suricata
detect-engine-prefilter.c File Reference
#include "suricata-common.h"
#include "suricata.h"
#include "detect-engine.h"
#include "detect-engine-prefilter.h"
#include "detect-engine-mpm.h"
#include "detect-engine-frame.h"
#include "detect-engine-uint.h"
#include "app-layer-parser.h"
#include "app-layer-htp.h"
#include "util-profiling.h"
#include "util-validate.h"
#include "util-hash-string.h"
#include "util-print.h"
Include dependency graph for detect-engine-prefilter.c:

Go to the source code of this file.

Data Structures

struct  PrefilterNonPFDataSig
 
struct  PrefilterNonPFData
 
struct  PrefilterNonPFDataTx
 
struct  TxNonPFData
 
struct  PrefilterMpmCtx
 
struct  PrefilterMpmPktCtx
 

Macros

#define NONPF_PKT_STATS_INCR(s)
 
#define QUEUE_STEP   16
 

Typedefs

typedef struct PrefilterMpmCtx PrefilterMpmCtx
 
typedef struct PrefilterMpmPktCtx PrefilterMpmPktCtx
 

Functions

void DetectRunPrefilterTx (DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const uint8_t ipproto, const uint8_t flow_flags, const AppProto alproto, void *alstate, DetectTransaction *tx)
 run prefilter engines on a transaction More...
 
void PrefilterPostRuleMatch (DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, Flow *f)
 invoke post-rule match "prefilter" engines More...
 
void Prefilter (DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const uint8_t flags, const SignatureMask mask)
 
int PrefilterAppendEngine (DetectEngineCtx *de_ctx, SigGroupHead *sgh, PrefilterPktFn PrefilterFunc, SignatureMask mask, enum SignatureHookPkt hook, void *pectx, void(*FreeFunc)(void *pectx), const char *name)
 
int PrefilterAppendPayloadEngine (DetectEngineCtx *de_ctx, SigGroupHead *sgh, PrefilterPktFn PrefilterFunc, void *pectx, void(*FreeFunc)(void *pectx), const char *name)
 
int PrefilterAppendTxEngine (DetectEngineCtx *de_ctx, SigGroupHead *sgh, PrefilterTxFn PrefilterTxFunc, AppProto alproto, int tx_min_progress, void *pectx, void(*FreeFunc)(void *pectx), const char *name)
 
int PrefilterAppendFrameEngine (DetectEngineCtx *de_ctx, SigGroupHead *sgh, PrefilterFrameFn PrefilterFrameFunc, AppProto alproto, uint8_t frame_type, void *pectx, void(*FreeFunc)(void *pectx), const char *name)
 
int PrefilterAppendPostRuleEngine (DetectEngineCtx *de_ctx, SigGroupHead *sgh, void(*PrefilterPostRuleFunc)(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f), void *pectx, void(*FreeFunc)(void *pectx), const char *name)
 
void PrefilterFreeEnginesList (PrefilterEngineList *list)
 
void PrefilterCleanupRuleGroup (const DetectEngineCtx *de_ctx, SigGroupHead *sgh)
 
void PrefilterPktNonPFStatsDump (void)
 
int PrefilterSetupRuleGroup (DetectEngineCtx *de_ctx, SigGroupHead *sgh)
 
void PrefilterDeinit (DetectEngineCtx *de_ctx)
 
void PrefilterInit (DetectEngineCtx *de_ctx)
 
const char * PrefilterStoreGetName (const uint32_t id)
 
int PrefilterGenericMpmRegister (DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
 
int PrefilterMultiGenericMpmRegister (DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
 
int PrefilterGenericMpmPktRegister (DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
 
void PostRuleMatchWorkQueueAppend (DetectEngineThreadCtx *det_ctx, const Signature *s, const int type, const uint32_t value)
 

Detailed Description

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Prefilter engine

Prefilter engines have as purpose to check for a critical common part of a set of rules. If the condition is present in the traffic, the rules will have to be inspected individually. Otherwise, the rules can be skipped.

The best example of this is the MPM. From each rule take a pattern and add it to the MPM state machine. Inspect that in one step and only individually inspect the rules that had a match in MPM.

This prefilter API is designed to abstract this logic so that it becomes easier to add other types of prefilters.

The prefilter engines are structured as a simple list of engines. Each engine checks for a condition using it's callback function and private data. It then adds the rule match candidates to the PrefilterRuleStore structure.

After the engines have run the resulting list of match candidates is sorted by the rule id's so that the individual inspection happens in the correct order.

Definition in file detect-engine-prefilter.c.

Macro Definition Documentation

◆ NONPF_PKT_STATS_INCR

#define NONPF_PKT_STATS_INCR (   s)

Definition at line 588 of file detect-engine-prefilter.c.

◆ QUEUE_STEP

#define QUEUE_STEP   16

Definition at line 1692 of file detect-engine-prefilter.c.

Typedef Documentation

◆ PrefilterMpmCtx

◆ PrefilterMpmPktCtx

Function Documentation

◆ DetectRunPrefilterTx()

◆ PostRuleMatchWorkQueueAppend()

◆ Prefilter()

◆ PrefilterAppendEngine()

◆ PrefilterAppendFrameEngine()

int PrefilterAppendFrameEngine ( DetectEngineCtx de_ctx,
SigGroupHead sgh,
PrefilterFrameFn  PrefilterFrameFunc,
AppProto  alproto,
uint8_t  frame_type,
void *  pectx,
void(*)(void *pectx)  FreeFunc,
const char *  name 
)

◆ PrefilterAppendPayloadEngine()

int PrefilterAppendPayloadEngine ( DetectEngineCtx de_ctx,
SigGroupHead sgh,
PrefilterPktFn  PrefilterFunc,
void *  pectx,
void(*)(void *pectx)  FreeFunc,
const char *  name 
)

◆ PrefilterAppendPostRuleEngine()

int PrefilterAppendPostRuleEngine ( DetectEngineCtx de_ctx,
SigGroupHead sgh,
void(*)(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f)  PrefilterPostRuleFunc,
void *  pectx,
void(*)(void *pectx)  FreeFunc,
const char *  name 
)

◆ PrefilterAppendTxEngine()

◆ PrefilterCleanupRuleGroup()

void PrefilterCleanupRuleGroup ( const DetectEngineCtx de_ctx,
SigGroupHead sgh 
)

Definition at line 493 of file detect-engine-prefilter.c.

References SigGroupHead_::pkt_engines.

Referenced by SigGroupHeadFree().

Here is the caller graph for this function:

◆ PrefilterDeinit()

void PrefilterDeinit ( DetectEngineCtx de_ctx)

Definition at line 1420 of file detect-engine-prefilter.c.

References de_ctx, HashListTableFree(), and DetectEngineCtx_::prefilter_hash_table.

Here is the call graph for this function:

◆ PrefilterFreeEnginesList()

void PrefilterFreeEnginesList ( PrefilterEngineList list)

Definition at line 465 of file detect-engine-prefilter.c.

Referenced by SigGroupHeadInitDataFree().

Here is the caller graph for this function:

◆ PrefilterGenericMpmPktRegister()

◆ PrefilterGenericMpmRegister()

int PrefilterGenericMpmRegister ( DetectEngineCtx de_ctx,
SigGroupHead sgh,
MpmCtx mpm_ctx,
const DetectBufferMpmRegistry mpm_reg,
int  list_id 
)

◆ PrefilterInit()

void PrefilterInit ( DetectEngineCtx de_ctx)

Definition at line 1427 of file detect-engine-prefilter.c.

References BUG_ON, de_ctx, HashListTableInit(), and DetectEngineCtx_::prefilter_hash_table.

Here is the call graph for this function:

◆ PrefilterMultiGenericMpmRegister()

int PrefilterMultiGenericMpmRegister ( DetectEngineCtx de_ctx,
SigGroupHead sgh,
MpmCtx mpm_ctx,
const DetectBufferMpmRegistry mpm_reg,
int  list_id 
)

◆ PrefilterPktNonPFStatsDump()

void PrefilterPktNonPFStatsDump ( void  )

Definition at line 590 of file detect-engine-prefilter.c.

References SCLogDebug.

◆ PrefilterPostRuleMatch()

void PrefilterPostRuleMatch ( DetectEngineThreadCtx det_ctx,
const SigGroupHead sgh,
Packet p,
Flow f 
)

invoke post-rule match "prefilter" engines

Invoke prefilter engines that depend on a rule match to run. e.g. the flowbits:set prefilter that adds sids that depend on a flowbit "set" to the match array.

Definition at line 193 of file detect-engine-prefilter.c.

References PrefilterEngine_::cb, PrefilterEngine_::gid, PrefilterEngine_::is_last, PrefilterEngine_::pectx, DetectEngineThreadCtx_::pmq, SigGroupHead_::post_rule_match_engines, PREFILTER_PROFILING_END, PREFILTER_PROFILING_START, PrefilterEngine_::PrefilterPostRule, PrefilterRuleStore_::rule_id_array_cnt, and SCLogDebug.

◆ PrefilterSetupRuleGroup()

int PrefilterSetupRuleGroup ( DetectEngineCtx de_ctx,
SigGroupHead sgh 
)

Definition at line 1176 of file detect-engine-prefilter.c.

References de_ctx, DETECT_PREFILTER_AUTO, DETECT_TBLSIZE, FatalError, PatternMatchPrepareGroup(), DetectEngineCtx_::prefilter_setting, SigTableElmt_::SetupPrefilter, sigmatch_table, and DetectEngineCtx_::sm_types_prefilter.

Referenced by SigPrepareStage4().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ PrefilterStoreGetName()

const char* PrefilterStoreGetName ( const uint32_t  id)

Definition at line 1492 of file detect-engine-prefilter.c.