suricata
detect-engine-prefilter.c
Go to the documentation of this file.
1 /* Copyright (C) 2016 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Prefilter engine
24  *
25  * Prefilter engines have as purpose to check for a critical common part of
26  * a set of rules. If the condition is present in the traffic, the rules
27  * will have to be inspected individually. Otherwise, the rules can be
28  * skipped.
29  *
30  * The best example of this is the MPM. From each rule take a pattern and
31  * add it to the MPM state machine. Inspect that in one step and only
32  * individually inspect the rules that had a match in MPM.
33  *
34  * This prefilter API is designed to abstract this logic so that it becomes
35  * easier to add other types of prefilters.
36  *
37  * The prefilter engines are structured as a simple list of engines. Each
38  * engine checks for a condition using it's callback function and private
39  * data. It then adds the rule match candidates to the PrefilterRuleStore
40  * structure.
41  *
42  * After the engines have run the resulting list of match candidates is
43  * sorted by the rule id's so that the individual inspection happens in
44  * the correct order.
45  */
46 
47 #include "suricata-common.h"
48 #include "suricata.h"
49 
51 #include "detect-engine-mpm.h"
52 
53 #include "app-layer-parser.h"
54 #include "app-layer-htp.h"
55 
56 #include "util-profiling.h"
57 #include "util-validate.h"
58 
59 static int PrefilterStoreGetId(DetectEngineCtx *de_ctx,
60  const char *name, void (*FreeFunc)(void *));
61 static const PrefilterStore *PrefilterStoreGetStore(const DetectEngineCtx *de_ctx,
62  const uint32_t id);
63 
64 static inline void QuickSortSigIntId(SigIntId *sids, uint32_t n)
65 {
66  if (n < 2)
67  return;
68  SigIntId p = sids[n / 2];
69  SigIntId *l = sids;
70  SigIntId *r = sids + n - 1;
71  while (l <= r) {
72  if (*l < p)
73  l++;
74  else if (*r > p)
75  r--;
76  else {
77  SigIntId t = *l;
78  *l = *r;
79  *r = t;
80  l++;
81  r--;
82  }
83  }
84  QuickSortSigIntId(sids, r - sids + 1);
85  QuickSortSigIntId(l, sids + n - l);
86 }
87 
88 /**
89  * \brief run prefilter engines on a transaction
90  */
92  const SigGroupHead *sgh,
93  Packet *p,
94  const uint8_t ipproto,
95  const uint8_t flow_flags,
96  const AppProto alproto,
97  void *alstate,
99 {
100  /* reset rule store */
101  det_ctx->pmq.rule_id_array_cnt = 0;
102 
103  SCLogDebug("packet %" PRIu64 " tx %p progress %d tx->prefilter_flags %" PRIx64, p->pcap_cnt,
104  tx->tx_ptr, tx->tx_progress, tx->prefilter_flags);
105 
106  PrefilterEngine *engine = sgh->tx_engines;
107  do {
108  if (engine->alproto != alproto)
109  goto next;
110  if (engine->tx_min_progress > tx->tx_progress)
111  break;
112  if (tx->tx_progress > engine->tx_min_progress) {
113  if (tx->prefilter_flags & BIT_U64(engine->tx_min_progress)) {
114  goto next;
115  }
116  }
117 
119  engine->cb.PrefilterTx(det_ctx, engine->pectx,
120  p, p->flow, tx->tx_ptr, tx->tx_id, flow_flags);
121  PREFILTER_PROFILING_END(det_ctx, engine->gid);
122 
123  if (tx->tx_progress > engine->tx_min_progress && engine->is_last_for_progress) {
124  tx->prefilter_flags |= BIT_U64(engine->tx_min_progress);
125  }
126  next:
127  if (engine->is_last)
128  break;
129  engine++;
130  } while (1);
131 
132  /* Sort the rule list to lets look at pmq.
133  * NOTE due to merging of 'stream' pmqs we *MAY* have duplicate entries */
134  if (likely(det_ctx->pmq.rule_id_array_cnt > 1)) {
136  QuickSortSigIntId(det_ctx->pmq.rule_id_array, det_ctx->pmq.rule_id_array_cnt);
138  }
139 }
140 
141 void Prefilter(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh,
142  Packet *p, const uint8_t flags)
143 {
144  SCEnter();
145 
146  if (sgh->pkt_engines) {
148  /* run packet engines */
149  PrefilterEngine *engine = sgh->pkt_engines;
150  do {
152  engine->cb.Prefilter(det_ctx, p, engine->pectx);
153  PREFILTER_PROFILING_END(det_ctx, engine->gid);
154 
155  if (engine->is_last)
156  break;
157  engine++;
158  } while (1);
160  }
161 
162  /* run payload inspecting engines */
163  if (sgh->payload_engines &&
166  {
168  PrefilterEngine *engine = sgh->payload_engines;
169  while (1) {
171  engine->cb.Prefilter(det_ctx, p, engine->pectx);
172  PREFILTER_PROFILING_END(det_ctx, engine->gid);
173 
174  if (engine->is_last)
175  break;
176  engine++;
177  }
179  }
180 
181  /* Sort the rule list to lets look at pmq.
182  * NOTE due to merging of 'stream' pmqs we *MAY* have duplicate entries */
183  if (likely(det_ctx->pmq.rule_id_array_cnt > 1)) {
185  QuickSortSigIntId(det_ctx->pmq.rule_id_array, det_ctx->pmq.rule_id_array_cnt);
187  }
188  SCReturn;
189 }
190 
192  void (*PrefilterFunc)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx),
193  void *pectx, void (*FreeFunc)(void *pectx),
194  const char *name)
195 {
196  if (sgh == NULL || PrefilterFunc == NULL || pectx == NULL)
197  return -1;
198 
199  PrefilterEngineList *e = SCMallocAligned(sizeof(*e), CLS);
200  if (e == NULL)
201  return -1;
202  memset(e, 0x00, sizeof(*e));
203 
204  e->Prefilter = PrefilterFunc;
205  e->pectx = pectx;
206  e->Free = FreeFunc;
207 
208  if (sgh->init->pkt_engines == NULL) {
209  sgh->init->pkt_engines = e;
210  } else {
212  while (t->next != NULL) {
213  t = t->next;
214  }
215 
216  t->next = e;
217  e->id = t->id + 1;
218  }
219 
220  e->name = name;
221  e->gid = PrefilterStoreGetId(de_ctx, e->name, e->Free);
222  return 0;
223 }
224 
226  void (*PrefilterFunc)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx),
227  void *pectx, void (*FreeFunc)(void *pectx),
228  const char *name)
229 {
230  if (sgh == NULL || PrefilterFunc == NULL || pectx == NULL)
231  return -1;
232 
233  PrefilterEngineList *e = SCMallocAligned(sizeof(*e), CLS);
234  if (e == NULL)
235  return -1;
236  memset(e, 0x00, sizeof(*e));
237 
238  e->Prefilter = PrefilterFunc;
239  e->pectx = pectx;
240  e->Free = FreeFunc;
241 
242  if (sgh->init->payload_engines == NULL) {
243  sgh->init->payload_engines = e;
244  } else {
246  while (t->next != NULL) {
247  t = t->next;
248  }
249 
250  t->next = e;
251  e->id = t->id + 1;
252  }
253 
254  e->name = name;
255  e->gid = PrefilterStoreGetId(de_ctx, e->name, e->Free);
256  return 0;
257 }
258 
260  void (*PrefilterTxFunc)(DetectEngineThreadCtx *det_ctx, const void *pectx,
261  Packet *p, Flow *f, void *tx,
262  const uint64_t idx, const uint8_t flags),
263  AppProto alproto, int tx_min_progress,
264  void *pectx, void (*FreeFunc)(void *pectx),
265  const char *name)
266 {
267  if (sgh == NULL || PrefilterTxFunc == NULL || pectx == NULL)
268  return -1;
269 
270  PrefilterEngineList *e = SCMallocAligned(sizeof(*e), CLS);
271  if (e == NULL)
272  return -1;
273  memset(e, 0x00, sizeof(*e));
274 
275  e->PrefilterTx = PrefilterTxFunc;
276  e->pectx = pectx;
277  e->alproto = alproto;
278  e->tx_min_progress = tx_min_progress;
279  e->Free = FreeFunc;
280 
281  if (sgh->init->tx_engines == NULL) {
282  sgh->init->tx_engines = e;
283  } else {
285  while (t->next != NULL) {
286  t = t->next;
287  }
288 
289  t->next = e;
290  e->id = t->id + 1;
291  }
292 
293  e->name = name;
294  e->gid = PrefilterStoreGetId(de_ctx, e->name, e->Free);
295  return 0;
296 }
297 
298 static void PrefilterFreeEngineList(PrefilterEngineList *e)
299 {
300  if (e->Free && e->pectx) {
301  e->Free(e->pectx);
302  }
303  SCFreeAligned(e);
304 }
305 
307 {
308  PrefilterEngineList *t = list;
309 
310  while (t != NULL) {
312  PrefilterFreeEngineList(t);
313  t = next;
314  }
315 }
316 
317 static void PrefilterFreeEngines(const DetectEngineCtx *de_ctx, PrefilterEngine *list)
318 {
319  PrefilterEngine *t = list;
320 
321  while (1) {
322  const PrefilterStore *s = PrefilterStoreGetStore(de_ctx, t->gid);
323  if (s && s->FreeFunc && t->pectx) {
324  s->FreeFunc(t->pectx);
325  }
326 
327  if (t->is_last)
328  break;
329  t++;
330  }
331  SCFreeAligned(list);
332 }
333 
335 {
336  if (sgh->pkt_engines) {
337  PrefilterFreeEngines(de_ctx, sgh->pkt_engines);
338  sgh->pkt_engines = NULL;
339  }
340  if (sgh->payload_engines) {
341  PrefilterFreeEngines(de_ctx, sgh->payload_engines);
342  sgh->payload_engines = NULL;
343  }
344  if (sgh->tx_engines) {
345  PrefilterFreeEngines(de_ctx, sgh->tx_engines);
346  sgh->tx_engines = NULL;
347  }
348 }
349 
350 static int PrefilterSetupRuleGroupSortHelper(const void *a, const void *b)
351 {
352  const PrefilterEngine *s0 = a;
353  const PrefilterEngine *s1 = b;
354  if (s1->tx_min_progress == s0->tx_min_progress) {
355  if (s1->alproto == s0->alproto) {
356  return s0->local_id > s1->local_id ? 1 : -1;
357  } else {
358  return s0->alproto > s1->alproto ? 1 : -1;
359  }
360  } else {
361  return s0->tx_min_progress > s1->tx_min_progress ? 1 : -1;
362  }
363 }
364 
366 {
367  int r = PatternMatchPrepareGroup(de_ctx, sgh);
368  if (r != 0) {
369  FatalError(SC_ERR_INITIALIZATION, "failed to set up pattern matching");
370  }
371 
372  /* set up engines if needed - when prefilter is set to auto we run
373  * all engines, otherwise only those that have been forced by the
374  * prefilter keyword. */
376  for (int i = 0; i < DETECT_TBLSIZE; i++)
377  {
378  if (sigmatch_table[i].SetupPrefilter != NULL &&
379  (setting == DETECT_PREFILTER_AUTO ||
381  {
383  }
384  }
385 
386  /* we have lists of engines in sgh->init now. Lets setup the
387  * match arrays */
389  if (sgh->init->pkt_engines != NULL) {
390  uint32_t cnt = 0;
391  for (el = sgh->init->pkt_engines ; el != NULL; el = el->next) {
392  cnt++;
394  }
395  sgh->pkt_engines = SCMallocAligned(cnt * sizeof(PrefilterEngine), CLS);
396  if (sgh->pkt_engines == NULL) {
397  return;
398  }
399  memset(sgh->pkt_engines, 0x00, (cnt * sizeof(PrefilterEngine)));
400 
401  PrefilterEngine *e = sgh->pkt_engines;
402  for (el = sgh->init->pkt_engines ; el != NULL; el = el->next) {
403  e->local_id = el->id;
404  e->cb.Prefilter = el->Prefilter;
405  e->pectx = el->pectx;
406  el->pectx = NULL; // e now owns the ctx
407  e->gid = el->gid;
408  if (el->next == NULL) {
409  e->is_last = TRUE;
410  }
411  e++;
412  }
413  }
414  if (sgh->init->payload_engines != NULL) {
415  uint32_t cnt = 0;
416  for (el = sgh->init->payload_engines ; el != NULL; el = el->next) {
417  cnt++;
419  }
420  sgh->payload_engines = SCMallocAligned(cnt * sizeof(PrefilterEngine), CLS);
421  if (sgh->payload_engines == NULL) {
422  return;
423  }
424  memset(sgh->payload_engines, 0x00, (cnt * sizeof(PrefilterEngine)));
425 
427  for (el = sgh->init->payload_engines ; el != NULL; el = el->next) {
428  e->local_id = el->id;
429  e->cb.Prefilter = el->Prefilter;
430  e->pectx = el->pectx;
431  el->pectx = NULL; // e now owns the ctx
432  e->gid = el->gid;
433  if (el->next == NULL) {
434  e->is_last = TRUE;
435  }
436  e++;
437  }
438  }
439  if (sgh->init->tx_engines != NULL) {
440  uint32_t cnt = 0;
441  for (el = sgh->init->tx_engines ; el != NULL; el = el->next) {
442  cnt++;
444  }
445  sgh->tx_engines = SCMallocAligned(cnt * sizeof(PrefilterEngine), CLS);
446  if (sgh->tx_engines == NULL) {
447  return;
448  }
449  memset(sgh->tx_engines, 0x00, (cnt * sizeof(PrefilterEngine)));
450 
451  uint32_t local_id = 0;
452  PrefilterEngine *e = sgh->tx_engines;
453  for (el = sgh->init->tx_engines ; el != NULL; el = el->next) {
454  e->local_id = local_id++;
455  e->alproto = el->alproto;
457  e->cb.PrefilterTx = el->PrefilterTx;
458  e->pectx = el->pectx;
459  el->pectx = NULL; // e now owns the ctx
460  e->gid = el->gid;
461  e++;
462  }
463 
464  /* sort by tx_min_progress, then alproto, then local_id */
465  qsort(sgh->tx_engines, local_id, sizeof(PrefilterEngine),
466  PrefilterSetupRuleGroupSortHelper);
467  sgh->tx_engines[local_id - 1].is_last = true;
468  sgh->tx_engines[local_id - 1].is_last_for_progress = true;
469 
470  PrefilterEngine *engine;
471 
472  /* per alproto to set is_last_for_progress per alproto because the inspect
473  * loop skips over engines that are not the correct alproto */
474  for (AppProto a = 1; a < ALPROTO_FAILED; a++) {
475  int last_tx_progress = 0;
476  bool last_tx_progress_set = false;
477  PrefilterEngine *prev_engine = NULL;
478  engine = sgh->tx_engines;
479  do {
480  BUG_ON(engine->tx_min_progress < last_tx_progress);
481  if (engine->alproto == a) {
482  if (last_tx_progress_set && engine->tx_min_progress > last_tx_progress) {
483  if (prev_engine) {
484  prev_engine->is_last_for_progress = true;
485  }
486  }
487 
488  last_tx_progress_set = true;
489  prev_engine = engine;
490  } else {
491  if (prev_engine) {
492  prev_engine->is_last_for_progress = true;
493  }
494  }
495  last_tx_progress = engine->tx_min_progress;
496  if (engine->is_last)
497  break;
498  engine++;
499  } while (1);
500  }
501 #ifdef DEBUG
502  SCLogDebug("sgh %p", sgh);
503  engine = sgh->tx_engines;
504  do {
505  SCLogDebug("engine: gid %u alproto %s tx_min_progress %d is_last %s "
506  "is_last_for_progress %s",
507  engine->gid, AppProtoToString(engine->alproto), engine->tx_min_progress,
508  engine->is_last ? "true" : "false",
509  engine->is_last_for_progress ? "true" : "false");
510  if (engine->is_last)
511  break;
512  engine++;
513  } while (1);
514 #endif
515  }
516 }
517 
518 /* hash table for assigning a unique id to each engine type. */
519 
520 static uint32_t PrefilterStoreHashFunc(HashListTable *ht, void *data, uint16_t datalen)
521 {
522  PrefilterStore *ctx = data;
523 
524  uint32_t hash = strlen(ctx->name);
525  uint16_t u;
526 
527  for (u = 0; u < strlen(ctx->name); u++) {
528  hash += ctx->name[u];
529  }
530 
531  hash %= ht->array_size;
532  return hash;
533 }
534 
535 static char PrefilterStoreCompareFunc(void *data1, uint16_t len1,
536  void *data2, uint16_t len2)
537 {
538  PrefilterStore *ctx1 = data1;
539  PrefilterStore *ctx2 = data2;
540  return (strcmp(ctx1->name, ctx2->name) == 0);
541 }
542 
543 static void PrefilterStoreFreeFunc(void *ptr)
544 {
545  SCFree(ptr);
546 }
547 
549 {
550  if (de_ctx->prefilter_hash_table != NULL) {
552  }
553 }
554 
556 {
558 
560  PrefilterStoreHashFunc,
561  PrefilterStoreCompareFunc,
562  PrefilterStoreFreeFunc);
564 }
565 
566 static int PrefilterStoreGetId(DetectEngineCtx *de_ctx,
567  const char *name, void (*FreeFunc)(void *))
568 {
569  PrefilterStore ctx = { name, FreeFunc, 0 };
570 
572 
573  SCLogDebug("looking up %s", name);
574 
576  if (rctx != NULL) {
577  return rctx->id;
578  }
579 
580  PrefilterStore *actx = SCCalloc(1, sizeof(*actx));
581  if (actx == NULL) {
582  return -1;
583  }
584 
585  actx->name = name;
586  actx->FreeFunc = FreeFunc;
587  actx->id = de_ctx->prefilter_id++;
588  SCLogDebug("prefilter engine %s has profile id %u", actx->name, actx->id);
589 
590  int ret = HashListTableAdd(de_ctx->prefilter_hash_table, actx, 0);
591  if (ret != 0) {
592  SCFree(actx);
593  return -1;
594  }
595 
596  int r = actx->id;
597  return r;
598 }
599 
600 /** \warning slow */
601 static const PrefilterStore *PrefilterStoreGetStore(const DetectEngineCtx *de_ctx,
602  const uint32_t id)
603 {
604 
605  const PrefilterStore *store = NULL;
606  if (de_ctx->prefilter_hash_table != NULL) {
608  for ( ; hb != NULL; hb = HashListTableGetListNext(hb)) {
610  if (ctx->id == id) {
611  store = ctx;
612  break;
613  }
614  }
615  }
616  return store;
617 }
618 
619 #ifdef PROFILING
620 const char *PrefilterStoreGetName(const uint32_t id)
621 {
622  return NULL;
623 }
624 #endif
625 
626 #include "util-print.h"
627 
628 typedef struct PrefilterMpmCtx {
629  int list_id;
631  const MpmCtx *mpm_ctx;
634 
635 /** \brief Generic Mpm prefilter callback
636  *
637  * \param det_ctx detection engine thread ctx
638  * \param p packet to inspect
639  * \param f flow to inspect
640  * \param txv tx to inspect
641  * \param pectx inspection context
642  */
643 static void PrefilterMpm(DetectEngineThreadCtx *det_ctx,
644  const void *pectx,
645  Packet *p, Flow *f, void *txv,
646  const uint64_t idx, const uint8_t flags)
647 {
648  SCEnter();
649 
650  const PrefilterMpmCtx *ctx = (const PrefilterMpmCtx *)pectx;
651  const MpmCtx *mpm_ctx = ctx->mpm_ctx;
652  SCLogDebug("running on list %d", ctx->list_id);
653 
654  InspectionBuffer *buffer = ctx->GetData(det_ctx, ctx->transforms,
655  f, flags, txv, ctx->list_id);
656  if (buffer == NULL)
657  return;
658 
659  const uint32_t data_len = buffer->inspect_len;
660  const uint8_t *data = buffer->inspect;
661 
662  SCLogDebug("mpm'ing buffer:");
663  //PrintRawDataFp(stdout, data, data_len);
664 
665  if (data != NULL && data_len >= mpm_ctx->minlen) {
666  (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
667  &det_ctx->mtcu, &det_ctx->pmq, data, data_len);
668  }
669 }
670 
671 static void PrefilterGenericMpmFree(void *ptr)
672 {
673  SCFree(ptr);
674 }
675 
677  SigGroupHead *sgh, MpmCtx *mpm_ctx,
678  const DetectBufferMpmRegistery *mpm_reg, int list_id)
679 {
680  SCEnter();
681  PrefilterMpmCtx *pectx = SCCalloc(1, sizeof(*pectx));
682  if (pectx == NULL)
683  return -1;
684  pectx->list_id = list_id;
685  pectx->GetData = mpm_reg->app_v2.GetData;
686  pectx->mpm_ctx = mpm_ctx;
687  pectx->transforms = &mpm_reg->transforms;
688 
689  int r = PrefilterAppendTxEngine(de_ctx, sgh, PrefilterMpm,
690  mpm_reg->app_v2.alproto, mpm_reg->app_v2.tx_min_progress,
691  pectx, PrefilterGenericMpmFree, mpm_reg->pname);
692  if (r != 0) {
693  SCFree(pectx);
694  }
695  return r;
696 }
697 
698 /* generic mpm for pkt engines */
699 
700 typedef struct PrefilterMpmPktCtx {
701  int list_id;
703  const MpmCtx *mpm_ctx;
706 
707 /** \brief Generic Mpm prefilter callback
708  *
709  * \param det_ctx detection engine thread ctx
710  * \param p packet to inspect
711  * \param f flow to inspect
712  * \param txv tx to inspect
713  * \param pectx inspection context
714  */
715 static void PrefilterMpmPkt(DetectEngineThreadCtx *det_ctx,
716  Packet *p, const void *pectx)
717 {
718  SCEnter();
719 
720  const PrefilterMpmPktCtx *ctx = (const PrefilterMpmPktCtx *)pectx;
721  const MpmCtx *mpm_ctx = ctx->mpm_ctx;
722  SCLogDebug("running on list %d", ctx->list_id);
723 
724  InspectionBuffer *buffer = ctx->GetData(det_ctx, ctx->transforms,
725  p, ctx->list_id);
726  if (buffer == NULL)
727  return;
728 
729  const uint32_t data_len = buffer->inspect_len;
730  const uint8_t *data = buffer->inspect;
731 
732  SCLogDebug("mpm'ing buffer:");
733  //PrintRawDataFp(stdout, data, data_len);
734 
735  if (data != NULL && data_len >= mpm_ctx->minlen) {
736  (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
737  &det_ctx->mtcu, &det_ctx->pmq, data, data_len);
738  }
739 }
740 
741 static void PrefilterMpmPktFree(void *ptr)
742 {
743  SCFree(ptr);
744 }
745 
747  SigGroupHead *sgh, MpmCtx *mpm_ctx,
748  const DetectBufferMpmRegistery *mpm_reg, int list_id)
749 {
750  SCEnter();
751  PrefilterMpmPktCtx *pectx = SCCalloc(1, sizeof(*pectx));
752  if (pectx == NULL)
753  return -1;
754  pectx->list_id = list_id;
755  pectx->GetData = mpm_reg->pkt_v1.GetData;
756  pectx->mpm_ctx = mpm_ctx;
757  pectx->transforms = &mpm_reg->transforms;
758 
759  int r = PrefilterAppendEngine(de_ctx, sgh, PrefilterMpmPkt,
760  pectx, PrefilterMpmPktFree, mpm_reg->pname);
761  if (r != 0) {
762  SCFree(pectx);
763  }
764  return r;
765 }
HashListTableGetListData
#define HashListTableGetListData(hb)
Definition: util-hashlist.h:59
SigGroupHead_::tx_engines
PrefilterEngine * tx_engines
Definition: detect.h:1365
MpmCtx_::mpm_type
uint8_t mpm_type
Definition: util-mpm.h:90
PrefilterEngine_::Prefilter
void(* Prefilter)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
Definition: detect.h:1306
PatternMatchPrepareGroup
int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
Prepare the pattern matcher ctx in a sig group head.
Definition: detect-engine-mpm.c:1668
PrefilterMpmPktCtx
struct PrefilterMpmPktCtx PrefilterMpmPktCtx
PrefilterStore_::FreeFunc
void(* FreeFunc)(void *)
Definition: detect-engine-prefilter.h:31
PREFILTER_PROFILING_END
#define PREFILTER_PROFILING_END(ctx, profile_id)
Definition: util-profiling.h:294
PrefilterStore_
Definition: detect-engine-prefilter.h:29
CLS
#define CLS
Definition: suricata-common.h:45
Prefilter
void Prefilter(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const uint8_t flags)
Definition: detect-engine-prefilter.c:141
PrefilterRuleStore_::rule_id_array_cnt
uint32_t rule_id_array_cnt
Definition: util-prefilter.h:38
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1346
DetectEngineTransforms
Definition: detect.h:378
PrefilterEngineList_::id
uint16_t id
Definition: detect.h:1265
PROF_DETECT_PF_PAYLOAD
@ PROF_DETECT_PF_PAYLOAD
Definition: suricata-common.h:419
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:572
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
PREFILTER_PROFILING_START
#define PREFILTER_PROFILING_START
Definition: util-profiling.h:280
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:77
PrefilterMpmCtx::GetData
InspectionBufferGetDataPtr GetData
Definition: detect-engine-prefilter.c:630
DetectBufferMpmRegistery_::transforms
DetectEngineTransforms transforms
Definition: detect.h:615
InspectionBuffer
Definition: detect.h:344
Packet_::flags
uint32_t flags
Definition: decode.h:449
DetectEngineCtx_::prefilter_maxid
uint32_t prefilter_maxid
Definition: detect.h:888
DETECT_TBLSIZE
@ DETECT_TBLSIZE
Definition: detect-engine-register.h:313
Flow_
Flow data structure.
Definition: flow.h:353
DetectEngineThreadCtx_::pmq
PrefilterRuleStore pmq
Definition: detect.h:1101
InspectionBufferGetDataPtr
InspectionBuffer *(* InspectionBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id)
Definition: detect.h:384
PrefilterGenericMpmRegister
int PrefilterGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id)
Definition: detect-engine-prefilter.c:676
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:30
PrefilterEngineList_::name
const char * name
Definition: detect.h:1287
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:758
HashListTableGetListHead
HashListTableBucket * HashListTableGetListHead(HashListTable *ht)
Definition: util-hashlist.c:290
PrefilterEngine_::tx_min_progress
uint8_t tx_min_progress
Definition: detect.h:1299
InspectionBufferGetPktDataPtr
InspectionBuffer *(* InspectionBufferGetPktDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Packet *p, const int list_id)
Definition: detect.h:444
PrefilterDeinit
void PrefilterDeinit(DetectEngineCtx *de_ctx)
Definition: detect-engine-prefilter.c:548
PrefilterMpmPktCtx
Definition: detect-engine-prefilter.c:700
DetectBufferMpmRegistery_
one time registration of keywords at start up
Definition: detect.h:601
PrefilterEngineList_::Prefilter
void(* Prefilter)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
Definition: detect.h:1277
SigGroupHead_::payload_engines
PrefilterEngine * payload_engines
Definition: detect.h:1364
DetectEngineCtx_::prefilter_setting
enum DetectEnginePrefilterSetting prefilter_setting
Definition: detect.h:903
PKT_NOPAYLOAD_INSPECTION
#define PKT_NOPAYLOAD_INSPECTION
Definition: decode.h:1141
PACKET_PROFILING_DETECT_END
#define PACKET_PROFILING_DETECT_END(p, id)
Definition: util-profiling.h:241
HashListTableLookup
void * HashListTableLookup(HashListTable *ht, void *data, uint16_t datalen)
Definition: util-hashlist.c:248
PrefilterEngine_::cb
union PrefilterEngine_::@97 cb
PrefilterEngine_::local_id
uint16_t local_id
Definition: detect.h:1293
PrefilterEngineList_::Free
void(* Free)(void *pectx)
Definition: detect.h:1285
MAX
#define MAX(x, y)
Definition: suricata-common.h:372
Packet_::payload_len
uint16_t payload_len
Definition: decode.h:552
DetectTransaction_::tx_progress
const int tx_progress
Definition: detect-engine-state.h:106
detect-engine-prefilter.h
DetectEngineThreadCtx_::mtcu
MpmThreadCtx mtcu
Definition: detect.h:1099
PrefilterStore_::id
uint32_t id
Definition: detect-engine-prefilter.h:32
HashListTableAdd
int HashListTableAdd(HashListTable *ht, void *data, uint16_t datalen)
Definition: util-hashlist.c:116
DETECT_PREFILTER_AUTO
@ DETECT_PREFILTER_AUTO
Definition: detect.h:740
HashListTable_::array_size
uint32_t array_size
Definition: util-hashlist.h:41
PrefilterEngine_::is_last_for_progress
bool is_last_for_progress
Definition: detect.h:1315
PROF_DETECT_PF_SORT1
@ PROF_DETECT_PF_SORT1
Definition: suricata-common.h:421
DetectEngineCtx_::prefilter_id
uint32_t prefilter_id
Definition: detect.h:933
PrefilterEngineList_::next
struct PrefilterEngineList_ * next
Definition: detect.h:1282
SigTableElmt_::SetupPrefilter
int(* SetupPrefilter)(DetectEngineCtx *de_ctx, struct SigGroupHead_ *sgh)
Definition: detect.h:1189
PrefilterGenericMpmPktRegister
int PrefilterGenericMpmPktRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistery *mpm_reg, int list_id)
Definition: detect-engine-prefilter.c:746
HashListTableGetListNext
#define HashListTableGetListNext(hb)
Definition: util-hashlist.h:58
DetectEngineCtx_::prefilter_hash_table
HashListTable * prefilter_hash_table
Definition: detect.h:934
app-layer-htp.h
HashListTableInit
HashListTable * HashListTableInit(uint32_t size, uint32_t(*Hash)(struct HashListTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
Definition: util-hashlist.c:35
PrefilterEngineList_::alproto
AppProto alproto
Definition: detect.h:1268
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
PrefilterEngine_::PrefilterTx
void(* PrefilterTx)(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *tx, const uint64_t idx, const uint8_t flags)
Definition: detect.h:1307
PrefilterStoreGetName
const char * PrefilterStoreGetName(const uint32_t id)
Definition: detect-engine-prefilter.c:620
DetectEngineThreadCtx_
Definition: detect.h:1003
PrefilterEngine_
Definition: detect.h:1292
SigGroupHeadInitData_::tx_engines
PrefilterEngineList * tx_engines
Definition: detect.h:1333
PROF_DETECT_PF_PKT
@ PROF_DETECT_PF_PKT
Definition: suricata-common.h:418
PrefilterEngineList_::pectx
void * pectx
Definition: detect.h:1275
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
detect-engine-mpm.h
PrefilterEngineList_::gid
uint32_t gid
Definition: detect.h:1289
PrefilterMpmPktCtx::GetData
InspectionBufferGetPktDataPtr GetData
Definition: detect-engine-prefilter.c:702
PKT_DETECT_HAS_STREAMDATA
#define PKT_DETECT_HAS_STREAMDATA
Definition: decode.h:1191
PrefilterMpmCtx
struct PrefilterMpmCtx PrefilterMpmCtx
SigGroupHead_::init
SigGroupHeadInitData * init
Definition: detect.h:1368
app-layer-parser.h
MpmCtx_::minlen
uint16_t minlen
Definition: util-mpm.h:99
TRUE
#define TRUE
Definition: suricata-common.h:33
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:277
util-profiling.h
DetectTransaction_::tx_id
const uint64_t tx_id
Definition: detect-engine-state.h:100
SCReturn
#define SCReturn
Definition: util-debug.h:302
PrefilterEngine_::alproto
AppProto alproto
Definition: detect.h:1296
DetectTransaction_::prefilter_flags
uint64_t prefilter_flags
Definition: detect-engine-state.h:104
Packet_
Definition: decode.h:414
SCFreeAligned
#define SCFreeAligned(p)
Definition: util-mem.h:77
HashListTable_
Definition: util-hashlist.h:37
BIT_U64
#define BIT_U64(n)
Definition: suricata-common.h:378
MpmTableElmt_::Search
uint32_t(* Search)(const struct MpmCtx_ *, struct MpmThreadCtx_ *, PrefilterRuleStore *, const uint8_t *, uint32_t)
Definition: util-mpm.h:165
PrefilterMpmCtx::list_id
int list_id
Definition: detect-engine-prefilter.c:629
DetectBufferMpmRegistery_::app_v2
struct DetectBufferMpmRegistery_::@85::@87 app_v2
PrefilterMpmPktCtx::list_id
int list_id
Definition: detect-engine-prefilter.c:701
SigGroupHeadInitData_::pkt_engines
PrefilterEngineList * pkt_engines
Definition: detect.h:1331
DetectBufferMpmRegistery_::pkt_v1
struct DetectBufferMpmRegistery_::@85::@88 pkt_v1
Packet_::flow
struct Flow_ * flow
Definition: decode.h:451
DetectBufferMpmRegistery_::pname
char pname[32]
Definition: detect.h:603
flags
uint8_t flags
Definition: decode-gre.h:0
suricata-common.h
SigGroupHeadInitData_::payload_engines
PrefilterEngineList * payload_engines
Definition: detect.h:1332
HashListTableFree
void HashListTableFree(HashListTable *ht)
Definition: util-hashlist.c:82
SCMallocAligned
#define SCMallocAligned(size, align)
Definition: util-mem.h:68
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:73
DetectEnginePrefilterSetting
DetectEnginePrefilterSetting
Definition: detect.h:738
DetectTransaction_
Definition: detect-engine-state.h:98
PrefilterEngineList_
Definition: detect.h:1264
PrefilterCleanupRuleGroup
void PrefilterCleanupRuleGroup(const DetectEngineCtx *de_ctx, SigGroupHead *sgh)
Definition: detect-engine-prefilter.c:334
PrefilterEngine_::gid
uint32_t gid
Definition: detect.h:1313
FatalError
#define FatalError(x,...)
Definition: util-debug.h:532
PrefilterEngineList_::PrefilterTx
void(* PrefilterTx)(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *tx, const uint64_t idx, const uint8_t flags)
Definition: detect.h:1278
PrefilterMpmPktCtx::transforms
const DetectEngineTransforms * transforms
Definition: detect-engine-prefilter.c:704
PrefilterMpmCtx
Definition: detect-engine-prefilter.c:628
util-validate.h
DetectTransaction_::tx_ptr
void * tx_ptr
Definition: detect-engine-state.h:99
InspectionBuffer::inspect_len
uint32_t inspect_len
Definition: detect.h:347
PrefilterEngine_::pectx
void * pectx
Definition: detect.h:1303
PrefilterInit
void PrefilterInit(DetectEngineCtx *de_ctx)
Definition: detect-engine-prefilter.c:555
DetectEngineCtx_::sm_types_prefilter
bool sm_types_prefilter[DETECT_TBLSIZE]
Definition: detect.h:945
InspectionBuffer::inspect
const uint8_t * inspect
Definition: detect.h:345
PACKET_PROFILING_DETECT_START
#define PACKET_PROFILING_DETECT_START(p, id)
Definition: util-profiling.h:234
PrefilterMpmCtx::transforms
const DetectEngineTransforms * transforms
Definition: detect-engine-prefilter.c:632
PrefilterStore_::name
const char * name
Definition: detect-engine-prefilter.h:30
SCFree
#define SCFree(p)
Definition: util-mem.h:61
PrefilterAppendPayloadEngine
int PrefilterAppendPayloadEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh, void(*PrefilterFunc)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx), void *pectx, void(*FreeFunc)(void *pectx), const char *name)
Definition: detect-engine-prefilter.c:225
HashListTableBucket_
Definition: util-hashlist.h:28
PrefilterMpmPktCtx::mpm_ctx
const MpmCtx * mpm_ctx
Definition: detect-engine-prefilter.c:703
PrefilterAppendTxEngine
int PrefilterAppendTxEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh, void(*PrefilterTxFunc)(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *tx, const uint64_t idx, const uint8_t flags), AppProto alproto, int tx_min_progress, void *pectx, void(*FreeFunc)(void *pectx), const char *name)
Definition: detect-engine-prefilter.c:259
ALPROTO_FAILED
@ ALPROTO_FAILED
Definition: app-layer-protos.h:67
mpm_table
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
Definition: util-mpm.c:48
PrefilterEngine_::is_last
bool is_last
Definition: detect.h:1314
suricata.h
PrefilterEngineList_::tx_min_progress
uint8_t tx_min_progress
Definition: detect.h:1271
PrefilterSetupRuleGroup
void PrefilterSetupRuleGroup(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
Definition: detect-engine-prefilter.c:365
likely
#define likely(expr)
Definition: util-optimize.h:32
SigGroupHead_::pkt_engines
PrefilterEngine * pkt_engines
Definition: detect.h:1363
SC_ERR_INITIALIZATION
@ SC_ERR_INITIALIZATION
Definition: util-error.h:75
MpmCtx_
Definition: util-mpm.h:88
PrefilterAppendEngine
int PrefilterAppendEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh, void(*PrefilterFunc)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx), void *pectx, void(*FreeFunc)(void *pectx), const char *name)
Definition: detect-engine-prefilter.c:191
SigIntId
#define SigIntId
Definition: suricata-common.h:292
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
PrefilterFreeEnginesList
void PrefilterFreeEnginesList(PrefilterEngineList *list)
Definition: detect-engine-prefilter.c:306
PrefilterMpmCtx::mpm_ctx
const MpmCtx * mpm_ctx
Definition: detect-engine-prefilter.c:631
DetectRunPrefilterTx
void DetectRunPrefilterTx(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const uint8_t ipproto, const uint8_t flow_flags, const AppProto alproto, void *alstate, DetectTransaction *tx)
run prefilter engines on a transaction
Definition: detect-engine-prefilter.c:91
PrefilterRuleStore_::rule_id_array
SigIntId * rule_id_array
Definition: util-prefilter.h:36