suricata
detect-engine-prefilter.c File Reference
#include "suricata-common.h"
#include "suricata.h"
#include "detect-engine-prefilter.h"
#include "detect-engine-mpm.h"
#include "app-layer-parser.h"
#include "app-layer-htp.h"
#include "util-profiling.h"
#include "util-print.h"
Include dependency graph for detect-engine-prefilter.c:

Go to the source code of this file.

Data Structures

struct  PrefilterMpmCtx
 
struct  PrefilterMpmPktCtx
 

Typedefs

typedef struct PrefilterMpmCtx PrefilterMpmCtx
 
typedef struct PrefilterMpmPktCtx PrefilterMpmPktCtx
 

Functions

void DetectRunPrefilterTx (DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const uint8_t ipproto, const uint8_t flow_flags, const AppProto alproto, void *alstate, DetectTransaction *tx)
 run prefilter engines on a transaction More...
 
void Prefilter (DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const uint8_t flags)
 
int PrefilterAppendEngine (DetectEngineCtx *de_ctx, SigGroupHead *sgh, void(*PrefilterFunc)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx), void *pectx, void(*FreeFunc)(void *pectx), const char *name)
 
int PrefilterAppendPayloadEngine (DetectEngineCtx *de_ctx, SigGroupHead *sgh, void(*PrefilterFunc)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx), void *pectx, void(*FreeFunc)(void *pectx), const char *name)
 
int PrefilterAppendTxEngine (DetectEngineCtx *de_ctx, SigGroupHead *sgh, void(*PrefilterTxFunc)(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *tx, const uint64_t idx, const uint8_t flags), AppProto alproto, int tx_min_progress, void *pectx, void(*FreeFunc)(void *pectx), const char *name)
 
void PrefilterFreeEnginesList (PrefilterEngineList *list)
 
void PrefilterCleanupRuleGroup (const DetectEngineCtx *de_ctx, SigGroupHead *sgh)
 
void PrefilterSetupRuleGroup (DetectEngineCtx *de_ctx, SigGroupHead *sgh)
 
void PrefilterDeinit (DetectEngineCtx *de_ctx)
 
void PrefilterInit (DetectEngineCtx *de_ctx)
 
const char * PrefilterStoreGetName (const uint32_t id)
 
int PrefilterGenericMpmRegister (DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id)
 
int PrefilterGenericMpmPktRegister (DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id)
 

Detailed Description

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Prefilter engine

Prefilter engines have as purpose to check for a critical common part of a set of rules. If the condition is present in the traffic, the rules will have to be inspected individually. Otherwise, the rules can be skipped.

The best example of this is the MPM. From each rule take a pattern and add it to the MPM state machine. Inspect that in one step and only individually inspect the rules that had a match in MPM.

This prefilter API is designed to abstract this logic so that it becomes easier to add other types of prefilters.

The prefilter engines are structured as a simple list of engines. Each engine checks for a condition using it's callback function and private data. It then adds the rule match candidates to the PrefilterRuleStore structure.

After the engines have run the resulting list of match candidates is sorted by the rule id's so that the individual inspection happens in the correct order.

Definition in file detect-engine-prefilter.c.

Typedef Documentation

Function Documentation

int PrefilterAppendEngine ( DetectEngineCtx de_ctx,
SigGroupHead sgh,
void(*)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)  PrefilterFunc,
void *  pectx,
void(*)(void *pectx)  FreeFunc,
const char *  name 
)
int PrefilterAppendPayloadEngine ( DetectEngineCtx de_ctx,
SigGroupHead sgh,
void(*)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)  PrefilterFunc,
void *  pectx,
void(*)(void *pectx)  FreeFunc,
const char *  name 
)
int PrefilterAppendTxEngine ( DetectEngineCtx de_ctx,
SigGroupHead sgh,
void(*)(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *tx, const uint64_t idx, const uint8_t flags PrefilterTxFunc,
AppProto  alproto,
int  tx_min_progress,
void *  pectx,
void(*)(void *pectx)  FreeFunc,
const char *  name 
)
void PrefilterCleanupRuleGroup ( const DetectEngineCtx de_ctx,
SigGroupHead sgh 
)

Definition at line 332 of file detect-engine-prefilter.c.

References SigGroupHead_::payload_engines, SigGroupHead_::pkt_engines, and SigGroupHead_::tx_engines.

Referenced by SigGroupHeadFree().

Here is the caller graph for this function:

void PrefilterDeinit ( DetectEngineCtx de_ctx)

Definition at line 483 of file detect-engine-prefilter.c.

References HashListTableFree(), and DetectEngineCtx_::prefilter_hash_table.

Referenced by InspectionBufferApplyTransforms().

Here is the call graph for this function:

Here is the caller graph for this function:

void PrefilterFreeEnginesList ( PrefilterEngineList list)
int PrefilterGenericMpmRegister ( DetectEngineCtx de_ctx,
SigGroupHead sgh,
MpmCtx mpm_ctx,
const DetectBufferMpmRegistery mpm_reg,
int  list_id 
)
const char* PrefilterStoreGetName ( const uint32_t  id)

Definition at line 555 of file detect-engine-prefilter.c.