suricata
detect-engine-prefilter.c
Go to the documentation of this file.
1 /* Copyright (C) 2016-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Prefilter engine
24  *
25  * Prefilter engines have as purpose to check for a critical common part of
26  * a set of rules. If the condition is present in the traffic, the rules
27  * will have to be inspected individually. Otherwise, the rules can be
28  * skipped.
29  *
30  * The best example of this is the MPM. From each rule take a pattern and
31  * add it to the MPM state machine. Inspect that in one step and only
32  * individually inspect the rules that had a match in MPM.
33  *
34  * This prefilter API is designed to abstract this logic so that it becomes
35  * easier to add other types of prefilters.
36  *
37  * The prefilter engines are structured as a simple list of engines. Each
38  * engine checks for a condition using it's callback function and private
39  * data. It then adds the rule match candidates to the PrefilterRuleStore
40  * structure.
41  *
42  * After the engines have run the resulting list of match candidates is
43  * sorted by the rule id's so that the individual inspection happens in
44  * the correct order.
45  */
46 
47 #include "suricata-common.h"
48 #include "suricata.h"
49 
50 #include "detect-engine.h"
52 #include "detect-engine-mpm.h"
53 #include "detect-engine-frame.h"
54 
55 #include "app-layer-parser.h"
56 #include "app-layer-htp.h"
57 
58 #include "util-profiling.h"
59 #include "util-validate.h"
60 
61 static int PrefilterStoreGetId(DetectEngineCtx *de_ctx,
62  const char *name, void (*FreeFunc)(void *));
63 static const PrefilterStore *PrefilterStoreGetStore(const DetectEngineCtx *de_ctx,
64  const uint32_t id);
65 
66 static inline void QuickSortSigIntId(SigIntId *sids, uint32_t n)
67 {
68  if (n < 2)
69  return;
70  SigIntId p = sids[n / 2];
71  SigIntId *l = sids;
72  SigIntId *r = sids + n - 1;
73  while (l <= r) {
74  if (*l < p)
75  l++;
76  else if (*r > p)
77  r--;
78  else {
79  SigIntId t = *l;
80  *l = *r;
81  *r = t;
82  l++;
83  r--;
84  }
85  }
86  QuickSortSigIntId(sids, r - sids + 1);
87  QuickSortSigIntId(l, sids + n - l);
88 }
89 
90 /**
91  * \brief run prefilter engines on a transaction
92  */
94  const SigGroupHead *sgh,
95  Packet *p,
96  const uint8_t ipproto,
97  const uint8_t flow_flags,
98  const AppProto alproto,
99  void *alstate,
100  DetectTransaction *tx)
101 {
102  /* reset rule store */
103  det_ctx->pmq.rule_id_array_cnt = 0;
104 
105  SCLogDebug("packet %" PRIu64 " tx %p progress %d tx->detect_progress %02x", p->pcap_cnt,
106  tx->tx_ptr, tx->tx_progress, tx->detect_progress);
107 
108  PrefilterEngine *engine = sgh->tx_engines;
109  do {
110  // based on flow alproto, and engine, we get right tx_ptr
111  void *tx_ptr = DetectGetInnerTx(tx->tx_ptr, alproto, engine->alproto, flow_flags);
112  if (tx_ptr == NULL) {
113  // incompatible engine->alproto with flow alproto
114  goto next;
115  }
116  if (engine->ctx.tx_min_progress > tx->tx_progress)
117  break;
118  if (tx->tx_progress > engine->ctx.tx_min_progress) {
119  /* if state value is at or beyond engine state, we can skip it. It means we ran at
120  * least once already. */
121  if (tx->detect_progress > engine->ctx.tx_min_progress) {
122  SCLogDebug("tx already marked progress as beyond engine: %u > %u",
123  tx->detect_progress, engine->ctx.tx_min_progress);
124  goto next;
125  }
126  }
127 
128  PREFILTER_PROFILING_START(det_ctx);
129  engine->cb.PrefilterTx(
130  det_ctx, engine->pectx, p, p->flow, tx_ptr, tx->tx_id, tx->tx_data_ptr, flow_flags);
131  PREFILTER_PROFILING_END(det_ctx, engine->gid);
132 
133  if (tx->tx_progress > engine->ctx.tx_min_progress && engine->is_last_for_progress) {
134  /* track with an offset of one, so that tx->progress 0 complete is tracked
135  * as 1, progress 1 as 2, etc. This is to allow 0 to mean: nothing tracked, even
136  * though a parser may use 0 as a valid value. */
137  tx->detect_progress = engine->ctx.tx_min_progress + 1;
138  SCLogDebug("tx->tx_progress %d engine->ctx.tx_min_progress %d "
139  "engine->is_last_for_progress %d => tx->detect_progress updated to %02x",
140  tx->tx_progress, engine->ctx.tx_min_progress, engine->is_last_for_progress,
141  tx->detect_progress);
142  }
143  next:
144  if (engine->is_last)
145  break;
146  engine++;
147  } while (1);
148 
149  /* Sort the rule list to lets look at pmq.
150  * NOTE due to merging of 'stream' pmqs we *MAY* have duplicate entries */
151  if (likely(det_ctx->pmq.rule_id_array_cnt > 1)) {
153  QuickSortSigIntId(det_ctx->pmq.rule_id_array, det_ctx->pmq.rule_id_array_cnt);
155  }
156 }
157 
158 void Prefilter(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p,
159  const uint8_t flags, const SignatureMask mask)
160 {
161  SCEnter();
162 #if 0
163  /* TODO review this check */
164  SCLogDebug("sgh %p frame_engines %p", sgh, sgh->frame_engines);
165  if (p->proto == IPPROTO_TCP && sgh->frame_engines && p->flow &&
166  p->flow->alproto != ALPROTO_UNKNOWN && p->flow->alparser != NULL) {
168  PrefilterFrames(det_ctx, sgh, p, flags, p->flow->alproto);
170  }
171 #endif
172  if (sgh->pkt_engines) {
174  /* run packet engines */
175  PrefilterEngine *engine = sgh->pkt_engines;
176  do {
177  if ((engine->ctx.pkt_mask & mask) == engine->ctx.pkt_mask) {
178  PREFILTER_PROFILING_START(det_ctx);
179  engine->cb.Prefilter(det_ctx, p, engine->pectx);
180  PREFILTER_PROFILING_END(det_ctx, engine->gid);
181  }
182 
183  if (engine->is_last)
184  break;
185  engine++;
186  } while (1);
188  }
189 
190  /* run payload inspecting engines */
191  if (sgh->payload_engines &&
194  {
196  PrefilterEngine *engine = sgh->payload_engines;
197  while (1) {
198  PREFILTER_PROFILING_START(det_ctx);
199  engine->cb.Prefilter(det_ctx, p, engine->pectx);
200  PREFILTER_PROFILING_END(det_ctx, engine->gid);
201 
202  if (engine->is_last)
203  break;
204  engine++;
205  }
207  }
208 
209  /* Sort the rule list to lets look at pmq.
210  * NOTE due to merging of 'stream' pmqs we *MAY* have duplicate entries */
211  if (likely(det_ctx->pmq.rule_id_array_cnt > 1)) {
213  QuickSortSigIntId(det_ctx->pmq.rule_id_array, det_ctx->pmq.rule_id_array_cnt);
215  }
216  SCReturn;
217 }
218 
220  SignatureMask mask, void *pectx, void (*FreeFunc)(void *pectx), const char *name)
221 {
222  if (sgh == NULL || PrefilterFunc == NULL || pectx == NULL)
223  return -1;
224 
225  PrefilterEngineList *e = SCMallocAligned(sizeof(*e), CLS);
226  if (e == NULL)
227  return -1;
228  memset(e, 0x00, sizeof(*e));
229 
230  e->Prefilter = PrefilterFunc;
231  e->pectx = pectx;
232  e->Free = FreeFunc;
233  e->pkt_mask = mask;
234 
235  if (sgh->init->pkt_engines == NULL) {
236  sgh->init->pkt_engines = e;
237  } else {
239  while (t->next != NULL) {
240  t = t->next;
241  }
242 
243  t->next = e;
244  e->id = t->id + 1;
245  }
246 
247  e->name = name;
248  e->gid = PrefilterStoreGetId(de_ctx, e->name, e->Free);
249  return 0;
250 }
251 
253  PrefilterPktFn PrefilterFunc, void *pectx, void (*FreeFunc)(void *pectx), const char *name)
254 {
255  if (sgh == NULL || PrefilterFunc == NULL || pectx == NULL)
256  return -1;
257 
258  PrefilterEngineList *e = SCMallocAligned(sizeof(*e), CLS);
259  if (e == NULL)
260  return -1;
261  memset(e, 0x00, sizeof(*e));
262 
263  e->Prefilter = PrefilterFunc;
264  e->pectx = pectx;
265  e->Free = FreeFunc;
266 
267  if (sgh->init->payload_engines == NULL) {
268  sgh->init->payload_engines = e;
269  } else {
271  while (t->next != NULL) {
272  t = t->next;
273  }
274 
275  t->next = e;
276  e->id = t->id + 1;
277  }
278 
279  e->name = name;
280  e->gid = PrefilterStoreGetId(de_ctx, e->name, e->Free);
281  return 0;
282 }
283 
285  PrefilterTxFn PrefilterTxFunc, AppProto alproto, int tx_min_progress, void *pectx,
286  void (*FreeFunc)(void *pectx), const char *name)
287 {
288  if (sgh == NULL || PrefilterTxFunc == NULL || pectx == NULL)
289  return -1;
290 
291  PrefilterEngineList *e = SCMallocAligned(sizeof(*e), CLS);
292  if (e == NULL)
293  return -1;
294  memset(e, 0x00, sizeof(*e));
295 
296  e->PrefilterTx = PrefilterTxFunc;
297  e->pectx = pectx;
298  e->alproto = alproto;
299  // TODO change function prototype ?
300  DEBUG_VALIDATE_BUG_ON(tx_min_progress > UINT8_MAX);
301  e->tx_min_progress = (uint8_t)tx_min_progress;
302  e->Free = FreeFunc;
303 
304  if (sgh->init->tx_engines == NULL) {
305  sgh->init->tx_engines = e;
306  } else {
308  while (t->next != NULL) {
309  t = t->next;
310  }
311 
312  t->next = e;
313  e->id = t->id + 1;
314  }
315 
316  e->name = name;
317  e->gid = PrefilterStoreGetId(de_ctx, e->name, e->Free);
318  return 0;
319 }
320 
322  PrefilterFrameFn PrefilterFrameFunc, AppProto alproto, uint8_t frame_type, void *pectx,
323  void (*FreeFunc)(void *pectx), const char *name)
324 {
325  if (sgh == NULL || PrefilterFrameFunc == NULL || pectx == NULL)
326  return -1;
327 
328  PrefilterEngineList *e = SCMallocAligned(sizeof(*e), CLS);
329  if (e == NULL)
330  return -1;
331  memset(e, 0x00, sizeof(*e));
332 
333  e->frame_type = frame_type;
334  e->alproto = alproto;
335  e->PrefilterFrame = PrefilterFrameFunc;
336  e->pectx = pectx;
337  e->Free = FreeFunc;
338 
339  if (sgh->init->frame_engines == NULL) {
340  sgh->init->frame_engines = e;
341  } else {
343  while (t->next != NULL) {
344  t = t->next;
345  }
346 
347  t->next = e;
348  e->id = t->id + 1;
349  }
350 
351  e->name = name;
352  e->gid = PrefilterStoreGetId(de_ctx, e->name, e->Free);
353  return 0;
354 }
355 
356 static void PrefilterFreeEngineList(PrefilterEngineList *e)
357 {
358  if (e->Free && e->pectx) {
359  e->Free(e->pectx);
360  }
361  SCFreeAligned(e);
362 }
363 
365 {
366  PrefilterEngineList *t = list;
367 
368  while (t != NULL) {
370  PrefilterFreeEngineList(t);
371  t = next;
372  }
373 }
374 
375 static void PrefilterFreeEngines(const DetectEngineCtx *de_ctx, PrefilterEngine *list)
376 {
377  PrefilterEngine *t = list;
378 
379  while (1) {
380  const PrefilterStore *s = PrefilterStoreGetStore(de_ctx, t->gid);
381  if (s && s->FreeFunc && t->pectx) {
382  s->FreeFunc(t->pectx);
383  }
384 
385  if (t->is_last)
386  break;
387  t++;
388  }
389  SCFreeAligned(list);
390 }
391 
393 {
394  if (sgh->pkt_engines) {
395  PrefilterFreeEngines(de_ctx, sgh->pkt_engines);
396  sgh->pkt_engines = NULL;
397  }
398  if (sgh->payload_engines) {
399  PrefilterFreeEngines(de_ctx, sgh->payload_engines);
400  sgh->payload_engines = NULL;
401  }
402  if (sgh->tx_engines) {
403  PrefilterFreeEngines(de_ctx, sgh->tx_engines);
404  sgh->tx_engines = NULL;
405  }
406  if (sgh->frame_engines) {
407  PrefilterFreeEngines(de_ctx, sgh->frame_engines);
408  sgh->frame_engines = NULL;
409  }
410 }
411 
412 static int PrefilterSetupRuleGroupSortHelper(const void *a, const void *b)
413 {
414  const PrefilterEngine *s0 = a;
415  const PrefilterEngine *s1 = b;
416  if (s1->ctx.tx_min_progress == s0->ctx.tx_min_progress) {
417  if (s1->alproto == s0->alproto) {
418  return s0->local_id > s1->local_id ? 1 : -1;
419  } else {
420  return s0->alproto > s1->alproto ? 1 : -1;
421  }
422  } else {
423  return s0->ctx.tx_min_progress > s1->ctx.tx_min_progress ? 1 : -1;
424  }
425 }
426 
428 {
429  int r = PatternMatchPrepareGroup(de_ctx, sgh);
430  if (r != 0) {
431  FatalError("failed to set up pattern matching");
432  }
433 
434  /* set up engines if needed - when prefilter is set to auto we run
435  * all engines, otherwise only those that have been forced by the
436  * prefilter keyword. */
438  for (int i = 0; i < DETECT_TBLSIZE; i++)
439  {
440  if (sigmatch_table[i].SetupPrefilter != NULL &&
441  (setting == DETECT_PREFILTER_AUTO ||
443  {
445  }
446  }
447 
448  /* we have lists of engines in sgh->init now. Lets setup the
449  * match arrays */
451  if (sgh->init->pkt_engines != NULL) {
452  uint32_t cnt = 0;
453  for (el = sgh->init->pkt_engines ; el != NULL; el = el->next) {
454  cnt++;
455  }
457  if (sgh->pkt_engines == NULL) {
458  return;
459  }
460  memset(sgh->pkt_engines, 0x00, (cnt * sizeof(PrefilterEngine)));
461 
462  PrefilterEngine *e = sgh->pkt_engines;
463  for (el = sgh->init->pkt_engines ; el != NULL; el = el->next) {
464  e->local_id = el->id;
465  e->cb.Prefilter = el->Prefilter;
466  e->ctx.pkt_mask = el->pkt_mask;
467  e->pectx = el->pectx;
468  el->pectx = NULL; // e now owns the ctx
469  e->gid = el->gid;
470  if (el->next == NULL) {
471  e->is_last = true;
472  }
473  e++;
474  }
475  }
476  if (sgh->init->payload_engines != NULL) {
477  uint32_t cnt = 0;
478  for (el = sgh->init->payload_engines ; el != NULL; el = el->next) {
479  cnt++;
480  }
482  if (sgh->payload_engines == NULL) {
483  return;
484  }
485  memset(sgh->payload_engines, 0x00, (cnt * sizeof(PrefilterEngine)));
486 
488  for (el = sgh->init->payload_engines ; el != NULL; el = el->next) {
489  e->local_id = el->id;
490  e->cb.Prefilter = el->Prefilter;
491  e->ctx.pkt_mask = el->pkt_mask;
492  e->pectx = el->pectx;
493  el->pectx = NULL; // e now owns the ctx
494  e->gid = el->gid;
495  if (el->next == NULL) {
496  e->is_last = true;
497  }
498  e++;
499  }
500  }
501  if (sgh->init->tx_engines != NULL) {
502  uint32_t cnt = 0;
503  for (el = sgh->init->tx_engines ; el != NULL; el = el->next) {
504  cnt++;
505  }
506  sgh->tx_engines = SCMallocAligned(cnt * sizeof(PrefilterEngine), CLS);
507  if (sgh->tx_engines == NULL) {
508  return;
509  }
510  memset(sgh->tx_engines, 0x00, (cnt * sizeof(PrefilterEngine)));
511 
512  uint16_t local_id = 0;
513  PrefilterEngine *e = sgh->tx_engines;
514  for (el = sgh->init->tx_engines ; el != NULL; el = el->next) {
515  e->local_id = local_id++;
516  e->alproto = el->alproto;
518  e->cb.PrefilterTx = el->PrefilterTx;
519  e->pectx = el->pectx;
520  el->pectx = NULL; // e now owns the ctx
521  e->gid = el->gid;
522  e++;
523  }
524 
525  /* sort by tx_min_progress, then alproto, then local_id */
526  qsort(sgh->tx_engines, local_id, sizeof(PrefilterEngine),
527  PrefilterSetupRuleGroupSortHelper);
528  sgh->tx_engines[local_id - 1].is_last = true;
529  sgh->tx_engines[local_id - 1].is_last_for_progress = true;
530 
531  PrefilterEngine *engine;
532 
533  /* per alproto to set is_last_for_progress per alproto because the inspect
534  * loop skips over engines that are not the correct alproto */
535  for (AppProto a = ALPROTO_FAILED + 1; a < g_alproto_max; a++) {
536  int last_tx_progress = 0;
537  bool last_tx_progress_set = false;
538  PrefilterEngine *prev_engine = NULL;
539  engine = sgh->tx_engines;
540  do {
541  BUG_ON(engine->ctx.tx_min_progress < last_tx_progress);
542  if (engine->alproto == a) {
543  if (last_tx_progress_set && engine->ctx.tx_min_progress > last_tx_progress) {
544  if (prev_engine) {
545  prev_engine->is_last_for_progress = true;
546  }
547  }
548 
549  last_tx_progress_set = true;
550  prev_engine = engine;
551  } else {
552  if (prev_engine) {
553  prev_engine->is_last_for_progress = true;
554  }
555  }
556  last_tx_progress = engine->ctx.tx_min_progress;
557  if (engine->is_last)
558  break;
559  engine++;
560  } while (1);
561  }
562 #ifdef DEBUG
563  SCLogDebug("sgh %p", sgh);
564  engine = sgh->tx_engines;
565  do {
566  SCLogDebug("engine: gid %u alproto %s tx_min_progress %d is_last %s "
567  "is_last_for_progress %s",
568  engine->gid, AppProtoToString(engine->alproto), engine->ctx.tx_min_progress,
569  engine->is_last ? "true" : "false",
570  engine->is_last_for_progress ? "true" : "false");
571  if (engine->is_last)
572  break;
573  engine++;
574  } while (1);
575 #endif
576  }
577  if (sgh->init->frame_engines != NULL) {
578  uint32_t cnt = 0;
579  for (el = sgh->init->frame_engines; el != NULL; el = el->next) {
580  cnt++;
581  }
583  if (sgh->frame_engines == NULL) {
584  return;
585  }
586  memset(sgh->frame_engines, 0x00, (cnt * sizeof(PrefilterEngine)));
587 
588  PrefilterEngine *e = sgh->frame_engines;
589  for (el = sgh->init->frame_engines; el != NULL; el = el->next) {
590  e->local_id = el->id;
591  e->ctx.frame_type = el->frame_type;
593  e->alproto = el->alproto;
594  e->pectx = el->pectx;
595  el->pectx = NULL; // e now owns the ctx
596  e->gid = el->gid;
597  if (el->next == NULL) {
598  e->is_last = true;
599  }
600  e++;
601  }
602  }
603 }
604 
605 /* hash table for assigning a unique id to each engine type. */
606 
607 static uint32_t PrefilterStoreHashFunc(HashListTable *ht, void *data, uint16_t datalen)
608 {
609  PrefilterStore *ctx = data;
610 
611  uint32_t hash = strlen(ctx->name);
612 
613  for (size_t u = 0; u < strlen(ctx->name); u++) {
614  hash += ctx->name[u];
615  }
616 
617  hash %= ht->array_size;
618  return hash;
619 }
620 
621 static char PrefilterStoreCompareFunc(void *data1, uint16_t len1,
622  void *data2, uint16_t len2)
623 {
624  PrefilterStore *ctx1 = data1;
625  PrefilterStore *ctx2 = data2;
626  return (strcmp(ctx1->name, ctx2->name) == 0);
627 }
628 
629 static void PrefilterStoreFreeFunc(void *ptr)
630 {
631  SCFree(ptr);
632 }
633 
635 {
636  if (de_ctx->prefilter_hash_table != NULL) {
638  }
639 }
640 
642 {
644 
646  PrefilterStoreHashFunc,
647  PrefilterStoreCompareFunc,
648  PrefilterStoreFreeFunc);
650 }
651 
652 static int PrefilterStoreGetId(DetectEngineCtx *de_ctx,
653  const char *name, void (*FreeFunc)(void *))
654 {
655  PrefilterStore ctx = { name, FreeFunc, 0 };
656 
658 
659  SCLogDebug("looking up %s", name);
660 
662  if (rctx != NULL) {
663  return rctx->id;
664  }
665 
666  PrefilterStore *actx = SCCalloc(1, sizeof(*actx));
667  if (actx == NULL) {
668  return -1;
669  }
670 
671  actx->name = name;
672  actx->FreeFunc = FreeFunc;
673  actx->id = de_ctx->prefilter_id++;
674  SCLogDebug("prefilter engine %s has profile id %u", actx->name, actx->id);
675 
676  int ret = HashListTableAdd(de_ctx->prefilter_hash_table, actx, 0);
677  if (ret != 0) {
678  SCFree(actx);
679  return -1;
680  }
681 
682  int r = actx->id;
683  return r;
684 }
685 
686 /** \warning slow */
687 static const PrefilterStore *PrefilterStoreGetStore(const DetectEngineCtx *de_ctx,
688  const uint32_t id)
689 {
690 
691  const PrefilterStore *store = NULL;
692  if (de_ctx->prefilter_hash_table != NULL) {
694  for ( ; hb != NULL; hb = HashListTableGetListNext(hb)) {
696  if (ctx->id == id) {
697  store = ctx;
698  break;
699  }
700  }
701  }
702  return store;
703 }
704 
705 #ifdef PROFILING
706 const char *PrefilterStoreGetName(const uint32_t id)
707 {
708  return NULL;
709 }
710 #endif
711 
712 #include "util-print.h"
713 
714 typedef struct PrefilterMpmCtx {
715  int list_id;
717  const MpmCtx *mpm_ctx;
720 
721 /** \brief Generic Mpm prefilter callback
722  *
723  * \param det_ctx detection engine thread ctx
724  * \param p packet to inspect
725  * \param f flow to inspect
726  * \param txv tx to inspect
727  * \param pectx inspection context
728  */
729 static void PrefilterMpm(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f,
730  void *txv, const uint64_t idx, const AppLayerTxData *_txd, const uint8_t flags)
731 {
732  SCEnter();
733 
734  const PrefilterMpmCtx *ctx = (const PrefilterMpmCtx *)pectx;
735  const MpmCtx *mpm_ctx = ctx->mpm_ctx;
736  SCLogDebug("running on list %d", ctx->list_id);
737 
738  InspectionBuffer *buffer = ctx->GetData(det_ctx, ctx->transforms,
739  f, flags, txv, ctx->list_id);
740  if (buffer == NULL)
741  return;
742 
743  const uint32_t data_len = buffer->inspect_len;
744  const uint8_t *data = buffer->inspect;
745 
746  SCLogDebug("mpm'ing buffer:");
747  //PrintRawDataFp(stdout, data, data_len);
748 
749  if (data != NULL && data_len >= mpm_ctx->minlen) {
750  (void)mpm_table[mpm_ctx->mpm_type].Search(
751  mpm_ctx, &det_ctx->mtc, &det_ctx->pmq, data, data_len);
752  PREFILTER_PROFILING_ADD_BYTES(det_ctx, data_len);
753  }
754 }
755 
756 static void PrefilterGenericMpmFree(void *ptr)
757 {
758  SCFree(ptr);
759 }
760 
762  const DetectBufferMpmRegistry *mpm_reg, int list_id)
763 {
764  SCEnter();
765  PrefilterMpmCtx *pectx = SCCalloc(1, sizeof(*pectx));
766  if (pectx == NULL)
767  return -1;
768  pectx->list_id = list_id;
769  pectx->GetData = mpm_reg->app_v2.GetData;
770  pectx->mpm_ctx = mpm_ctx;
771  pectx->transforms = &mpm_reg->transforms;
772 
774  mpm_reg->app_v2.alproto, mpm_reg->app_v2.tx_min_progress,
775  pectx, PrefilterGenericMpmFree, mpm_reg->pname);
776  if (r != 0) {
777  SCFree(pectx);
778  }
779  return r;
780 }
781 
782 static void PrefilterMultiGenericMpmFree(void *ptr)
783 {
784  // PrefilterMpmListId
785  SCFree(ptr);
786 }
787 
788 static void PrefilterMultiMpm(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f,
789  void *txv, const uint64_t idx, const AppLayerTxData *_txd, const uint8_t flags)
790 {
791  SCEnter();
792 
793  const PrefilterMpmListId *ctx = (const PrefilterMpmListId *)pectx;
794  const MpmCtx *mpm_ctx = ctx->mpm_ctx;
795  SCLogDebug("running on list %d", ctx->list_id);
796  uint32_t local_id = 0;
797 
798  do {
799  // loop until we get a NULL
800  InspectionBuffer *buffer =
801  ctx->GetData(det_ctx, ctx->transforms, f, flags, txv, ctx->list_id, local_id);
802  if (buffer == NULL)
803  break;
804 
805  if (buffer->inspect_len >= mpm_ctx->minlen) {
806  (void)mpm_table[mpm_ctx->mpm_type].Search(
807  mpm_ctx, &det_ctx->mtc, &det_ctx->pmq, buffer->inspect, buffer->inspect_len);
808  PREFILTER_PROFILING_ADD_BYTES(det_ctx, buffer->inspect_len);
809  }
810 
811  local_id++;
812  } while (1);
813 }
814 
816  const DetectBufferMpmRegistry *mpm_reg, int list_id)
817 {
818  SCEnter();
819  PrefilterMpmListId *pectx = SCCalloc(1, sizeof(*pectx));
820  if (pectx == NULL)
821  return -1;
822  pectx->list_id = list_id;
823  pectx->GetData = mpm_reg->app_v2.GetMultiData;
824  pectx->mpm_ctx = mpm_ctx;
825  pectx->transforms = &mpm_reg->transforms;
826 
827  int r = PrefilterAppendTxEngine(de_ctx, sgh, PrefilterMultiMpm, mpm_reg->app_v2.alproto,
828  mpm_reg->app_v2.tx_min_progress, pectx, PrefilterMultiGenericMpmFree, mpm_reg->pname);
829  if (r != 0) {
830  SCFree(pectx);
831  }
832  return r;
833 }
834 
835 /* generic mpm for pkt engines */
836 
837 typedef struct PrefilterMpmPktCtx {
838  int list_id;
840  const MpmCtx *mpm_ctx;
843 
844 /** \brief Generic Mpm prefilter callback
845  *
846  * \param det_ctx detection engine thread ctx
847  * \param p packet to inspect
848  * \param f flow to inspect
849  * \param txv tx to inspect
850  * \param pectx inspection context
851  */
852 static void PrefilterMpmPkt(DetectEngineThreadCtx *det_ctx,
853  Packet *p, const void *pectx)
854 {
855  SCEnter();
856 
857  const PrefilterMpmPktCtx *ctx = (const PrefilterMpmPktCtx *)pectx;
858  const MpmCtx *mpm_ctx = ctx->mpm_ctx;
859  SCLogDebug("running on list %d", ctx->list_id);
860 
861  InspectionBuffer *buffer = ctx->GetData(det_ctx, ctx->transforms,
862  p, ctx->list_id);
863  if (buffer == NULL)
864  return;
865 
866  const uint32_t data_len = buffer->inspect_len;
867  const uint8_t *data = buffer->inspect;
868 
869  SCLogDebug("mpm'ing buffer:");
870  //PrintRawDataFp(stdout, data, data_len);
871 
872  if (data != NULL && data_len >= mpm_ctx->minlen) {
873  (void)mpm_table[mpm_ctx->mpm_type].Search(
874  mpm_ctx, &det_ctx->mtc, &det_ctx->pmq, data, data_len);
875  PREFILTER_PROFILING_ADD_BYTES(det_ctx, data_len);
876  }
877 }
878 
879 static void PrefilterMpmPktFree(void *ptr)
880 {
881  SCFree(ptr);
882 }
883 
885  const DetectBufferMpmRegistry *mpm_reg, int list_id)
886 {
887  SCEnter();
888  PrefilterMpmPktCtx *pectx = SCCalloc(1, sizeof(*pectx));
889  if (pectx == NULL)
890  return -1;
891  pectx->list_id = list_id;
892  pectx->GetData = mpm_reg->pkt_v1.GetData;
893  pectx->mpm_ctx = mpm_ctx;
894  pectx->transforms = &mpm_reg->transforms;
895 
896  int r = PrefilterAppendEngine(
897  de_ctx, sgh, PrefilterMpmPkt, 0, pectx, PrefilterMpmPktFree, mpm_reg->pname);
898  if (r != 0) {
899  SCFree(pectx);
900  }
901  return r;
902 }
DetectBufferMpmRegistry_::pkt_v1
struct DetectBufferMpmRegistry_::@82::@85 pkt_v1
HashListTableGetListData
#define HashListTableGetListData(hb)
Definition: util-hashlist.h:56
PrefilterGenericMpmPktRegister
int PrefilterGenericMpmPktRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-prefilter.c:884
PrefilterEngineList_::frame_type
uint8_t frame_type
Definition: detect.h:1412
SigGroupHead_::tx_engines
PrefilterEngine * tx_engines
Definition: detect.h:1511
Packet_::proto
uint8_t proto
Definition: decode.h:498
DetectTransaction_::tx_data_ptr
struct AppLayerTxData * tx_data_ptr
Definition: detect-engine-prefilter.h:34
PrefilterEngineList_::Prefilter
PrefilterPktFn Prefilter
Definition: detect.h:1420
MpmCtx_::mpm_type
uint8_t mpm_type
Definition: util-mpm.h:95
detect-engine.h
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:153
PatternMatchPrepareGroup
int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
Prepare the pattern matcher ctx in a sig group head.
Definition: detect-engine-mpm.c:2270
PrefilterMpmPktCtx
struct PrefilterMpmPktCtx PrefilterMpmPktCtx
PrefilterStore_::FreeFunc
void(* FreeFunc)(void *)
Definition: detect-engine-prefilter.h:49
PREFILTER_PROFILING_END
#define PREFILTER_PROFILING_END(ctx, profile_id)
Definition: util-profiling.h:276
PrefilterStore_
Definition: detect-engine-prefilter.h:47
CLS
#define CLS
Definition: suricata-common.h:61
PrefilterRuleStore_::rule_id_array_cnt
uint32_t rule_id_array_cnt
Definition: util-prefilter.h:40
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1492
DetectEngineTransforms
Definition: detect.h:417
PrefilterEngineList_::id
uint16_t id
Definition: detect.h:1404
PROF_DETECT_PF_PAYLOAD
@ PROF_DETECT_PF_PAYLOAD
Definition: suricata-common.h:455
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:595
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:85
PrefilterMpmCtx::GetData
InspectionBufferGetDataPtr GetData
Definition: detect-engine-prefilter.c:716
InspectionBuffer
Definition: detect.h:382
Packet_::flags
uint32_t flags
Definition: decode.h:513
Flow_
Flow data structure.
Definition: flow.h:354
PREFILTER_PROFILING_START
#define PREFILTER_PROFILING_START(det_ctx)
Definition: util-profiling.h:260
DetectEngineThreadCtx_::pmq
PrefilterRuleStore pmq
Definition: detect.h:1232
InspectionBufferGetDataPtr
InspectionBuffer *(* InspectionBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id)
Definition: detect.h:423
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:40
ctx
struct Thresholds ctx
PrefilterEngineList_::name
const char * name
Definition: detect.h:1429
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:870
HashListTableGetListHead
HashListTableBucket * HashListTableGetListHead(HashListTable *ht)
Definition: util-hashlist.c:287
PrefilterEngine_::tx_min_progress
uint8_t tx_min_progress
Definition: detect.h:1444
InspectionBufferGetPktDataPtr
InspectionBuffer *(* InspectionBufferGetPktDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Packet *p, const int list_id)
Definition: detect.h:492
PrefilterDeinit
void PrefilterDeinit(DetectEngineCtx *de_ctx)
Definition: detect-engine-prefilter.c:634
DetectBufferMpmRegistry_
one time registration of keywords at start up
Definition: detect.h:713
PrefilterMpmPktCtx
Definition: detect-engine-prefilter.c:837
detect-engine-frame.h
SigGroupHead_::payload_engines
PrefilterEngine * payload_engines
Definition: detect.h:1510
DetectEngineCtx_::prefilter_setting
enum DetectEnginePrefilterSetting prefilter_setting
Definition: detect.h:1006
PKT_NOPAYLOAD_INSPECTION
#define PKT_NOPAYLOAD_INSPECTION
Definition: decode.h:1255
PACKET_PROFILING_DETECT_END
#define PACKET_PROFILING_DETECT_END(p, id)
Definition: util-profiling.h:221
HashListTableLookup
void * HashListTableLookup(HashListTable *ht, void *data, uint16_t datalen)
Definition: util-hashlist.c:245
PrefilterEngine_::cb
union PrefilterEngine_::@97 cb
PrefilterEngine_::local_id
uint16_t local_id
Definition: detect.h:1435
PrefilterEngineList_::Free
void(* Free)(void *pectx)
Definition: detect.h:1427
PrefilterAppendFrameEngine
int PrefilterAppendFrameEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh, PrefilterFrameFn PrefilterFrameFunc, AppProto alproto, uint8_t frame_type, void *pectx, void(*FreeFunc)(void *pectx), const char *name)
Definition: detect-engine-prefilter.c:321
DetectBufferMpmRegistry_::transforms
DetectEngineTransforms transforms
Definition: detect.h:726
Packet_::payload_len
uint16_t payload_len
Definition: decode.h:575
DetectTransaction_::tx_progress
const int tx_progress
Definition: detect-engine-prefilter.h:43
detect-engine-prefilter.h
PrefilterMultiGenericMpmRegister
int PrefilterMultiGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-prefilter.c:815
PrefilterStore_::id
uint32_t id
Definition: detect-engine-prefilter.h:50
HashListTableAdd
int HashListTableAdd(HashListTable *ht, void *data, uint16_t datalen)
Definition: util-hashlist.c:114
DETECT_PREFILTER_AUTO
@ DETECT_PREFILTER_AUTO
Definition: detect.h:847
HashListTable_::array_size
uint32_t array_size
Definition: util-hashlist.h:41
PrefilterEngine_::is_last_for_progress
bool is_last_for_progress
Definition: detect.h:1461
PROF_DETECT_PF_SORT1
@ PROF_DETECT_PF_SORT1
Definition: suricata-common.h:458
DetectEngineCtx_::prefilter_id
uint32_t prefilter_id
Definition: detect.h:1037
PrefilterEngineList_::next
struct PrefilterEngineList_ * next
Definition: detect.h:1424
SigTableElmt_::SetupPrefilter
int(* SetupPrefilter)(DetectEngineCtx *de_ctx, struct SigGroupHead_ *sgh)
Definition: detect.h:1324
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:476
HashListTableGetListNext
#define HashListTableGetListNext(hb)
Definition: util-hashlist.h:55
PrefilterMpmListId
Definition: detect-engine-mpm.h:120
DetectEngineCtx_::prefilter_hash_table
HashListTable * prefilter_hash_table
Definition: detect.h:1038
app-layer-htp.h
HashListTableInit
HashListTable * HashListTableInit(uint32_t size, uint32_t(*Hash)(struct HashListTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
Definition: util-hashlist.c:35
PrefilterEngineList_::alproto
AppProto alproto
Definition: detect.h:1407
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:18
g_alproto_max
AppProto g_alproto_max
Definition: app-layer-protos.c:29
Prefilter
void Prefilter(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const uint8_t flags, const SignatureMask mask)
Definition: detect-engine-prefilter.c:158
PrefilterStoreGetName
const char * PrefilterStoreGetName(const uint32_t id)
Definition: detect-engine-prefilter.c:706
DetectEngineThreadCtx_
Definition: detect.h:1126
PrefilterEngine_
Definition: detect.h:1434
SigGroupHeadInitData_::tx_engines
PrefilterEngineList * tx_engines
Definition: detect.h:1481
DetectTransaction_::detect_progress
uint8_t detect_progress
Definition: detect-engine-prefilter.h:39
PROF_DETECT_PF_PKT
@ PROF_DETECT_PF_PKT
Definition: suricata-common.h:454
PrefilterEngineList_::PrefilterFrame
PrefilterFrameFn PrefilterFrame
Definition: detect.h:1422
PrefilterEngineList_::pectx
void * pectx
Definition: detect.h:1418
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
detect-engine-mpm.h
PrefilterEngineList_::PrefilterTx
PrefilterTxFn PrefilterTx
Definition: detect.h:1421
DetectEngineCtx_::sm_types_prefilter
bool * sm_types_prefilter
Definition: detect.h:1053
PrefilterEngineList_::gid
uint32_t gid
Definition: detect.h:1431
PrefilterMpmPktCtx::GetData
InspectionBufferGetPktDataPtr GetData
Definition: detect-engine-prefilter.c:839
PKT_DETECT_HAS_STREAMDATA
#define PKT_DETECT_HAS_STREAMDATA
Definition: decode.h:1305
PrefilterMpmCtx
struct PrefilterMpmCtx PrefilterMpmCtx
PrefilterGenericMpmRegister
int PrefilterGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-prefilter.c:761
PrefilterFrameFn
void(* PrefilterFrameFn)(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, const struct Frames *frames, const struct Frame *frame)
Definition: detect.h:1396
SigGroupHead_::init
SigGroupHeadInitData * init
Definition: detect.h:1515
PrefilterMpmListId::transforms
const DetectEngineTransforms * transforms
Definition: detect-engine-mpm.h:124
app-layer-parser.h
MpmCtx_::minlen
uint16_t minlen
Definition: util-mpm.h:104
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:309
util-profiling.h
DetectTransaction_::tx_id
const uint64_t tx_id
Definition: detect-engine-prefilter.h:33
SCReturn
#define SCReturn
Definition: util-debug.h:273
PrefilterEngine_::alproto
AppProto alproto
Definition: detect.h:1438
PrefilterMpmListId::mpm_ctx
const MpmCtx * mpm_ctx
Definition: detect-engine-mpm.h:122
Packet_
Definition: decode.h:476
SCFreeAligned
#define SCFreeAligned(p)
Definition: util-mem.h:77
PrefilterEngine_::PrefilterFrame
PrefilterFrameFn PrefilterFrame
Definition: detect.h:1455
PrefilterEngine_::frame_type
uint8_t frame_type
Definition: detect.h:1445
name
const char * name
Definition: tm-threads.c:2081
PrefilterAppendEngine
int PrefilterAppendEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh, PrefilterPktFn PrefilterFunc, SignatureMask mask, void *pectx, void(*FreeFunc)(void *pectx), const char *name)
Definition: detect-engine-prefilter.c:219
HashListTable_
Definition: util-hashlist.h:37
DetectBufferMpmRegistry_::app_v2
struct DetectBufferMpmRegistry_::@82::@84 app_v2
PrefilterTxFn
void(* PrefilterTxFn)(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *tx, const uint64_t tx_id, const AppLayerTxData *tx_data, const uint8_t flags)
Definition: detect.h:1400
MpmTableElmt_::Search
uint32_t(* Search)(const struct MpmCtx_ *, struct MpmThreadCtx_ *, PrefilterRuleStore *, const uint8_t *, uint32_t)
Definition: util-mpm.h:177
SigGroupHead_::frame_engines
PrefilterEngine * frame_engines
Definition: detect.h:1512
PrefilterMpmCtx::list_id
int list_id
Definition: detect-engine-prefilter.c:715
DetectEngineThreadCtx_::mtc
MpmThreadCtx mtc
Definition: detect.h:1231
PrefilterMpmPktCtx::list_id
int list_id
Definition: detect-engine-prefilter.c:838
PrefilterAppendPayloadEngine
int PrefilterAppendPayloadEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh, PrefilterPktFn PrefilterFunc, void *pectx, void(*FreeFunc)(void *pectx), const char *name)
Definition: detect-engine-prefilter.c:252
SigGroupHeadInitData_::pkt_engines
PrefilterEngineList * pkt_engines
Definition: detect.h:1479
AppLayerTxData
struct AppLayerTxData AppLayerTxData
Definition: detect.h:1399
cnt
uint32_t cnt
Definition: tmqh-packetpool.h:7
PREFILTER_PROFILING_ADD_BYTES
#define PREFILTER_PROFILING_ADD_BYTES(det_ctx, bytes)
Definition: util-profiling.h:286
Packet_::flow
struct Flow_ * flow
Definition: decode.h:515
flags
uint8_t flags
Definition: decode-gre.h:0
suricata-common.h
SigGroupHeadInitData_::frame_engines
PrefilterEngineList * frame_engines
Definition: detect.h:1482
SigGroupHeadInitData_::payload_engines
PrefilterEngineList * payload_engines
Definition: detect.h:1480
HashListTableFree
void HashListTableFree(HashListTable *ht)
Definition: util-hashlist.c:88
PROF_DETECT_PF_RECORD
@ PROF_DETECT_PF_RECORD
Definition: suricata-common.h:457
SCMallocAligned
#define SCMallocAligned(size, align)
Definition: util-mem.h:68
DetectEnginePrefilterSetting
DetectEnginePrefilterSetting
Definition: detect.h:845
DetectTransaction_
Definition: detect-engine-prefilter.h:31
PrefilterEngineList_
Definition: detect.h:1403
PrefilterCleanupRuleGroup
void PrefilterCleanupRuleGroup(const DetectEngineCtx *de_ctx, SigGroupHead *sgh)
Definition: detect-engine-prefilter.c:392
PrefilterEngine_::gid
uint32_t gid
Definition: detect.h:1459
FatalError
#define FatalError(...)
Definition: util-debug.h:502
PrefilterMpmPktCtx::transforms
const DetectEngineTransforms * transforms
Definition: detect-engine-prefilter.c:841
PrefilterAppendTxEngine
int PrefilterAppendTxEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh, PrefilterTxFn PrefilterTxFunc, AppProto alproto, int tx_min_progress, void *pectx, void(*FreeFunc)(void *pectx), const char *name)
Definition: detect-engine-prefilter.c:284
PrefilterPktFn
void(* PrefilterPktFn)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
Definition: detect.h:1395
PrefilterMpmCtx
Definition: detect-engine-prefilter.c:714
PrefilterMpmListId::GetData
InspectionMultiBufferGetDataPtr GetData
Definition: detect-engine-mpm.h:123
util-validate.h
DetectTransaction_::tx_ptr
void * tx_ptr
Definition: detect-engine-prefilter.h:32
InspectionBuffer::inspect_len
uint32_t inspect_len
Definition: detect.h:385
PrefilterEngine_::pectx
void * pectx
Definition: detect.h:1450
PrefilterInit
void PrefilterInit(DetectEngineCtx *de_ctx)
Definition: detect-engine-prefilter.c:641
InspectionBuffer::inspect
const uint8_t * inspect
Definition: detect.h:383
PACKET_PROFILING_DETECT_START
#define PACKET_PROFILING_DETECT_START(p, id)
Definition: util-profiling.h:214
PrefilterMpmCtx::transforms
const DetectEngineTransforms * transforms
Definition: detect-engine-prefilter.c:718
DETECT_TBLSIZE
int DETECT_TBLSIZE
Definition: detect-engine-register.c:285
PrefilterStore_::name
const char * name
Definition: detect-engine-prefilter.h:48
SCFree
#define SCFree(p)
Definition: util-mem.h:61
HashListTableBucket_
Definition: util-hashlist.h:28
PrefilterMpmPktCtx::mpm_ctx
const MpmCtx * mpm_ctx
Definition: detect-engine-prefilter.c:840
PrefilterEngineList_::pkt_mask
SignatureMask pkt_mask
Definition: detect.h:1414
PrefilterMpmListId::list_id
int list_id
Definition: detect-engine-mpm.h:121
SignatureMask
#define SignatureMask
Definition: detect.h:320
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
ALPROTO_FAILED
@ ALPROTO_FAILED
Definition: app-layer-protos.h:33
PrefilterEngine_::pkt_mask
SignatureMask pkt_mask
Definition: detect.h:1441
mpm_table
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
Definition: util-mpm.c:47
PrefilterEngine_::is_last
bool is_last
Definition: detect.h:1460
suricata.h
PrefilterEngineList_::tx_min_progress
uint8_t tx_min_progress
Definition: detect.h:1410
DetectGetInnerTx
void * DetectGetInnerTx(void *tx_ptr, AppProto alproto, AppProto engine_alproto, uint8_t flow_flags)
Definition: detect.c:1095
PrefilterSetupRuleGroup
void PrefilterSetupRuleGroup(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
Definition: detect-engine-prefilter.c:427
likely
#define likely(expr)
Definition: util-optimize.h:32
PrefilterMpm
struct PrefilterMpm PrefilterMpm
SigGroupHead_::pkt_engines
PrefilterEngine * pkt_engines
Definition: detect.h:1509
PrefilterEngine_::Prefilter
PrefilterPktFn Prefilter
Definition: detect.h:1453
PrefilterEngine_::PrefilterTx
PrefilterTxFn PrefilterTx
Definition: detect.h:1454
MpmCtx_
Definition: util-mpm.h:93
PrefilterEngine_::ctx
union PrefilterEngine_::@96 ctx
SigIntId
#define SigIntId
Definition: suricata-common.h:324
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:448
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
PrefilterMpm
Definition: detect-dns-response.c:34
PrefilterFreeEnginesList
void PrefilterFreeEnginesList(PrefilterEngineList *list)
Definition: detect-engine-prefilter.c:364
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
PrefilterMpmCtx::mpm_ctx
const MpmCtx * mpm_ctx
Definition: detect-engine-prefilter.c:717
DetectRunPrefilterTx
void DetectRunPrefilterTx(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const uint8_t ipproto, const uint8_t flow_flags, const AppProto alproto, void *alstate, DetectTransaction *tx)
run prefilter engines on a transaction
Definition: detect-engine-prefilter.c:93
PrefilterRuleStore_::rule_id_array
SigIntId * rule_id_array
Definition: util-prefilter.h:38
DetectBufferMpmRegistry_::pname
char pname[32]
Definition: detect.h:715