suricata
detect-engine-prefilter.c
Go to the documentation of this file.
1 /* Copyright (C) 2016 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Prefilter engine
24  *
25  * Prefilter engines have as purpose to check for a critical common part of
26  * a set of rules. If the condition is present in the traffic, the rules
27  * will have to be inspected individually. Otherwise, the rules can be
28  * skipped.
29  *
30  * The best example of this is the MPM. From each rule take a pattern and
31  * add it to the MPM state machine. Inspect that in one step and only
32  * individually inspect the rules that had a match in MPM.
33  *
34  * This prefilter API is designed to abstract this logic so that it becomes
35  * easier to add other types of prefilters.
36  *
37  * The prefilter engines are structured as a simple list of engines. Each
38  * engine checks for a condition using it's callback function and private
39  * data. It then adds the rule match candidates to the PrefilterRuleStore
40  * structure.
41  *
42  * After the engines have run the resulting list of match candidates is
43  * sorted by the rule id's so that the individual inspection happens in
44  * the correct order.
45  */
46 
47 #include "suricata-common.h"
48 #include "suricata.h"
49 
51 #include "detect-engine-mpm.h"
52 
53 #include "app-layer-parser.h"
54 #include "app-layer-htp.h"
55 
56 #include "util-profiling.h"
57 
58 static int PrefilterStoreGetId(DetectEngineCtx *de_ctx,
59  const char *name, void (*FreeFunc)(void *));
60 static const PrefilterStore *PrefilterStoreGetStore(const DetectEngineCtx *de_ctx,
61  const uint32_t id);
62 
63 static inline void QuickSortSigIntId(SigIntId *sids, uint32_t n)
64 {
65  if (n < 2)
66  return;
67  SigIntId p = sids[n / 2];
68  SigIntId *l = sids;
69  SigIntId *r = sids + n - 1;
70  while (l <= r) {
71  if (*l < p)
72  l++;
73  else if (*r > p)
74  r--;
75  else {
76  SigIntId t = *l;
77  *l = *r;
78  *r = t;
79  l++;
80  r--;
81  }
82  }
83  QuickSortSigIntId(sids, r - sids + 1);
84  QuickSortSigIntId(l, sids + n - l);
85 }
86 
87 /**
88  * \brief run prefilter engines on a transaction
89  */
91  const SigGroupHead *sgh,
92  Packet *p,
93  const uint8_t ipproto,
94  const uint8_t flow_flags,
95  const AppProto alproto,
96  void *alstate,
98 {
99  /* reset rule store */
100  det_ctx->pmq.rule_id_array_cnt = 0;
101 
102  SCLogDebug("tx %p progress %d", tx->tx_ptr, tx->tx_progress);
103 
104  PrefilterEngine *engine = sgh->tx_engines;
105  do {
106  if (engine->alproto != alproto)
107  goto next;
108  if (engine->tx_min_progress > tx->tx_progress)
109  goto next;
110  if (tx->tx_progress > engine->tx_min_progress) {
111  if (tx->prefilter_flags & (1<<(engine->local_id))) {
112  goto next;
113  }
114  }
115 
117  engine->cb.PrefilterTx(det_ctx, engine->pectx,
118  p, p->flow, tx->tx_ptr, tx->tx_id, flow_flags);
119  PREFILTER_PROFILING_END(det_ctx, engine->gid);
120 
121  if (tx->tx_progress > engine->tx_min_progress) {
122  tx->prefilter_flags |= (1<<(engine->local_id));
123  }
124  next:
125  if (engine->is_last)
126  break;
127  engine++;
128  } while (1);
129 
130  /* Sort the rule list to lets look at pmq.
131  * NOTE due to merging of 'stream' pmqs we *MAY* have duplicate entries */
132  if (likely(det_ctx->pmq.rule_id_array_cnt > 1)) {
134  QuickSortSigIntId(det_ctx->pmq.rule_id_array, det_ctx->pmq.rule_id_array_cnt);
136  }
137 }
138 
139 void Prefilter(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh,
140  Packet *p, const uint8_t flags)
141 {
142  SCEnter();
143 
144  if (sgh->pkt_engines) {
146  /* run packet engines */
147  PrefilterEngine *engine = sgh->pkt_engines;
148  do {
150  engine->cb.Prefilter(det_ctx, p, engine->pectx);
151  PREFILTER_PROFILING_END(det_ctx, engine->gid);
152 
153  if (engine->is_last)
154  break;
155  engine++;
156  } while (1);
158  }
159 
160  /* run payload inspecting engines */
161  if (sgh->payload_engines &&
164  {
166  PrefilterEngine *engine = sgh->payload_engines;
167  while (1) {
169  engine->cb.Prefilter(det_ctx, p, engine->pectx);
170  PREFILTER_PROFILING_END(det_ctx, engine->gid);
171 
172  if (engine->is_last)
173  break;
174  engine++;
175  }
177  }
178 
179  /* Sort the rule list to lets look at pmq.
180  * NOTE due to merging of 'stream' pmqs we *MAY* have duplicate entries */
181  if (likely(det_ctx->pmq.rule_id_array_cnt > 1)) {
183  QuickSortSigIntId(det_ctx->pmq.rule_id_array, det_ctx->pmq.rule_id_array_cnt);
185  }
186  SCReturn;
187 }
188 
190  void (*PrefilterFunc)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx),
191  void *pectx, void (*FreeFunc)(void *pectx),
192  const char *name)
193 {
194  if (sgh == NULL || PrefilterFunc == NULL || pectx == NULL)
195  return -1;
196 
197  PrefilterEngineList *e = SCMallocAligned(sizeof(*e), CLS);
198  if (e == NULL)
199  return -1;
200  memset(e, 0x00, sizeof(*e));
201 
202  e->Prefilter = PrefilterFunc;
203  e->pectx = pectx;
204  e->Free = FreeFunc;
205 
206  if (sgh->init->pkt_engines == NULL) {
207  sgh->init->pkt_engines = e;
208  } else {
210  while (t->next != NULL) {
211  t = t->next;
212  }
213 
214  t->next = e;
215  e->id = t->id + 1;
216  }
217 
218  e->name = name;
219  e->gid = PrefilterStoreGetId(de_ctx, e->name, e->Free);
220  return 0;
221 }
222 
224  void (*PrefilterFunc)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx),
225  void *pectx, void (*FreeFunc)(void *pectx),
226  const char *name)
227 {
228  if (sgh == NULL || PrefilterFunc == NULL || pectx == NULL)
229  return -1;
230 
231  PrefilterEngineList *e = SCMallocAligned(sizeof(*e), CLS);
232  if (e == NULL)
233  return -1;
234  memset(e, 0x00, sizeof(*e));
235 
236  e->Prefilter = PrefilterFunc;
237  e->pectx = pectx;
238  e->Free = FreeFunc;
239 
240  if (sgh->init->payload_engines == NULL) {
241  sgh->init->payload_engines = e;
242  } else {
244  while (t->next != NULL) {
245  t = t->next;
246  }
247 
248  t->next = e;
249  e->id = t->id + 1;
250  }
251 
252  e->name = name;
253  e->gid = PrefilterStoreGetId(de_ctx, e->name, e->Free);
254  return 0;
255 }
256 
258  void (*PrefilterTxFunc)(DetectEngineThreadCtx *det_ctx, const void *pectx,
259  Packet *p, Flow *f, void *tx,
260  const uint64_t idx, const uint8_t flags),
261  AppProto alproto, int tx_min_progress,
262  void *pectx, void (*FreeFunc)(void *pectx),
263  const char *name)
264 {
265  if (sgh == NULL || PrefilterTxFunc == NULL || pectx == NULL)
266  return -1;
267 
268  PrefilterEngineList *e = SCMallocAligned(sizeof(*e), CLS);
269  if (e == NULL)
270  return -1;
271  memset(e, 0x00, sizeof(*e));
272 
273  e->PrefilterTx = PrefilterTxFunc;
274  e->pectx = pectx;
275  e->alproto = alproto;
276  e->tx_min_progress = tx_min_progress;
277  e->Free = FreeFunc;
278 
279  if (sgh->init->tx_engines == NULL) {
280  sgh->init->tx_engines = e;
281  } else {
283  while (t->next != NULL) {
284  t = t->next;
285  }
286 
287  t->next = e;
288  e->id = t->id + 1;
289  }
290 
291  e->name = name;
292  e->gid = PrefilterStoreGetId(de_ctx, e->name, e->Free);
293  return 0;
294 }
295 
296 static void PrefilterFreeEngineList(PrefilterEngineList *e)
297 {
298  if (e->Free && e->pectx) {
299  e->Free(e->pectx);
300  }
301  SCFreeAligned(e);
302 }
303 
305 {
306  PrefilterEngineList *t = list;
307 
308  while (t != NULL) {
310  PrefilterFreeEngineList(t);
311  t = next;
312  }
313 }
314 
315 static void PrefilterFreeEngines(const DetectEngineCtx *de_ctx, PrefilterEngine *list)
316 {
317  PrefilterEngine *t = list;
318 
319  while (1) {
320  const PrefilterStore *s = PrefilterStoreGetStore(de_ctx, t->gid);
321  if (s && s->FreeFunc && t->pectx) {
322  s->FreeFunc(t->pectx);
323  }
324 
325  if (t->is_last)
326  break;
327  t++;
328  }
329  SCFreeAligned(list);
330 }
331 
333 {
334  if (sgh->pkt_engines) {
335  PrefilterFreeEngines(de_ctx, sgh->pkt_engines);
336  sgh->pkt_engines = NULL;
337  }
338  if (sgh->payload_engines) {
339  PrefilterFreeEngines(de_ctx, sgh->payload_engines);
340  sgh->payload_engines = NULL;
341  }
342  if (sgh->tx_engines) {
343  PrefilterFreeEngines(de_ctx, sgh->tx_engines);
344  sgh->tx_engines = NULL;
345  }
346 }
347 
349 {
350  int r = PatternMatchPrepareGroup(de_ctx, sgh);
351  if (r != 0) {
352  FatalError(SC_ERR_INITIALIZATION, "failed to set up pattern matching");
353  }
354 
355  /* set up engines if needed - when prefilter is set to auto we run
356  * all engines, otherwise only those that have been forced by the
357  * prefilter keyword. */
358  const enum DetectEnginePrefilterSetting setting = de_ctx->prefilter_setting;
359  for (int i = 0; i < DETECT_TBLSIZE; i++)
360  {
361  if (sigmatch_table[i].SetupPrefilter != NULL &&
362  (setting == DETECT_PREFILTER_AUTO ||
363  de_ctx->sm_types_prefilter[i]))
364  {
365  sigmatch_table[i].SetupPrefilter(de_ctx, sgh);
366  }
367  }
368 
369  /* we have lists of engines in sgh->init now. Lets setup the
370  * match arrays */
372  if (sgh->init->pkt_engines != NULL) {
373  uint32_t cnt = 0;
374  for (el = sgh->init->pkt_engines ; el != NULL; el = el->next) {
375  cnt++;
376  de_ctx->prefilter_maxid = MAX(de_ctx->prefilter_maxid, el->gid);
377  }
378  sgh->pkt_engines = SCMallocAligned(cnt * sizeof(PrefilterEngine), CLS);
379  if (sgh->pkt_engines == NULL) {
380  return;
381  }
382  memset(sgh->pkt_engines, 0x00, (cnt * sizeof(PrefilterEngine)));
383 
384  PrefilterEngine *e = sgh->pkt_engines;
385  for (el = sgh->init->pkt_engines ; el != NULL; el = el->next) {
386  e->local_id = el->id;
387  e->cb.Prefilter = el->Prefilter;
388  e->pectx = el->pectx;
389  el->pectx = NULL; // e now owns the ctx
390  e->gid = el->gid;
391  if (el->next == NULL) {
392  e->is_last = TRUE;
393  }
394  e++;
395  }
396  }
397  if (sgh->init->payload_engines != NULL) {
398  uint32_t cnt = 0;
399  for (el = sgh->init->payload_engines ; el != NULL; el = el->next) {
400  cnt++;
401  de_ctx->prefilter_maxid = MAX(de_ctx->prefilter_maxid, el->gid);
402  }
403  sgh->payload_engines = SCMallocAligned(cnt * sizeof(PrefilterEngine), CLS);
404  if (sgh->payload_engines == NULL) {
405  return;
406  }
407  memset(sgh->payload_engines, 0x00, (cnt * sizeof(PrefilterEngine)));
408 
410  for (el = sgh->init->payload_engines ; el != NULL; el = el->next) {
411  e->local_id = el->id;
412  e->cb.Prefilter = el->Prefilter;
413  e->pectx = el->pectx;
414  el->pectx = NULL; // e now owns the ctx
415  e->gid = el->gid;
416  if (el->next == NULL) {
417  e->is_last = TRUE;
418  }
419  e++;
420  }
421  }
422  if (sgh->init->tx_engines != NULL) {
423  uint32_t cnt = 0;
424  for (el = sgh->init->tx_engines ; el != NULL; el = el->next) {
425  cnt++;
426  de_ctx->prefilter_maxid = MAX(de_ctx->prefilter_maxid, el->gid);
427  }
428  sgh->tx_engines = SCMallocAligned(cnt * sizeof(PrefilterEngine), CLS);
429  if (sgh->tx_engines == NULL) {
430  return;
431  }
432  memset(sgh->tx_engines, 0x00, (cnt * sizeof(PrefilterEngine)));
433 
434  uint32_t local_id = 0;
435  PrefilterEngine *e = sgh->tx_engines;
436  for (el = sgh->init->tx_engines ; el != NULL; el = el->next) {
437  e->local_id = local_id++;
438  e->alproto = el->alproto;
440  e->cb.PrefilterTx = el->PrefilterTx;
441  e->pectx = el->pectx;
442  el->pectx = NULL; // e now owns the ctx
443  e->gid = el->gid;
444  if (el->next == NULL) {
445  e->is_last = TRUE;
446  }
447  e++;
448  }
449  SCLogDebug("sgh %p max local_id %u", sgh, local_id);
450  }
451 }
452 
453 /* hash table for assigning a unique id to each engine type. */
454 
455 static uint32_t PrefilterStoreHashFunc(HashListTable *ht, void *data, uint16_t datalen)
456 {
457  PrefilterStore *ctx = data;
458 
459  uint32_t hash = strlen(ctx->name);
460  uint16_t u;
461 
462  for (u = 0; u < strlen(ctx->name); u++) {
463  hash += ctx->name[u];
464  }
465 
466  hash %= ht->array_size;
467  return hash;
468 }
469 
470 static char PrefilterStoreCompareFunc(void *data1, uint16_t len1,
471  void *data2, uint16_t len2)
472 {
473  PrefilterStore *ctx1 = data1;
474  PrefilterStore *ctx2 = data2;
475  return (strcmp(ctx1->name, ctx2->name) == 0);
476 }
477 
478 static void PrefilterStoreFreeFunc(void *ptr)
479 {
480  SCFree(ptr);
481 }
482 
484 {
485  if (de_ctx->prefilter_hash_table != NULL) {
487  }
488 }
489 
491 {
492  BUG_ON(de_ctx->prefilter_hash_table != NULL);
493 
495  PrefilterStoreHashFunc,
496  PrefilterStoreCompareFunc,
497  PrefilterStoreFreeFunc);
498  BUG_ON(de_ctx->prefilter_hash_table == NULL);
499 }
500 
501 static int PrefilterStoreGetId(DetectEngineCtx *de_ctx,
502  const char *name, void (*FreeFunc)(void *))
503 {
504  PrefilterStore ctx = { name, FreeFunc, 0 };
505 
506  BUG_ON(de_ctx->prefilter_hash_table == NULL);
507 
508  SCLogDebug("looking up %s", name);
509 
510  PrefilterStore *rctx = HashListTableLookup(de_ctx->prefilter_hash_table, (void *)&ctx, 0);
511  if (rctx != NULL) {
512  return rctx->id;
513  }
514 
515  PrefilterStore *actx = SCCalloc(1, sizeof(*actx));
516  if (actx == NULL) {
517  return -1;
518  }
519 
520  actx->name = name;
521  actx->FreeFunc = FreeFunc;
522  actx->id = de_ctx->prefilter_id++;
523  SCLogDebug("prefilter engine %s has profile id %u", actx->name, actx->id);
524 
525  int ret = HashListTableAdd(de_ctx->prefilter_hash_table, actx, 0);
526  if (ret != 0) {
527  SCFree(actx);
528  return -1;
529  }
530 
531  int r = actx->id;
532  return r;
533 }
534 
535 /** \warning slow */
536 static const PrefilterStore *PrefilterStoreGetStore(const DetectEngineCtx *de_ctx,
537  const uint32_t id)
538 {
539 
540  const PrefilterStore *store = NULL;
541  if (de_ctx->prefilter_hash_table != NULL) {
543  for ( ; hb != NULL; hb = HashListTableGetListNext(hb)) {
545  if (ctx->id == id) {
546  store = ctx;
547  break;
548  }
549  }
550  }
551  return store;
552 }
553 
554 #ifdef PROFILING
555 const char *PrefilterStoreGetName(const uint32_t id)
556 {
557  return NULL;
558 }
559 #endif
560 
561 #include "util-print.h"
562 
563 typedef struct PrefilterMpmCtx {
564  int list_id;
566  const MpmCtx *mpm_ctx;
569 
570 /** \brief Generic Mpm prefilter callback
571  *
572  * \param det_ctx detection engine thread ctx
573  * \param p packet to inspect
574  * \param f flow to inspect
575  * \param txv tx to inspect
576  * \param pectx inspection context
577  */
578 static void PrefilterMpm(DetectEngineThreadCtx *det_ctx,
579  const void *pectx,
580  Packet *p, Flow *f, void *txv,
581  const uint64_t idx, const uint8_t flags)
582 {
583  SCEnter();
584 
585  const PrefilterMpmCtx *ctx = (const PrefilterMpmCtx *)pectx;
586  const MpmCtx *mpm_ctx = ctx->mpm_ctx;
587  SCLogDebug("running on list %d", ctx->list_id);
588 
589  InspectionBuffer *buffer = ctx->GetData(det_ctx, ctx->transforms,
590  f, flags, txv, ctx->list_id);
591  if (buffer == NULL)
592  return;
593 
594  const uint32_t data_len = buffer->inspect_len;
595  const uint8_t *data = buffer->inspect;
596 
597  SCLogDebug("mpm'ing buffer:");
598  //PrintRawDataFp(stdout, data, data_len);
599 
600  if (data != NULL && data_len >= mpm_ctx->minlen) {
601  (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
602  &det_ctx->mtcu, &det_ctx->pmq, data, data_len);
603  }
604 }
605 
606 static void PrefilterGenericMpmFree(void *ptr)
607 {
608  SCFree(ptr);
609 }
610 
612  SigGroupHead *sgh, MpmCtx *mpm_ctx,
613  const DetectBufferMpmRegistery *mpm_reg, int list_id)
614 {
615  SCEnter();
616  PrefilterMpmCtx *pectx = SCCalloc(1, sizeof(*pectx));
617  if (pectx == NULL)
618  return -1;
619  pectx->list_id = list_id;
620  pectx->GetData = mpm_reg->app_v2.GetData;
621  pectx->mpm_ctx = mpm_ctx;
622  pectx->transforms = &mpm_reg->transforms;
623 
624  int r = PrefilterAppendTxEngine(de_ctx, sgh, PrefilterMpm,
625  mpm_reg->app_v2.alproto, mpm_reg->app_v2.tx_min_progress,
626  pectx, PrefilterGenericMpmFree, mpm_reg->pname);
627  if (r != 0) {
628  SCFree(pectx);
629  }
630  return r;
631 }
632 
633 /* generic mpm for pkt engines */
634 
635 typedef struct PrefilterMpmPktCtx {
636  int list_id;
638  const MpmCtx *mpm_ctx;
641 
642 /** \brief Generic Mpm prefilter callback
643  *
644  * \param det_ctx detection engine thread ctx
645  * \param p packet to inspect
646  * \param f flow to inspect
647  * \param txv tx to inspect
648  * \param pectx inspection context
649  */
650 static void PrefilterMpmPkt(DetectEngineThreadCtx *det_ctx,
651  Packet *p, const void *pectx)
652 {
653  SCEnter();
654 
655  const PrefilterMpmPktCtx *ctx = (const PrefilterMpmPktCtx *)pectx;
656  const MpmCtx *mpm_ctx = ctx->mpm_ctx;
657  SCLogDebug("running on list %d", ctx->list_id);
658 
659  InspectionBuffer *buffer = ctx->GetData(det_ctx, ctx->transforms,
660  p, ctx->list_id);
661  if (buffer == NULL)
662  return;
663 
664  const uint32_t data_len = buffer->inspect_len;
665  const uint8_t *data = buffer->inspect;
666 
667  SCLogDebug("mpm'ing buffer:");
668  //PrintRawDataFp(stdout, data, data_len);
669 
670  if (data != NULL && data_len >= mpm_ctx->minlen) {
671  (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
672  &det_ctx->mtcu, &det_ctx->pmq, data, data_len);
673  }
674 }
675 
676 static void PrefilterMpmPktFree(void *ptr)
677 {
678  SCFree(ptr);
679 }
680 
682  SigGroupHead *sgh, MpmCtx *mpm_ctx,
683  const DetectBufferMpmRegistery *mpm_reg, int list_id)
684 {
685  SCEnter();
686  PrefilterMpmPktCtx *pectx = SCCalloc(1, sizeof(*pectx));
687  if (pectx == NULL)
688  return -1;
689  pectx->list_id = list_id;
690  pectx->GetData = mpm_reg->pkt_v1.GetData;
691  pectx->mpm_ctx = mpm_ctx;
692  pectx->transforms = &mpm_reg->transforms;
693 
694  int r = PrefilterAppendEngine(de_ctx, sgh, PrefilterMpmPkt,
695  pectx, PrefilterMpmPktFree, mpm_reg->pname);
696  if (r != 0) {
697  SCFree(pectx);
698  }
699  return r;
700 }
void(* FreeFunc)(void *)
struct PrefilterMpmPktCtx PrefilterMpmPktCtx
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect.h:1439
uint16_t flags
#define SCLogDebug(...)
Definition: util-debug.h:335
#define MAX(x, y)
HashListTableBucket * HashListTableGetListHead(HashListTable *ht)
DetectEnginePrefilterSetting
Definition: detect.h:735
union PrefilterEngine_::@106 cb
struct Flow_ * flow
Definition: decode.h:445
uint16_t minlen
Definition: util-mpm.h:99
struct HtpBodyChunk_ * next
InspectionBuffer *(* InspectionBufferGetPktDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Packet *p, const int list_id)
Definition: detect.h:444
int(* SetupPrefilter)(DetectEngineCtx *de_ctx, struct SigGroupHead_ *sgh)
Definition: detect.h:1182
#define BUG_ON(x)
#define PREFILTER_PROFILING_END(ctx, profile_id)
DetectEngineTransforms transforms
Definition: detect.h:613
#define HashListTableGetListData(hb)
Definition: util-hashlist.h:59
void(* PrefilterTx)(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *tx, const uint64_t idx, const uint8_t flags)
Definition: detect.h:1268
const char * PrefilterStoreGetName(const uint32_t id)
Container for matching data for a signature group.
Definition: detect.h:1329
void * HashListTableLookup(HashListTable *ht, void *data, uint16_t datalen)
#define CLS
uint16_t AppProto
PrefilterEngineList * tx_engines
Definition: detect.h:1322
#define TRUE
int PrefilterGenericMpmPktRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id)
main detection engine ctx
Definition: detect.h:756
void * pectx
Definition: detect.h:1293
PrefilterEngine * tx_engines
Definition: detect.h:1351
void PrefilterCleanupRuleGroup(const DetectEngineCtx *de_ctx, SigGroupHead *sgh)
const DetectEngineTransforms * transforms
PrefilterEngine * pkt_engines
Definition: detect.h:1349
int HashListTableAdd(HashListTable *ht, void *data, uint16_t datalen)
#define SCCalloc(nm, a)
Definition: util-mem.h:253
uint16_t local_id
Definition: detect.h:1283
#define HashListTableGetListNext(hb)
Definition: util-hashlist.h:58
void DetectRunPrefilterTx(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const uint8_t ipproto, const uint8_t flow_flags, const AppProto alproto, void *alstate, DetectTransaction *tx)
run prefilter engines on a transaction
int PrefilterAppendPayloadEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh, void(*PrefilterFunc)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx), void *pectx, void(*FreeFunc)(void *pectx), const char *name)
#define PKT_DETECT_HAS_STREAMDATA
Definition: decode.h:1120
void(* PrefilterTx)(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *tx, const uint64_t idx, const uint8_t flags)
Definition: detect.h:1297
void Prefilter(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const uint8_t flags)
uint8_t mpm_type
Definition: util-mpm.h:90
one time registration of keywords at start up
Definition: detect.h:600
struct PrefilterMpmCtx PrefilterMpmCtx
#define SCEnter(...)
Definition: util-debug.h:337
PrefilterRuleStore pmq
Definition: detect.h:1095
void PrefilterFreeEnginesList(PrefilterEngineList *list)
#define PACKET_PROFILING_DETECT_END(p, id)
PrefilterEngineList * payload_engines
Definition: detect.h:1321
HashListTable * HashListTableInit(uint32_t size, uint32_t(*Hash)(struct HashListTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
Definition: util-hashlist.c:35
PrefilterEngine * payload_engines
Definition: detect.h:1350
SigIntId * rule_id_array
uint32_t prefilter_id
Definition: detect.h:928
PrefilterEngineList * pkt_engines
Definition: detect.h:1320
void PrefilterDeinit(DetectEngineCtx *de_ctx)
int PrefilterGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id)
enum DetectEnginePrefilterSetting prefilter_setting
Definition: detect.h:898
void PrefilterSetupRuleGroup(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
uint32_t gid
Definition: detect.h:1303
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
Definition: util-mpm.h:169
#define SCFree(a)
Definition: util-mem.h:322
#define SCMallocAligned(a, b)
wrapper for allocing aligned mem
Definition: util-mem.h:363
void(* Prefilter)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
Definition: detect.h:1267
InspectionBufferGetPktDataPtr GetData
struct DetectBufferMpmRegistery_::@94::@96 app_v2
MpmThreadCtx mtcu
Definition: detect.h:1093
AppProto alproto
Definition: detect.h:1258
const char * name
Definition: detect.h:1277
#define FatalError(x,...)
Definition: util-debug.h:539
uint32_t rule_id_array_cnt
HashListTable * prefilter_hash_table
Definition: detect.h:929
#define PACKET_PROFILING_DETECT_START(p, id)
const DetectEngineTransforms * transforms
uint32_t array_size
Definition: util-hashlist.h:41
uint32_t prefilter_maxid
Definition: detect.h:883
struct PrefilterEngineList_ * next
Definition: detect.h:1272
uint32_t inspect_len
Definition: detect.h:340
const uint8_t * inspect
Definition: detect.h:338
void HashListTableFree(HashListTable *ht)
Definition: util-hashlist.c:82
int PrefilterAppendEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh, void(*PrefilterFunc)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx), void *pectx, void(*FreeFunc)(void *pectx), const char *name)
int tx_min_progress
Definition: detect.h:1289
uint32_t(* Search)(const struct MpmCtx_ *, struct MpmThreadCtx_ *, PrefilterRuleStore *, const uint8_t *, uint32_t)
Definition: util-mpm.h:162
#define SCReturn
Definition: util-debug.h:339
int PrefilterAppendTxEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh, void(*PrefilterTxFunc)(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *tx, const uint64_t idx, const uint8_t flags), AppProto alproto, int tx_min_progress, void *pectx, void(*FreeFunc)(void *pectx), const char *name)
void(* Free)(void *pectx)
Definition: detect.h:1275
InspectionBufferGetDataPtr GetData
#define PKT_NOPAYLOAD_INSPECTION
Definition: decode.h:1084
uint32_t flags
Definition: decode.h:443
uint16_t payload_len
Definition: decode.h:541
#define likely(expr)
Definition: util-optimize.h:32
bool sm_types_prefilter[DETECT_TBLSIZE]
Definition: detect.h:940
InspectionBuffer *(* InspectionBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id)
Definition: detect.h:370
AppProto alproto
Definition: detect.h:1286
#define PREFILTER_PROFILING_START
int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
Prepare the pattern matcher ctx in a sig group head.
struct DetectBufferMpmRegistery_::@94::@97 pkt_v1
Flow data structure.
Definition: flow.h:325
void(* Prefilter)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
Definition: detect.h:1296
#define SigIntId
void PrefilterInit(DetectEngineCtx *de_ctx)
#define SCFreeAligned(a)
Free aligned memory.
Definition: util-mem.h:388
SigGroupHeadInitData * init
Definition: detect.h:1357