Go to the documentation of this file.
64 const char *
name,
void (*FreeFunc)(
void *));
68 static inline void QuickSortSigIntId(
SigIntId *sids, uint32_t n)
88 QuickSortSigIntId(sids, r - sids + 1);
89 QuickSortSigIntId(l, sids + n - l);
98 const uint8_t ipproto,
99 const uint8_t flow_flags,
107 SCLogDebug(
"packet %" PRIu64
" tx %p progress %d tx->detect_progress %02x", p->
pcap_cnt,
114 if (tx_ptr == NULL) {
136 SCLogDebug(
"tx already marked progress as beyond engine: %u > %u",
140 SCLogDebug(
"tx->tx_progress %u > engine->ctx.tx_min_progress %d: "
141 "tx->detect_progress %u",
152 SCLogDebug(
"engine %p min_progress %d %s:%s: results %u", engine,
161 SCLogDebug(
"tx->tx_progress %d engine->ctx.tx_min_progress %d "
162 "engine->is_last_for_progress %d => tx->detect_progress updated to %02x",
239 if (((engine->
ctx.
pkt.mask & mask) == engine->
ctx.
pkt.mask) &&
286 if (sgh == NULL || PrefilterFunc == NULL || pectx == NULL)
292 memset(e, 0x00,
sizeof(*e));
307 while (t->
next != NULL) {
321 PrefilterPktFn PrefilterFunc,
void *pectx,
void (*FreeFunc)(
void *pectx),
const char *
name)
323 if (sgh == NULL || PrefilterFunc == NULL || pectx == NULL)
329 memset(e, 0x00,
sizeof(*e));
339 while (t->
next != NULL) {
354 void (*FreeFunc)(
void *pectx),
const char *
name)
356 if (sgh == NULL || PrefilterTxFunc == NULL || pectx == NULL)
362 memset(e, 0x00,
sizeof(*e));
376 while (t->
next != NULL) {
391 void (*FreeFunc)(
void *pectx),
const char *
name)
393 if (sgh == NULL || PrefilterFrameFunc == NULL || pectx == NULL)
399 memset(e, 0x00,
sizeof(*e));
411 while (t->
next != NULL) {
425 void (*PrefilterPostRuleFunc)(
427 void *pectx,
void (*FreeFunc)(
void *pectx),
const char *
name)
429 if (sgh == NULL || PrefilterPostRuleFunc == NULL || pectx == NULL)
435 memset(e, 0x00,
sizeof(*e));
444 while (t->
next != NULL) {
471 PrefilterFreeEngineList(t);
517 static int PrefilterSetupRuleGroupSortHelper(
const void *a,
const void *b)
565 static void PrefilterNonPFDataFree(
void *data)
575 PrefilterAddSids(&det_ctx->
pmq, data->
array, data->
size);
578 #ifdef NONPF_PKT_STATS
579 static thread_local uint64_t prefilter_pkt_nonpf_called = 0;
580 static thread_local uint64_t prefilter_pkt_nonpf_mask_fail = 0;
581 static thread_local uint64_t prefilter_pkt_nonpf_alproto_fail = 0;
582 static thread_local uint64_t prefilter_pkt_nonpf_dsize_fail = 0;
583 static thread_local uint64_t prefilter_pkt_nonpf_dport_fail = 0;
584 static thread_local uint64_t prefilter_pkt_nonpf_sids = 0;
585 #define NONPF_PKT_STATS_INCR(s) (s)++
587 #define NONPF_PKT_STATS_INCR(s)
592 #ifdef NONPF_PKT_STATS
593 SCLogDebug(
"prefilter non-pf: called:%" PRIu64
", mask_fail:%" PRIu64
", alproto fail:%" PRIu64
594 ", dport fail:%" PRIu64
", dsize fail:%" PRIu64
", sids:%" PRIu64
595 ", avg sids:%" PRIu64,
596 prefilter_pkt_nonpf_called, prefilter_pkt_nonpf_mask_fail,
597 prefilter_pkt_nonpf_alproto_fail, prefilter_pkt_nonpf_dport_fail,
598 prefilter_pkt_nonpf_dsize_fail, prefilter_pkt_nonpf_sids,
599 prefilter_pkt_nonpf_called ? prefilter_pkt_nonpf_sids / prefilter_pkt_nonpf_called : 0);
610 for (uint32_t i = 0; i < data->
size; i++) {
613 if ((rule_mask & mask) == rule_mask) {
617 const uint32_t
sid = ds->
sid;
618 PrefilterAddSids(&det_ctx->
pmq, &
sid, 1);
626 const uint32_t
sid = ds->
sid;
627 PrefilterAddSids(&det_ctx->
pmq, &
sid, 1);
635 const uint32_t
sid = ds->
sid;
636 PrefilterAddSids(&det_ctx->
pmq, &
sid, 1);
649 static void PrefilterPktNonPFHookFlowStart(
653 PrefilterPktNonPF(det_ctx, p, pectx);
668 for (uint32_t i = 0; i < data->
size; i++) {
672 const uint32_t
sid = ds->
sid;
673 PrefilterAddSids(&det_ctx->
pmq, &
sid, 1);
680 static uint32_t NonPFNamesHash(
HashTable *h,
void *data, uint16_t _len)
682 const char *
str = data;
686 static char NonPFNamesCompare(
void *data1, uint16_t _len1,
void *data2, uint16_t len2)
688 const char *s1 = data1;
689 const char *s2 = data2;
693 static void NonPFNamesFree(
void *data)
711 static uint32_t TxNonPFHash(
HashListTable *h,
void *data, uint16_t _len)
717 static char TxNonPFCompare(
void *data1, uint16_t _len1,
void *data2, uint16_t len2)
725 static void TxNonPFFree(
void *data)
751 for (uint32_t y = 0; y < e->
sigs_cnt; y++) {
775 if (add->
sigs == NULL) {
786 dir == 0 ?
"toserver" :
"toclient");
788 if (engine_name_heap == NULL) {
802 SCLogDebug(
"engine_name_heap %s", engine_name_heap);
826 if (pkt_non_pf_array == NULL) {
829 uint32_t pkt_non_pf_array_size = 0;
831 SCCalloc(max_sids,
sizeof(*frame_non_pf_array));
832 if (frame_non_pf_array == NULL) {
836 uint32_t frame_non_pf_array_size = 0;
839 SCCalloc(max_sids,
sizeof(*pkt_hook_flow_start_non_pf_array));
840 if (pkt_hook_flow_start_non_pf_array == NULL) {
842 SCFree(frame_non_pf_array);
845 uint32_t pkt_hook_flow_start_non_pf_array_size = 0;
847 bool pkt_hook_flow_start_mask_init =
false;
851 if (tx_engines_hash == NULL) {
853 SCFree(pkt_hook_flow_start_non_pf_array);
854 SCFree(frame_non_pf_array);
860 HashTableInit(512, NonPFNamesHash, NonPFNamesCompare, NonPFNamesFree);
863 SCFree(pkt_hook_flow_start_non_pf_array);
864 SCFree(frame_non_pf_array);
871 bool pkt_mask_init =
false;
872 #ifdef NONPF_PKT_STATS
873 uint32_t nonpf_pkt_alproto = 0;
874 uint32_t nonpf_pkt_dsize = 0;
875 uint32_t nonpf_pkt_dport = 0;
878 SCLogDebug(
"app_events_list_id %d", app_events_list_id);
880 SCLogDebug(
"app_state_list_id %d", app_state_list_id);
881 for (uint32_t sig = 0; sig < sgh->
init->
sig_cnt; sig++) {
892 SCLogDebug(
"setting up sid %u for non-prefilter", s->
id);
894 uint8_t frame_type = 0;
895 bool tx_non_pf =
false;
896 bool frame_non_pf =
false;
897 bool pkt_non_pf =
false;
918 pkt_hook_flow_start_non_pf_array[pkt_hook_flow_start_non_pf_array_size].
sid = s->
num;
919 pkt_hook_flow_start_non_pf_array[pkt_hook_flow_start_non_pf_array_size].
value =
value;
920 pkt_hook_flow_start_non_pf_array[pkt_hook_flow_start_non_pf_array_size].
type =
type;
921 pkt_hook_flow_start_non_pf_array[pkt_hook_flow_start_non_pf_array_size].
pkt.sig_mask =
923 pkt_hook_flow_start_non_pf_array_size++;
925 if (pkt_hook_flow_start_mask_init) {
926 pkt_hook_flow_start_mask &= s->
mask;
928 pkt_hook_flow_start_mask = s->
mask;
929 pkt_hook_flow_start_mask_init =
true;
943 SCLogDebug(
"list_id %d buf %p", list_id, buf);
944 if (list_id == app_events_list_id)
950 }
else if (buf->
frame) {
952 f != NULL; f = f->
next) {
955 list_id == (
int)f->sm_list &&
960 frame_type = f->
type;
963 frame_non_pf_array[frame_non_pf_array_size].
sid = s->
num;
964 frame_non_pf_array[frame_non_pf_array_size].
value = s->
alproto;
965 frame_non_pf_array[frame_non_pf_array_size].
frame.type = frame_type;
966 frame_non_pf_array_size++;
984 list_id == (
int)
app->sm_list &&
990 if (list_id == app_state_list_id)
991 sig_list = app_state_list_id;
992 if (TxNonPFAddSig(
de_ctx, tx_engines_hash,
app->alproto,
app->dir,
993 app->progress, sig_list, buf->
name, s) != 0) {
1005 dir == 0 ? STREAM_TOSERVER : STREAM_TOCLIENT);
1019 if (!(tx_non_pf || frame_non_pf)) {
1026 SCLogDebug(
"setting up sid %u for non-prefilter: %s", s->
id,
1027 tx_non_pf ?
"tx engine" : (frame_non_pf ?
"frame engine" :
"pkt engine"));
1038 #ifdef NONPF_PKT_STATS
1044 #ifdef NONPF_PKT_STATS
1050 #ifdef NONPF_PKT_STATS
1051 nonpf_pkt_alproto++;
1055 pkt_non_pf_array[pkt_non_pf_array_size].
sid = s->
num;
1056 pkt_non_pf_array[pkt_non_pf_array_size].
value =
value;
1057 pkt_non_pf_array[pkt_non_pf_array_size].
type =
type;
1058 pkt_non_pf_array[pkt_non_pf_array_size].
pkt.sig_mask = s->
mask;
1059 pkt_non_pf_array_size++;
1061 if (pkt_mask_init) {
1062 pkt_mask &= s->
mask;
1065 pkt_mask_init =
true;
1074 SCLogDebug(
"%s engine for %s hook %d has %u non-pf sigs",
1086 if (t->
sig_list == app_state_list_id) {
1088 engine_progress = -1;
1096 for (uint32_t i = 0; i < t->
sigs_cnt; i++) {
1100 (
void *)data, PrefilterNonPFDataFree, t->
engine_name) < 0) {
1106 tx_engines_hash = NULL;
1108 if (pkt_non_pf_array_size) {
1110 SCCalloc(1,
sizeof(*data) + pkt_non_pf_array_size *
sizeof(data->
array[0]));
1113 data->
size = pkt_non_pf_array_size;
1114 memcpy((uint8_t *)&data->
array, pkt_non_pf_array,
1115 pkt_non_pf_array_size *
sizeof(data->
array[0]));
1118 PrefilterNonPFDataFree,
"packet:non_pf") < 0) {
1123 if (pkt_hook_flow_start_non_pf_array_size) {
1125 1,
sizeof(*data) + pkt_hook_flow_start_non_pf_array_size *
sizeof(data->
array[0]));
1128 data->
size = pkt_hook_flow_start_non_pf_array_size;
1129 memcpy((uint8_t *)&data->
array, pkt_hook_flow_start_non_pf_array,
1130 pkt_hook_flow_start_non_pf_array_size *
sizeof(data->
array[0]));
1131 SCLogDebug(
"packet:flow_start:non_pf added with %u rules", data->
size);
1134 PrefilterPktNonPFHookFlowStart,
1136 pkt_hook_flow_start_mask, hook, (
void *)data, PrefilterNonPFDataFree,
1137 "packet:flow_start:non_pf") < 0) {
1142 if (frame_non_pf_array_size) {
1143 SCLogDebug(
"%u frame non-pf sigs", frame_non_pf_array_size);
1145 SCCalloc(1,
sizeof(*data) + frame_non_pf_array_size *
sizeof(data->
array[0]));
1148 data->
size = frame_non_pf_array_size;
1149 memcpy((uint8_t *)&data->
array, frame_non_pf_array,
1150 frame_non_pf_array_size *
sizeof(data->
array[0]));
1152 FRAME_ANY_TYPE, (
void *)data, PrefilterNonPFDataFree,
"frame:non_pf") < 0) {
1158 SCFree(pkt_hook_flow_start_non_pf_array);
1159 pkt_hook_flow_start_non_pf_array = NULL;
1160 SCFree(pkt_non_pf_array);
1161 pkt_non_pf_array = NULL;
1162 SCFree(frame_non_pf_array);
1163 frame_non_pf_array = NULL;
1167 if (tx_engines_hash) {
1170 SCFree(pkt_hook_flow_start_non_pf_array);
1171 SCFree(pkt_non_pf_array);
1172 SCFree(frame_non_pf_array);
1180 FatalError(
"failed to set up pattern matching");
1194 if (SetupNonPrefilter(
de_ctx, sgh) != 0) {
1224 if (el->
next == NULL) {
1253 if (el->
next == NULL) {
1270 uint16_t local_id = 0;
1285 PrefilterSetupRuleGroupSortHelper);
1294 int last_tx_progress = 0;
1295 bool last_tx_progress_set =
false;
1308 last_tx_progress_set =
true;
1309 prev_engine = engine;
1325 SCLogDebug(
"engine: gid %u alproto %s tx_min_progress %d is_last %s "
1326 "is_last_for_progress %s",
1328 engine->
is_last ?
"true" :
"false",
1356 if (el->
next == NULL) {
1374 uint16_t local_id = 0;
1385 SCLogDebug(
"sgh %p max local_id %u", sgh, local_id);
1393 static uint32_t PrefilterStoreHashFunc(
HashListTable *ht,
void *data, uint16_t datalen)
1397 uint32_t hash = strlen(
ctx->name);
1399 for (
size_t u = 0; u < strlen(
ctx->name); u++) {
1400 hash +=
ctx->name[u];
1407 static char PrefilterStoreCompareFunc(
void *data1, uint16_t len1,
1408 void *data2, uint16_t len2)
1412 return (strcmp(ctx1->
name, ctx2->
name) == 0);
1415 static void PrefilterStoreFreeFunc(
void *ptr)
1432 PrefilterStoreHashFunc,
1433 PrefilterStoreCompareFunc,
1434 PrefilterStoreFreeFunc);
1439 const char *
name,
void (*FreeFunc)(
void *))
1482 if (
ctx->id ==
id) {
1530 const uint8_t *data = buffer->
inspect;
1535 if (data != NULL && data_len >= mpm_ctx->
minlen) {
1537 mpm_ctx, &det_ctx->
mtc, &det_ctx->
pmq, data, data_len);
1542 static void PrefilterGenericMpmFree(
void *ptr)
1560 mpm_reg->
app_v2.alproto, mpm_reg->
app_v2.tx_min_progress,
1561 pectx, PrefilterGenericMpmFree, mpm_reg->
pname);
1568 static void PrefilterMultiGenericMpmFree(
void *ptr)
1582 uint32_t local_id = 0;
1587 ctx->GetData(det_ctx,
ctx->transforms, f,
flags, txv,
ctx->list_id, local_id);
1614 mpm_reg->
app_v2.tx_min_progress, pectx, PrefilterMultiGenericMpmFree, mpm_reg->
pname);
1639 Packet *p,
const void *pectx)
1653 const uint8_t *data = buffer->
inspect;
1658 if (data != NULL && data_len >= mpm_ctx->
minlen) {
1660 mpm_ctx, &det_ctx->
mtc, &det_ctx->
pmq, data, data_len);
1665 static void PrefilterMpmPktFree(
void *ptr)
1684 de_ctx, sgh, PrefilterMpmPkt, 0, hook, pectx, PrefilterMpmPktFree, mpm_reg->
pname);
1691 #define QUEUE_STEP 16
#define HashListTableGetListData(hb)
int PrefilterGenericMpmPktRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
PrefilterEngine * tx_engines
struct AppLayerTxData * tx_data_ptr
void(* PrefilterPostRule)(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f)
SigTableElmt * sigmatch_table
void PostRuleMatchWorkQueueAppend(DetectEngineThreadCtx *det_ctx, const Signature *s, const int type, const uint32_t value)
const char * AppLayerParserGetStateNameById(uint8_t ipproto, AppProto alproto, const int id, const uint8_t direction)
int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
Prepare the pattern matcher ctx in a sig group head.
struct PrefilterMpmPktCtx PrefilterMpmPktCtx
union PrefilterEngine_::@101 ctx
#define PREFILTER_PROFILING_END(ctx, profile_id)
uint32_t rule_id_array_cnt
Container for matching data for a signature group.
@ DETECT_EVENT_POST_MATCH_QUEUE_FAILED
struct HtpBodyChunk_ * next
InspectionBufferGetDataPtr GetData
struct DetectBufferMpmRegistry_::@87::@90 pkt_v1
int PrefilterAppendEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh, PrefilterPktFn PrefilterFunc, SignatureMask mask, enum SignatureHookPkt hook, void *pectx, void(*FreeFunc)(void *pectx), const char *name)
#define PREFILTER_PROFILING_START(det_ctx)
InspectionBuffer *(* InspectionBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id)
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
main detection engine ctx
@ SIGNATURE_HOOK_PKT_NOT_SET
HashListTableBucket * HashListTableGetListHead(HashListTable *ht)
InspectionBuffer *(* InspectionBufferGetPktDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Packet *p, const int list_id)
void PrefilterDeinit(DetectEngineCtx *de_ctx)
void DetectEngineSetEvent(DetectEngineThreadCtx *det_ctx, uint8_t e)
one time registration of keywords at start up
struct DetectPort_ * next
PrefilterEngine * payload_engines
enum DetectEnginePrefilterSetting prefilter_setting
#define PKT_NOPAYLOAD_INSPECTION
struct PrefilterNonPFDataSig array[]
#define PACKET_PROFILING_DETECT_END(p, id)
void * HashListTableLookup(HashListTable *ht, void *data, uint16_t datalen)
void(* Free)(void *pectx)
char StringHashCompareFunc(void *data1, uint16_t datalen1, void *data2, uint16_t datalen2)
#define SIG_FLAG_TOCLIENT
int PrefilterAppendFrameEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh, PrefilterFrameFn PrefilterFrameFunc, AppProto alproto, uint8_t frame_type, void *pectx, void(*FreeFunc)(void *pectx), const char *name)
DetectEngineTransforms transforms
HashTable * non_pf_engine_names
int PrefilterMultiGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
int DetectBufferTypeGetByName(const char *name)
int HashListTableAdd(HashListTable *ht, void *data, uint16_t datalen)
bool is_last_for_progress
struct PrefilterEngineList_ * next
int(* SetupPrefilter)(DetectEngineCtx *de_ctx, struct SigGroupHead_ *sgh)
@ SIGNATURE_HOOK_TYPE_APP
AppLayerParserState * alparser
#define HashListTableGetListNext(hb)
union PrefilterEngine_::@102 cb
HashListTable * prefilter_hash_table
#define SIG_FLAG_TOSERVER
HashListTable * HashListTableInit(uint32_t size, uint32_t(*Hash)(struct HashListTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
struct SignatureHook_::@84::@86 pkt
enum SignatureHookPkt pkt_hook
struct PrefilterEngine_::@101::@103 pkt
void Prefilter(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const uint8_t flags, const SignatureMask mask)
const char * PrefilterStoreGetName(const uint32_t id)
PrefilterEngineList * tx_engines
#define DetectEngineGetMaxSigId(de_ctx)
PrefilterFrameFn PrefilterFrame
PrefilterTxFn PrefilterTx
bool * sm_types_prefilter
InspectionBufferGetPktDataPtr GetData
#define PKT_DETECT_HAS_STREAMDATA
#define FLOW_PKT_TOCLIENT_FIRST
struct DetectBufferMpmRegistry_::@87::@89 app_v2
struct PrefilterMpmCtx PrefilterMpmCtx
#define NONPF_PKT_STATS_INCR(s)
DetectEngineFrameInspectionEngine * frame_inspect_engines
int PrefilterGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
void(* PrefilterFrameFn)(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, const struct Frames *frames, const struct Frame *frame)
int HashTableAdd(HashTable *ht, void *data, uint16_t datalen)
SigGroupHeadInitData * init
const DetectEngineTransforms * transforms
struct SignatureHook_::@84::@85 app
const DetectBufferType * DetectEngineBufferTypeGetById(const DetectEngineCtx *de_ctx, const int id)
PrefilterFrameFn PrefilterFrame
SignatureInitData * init_data
void(* PrefilterTxFn)(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *tx, const uint64_t tx_id, const AppLayerTxData *tx_data, const uint8_t flags)
uint32_t(* Search)(const struct MpmCtx_ *, struct MpmThreadCtx_ *, PrefilterRuleStore *, const uint8_t *, uint32_t)
PrefilterEngine * frame_engines
int PrefilterAppendPayloadEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh, PrefilterPktFn PrefilterFunc, void *pectx, void(*FreeFunc)(void *pectx), const char *name)
#define SCRealloc(ptr, sz)
PrefilterEngineList * pkt_engines
PrefilterEngine * post_rule_match_engines
struct AppLayerTxData AppLayerTxData
#define PREFILTER_PROFILING_ADD_BYTES(det_ctx, bytes)
PrefilterEngineList * frame_engines
PrefilterEngineList * payload_engines
void HashListTableFree(HashListTable *ht)
#define SCMallocAligned(size, align)
DetectEnginePrefilterSetting
enum SignatureHookType type
void(* PrefilterPostRule)(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f)
void PrefilterCleanupRuleGroup(const DetectEngineCtx *de_ctx, SigGroupHead *sgh)
PostRuleMatchWorkQueueItem * q
struct PrefilterNonPFDataSig::@53::@57 app
@ SIGNATURE_HOOK_TYPE_PKT
const DetectEngineTransforms * transforms
int PrefilterAppendTxEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh, PrefilterTxFn PrefilterTxFunc, AppProto alproto, int tx_min_progress, void *pectx, void(*FreeFunc)(void *pectx), const char *name)
void(* PrefilterPktFn)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
InspectionMultiBufferGetDataPtr GetData
SignatureInitDataBuffer * buffers
DetectEngineAppInspectionEngine * app_inspect_engines
int PrefilterAppendPostRuleEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh, void(*PrefilterPostRuleFunc)(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f), void *pectx, void(*FreeFunc)(void *pectx), const char *name)
void PrefilterInit(DetectEngineCtx *de_ctx)
#define PACKET_PROFILING_DETECT_START(p, id)
const DetectEngineTransforms * transforms
PrefilterEngineList * post_rule_match_engines
HashTable * HashTableInit(uint32_t size, uint32_t(*Hash)(struct HashTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
int PrefilterSetupRuleGroup(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
@ SIGNATURE_HOOK_PKT_FLOW_START
void PrefilterPostRuleMatch(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, Flow *f)
invoke post-rule match "prefilter" engines
void * DetectGetInnerTx(void *tx_ptr, AppProto alproto, AppProto engine_alproto, uint8_t flow_flags)
struct PrefilterNonPFDataSig::@53::@55 pkt
struct PrefilterMpm PrefilterMpm
PrefilterEngine * pkt_engines
PrefilterTxFn PrefilterTx
AppProto alproto
application level protocol
struct PrefilterNonPFDataSig::@53::@56 frame
void PrefilterFreeEnginesList(PrefilterEngineList *list)
#define FLOW_PKT_TOSERVER_FIRST
#define DEBUG_VALIDATE_BUG_ON(exp)
#define SIG_FLAG_PREFILTER
union SignatureHook_::@84 t
void DetectRunPrefilterTx(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const uint8_t ipproto, const uint8_t flow_flags, const AppProto alproto, void *alstate, DetectTransaction *tx)
run prefilter engines on a transaction
PostRuleMatchWorkQueue post_rule_work_queue
uint32_t StringHashDjb2(const uint8_t *data, uint32_t datalen)
void PrefilterPktNonPFStatsDump(void)
struct PrefilterNonPFDataSig * sigs