Definition: detect.h:542
PrefilterMpmListId::list_id
int list_id
Definition: detect-engine-mpm.h:133
MpmStoreInit
int MpmStoreInit(DetectEngineCtx *)
Initializes the MpmStore mpm hash table to be used by the detection engine context.
Definition: detect-engine-mpm.c:1282
DetectMpmPrepareBuiltinMpms
int DetectMpmPrepareBuiltinMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for builtin buffers that are in "single or "shared" mode.
Definition: detect-engine-mpm.c:715
DetectPktMpmRegister
void DetectPktMpmRegister(const char *name, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id), InspectionBufferGetPktDataPtr GetData)
register a MPM engine
Definition: detect-engine-mpm.c:516
DetectMpmPreparePktMpms
int DetectMpmPreparePktMpms(DetectEngineCtx *de_ctx)
initialize mpm contexts for applayer buffers that are in "single or "shared" mode.
Definition: detect-engine-mpm.c:656
DetectPktMpmRegisterByParentId
void DetectPktMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Definition: detect-engine-mpm.c:567
PrefilterGenericMpmPktRegister
int PrefilterGenericMpmPktRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id)
Definition: detect-engine-prefilter.c:820
DetectAppLayerMpmRegister2
void DetectAppLayerMpmRegister2(const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id), InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
register an app layer keyword for mpm
Definition: detect-engine-mpm.c:89
MpmStoreReportStats
void MpmStoreReportStats(const DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:1348
MpmStoreFree
void MpmStoreFree(DetectEngineCtx *)
Frees the hash table - DetectEngineCtx->mpm_hash_table, allocated by MpmStoreInit() function.
Definition: detect-engine-mpm.c:1446
MpmCtx_
Definition: util-mpm.h:88
DnsQueryPatternSearch
uint32_t DnsQueryPatternSearch(DetectEngineThreadCtx *det_ctx, uint8_t *buffer, uint32_t buffer_len, uint8_t flags)
PrefilterGenericMpmFrameRegister
int PrefilterGenericMpmFrameRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id)
Definition: detect-engine-frame.c:207
DetectAppLayerMpmRegisterByParentId
void DetectAppLayerMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Definition: detect-engine-mpm.c:147
PatternMatchThreadDestroy
void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t)
Definition: detect-engine-mpm.c:896
PatternMatchPrepare
void PatternMatchPrepare(MpmCtx *, uint16_t)