suricata
detect-engine-prefilter.c
Go to the documentation of this file.
1 /* Copyright (C) 2016-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Prefilter engine
24  *
25  * Prefilter engines have as purpose to check for a critical common part of
26  * a set of rules. If the condition is present in the traffic, the rules
27  * will have to be inspected individually. Otherwise, the rules can be
28  * skipped.
29  *
30  * The best example of this is the MPM. From each rule take a pattern and
31  * add it to the MPM state machine. Inspect that in one step and only
32  * individually inspect the rules that had a match in MPM.
33  *
34  * This prefilter API is designed to abstract this logic so that it becomes
35  * easier to add other types of prefilters.
36  *
37  * The prefilter engines are structured as a simple list of engines. Each
38  * engine checks for a condition using it's callback function and private
39  * data. It then adds the rule match candidates to the PrefilterRuleStore
40  * structure.
41  *
42  * After the engines have run the resulting list of match candidates is
43  * sorted by the rule id's so that the individual inspection happens in
44  * the correct order.
45  */
46 
47 #include "suricata-common.h"
48 #include "suricata.h"
49 
50 #include "detect-engine.h"
52 #include "detect-engine-mpm.h"
53 #include "detect-engine-frame.h"
54 
55 #include "app-layer-parser.h"
56 #include "app-layer-htp.h"
57 
58 #include "util-profiling.h"
59 #include "util-validate.h"
60 
61 static int PrefilterStoreGetId(DetectEngineCtx *de_ctx,
62  const char *name, void (*FreeFunc)(void *));
63 static const PrefilterStore *PrefilterStoreGetStore(const DetectEngineCtx *de_ctx,
64  const uint32_t id);
65 
66 static inline void QuickSortSigIntId(SigIntId *sids, uint32_t n)
67 {
68  if (n < 2)
69  return;
70  SigIntId p = sids[n / 2];
71  SigIntId *l = sids;
72  SigIntId *r = sids + n - 1;
73  while (l <= r) {
74  if (*l < p)
75  l++;
76  else if (*r > p)
77  r--;
78  else {
79  SigIntId t = *l;
80  *l = *r;
81  *r = t;
82  l++;
83  r--;
84  }
85  }
86  QuickSortSigIntId(sids, r - sids + 1);
87  QuickSortSigIntId(l, sids + n - l);
88 }
89 
90 /**
91  * \brief run prefilter engines on a transaction
92  */
94  const SigGroupHead *sgh,
95  Packet *p,
96  const uint8_t ipproto,
97  const uint8_t flow_flags,
98  const AppProto alproto,
99  void *alstate,
100  DetectTransaction *tx)
101 {
102  /* reset rule store */
103  det_ctx->pmq.rule_id_array_cnt = 0;
104 
105  SCLogDebug("packet %" PRIu64 " tx %p progress %d tx->prefilter_flags %" PRIx64, p->pcap_cnt,
106  tx->tx_ptr, tx->tx_progress, tx->prefilter_flags);
107 
108  PrefilterEngine *engine = sgh->tx_engines;
109  do {
110  if (engine->alproto != alproto)
111  goto next;
112  if (engine->ctx.tx_min_progress > tx->tx_progress)
113  break;
114  if (tx->tx_progress > engine->ctx.tx_min_progress) {
115  if (tx->prefilter_flags & BIT_U64(engine->ctx.tx_min_progress)) {
116  goto next;
117  }
118  }
119 
120  PREFILTER_PROFILING_START(det_ctx);
121  engine->cb.PrefilterTx(det_ctx, engine->pectx, p, p->flow, tx->tx_ptr, tx->tx_id,
122  tx->tx_data_ptr, flow_flags);
123  PREFILTER_PROFILING_END(det_ctx, engine->gid);
124 
125  if (tx->tx_progress > engine->ctx.tx_min_progress && engine->is_last_for_progress) {
126  tx->prefilter_flags |= BIT_U64(engine->ctx.tx_min_progress);
127  }
128  next:
129  if (engine->is_last)
130  break;
131  engine++;
132  } while (1);
133 
134  /* Sort the rule list to lets look at pmq.
135  * NOTE due to merging of 'stream' pmqs we *MAY* have duplicate entries */
136  if (likely(det_ctx->pmq.rule_id_array_cnt > 1)) {
138  QuickSortSigIntId(det_ctx->pmq.rule_id_array, det_ctx->pmq.rule_id_array_cnt);
140  }
141 }
142 
143 void Prefilter(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p,
144  const uint8_t flags, const SignatureMask mask)
145 {
146  SCEnter();
147 #if 0
148  /* TODO review this check */
149  SCLogDebug("sgh %p frame_engines %p", sgh, sgh->frame_engines);
150  if (p->proto == IPPROTO_TCP && sgh->frame_engines && p->flow &&
151  p->flow->alproto != ALPROTO_UNKNOWN && p->flow->alparser != NULL) {
153  PrefilterFrames(det_ctx, sgh, p, flags, p->flow->alproto);
155  }
156 #endif
157  if (sgh->pkt_engines) {
159  /* run packet engines */
160  PrefilterEngine *engine = sgh->pkt_engines;
161  do {
162  if ((engine->ctx.pkt_mask & mask) == engine->ctx.pkt_mask) {
163  PREFILTER_PROFILING_START(det_ctx);
164  engine->cb.Prefilter(det_ctx, p, engine->pectx);
165  PREFILTER_PROFILING_END(det_ctx, engine->gid);
166  }
167 
168  if (engine->is_last)
169  break;
170  engine++;
171  } while (1);
173  }
174 
175  /* run payload inspecting engines */
176  if (sgh->payload_engines &&
179  {
181  PrefilterEngine *engine = sgh->payload_engines;
182  while (1) {
183  PREFILTER_PROFILING_START(det_ctx);
184  engine->cb.Prefilter(det_ctx, p, engine->pectx);
185  PREFILTER_PROFILING_END(det_ctx, engine->gid);
186 
187  if (engine->is_last)
188  break;
189  engine++;
190  }
192  }
193 
194  /* Sort the rule list to lets look at pmq.
195  * NOTE due to merging of 'stream' pmqs we *MAY* have duplicate entries */
196  if (likely(det_ctx->pmq.rule_id_array_cnt > 1)) {
198  QuickSortSigIntId(det_ctx->pmq.rule_id_array, det_ctx->pmq.rule_id_array_cnt);
200  }
201  SCReturn;
202 }
203 
205  SignatureMask mask, void *pectx, void (*FreeFunc)(void *pectx), const char *name)
206 {
207  if (sgh == NULL || PrefilterFunc == NULL || pectx == NULL)
208  return -1;
209 
210  PrefilterEngineList *e = SCMallocAligned(sizeof(*e), CLS);
211  if (e == NULL)
212  return -1;
213  memset(e, 0x00, sizeof(*e));
214 
215  e->Prefilter = PrefilterFunc;
216  e->pectx = pectx;
217  e->Free = FreeFunc;
218  e->pkt_mask = mask;
219 
220  if (sgh->init->pkt_engines == NULL) {
221  sgh->init->pkt_engines = e;
222  } else {
224  while (t->next != NULL) {
225  t = t->next;
226  }
227 
228  t->next = e;
229  e->id = t->id + 1;
230  }
231 
232  e->name = name;
233  e->gid = PrefilterStoreGetId(de_ctx, e->name, e->Free);
234  return 0;
235 }
236 
238  PrefilterPktFn PrefilterFunc, void *pectx, void (*FreeFunc)(void *pectx), const char *name)
239 {
240  if (sgh == NULL || PrefilterFunc == NULL || pectx == NULL)
241  return -1;
242 
243  PrefilterEngineList *e = SCMallocAligned(sizeof(*e), CLS);
244  if (e == NULL)
245  return -1;
246  memset(e, 0x00, sizeof(*e));
247 
248  e->Prefilter = PrefilterFunc;
249  e->pectx = pectx;
250  e->Free = FreeFunc;
251 
252  if (sgh->init->payload_engines == NULL) {
253  sgh->init->payload_engines = e;
254  } else {
256  while (t->next != NULL) {
257  t = t->next;
258  }
259 
260  t->next = e;
261  e->id = t->id + 1;
262  }
263 
264  e->name = name;
265  e->gid = PrefilterStoreGetId(de_ctx, e->name, e->Free);
266  return 0;
267 }
268 
270  PrefilterTxFn PrefilterTxFunc, AppProto alproto, int tx_min_progress, void *pectx,
271  void (*FreeFunc)(void *pectx), const char *name)
272 {
273  if (sgh == NULL || PrefilterTxFunc == NULL || pectx == NULL)
274  return -1;
275 
276  PrefilterEngineList *e = SCMallocAligned(sizeof(*e), CLS);
277  if (e == NULL)
278  return -1;
279  memset(e, 0x00, sizeof(*e));
280 
281  e->PrefilterTx = PrefilterTxFunc;
282  e->pectx = pectx;
283  e->alproto = alproto;
284  // TODO change function prototype ?
285  DEBUG_VALIDATE_BUG_ON(tx_min_progress > UINT8_MAX);
286  e->tx_min_progress = (uint8_t)tx_min_progress;
287  e->Free = FreeFunc;
288 
289  if (sgh->init->tx_engines == NULL) {
290  sgh->init->tx_engines = e;
291  } else {
293  while (t->next != NULL) {
294  t = t->next;
295  }
296 
297  t->next = e;
298  e->id = t->id + 1;
299  }
300 
301  e->name = name;
302  e->gid = PrefilterStoreGetId(de_ctx, e->name, e->Free);
303  return 0;
304 }
305 
307  PrefilterFrameFn PrefilterFrameFunc, AppProto alproto, uint8_t frame_type, void *pectx,
308  void (*FreeFunc)(void *pectx), const char *name)
309 {
310  if (sgh == NULL || PrefilterFrameFunc == NULL || pectx == NULL)
311  return -1;
312 
313  PrefilterEngineList *e = SCMallocAligned(sizeof(*e), CLS);
314  if (e == NULL)
315  return -1;
316  memset(e, 0x00, sizeof(*e));
317 
318  e->frame_type = frame_type;
319  e->alproto = alproto;
320  e->PrefilterFrame = PrefilterFrameFunc;
321  e->pectx = pectx;
322  e->Free = FreeFunc;
323 
324  if (sgh->init->frame_engines == NULL) {
325  sgh->init->frame_engines = e;
326  } else {
328  while (t->next != NULL) {
329  t = t->next;
330  }
331 
332  t->next = e;
333  e->id = t->id + 1;
334  }
335 
336  e->name = name;
337  e->gid = PrefilterStoreGetId(de_ctx, e->name, e->Free);
338  return 0;
339 }
340 
341 static void PrefilterFreeEngineList(PrefilterEngineList *e)
342 {
343  if (e->Free && e->pectx) {
344  e->Free(e->pectx);
345  }
346  SCFreeAligned(e);
347 }
348 
350 {
351  PrefilterEngineList *t = list;
352 
353  while (t != NULL) {
355  PrefilterFreeEngineList(t);
356  t = next;
357  }
358 }
359 
360 static void PrefilterFreeEngines(const DetectEngineCtx *de_ctx, PrefilterEngine *list)
361 {
362  PrefilterEngine *t = list;
363 
364  while (1) {
365  const PrefilterStore *s = PrefilterStoreGetStore(de_ctx, t->gid);
366  if (s && s->FreeFunc && t->pectx) {
367  s->FreeFunc(t->pectx);
368  }
369 
370  if (t->is_last)
371  break;
372  t++;
373  }
374  SCFreeAligned(list);
375 }
376 
378 {
379  if (sgh->pkt_engines) {
380  PrefilterFreeEngines(de_ctx, sgh->pkt_engines);
381  sgh->pkt_engines = NULL;
382  }
383  if (sgh->payload_engines) {
384  PrefilterFreeEngines(de_ctx, sgh->payload_engines);
385  sgh->payload_engines = NULL;
386  }
387  if (sgh->tx_engines) {
388  PrefilterFreeEngines(de_ctx, sgh->tx_engines);
389  sgh->tx_engines = NULL;
390  }
391  if (sgh->frame_engines) {
392  PrefilterFreeEngines(de_ctx, sgh->frame_engines);
393  sgh->frame_engines = NULL;
394  }
395 }
396 
397 static int PrefilterSetupRuleGroupSortHelper(const void *a, const void *b)
398 {
399  const PrefilterEngine *s0 = a;
400  const PrefilterEngine *s1 = b;
401  if (s1->ctx.tx_min_progress == s0->ctx.tx_min_progress) {
402  if (s1->alproto == s0->alproto) {
403  return s0->local_id > s1->local_id ? 1 : -1;
404  } else {
405  return s0->alproto > s1->alproto ? 1 : -1;
406  }
407  } else {
408  return s0->ctx.tx_min_progress > s1->ctx.tx_min_progress ? 1 : -1;
409  }
410 }
411 
413 {
414  int r = PatternMatchPrepareGroup(de_ctx, sgh);
415  if (r != 0) {
416  FatalError("failed to set up pattern matching");
417  }
418 
419  /* set up engines if needed - when prefilter is set to auto we run
420  * all engines, otherwise only those that have been forced by the
421  * prefilter keyword. */
423  for (int i = 0; i < DETECT_TBLSIZE; i++)
424  {
425  if (sigmatch_table[i].SetupPrefilter != NULL &&
426  (setting == DETECT_PREFILTER_AUTO ||
428  {
430  }
431  }
432 
433  /* we have lists of engines in sgh->init now. Lets setup the
434  * match arrays */
436  if (sgh->init->pkt_engines != NULL) {
437  uint32_t cnt = 0;
438  for (el = sgh->init->pkt_engines ; el != NULL; el = el->next) {
439  cnt++;
440  }
442  if (sgh->pkt_engines == NULL) {
443  return;
444  }
445  memset(sgh->pkt_engines, 0x00, (cnt * sizeof(PrefilterEngine)));
446 
447  PrefilterEngine *e = sgh->pkt_engines;
448  for (el = sgh->init->pkt_engines ; el != NULL; el = el->next) {
449  e->local_id = el->id;
450  e->cb.Prefilter = el->Prefilter;
451  e->ctx.pkt_mask = el->pkt_mask;
452  e->pectx = el->pectx;
453  el->pectx = NULL; // e now owns the ctx
454  e->gid = el->gid;
455  if (el->next == NULL) {
456  e->is_last = true;
457  }
458  e++;
459  }
460  }
461  if (sgh->init->payload_engines != NULL) {
462  uint32_t cnt = 0;
463  for (el = sgh->init->payload_engines ; el != NULL; el = el->next) {
464  cnt++;
465  }
467  if (sgh->payload_engines == NULL) {
468  return;
469  }
470  memset(sgh->payload_engines, 0x00, (cnt * sizeof(PrefilterEngine)));
471 
473  for (el = sgh->init->payload_engines ; el != NULL; el = el->next) {
474  e->local_id = el->id;
475  e->cb.Prefilter = el->Prefilter;
476  e->ctx.pkt_mask = el->pkt_mask;
477  e->pectx = el->pectx;
478  el->pectx = NULL; // e now owns the ctx
479  e->gid = el->gid;
480  if (el->next == NULL) {
481  e->is_last = true;
482  }
483  e++;
484  }
485  }
486  if (sgh->init->tx_engines != NULL) {
487  uint32_t cnt = 0;
488  for (el = sgh->init->tx_engines ; el != NULL; el = el->next) {
489  cnt++;
490  }
491  sgh->tx_engines = SCMallocAligned(cnt * sizeof(PrefilterEngine), CLS);
492  if (sgh->tx_engines == NULL) {
493  return;
494  }
495  memset(sgh->tx_engines, 0x00, (cnt * sizeof(PrefilterEngine)));
496 
497  uint16_t local_id = 0;
498  PrefilterEngine *e = sgh->tx_engines;
499  for (el = sgh->init->tx_engines ; el != NULL; el = el->next) {
500  e->local_id = local_id++;
501  e->alproto = el->alproto;
503  e->cb.PrefilterTx = el->PrefilterTx;
504  e->pectx = el->pectx;
505  el->pectx = NULL; // e now owns the ctx
506  e->gid = el->gid;
507  e++;
508  }
509 
510  /* sort by tx_min_progress, then alproto, then local_id */
511  qsort(sgh->tx_engines, local_id, sizeof(PrefilterEngine),
512  PrefilterSetupRuleGroupSortHelper);
513  sgh->tx_engines[local_id - 1].is_last = true;
514  sgh->tx_engines[local_id - 1].is_last_for_progress = true;
515 
516  PrefilterEngine *engine;
517 
518  /* per alproto to set is_last_for_progress per alproto because the inspect
519  * loop skips over engines that are not the correct alproto */
520  for (AppProto a = 1; a < ALPROTO_FAILED; a++) {
521  int last_tx_progress = 0;
522  bool last_tx_progress_set = false;
523  PrefilterEngine *prev_engine = NULL;
524  engine = sgh->tx_engines;
525  do {
526  BUG_ON(engine->ctx.tx_min_progress < last_tx_progress);
527  if (engine->alproto == a) {
528  if (last_tx_progress_set && engine->ctx.tx_min_progress > last_tx_progress) {
529  if (prev_engine) {
530  prev_engine->is_last_for_progress = true;
531  }
532  }
533 
534  last_tx_progress_set = true;
535  prev_engine = engine;
536  } else {
537  if (prev_engine) {
538  prev_engine->is_last_for_progress = true;
539  }
540  }
541  last_tx_progress = engine->ctx.tx_min_progress;
542  if (engine->is_last)
543  break;
544  engine++;
545  } while (1);
546  }
547 #ifdef DEBUG
548  SCLogDebug("sgh %p", sgh);
549  engine = sgh->tx_engines;
550  do {
551  SCLogDebug("engine: gid %u alproto %s tx_min_progress %d is_last %s "
552  "is_last_for_progress %s",
553  engine->gid, AppProtoToString(engine->alproto), engine->ctx.tx_min_progress,
554  engine->is_last ? "true" : "false",
555  engine->is_last_for_progress ? "true" : "false");
556  if (engine->is_last)
557  break;
558  engine++;
559  } while (1);
560 #endif
561  }
562  if (sgh->init->frame_engines != NULL) {
563  uint32_t cnt = 0;
564  for (el = sgh->init->frame_engines; el != NULL; el = el->next) {
565  cnt++;
566  }
568  if (sgh->frame_engines == NULL) {
569  return;
570  }
571  memset(sgh->frame_engines, 0x00, (cnt * sizeof(PrefilterEngine)));
572 
573  PrefilterEngine *e = sgh->frame_engines;
574  for (el = sgh->init->frame_engines; el != NULL; el = el->next) {
575  e->local_id = el->id;
576  e->ctx.frame_type = el->frame_type;
578  e->alproto = el->alproto;
579  e->pectx = el->pectx;
580  el->pectx = NULL; // e now owns the ctx
581  e->gid = el->gid;
582  if (el->next == NULL) {
583  e->is_last = true;
584  }
585  e++;
586  }
587  }
588 }
589 
590 /* hash table for assigning a unique id to each engine type. */
591 
592 static uint32_t PrefilterStoreHashFunc(HashListTable *ht, void *data, uint16_t datalen)
593 {
594  PrefilterStore *ctx = data;
595 
596  uint32_t hash = strlen(ctx->name);
597 
598  for (size_t u = 0; u < strlen(ctx->name); u++) {
599  hash += ctx->name[u];
600  }
601 
602  hash %= ht->array_size;
603  return hash;
604 }
605 
606 static char PrefilterStoreCompareFunc(void *data1, uint16_t len1,
607  void *data2, uint16_t len2)
608 {
609  PrefilterStore *ctx1 = data1;
610  PrefilterStore *ctx2 = data2;
611  return (strcmp(ctx1->name, ctx2->name) == 0);
612 }
613 
614 static void PrefilterStoreFreeFunc(void *ptr)
615 {
616  SCFree(ptr);
617 }
618 
620 {
621  if (de_ctx->prefilter_hash_table != NULL) {
623  }
624 }
625 
627 {
629 
631  PrefilterStoreHashFunc,
632  PrefilterStoreCompareFunc,
633  PrefilterStoreFreeFunc);
635 }
636 
637 static int PrefilterStoreGetId(DetectEngineCtx *de_ctx,
638  const char *name, void (*FreeFunc)(void *))
639 {
640  PrefilterStore ctx = { name, FreeFunc, 0 };
641 
643 
644  SCLogDebug("looking up %s", name);
645 
647  if (rctx != NULL) {
648  return rctx->id;
649  }
650 
651  PrefilterStore *actx = SCCalloc(1, sizeof(*actx));
652  if (actx == NULL) {
653  return -1;
654  }
655 
656  actx->name = name;
657  actx->FreeFunc = FreeFunc;
658  actx->id = de_ctx->prefilter_id++;
659  SCLogDebug("prefilter engine %s has profile id %u", actx->name, actx->id);
660 
661  int ret = HashListTableAdd(de_ctx->prefilter_hash_table, actx, 0);
662  if (ret != 0) {
663  SCFree(actx);
664  return -1;
665  }
666 
667  int r = actx->id;
668  return r;
669 }
670 
671 /** \warning slow */
672 static const PrefilterStore *PrefilterStoreGetStore(const DetectEngineCtx *de_ctx,
673  const uint32_t id)
674 {
675 
676  const PrefilterStore *store = NULL;
677  if (de_ctx->prefilter_hash_table != NULL) {
679  for ( ; hb != NULL; hb = HashListTableGetListNext(hb)) {
681  if (ctx->id == id) {
682  store = ctx;
683  break;
684  }
685  }
686  }
687  return store;
688 }
689 
690 #ifdef PROFILING
691 const char *PrefilterStoreGetName(const uint32_t id)
692 {
693  return NULL;
694 }
695 #endif
696 
697 #include "util-print.h"
698 
699 typedef struct PrefilterMpmCtx {
700  int list_id;
702  const MpmCtx *mpm_ctx;
705 
706 /** \brief Generic Mpm prefilter callback
707  *
708  * \param det_ctx detection engine thread ctx
709  * \param p packet to inspect
710  * \param f flow to inspect
711  * \param txv tx to inspect
712  * \param pectx inspection context
713  */
714 static void PrefilterMpm(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f,
715  void *txv, const uint64_t idx, const AppLayerTxData *_txd, const uint8_t flags)
716 {
717  SCEnter();
718 
719  const PrefilterMpmCtx *ctx = (const PrefilterMpmCtx *)pectx;
720  const MpmCtx *mpm_ctx = ctx->mpm_ctx;
721  SCLogDebug("running on list %d", ctx->list_id);
722 
723  InspectionBuffer *buffer = ctx->GetData(det_ctx, ctx->transforms,
724  f, flags, txv, ctx->list_id);
725  if (buffer == NULL)
726  return;
727 
728  const uint32_t data_len = buffer->inspect_len;
729  const uint8_t *data = buffer->inspect;
730 
731  SCLogDebug("mpm'ing buffer:");
732  //PrintRawDataFp(stdout, data, data_len);
733 
734  if (data != NULL && data_len >= mpm_ctx->minlen) {
735  (void)mpm_table[mpm_ctx->mpm_type].Search(
736  mpm_ctx, &det_ctx->mtc, &det_ctx->pmq, data, data_len);
737  PREFILTER_PROFILING_ADD_BYTES(det_ctx, data_len);
738  }
739 }
740 
741 static void PrefilterGenericMpmFree(void *ptr)
742 {
743  SCFree(ptr);
744 }
745 
747  const DetectBufferMpmRegistry *mpm_reg, int list_id)
748 {
749  SCEnter();
750  PrefilterMpmCtx *pectx = SCCalloc(1, sizeof(*pectx));
751  if (pectx == NULL)
752  return -1;
753  pectx->list_id = list_id;
754  pectx->GetData = mpm_reg->app_v2.GetData;
755  pectx->mpm_ctx = mpm_ctx;
756  pectx->transforms = &mpm_reg->transforms;
757 
758  int r = PrefilterAppendTxEngine(de_ctx, sgh, PrefilterMpm,
759  mpm_reg->app_v2.alproto, mpm_reg->app_v2.tx_min_progress,
760  pectx, PrefilterGenericMpmFree, mpm_reg->pname);
761  if (r != 0) {
762  SCFree(pectx);
763  }
764  return r;
765 }
766 
767 static void PrefilterMultiGenericMpmFree(void *ptr)
768 {
769  // PrefilterMpmListId
770  SCFree(ptr);
771 }
772 
773 static void PrefilterMultiMpm(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f,
774  void *txv, const uint64_t idx, const AppLayerTxData *_txd, const uint8_t flags)
775 {
776  SCEnter();
777 
778  const PrefilterMpmListId *ctx = (const PrefilterMpmListId *)pectx;
779  const MpmCtx *mpm_ctx = ctx->mpm_ctx;
780  SCLogDebug("running on list %d", ctx->list_id);
781  uint32_t local_id = 0;
782 
783  do {
784  // loop until we get a NULL
785  InspectionBuffer *buffer =
786  ctx->GetData(det_ctx, ctx->transforms, f, flags, txv, ctx->list_id, local_id);
787  if (buffer == NULL)
788  break;
789 
790  if (buffer->inspect_len >= mpm_ctx->minlen) {
791  (void)mpm_table[mpm_ctx->mpm_type].Search(
792  mpm_ctx, &det_ctx->mtc, &det_ctx->pmq, buffer->inspect, buffer->inspect_len);
793  PREFILTER_PROFILING_ADD_BYTES(det_ctx, buffer->inspect_len);
794  }
795 
796  local_id++;
797  } while (1);
798 }
799 
801  const DetectBufferMpmRegistry *mpm_reg, int list_id)
802 {
803  SCEnter();
804  PrefilterMpmListId *pectx = SCCalloc(1, sizeof(*pectx));
805  if (pectx == NULL)
806  return -1;
807  pectx->list_id = list_id;
808  pectx->GetData = mpm_reg->app_v2.GetMultiData;
809  pectx->mpm_ctx = mpm_ctx;
810  pectx->transforms = &mpm_reg->transforms;
811 
812  int r = PrefilterAppendTxEngine(de_ctx, sgh, PrefilterMultiMpm, mpm_reg->app_v2.alproto,
813  mpm_reg->app_v2.tx_min_progress, pectx, PrefilterMultiGenericMpmFree, mpm_reg->pname);
814  if (r != 0) {
815  SCFree(pectx);
816  }
817  return r;
818 }
819 
820 /* generic mpm for pkt engines */
821 
822 typedef struct PrefilterMpmPktCtx {
823  int list_id;
825  const MpmCtx *mpm_ctx;
828 
829 /** \brief Generic Mpm prefilter callback
830  *
831  * \param det_ctx detection engine thread ctx
832  * \param p packet to inspect
833  * \param f flow to inspect
834  * \param txv tx to inspect
835  * \param pectx inspection context
836  */
837 static void PrefilterMpmPkt(DetectEngineThreadCtx *det_ctx,
838  Packet *p, const void *pectx)
839 {
840  SCEnter();
841 
842  const PrefilterMpmPktCtx *ctx = (const PrefilterMpmPktCtx *)pectx;
843  const MpmCtx *mpm_ctx = ctx->mpm_ctx;
844  SCLogDebug("running on list %d", ctx->list_id);
845 
846  InspectionBuffer *buffer = ctx->GetData(det_ctx, ctx->transforms,
847  p, ctx->list_id);
848  if (buffer == NULL)
849  return;
850 
851  const uint32_t data_len = buffer->inspect_len;
852  const uint8_t *data = buffer->inspect;
853 
854  SCLogDebug("mpm'ing buffer:");
855  //PrintRawDataFp(stdout, data, data_len);
856 
857  if (data != NULL && data_len >= mpm_ctx->minlen) {
858  (void)mpm_table[mpm_ctx->mpm_type].Search(
859  mpm_ctx, &det_ctx->mtc, &det_ctx->pmq, data, data_len);
860  PREFILTER_PROFILING_ADD_BYTES(det_ctx, data_len);
861  }
862 }
863 
864 static void PrefilterMpmPktFree(void *ptr)
865 {
866  SCFree(ptr);
867 }
868 
870  const DetectBufferMpmRegistry *mpm_reg, int list_id)
871 {
872  SCEnter();
873  PrefilterMpmPktCtx *pectx = SCCalloc(1, sizeof(*pectx));
874  if (pectx == NULL)
875  return -1;
876  pectx->list_id = list_id;
877  pectx->GetData = mpm_reg->pkt_v1.GetData;
878  pectx->mpm_ctx = mpm_ctx;
879  pectx->transforms = &mpm_reg->transforms;
880 
881  int r = PrefilterAppendEngine(
882  de_ctx, sgh, PrefilterMpmPkt, 0, pectx, PrefilterMpmPktFree, mpm_reg->pname);
883  if (r != 0) {
884  SCFree(pectx);
885  }
886  return r;
887 }
HashListTableGetListData
#define HashListTableGetListData(hb)
Definition: util-hashlist.h:56
PrefilterGenericMpmPktRegister
int PrefilterGenericMpmPktRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-prefilter.c:869
PrefilterEngineList_::frame_type
uint8_t frame_type
Definition: detect.h:1395
SigGroupHead_::tx_engines
PrefilterEngine * tx_engines
Definition: detect.h:1494
Packet_::proto
uint8_t proto
Definition: decode.h:504
DetectTransaction_::tx_data_ptr
struct AppLayerTxData * tx_data_ptr
Definition: detect-engine-prefilter.h:34
PrefilterEngineList_::Prefilter
PrefilterPktFn Prefilter
Definition: detect.h:1403
MpmCtx_::mpm_type
uint8_t mpm_type
Definition: util-mpm.h:90
detect-engine.h
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:127
PatternMatchPrepareGroup
int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
Prepare the pattern matcher ctx in a sig group head.
Definition: detect-engine-mpm.c:2218
PrefilterMpmPktCtx
struct PrefilterMpmPktCtx PrefilterMpmPktCtx
PrefilterStore_::FreeFunc
void(* FreeFunc)(void *)
Definition: detect-engine-prefilter.h:46
PREFILTER_PROFILING_END
#define PREFILTER_PROFILING_END(ctx, profile_id)
Definition: util-profiling.h:277
PrefilterStore_
Definition: detect-engine-prefilter.h:44
CLS
#define CLS
Definition: suricata-common.h:56
PrefilterRuleStore_::rule_id_array_cnt
uint32_t rule_id_array_cnt
Definition: util-prefilter.h:40
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1475
DetectEngineTransforms
Definition: detect.h:411
PrefilterEngineList_::id
uint16_t id
Definition: detect.h:1387
PROF_DETECT_PF_PAYLOAD
@ PROF_DETECT_PF_PAYLOAD
Definition: suricata-common.h:446
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:609
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
DetectBufferMpmRegistry_::pkt_v1
struct DetectBufferMpmRegistry_::@80::@83 pkt_v1
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:82
PrefilterMpmCtx::GetData
InspectionBufferGetDataPtr GetData
Definition: detect-engine-prefilter.c:701
InspectionBuffer
Definition: detect.h:376
Packet_::flags
uint32_t flags
Definition: decode.h:519
Flow_
Flow data structure.
Definition: flow.h:360
PREFILTER_PROFILING_START
#define PREFILTER_PROFILING_START(det_ctx)
Definition: util-profiling.h:261
DetectEngineThreadCtx_::pmq
PrefilterRuleStore pmq
Definition: detect.h:1215
InspectionBufferGetDataPtr
InspectionBuffer *(* InspectionBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id)
Definition: detect.h:417
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:76
PrefilterEngineList_::name
const char * name
Definition: detect.h:1412
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:850
HashListTableGetListHead
HashListTableBucket * HashListTableGetListHead(HashListTable *ht)
Definition: util-hashlist.c:287
PrefilterEngine_::tx_min_progress
uint8_t tx_min_progress
Definition: detect.h:1427
InspectionBufferGetPktDataPtr
InspectionBuffer *(* InspectionBufferGetPktDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Packet *p, const int list_id)
Definition: detect.h:484
PrefilterDeinit
void PrefilterDeinit(DetectEngineCtx *de_ctx)
Definition: detect-engine-prefilter.c:619
DetectBufferMpmRegistry_
one time registration of keywords at start up
Definition: detect.h:688
PrefilterMpmPktCtx
Definition: detect-engine-prefilter.c:822
detect-engine-frame.h
SigGroupHead_::payload_engines
PrefilterEngine * payload_engines
Definition: detect.h:1493
DetectEngineCtx_::prefilter_setting
enum DetectEnginePrefilterSetting prefilter_setting
Definition: detect.h:986
PKT_NOPAYLOAD_INSPECTION
#define PKT_NOPAYLOAD_INSPECTION
Definition: decode.h:1270
PACKET_PROFILING_DETECT_END
#define PACKET_PROFILING_DETECT_END(p, id)
Definition: util-profiling.h:222
HashListTableLookup
void * HashListTableLookup(HashListTable *ht, void *data, uint16_t datalen)
Definition: util-hashlist.c:245
PrefilterEngine_::local_id
uint16_t local_id
Definition: detect.h:1418
PrefilterEngineList_::Free
void(* Free)(void *pectx)
Definition: detect.h:1410
PrefilterAppendFrameEngine
int PrefilterAppendFrameEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh, PrefilterFrameFn PrefilterFrameFunc, AppProto alproto, uint8_t frame_type, void *pectx, void(*FreeFunc)(void *pectx), const char *name)
Definition: detect-engine-prefilter.c:306
DetectBufferMpmRegistry_::transforms
DetectEngineTransforms transforms
Definition: detect.h:701
Packet_::payload_len
uint16_t payload_len
Definition: decode.h:589
DetectTransaction_::tx_progress
const int tx_progress
Definition: detect-engine-prefilter.h:40
detect-engine-prefilter.h
PrefilterMultiGenericMpmRegister
int PrefilterMultiGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-prefilter.c:800
PrefilterStore_::id
uint32_t id
Definition: detect-engine-prefilter.h:47
HashListTableAdd
int HashListTableAdd(HashListTable *ht, void *data, uint16_t datalen)
Definition: util-hashlist.c:114
DETECT_PREFILTER_AUTO
@ DETECT_PREFILTER_AUTO
Definition: detect.h:832
HashListTable_::array_size
uint32_t array_size
Definition: util-hashlist.h:41
PrefilterEngine_::is_last_for_progress
bool is_last_for_progress
Definition: detect.h:1444
PROF_DETECT_PF_SORT1
@ PROF_DETECT_PF_SORT1
Definition: suricata-common.h:449
DetectEngineCtx_::prefilter_id
uint32_t prefilter_id
Definition: detect.h:1017
PrefilterEngineList_::next
struct PrefilterEngineList_ * next
Definition: detect.h:1407
SigTableElmt_::SetupPrefilter
int(* SetupPrefilter)(DetectEngineCtx *de_ctx, struct SigGroupHead_ *sgh)
Definition: detect.h:1307
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:484
HashListTableGetListNext
#define HashListTableGetListNext(hb)
Definition: util-hashlist.h:55
PrefilterMpmListId
Definition: detect-engine-mpm.h:125
DetectEngineCtx_::prefilter_hash_table
HashListTable * prefilter_hash_table
Definition: detect.h:1018
app-layer-htp.h
HashListTableInit
HashListTable * HashListTableInit(uint32_t size, uint32_t(*Hash)(struct HashListTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
Definition: util-hashlist.c:35
PrefilterEngineList_::alproto
AppProto alproto
Definition: detect.h:1390
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
Prefilter
void Prefilter(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const uint8_t flags, const SignatureMask mask)
Definition: detect-engine-prefilter.c:143
PrefilterStoreGetName
const char * PrefilterStoreGetName(const uint32_t id)
Definition: detect-engine-prefilter.c:691
DetectEngineThreadCtx_
Definition: detect.h:1106
PrefilterEngine_
Definition: detect.h:1417
SigGroupHeadInitData_::tx_engines
PrefilterEngineList * tx_engines
Definition: detect.h:1464
PROF_DETECT_PF_PKT
@ PROF_DETECT_PF_PKT
Definition: suricata-common.h:445
PrefilterEngineList_::PrefilterFrame
PrefilterFrameFn PrefilterFrame
Definition: detect.h:1405
PrefilterEngineList_::pectx
void * pectx
Definition: detect.h:1401
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
detect-engine-mpm.h
PrefilterEngineList_::PrefilterTx
PrefilterTxFn PrefilterTx
Definition: detect.h:1404
DetectEngineCtx_::sm_types_prefilter
bool * sm_types_prefilter
Definition: detect.h:1033
PrefilterEngineList_::gid
uint32_t gid
Definition: detect.h:1414
PrefilterMpmPktCtx::GetData
InspectionBufferGetPktDataPtr GetData
Definition: detect-engine-prefilter.c:824
PKT_DETECT_HAS_STREAMDATA
#define PKT_DETECT_HAS_STREAMDATA
Definition: decode.h:1320
PrefilterMpmCtx
struct PrefilterMpmCtx PrefilterMpmCtx
PrefilterGenericMpmRegister
int PrefilterGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-prefilter.c:746
PrefilterFrameFn
void(* PrefilterFrameFn)(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, const struct Frames *frames, const struct Frame *frame)
Definition: detect.h:1379
SigGroupHead_::init
SigGroupHeadInitData * init
Definition: detect.h:1498
PrefilterEngine_::ctx
union PrefilterEngine_::@95 ctx
PrefilterMpmListId::transforms
const DetectEngineTransforms * transforms
Definition: detect-engine-mpm.h:129
app-layer-parser.h
MpmCtx_::minlen
uint16_t minlen
Definition: util-mpm.h:99
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:300
util-profiling.h
DetectTransaction_::tx_id
const uint64_t tx_id
Definition: detect-engine-prefilter.h:33
SCReturn
#define SCReturn
Definition: util-debug.h:273
PrefilterEngine_::alproto
AppProto alproto
Definition: detect.h:1421
PrefilterMpmListId::mpm_ctx
const MpmCtx * mpm_ctx
Definition: detect-engine-mpm.h:127
DetectTransaction_::prefilter_flags
uint64_t prefilter_flags
Definition: detect-engine-prefilter.h:37
Packet_
Definition: decode.h:482
SCFreeAligned
#define SCFreeAligned(p)
Definition: util-mem.h:77
DetectBufferMpmRegistry_::app_v2
struct DetectBufferMpmRegistry_::@80::@82 app_v2
PrefilterEngine_::PrefilterFrame
PrefilterFrameFn PrefilterFrame
Definition: detect.h:1438
PrefilterEngine_::frame_type
uint8_t frame_type
Definition: detect.h:1428
PrefilterAppendEngine
int PrefilterAppendEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh, PrefilterPktFn PrefilterFunc, SignatureMask mask, void *pectx, void(*FreeFunc)(void *pectx), const char *name)
Definition: detect-engine-prefilter.c:204
HashListTable_
Definition: util-hashlist.h:37
BIT_U64
#define BIT_U64(n)
Definition: suricata-common.h:401
PrefilterTxFn
void(* PrefilterTxFn)(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *tx, const uint64_t tx_id, const AppLayerTxData *tx_data, const uint8_t flags)
Definition: detect.h:1383
MpmTableElmt_::Search
uint32_t(* Search)(const struct MpmCtx_ *, struct MpmThreadCtx_ *, PrefilterRuleStore *, const uint8_t *, uint32_t)
Definition: util-mpm.h:168
SigGroupHead_::frame_engines
PrefilterEngine * frame_engines
Definition: detect.h:1495
PrefilterMpmCtx::list_id
int list_id
Definition: detect-engine-prefilter.c:700
DetectEngineThreadCtx_::mtc
MpmThreadCtx mtc
Definition: detect.h:1214
PrefilterMpmPktCtx::list_id
int list_id
Definition: detect-engine-prefilter.c:823
PrefilterAppendPayloadEngine
int PrefilterAppendPayloadEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh, PrefilterPktFn PrefilterFunc, void *pectx, void(*FreeFunc)(void *pectx), const char *name)
Definition: detect-engine-prefilter.c:237
PrefilterEngine_::cb
union PrefilterEngine_::@96 cb
SigGroupHeadInitData_::pkt_engines
PrefilterEngineList * pkt_engines
Definition: detect.h:1462
AppLayerTxData
struct AppLayerTxData AppLayerTxData
Definition: detect.h:1382
cnt
uint32_t cnt
Definition: tmqh-packetpool.h:7
PREFILTER_PROFILING_ADD_BYTES
#define PREFILTER_PROFILING_ADD_BYTES(det_ctx, bytes)
Definition: util-profiling.h:287
Packet_::flow
struct Flow_ * flow
Definition: decode.h:521
flags
uint8_t flags
Definition: decode-gre.h:0
suricata-common.h
SigGroupHeadInitData_::frame_engines
PrefilterEngineList * frame_engines
Definition: detect.h:1465
SigGroupHeadInitData_::payload_engines
PrefilterEngineList * payload_engines
Definition: detect.h:1463
HashListTableFree
void HashListTableFree(HashListTable *ht)
Definition: util-hashlist.c:88
PROF_DETECT_PF_RECORD
@ PROF_DETECT_PF_RECORD
Definition: suricata-common.h:448
SCMallocAligned
#define SCMallocAligned(size, align)
Definition: util-mem.h:68
DetectEnginePrefilterSetting
DetectEnginePrefilterSetting
Definition: detect.h:830
DetectTransaction_
Definition: detect-engine-prefilter.h:31
PrefilterEngineList_
Definition: detect.h:1386
PrefilterCleanupRuleGroup
void PrefilterCleanupRuleGroup(const DetectEngineCtx *de_ctx, SigGroupHead *sgh)
Definition: detect-engine-prefilter.c:377
PrefilterEngine_::gid
uint32_t gid
Definition: detect.h:1442
FatalError
#define FatalError(...)
Definition: util-debug.h:502
PrefilterMpmPktCtx::transforms
const DetectEngineTransforms * transforms
Definition: detect-engine-prefilter.c:826
PrefilterAppendTxEngine
int PrefilterAppendTxEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh, PrefilterTxFn PrefilterTxFunc, AppProto alproto, int tx_min_progress, void *pectx, void(*FreeFunc)(void *pectx), const char *name)
Definition: detect-engine-prefilter.c:269
PrefilterPktFn
void(* PrefilterPktFn)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
Definition: detect.h:1378
PrefilterMpmCtx
Definition: detect-engine-prefilter.c:699
PrefilterMpmListId::GetData
InspectionMultiBufferGetDataPtr GetData
Definition: detect-engine-mpm.h:128
util-validate.h
DetectTransaction_::tx_ptr
void * tx_ptr
Definition: detect-engine-prefilter.h:32
InspectionBuffer::inspect_len
uint32_t inspect_len
Definition: detect.h:379
PrefilterEngine_::pectx
void * pectx
Definition: detect.h:1433
PrefilterInit
void PrefilterInit(DetectEngineCtx *de_ctx)
Definition: detect-engine-prefilter.c:626
InspectionBuffer::inspect
const uint8_t * inspect
Definition: detect.h:377
PACKET_PROFILING_DETECT_START
#define PACKET_PROFILING_DETECT_START(p, id)
Definition: util-profiling.h:215
PrefilterMpmCtx::transforms
const DetectEngineTransforms * transforms
Definition: detect-engine-prefilter.c:703
DETECT_TBLSIZE
int DETECT_TBLSIZE
Definition: detect-engine-register.c:316
PrefilterStore_::name
const char * name
Definition: detect-engine-prefilter.h:45
SCFree
#define SCFree(p)
Definition: util-mem.h:61
HashListTableBucket_
Definition: util-hashlist.h:28
PrefilterMpmPktCtx::mpm_ctx
const MpmCtx * mpm_ctx
Definition: detect-engine-prefilter.c:825
PrefilterEngineList_::pkt_mask
SignatureMask pkt_mask
Definition: detect.h:1397
PrefilterMpmListId::list_id
int list_id
Definition: detect-engine-mpm.h:126
SignatureMask
#define SignatureMask
Definition: detect.h:311
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
ALPROTO_FAILED
@ ALPROTO_FAILED
Definition: app-layer-protos.h:72
PrefilterEngine_::pkt_mask
SignatureMask pkt_mask
Definition: detect.h:1424
mpm_table
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
Definition: util-mpm.c:47
PrefilterEngine_::is_last
bool is_last
Definition: detect.h:1443
suricata.h
PrefilterEngineList_::tx_min_progress
uint8_t tx_min_progress
Definition: detect.h:1393
PrefilterSetupRuleGroup
void PrefilterSetupRuleGroup(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
Definition: detect-engine-prefilter.c:412
likely
#define likely(expr)
Definition: util-optimize.h:32
SigGroupHead_::pkt_engines
PrefilterEngine * pkt_engines
Definition: detect.h:1492
PrefilterEngine_::Prefilter
PrefilterPktFn Prefilter
Definition: detect.h:1436
PrefilterEngine_::PrefilterTx
PrefilterTxFn PrefilterTx
Definition: detect.h:1437
MpmCtx_
Definition: util-mpm.h:88
SigIntId
#define SigIntId
Definition: suricata-common.h:315
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:459
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
PrefilterFreeEnginesList
void PrefilterFreeEnginesList(PrefilterEngineList *list)
Definition: detect-engine-prefilter.c:349
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
PrefilterMpmCtx::mpm_ctx
const MpmCtx * mpm_ctx
Definition: detect-engine-prefilter.c:702
DetectRunPrefilterTx
void DetectRunPrefilterTx(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const uint8_t ipproto, const uint8_t flow_flags, const AppProto alproto, void *alstate, DetectTransaction *tx)
run prefilter engines on a transaction
Definition: detect-engine-prefilter.c:93
PrefilterRuleStore_::rule_id_array
SigIntId * rule_id_array
Definition: util-prefilter.h:38
DetectBufferMpmRegistry_::pname
char pname[32]
Definition: detect.h:690