suricata
detect-engine.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2022 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #include "suricata-common.h"
25 #include "suricata.h"
26 #include "detect.h"
27 #include "flow.h"
28 #include "flow-private.h"
29 #include "flow-util.h"
30 #include "flow-worker.h"
31 #include "conf.h"
32 #include "conf-yaml-loader.h"
33 #include "datasets.h"
34 
35 #include "app-layer-parser.h"
36 #include "app-layer-events.h"
37 #include "app-layer-htp.h"
38 
39 #include "detect-parse.h"
40 #include "detect-engine-sigorder.h"
41 
42 #include "detect-engine-build.h"
43 #include "detect-engine-siggroup.h"
44 #include "detect-engine-address.h"
45 #include "detect-engine-port.h"
47 #include "detect-engine-mpm.h"
48 #include "detect-engine-iponly.h"
49 #include "detect-engine-tag.h"
50 #include "detect-engine-frame.h"
51 
52 #include "detect-engine-file.h"
53 
54 #include "detect-engine.h"
55 #include "detect-engine-state.h"
56 #include "detect-engine-payload.h"
57 #include "detect-fast-pattern.h"
58 #include "detect-byte-extract.h"
59 #include "detect-content.h"
60 #include "detect-uricontent.h"
61 #include "detect-tcphdr.h"
64 
65 #include "detect-engine-loader.h"
66 
67 #include "detect-engine-alert.h"
68 
70 #include "util-reference-config.h"
71 #include "util-threshold-config.h"
72 #include "util-error.h"
73 #include "util-hash.h"
74 #include "util-byte.h"
75 #include "util-debug.h"
76 #include "util-unittest.h"
77 #include "util-action.h"
78 #include "util-magic.h"
79 #include "util-signal.h"
80 #include "util-spm.h"
81 #include "util-device-private.h"
82 #include "util-var-name.h"
83 #include "util-path.h"
84 #include "util-profiling.h"
85 #include "util-validate.h"
86 #include "util-hash-string.h"
87 #include "util-enum.h"
88 #include "util-conf.h"
89 
90 #include "tm-threads.h"
91 #include "runmodes.h"
92 
93 #include "reputation.h"
94 
95 #define DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT 3000
96 
97 static int DetectEngineCtxLoadConf(DetectEngineCtx *);
98 
99 static DetectEngineMasterCtx g_master_de_ctx = { SCMUTEX_INITIALIZER,
100  0, 99, NULL, NULL, TENANT_SELECTOR_UNKNOWN, NULL, NULL, 0};
101 
102 static uint32_t TenantIdHash(HashTable *h, void *data, uint16_t data_len);
103 static char TenantIdCompare(void *d1, uint16_t d1_len, void *d2, uint16_t d2_len);
104 static void TenantIdFree(void *d);
105 static uint32_t DetectEngineTenantGetIdFromLivedev(const void *ctx, const Packet *p);
106 static uint32_t DetectEngineTenantGetIdFromVlanId(const void *ctx, const Packet *p);
107 static uint32_t DetectEngineTenantGetIdFromPcap(const void *ctx, const Packet *p);
108 
109 static bool DetectEngineMultiTenantEnabledWithLock(void);
110 static DetectEngineAppInspectionEngine *g_app_inspect_engines = NULL;
111 static DetectEnginePktInspectionEngine *g_pkt_inspect_engines = NULL;
112 static DetectEngineFrameInspectionEngine *g_frame_inspect_engines = NULL;
113 
114 // clang-format off
115 // rule types documentation tag start: SignatureProperties
117  /* SIG_TYPE_NOT_SET */ { SIG_PROP_FLOW_ACTION_PACKET, },
118  /* SIG_TYPE_IPONLY */ { SIG_PROP_FLOW_ACTION_FLOW, },
119  /* SIG_TYPE_LIKE_IPONLY */ { SIG_PROP_FLOW_ACTION_FLOW, },
120  /* SIG_TYPE_PDONLY */ { SIG_PROP_FLOW_ACTION_FLOW, },
121  /* SIG_TYPE_DEONLY */ { SIG_PROP_FLOW_ACTION_PACKET, },
122  /* SIG_TYPE_PKT */ { SIG_PROP_FLOW_ACTION_PACKET, },
123  /* SIG_TYPE_PKT_STREAM */ { SIG_PROP_FLOW_ACTION_FLOW_IF_STATEFUL, },
124  /* SIG_TYPE_STREAM */ { SIG_PROP_FLOW_ACTION_FLOW_IF_STATEFUL, },
125  /* SIG_TYPE_APPLAYER */ { SIG_PROP_FLOW_ACTION_FLOW, },
126  /* SIG_TYPE_APP_TX */ { SIG_PROP_FLOW_ACTION_FLOW, },
127 };
128 // rule types documentation tag end: SignatureProperties
129 // clang-format on
130 
131 const char *DetectTableToString(enum DetectTable table)
132 {
133  switch (table) {
135  return "not_set";
137  return "pre_flow";
139  return "pre_stream";
141  return "packet_filter";
143  return "packet_td";
145  return "app_filter";
146  case DETECT_TABLE_APP_TD:
147  return "app_td";
148  default:
149  return "unknown";
150  }
151 }
152 
153 /** \brief register inspect engine at start up time
154  *
155  * \note errors are fatal */
159 {
161  const int sm_list = DetectBufferTypeGetByName(name);
162  if (sm_list == -1) {
163  FatalError("failed to register inspect engine %s", name);
164  }
165 
166  if ((sm_list < DETECT_SM_LIST_MATCH) || (sm_list >= SHRT_MAX) ||
167  (Callback == NULL))
168  {
169  SCLogError("Invalid arguments");
170  BUG_ON(1);
171  }
172 
173  DetectEnginePktInspectionEngine *new_engine = SCCalloc(1, sizeof(*new_engine));
174  if (unlikely(new_engine == NULL)) {
175  FatalError("failed to register inspect engine %s: %s", name, strerror(errno));
176  }
177  new_engine->sm_list = (uint16_t)sm_list;
178  new_engine->sm_list_base = (uint16_t)sm_list;
179  new_engine->v1.Callback = Callback;
180  new_engine->v1.GetData = GetPktData;
181 
182  if (g_pkt_inspect_engines == NULL) {
183  g_pkt_inspect_engines = new_engine;
184  } else {
185  DetectEnginePktInspectionEngine *t = g_pkt_inspect_engines;
186  while (t->next != NULL) {
187  t = t->next;
188  }
189 
190  t->next = new_engine;
191  }
192 }
193 
194 /** \brief register inspect engine at start up time
195  *
196  * \note errors are fatal */
197 static void AppLayerInspectEngineRegisterInternal(const char *name, AppProto alproto, uint32_t dir,
198  int progress, InspectEngineFuncPtr Callback, InspectionBufferGetDataPtr GetData,
199  InspectionSingleBufferGetDataPtr GetDataSingle,
200  InspectionMultiBufferGetDataPtr GetMultiData)
201 {
202  BUG_ON(progress >= 48);
203 
205  const int sm_list = DetectBufferTypeGetByName(name);
206  if (sm_list == -1) {
207  FatalError("failed to register inspect engine %s", name);
208  }
209  SCLogDebug("name %s id %d", name, sm_list);
210 
211  if ((alproto == ALPROTO_FAILED) || (!(dir == SIG_FLAG_TOSERVER || dir == SIG_FLAG_TOCLIENT)) ||
212  (sm_list < DETECT_SM_LIST_MATCH) || (sm_list >= SHRT_MAX) ||
213  (progress < 0 || progress >= SHRT_MAX) || (Callback == NULL)) {
214  SCLogError("Invalid arguments");
215  BUG_ON(1);
216  } else if (Callback == DetectEngineInspectBufferGeneric && GetData == NULL) {
217  SCLogError("Invalid arguments: must register "
218  "GetData with DetectEngineInspectBufferGeneric");
219  BUG_ON(1);
220  } else if (Callback == DetectEngineInspectBufferSingle && GetDataSingle == NULL) {
221  SCLogError("Invalid arguments: must register "
222  "GetData with DetectEngineInspectBufferGeneric");
223  BUG_ON(1);
224  } else if (Callback == DetectEngineInspectMultiBufferGeneric && GetMultiData == NULL) {
225  SCLogError("Invalid arguments: must register "
226  "GetData with DetectEngineInspectMultiBufferGeneric");
227  BUG_ON(1);
228  }
229 
230  uint8_t direction;
231  if (dir == SIG_FLAG_TOSERVER) {
232  direction = 0;
233  } else {
234  direction = 1;
235  }
236  // every DNS or HTTP2 can be accessed from DOH2
237  if (alproto == ALPROTO_HTTP2 || alproto == ALPROTO_DNS) {
238  AppLayerInspectEngineRegisterInternal(
239  name, ALPROTO_DOH2, dir, progress, Callback, GetData, GetDataSingle, GetMultiData);
240  }
241 
242  DetectEngineAppInspectionEngine *new_engine =
244  if (unlikely(new_engine == NULL)) {
245  exit(EXIT_FAILURE);
246  }
247  new_engine->alproto = alproto;
248  new_engine->dir = direction;
249  new_engine->sm_list = (uint16_t)sm_list;
250  new_engine->sm_list_base = (uint16_t)sm_list;
251  new_engine->progress = (int16_t)progress;
252  new_engine->v2.Callback = Callback;
253  if (Callback == DetectEngineInspectBufferGeneric) {
254  new_engine->v2.GetData = GetData;
255  } else if (Callback == DetectEngineInspectBufferSingle) {
256  new_engine->v2.GetDataSingle = GetDataSingle;
257  } else if (Callback == DetectEngineInspectMultiBufferGeneric) {
258  new_engine->v2.GetMultiData = GetMultiData;
259  }
260 
261  if (g_app_inspect_engines == NULL) {
262  g_app_inspect_engines = new_engine;
263  } else {
264  DetectEngineAppInspectionEngine *t = g_app_inspect_engines;
265  while (t->next != NULL) {
266  t = t->next;
267  }
268 
269  t->next = new_engine;
270  }
271 }
272 
273 void DetectAppLayerInspectEngineRegister(const char *name, AppProto alproto, uint32_t dir,
274  int progress, InspectEngineFuncPtr Callback, InspectionBufferGetDataPtr GetData)
275 {
276  /* before adding, check that we don't add a duplicate entry, which will
277  * propagate all the way into the packet runtime if allowed. */
278  DetectEngineAppInspectionEngine *t = g_app_inspect_engines;
279  while (t != NULL) {
280  const uint32_t t_direction = t->dir == 0 ? SIG_FLAG_TOSERVER : SIG_FLAG_TOCLIENT;
281  const int sm_list = DetectBufferTypeGetByName(name);
282 
283  if (t->sm_list == sm_list && t->alproto == alproto && t_direction == dir &&
284  t->progress == progress && t->v2.Callback == Callback && t->v2.GetData == GetData) {
286  return;
287  }
288  t = t->next;
289  }
290 
291  AppLayerInspectEngineRegisterInternal(
292  name, alproto, dir, progress, Callback, GetData, NULL, NULL);
293 }
294 
295 void DetectAppLayerInspectEngineRegisterSingle(const char *name, AppProto alproto, uint32_t dir,
296  int progress, InspectEngineFuncPtr Callback, InspectionSingleBufferGetDataPtr GetData)
297 {
298  /* before adding, check that we don't add a duplicate entry, which will
299  * propagate all the way into the packet runtime if allowed. */
300  DetectEngineAppInspectionEngine *t = g_app_inspect_engines;
301  while (t != NULL) {
302  const uint32_t t_direction = t->dir == 0 ? SIG_FLAG_TOSERVER : SIG_FLAG_TOCLIENT;
303  const int sm_list = DetectBufferTypeGetByName(name);
304 
305  if (t->sm_list == sm_list && t->alproto == alproto && t_direction == dir &&
306  t->progress == progress && t->v2.Callback == Callback &&
307  t->v2.GetDataSingle == GetData) {
309  return;
310  }
311  t = t->next;
312  }
313 
314  AppLayerInspectEngineRegisterInternal(
315  name, alproto, dir, progress, Callback, NULL, GetData, NULL);
316 }
317 
318 /* copy an inspect engine with transforms to a new list id. */
319 static void DetectAppLayerInspectEngineCopy(
321  int sm_list, int new_list,
322  const DetectEngineTransforms *transforms)
323 {
324  const DetectEngineAppInspectionEngine *t = g_app_inspect_engines;
325  while (t) {
326  if (t->sm_list == sm_list) {
328  if (unlikely(new_engine == NULL)) {
329  exit(EXIT_FAILURE);
330  }
331  new_engine->alproto = t->alproto;
332  new_engine->dir = t->dir;
333  DEBUG_VALIDATE_BUG_ON(new_list < 0 || new_list > UINT16_MAX);
334  new_engine->sm_list = (uint16_t)new_list; /* use new list id */
335  DEBUG_VALIDATE_BUG_ON(sm_list < 0 || sm_list > UINT16_MAX);
336  new_engine->sm_list_base = (uint16_t)sm_list;
337  new_engine->progress = t->progress;
338  new_engine->v2 = t->v2;
339  new_engine->v2.transforms = transforms; /* assign transforms */
340 
341  if (de_ctx->app_inspect_engines == NULL) {
342  de_ctx->app_inspect_engines = new_engine;
343  } else {
345  while (list->next != NULL) {
346  list = list->next;
347  }
348 
349  list->next = new_engine;
350  }
351  }
352  t = t->next;
353  }
354 }
355 
356 /* copy inspect engines from global registrations to de_ctx list */
357 static void DetectAppLayerInspectEngineCopyListToDetectCtx(DetectEngineCtx *de_ctx)
358 {
359  const DetectEngineAppInspectionEngine *t = g_app_inspect_engines;
361  while (t) {
363  if (unlikely(new_engine == NULL)) {
364  exit(EXIT_FAILURE);
365  }
366  new_engine->alproto = t->alproto;
367  new_engine->dir = t->dir;
368  new_engine->sm_list = t->sm_list;
369  new_engine->sm_list_base = t->sm_list;
370  new_engine->progress = t->progress;
371  new_engine->v2 = t->v2;
372 
373  if (list == NULL) {
374  de_ctx->app_inspect_engines = new_engine;
375  } else {
376  list->next = new_engine;
377  }
378  list = new_engine;
379 
380  t = t->next;
381  }
382 }
383 
384 /* copy an inspect engine with transforms to a new list id. */
385 static void DetectPktInspectEngineCopy(
387  int sm_list, int new_list,
388  const DetectEngineTransforms *transforms)
389 {
390  const DetectEnginePktInspectionEngine *t = g_pkt_inspect_engines;
391  while (t) {
392  if (t->sm_list == sm_list) {
394  if (unlikely(new_engine == NULL)) {
395  exit(EXIT_FAILURE);
396  }
397  DEBUG_VALIDATE_BUG_ON(new_list < 0 || new_list > UINT16_MAX);
398  new_engine->sm_list = (uint16_t)new_list; /* use new list id */
399  DEBUG_VALIDATE_BUG_ON(sm_list < 0 || sm_list > UINT16_MAX);
400  new_engine->sm_list_base = (uint16_t)sm_list;
401  new_engine->v1 = t->v1;
402  new_engine->v1.transforms = transforms; /* assign transforms */
403 
404  if (de_ctx->pkt_inspect_engines == NULL) {
405  de_ctx->pkt_inspect_engines = new_engine;
406  } else {
408  while (list->next != NULL) {
409  list = list->next;
410  }
411 
412  list->next = new_engine;
413  }
414  }
415  t = t->next;
416  }
417 }
418 
419 /* copy inspect engines from global registrations to de_ctx list */
420 static void DetectPktInspectEngineCopyListToDetectCtx(DetectEngineCtx *de_ctx)
421 {
422  const DetectEnginePktInspectionEngine *t = g_pkt_inspect_engines;
423  while (t) {
424  SCLogDebug("engine %p", t);
426  if (unlikely(new_engine == NULL)) {
427  exit(EXIT_FAILURE);
428  }
429  new_engine->sm_list = t->sm_list;
430  new_engine->sm_list_base = t->sm_list;
431  new_engine->v1 = t->v1;
432 
433  if (de_ctx->pkt_inspect_engines == NULL) {
434  de_ctx->pkt_inspect_engines = new_engine;
435  } else {
437  while (list->next != NULL) {
438  list = list->next;
439  }
440 
441  list->next = new_engine;
442  }
443 
444  t = t->next;
445  }
446 }
447 
448 /** \brief register inspect engine at start up time
449  *
450  * \note errors are fatal */
452  InspectionBufferFrameInspectFunc Callback, AppProto alproto, uint8_t type)
453 {
454  const int sm_list = DetectEngineBufferTypeRegister(de_ctx, name);
455  if (sm_list < 0) {
456  FatalError("failed to register inspect engine %s", name);
457  }
458 
459  if ((sm_list < DETECT_SM_LIST_MATCH) || (sm_list >= SHRT_MAX) || (Callback == NULL)) {
460  SCLogError("Invalid arguments");
461  BUG_ON(1);
462  }
463 
464  uint8_t direction;
465  if (dir == SIG_FLAG_TOSERVER) {
466  direction = 0;
467  } else {
468  direction = 1;
469  }
470 
471  DetectEngineFrameInspectionEngine *new_engine = SCCalloc(1, sizeof(*new_engine));
472  if (unlikely(new_engine == NULL)) {
473  FatalError("failed to register inspect engine %s: %s", name, strerror(errno));
474  }
475  new_engine->sm_list = (uint16_t)sm_list;
476  new_engine->sm_list_base = (uint16_t)sm_list;
477  new_engine->dir = direction;
478  new_engine->v1.Callback = Callback;
479  new_engine->alproto = alproto;
480  new_engine->type = type;
481 
482  if (de_ctx->frame_inspect_engines == NULL) {
483  de_ctx->frame_inspect_engines = new_engine;
484  } else {
486  while (list->next != NULL) {
487  list = list->next;
488  }
489 
490  list->next = new_engine;
491  }
492 }
493 
494 /* copy an inspect engine with transforms to a new list id. */
495 static void DetectFrameInspectEngineCopy(DetectEngineCtx *de_ctx, int sm_list, int new_list,
496  const DetectEngineTransforms *transforms)
497 {
498  /* take the list from the detect engine as the buffers can be registered
499  * dynamically. */
501  while (t) {
502  if (t->sm_list == sm_list) {
505  if (unlikely(new_engine == NULL)) {
506  exit(EXIT_FAILURE);
507  }
508  DEBUG_VALIDATE_BUG_ON(new_list < 0 || new_list > UINT16_MAX);
509  new_engine->sm_list = (uint16_t)new_list; /* use new list id */
510  DEBUG_VALIDATE_BUG_ON(sm_list < 0 || sm_list > UINT16_MAX);
511  new_engine->sm_list_base = (uint16_t)sm_list;
512  new_engine->dir = t->dir;
513  new_engine->alproto = t->alproto;
514  new_engine->type = t->type;
515  new_engine->v1 = t->v1;
516  new_engine->v1.transforms = transforms; /* assign transforms */
517 
518  /* append to the list */
520  while (list->next != NULL) {
521  list = list->next;
522  }
523 
524  list->next = new_engine;
525  }
526  t = t->next;
527  }
528 }
529 
530 /* copy inspect engines from global registrations to de_ctx list */
531 static void DetectFrameInspectEngineCopyListToDetectCtx(DetectEngineCtx *de_ctx)
532 {
533  const DetectEngineFrameInspectionEngine *t = g_frame_inspect_engines;
534  while (t) {
535  SCLogDebug("engine %p", t);
538  if (unlikely(new_engine == NULL)) {
539  exit(EXIT_FAILURE);
540  }
541  new_engine->sm_list = t->sm_list;
542  new_engine->sm_list_base = t->sm_list;
543  new_engine->dir = t->dir;
544  new_engine->alproto = t->alproto;
545  new_engine->type = t->type;
546  new_engine->v1 = t->v1;
547 
548  if (de_ctx->frame_inspect_engines == NULL) {
549  de_ctx->frame_inspect_engines = new_engine;
550  } else {
552  while (list->next != NULL) {
553  list = list->next;
554  }
555 
556  list->next = new_engine;
557  }
558 
559  t = t->next;
560  }
561 }
562 
563 /** \internal
564  * \brief append the stream inspection
565  *
566  * If stream inspection is MPM, then prepend it.
567  */
568 static void AppendStreamInspectEngine(
569  Signature *s, SigMatchData *stream, uint8_t direction, uint8_t id)
570 {
571  bool prepend = false;
572 
574  if (unlikely(new_engine == NULL)) {
575  exit(EXIT_FAILURE);
576  }
578  SCLogDebug("stream is mpm");
579  prepend = true;
580  new_engine->mpm = true;
581  }
582  new_engine->alproto = ALPROTO_UNKNOWN; /* all */
583  new_engine->dir = direction;
584  new_engine->stream = true;
585  new_engine->sm_list = DETECT_SM_LIST_PMATCH;
586  new_engine->sm_list_base = DETECT_SM_LIST_PMATCH;
587  new_engine->smd = stream;
588  new_engine->v2.Callback = DetectEngineInspectStream;
589  new_engine->progress = 0;
590 
591  /* append */
592  if (s->app_inspect == NULL) {
593  s->app_inspect = new_engine;
594  new_engine->id = DE_STATE_FLAG_BASE; /* id is used as flag in stateful detect */
595  } else if (prepend) {
596  new_engine->next = s->app_inspect;
597  s->app_inspect = new_engine;
598  new_engine->id = id;
599 
600  } else {
602  while (a->next != NULL) {
603  a = a->next;
604  }
605 
606  a->next = new_engine;
607  new_engine->id = id;
608  }
609  SCLogDebug("sid %u: engine %p/%u added", s->id, new_engine, new_engine->id);
610 }
611 
612 static void AppendFrameInspectEngine(DetectEngineCtx *de_ctx,
614  const int mpm_list)
615 {
616  bool prepend = false;
617 
618  if (u->alproto == ALPROTO_UNKNOWN) {
619  /* special case, inspect engine applies to all protocols */
620  } else if (s->alproto != ALPROTO_UNKNOWN && !AppProtoEquals(s->alproto, u->alproto))
621  return;
622 
623  if (s->flags & SIG_FLAG_TOSERVER && !(s->flags & SIG_FLAG_TOCLIENT)) {
624  if (u->dir == 1)
625  return;
626  } else if (s->flags & SIG_FLAG_TOCLIENT && !(s->flags & SIG_FLAG_TOSERVER)) {
627  if (u->dir == 0)
628  return;
629  }
630 
633  if (unlikely(new_engine == NULL)) {
634  exit(EXIT_FAILURE);
635  }
636  if (mpm_list == u->sm_list) {
638  prepend = true;
639  new_engine->mpm = true;
640  }
641 
642  new_engine->type = u->type;
643  new_engine->sm_list = u->sm_list;
644  new_engine->sm_list_base = u->sm_list_base;
645  new_engine->smd = smd;
646  new_engine->v1 = u->v1;
647  SCLogDebug("sm_list %d new_engine->v1 %p/%p", new_engine->sm_list, new_engine->v1.Callback,
648  new_engine->v1.transforms);
649 
650  if (s->frame_inspect == NULL) {
651  s->frame_inspect = new_engine;
652  } else if (prepend) {
653  new_engine->next = s->frame_inspect;
654  s->frame_inspect = new_engine;
655  } else {
657  while (a->next != NULL) {
658  a = a->next;
659  }
660  new_engine->next = a->next;
661  a->next = new_engine;
662  }
663 }
664 
665 static void AppendPacketInspectEngine(DetectEngineCtx *de_ctx,
667  const int mpm_list)
668 {
669  bool prepend = false;
670 
671  DetectEnginePktInspectionEngine *new_engine =
673  if (unlikely(new_engine == NULL)) {
674  exit(EXIT_FAILURE);
675  }
676  if (mpm_list == e->sm_list) {
678  prepend = true;
679  new_engine->mpm = true;
680  }
681 
682  new_engine->sm_list = e->sm_list;
683  new_engine->sm_list_base = e->sm_list_base;
684  new_engine->smd = smd;
685  new_engine->v1 = e->v1;
686  SCLogDebug("sm_list %d new_engine->v1 %p/%p/%p", new_engine->sm_list, new_engine->v1.Callback,
687  new_engine->v1.GetData, new_engine->v1.transforms);
688 
689  if (s->pkt_inspect == NULL) {
690  s->pkt_inspect = new_engine;
691  } else if (prepend) {
692  new_engine->next = s->pkt_inspect;
693  s->pkt_inspect = new_engine;
694  } else {
696  while (a->next != NULL) {
697  a = a->next;
698  }
699  new_engine->next = a->next;
700  a->next = new_engine;
701  }
702 }
703 
704 static void AppendAppInspectEngine(DetectEngineCtx *de_ctx,
706  const int mpm_list, const int files_id, uint8_t *last_id, bool *head_is_mpm)
707 {
708  if (t->alproto == ALPROTO_UNKNOWN) {
709  /* special case, inspect engine applies to all protocols */
710  } else if (s->alproto != ALPROTO_UNKNOWN && !AppProtoEquals(s->alproto, t->alproto))
711  return;
712 
713  if (s->flags & SIG_FLAG_TOSERVER && !(s->flags & SIG_FLAG_TOCLIENT)) {
714  if (t->dir == 1)
715  return;
716  } else if (s->flags & SIG_FLAG_TOCLIENT && !(s->flags & SIG_FLAG_TOSERVER)) {
717  if (t->dir == 0)
718  return;
719  }
720  SCLogDebug("app engine: t %p t->id %u => alproto:%s files:%s", t, t->id,
721  AppProtoToString(t->alproto), BOOL2STR(t->sm_list == files_id));
722 
723  DetectEngineAppInspectionEngine *new_engine =
725  if (unlikely(new_engine == NULL)) {
726  exit(EXIT_FAILURE);
727  }
728  bool prepend = false;
729  if (mpm_list == t->sm_list) {
731  prepend = true;
732  *head_is_mpm = true;
733  new_engine->mpm = true;
734  }
735 
736  new_engine->alproto = t->alproto;
737  new_engine->dir = t->dir;
738  new_engine->sm_list = t->sm_list;
739  new_engine->sm_list_base = t->sm_list_base;
740  new_engine->smd = smd;
741  new_engine->match_on_null = smd ? DetectContentInspectionMatchOnAbsentBuffer(smd) : false;
742  new_engine->progress = t->progress;
743  new_engine->v2 = t->v2;
744  SCLogDebug("sm_list %d new_engine->v2 %p/%p/%p", new_engine->sm_list, new_engine->v2.Callback,
745  new_engine->v2.GetData, new_engine->v2.transforms);
746 
747  if (s->app_inspect == NULL) {
748  s->app_inspect = new_engine;
749  if (new_engine->sm_list == files_id) {
750  new_engine->id = DE_STATE_ID_FILE_INSPECT;
751  SCLogDebug("sid %u: engine %p/%u is FILE ENGINE", s->id, new_engine, new_engine->id);
752  } else {
753  new_engine->id = DE_STATE_FLAG_BASE; /* id is used as flag in stateful detect */
754  SCLogDebug("sid %u: engine %p/%u %s", s->id, new_engine, new_engine->id,
756  }
757 
758  /* prepend engine if forced or if our engine has a lower progress. */
759  } else if (prepend || (!(*head_is_mpm) && s->app_inspect->progress > new_engine->progress)) {
760  new_engine->next = s->app_inspect;
761  s->app_inspect = new_engine;
762  if (new_engine->sm_list == files_id) {
763  new_engine->id = DE_STATE_ID_FILE_INSPECT;
764  SCLogDebug("sid %u: engine %p/%u is FILE ENGINE", s->id, new_engine, new_engine->id);
765  } else {
766  new_engine->id = ++(*last_id);
767  SCLogDebug("sid %u: engine %p/%u %s", s->id, new_engine, new_engine->id,
769  }
770 
771  } else {
773  while (a->next != NULL) {
774  if (a->next && a->next->progress > new_engine->progress) {
775  break;
776  }
777  a = a->next;
778  }
779 
780  new_engine->next = a->next;
781  a->next = new_engine;
782  if (new_engine->sm_list == files_id) {
783  new_engine->id = DE_STATE_ID_FILE_INSPECT;
784  SCLogDebug("sid %u: engine %p/%u is FILE ENGINE", s->id, new_engine, new_engine->id);
785  } else {
786  new_engine->id = ++(*last_id);
787  SCLogDebug("sid %u: engine %p/%u %s", s->id, new_engine, new_engine->id,
789  }
790  }
791 
792  SCLogDebug("sid %u: engine %p/%u added", s->id, new_engine, new_engine->id);
793 
795 }
796 
797 /**
798  * \note for the file inspect engine, the id DE_STATE_ID_FILE_INSPECT
799  * is assigned.
800  */
802 {
803  const int mpm_list = s->init_data->mpm_sm ? s->init_data->mpm_sm_list : -1;
804  const int files_id = DetectBufferTypeGetByName("files");
805  bool head_is_mpm = false;
806  uint8_t last_id = DE_STATE_FLAG_BASE;
807  SCLogDebug("%u: setup app inspect engines. %u buffers", s->id, s->init_data->buffer_index);
808 
809  for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
811  SCLogDebug("smd %p, id %u", smd, s->init_data->buffers[x].id);
812 
813  const DetectBufferType *b =
815  if (b == NULL)
816  FatalError("unknown buffer");
817 
818  if (b->frame) {
820  u != NULL; u = u->next) {
821  if (u->sm_list == s->init_data->buffers[x].id) {
822  AppendFrameInspectEngine(de_ctx, u, s, smd, mpm_list);
823  }
824  }
825  } else if (b->packet) {
826  /* set up pkt inspect engines */
827  for (const DetectEnginePktInspectionEngine *e = de_ctx->pkt_inspect_engines; e != NULL;
828  e = e->next) {
829  SCLogDebug("e %p sm_list %u", e, e->sm_list);
830  if (e->sm_list == s->init_data->buffers[x].id) {
831  AppendPacketInspectEngine(de_ctx, e, s, smd, mpm_list);
832  }
833  }
834  } else {
835  SCLogDebug("app %s id %u parent %u rule %u xforms %u", b->name, b->id, b->parent_id,
836  s->init_data->buffers[x].id, b->transforms.cnt);
837  for (const DetectEngineAppInspectionEngine *t = de_ctx->app_inspect_engines; t != NULL;
838  t = t->next) {
839  if (t->sm_list == s->init_data->buffers[x].id) {
840  if (s->flags & SIG_FLAG_TXBOTHDIR) {
841  // ambiguous keywords have app engines in both directions
842  // so we skip the wrong direction for this buffer
843  if (s->init_data->buffers[x].only_tc && t->dir == 0) {
844  continue;
845  } else if (s->init_data->buffers[x].only_ts && t->dir == 1) {
846  continue;
847  }
848  }
849  AppendAppInspectEngine(
850  de_ctx, t, s, smd, mpm_list, files_id, &last_id, &head_is_mpm);
851  }
852  }
853  }
854  }
855 
856  /* handle rules that have an app-layer hook w/o bringing their own app inspect engine,
857  * e.g. `alert dns:request_complete ... (sid:1;)`
858  *
859  * Here we use a minimal stub inspect engine in which we set:
860  * - alproto
861  * - progress
862  * - sm_list/sm_list_base to get the mapping to the hook name
863  * - dir based on sig direction
864  *
865  * The inspect engine has no callback and is thus considered a straight match.
866  */
868  uint8_t dir = 0;
872  if (s->flags & SIG_FLAG_TOSERVER)
873  dir = 0;
874  else if (s->flags & SIG_FLAG_TOCLIENT)
875  dir = 1;
876 
878  .alproto = s->init_data->hook.t.app.alproto,
879  .progress = (uint16_t)s->init_data->hook.t.app.app_progress,
880  .sm_list = (uint16_t)s->init_data->hook.sm_list,
881  .sm_list_base = (uint16_t)s->init_data->hook.sm_list,
882  .dir = dir,
883  };
884  AppendAppInspectEngine(de_ctx, &t, s, NULL, mpm_list, files_id, &last_id, &head_is_mpm);
885  }
886 
889  {
890  /* if engine is added multiple times, we pass it the same list */
892  BUG_ON(stream == NULL);
893  if (s->flags & SIG_FLAG_TOSERVER && !(s->flags & SIG_FLAG_TOCLIENT)) {
894  AppendStreamInspectEngine(s, stream, 0, last_id + 1);
895  } else if (s->flags & SIG_FLAG_TOCLIENT && !(s->flags & SIG_FLAG_TOSERVER)) {
896  AppendStreamInspectEngine(s, stream, 1, last_id + 1);
897  } else {
898  AppendStreamInspectEngine(s, stream, 0, last_id + 1);
899  AppendStreamInspectEngine(s, stream, 1, last_id + 1);
900  }
901 
903  SCLogDebug("set SIG_FLAG_FLUSH on %u", s->id);
904  s->flags |= SIG_FLAG_FLUSH;
905  }
906  }
907 
908 #ifdef DEBUG
910  while (iter) {
911  SCLogDebug("%u: engine %s id %u progress %d %s", s->id,
913  iter->sm_list == mpm_list ? "MPM" : "");
914  iter = iter->next;
915  }
916 #endif
917  return 0;
918 }
919 
920 /** \brief free app inspect engines for a signature
921  *
922  * For lists that are registered multiple times, like http_header and
923  * http_cookie, making the engines owner of the lists is complicated.
924  * Multiple engines in a sig may be pointing to the same list. To
925  * address this the 'free' code needs to be extra careful about not
926  * double freeing, so it takes an approach to first fill an array
927  * of the to-free pointers before freeing them.
928  */
930 {
931  int engines = 0;
932 
934  while (ie) {
935  ie = ie->next;
936  engines++;
937  }
939  while (e) {
940  e = e->next;
941  engines++;
942  }
944  while (u) {
945  u = u->next;
946  engines++;
947  }
948  if (engines == 0) {
949  BUG_ON(s->pkt_inspect);
950  BUG_ON(s->frame_inspect);
951  return;
952  }
953 
954  SigMatchData *bufs[engines];
955  memset(&bufs, 0, (engines * sizeof(SigMatchData *)));
956  int arrays = 0;
957 
958  /* free engines and put smd in the array */
959  ie = s->app_inspect;
960  while (ie) {
962 
963  bool skip = false;
964  for (int i = 0; i < arrays; i++) {
965  if (bufs[i] == ie->smd) {
966  skip = true;
967  break;
968  }
969  }
970  if (!skip) {
971  bufs[arrays++] = ie->smd;
972  }
973  SCFree(ie);
974  ie = next;
975  }
976  e = s->pkt_inspect;
977  while (e) {
979 
980  bool skip = false;
981  for (int i = 0; i < arrays; i++) {
982  if (bufs[i] == e->smd) {
983  skip = true;
984  break;
985  }
986  }
987  if (!skip) {
988  bufs[arrays++] = e->smd;
989  }
990  SCFree(e);
991  e = next;
992  }
993  u = s->frame_inspect;
994  while (u) {
996 
997  bool skip = false;
998  for (int i = 0; i < arrays; i++) {
999  if (bufs[i] == u->smd) {
1000  skip = true;
1001  break;
1002  }
1003  }
1004  if (!skip) {
1005  bufs[arrays++] = u->smd;
1006  }
1007  SCFree(u);
1008  u = next;
1009  }
1010 
1011  for (int i = 0; i < engines; i++) {
1012  if (bufs[i] == NULL)
1013  continue;
1014  SigMatchData *smd = bufs[i];
1015  while (1) {
1016  if (sigmatch_table[smd->type].Free != NULL) {
1017  sigmatch_table[smd->type].Free(de_ctx, smd->ctx);
1018  }
1019  if (smd->is_last)
1020  break;
1021  smd++;
1022  }
1023  SCFree(bufs[i]);
1024  }
1025 }
1026 
1027 /* code for registering buffers */
1028 
1029 #include "util-hash-lookup3.h"
1030 
1031 static HashListTable *g_buffer_type_hash = NULL;
1032 static int g_buffer_type_id = DETECT_SM_LIST_DYNAMIC_START;
1033 static int g_buffer_type_reg_closed = 0;
1034 
1036 {
1037  return g_buffer_type_id;
1038 }
1039 
1040 static void DetectBufferAddTransformData(DetectBufferType *map)
1041 {
1042  for (int i = 0; i < map->transforms.cnt; i++) {
1043  const TransformData *t = &map->transforms.transforms[i];
1046  &map->xform_id[i].id_data, &map->xform_id[i].id_data_len, t->options);
1047  SCLogDebug("transform identity data: [%p] \"%s\" [%d]", map->xform_id[i].id_data,
1048  (char *)map->xform_id[i].id_data, map->xform_id[i].id_data_len);
1049  }
1050  }
1051 }
1052 
1053 static uint32_t DetectBufferTypeHashNameFunc(HashListTable *ht, void *data, uint16_t datalen)
1054 {
1055  const DetectBufferType *map = (DetectBufferType *)data;
1056  uint32_t hash = hashlittle_safe(map->name, strlen(map->name), 0);
1057 
1058  // Add the transform data
1059  // - Collect transform id and position
1060  // - Collect identity data, if any
1061  hash += hashlittle_safe((uint8_t *)&map->transforms.cnt, sizeof(map->transforms.cnt), 0);
1062  for (int i = 0; i < map->transforms.cnt; i++) {
1063  const TransformData *t = &map->transforms.transforms[i];
1064  int tval = t->transform;
1065  hash += hashlittle_safe((uint8_t *)&tval, sizeof(tval), 0);
1066  if (map->xform_id[i].id_data) {
1067  hash += hashlittle_safe(
1068  &map->xform_id[i].id_data_len, sizeof(map->xform_id[i].id_data_len), 0);
1069  hash += hashlittle_safe(map->xform_id[i].id_data, map->xform_id[i].id_data_len, 0);
1070  }
1071  }
1072  hash %= ht->array_size;
1073  SCLogDebug("map->name %s, hash %d", map->name, hash);
1074  return hash;
1075 }
1076 
1077 static uint32_t DetectBufferTypeHashIdFunc(HashListTable *ht, void *data, uint16_t datalen)
1078 {
1079  const DetectBufferType *map = (DetectBufferType *)data;
1080  uint32_t hash = map->id;
1081  hash %= ht->array_size;
1082  return hash;
1083 }
1084 
1085 static char DetectBufferTypeCompareNameFunc(void *data1, uint16_t len1, void *data2, uint16_t len2)
1086 {
1087  DetectBufferType *map1 = (DetectBufferType *)data1;
1088  DetectBufferType *map2 = (DetectBufferType *)data2;
1089 
1090  char r = (strcmp(map1->name, map2->name) == 0);
1091 
1092  // Compare the transforms
1093  // the transform supports identity, that data will also be added.
1094  r &= map1->transforms.cnt == map2->transforms.cnt;
1095  if (r && map1->transforms.cnt) {
1096  for (int i = 0; i < map1->transforms.cnt; i++) {
1097  if (map1->transforms.transforms[i].transform !=
1098  map2->transforms.transforms[i].transform) {
1099  r = 0;
1100  break;
1101  }
1102 
1103  SCLogDebug("%s: transform ids match; checking specialized data", map1->name);
1104  // Checks
1105  // - Both NULL: --> ok, continue
1106  // - One NULL: --> no match, break?
1107  // - identity data lengths match: --> ok, continue
1108  // - identity data matches: ok
1109 
1110  // Stop if only one is NULL
1111  if ((map1->xform_id[i].id_data == NULL) ^ (map2->xform_id[i].id_data == NULL)) {
1112  SCLogDebug("identity data: only one is null");
1113  r = 0;
1114  break;
1115  } else if (map1->xform_id[i].id_data == NULL) { /* continue when both are null */
1116  SCLogDebug("identity data: both null");
1117  r = 1;
1118  continue;
1119  } else if (map1->xform_id[i].id_data_len != map2->xform_id[i].id_data_len) {
1120  // Stop when id data lengths aren't equal
1121  SCLogDebug("id data: unequal lengths");
1122  r = 0;
1123  break;
1124  }
1125 
1126  // stop if the identity data is different
1127  r &= memcmp(map1->xform_id[i].id_data, map2->xform_id[i].id_data,
1128  map1->xform_id[i].id_data_len) == 0;
1129  if (r == 0)
1130  break;
1131  SCLogDebug("identity data: data matches");
1132  }
1133  }
1134  return r;
1135 }
1136 
1137 static char DetectBufferTypeCompareIdFunc(void *data1, uint16_t len1, void *data2, uint16_t len2)
1138 {
1139  DetectBufferType *map1 = (DetectBufferType *)data1;
1140  DetectBufferType *map2 = (DetectBufferType *)data2;
1141  return map1->id == map2->id;
1142 }
1143 
1144 static void DetectBufferTypeFreeFunc(void *data)
1145 {
1146  DetectBufferType *map = (DetectBufferType *)data;
1147 
1148  if (map == NULL) {
1149  return;
1150  }
1151 
1152  /* Release transformation option memory, if any */
1153  for (int i = 0; i < map->transforms.cnt; i++) {
1154  if (map->transforms.transforms[i].options == NULL)
1155  continue;
1156 
1157  if (sigmatch_table[map->transforms.transforms[i].transform].Free == NULL) {
1158  SCLogError("%s allocates transform option memory but has no free routine",
1160  continue;
1161  }
1163  }
1164 
1165  SCFree(map);
1166 }
1167 
1168 static int DetectBufferTypeInit(void)
1169 {
1170  BUG_ON(g_buffer_type_hash);
1171  g_buffer_type_hash = HashListTableInit(256, DetectBufferTypeHashNameFunc,
1172  DetectBufferTypeCompareNameFunc, DetectBufferTypeFreeFunc);
1173  if (g_buffer_type_hash == NULL)
1174  return -1;
1175 
1176  return 0;
1177 }
1178 #if 0
1179 static void DetectBufferTypeFree(void)
1180 {
1181  if (g_buffer_type_hash == NULL)
1182  return;
1183 
1184  HashListTableFree(g_buffer_type_hash);
1185  g_buffer_type_hash = NULL;
1186 }
1187 #endif
1188 static int DetectBufferTypeAdd(const char *string)
1189 {
1190  BUG_ON(string == NULL || strlen(string) >= 64);
1191 
1192  DetectBufferType *map = SCCalloc(1, sizeof(*map));
1193  if (map == NULL)
1194  return -1;
1195 
1196  strlcpy(map->name, string, sizeof(map->name));
1197  map->id = g_buffer_type_id++;
1198 
1199  BUG_ON(HashListTableAdd(g_buffer_type_hash, (void *)map, 0) != 0);
1200  SCLogDebug("buffer %s registered with id %d", map->name, map->id);
1201  return map->id;
1202 }
1203 
1204 static DetectBufferType *DetectBufferTypeLookupByName(const char *string)
1205 {
1206  DetectBufferType map;
1207  memset(&map, 0, sizeof(map));
1208  strlcpy(map.name, string, sizeof(map.name));
1209 
1210  DetectBufferType *res = HashListTableLookup(g_buffer_type_hash, &map, 0);
1211  return res;
1212 }
1213 
1215 {
1216  BUG_ON(g_buffer_type_reg_closed);
1217  if (g_buffer_type_hash == NULL)
1218  DetectBufferTypeInit();
1219 
1220  DetectBufferType *exists = DetectBufferTypeLookupByName(name);
1221  if (!exists) {
1222  return DetectBufferTypeAdd(name);
1223  } else {
1224  return exists->id;
1225  }
1226 }
1227 
1229 {
1230  BUG_ON(g_buffer_type_reg_closed);
1232  DetectBufferType *exists = DetectBufferTypeLookupByName(name);
1233  BUG_ON(!exists);
1234  exists->multi_instance = true;
1235  SCLogDebug("%p %s -- %d supports multi instance", exists, name, exists->id);
1236 }
1237 
1239 {
1240  BUG_ON(g_buffer_type_reg_closed);
1242  DetectBufferType *exists = DetectBufferTypeLookupByName(name);
1243  BUG_ON(!exists);
1244  exists->frame = true;
1245  SCLogDebug("%p %s -- %d supports frame inspection", exists, name, exists->id);
1246 }
1247 
1249 {
1250  BUG_ON(g_buffer_type_reg_closed);
1252  DetectBufferType *exists = DetectBufferTypeLookupByName(name);
1253  BUG_ON(!exists);
1254  exists->packet = true;
1255  SCLogDebug("%p %s -- %d supports packet inspection", exists, name, exists->id);
1256 }
1257 
1259 {
1260  BUG_ON(g_buffer_type_reg_closed);
1262  DetectBufferType *exists = DetectBufferTypeLookupByName(name);
1263  BUG_ON(!exists);
1264  exists->mpm = true;
1265  SCLogDebug("%p %s -- %d supports mpm", exists, name, exists->id);
1266 }
1267 
1269 {
1270  BUG_ON(g_buffer_type_reg_closed);
1272  DetectBufferType *exists = DetectBufferTypeLookupByName(name);
1273  BUG_ON(!exists);
1274  exists->supports_transforms = true;
1275  SCLogDebug("%p %s -- %d supports transformations", exists, name, exists->id);
1276 }
1277 
1279 {
1280  DetectBufferType *exists = DetectBufferTypeLookupByName(name);
1281  if (!exists) {
1282  return -1;
1283  }
1284  return exists->id;
1285 }
1286 
1287 static DetectBufferType *DetectEngineBufferTypeLookupByName(
1288  const DetectEngineCtx *de_ctx, const char *string)
1289 {
1290  DetectBufferType map;
1291  memset(&map, 0, sizeof(map));
1292  strlcpy(map.name, string, sizeof(map.name));
1293 
1295  return res;
1296 }
1297 
1299 {
1300  DetectBufferType lookup;
1301  memset(&lookup, 0, sizeof(lookup));
1302  lookup.id = id;
1303  const DetectBufferType *res =
1304  HashListTableLookup(de_ctx->buffer_type_hash_id, (void *)&lookup, 0);
1305  return res;
1306 }
1307 
1309 {
1311  return res ? res->name : NULL;
1312 }
1313 
1314 static int DetectEngineBufferTypeAdd(DetectEngineCtx *de_ctx, const char *string)
1315 {
1316  BUG_ON(string == NULL || strlen(string) >= 32);
1317 
1318  DetectBufferType *map = SCCalloc(1, sizeof(*map));
1319  if (map == NULL)
1320  return -1;
1321 
1322  strlcpy(map->name, string, sizeof(map->name));
1323  map->id = de_ctx->buffer_type_id++;
1324 
1325  BUG_ON(HashListTableAdd(de_ctx->buffer_type_hash_name, (void *)map, 0) != 0);
1326  BUG_ON(HashListTableAdd(de_ctx->buffer_type_hash_id, (void *)map, 0) != 0);
1327  SCLogDebug("buffer %s registered with id %d", map->name, map->id);
1328  return map->id;
1329 }
1330 
1332  const int direction, const AppProto alproto, const uint8_t frame_type)
1333 {
1334  DetectBufferType *exists = DetectEngineBufferTypeLookupByName(de_ctx, name);
1335  if (exists) {
1336  return exists->id;
1337  }
1338 
1339  const int buffer_id = DetectEngineBufferTypeAdd(de_ctx, name);
1340  if (buffer_id < 0) {
1341  return -1;
1342  }
1343 
1344  /* TODO hack we need the map to get the name. Should we return the map at reg? */
1345  const DetectBufferType *map = DetectEngineBufferTypeGetById(de_ctx, buffer_id);
1346  BUG_ON(!map);
1347 
1348  /* register MPM/inspect engines */
1349  if (direction & SIG_FLAG_TOSERVER) {
1351  PrefilterGenericMpmFrameRegister, alproto, frame_type);
1353  DetectEngineInspectFrameBufferGeneric, alproto, frame_type);
1354  }
1355  if (direction & SIG_FLAG_TOCLIENT) {
1357  PrefilterGenericMpmFrameRegister, alproto, frame_type);
1359  DetectEngineInspectFrameBufferGeneric, alproto, frame_type);
1360  }
1361 
1362  return buffer_id;
1363 }
1364 
1366 {
1367  DetectBufferType *exists = DetectEngineBufferTypeLookupByName(de_ctx, name);
1368  if (!exists) {
1369  return DetectEngineBufferTypeAdd(de_ctx, name);
1370  } else {
1371  return exists->id;
1372  }
1373 }
1374 
1375 void DetectBufferTypeSetDescriptionByName(const char *name, const char *desc)
1376 {
1377  BUG_ON(desc == NULL || strlen(desc) >= 128);
1378 
1379  DetectBufferType *exists = DetectBufferTypeLookupByName(name);
1380  if (!exists) {
1381  return;
1382  }
1383  strlcpy(exists->description, desc, sizeof(exists->description));
1384 }
1385 
1387 {
1389  if (!exists) {
1390  return NULL;
1391  }
1392  return exists->description;
1393 }
1394 
1396 {
1397  DetectBufferType *exists = DetectEngineBufferTypeLookupByName(de_ctx, name);
1398  BUG_ON(!exists);
1399  exists->frame = true;
1400  SCLogDebug("%p %s -- %d supports frame inspection", exists, name, exists->id);
1401 }
1402 
1404 {
1405  DetectBufferType *exists = DetectEngineBufferTypeLookupByName(de_ctx, name);
1406  BUG_ON(!exists);
1407  exists->packet = true;
1408  SCLogDebug("%p %s -- %d supports packet inspection", exists, name, exists->id);
1409 }
1410 
1412 {
1413  DetectBufferType *exists = DetectEngineBufferTypeLookupByName(de_ctx, name);
1414  BUG_ON(!exists);
1415  exists->mpm = true;
1416  SCLogDebug("%p %s -- %d supports mpm", exists, name, exists->id);
1417 }
1418 
1420 {
1421  DetectBufferType *exists = DetectEngineBufferTypeLookupByName(de_ctx, name);
1422  BUG_ON(!exists);
1423  exists->supports_transforms = true;
1424  SCLogDebug("%p %s -- %d supports transformations", exists, name, exists->id);
1425 }
1426 
1428 {
1430  if (map == NULL)
1431  return false;
1432  SCLogDebug("map %p id %d multi_instance? %s", map, id, BOOL2STR(map->multi_instance));
1433  return map->multi_instance;
1434 }
1435 
1437 {
1439  if (map == NULL)
1440  return false;
1441  SCLogDebug("map %p id %d packet? %d", map, id, map->packet);
1442  return map->packet;
1443 }
1444 
1446 {
1448  if (map == NULL)
1449  return false;
1450  SCLogDebug("map %p id %d mpm? %d", map, id, map->mpm);
1451  return map->mpm;
1452 }
1453 
1455 {
1457  if (map == NULL)
1458  return false;
1459  SCLogDebug("map %p id %d frame? %d", map, id, map->frame);
1460  return map->frame;
1461 }
1462 
1464  void (*SetupCallback)(const DetectEngineCtx *, Signature *))
1465 {
1466  BUG_ON(g_buffer_type_reg_closed);
1468  DetectBufferType *exists = DetectBufferTypeLookupByName(name);
1469  BUG_ON(!exists);
1470  exists->SetupCallback = SetupCallback;
1471 }
1472 
1474 {
1476  if (map && map->SetupCallback) {
1477  map->SetupCallback(de_ctx, s);
1478  }
1479 }
1480 
1482  const char *name, bool (*ValidateCallback)(const Signature *, const char **sigerror,
1483  const DetectBufferType *))
1484 {
1485  BUG_ON(g_buffer_type_reg_closed);
1487  DetectBufferType *exists = DetectBufferTypeLookupByName(name);
1488  BUG_ON(!exists);
1489  exists->ValidateCallback = ValidateCallback;
1490 }
1491 
1493  const DetectEngineCtx *de_ctx, const int id, const Signature *s, const char **sigerror)
1494 {
1496  // only run validation if the buffer is not transformed
1497  if (map && map->ValidateCallback && map->transforms.cnt == 0) {
1498  return map->ValidateCallback(s, sigerror, map);
1499  }
1500  return true;
1501 }
1502 
1503 bool DetectBufferIsPresent(const Signature *s, const uint32_t buf_id)
1504 {
1505  for (uint32_t i = 0; i < s->init_data->buffer_index; i++) {
1506  if (buf_id == s->init_data->buffers[i].id) {
1507  return true;
1508  }
1509  }
1510  return false;
1511 }
1512 
1513 /** \brief Check content byte array compatibility with transforms
1514  *
1515  * The "content" array is presented to the transforms so that each
1516  * transform may validate that it's compatible with the transform.
1517  *
1518  * When a transform indicates the byte array is incompatible, none of the
1519  * subsequent transforms, if any, are invoked. This means the first validation
1520  * failure terminates the loop.
1521  *
1522  * \param de_ctx Detection engine context.
1523  * \param sm_list The SM list id.
1524  * \param content The byte array being validated
1525  * \param namestr returns the name of the transform that is incompatible with
1526  * content.
1527  *
1528  * \retval true (false) If any of the transforms indicate the byte array is
1529  * (is not) compatible.
1530  **/
1532  const uint8_t *content, uint16_t content_len, const char **namestr)
1533 {
1534  const DetectBufferType *dbt = DetectEngineBufferTypeGetById(de_ctx, sm_list);
1535  BUG_ON(dbt == NULL);
1536 
1537  for (int i = 0; i < dbt->transforms.cnt; i++) {
1538  const TransformData *t = &dbt->transforms.transforms[i];
1540  continue;
1541 
1542  if (sigmatch_table[t->transform].TransformValidate(content, content_len, t->options)) {
1543  continue;
1544  }
1545 
1546  if (namestr) {
1547  *namestr = sigmatch_table[t->transform].name;
1548  }
1549 
1550  return false;
1551  }
1552 
1553  return true;
1554 }
1555 
1556 static void DetectBufferTypeSetupDetectEngine(DetectEngineCtx *de_ctx)
1557 {
1558  const int size = g_buffer_type_id;
1559  BUG_ON(!(size > 0));
1560 
1561  de_ctx->buffer_type_hash_name = HashListTableInit(256, DetectBufferTypeHashNameFunc,
1562  DetectBufferTypeCompareNameFunc, DetectBufferTypeFreeFunc);
1565  HashListTableInit(256, DetectBufferTypeHashIdFunc, DetectBufferTypeCompareIdFunc,
1566  NULL); // entries owned by buffer_type_hash_name
1567  BUG_ON(de_ctx->buffer_type_hash_id == NULL);
1568  de_ctx->buffer_type_id = g_buffer_type_id;
1569 
1570  SCLogDebug("DETECT_SM_LIST_DYNAMIC_START %u", DETECT_SM_LIST_DYNAMIC_START);
1571  HashListTableBucket *b = HashListTableGetListHead(g_buffer_type_hash);
1572  while (b) {
1574 
1575  DetectBufferType *copy = SCCalloc(1, sizeof(*copy));
1576  BUG_ON(!copy);
1577  memcpy(copy, map, sizeof(*copy));
1578  int r = HashListTableAdd(de_ctx->buffer_type_hash_name, (void *)copy, 0);
1579  BUG_ON(r != 0);
1580  r = HashListTableAdd(de_ctx->buffer_type_hash_id, (void *)copy, 0);
1581  BUG_ON(r != 0);
1582 
1583  SCLogDebug("name %s id %d mpm %s packet %s -- %s. "
1584  "Callbacks: Setup %p Validate %p",
1585  map->name, map->id, map->mpm ? "true" : "false", map->packet ? "true" : "false",
1586  map->description, map->SetupCallback, map->ValidateCallback);
1587  b = HashListTableGetListNext(b);
1588  }
1589 
1592  DetectAppLayerInspectEngineCopyListToDetectCtx(de_ctx);
1594  DetectFrameInspectEngineCopyListToDetectCtx(de_ctx);
1596  DetectPktInspectEngineCopyListToDetectCtx(de_ctx);
1597 }
1598 
1599 static void DetectBufferTypeFreeDetectEngine(DetectEngineCtx *de_ctx)
1600 {
1601  if (de_ctx) {
1606 
1608  while (ilist) {
1610  SCFree(ilist);
1611  ilist = next;
1612  }
1614  while (mlist) {
1615  DetectBufferMpmRegistry *next = mlist->next;
1616  SCFree(mlist);
1617  mlist = next;
1618  }
1620  while (plist) {
1622  SCFree(plist);
1623  plist = next;
1624  }
1626  while (pmlist) {
1627  DetectBufferMpmRegistry *next = pmlist->next;
1628  SCFree(pmlist);
1629  pmlist = next;
1630  }
1632  while (framelist) {
1634  SCFree(framelist);
1635  framelist = next;
1636  }
1638  while (framemlist) {
1639  DetectBufferMpmRegistry *next = framemlist->next;
1640  SCFree(framemlist);
1641  framemlist = next;
1642  }
1644  }
1645 }
1646 
1648 {
1649  BUG_ON(g_buffer_type_hash == NULL);
1650 
1651  g_buffer_type_reg_closed = 1;
1652 }
1653 
1655  DetectEngineCtx *de_ctx, const int id, TransformData *transforms, int transform_cnt)
1656 {
1657  const DetectBufferType *base_map = DetectEngineBufferTypeGetById(de_ctx, id);
1658  if (!base_map) {
1659  return -1;
1660  }
1661  if (!base_map->supports_transforms) {
1662  SCLogError("buffer '%s' does not support transformations", base_map->name);
1663  return -1;
1664  }
1665 
1666  SCLogDebug("base_map %s", base_map->name);
1667 
1669  memset(&t, 0, sizeof(t));
1670  for (int i = 0; i < transform_cnt; i++) {
1671  t.transforms[i] = transforms[i];
1672  }
1673  t.cnt = transform_cnt;
1674 
1675  DetectBufferType lookup_map;
1676  memset(&lookup_map, 0, sizeof(lookup_map));
1677  strlcpy(lookup_map.name, base_map->name, sizeof(lookup_map.name));
1678  lookup_map.transforms = t;
1679 
1680  /* Add transform identity data from transforms */
1681  if (t.cnt) {
1682  DetectBufferAddTransformData(&lookup_map);
1683  }
1685 
1686  SCLogDebug("res %p", res);
1687  if (res != NULL) {
1688  return res->id;
1689  }
1690 
1691  DetectBufferType *map = SCCalloc(1, sizeof(*map));
1692  if (map == NULL)
1693  return -1;
1694 
1695  strlcpy(map->name, base_map->name, sizeof(map->name));
1696  map->id = de_ctx->buffer_type_id++;
1697  map->parent_id = base_map->id;
1698  map->transforms = t;
1699  map->mpm = base_map->mpm;
1700  map->packet = base_map->packet;
1701  map->frame = base_map->frame;
1702  map->SetupCallback = base_map->SetupCallback;
1703  map->ValidateCallback = base_map->ValidateCallback;
1704  if (map->frame) {
1706  } else if (map->packet) {
1708  map->id, map->parent_id, &map->transforms);
1709  } else {
1711  map->id, map->parent_id, &map->transforms);
1712  }
1713 
1714  BUG_ON(HashListTableAdd(de_ctx->buffer_type_hash_name, (void *)map, 0) != 0);
1715  BUG_ON(HashListTableAdd(de_ctx->buffer_type_hash_id, (void *)map, 0) != 0);
1716  SCLogDebug("buffer %s registered with id %d, parent %d", map->name, map->id, map->parent_id);
1717 
1718  if (map->frame) {
1719  DetectFrameInspectEngineCopy(de_ctx, map->parent_id, map->id, &map->transforms);
1720  } else if (map->packet) {
1721  DetectPktInspectEngineCopy(de_ctx, map->parent_id, map->id, &map->transforms);
1722  } else {
1723  DetectAppLayerInspectEngineCopy(de_ctx, map->parent_id, map->id, &map->transforms);
1724  }
1725  return map->id;
1726 }
1727 
1728 /* returns false if no match, true if match */
1729 static int DetectEngineInspectRulePacketMatches(
1730  DetectEngineThreadCtx *det_ctx,
1731  const DetectEnginePktInspectionEngine *engine,
1732  const Signature *s,
1733  Packet *p, uint8_t *_alert_flags)
1734 {
1735  SCEnter();
1736 
1737  /* run the packet match functions */
1739  const SigMatchData *smd = s->sm_arrays[DETECT_SM_LIST_MATCH];
1740 
1741  SCLogDebug("running match functions, sm %p", smd);
1742  while (1) {
1744  if (sigmatch_table[smd->type].Match(det_ctx, p, s, smd->ctx) <= 0) {
1745  KEYWORD_PROFILING_END(det_ctx, smd->type, 0);
1746  SCLogDebug("no match");
1748  }
1749  KEYWORD_PROFILING_END(det_ctx, smd->type, 1);
1750  if (smd->is_last) {
1751  SCLogDebug("match and is_last");
1752  break;
1753  }
1754  smd++;
1755  }
1757 }
1758 
1759 static int DetectEngineInspectRulePayloadMatches(
1760  DetectEngineThreadCtx *det_ctx,
1761  const DetectEnginePktInspectionEngine *engine,
1762  const Signature *s, Packet *p, uint8_t *alert_flags)
1763 {
1764  SCEnter();
1765 
1766  DetectEngineCtx *de_ctx = det_ctx->de_ctx;
1767 
1769  /* if we have stream msgs, inspect against those first,
1770  * but not for a "dsize" signature */
1771  if (s->flags & SIG_FLAG_REQUIRE_STREAM) {
1772  int pmatch = 0;
1773  if (p->flags & PKT_DETECT_HAS_STREAMDATA) {
1774  pmatch = DetectEngineInspectStreamPayload(de_ctx, det_ctx, s, p->flow, p);
1775  if (pmatch) {
1776  *alert_flags |= PACKET_ALERT_FLAG_STREAM_MATCH;
1777  }
1778  }
1779  /* no match? then inspect packet payload */
1780  if (pmatch == 0) {
1781  SCLogDebug("no match in stream, fall back to packet payload");
1782 
1783  /* skip if we don't have to inspect the packet and segment was
1784  * added to stream */
1785  if (!(s->flags & SIG_FLAG_REQUIRE_PACKET) && (p->flags & PKT_STREAM_ADD)) {
1787  }
1789  SCLogDebug("SIG_FLAG_REQUIRE_STREAM_ONLY, so no match");
1791  }
1792  if (DetectEngineInspectPacketPayload(de_ctx, det_ctx, s, p->flow, p) != 1) {
1794  }
1795  }
1796  } else {
1797  if (DetectEngineInspectPacketPayload(de_ctx, det_ctx, s, p->flow, p) != 1) {
1799  }
1800  }
1802 }
1803 
1805  DetectEngineThreadCtx *det_ctx, const Signature *s,
1806  Flow *f, Packet *p,
1807  uint8_t *alert_flags)
1808 {
1809  SCEnter();
1810 
1811  for (DetectEnginePktInspectionEngine *e = s->pkt_inspect; e != NULL; e = e->next) {
1812  if (e->v1.Callback(det_ctx, e, s, p, alert_flags) != DETECT_ENGINE_INSPECT_SIG_MATCH) {
1813  SCLogDebug("sid %u: e %p Callback returned no match", s->id, e);
1814  return false;
1815  }
1816  SCLogDebug("sid %u: e %p Callback returned true", s->id, e);
1817  }
1818 
1819  SCLogDebug("sid %u: returning true", s->id);
1820  return true;
1821 }
1822 
1823 /**
1824  * \param data pointer to SigMatchData. Allowed to be NULL.
1825  */
1826 static int DetectEnginePktInspectionAppend(Signature *s, InspectionBufferPktInspectFunc Callback,
1827  SigMatchData *data, const int list_id)
1828 {
1829  DetectEnginePktInspectionEngine *e = SCCalloc(1, sizeof(*e));
1830  if (e == NULL)
1831  return -1;
1832 
1833  e->mpm = s->init_data->mpm_sm_list == list_id;
1834  DEBUG_VALIDATE_BUG_ON(list_id < 0 || list_id > UINT16_MAX);
1835  e->sm_list = (uint16_t)list_id;
1836  e->sm_list_base = (uint16_t)list_id;
1837  e->v1.Callback = Callback;
1838  e->smd = data;
1839 
1840  if (s->pkt_inspect == NULL) {
1841  s->pkt_inspect = e;
1842  } else {
1844  while (a->next != NULL) {
1845  a = a->next;
1846  }
1847  a->next = e;
1848  }
1849  return 0;
1850 }
1851 
1853 {
1854  /* only handle PMATCH here if we're not an app inspect rule */
1856  if (DetectEnginePktInspectionAppend(
1857  s, DetectEngineInspectRulePayloadMatches, NULL, DETECT_SM_LIST_PMATCH) < 0)
1858  return -1;
1859  SCLogDebug("sid %u: DetectEngineInspectRulePayloadMatches appended", s->id);
1860  }
1861 
1862  if (s->sm_arrays[DETECT_SM_LIST_MATCH]) {
1863  if (DetectEnginePktInspectionAppend(
1864  s, DetectEngineInspectRulePacketMatches, NULL, DETECT_SM_LIST_MATCH) < 0)
1865  return -1;
1866  SCLogDebug("sid %u: DetectEngineInspectRulePacketMatches appended", s->id);
1867  }
1868 
1869  return 0;
1870 }
1871 
1872 /* code to control the main thread to do a reload */
1873 
1875  IDLE, /**< ready to start a reload */
1876  RELOAD, /**< command main thread to do the reload */
1877 };
1878 
1879 
1880 typedef struct DetectEngineSyncer_ {
1884 
1885 static DetectEngineSyncer detect_sync = { SCMUTEX_INITIALIZER, IDLE };
1886 
1887 /* tell main to start reloading */
1889 {
1890  int r = 0;
1891  SCMutexLock(&detect_sync.m);
1892  if (detect_sync.state == IDLE) {
1893  detect_sync.state = RELOAD;
1894  } else {
1895  r = -1;
1896  }
1897  SCMutexUnlock(&detect_sync.m);
1898  return r;
1899 }
1900 
1901 /* main thread checks this to see if it should start */
1903 {
1904  int r = 0;
1905  SCMutexLock(&detect_sync.m);
1906  if (detect_sync.state == RELOAD) {
1907  r = 1;
1908  }
1909  SCMutexUnlock(&detect_sync.m);
1910  return r;
1911 }
1912 
1913 /* main thread sets done when it's done */
1915 {
1916  SCMutexLock(&detect_sync.m);
1917  detect_sync.state = IDLE;
1918  SCMutexUnlock(&detect_sync.m);
1919 }
1920 
1921 /* caller loops this until it returns 1 */
1923 {
1924  int r = 0;
1925  SCMutexLock(&detect_sync.m);
1926  if (detect_sync.state == IDLE) {
1927  r = 1;
1928  }
1929  SCMutexUnlock(&detect_sync.m);
1930  return r;
1931 }
1932 
1933 /** \brief Do the content inspection & validation for a signature
1934  *
1935  * \param de_ctx Detection engine context
1936  * \param det_ctx Detection engine thread context
1937  * \param s Signature to inspect
1938  * \param sm SigMatch to inspect
1939  * \param f Flow
1940  * \param flags app layer flags
1941  * \param state App layer state
1942  *
1943  * \retval 0 no match
1944  * \retval 1 match
1945  */
1947  const struct DetectEngineAppInspectionEngine_ *engine, const Signature *s, Flow *f,
1948  uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
1949 {
1950  SigMatchData *smd = engine->smd;
1951  SCLogDebug("running match functions, sm %p", smd);
1952  if (smd != NULL) {
1953  while (1) {
1954  int match = 0;
1956  match = sigmatch_table[smd->type].
1957  AppLayerTxMatch(det_ctx, f, flags, alstate, txv, s, smd->ctx);
1958  KEYWORD_PROFILING_END(det_ctx, smd->type, (match == 1));
1959  if (match == 0)
1961  if (match == 2) {
1963  }
1964 
1965  if (smd->is_last)
1966  break;
1967  smd++;
1968  }
1969  }
1970 
1972 }
1973 
1974 /**
1975  * \brief Do the content inspection & validation for a signature
1976  *
1977  * \param de_ctx Detection engine context
1978  * \param det_ctx Detection engine thread context
1979  * \param s Signature to inspect
1980  * \param f Flow
1981  * \param flags app layer flags
1982  * \param state App layer state
1983  *
1984  * \retval 0 no match.
1985  * \retval 1 match.
1986  * \retval 2 Sig can't match.
1987  */
1989  const DetectEngineAppInspectionEngine *engine, const Signature *s, Flow *f, uint8_t flags,
1990  void *alstate, void *txv, uint64_t tx_id)
1991 {
1992  const int list_id = engine->sm_list;
1993  SCLogDebug("running inspect on %d", list_id);
1994 
1995  const bool eof =
1996  (AppLayerParserGetStateProgress(f->proto, f->alproto, txv, flags) > engine->progress);
1997 
1998  SCLogDebug("list %d mpm? %s transforms %p", engine->sm_list, engine->mpm ? "true" : "false",
1999  engine->v2.transforms);
2000 
2001  /* if prefilter didn't already run, we need to consider transformations */
2002  const DetectEngineTransforms *transforms = NULL;
2003  if (!engine->mpm) {
2004  transforms = engine->v2.transforms;
2005  }
2006 
2007  const InspectionBuffer *buffer = DetectGetSingleData(
2008  det_ctx, transforms, f, flags, txv, list_id, engine->v2.GetDataSingle);
2009  if (unlikely(buffer == NULL)) {
2010  if (eof && engine->match_on_null) {
2012  }
2014  }
2015 
2016  const uint32_t data_len = buffer->inspect_len;
2017  const uint8_t *data = buffer->inspect;
2018  const uint64_t offset = buffer->inspect_offset;
2019 
2020  uint8_t ci_flags = eof ? DETECT_CI_FLAGS_END : 0;
2021  ci_flags |= (offset == 0 ? DETECT_CI_FLAGS_START : 0);
2022  ci_flags |= buffer->flags;
2023 
2024  /* Inspect all the uricontents fetched on each
2025  * transaction at the app layer */
2026  const bool match = DetectEngineContentInspection(de_ctx, det_ctx, s, engine->smd, NULL, f, data,
2028  if (match) {
2030  } else {
2032  }
2033 }
2034 
2035 /**
2036  * \brief Do the content inspection & validation for a signature
2037  *
2038  * \param de_ctx Detection engine context
2039  * \param det_ctx Detection engine thread context
2040  * \param s Signature to inspect
2041  * \param f Flow
2042  * \param flags app layer flags
2043  * \param state App layer state
2044  *
2045  * \retval 0 no match.
2046  * \retval 1 match.
2047  * \retval 2 Sig can't match.
2048  */
2050  const DetectEngineAppInspectionEngine *engine, const Signature *s, Flow *f, uint8_t flags,
2051  void *alstate, void *txv, uint64_t tx_id)
2052 {
2053  const int list_id = engine->sm_list;
2054  SCLogDebug("running inspect on %d", list_id);
2055 
2056  const bool eof = (AppLayerParserGetStateProgress(f->proto, f->alproto, txv, flags) > engine->progress);
2057 
2058  SCLogDebug("list %d mpm? %s transforms %p",
2059  engine->sm_list, engine->mpm ? "true" : "false", engine->v2.transforms);
2060 
2061  /* if prefilter didn't already run, we need to consider transformations */
2062  const DetectEngineTransforms *transforms = NULL;
2063  if (!engine->mpm) {
2064  transforms = engine->v2.transforms;
2065  }
2066 
2067  const InspectionBuffer *buffer = engine->v2.GetData(det_ctx, transforms,
2068  f, flags, txv, list_id);
2069  if (unlikely(buffer == NULL)) {
2070  if (eof && engine->match_on_null) {
2072  }
2075  }
2076 
2077  const uint32_t data_len = buffer->inspect_len;
2078  const uint8_t *data = buffer->inspect;
2079  const uint64_t offset = buffer->inspect_offset;
2080 
2081  uint8_t ci_flags = eof ? DETECT_CI_FLAGS_END : 0;
2082  ci_flags |= (offset == 0 ? DETECT_CI_FLAGS_START : 0);
2083  ci_flags |= buffer->flags;
2084 
2085  /* Inspect all the uricontents fetched on each
2086  * transaction at the app layer */
2087  const bool match = DetectEngineContentInspection(de_ctx, det_ctx, s, engine->smd, NULL, f, data,
2089  if (match) {
2091  } else {
2094  }
2095 }
2096 
2097 // wrapper for both DetectAppLayerInspectEngineRegister and DetectAppLayerMpmRegister
2098 // with cast of callback function
2099 void DetectAppLayerMultiRegister(const char *name, AppProto alproto, uint32_t dir, int progress,
2100  InspectionMultiBufferGetDataPtr GetData, int priority)
2101 {
2102  AppLayerInspectEngineRegisterInternal(name, alproto, dir, progress,
2103  DetectEngineInspectMultiBufferGeneric, NULL, NULL, GetData);
2105  name, dir, priority, PrefilterMultiGenericMpmRegister, GetData, alproto, progress);
2106 }
2107 
2109  const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv,
2110  const int list_id, InspectionSingleBufferGetDataPtr GetBuf)
2111 {
2112  InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
2113  if (buffer->inspect == NULL) {
2114  const uint8_t *b = NULL;
2115  uint32_t b_len = 0;
2116 
2117  if (!GetBuf(txv, flow_flags, &b, &b_len))
2118  return NULL;
2119 
2120  InspectionBufferSetupAndApplyTransforms(det_ctx, list_id, buffer, b, b_len, transforms);
2121  }
2122  return buffer;
2123 }
2124 
2126  const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv,
2127  const int list_id, uint32_t index, InspectionMultiBufferGetDataPtr GetBuf)
2128 {
2129  InspectionBuffer *buffer = InspectionBufferMultipleForListGet(det_ctx, list_id, index);
2130  if (buffer == NULL) {
2131  return NULL;
2132  }
2133  if (buffer->initialized) {
2134  return buffer;
2135  }
2136 
2137  const uint8_t *data = NULL;
2138  uint32_t data_len = 0;
2139 
2140  if (!GetBuf(det_ctx, txv, flow_flags, index, &data, &data_len)) {
2142  return NULL;
2143  }
2144  InspectionBufferSetupMulti(det_ctx, buffer, transforms, data, data_len);
2145  buffer->flags = DETECT_CI_FLAGS_SINGLE;
2146  return buffer;
2147 }
2148 
2151  const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
2152 {
2153  uint32_t local_id = 0;
2154  const DetectEngineTransforms *transforms = NULL;
2155  if (!engine->mpm) {
2156  transforms = engine->v2.transforms;
2157  }
2158 
2159  do {
2160  InspectionBuffer *buffer = DetectGetMultiData(det_ctx, transforms, f, flags, txv,
2161  engine->sm_list, local_id, engine->v2.GetMultiData);
2162 
2163  if (buffer == NULL || buffer->inspect == NULL)
2164  break;
2165 
2166  // The GetData functions set buffer->flags to DETECT_CI_FLAGS_SINGLE
2167  // This is not meant for streaming buffers
2168  const bool match = DetectEngineContentInspectionBuffer(de_ctx, det_ctx, s, engine->smd,
2170  if (match) {
2172  }
2173  local_id++;
2174  } while (1);
2175  if (local_id == 0) {
2176  // That means we did not get even one buffer value from the multi-buffer
2177  const bool eof = (AppLayerParserGetStateProgress(f->proto, f->alproto, txv, flags) >
2178  engine->progress);
2179  if (eof && engine->match_on_null) {
2181  }
2182  }
2184 }
2185 
2186 /**
2187  * \brief Do the content inspection & validation for a signature
2188  *
2189  * \param de_ctx Detection engine context
2190  * \param det_ctx Detection engine thread context
2191  * \param s Signature to inspect
2192  * \param p Packet
2193  *
2194  * \retval 0 no match.
2195  * \retval 1 match.
2196  */
2198  DetectEngineThreadCtx *det_ctx,
2199  const DetectEnginePktInspectionEngine *engine,
2200  const Signature *s, Packet *p, uint8_t *_alert_flags)
2201 {
2202  const int list_id = engine->sm_list;
2203  SCLogDebug("running inspect on %d", list_id);
2204 
2205  SCLogDebug("list %d transforms %p",
2206  engine->sm_list, engine->v1.transforms);
2207 
2208  /* if prefilter didn't already run, we need to consider transformations */
2209  const DetectEngineTransforms *transforms = NULL;
2210  if (!engine->mpm) {
2211  transforms = engine->v1.transforms;
2212  }
2213 
2214  const InspectionBuffer *buffer = engine->v1.GetData(det_ctx, transforms, p,
2215  list_id);
2216  if (unlikely(buffer == NULL)) {
2218  }
2219 
2220  uint8_t ci_flags = DETECT_CI_FLAGS_START|DETECT_CI_FLAGS_END;
2221  ci_flags |= buffer->flags;
2222 
2223  /* Inspect all the uricontents fetched on each
2224  * transaction at the app layer */
2225  const bool match = DetectEngineContentInspection(det_ctx->de_ctx, det_ctx, s, engine->smd, p,
2226  p->flow, buffer->inspect, buffer->inspect_len, 0, ci_flags,
2228  if (match) {
2230  } else {
2232  }
2233 }
2234 
2235 /** \internal
2236  * \brief inject a pseudo packet into each detect thread
2237  * if the thread should flush its output logs.
2238  */
2239 void InjectPacketsForFlush(ThreadVars **detect_tvs, int no_of_detect_tvs)
2240 {
2241  /* inject a fake packet if the detect thread that needs it. This function
2242  * is called when a heartbeat log-flush request has been made
2243  * and it should process a pseudo packet and flush its output logs
2244  * to speed the process. */
2245 #if DEBUG
2246  int count = 0;
2247 #endif
2248  for (int i = 0; i < no_of_detect_tvs; i++) {
2249  if (detect_tvs[i]) { // && detect_tvs[i]->inq != NULL) {
2250  Packet *p = PacketGetFromAlloc();
2251  if (p != NULL) {
2252  SCLogDebug("Injecting pkt for tv %s[i=%d] %d", detect_tvs[i]->name, i, count++);
2256  PacketQueue *q = detect_tvs[i]->stream_pq;
2257  SCMutexLock(&q->mutex_q);
2258  PacketEnqueue(q, p);
2259  SCCondSignal(&q->cond_q);
2260  SCMutexUnlock(&q->mutex_q);
2261  }
2262  }
2263  }
2264  SCLogDebug("leaving: thread notification count = %d", count);
2265 }
2266 
2267 /** \internal
2268  * \brief inject a pseudo packet into each detect thread
2269  * -that doesn't use the new det_ctx yet
2270  * -*or*, if the thread should flush its output logs.
2271  */
2272 static void InjectPackets(
2273  ThreadVars **detect_tvs, DetectEngineThreadCtx **new_det_ctx, int no_of_detect_tvs)
2274 {
2275  /* inject a fake packet if the detect thread that needs it. This function
2276  * is called if
2277  * - A thread isn't using a DE ctx and should
2278  * - Or, it should process a pseudo packet and flush its output logs.
2279  * to speed the process. */
2280  for (int i = 0; i < no_of_detect_tvs; i++) {
2281  if (SC_ATOMIC_GET(new_det_ctx[i]->so_far_used_by_detect) != 1) {
2282  if (detect_tvs[i]->inq != NULL) {
2283  Packet *p = PacketGetFromAlloc();
2284  if (p != NULL) {
2287  PacketQueue *q = detect_tvs[i]->inq->pq;
2288  SCMutexLock(&q->mutex_q);
2289  PacketEnqueue(q, p);
2290  SCCondSignal(&q->cond_q);
2291  SCMutexUnlock(&q->mutex_q);
2292  }
2293  }
2294  }
2295  }
2296 }
2297 
2298 /** \internal
2299  * \brief Update detect threads with new detect engine
2300  *
2301  * Atomically update each detect thread with a new thread context
2302  * that is associated to the new detection engine(s).
2303  *
2304  * If called in unix socket mode, it's possible that we don't have
2305  * detect threads yet.
2306  * NOTE: master MUST be locked before calling this
2307  *
2308  * \retval -1 error
2309  * \retval 0 no detection threads
2310  * \retval 1 successful reload
2311  */
2312 static int DetectEngineReloadThreads(DetectEngineCtx *new_de_ctx)
2313 {
2314  SCEnter();
2315  uint32_t i = 0;
2316 
2317  /* count detect threads in use */
2318  uint32_t no_of_detect_tvs = TmThreadCountThreadsByTmmFlags(TM_FLAG_FLOWWORKER_TM);
2319  /* can be zero in unix socket mode */
2320  if (no_of_detect_tvs == 0) {
2321  return 0;
2322  }
2323 
2324  /* prepare swap structures */
2325  DetectEngineThreadCtx *old_det_ctx[no_of_detect_tvs];
2326  DetectEngineThreadCtx *new_det_ctx[no_of_detect_tvs];
2327  ThreadVars *detect_tvs[no_of_detect_tvs];
2328  memset(old_det_ctx, 0x00, (no_of_detect_tvs * sizeof(DetectEngineThreadCtx *)));
2329  memset(new_det_ctx, 0x00, (no_of_detect_tvs * sizeof(DetectEngineThreadCtx *)));
2330  memset(detect_tvs, 0x00, (no_of_detect_tvs * sizeof(ThreadVars *)));
2331 
2332  /* start the process of swapping detect threads ctxs */
2333 
2334  /* get reference to tv's and setup new_det_ctx array */
2336  for (ThreadVars *tv = tv_root[TVT_PPT]; tv != NULL; tv = tv->next) {
2337  if ((tv->tmm_flags & TM_FLAG_FLOWWORKER_TM) == 0) {
2338  continue;
2339  }
2340  for (TmSlot *s = tv->tm_slots; s != NULL; s = s->slot_next) {
2341  TmModule *tm = TmModuleGetById(s->tm_id);
2342  if (!(tm->flags & TM_FLAG_FLOWWORKER_TM)) {
2343  continue;
2344  }
2345 
2346  if (suricata_ctl_flags != 0) {
2348  goto error;
2349  }
2350 
2351  old_det_ctx[i] = FlowWorkerGetDetectCtxPtr(SC_ATOMIC_GET(s->slot_data));
2352  detect_tvs[i] = tv;
2353 
2354  new_det_ctx[i] = DetectEngineThreadCtxInitForReload(tv, new_de_ctx, 1);
2355  if (new_det_ctx[i] == NULL) {
2356  SCLogError("Detect engine thread init "
2357  "failure in live rule swap. Let's get out of here");
2359  goto error;
2360  }
2361  SCLogDebug("live rule swap created new det_ctx - %p and de_ctx "
2362  "- %p\n", new_det_ctx[i], new_de_ctx);
2363  i++;
2364  break;
2365  }
2366  }
2367  BUG_ON(i != no_of_detect_tvs);
2368 
2369  /* atomically replace the det_ctx data */
2370  i = 0;
2371  for (ThreadVars *tv = tv_root[TVT_PPT]; tv != NULL; tv = tv->next) {
2372  if ((tv->tmm_flags & TM_FLAG_FLOWWORKER_TM) == 0) {
2373  continue;
2374  }
2375  for (TmSlot *s = tv->tm_slots; s != NULL; s = s->slot_next) {
2376  TmModule *tm = TmModuleGetById(s->tm_id);
2377  if (!(tm->flags & TM_FLAG_FLOWWORKER_TM)) {
2378  continue;
2379  }
2380  SCLogDebug("swapping new det_ctx - %p with older one - %p",
2381  new_det_ctx[i], SC_ATOMIC_GET(s->slot_data));
2382  FlowWorkerReplaceDetectCtx(SC_ATOMIC_GET(s->slot_data), new_det_ctx[i++]);
2383  break;
2384  }
2385  }
2387 
2388  /* threads now all have new data, however they may not have started using
2389  * it and may still use the old data */
2390 
2391  SCLogDebug("Live rule swap has swapped %d old det_ctx's with new ones, "
2392  "along with the new de_ctx", no_of_detect_tvs);
2393 
2394  InjectPackets(detect_tvs, new_det_ctx, no_of_detect_tvs);
2395 
2396  /* loop waiting for detect threads to switch to the new det_ctx. Try to
2397  * wake up capture if needed (break loop). */
2398  uint32_t threads_done = 0;
2399 retry:
2400  for (i = 0; i < no_of_detect_tvs; i++) {
2401  if (suricata_ctl_flags != 0) {
2402  threads_done = no_of_detect_tvs;
2403  break;
2404  }
2405  SleepMsec(1);
2406  if (SC_ATOMIC_GET(new_det_ctx[i]->so_far_used_by_detect) == 1) {
2407  SCLogDebug("new_det_ctx - %p used by detect engine", new_det_ctx[i]);
2408  threads_done++;
2409  } else {
2410  TmThreadsCaptureBreakLoop(detect_tvs[i]);
2411  }
2412  }
2413  if (threads_done < no_of_detect_tvs) {
2414  threads_done = 0;
2415  SleepMsec(250);
2416  goto retry;
2417  }
2418 
2419  /* this is to make sure that if someone initiated shutdown during a live
2420  * rule swap, the live rule swap won't clean up the old det_ctx and
2421  * de_ctx, till all detect threads have stopped working and sitting
2422  * silently after setting RUNNING_DONE flag and while waiting for
2423  * THV_DEINIT flag */
2424  if (i != no_of_detect_tvs) { // not all threads we swapped
2425  for (ThreadVars *tv = tv_root[TVT_PPT]; tv != NULL; tv = tv->next) {
2426  if ((tv->tmm_flags & TM_FLAG_FLOWWORKER_TM) == 0) {
2427  continue;
2428  }
2429 
2431  SleepUsec(100);
2432  }
2433  }
2434  }
2435 
2436  /* free all the ctxs */
2437  for (i = 0; i < no_of_detect_tvs; i++) {
2438  SCLogDebug("Freeing old_det_ctx - %p used by detect",
2439  old_det_ctx[i]);
2440  DetectEngineThreadCtxDeinit(NULL, old_det_ctx[i]);
2441  }
2442 
2444 
2445  return 1;
2446 
2447  error:
2448  for (i = 0; i < no_of_detect_tvs; i++) {
2449  if (new_det_ctx[i] != NULL)
2450  DetectEngineThreadCtxDeinit(NULL, new_det_ctx[i]);
2451  }
2452  return -1;
2453 }
2454 
2456 {
2457  int sgh_mpm_caching = 0;
2458  if (SCConfGetBool("detect.sgh-mpm-caching", &sgh_mpm_caching) != 1) {
2459  return false;
2460  }
2461  return (bool)sgh_mpm_caching;
2462 }
2463 
2465 {
2466  if (DetectEngineMpmCachingEnabled() == false) {
2467  return NULL;
2468  }
2469 
2470  char yamlpath[] = "detect.sgh-mpm-caching-path";
2471  const char *strval = NULL;
2472  if (SCConfGet(yamlpath, &strval) == 1 && strval != NULL) {
2473  return strval;
2474  }
2475 
2476  static bool notified = false;
2477  if (!notified) {
2478  SCLogInfo("%s has no path specified, using %s", yamlpath, SGH_CACHE_DIR);
2479  notified = true;
2480  }
2481  return SGH_CACHE_DIR;
2482 }
2483 
2484 static DetectEngineCtx *DetectEngineCtxInitReal(
2485  enum DetectEngineType type, const char *prefix, uint32_t tenant_id)
2486 {
2488  if (unlikely(de_ctx == NULL))
2489  goto error;
2490 
2491  memset(&de_ctx->sig_stat, 0, sizeof(SigFileLoaderStat));
2492  TAILQ_INIT(&de_ctx->sig_stat.failed_sigs);
2493  de_ctx->sigerror = NULL;
2494  de_ctx->type = type;
2496  de_ctx->tenant_id = tenant_id;
2497 
2500  SCLogDebug("stub %u with version %u", type, de_ctx->version);
2501  return de_ctx;
2502  }
2503 
2504  if (prefix != NULL) {
2505  strlcpy(de_ctx->config_prefix, prefix, sizeof(de_ctx->config_prefix));
2506  }
2507 
2508  int failure_fatal = 0;
2509  if (SCConfGetBool("engine.init-failure-fatal", (int *)&failure_fatal) != 1) {
2510  SCLogDebug("ConfGetBool could not load the value.");
2511  }
2512  de_ctx->failure_fatal = (failure_fatal == 1);
2513 
2516  SCLogConfig("pattern matchers: MPM: %s, SPM: %s",
2519 
2522  if (de_ctx->mpm_cfg == NULL) {
2523  goto error;
2524  }
2525  }
2529  }
2530 
2532  if (de_ctx->spm_global_thread_ctx == NULL) {
2533  SCLogDebug("Unable to alloc SpmGlobalThreadCtx.");
2534  goto error;
2535  }
2536 
2538  if (de_ctx->sm_types_prefilter == NULL) {
2539  goto error;
2540  }
2542  if (de_ctx->sm_types_silent_error == NULL) {
2543  goto error;
2544  }
2545  if (DetectEngineCtxLoadConf(de_ctx) == -1) {
2546  goto error;
2547  }
2548 
2554  DetectBufferTypeSetupDetectEngine(de_ctx);
2556 
2557  /* init iprep... ignore errors for now */
2558  (void)SRepInit(de_ctx);
2559 
2563  goto error;
2564  }
2565 
2566  if (ActionInitConfig() < 0) {
2567  goto error;
2568  }
2570  if (SCRConfLoadReferenceConfigFile(de_ctx, NULL) < 0) {
2572  goto error;
2573  }
2574 
2576  SCLogDebug("dectx with version %u", de_ctx->version);
2577  return de_ctx;
2578 error:
2579  if (de_ctx != NULL) {
2581  }
2582  return NULL;
2583 }
2584 
2586 {
2587  return DetectEngineCtxInitReal(DETECT_ENGINE_TYPE_MT_STUB, NULL, 0);
2588 }
2589 
2591 {
2592  return DetectEngineCtxInitReal(DETECT_ENGINE_TYPE_DD_STUB, NULL, 0);
2593 }
2594 
2596 {
2597  return DetectEngineCtxInitReal(DETECT_ENGINE_TYPE_NORMAL, NULL, 0);
2598 }
2599 
2600 DetectEngineCtx *DetectEngineCtxInitWithPrefix(const char *prefix, uint32_t tenant_id)
2601 {
2602  if (prefix == NULL || strlen(prefix) == 0)
2603  return DetectEngineCtxInit();
2604  else
2605  return DetectEngineCtxInitReal(DETECT_ENGINE_TYPE_NORMAL, prefix, tenant_id);
2606 }
2607 
2608 static void DetectEngineCtxFreeThreadKeywordData(DetectEngineCtx *de_ctx)
2609 {
2611 }
2612 
2613 static void DetectEngineCtxFreeFailedSigs(DetectEngineCtx *de_ctx)
2614 {
2615  SigString *item = NULL;
2616  SigString *sitem;
2617 
2618  TAILQ_FOREACH_SAFE(item, &de_ctx->sig_stat.failed_sigs, next, sitem) {
2619  SCFree(item->filename);
2620  SCFree(item->sig_str);
2621  if (item->sig_error) {
2622  SCFree(item->sig_error);
2623  }
2624  TAILQ_REMOVE(&de_ctx->sig_stat.failed_sigs, item, next);
2625  SCFree(item);
2626  }
2627 }
2628 
2629 /**
2630  * \brief Free a DetectEngineCtx::
2631  *
2632  * \param de_ctx DetectEngineCtx:: to be freed
2633  */
2635 {
2636 
2637  if (de_ctx == NULL)
2638  return;
2639 
2640 #ifdef PROFILE_RULES
2641  if (de_ctx->profile_ctx != NULL) {
2642  SCProfilingRuleDestroyCtx(de_ctx->profile_ctx);
2643  de_ctx->profile_ctx = NULL;
2644  }
2645 #endif
2646 #ifdef PROFILING
2647  if (de_ctx->profile_keyword_ctx != NULL) {
2648  SCProfilingKeywordDestroyCtx(de_ctx);//->profile_keyword_ctx);
2649 // de_ctx->profile_keyword_ctx = NULL;
2650  }
2651  if (de_ctx->profile_sgh_ctx != NULL) {
2653  }
2655 #endif
2656 
2659  }
2660  /* Normally the hashes are freed elsewhere, but
2661  * to be sure look at them again here.
2662  */
2668  if (de_ctx->sig_array)
2670 
2671  if (de_ctx->filedata_config)
2673 
2677 
2679 
2683 
2685 
2686  DetectEngineCtxFreeThreadKeywordData(de_ctx);
2688  DetectEngineCtxFreeFailedSigs(de_ctx);
2689 
2692 
2693  /* if we have a config prefix, remove the config from the tree */
2694  if (strlen(de_ctx->config_prefix) > 0) {
2695  /* remove config */
2697  if (node != NULL) {
2698  SCConfNodeRemove(node); /* frees node */
2699  }
2700 #if 0
2701  SCConfDump();
2702 #endif
2703  }
2704 
2707 
2708  DetectBufferTypeFreeDetectEngine(de_ctx);
2711 
2712  if (de_ctx->tenant_path) {
2714  }
2715 
2716  if (de_ctx->requirements) {
2717  SCDetectRequiresStatusFree(de_ctx->requirements);
2718  }
2719 
2720  if (de_ctx->non_pf_engine_names) {
2722  }
2723  SCFree(de_ctx);
2724  //DetectAddressGroupPrintMemory();
2725  //DetectSigGroupPrintMemory();
2726  //DetectPortPrintMemory();
2727 }
2728 
2729 /** \brief Function that load DetectEngineCtx config for grouping sigs
2730  * used by the engine
2731  * \retval 0 if no config provided, 1 if config was provided
2732  * and loaded successfully
2733  */
2734 static int DetectEngineCtxLoadConf(DetectEngineCtx *de_ctx)
2735 {
2736  uint8_t profile = ENGINE_PROFILE_MEDIUM;
2737  const char *max_uniq_toclient_groups_str = NULL;
2738  const char *max_uniq_toserver_groups_str = NULL;
2739  const char *sgh_mpm_context = NULL;
2740  const char *de_ctx_profile = NULL;
2741 
2742  (void)SCConfGet("detect.profile", &de_ctx_profile);
2743  (void)SCConfGet("detect.sgh-mpm-context", &sgh_mpm_context);
2744 
2745  SCConfNode *de_ctx_custom = SCConfGetNode("detect-engine");
2746  SCConfNode *opt = NULL;
2747 
2748  if (de_ctx_custom != NULL) {
2749  TAILQ_FOREACH(opt, &de_ctx_custom->head, next) {
2750  if (de_ctx_profile == NULL) {
2751  if (opt->val && strcmp(opt->val, "profile") == 0) {
2752  de_ctx_profile = opt->head.tqh_first->val;
2753  }
2754  }
2755 
2756  if (sgh_mpm_context == NULL) {
2757  if (opt->val && strcmp(opt->val, "sgh-mpm-context") == 0) {
2758  sgh_mpm_context = opt->head.tqh_first->val;
2759  }
2760  }
2761  }
2762  }
2763 
2764  if (de_ctx_profile != NULL) {
2765  if (strcmp(de_ctx_profile, "low") == 0 ||
2766  strcmp(de_ctx_profile, "lowest") == 0) { // legacy
2767  profile = ENGINE_PROFILE_LOW;
2768  } else if (strcmp(de_ctx_profile, "medium") == 0) {
2769  profile = ENGINE_PROFILE_MEDIUM;
2770  } else if (strcmp(de_ctx_profile, "high") == 0 ||
2771  strcmp(de_ctx_profile, "highest") == 0) { // legacy
2772  profile = ENGINE_PROFILE_HIGH;
2773  } else if (strcmp(de_ctx_profile, "custom") == 0) {
2774  profile = ENGINE_PROFILE_CUSTOM;
2775  } else {
2776  SCLogError("invalid value for detect.profile: '%s'. "
2777  "Valid options: low, medium, high and custom.",
2778  de_ctx_profile);
2779  return -1;
2780  }
2781 
2782  SCLogDebug("Profile for detection engine groups is \"%s\"", de_ctx_profile);
2783  } else {
2784  SCLogDebug("Profile for detection engine groups not provided "
2785  "at suricata.yaml. Using default (\"medium\").");
2786  }
2787 
2788  /* detect-engine.sgh-mpm-context option parsing */
2789  if (sgh_mpm_context == NULL || strcmp(sgh_mpm_context, "auto") == 0) {
2790  /* for now, since we still haven't implemented any intelligence into
2791  * understanding the patterns and distributing mpm_ctx across sgh */
2793  de_ctx->mpm_matcher == MPM_HS) {
2795  } else {
2797  }
2798  } else {
2799  if (strcmp(sgh_mpm_context, "single") == 0) {
2801  } else if (strcmp(sgh_mpm_context, "full") == 0) {
2803  } else {
2804  SCLogError("You have supplied an "
2805  "invalid conf value for detect-engine.sgh-mpm-context-"
2806  "%s",
2807  sgh_mpm_context);
2808  exit(EXIT_FAILURE);
2809  }
2810  }
2811 
2812  if (RunmodeIsUnittests()) {
2814  }
2815 
2816  /* parse profile custom-values */
2817  opt = NULL;
2818  switch (profile) {
2819  case ENGINE_PROFILE_LOW:
2822  break;
2823 
2824  case ENGINE_PROFILE_HIGH:
2827  break;
2828 
2829  case ENGINE_PROFILE_CUSTOM:
2830  (void)SCConfGet("detect.custom-values.toclient-groups", &max_uniq_toclient_groups_str);
2831  (void)SCConfGet("detect.custom-values.toserver-groups", &max_uniq_toserver_groups_str);
2832 
2833  if (de_ctx_custom != NULL) {
2834  TAILQ_FOREACH(opt, &de_ctx_custom->head, next) {
2835  if (opt->val && strcmp(opt->val, "custom-values") == 0) {
2836  if (max_uniq_toclient_groups_str == NULL) {
2837  max_uniq_toclient_groups_str = (char *)SCConfNodeLookupChildValue(
2838  opt->head.tqh_first, "toclient-sp-groups");
2839  }
2840  if (max_uniq_toclient_groups_str == NULL) {
2841  max_uniq_toclient_groups_str = (char *)SCConfNodeLookupChildValue(
2842  opt->head.tqh_first, "toclient-groups");
2843  }
2844  if (max_uniq_toserver_groups_str == NULL) {
2845  max_uniq_toserver_groups_str = (char *)SCConfNodeLookupChildValue(
2846  opt->head.tqh_first, "toserver-dp-groups");
2847  }
2848  if (max_uniq_toserver_groups_str == NULL) {
2849  max_uniq_toserver_groups_str = (char *)SCConfNodeLookupChildValue(
2850  opt->head.tqh_first, "toserver-groups");
2851  }
2852  }
2853  }
2854  }
2855  if (max_uniq_toclient_groups_str != NULL) {
2857  (uint16_t)strlen(max_uniq_toclient_groups_str),
2858  (const char *)max_uniq_toclient_groups_str) <= 0) {
2860 
2861  SCLogWarning("parsing '%s' for "
2862  "toclient-groups failed, using %u",
2863  max_uniq_toclient_groups_str, de_ctx->max_uniq_toclient_groups);
2864  }
2865  } else {
2867  }
2868  SCLogConfig("toclient-groups %u", de_ctx->max_uniq_toclient_groups);
2869 
2870  if (max_uniq_toserver_groups_str != NULL) {
2872  (uint16_t)strlen(max_uniq_toserver_groups_str),
2873  (const char *)max_uniq_toserver_groups_str) <= 0) {
2875 
2876  SCLogWarning("parsing '%s' for "
2877  "toserver-groups failed, using %u",
2878  max_uniq_toserver_groups_str, de_ctx->max_uniq_toserver_groups);
2879  }
2880  } else {
2882  }
2883  SCLogConfig("toserver-groups %u", de_ctx->max_uniq_toserver_groups);
2884  break;
2885 
2886  /* Default (or no config provided) is profile medium */
2887  case ENGINE_PROFILE_MEDIUM:
2889  default:
2892  break;
2893  }
2894 
2895  intmax_t value = 0;
2897  if (SCConfGetInt("detect.inspection-recursion-limit", &value) == 1) {
2898  if (value >= 0 && value <= INT_MAX) {
2899  de_ctx->inspection_recursion_limit = (int)value;
2900  }
2901 
2902  /* fall back to old config parsing */
2903  } else {
2904  SCConfNode *insp_recursion_limit_node = NULL;
2905  char *insp_recursion_limit = NULL;
2906 
2907  if (de_ctx_custom != NULL) {
2908  opt = NULL;
2909  TAILQ_FOREACH(opt, &de_ctx_custom->head, next) {
2910  if (opt->val && strcmp(opt->val, "inspection-recursion-limit") != 0)
2911  continue;
2912 
2913  insp_recursion_limit_node = SCConfNodeLookupChild(opt, opt->val);
2914  if (insp_recursion_limit_node == NULL) {
2915  SCLogError("Error retrieving conf "
2916  "entry for detect-engine:inspection-recursion-limit");
2917  break;
2918  }
2919  insp_recursion_limit = insp_recursion_limit_node->val;
2920  SCLogDebug("Found detect-engine.inspection-recursion-limit - %s:%s",
2921  insp_recursion_limit_node->name, insp_recursion_limit_node->val);
2922  break;
2923  }
2924 
2925  if (insp_recursion_limit != NULL) {
2927  0, (const char *)insp_recursion_limit) < 0) {
2928  SCLogWarning("Invalid value for "
2929  "detect-engine.inspection-recursion-limit: %s "
2930  "resetting to %d",
2931  insp_recursion_limit, DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT);
2934  }
2935  }
2936  }
2937  }
2938 
2941 
2942  SCLogDebug("de_ctx->inspection_recursion_limit: %d",
2944 
2945  // default value is 4
2947  if (SCConfGetInt("detect.stream-tx-log-limit", &value) == 1) {
2948  if (value >= 0 && value <= UINT8_MAX) {
2949  de_ctx->guess_applayer_log_limit = (uint8_t)value;
2950  } else {
2951  SCLogWarning("Invalid value for detect-engine.stream-tx-log-limit: must be between 0 "
2952  "and 255, will default to 4");
2953  }
2954  }
2955  int guess_applayer = 0;
2956  if ((SCConfGetBool("detect.guess-applayer-tx", &guess_applayer)) == 1) {
2957  if (guess_applayer == 1) {
2958  de_ctx->guess_applayer = true;
2959  }
2960  }
2961 
2962  /* parse port grouping priority settings */
2963 
2964  const char *ports = NULL;
2965  (void)SCConfGet("detect.grouping.tcp-priority-ports", &ports);
2966  if (ports) {
2967  SCLogConfig("grouping: tcp-priority-ports %s", ports);
2968  } else {
2969  (void)SCConfGet("detect.grouping.tcp-whitelist", &ports);
2970  if (ports) {
2971  SCLogConfig(
2972  "grouping: tcp-priority-ports from legacy 'tcp-whitelist' setting: %s", ports);
2973  } else {
2974  ports = "53, 80, 139, 443, 445, 1433, 3306, 3389, 6666, 6667, 8080";
2975  SCLogConfig("grouping: tcp-priority-ports (default) %s", ports);
2976  }
2977  }
2978  if (DetectPortParse(de_ctx, &de_ctx->tcp_priorityports, ports) != 0) {
2979  SCLogWarning("'%s' is not a valid value "
2980  "for detect.grouping.tcp-priority-ports",
2981  ports);
2982  }
2984  for ( ; x != NULL; x = x->next) {
2985  if (x->port != x->port2) {
2986  SCLogWarning("'%s' is not a valid value "
2987  "for detect.grouping.tcp-priority-ports: only single ports allowed",
2988  ports);
2990  de_ctx->tcp_priorityports = NULL;
2991  break;
2992  }
2993  }
2994 
2995  ports = NULL;
2996  (void)SCConfGet("detect.grouping.udp-priority-ports", &ports);
2997  if (ports) {
2998  SCLogConfig("grouping: udp-priority-ports %s", ports);
2999  } else {
3000  (void)SCConfGet("detect.grouping.udp-whitelist", &ports);
3001  if (ports) {
3002  SCLogConfig(
3003  "grouping: udp-priority-ports from legacy 'udp-whitelist' setting: %s", ports);
3004  } else {
3005  ports = "53, 135, 5060";
3006  SCLogConfig("grouping: udp-priority-ports (default) %s", ports);
3007  }
3008  }
3009  if (DetectPortParse(de_ctx, &de_ctx->udp_priorityports, ports) != 0) {
3010  SCLogWarning("'%s' is not a valid value "
3011  "for detect.grouping.udp-priority-ports",
3012  ports);
3013  }
3014  for (x = de_ctx->udp_priorityports; x != NULL; x = x->next) {
3015  if (x->port != x->port2) {
3016  SCLogWarning("'%s' is not a valid value "
3017  "for detect.grouping.udp-priority-ports: only single ports allowed",
3018  ports);
3020  de_ctx->udp_priorityports = NULL;
3021  break;
3022  }
3023  }
3024 
3026  const char *pf_setting = NULL;
3027  if (SCConfGet("detect.prefilter.default", &pf_setting) == 1 && pf_setting) {
3028  if (strcasecmp(pf_setting, "mpm") == 0) {
3030  } else if (strcasecmp(pf_setting, "auto") == 0) {
3032  }
3033  }
3034  switch (de_ctx->prefilter_setting) {
3035  case DETECT_PREFILTER_MPM:
3036  SCLogConfig("prefilter engines: MPM");
3037  break;
3038  case DETECT_PREFILTER_AUTO:
3039  SCLogConfig("prefilter engines: MPM and keywords");
3040  break;
3041  }
3042 
3043  return 0;
3044 }
3045 
3047 {
3048  de_ctx->signum = 0;
3049 }
3050 
3051 static int DetectEngineThreadCtxInitGlobalKeywords(DetectEngineThreadCtx *det_ctx)
3052 {
3053  const DetectEngineMasterCtx *master = &g_master_de_ctx;
3054 
3055  if (master->keyword_id > 0) {
3056  // coverity[suspicious_sizeof : FALSE]
3057  det_ctx->global_keyword_ctxs_array = (void **)SCCalloc(master->keyword_id, sizeof(void *));
3058  if (det_ctx->global_keyword_ctxs_array == NULL) {
3059  SCLogError("setting up thread local detect ctx");
3060  return TM_ECODE_FAILED;
3061  }
3062  det_ctx->global_keyword_ctxs_size = master->keyword_id;
3063 
3064  const DetectEngineThreadKeywordCtxItem *item = master->keyword_list;
3065  while (item) {
3066  det_ctx->global_keyword_ctxs_array[item->id] = item->InitFunc(item->data);
3067  if (det_ctx->global_keyword_ctxs_array[item->id] == NULL) {
3068  SCLogError("setting up thread local detect ctx "
3069  "for keyword \"%s\" failed",
3070  item->name);
3071  return TM_ECODE_FAILED;
3072  }
3073  item = item->next;
3074  }
3075  }
3076  return TM_ECODE_OK;
3077 }
3078 
3079 static void DetectEngineThreadCtxDeinitGlobalKeywords(DetectEngineThreadCtx *det_ctx)
3080 {
3081  if (det_ctx->global_keyword_ctxs_array == NULL ||
3082  det_ctx->global_keyword_ctxs_size == 0) {
3083  return;
3084  }
3085 
3086  const DetectEngineMasterCtx *master = &g_master_de_ctx;
3087  if (master->keyword_id > 0) {
3088  const DetectEngineThreadKeywordCtxItem *item = master->keyword_list;
3089  while (item) {
3090  if (det_ctx->global_keyword_ctxs_array[item->id] != NULL)
3091  item->FreeFunc(det_ctx->global_keyword_ctxs_array[item->id]);
3092 
3093  item = item->next;
3094  }
3095  det_ctx->global_keyword_ctxs_size = 0;
3097  det_ctx->global_keyword_ctxs_array = NULL;
3098  }
3099 }
3100 
3101 static int DetectEngineThreadCtxInitKeywords(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx)
3102 {
3103  if (de_ctx->keyword_id > 0) {
3104  // coverity[suspicious_sizeof : FALSE]
3105  det_ctx->keyword_ctxs_array = SCCalloc(de_ctx->keyword_id, sizeof(void *));
3106  if (det_ctx->keyword_ctxs_array == NULL) {
3107  SCLogError("setting up thread local detect ctx");
3108  return TM_ECODE_FAILED;
3109  }
3110 
3111  det_ctx->keyword_ctxs_size = de_ctx->keyword_id;
3112 
3114  for (; hb != NULL; hb = HashListTableGetListNext(hb)) {
3116 
3117  det_ctx->keyword_ctxs_array[item->id] = item->InitFunc(item->data);
3118  if (det_ctx->keyword_ctxs_array[item->id] == NULL) {
3119  SCLogError("setting up thread local detect ctx "
3120  "for keyword \"%s\" failed",
3121  item->name);
3122  return TM_ECODE_FAILED;
3123  }
3124  }
3125  }
3126  return TM_ECODE_OK;
3127 }
3128 
3129 static void DetectEngineThreadCtxDeinitKeywords(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx)
3130 {
3131  if (de_ctx->keyword_id > 0) {
3133  for (; hb != NULL; hb = HashListTableGetListNext(hb)) {
3135 
3136  if (det_ctx->keyword_ctxs_array[item->id] != NULL)
3137  item->FreeFunc(det_ctx->keyword_ctxs_array[item->id]);
3138  }
3139  det_ctx->keyword_ctxs_size = 0;
3140  SCFree(det_ctx->keyword_ctxs_array);
3141  det_ctx->keyword_ctxs_array = NULL;
3142  }
3143 }
3144 
3145 /** NOTE: master MUST be locked before calling this */
3146 static TmEcode DetectEngineThreadCtxInitForMT(ThreadVars *tv, DetectEngineThreadCtx *det_ctx)
3147 {
3148  DetectEngineMasterCtx *master = &g_master_de_ctx;
3149 
3150  DetectEngineTenantMapping *map_array = NULL;
3151  uint32_t map_array_size = 0;
3152  uint32_t map_cnt = 0;
3153  uint32_t max_tenant_id = 0;
3154  DetectEngineCtx *list = master->list;
3155 
3157 
3158  /* coverity[missing_lock] */
3159  if (master->tenant_selector == TENANT_SELECTOR_UNKNOWN) {
3160  SCLogError("no tenant selector set: "
3161  "set using multi-detect.selector");
3162  return TM_ECODE_FAILED;
3163  }
3164 
3165  uint32_t tcnt = 0;
3166  while (list) {
3167  if (list->tenant_id > max_tenant_id)
3168  max_tenant_id = list->tenant_id;
3169 
3170  list = list->next;
3171  tcnt++;
3172  }
3173 
3174  HashTable *mt_det_ctxs_hash =
3175  HashTableInit(tcnt * 2, TenantIdHash, TenantIdCompare, TenantIdFree);
3176  if (mt_det_ctxs_hash == NULL) {
3177  goto error;
3178  }
3179 
3180  if (tcnt == 0) {
3181  SCLogInfo("no tenants left, or none registered yet");
3182  } else {
3183  max_tenant_id++;
3184 
3186  while (map) {
3187  map_cnt++;
3188  map = map->next;
3189  }
3190 
3191  if (map_cnt > 0) {
3192  map_array_size = map_cnt + 1;
3193 
3194  map_array = SCCalloc(map_array_size, sizeof(*map_array));
3195  if (map_array == NULL)
3196  goto error;
3197 
3198  /* fill the array */
3199  map_cnt = 0;
3200  map = master->tenant_mapping_list;
3201  while (map) {
3202  if (map_cnt >= map_array_size) {
3203  goto error;
3204  }
3205  map_array[map_cnt].traffic_id = map->traffic_id;
3206  map_array[map_cnt].tenant_id = map->tenant_id;
3207  map_cnt++;
3208  map = map->next;
3209  }
3210 
3211  }
3212 
3213  /* set up hash for tenant lookup */
3214  list = master->list;
3215  while (list) {
3216  SCLogDebug("tenant-id %u", list->tenant_id);
3217  if (list->tenant_id != 0) {
3219  if (mt_det_ctx == NULL)
3220  goto error;
3221  if (HashTableAdd(mt_det_ctxs_hash, mt_det_ctx, 0) != 0) {
3222  goto error;
3223  }
3224  }
3225  list = list->next;
3226  }
3227  }
3228 
3229  det_ctx->mt_det_ctxs_hash = mt_det_ctxs_hash;
3230  mt_det_ctxs_hash = NULL;
3231 
3232  det_ctx->mt_det_ctxs_cnt = max_tenant_id;
3233 
3234  det_ctx->tenant_array = map_array;
3235  det_ctx->tenant_array_size = map_array_size;
3236 
3237  switch (master->tenant_selector) {
3239  SCLogDebug("TENANT_SELECTOR_UNKNOWN");
3240  break;
3241  case TENANT_SELECTOR_VLAN:
3242  det_ctx->TenantGetId = DetectEngineTenantGetIdFromVlanId;
3243  SCLogDebug("TENANT_SELECTOR_VLAN");
3244  break;
3246  det_ctx->TenantGetId = DetectEngineTenantGetIdFromLivedev;
3247  SCLogDebug("TENANT_SELECTOR_LIVEDEV");
3248  break;
3250  det_ctx->TenantGetId = DetectEngineTenantGetIdFromPcap;
3251  SCLogDebug("TENANT_SELECTOR_DIRECT");
3252  break;
3253  }
3254 
3255  return TM_ECODE_OK;
3256 error:
3257  if (map_array != NULL)
3258  SCFree(map_array);
3259  if (mt_det_ctxs_hash != NULL)
3260  HashTableFree(mt_det_ctxs_hash);
3261 
3262  return TM_ECODE_FAILED;
3263 }
3264 
3265 /** \internal
3266  * \brief Helper for DetectThread setup functions
3267  */
3268 static TmEcode ThreadCtxDoInit (DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx)
3269 {
3271 
3272  PmqSetup(&det_ctx->pmq);
3273 
3275  if (det_ctx->spm_thread_ctx == NULL) {
3276  return TM_ECODE_FAILED;
3277  }
3278 
3279  /* DeState */
3280  if (de_ctx->sig_array_len > 0) {
3281  det_ctx->match_array_len = de_ctx->sig_array_len;
3282  det_ctx->match_array = SCCalloc(det_ctx->match_array_len, sizeof(Signature *));
3283  if (det_ctx->match_array == NULL) {
3284  return TM_ECODE_FAILED;
3285  }
3286 
3288  }
3289 
3290  /* Alert processing queue */
3291  AlertQueueInit(det_ctx);
3292 
3293  /* byte_extract storage */
3294  det_ctx->byte_values = SCMalloc(sizeof(*det_ctx->byte_values) *
3296  if (det_ctx->byte_values == NULL) {
3297  return TM_ECODE_FAILED;
3298  }
3299 
3300  /* Allocate space for base64 decoded data. */
3303  if (det_ctx->base64_decoded == NULL) {
3304  return TM_ECODE_FAILED;
3305  }
3306  det_ctx->base64_decoded_len = 0;
3307  }
3308 
3310  det_ctx->inspect.buffers = SCCalloc(det_ctx->inspect.buffers_size, sizeof(InspectionBuffer));
3311  if (det_ctx->inspect.buffers == NULL) {
3312  return TM_ECODE_FAILED;
3313  }
3314  det_ctx->inspect.to_clear_queue = SCCalloc(det_ctx->inspect.buffers_size, sizeof(uint32_t));
3315  if (det_ctx->inspect.to_clear_queue == NULL) {
3316  return TM_ECODE_FAILED;
3317  }
3318  det_ctx->inspect.to_clear_idx = 0;
3319 
3322  if (det_ctx->multi_inspect.buffers == NULL) {
3323  return TM_ECODE_FAILED;
3324  }
3325  det_ctx->multi_inspect.to_clear_queue = SCCalloc(det_ctx->multi_inspect.buffers_size, sizeof(uint32_t));
3326  if (det_ctx->multi_inspect.to_clear_queue == NULL) {
3327  return TM_ECODE_FAILED;
3328  }
3329  det_ctx->multi_inspect.to_clear_idx = 0;
3330 
3331 
3332  DetectEngineThreadCtxInitKeywords(de_ctx, det_ctx);
3333  DetectEngineThreadCtxInitGlobalKeywords(det_ctx);
3334 #ifdef PROFILE_RULES
3335  SCProfilingRuleThreadSetup(de_ctx->profile_ctx, det_ctx);
3336 #endif
3337 #ifdef PROFILING
3341 #endif
3342  SC_ATOMIC_INIT(det_ctx->so_far_used_by_detect);
3343 
3344  return TM_ECODE_OK;
3345 }
3346 
3347 /** \brief initialize thread specific detection engine context
3348  *
3349  * \note there is a special case when using delayed detect. In this case the
3350  * function is called twice per thread. The first time the rules are not
3351  * yet loaded. de_ctx->delayed_detect_initialized will be 0. The 2nd
3352  * time they will be loaded. de_ctx->delayed_detect_initialized will be 1.
3353  * This is needed to do the per thread counter registration before the
3354  * packet runtime starts. In delayed detect mode, the first call will
3355  * return a NULL ptr through the data ptr.
3356  *
3357  * \param tv ThreadVars for this thread
3358  * \param initdata pointer to de_ctx
3359  * \param data[out] pointer to store our thread detection ctx
3360  *
3361  * \retval TM_ECODE_OK if all went well
3362  * \retval TM_ECODE_FAILED on serious errors
3363  */
3364 TmEcode DetectEngineThreadCtxInit(ThreadVars *tv, void *initdata, void **data)
3365 {
3366  DetectEngineThreadCtx *det_ctx = SCCalloc(1, sizeof(DetectEngineThreadCtx));
3367  if (unlikely(det_ctx == NULL))
3368  return TM_ECODE_FAILED;
3369 
3370  det_ctx->tv = tv;
3371  det_ctx->de_ctx = DetectEngineGetCurrent();
3372  if (det_ctx->de_ctx == NULL) {
3373 #ifdef UNITTESTS
3374  if (RunmodeIsUnittests()) {
3375  det_ctx->de_ctx = (DetectEngineCtx *)initdata;
3376  } else {
3377  DetectEngineThreadCtxDeinit(tv, det_ctx);
3378  return TM_ECODE_FAILED;
3379  }
3380 #else
3381  DetectEngineThreadCtxDeinit(tv, det_ctx);
3382  return TM_ECODE_FAILED;
3383 #endif
3384  }
3385 
3386  if (det_ctx->de_ctx->type == DETECT_ENGINE_TYPE_NORMAL ||
3387  det_ctx->de_ctx->type == DETECT_ENGINE_TYPE_TENANT)
3388  {
3389  if (ThreadCtxDoInit(det_ctx->de_ctx, det_ctx) != TM_ECODE_OK) {
3390  DetectEngineThreadCtxDeinit(tv, det_ctx);
3391  return TM_ECODE_FAILED;
3392  }
3393  }
3394 
3395  /** alert counter setup */
3396  det_ctx->counter_alerts = StatsRegisterCounter("detect.alert", tv);
3397  det_ctx->counter_alerts_overflow = StatsRegisterCounter("detect.alert_queue_overflow", tv);
3398  det_ctx->counter_alerts_suppressed = StatsRegisterCounter("detect.alerts_suppressed", tv);
3399 
3400  /* Register counter for Lua rule errors. */
3401  det_ctx->lua_rule_errors = StatsRegisterCounter("detect.lua.errors", tv);
3402 
3403  /* Register a counter for Lua blocked function attempts. */
3404  det_ctx->lua_blocked_function_errors =
3405  StatsRegisterCounter("detect.lua.blocked_function_errors", tv);
3406 
3407  /* Register a counter for Lua instruction limit errors. */
3408  det_ctx->lua_instruction_limit_errors =
3409  StatsRegisterCounter("detect.lua.instruction_limit_errors", tv);
3410 
3411  /* Register a counter for Lua memory limit errors. */
3412  det_ctx->lua_memory_limit_errors = StatsRegisterCounter("detect.lua.memory_limit_errors", tv);
3413 
3414  det_ctx->json_content = NULL;
3415  det_ctx->json_content_capacity = 0;
3416  det_ctx->json_content_len = 0;
3417 
3418 #ifdef PROFILING
3419  det_ctx->counter_mpm_list = StatsRegisterAvgCounter("detect.mpm_list", tv);
3420  det_ctx->counter_match_list = StatsRegisterAvgCounter("detect.match_list", tv);
3421 #endif
3422 
3424  DetectEngineMasterCtx *master = &g_master_de_ctx;
3425  SCMutexLock(&master->lock);
3426  if (DetectEngineThreadCtxInitForMT(tv, det_ctx) != TM_ECODE_OK) {
3427  DetectEngineThreadCtxDeinit(tv, det_ctx);
3428  SCMutexUnlock(&master->lock);
3429  return TM_ECODE_FAILED;
3430  }
3431  SCMutexUnlock(&master->lock);
3432  }
3433 
3434  /* pass thread data back to caller */
3435  *data = (void *)det_ctx;
3436 
3437  return TM_ECODE_OK;
3438 }
3439 
3440 /**
3441  * \internal
3442  * \brief initialize a det_ctx for reload cases
3443  * \param new_de_ctx the new detection engine
3444  * \param mt flag to indicate if MT should be set up for this det_ctx
3445  * this should only be done for the 'root' det_ctx
3446  *
3447  * \retval det_ctx detection engine thread ctx or NULL in case of error
3448  */
3450  ThreadVars *tv, DetectEngineCtx *new_de_ctx, int mt)
3451 {
3452  DetectEngineThreadCtx *det_ctx = SCCalloc(1, sizeof(DetectEngineThreadCtx));
3453  if (unlikely(det_ctx == NULL))
3454  return NULL;
3455 
3456  det_ctx->tenant_id = new_de_ctx->tenant_id;
3457  det_ctx->tv = tv;
3458  det_ctx->de_ctx = DetectEngineReference(new_de_ctx);
3459  if (det_ctx->de_ctx == NULL) {
3460  SCFree(det_ctx);
3461  return NULL;
3462  }
3463 
3464  /* most of the init happens here */
3465  if (det_ctx->de_ctx->type == DETECT_ENGINE_TYPE_NORMAL ||
3466  det_ctx->de_ctx->type == DETECT_ENGINE_TYPE_TENANT)
3467  {
3468  if (ThreadCtxDoInit(det_ctx->de_ctx, det_ctx) != TM_ECODE_OK) {
3469  DetectEngineDeReference(&det_ctx->de_ctx);
3470  SCFree(det_ctx);
3471  return NULL;
3472  }
3473  }
3474 
3475  /** alert counter setup */
3476  det_ctx->counter_alerts = StatsRegisterCounter("detect.alert", tv);
3477  det_ctx->counter_alerts_overflow = StatsRegisterCounter("detect.alert_queue_overflow", tv);
3478  det_ctx->counter_alerts_suppressed = StatsRegisterCounter("detect.alerts_suppressed", tv);
3479 #ifdef PROFILING
3480  det_ctx->counter_mpm_list = StatsRegisterAvgCounter("detect.mpm_list", tv);
3481  det_ctx->counter_match_list = StatsRegisterAvgCounter("detect.match_list", tv);
3482 #endif
3483 
3484  if (mt && DetectEngineMultiTenantEnabledWithLock()) {
3485  if (DetectEngineThreadCtxInitForMT(tv, det_ctx) != TM_ECODE_OK) {
3486  DetectEngineDeReference(&det_ctx->de_ctx);
3487  SCFree(det_ctx);
3488  return NULL;
3489  }
3490  }
3491 
3492  return det_ctx;
3493 }
3494 
3495 static void DetectEngineThreadCtxFree(DetectEngineThreadCtx *det_ctx)
3496 {
3497 #if DEBUG
3498  SCLogDebug("PACKET PKT_STREAM_ADD: %"PRIu64, det_ctx->pkt_stream_add_cnt);
3499 
3500  SCLogDebug("PAYLOAD MPM %"PRIu64"/%"PRIu64, det_ctx->payload_mpm_cnt, det_ctx->payload_mpm_size);
3501  SCLogDebug("STREAM MPM %"PRIu64"/%"PRIu64, det_ctx->stream_mpm_cnt, det_ctx->stream_mpm_size);
3502 
3503  SCLogDebug("PAYLOAD SIG %"PRIu64"/%"PRIu64, det_ctx->payload_persig_cnt, det_ctx->payload_persig_size);
3504  SCLogDebug("STREAM SIG %"PRIu64"/%"PRIu64, det_ctx->stream_persig_cnt, det_ctx->stream_persig_size);
3505 #endif
3506 
3507  if (det_ctx->tenant_array != NULL) {
3508  SCFree(det_ctx->tenant_array);
3509  det_ctx->tenant_array = NULL;
3510  }
3511 
3512 #ifdef PROFILE_RULES
3513  SCProfilingRuleThreadCleanup(det_ctx);
3514 #endif
3515 #ifdef PROFILING
3518  SCProfilingSghThreadCleanup(det_ctx);
3519 #endif
3520 
3521  /** \todo get rid of this static */
3522  if (det_ctx->de_ctx != NULL) {
3523  PatternMatchThreadDestroy(&det_ctx->mtc, det_ctx->de_ctx->mpm_matcher);
3524  }
3525 
3526  PmqFree(&det_ctx->pmq);
3527 
3528  if (det_ctx->spm_thread_ctx != NULL) {
3530  }
3531  if (det_ctx->match_array != NULL)
3532  SCFree(det_ctx->match_array);
3533 
3535 
3536  AlertQueueFree(det_ctx);
3537 
3538  if (det_ctx->post_rule_work_queue.q)
3539  SCFree(det_ctx->post_rule_work_queue.q);
3540 
3541  if (det_ctx->byte_values != NULL)
3542  SCFree(det_ctx->byte_values);
3543 
3544  /* Decoded base64 data. */
3545  if (det_ctx->base64_decoded != NULL) {
3546  SCFree(det_ctx->base64_decoded);
3547  }
3548 
3549  if (det_ctx->inspect.buffers) {
3550  for (uint32_t i = 0; i < det_ctx->inspect.buffers_size; i++) {
3551  InspectionBufferFree(&det_ctx->inspect.buffers[i]);
3552  }
3553  SCFree(det_ctx->inspect.buffers);
3554  }
3555  if (det_ctx->inspect.to_clear_queue) {
3556  SCFree(det_ctx->inspect.to_clear_queue);
3557  }
3558  if (det_ctx->multi_inspect.buffers) {
3559  for (uint32_t i = 0; i < det_ctx->multi_inspect.buffers_size; i++) {
3561  for (uint32_t x = 0; x < fb->size; x++) {
3563  }
3565  }
3566  SCFree(det_ctx->multi_inspect.buffers);
3567  }
3568  if (det_ctx->multi_inspect.to_clear_queue) {
3570  }
3571 
3572  DetectEngineThreadCtxDeinitGlobalKeywords(det_ctx);
3573  if (det_ctx->de_ctx != NULL) {
3574  DetectEngineThreadCtxDeinitKeywords(det_ctx->de_ctx, det_ctx);
3575 #ifdef UNITTESTS
3576  if (!RunmodeIsUnittests() || det_ctx->de_ctx->ref_cnt > 0)
3577  DetectEngineDeReference(&det_ctx->de_ctx);
3578 #else
3579  DetectEngineDeReference(&det_ctx->de_ctx);
3580 #endif
3581  }
3582 
3583  if (det_ctx->json_content) {
3584  SCFree(det_ctx->json_content);
3585  det_ctx->json_content = NULL;
3586  det_ctx->json_content_capacity = 0;
3587  }
3588 
3591  SCFree(det_ctx);
3592 
3594 }
3595 
3597 {
3598  DetectEngineThreadCtx *det_ctx = (DetectEngineThreadCtx *)data;
3599 
3600  if (det_ctx == NULL) {
3601  SCLogWarning("argument \"data\" NULL");
3602  return TM_ECODE_OK;
3603  }
3604 
3605  if (det_ctx->mt_det_ctxs_hash != NULL) {
3606  HashTableFree(det_ctx->mt_det_ctxs_hash);
3607  det_ctx->mt_det_ctxs_hash = NULL;
3608  }
3609  DetectEngineThreadCtxFree(det_ctx);
3610 
3611  return TM_ECODE_OK;
3612 }
3613 
3614 static uint32_t DetectKeywordCtxHashFunc(HashListTable *ht, void *data, uint16_t datalen)
3615 {
3617  const char *name = ctx->name;
3618  uint64_t hash =
3619  StringHashDjb2((const uint8_t *)name, (uint32_t)strlen(name)) + (ptrdiff_t)ctx->data;
3620  hash %= ht->array_size;
3621  return (uint32_t)hash;
3622 }
3623 
3624 static char DetectKeywordCtxCompareFunc(void *data1, uint16_t len1, void *data2, uint16_t len2)
3625 {
3626  DetectEngineThreadKeywordCtxItem *ctx1 = data1;
3627  DetectEngineThreadKeywordCtxItem *ctx2 = data2;
3628  const char *name1 = ctx1->name;
3629  const char *name2 = ctx2->name;
3630  return (strcmp(name1, name2) == 0 && ctx1->data == ctx2->data);
3631 }
3632 
3633 static void DetectKeywordCtxFreeFunc(void *ptr)
3634 {
3635  SCFree(ptr);
3636 }
3637 
3638 /** \brief Register Thread keyword context Funcs
3639  *
3640  * \param de_ctx detection engine to register in
3641  * \param name keyword name for error printing
3642  * \param InitFunc function ptr
3643  * \param data keyword init data to pass to Func. Can be NULL.
3644  * \param FreeFunc function ptr
3645  * \param mode 0 normal (ctx per keyword instance) 1 shared (one ctx per det_ct)
3646  *
3647  * \retval id for retrieval of ctx at runtime
3648  * \retval -1 on error
3649  *
3650  * \note make sure "data" remains valid and it free'd elsewhere. It's
3651  * recommended to store it in the keywords global ctx so that
3652  * it's freed when the de_ctx is freed.
3653  */
3654 int DetectRegisterThreadCtxFuncs(DetectEngineCtx *de_ctx, const char *name, void *(*InitFunc)(void *), void *data, void (*FreeFunc)(void *), int mode)
3655 {
3656  BUG_ON(de_ctx == NULL || InitFunc == NULL || FreeFunc == NULL);
3657 
3658  if (de_ctx->keyword_hash == NULL) {
3659  de_ctx->keyword_hash = HashListTableInit(4096, // TODO
3660  DetectKeywordCtxHashFunc, DetectKeywordCtxCompareFunc, DetectKeywordCtxFreeFunc);
3661  BUG_ON(de_ctx->keyword_hash == NULL);
3662  }
3663 
3664  if (mode) {
3665  DetectEngineThreadKeywordCtxItem search = { .data = data, .name = name };
3666 
3668  HashListTableLookup(de_ctx->keyword_hash, (void *)&search, 0);
3669  if (item)
3670  return item->id;
3671 
3672  /* fall through */
3673  }
3674 
3676  if (unlikely(item == NULL))
3677  return -1;
3678 
3679  item->InitFunc = InitFunc;
3680  item->FreeFunc = FreeFunc;
3681  item->data = data;
3682  item->name = name;
3683  item->id = de_ctx->keyword_id++;
3684 
3685  if (HashListTableAdd(de_ctx->keyword_hash, (void *)item, 0) < 0) {
3686  SCFree(item);
3687  return -1;
3688  }
3689  return item->id;
3690 }
3691 
3692 /** \brief Remove Thread keyword context registration
3693  *
3694  * \param de_ctx detection engine to deregister from
3695  * \param det_ctx detection engine thread context to deregister from
3696  * \param data keyword init data to pass to Func. Can be NULL.
3697  * \param name keyword name for error printing
3698  *
3699  * \retval 1 Item unregistered
3700  * \retval 0 otherwise
3701  *
3702  * \note make sure "data" remains valid and it free'd elsewhere. It's
3703  * recommended to store it in the keywords global ctx so that
3704  * it's freed when the de_ctx is freed.
3705  */
3707 {
3708  /* might happen if we call this before a call to *Register* */
3709  if (de_ctx->keyword_hash == NULL)
3710  return 1;
3711  DetectEngineThreadKeywordCtxItem remove = { .data = data, .name = name };
3712  if (HashListTableRemove(de_ctx->keyword_hash, (void *)&remove, 0) == 0)
3713  return 1;
3714  return 0;
3715 }
3716 /** \brief Retrieve thread local keyword ctx by id
3717  *
3718  * \param det_ctx detection engine thread ctx to retrieve the ctx from
3719  * \param id id of the ctx returned by DetectRegisterThreadCtxInitFunc at
3720  * keyword init.
3721  *
3722  * \retval ctx or NULL on error
3723  */
3725 {
3726  if (id < 0 || id > det_ctx->keyword_ctxs_size || det_ctx->keyword_ctxs_array == NULL)
3727  return NULL;
3728 
3729  return det_ctx->keyword_ctxs_array[id];
3730 }
3731 
3732 
3733 /** \brief Register Thread keyword context Funcs (Global)
3734  *
3735  * IDs stay static over reloads and between tenants
3736  *
3737  * \param name keyword name for error printing
3738  * \param InitFunc function ptr
3739  * \param FreeFunc function ptr
3740  *
3741  * \retval id for retrieval of ctx at runtime
3742  * \retval -1 on error
3743  */
3745  void *(*InitFunc)(void *), void *data, void (*FreeFunc)(void *))
3746 {
3747  int id;
3748  BUG_ON(InitFunc == NULL || FreeFunc == NULL);
3749 
3750  DetectEngineMasterCtx *master = &g_master_de_ctx;
3751 
3752  /* if already registered, return existing id */
3754  while (item != NULL) {
3755  if (strcmp(name, item->name) == 0) {
3756  id = item->id;
3757  return id;
3758  }
3759 
3760  item = item->next;
3761  }
3762 
3763  item = SCCalloc(1, sizeof(*item));
3764  if (unlikely(item == NULL)) {
3765  return -1;
3766  }
3767  item->InitFunc = InitFunc;
3768  item->FreeFunc = FreeFunc;
3769  item->name = name;
3770  item->data = data;
3771 
3772  item->next = master->keyword_list;
3773  master->keyword_list = item;
3774  item->id = master->keyword_id++;
3775 
3776  id = item->id;
3777  return id;
3778 }
3779 
3780 /** \brief Retrieve thread local keyword ctx by id
3781  *
3782  * \param det_ctx detection engine thread ctx to retrieve the ctx from
3783  * \param id id of the ctx returned by DetectRegisterThreadCtxInitFunc at
3784  * keyword init.
3785  *
3786  * \retval ctx or NULL on error
3787  */
3789 {
3790  if (id < 0 || id > det_ctx->global_keyword_ctxs_size ||
3791  det_ctx->global_keyword_ctxs_array == NULL) {
3792  return NULL;
3793  }
3794 
3795  return det_ctx->global_keyword_ctxs_array[id];
3796 }
3797 
3798 /** \brief Check if detection is enabled
3799  * \retval bool true or false */
3801 {
3802  DetectEngineMasterCtx *master = &g_master_de_ctx;
3803  SCMutexLock(&master->lock);
3804 
3805  if (master->list == NULL) {
3806  SCMutexUnlock(&master->lock);
3807  return 0;
3808  }
3809 
3810  SCMutexUnlock(&master->lock);
3811  return 1;
3812 }
3813 
3815 {
3816  uint32_t version;
3817  DetectEngineMasterCtx *master = &g_master_de_ctx;
3818  SCMutexLock(&master->lock);
3819  version = master->version;
3820  SCMutexUnlock(&master->lock);
3821  return version;
3822 }
3823 
3825 {
3826  DetectEngineMasterCtx *master = &g_master_de_ctx;
3827  SCMutexLock(&master->lock);
3828  master->version++;
3829  SCLogDebug("master version now %u", master->version);
3830  SCMutexUnlock(&master->lock);
3831 }
3832 
3834 {
3835  DetectEngineMasterCtx *master = &g_master_de_ctx;
3836  SCMutexLock(&master->lock);
3837 
3838  DetectEngineCtx *de_ctx = master->list;
3839  while (de_ctx) {
3843  {
3844  de_ctx->ref_cnt++;
3845  SCLogDebug("de_ctx %p ref_cnt %u", de_ctx, de_ctx->ref_cnt);
3846  SCMutexUnlock(&master->lock);
3847  return de_ctx;
3848  }
3849  de_ctx = de_ctx->next;
3850  }
3851 
3852  SCMutexUnlock(&master->lock);
3853  return NULL;
3854 }
3855 
3857 {
3858  if (de_ctx == NULL)
3859  return NULL;
3860  de_ctx->ref_cnt++;
3861  return de_ctx;
3862 }
3863 
3864 static bool DetectEngineMultiTenantEnabledWithLock(void)
3865 {
3866  DetectEngineMasterCtx *master = &g_master_de_ctx;
3867  return master->multi_tenant_enabled;
3868 }
3869 
3871 {
3872  DetectEngineMasterCtx *master = &g_master_de_ctx;
3873  SCMutexLock(&master->lock);
3874  bool enabled = DetectEngineMultiTenantEnabledWithLock();
3875  SCMutexUnlock(&master->lock);
3876  return enabled;
3877 }
3878 
3879 /** \internal
3880  * \brief load a tenant from a yaml file
3881  *
3882  * \param tenant_id the tenant id by which the config is known
3883  * \param filename full path of a yaml file
3884  * \param loader_id id of loader thread or -1
3885  *
3886  * \retval 0 ok
3887  * \retval -1 failed
3888  */
3889 static int DetectEngineMultiTenantLoadTenant(uint32_t tenant_id, const char *filename, int loader_id)
3890 {
3891  DetectEngineCtx *de_ctx = NULL;
3892  char prefix[64];
3893 
3894  snprintf(prefix, sizeof(prefix), "multi-detect.%u", tenant_id);
3895 
3896  SCStat st;
3897  if (SCStatFn(filename, &st) != 0) {
3898  SCLogError("failed to stat file %s", filename);
3899  goto error;
3900  }
3901 
3902  de_ctx = DetectEngineGetByTenantId(tenant_id);
3903  if (de_ctx != NULL) {
3904  SCLogError("tenant %u already registered", tenant_id);
3906  goto error;
3907  }
3908 
3909  SCConfNode *node = SCConfGetNode(prefix);
3910  if (node == NULL) {
3911  SCLogError("failed to properly setup yaml %s", filename);
3912  goto error;
3913  }
3914 
3915  de_ctx = DetectEngineCtxInitWithPrefix(prefix, tenant_id);
3916  if (de_ctx == NULL) {
3917  SCLogError("initializing detection engine "
3918  "context failed.");
3919  goto error;
3920  }
3921  SCLogDebug("de_ctx %p with prefix %s", de_ctx, de_ctx->config_prefix);
3922 
3924  de_ctx->tenant_id = tenant_id;
3925  de_ctx->loader_id = loader_id;
3926  de_ctx->tenant_path = SCStrdup(filename);
3927  if (de_ctx->tenant_path == NULL) {
3928  SCLogError("Failed to duplicate path");
3929  goto error;
3930  }
3931 
3932  if (SigLoadSignatures(de_ctx, NULL, false) < 0) {
3933  SCLogError("Loading signatures failed.");
3934  goto error;
3935  }
3936 
3938 
3939  return 0;
3940 
3941 error:
3942  if (de_ctx != NULL) {
3944  }
3945  return -1;
3946 }
3947 
3948 static int DetectEngineMultiTenantReloadTenant(uint32_t tenant_id, const char *filename, int reload_cnt)
3949 {
3950  DetectEngineCtx *old_de_ctx = DetectEngineGetByTenantId(tenant_id);
3951  if (old_de_ctx == NULL) {
3952  SCLogError("tenant detect engine not found");
3953  return -1;
3954  }
3955 
3956  if (filename == NULL)
3957  filename = old_de_ctx->tenant_path;
3958 
3959  char prefix[64];
3960  snprintf(prefix, sizeof(prefix), "multi-detect.%u.reload.%d", tenant_id, reload_cnt);
3961  reload_cnt++;
3962  SCLogDebug("prefix %s", prefix);
3963 
3964  if (SCConfYamlLoadFileWithPrefix(filename, prefix) != 0) {
3965  SCLogError("failed to load yaml");
3966  goto error;
3967  }
3968 
3969  SCConfNode *node = SCConfGetNode(prefix);
3970  if (node == NULL) {
3971  SCLogError("failed to properly setup yaml %s", filename);
3972  goto error;
3973  }
3974 
3975  DetectEngineCtx *new_de_ctx = DetectEngineCtxInitWithPrefix(prefix, tenant_id);
3976  if (new_de_ctx == NULL) {
3977  SCLogError("initializing detection engine "
3978  "context failed.");
3979  goto error;
3980  }
3981  SCLogDebug("de_ctx %p with prefix %s", new_de_ctx, new_de_ctx->config_prefix);
3982 
3983  new_de_ctx->type = DETECT_ENGINE_TYPE_TENANT;
3984  new_de_ctx->tenant_id = tenant_id;
3985  new_de_ctx->loader_id = old_de_ctx->loader_id;
3986  new_de_ctx->tenant_path = SCStrdup(filename);
3987  if (new_de_ctx->tenant_path == NULL) {
3988  SCLogError("Failed to duplicate path");
3989  goto new_de_ctx_error;
3990  }
3991 
3992  if (SigLoadSignatures(new_de_ctx, NULL, false) < 0) {
3993  SCLogError("Loading signatures failed.");
3994  goto new_de_ctx_error;
3995  }
3996 
3997  DetectEngineAddToMaster(new_de_ctx);
3998 
3999  /* move to free list */
4000  DetectEngineMoveToFreeList(old_de_ctx);
4001  DetectEngineDeReference(&old_de_ctx);
4002  return 0;
4003 
4004 new_de_ctx_error:
4005  DetectEngineCtxFree(new_de_ctx);
4006 
4007 error:
4008  DetectEngineDeReference(&old_de_ctx);
4009  return -1;
4010 }
4011 
4012 
4013 typedef struct TenantLoaderCtx_ {
4014  uint32_t tenant_id;
4015  int reload_cnt; /**< used by reload */
4016  char *yaml; /**< heap alloc'd copy of file path for the yaml */
4018 
4019 static void DetectLoaderFreeTenant(void *ctx)
4020 {
4022  if (t->yaml != NULL) {
4023  SCFree(t->yaml);
4024  }
4025  SCFree(t);
4026 }
4027 
4028 static int DetectLoaderFuncLoadTenant(void *vctx, int loader_id)
4029 {
4030  TenantLoaderCtx *ctx = (TenantLoaderCtx *)vctx;
4031 
4032  SCLogDebug("loader %d", loader_id);
4033  if (DetectEngineMultiTenantLoadTenant(ctx->tenant_id, ctx->yaml, loader_id) != 0) {
4034  return -1;
4035  }
4036  return 0;
4037 }
4038 
4039 static int DetectLoaderSetupLoadTenant(uint32_t tenant_id, const char *yaml)
4040 {
4041  TenantLoaderCtx *t = SCCalloc(1, sizeof(*t));
4042  if (t == NULL)
4043  return -ENOMEM;
4044 
4045  t->tenant_id = tenant_id;
4046  t->yaml = SCStrdup(yaml);
4047  if (t->yaml == NULL) {
4048  SCFree(t);
4049  return -ENOMEM;
4050  }
4051 
4052  return DetectLoaderQueueTask(-1, DetectLoaderFuncLoadTenant, t, DetectLoaderFreeTenant);
4053 }
4054 
4055 static int DetectLoaderFuncReloadTenant(void *vctx, int loader_id)
4056 {
4057  TenantLoaderCtx *ctx = (TenantLoaderCtx *)vctx;
4058 
4059  SCLogDebug("loader_id %d", loader_id);
4060 
4061  if (DetectEngineMultiTenantReloadTenant(ctx->tenant_id, ctx->yaml, ctx->reload_cnt) != 0) {
4062  return -1;
4063  }
4064  return 0;
4065 }
4066 
4067 static int DetectLoaderSetupReloadTenants(const int reload_cnt)
4068 {
4069  int ret = 0;
4070  DetectEngineMasterCtx *master = &g_master_de_ctx;
4071  SCMutexLock(&master->lock);
4072 
4073  DetectEngineCtx *de_ctx = master->list;
4074  while (de_ctx) {
4076  TenantLoaderCtx *t = SCCalloc(1, sizeof(*t));
4077  if (t == NULL) {
4078  ret = -1;
4079  goto error;
4080  }
4081  t->tenant_id = de_ctx->tenant_id;
4082  t->reload_cnt = reload_cnt;
4083  int loader_id = de_ctx->loader_id;
4084 
4085  int r = DetectLoaderQueueTask(
4086  loader_id, DetectLoaderFuncReloadTenant, t, DetectLoaderFreeTenant);
4087  if (r < 0) {
4088  ret = -2;
4089  goto error;
4090  }
4091  }
4092 
4093  de_ctx = de_ctx->next;
4094  }
4095 error:
4096  SCMutexUnlock(&master->lock);
4097  return ret;
4098 }
4099 
4100 static int DetectLoaderSetupReloadTenant(uint32_t tenant_id, const char *yaml, int reload_cnt)
4101 {
4102  DetectEngineCtx *old_de_ctx = DetectEngineGetByTenantId(tenant_id);
4103  if (old_de_ctx == NULL)
4104  return -ENOENT;
4105  int loader_id = old_de_ctx->loader_id;
4106  DetectEngineDeReference(&old_de_ctx);
4107 
4108  TenantLoaderCtx *t = SCCalloc(1, sizeof(*t));
4109  if (t == NULL)
4110  return -ENOMEM;
4111 
4112  t->tenant_id = tenant_id;
4113  if (yaml != NULL) {
4114  t->yaml = SCStrdup(yaml);
4115  if (t->yaml == NULL) {
4116  SCFree(t);
4117  return -ENOMEM;
4118  }
4119  }
4120  t->reload_cnt = reload_cnt;
4121 
4122  SCLogDebug("loader_id %d", loader_id);
4123 
4124  return DetectLoaderQueueTask(
4125  loader_id, DetectLoaderFuncReloadTenant, t, DetectLoaderFreeTenant);
4126 }
4127 
4128 /** \brief Load a tenant and wait for loading to complete
4129  */
4130 int DetectEngineLoadTenantBlocking(uint32_t tenant_id, const char *yaml)
4131 {
4132  int r = DetectLoaderSetupLoadTenant(tenant_id, yaml);
4133  if (r < 0)
4134  return r;
4135 
4136  if (DetectLoadersSync() != 0)
4137  return -1;
4138 
4139  return 0;
4140 }
4141 
4142 /** \brief Reload a tenant and wait for loading to complete
4143  */
4144 int DetectEngineReloadTenantBlocking(uint32_t tenant_id, const char *yaml, int reload_cnt)
4145 {
4146  int r = DetectLoaderSetupReloadTenant(tenant_id, yaml, reload_cnt);
4147  if (r < 0)
4148  return r;
4149 
4150  if (DetectLoadersSync() != 0)
4151  return -1;
4152 
4153  return 0;
4154 }
4155 
4156 /** \brief Reload all tenants and wait for loading to complete
4157  */
4158 int DetectEngineReloadTenantsBlocking(const int reload_cnt)
4159 {
4160  int r = DetectLoaderSetupReloadTenants(reload_cnt);
4161  if (r < 0)
4162  return r;
4163 
4164  if (DetectLoadersSync() != 0)
4165  return -1;
4166 
4167  return 0;
4168 }
4169 
4170 static int DetectEngineMultiTenantSetupLoadLivedevMappings(
4171  const SCConfNode *mappings_root_node, bool failure_fatal)
4172 {
4173  SCConfNode *mapping_node = NULL;
4174 
4175  int mapping_cnt = 0;
4176  if (mappings_root_node != NULL) {
4177  TAILQ_FOREACH(mapping_node, &mappings_root_node->head, next) {
4178  SCConfNode *tenant_id_node = SCConfNodeLookupChild(mapping_node, "tenant-id");
4179  if (tenant_id_node == NULL)
4180  goto bad_mapping;
4181  SCConfNode *device_node = SCConfNodeLookupChild(mapping_node, "device");
4182  if (device_node == NULL)
4183  goto bad_mapping;
4184 
4185  uint32_t tenant_id = 0;
4186  if (StringParseUint32(&tenant_id, 10, (uint16_t)strlen(tenant_id_node->val),
4187  tenant_id_node->val) < 0) {
4188  SCLogError("tenant-id "
4189  "of %s is invalid",
4190  tenant_id_node->val);
4191  goto bad_mapping;
4192  }
4193 
4194  const char *dev = device_node->val;
4195  LiveDevice *ld = LiveGetDevice(dev);
4196  if (ld == NULL) {
4197  SCLogWarning("device %s not found", dev);
4198  goto bad_mapping;
4199  }
4200 
4201  if (ld->tenant_id_set) {
4202  SCLogWarning("device %s already mapped to tenant-id %u", dev, ld->tenant_id);
4203  goto bad_mapping;
4204  }
4205 
4206  ld->tenant_id = tenant_id;
4207  ld->tenant_id_set = true;
4208 
4209  if (DetectEngineTenantRegisterLivedev(tenant_id, ld->id) != 0) {
4210  goto error;
4211  }
4212 
4213  SCLogConfig("device %s connected to tenant-id %u", dev, tenant_id);
4214  mapping_cnt++;
4215  continue;
4216 
4217  bad_mapping:
4218  if (failure_fatal)
4219  goto error;
4220  }
4221  }
4222  SCLogConfig("%d device - tenant-id mappings defined", mapping_cnt);
4223  return mapping_cnt;
4224 
4225 error:
4226  return 0;
4227 }
4228 
4229 static int DetectEngineMultiTenantSetupLoadVlanMappings(
4230  const SCConfNode *mappings_root_node, bool failure_fatal)
4231 {
4232  SCConfNode *mapping_node = NULL;
4233 
4234  int mapping_cnt = 0;
4235  if (mappings_root_node != NULL) {
4236  TAILQ_FOREACH(mapping_node, &mappings_root_node->head, next) {
4237  SCConfNode *tenant_id_node = SCConfNodeLookupChild(mapping_node, "tenant-id");
4238  if (tenant_id_node == NULL)
4239  goto bad_mapping;
4240  SCConfNode *vlan_id_node = SCConfNodeLookupChild(mapping_node, "vlan-id");
4241  if (vlan_id_node == NULL)
4242  goto bad_mapping;
4243 
4244  uint32_t tenant_id = 0;
4245  if (StringParseUint32(&tenant_id, 10, (uint16_t)strlen(tenant_id_node->val),
4246  tenant_id_node->val) < 0) {
4247  SCLogError("tenant-id "
4248  "of %s is invalid",
4249  tenant_id_node->val);
4250  goto bad_mapping;
4251  }
4252 
4253  uint16_t vlan_id = 0;
4254  if (StringParseUint16(
4255  &vlan_id, 10, (uint16_t)strlen(vlan_id_node->val), vlan_id_node->val) < 0) {
4256  SCLogError("vlan-id "
4257  "of %s is invalid",
4258  vlan_id_node->val);
4259  goto bad_mapping;
4260  }
4261  if (vlan_id == 0 || vlan_id >= 4095) {
4262  SCLogError("vlan-id "
4263  "of %s is invalid. Valid range 1-4094.",
4264  vlan_id_node->val);
4265  goto bad_mapping;
4266  }
4267 
4268  if (DetectEngineTenantRegisterVlanId(tenant_id, vlan_id) != 0) {
4269  goto error;
4270  }
4271  SCLogConfig("vlan %u connected to tenant-id %u", vlan_id, tenant_id);
4272  mapping_cnt++;
4273  continue;
4274 
4275  bad_mapping:
4276  if (failure_fatal)
4277  goto error;
4278  }
4279  }
4280  return mapping_cnt;
4281 
4282 error:
4283  return 0;
4284 }
4285 
4286 /**
4287  * \brief setup multi-detect / multi-tenancy
4288  *
4289  * See if MT is enabled. If so, setup the selector, tenants and mappings.
4290  * Tenants and mappings are optional, and can also dynamically be added
4291  * and removed from the unix socket.
4292  */
4293 int DetectEngineMultiTenantSetup(const bool unix_socket)
4294 {
4296  DetectEngineMasterCtx *master = &g_master_de_ctx;
4297  int failure_fatal = 0;
4298  (void)SCConfGetBool("engine.init-failure-fatal", &failure_fatal);
4299 
4300  int enabled = 0;
4301  (void)SCConfGetBool("multi-detect.enabled", &enabled);
4302  if (enabled == 1) {
4307 
4308  SCMutexLock(&master->lock);
4309  master->multi_tenant_enabled = 1;
4310 
4311  const char *handler = NULL;
4312  if (SCConfGet("multi-detect.selector", &handler) == 1) {
4313  SCLogConfig("multi-tenant selector type %s", handler);
4314 
4315  if (strcmp(handler, "vlan") == 0) {
4316  tenant_selector = master->tenant_selector = TENANT_SELECTOR_VLAN;
4317 
4318  int vlanbool = 0;
4319  if ((SCConfGetBool("vlan.use-for-tracking", &vlanbool)) == 1 && vlanbool == 0) {
4320  SCLogError("vlan tracking is disabled, "
4321  "can't use multi-detect selector 'vlan'");
4322  SCMutexUnlock(&master->lock);
4323  goto error;
4324  }
4325 
4326  } else if (strcmp(handler, "direct") == 0) {
4327  tenant_selector = master->tenant_selector = TENANT_SELECTOR_DIRECT;
4328  } else if (strcmp(handler, "device") == 0) {
4329  tenant_selector = master->tenant_selector = TENANT_SELECTOR_LIVEDEV;
4330  if (EngineModeIsIPS()) {
4331  SCLogWarning("multi-tenant 'device' mode not supported for IPS");
4332  SCMutexUnlock(&master->lock);
4333  goto error;
4334  }
4335 
4336  } else {
4337  SCLogError("unknown value %s "
4338  "multi-detect.selector",
4339  handler);
4340  SCMutexUnlock(&master->lock);
4341  goto error;
4342  }
4343  }
4344  SCMutexUnlock(&master->lock);
4345  SCLogConfig("multi-detect is enabled (multi tenancy). Selector: %s", handler);
4346 
4347  /* traffic -- tenant mappings */
4348  SCConfNode *mappings_root_node = SCConfGetNode("multi-detect.mappings");
4349 
4350  if (tenant_selector == TENANT_SELECTOR_VLAN) {
4351  int mapping_cnt = DetectEngineMultiTenantSetupLoadVlanMappings(mappings_root_node,
4352  failure_fatal);
4353  if (mapping_cnt == 0) {
4354  /* no mappings are valid when we're in unix socket mode,
4355  * they can be added on the fly. Otherwise warn/error
4356  * depending on failure_fatal */
4357 
4358  if (unix_socket) {
4359  SCLogNotice("no tenant traffic mappings defined, "
4360  "tenants won't be used until mappings are added");
4361  } else {
4362  if (failure_fatal) {
4363  SCLogError("no multi-detect mappings defined");
4364  goto error;
4365  } else {
4366  SCLogWarning("no multi-detect mappings defined");
4367  }
4368  }
4369  }
4370  } else if (tenant_selector == TENANT_SELECTOR_LIVEDEV) {
4371  int mapping_cnt = DetectEngineMultiTenantSetupLoadLivedevMappings(mappings_root_node,
4372  failure_fatal);
4373  if (mapping_cnt == 0) {
4374  if (failure_fatal) {
4375  SCLogError("no multi-detect mappings defined");
4376  goto error;
4377  } else {
4378  SCLogWarning("no multi-detect mappings defined");
4379  }
4380  }
4381  }
4382 
4383  /* tenants */
4384  SCConfNode *tenants_root_node = SCConfGetNode("multi-detect.tenants");
4385  SCConfNode *tenant_node = NULL;
4386 
4387  if (tenants_root_node != NULL) {
4388  const char *path = NULL;
4389  SCConfNode *path_node = SCConfGetNode("multi-detect.config-path");
4390  if (path_node) {
4391  path = path_node->val;
4392  SCLogConfig("tenants config path: %s", path);
4393  }
4394 
4395  TAILQ_FOREACH(tenant_node, &tenants_root_node->head, next) {
4396  SCConfNode *id_node = SCConfNodeLookupChild(tenant_node, "id");
4397  if (id_node == NULL) {
4398  goto bad_tenant;
4399  }
4400  SCConfNode *yaml_node = SCConfNodeLookupChild(tenant_node, "yaml");
4401  if (yaml_node == NULL) {
4402  goto bad_tenant;
4403  }
4404 
4405  uint32_t tenant_id = 0;
4406  if (StringParseUint32(
4407  &tenant_id, 10, (uint16_t)strlen(id_node->val), id_node->val) < 0) {
4408  SCLogError("tenant_id "
4409  "of %s is invalid",
4410  id_node->val);
4411  goto bad_tenant;
4412  }
4413  SCLogDebug("tenant id: %u, %s", tenant_id, yaml_node->val);
4414 
4415  char yaml_path[PATH_MAX] = "";
4416  if (path) {
4417  if (PathMerge(yaml_path, PATH_MAX, path, yaml_node->val) < 0)
4418  goto bad_tenant;
4419  } else {
4420  size_t r = strlcpy(yaml_path, yaml_node->val, sizeof(yaml_path));
4421  if (r >= sizeof(yaml_path))
4422  goto bad_tenant;
4423  }
4424  SCLogDebug("tenant path: %s", yaml_path);
4425 
4426  /* setup the yaml in this loop so that it's not done by the loader
4427  * threads. SCConfYamlLoadFileWithPrefix is not thread safe. */
4428  char prefix[64];
4429  snprintf(prefix, sizeof(prefix), "multi-detect.%u", tenant_id);
4430  if (SCConfYamlLoadFileWithPrefix(yaml_path, prefix) != 0) {
4431  SCLogError("failed to load yaml %s", yaml_path);
4432  goto bad_tenant;
4433  }
4434 
4435  int r = DetectLoaderSetupLoadTenant(tenant_id, yaml_path);
4436  if (r < 0) {
4437  /* error logged already */
4438  goto bad_tenant;
4439  }
4440  continue;
4441 
4442  bad_tenant:
4443  if (failure_fatal)
4444  goto error;
4445  }
4446  }
4447 
4448  /* wait for our loaders to complete their tasks */
4449  if (DetectLoadersSync() != 0) {
4450  goto error;
4451  }
4452 
4454 
4455  } else {
4456  SCLogDebug("multi-detect not enabled (multi tenancy)");
4457  }
4458  return 0;
4459 error:
4460  return -1;
4461 }
4462 
4463 static uint32_t DetectEngineTenantGetIdFromVlanId(const void *ctx, const Packet *p)
4464 {
4465  const DetectEngineThreadCtx *det_ctx = ctx;
4466  uint32_t x = 0;
4467  uint32_t vlan_id = 0;
4468 
4469  if (p->vlan_idx == 0)
4470  return 0;
4471 
4472  vlan_id = p->vlan_id[0];
4473 
4474  if (det_ctx == NULL || det_ctx->tenant_array == NULL || det_ctx->tenant_array_size == 0)
4475  return 0;
4476 
4477  /* not very efficient, but for now we're targeting only limited amounts.
4478  * Can use hash/tree approach later. */
4479  for (x = 0; x < det_ctx->tenant_array_size; x++) {
4480  if (det_ctx->tenant_array[x].traffic_id == vlan_id)
4481  return det_ctx->tenant_array[x].tenant_id;
4482  }
4483 
4484  return 0;
4485 }
4486 
4487 static uint32_t DetectEngineTenantGetIdFromLivedev(const void *ctx, const Packet *p)
4488 {
4489  const DetectEngineThreadCtx *det_ctx = ctx;
4490  const LiveDevice *ld = p->livedev;
4491 
4492  if (ld == NULL || det_ctx == NULL)
4493  return 0;
4494 
4495  SCLogDebug("using tenant-id %u for packet on device %s", ld->tenant_id, ld->dev);
4496  return ld->tenant_id;
4497 }
4498 
4499 static int DetectEngineTenantRegisterSelector(
4500  enum DetectEngineTenantSelectors selector, uint32_t tenant_id, uint32_t traffic_id)
4501 {
4502  DetectEngineMasterCtx *master = &g_master_de_ctx;
4503  SCMutexLock(&master->lock);
4504 
4505  if (!(master->tenant_selector == TENANT_SELECTOR_UNKNOWN || master->tenant_selector == selector)) {
4506  SCLogInfo("conflicting selector already set");
4507  SCMutexUnlock(&master->lock);
4508  return -1;
4509  }
4510 
4512  while (m) {
4513  if (m->traffic_id == traffic_id) {
4514  SCLogInfo("traffic id already registered");
4515  SCMutexUnlock(&master->lock);
4516  return -1;
4517  }
4518  m = m->next;
4519  }
4520 
4521  DetectEngineTenantMapping *map = SCCalloc(1, sizeof(*map));
4522  if (map == NULL) {
4523  SCLogInfo("memory fail");
4524  SCMutexUnlock(&master->lock);
4525  return -1;
4526  }
4527  map->traffic_id = traffic_id;
4528  map->tenant_id = tenant_id;
4529 
4530  map->next = master->tenant_mapping_list;
4531  master->tenant_mapping_list = map;
4532 
4533  master->tenant_selector = selector;
4534 
4535  SCLogDebug("tenant handler %u %u %u registered", selector, tenant_id, traffic_id);
4536  SCMutexUnlock(&master->lock);
4537  return 0;
4538 }
4539 
4540 static int DetectEngineTenantUnregisterSelector(
4541  enum DetectEngineTenantSelectors selector, uint32_t tenant_id, uint32_t traffic_id)
4542 {
4543  DetectEngineMasterCtx *master = &g_master_de_ctx;
4544  SCMutexLock(&master->lock);
4545 
4546  if (master->tenant_mapping_list == NULL) {
4547  SCMutexUnlock(&master->lock);
4548  return -1;
4549  }
4550 
4551  DetectEngineTenantMapping *prev = NULL;
4553  while (map) {
4554  if (map->traffic_id == traffic_id &&
4555  map->tenant_id == tenant_id)
4556  {
4557  if (prev != NULL)
4558  prev->next = map->next;
4559  else
4560  master->tenant_mapping_list = map->next;
4561 
4562  map->next = NULL;
4563  SCFree(map);
4564  SCLogInfo("tenant handler %u %u %u unregistered", selector, tenant_id, traffic_id);
4565  SCMutexUnlock(&master->lock);
4566  return 0;
4567  }
4568  prev = map;
4569  map = map->next;
4570  }
4571 
4572  SCMutexUnlock(&master->lock);
4573  return -1;
4574 }
4575 
4576 int DetectEngineTenantRegisterLivedev(uint32_t tenant_id, int device_id)
4577 {
4578  return DetectEngineTenantRegisterSelector(
4579  TENANT_SELECTOR_LIVEDEV, tenant_id, (uint32_t)device_id);
4580 }
4581 
4582 int DetectEngineTenantRegisterVlanId(uint32_t tenant_id, uint16_t vlan_id)
4583 {
4584  return DetectEngineTenantRegisterSelector(TENANT_SELECTOR_VLAN, tenant_id, (uint32_t)vlan_id);
4585 }
4586 
4587 int DetectEngineTenantUnregisterVlanId(uint32_t tenant_id, uint16_t vlan_id)
4588 {
4589  return DetectEngineTenantUnregisterSelector(TENANT_SELECTOR_VLAN, tenant_id, (uint32_t)vlan_id);
4590 }
4591 
4592 int DetectEngineTenantRegisterPcapFile(uint32_t tenant_id)
4593 {
4594  SCLogInfo("registering %u %d 0", TENANT_SELECTOR_DIRECT, tenant_id);
4595  return DetectEngineTenantRegisterSelector(TENANT_SELECTOR_DIRECT, tenant_id, 0);
4596 }
4597 
4599 {
4600  SCLogInfo("unregistering %u %d 0", TENANT_SELECTOR_DIRECT, tenant_id);
4601  return DetectEngineTenantUnregisterSelector(TENANT_SELECTOR_DIRECT, tenant_id, 0);
4602 }
4603 
4604 static uint32_t DetectEngineTenantGetIdFromPcap(const void *ctx, const Packet *p)
4605 {
4606  return p->pcap_v.tenant_id;
4607 }
4608 
4610 {
4611  DetectEngineMasterCtx *master = &g_master_de_ctx;
4612  SCMutexLock(&master->lock);
4613 
4614  if (master->list == NULL) {
4615  SCMutexUnlock(&master->lock);
4616  return NULL;
4617  }
4618 
4619  DetectEngineCtx *de_ctx = master->list;
4620  while (de_ctx) {
4622  de_ctx->tenant_id == tenant_id)
4623  {
4624  de_ctx->ref_cnt++;
4625  break;
4626  }
4627 
4628  de_ctx = de_ctx->next;
4629  }
4630 
4631  SCMutexUnlock(&master->lock);
4632  return de_ctx;
4633 }
4634 
4636 {
4637  DEBUG_VALIDATE_BUG_ON((*de_ctx)->ref_cnt == 0);
4638  (*de_ctx)->ref_cnt--;
4639  *de_ctx = NULL;
4640 }
4641 
4642 static int DetectEngineAddToList(DetectEngineCtx *instance)
4643 {
4644  DetectEngineMasterCtx *master = &g_master_de_ctx;
4645 
4646  if (instance == NULL)
4647  return -1;
4648 
4649  if (master->list == NULL) {
4650  master->list = instance;
4651  } else {
4652  instance->next = master->list;
4653  master->list = instance;
4654  }
4655 
4656  return 0;
4657 }
4658 
4660 {
4661  int r;
4662 
4663  if (de_ctx == NULL)
4664  return -1;
4665 
4666  SCLogDebug("adding de_ctx %p to master", de_ctx);
4667 
4668  DetectEngineMasterCtx *master = &g_master_de_ctx;
4669  SCMutexLock(&master->lock);
4670  r = DetectEngineAddToList(de_ctx);
4671  SCMutexUnlock(&master->lock);
4672  return r;
4673 }
4674 
4675 static int DetectEngineMoveToFreeListNoLock(DetectEngineMasterCtx *master, DetectEngineCtx *de_ctx)
4676 {
4677  DetectEngineCtx *instance = master->list;
4678  if (instance == NULL) {
4679  return -1;
4680  }
4681 
4682  /* remove from active list */
4683  if (instance == de_ctx) {
4684  master->list = instance->next;
4685  } else {
4686  DetectEngineCtx *prev = instance;
4687  instance = instance->next; /* already checked first element */
4688 
4689  while (instance) {
4690  DetectEngineCtx *next = instance->next;
4691 
4692  if (instance == de_ctx) {
4693  prev->next = instance->next;
4694  break;
4695  }
4696 
4697  prev = instance;
4698  instance = next;
4699  }
4700  if (instance == NULL) {
4701  return -1;
4702  }
4703  }
4704 
4705  /* instance is now detached from list */
4706  instance->next = NULL;
4707 
4708  /* add to free list */
4709  if (master->free_list == NULL) {
4710  master->free_list = instance;
4711  } else {
4712  instance->next = master->free_list;
4713  master->free_list = instance;
4714  }
4715  SCLogDebug("detect engine %p moved to free list (%u refs)", de_ctx, de_ctx->ref_cnt);
4716  return 0;
4717 }
4718 
4720 {
4721  int ret = 0;
4722  DetectEngineMasterCtx *master = &g_master_de_ctx;
4723  SCMutexLock(&master->lock);
4724  ret = DetectEngineMoveToFreeListNoLock(master, de_ctx);
4725  SCMutexUnlock(&master->lock);
4726  return ret;
4727 }
4728 
4730 {
4731  DetectEngineMasterCtx *master = &g_master_de_ctx;
4732  SCMutexLock(&master->lock);
4733 
4734  DetectEngineCtx *prev = NULL;
4735  DetectEngineCtx *instance = master->free_list;
4736  while (instance) {
4737  DetectEngineCtx *next = instance->next;
4738 
4739  SCLogDebug("detect engine %p has %u ref(s)", instance, instance->ref_cnt);
4740 
4741  if (instance->ref_cnt == 0) {
4742  if (prev == NULL) {
4743  master->free_list = next;
4744  } else {
4745  prev->next = next;
4746  }
4747 
4748  SCLogDebug("freeing detect engine %p", instance);
4749  DetectEngineCtxFree(instance);
4750  instance = NULL;
4751  }
4752 
4753  prev = instance;
4754  instance = next;
4755  }
4756  SCMutexUnlock(&master->lock);
4757 }
4758 
4760 {
4761  DetectEngineMasterCtx *master = &g_master_de_ctx;
4762  SCMutexLock(&master->lock);
4763 
4764  DetectEngineCtx *instance = master->list;
4765  while (instance) {
4766  DetectEngineCtx *next = instance->next;
4767  DEBUG_VALIDATE_BUG_ON(instance->ref_cnt);
4768  SCLogDebug("detect engine %p has %u ref(s)", instance, instance->ref_cnt);
4769  instance->ref_cnt = 0;
4770  DetectEngineMoveToFreeListNoLock(master, instance);
4771  instance = next;
4772  }
4773  SCMutexUnlock(&master->lock);
4775 }
4776 
4777 static int reloads = 0;
4778 
4779 /** \brief Reload the detection engine
4780  *
4781  * \param filename YAML file to load for the detect config
4782  *
4783  * \retval -1 error
4784  * \retval 0 ok
4785  */
4787 {
4788  DetectEngineCtx *new_de_ctx = NULL;
4789  DetectEngineCtx *old_de_ctx = NULL;
4790 
4791  char prefix[128];
4792  memset(prefix, 0, sizeof(prefix));
4793 
4794  SCLogNotice("rule reload starting");
4795 
4796  if (suri->conf_filename != NULL) {
4797  snprintf(prefix, sizeof(prefix), "detect-engine-reloads.%d", reloads++);
4798  SCLogConfig("Reloading %s", suri->conf_filename);
4799  if (SCConfYamlLoadFileWithPrefix(suri->conf_filename, prefix) != 0) {
4800  SCLogError("failed to load yaml %s", suri->conf_filename);
4801  return -1;
4802  }
4803 
4804  SCConfNode *node = SCConfGetNode(prefix);
4805  if (node == NULL) {
4806  SCLogError("failed to properly setup yaml %s", suri->conf_filename);
4807  return -1;
4808  }
4809 
4810  if (suri->additional_configs) {
4811  for (int i = 0; suri->additional_configs[i] != NULL; i++) {
4812  SCLogConfig("Reloading %s", suri->additional_configs[i]);
4814  }
4815  }
4816 
4817 #if 0
4818  SCConfDump();
4819 #endif
4820  }
4821 
4822  /* get a reference to the current de_ctx */
4823  old_de_ctx = DetectEngineGetCurrent();
4824  if (old_de_ctx == NULL)
4825  return -1;
4826  SCLogDebug("get ref to old_de_ctx %p", old_de_ctx);
4827  DatasetReload();
4828 
4829  /* only reload a regular 'normal' and 'delayed detect stub' detect engines */
4830  if (!(old_de_ctx->type == DETECT_ENGINE_TYPE_NORMAL ||
4831  old_de_ctx->type == DETECT_ENGINE_TYPE_DD_STUB))
4832  {
4833  DetectEngineDeReference(&old_de_ctx);
4834  SCLogNotice("rule reload complete");
4835  return -1;
4836  }
4837 
4838  /* get new detection engine */
4839  new_de_ctx = DetectEngineCtxInitWithPrefix(prefix, old_de_ctx->tenant_id);
4840  if (new_de_ctx == NULL) {
4841  SCLogError("initializing detection engine "
4842  "context failed.");
4843  DetectEngineDeReference(&old_de_ctx);
4844  return -1;
4845  }
4846  if (SigLoadSignatures(new_de_ctx,
4847  suri->sig_file, suri->sig_file_exclusive) != 0) {
4848  DetectEngineCtxFree(new_de_ctx);
4849  DetectEngineDeReference(&old_de_ctx);
4850  return -1;
4851  }
4852  SCLogDebug("set up new_de_ctx %p", new_de_ctx);
4853 
4854  /* Copy over callbacks. */
4855  new_de_ctx->RateFilterCallback = old_de_ctx->RateFilterCallback;
4856  new_de_ctx->rate_filter_callback_arg = old_de_ctx->rate_filter_callback_arg;
4857 
4858  /* add to master */
4859  DetectEngineAddToMaster(new_de_ctx);
4860 
4861  /* move to old free list */
4862  DetectEngineMoveToFreeList(old_de_ctx);
4863  DetectEngineDeReference(&old_de_ctx);
4864 
4865  SCLogDebug("going to reload the threads to use new_de_ctx %p", new_de_ctx);
4866 
4867  DetectEngineMasterCtx *master = &g_master_de_ctx;
4868  SCMutexLock(&master->lock);
4869  /* update the threads */
4870  DetectEngineReloadThreads(new_de_ctx);
4871  SCMutexUnlock(&master->lock);
4872 
4873  SCLogDebug("threads now run new_de_ctx %p", new_de_ctx);
4874 
4875  /* walk free list, freeing the old_de_ctx */
4877 
4879 
4881 
4882  SCLogDebug("old_de_ctx should have been freed");
4883 
4884  SCLogNotice("rule reload complete");
4885 
4886 #ifdef HAVE_MALLOC_TRIM
4887  /* The reload process potentially frees up large amounts of memory.
4888  * Encourage the memory management system to reclaim as much as it
4889  * can.
4890  */
4891  malloc_trim(0);
4892 #endif
4893 
4894  return 0;
4895 }
4896 
4897 static uint32_t TenantIdHash(HashTable *h, void *data, uint16_t data_len)
4898 {
4899  DetectEngineThreadCtx *det_ctx = (DetectEngineThreadCtx *)data;
4900  return det_ctx->tenant_id % h->array_size;
4901 }
4902 
4903 static char TenantIdCompare(void *d1, uint16_t d1_len, void *d2, uint16_t d2_len)
4904 {
4907  return (det1->tenant_id == det2->tenant_id);
4908 }
4909 
4910 static void TenantIdFree(void *d)
4911 {
4912  DetectEngineThreadCtxFree(d);
4913 }
4914 
4916 {
4917  DetectEngineMasterCtx *master = &g_master_de_ctx;
4918  SCMutexLock(&master->lock);
4919 
4920  if (master->tenant_selector == TENANT_SELECTOR_UNKNOWN) {
4921  SCLogInfo("error, no tenant selector");
4922  SCMutexUnlock(&master->lock);
4923  return -1;
4924  }
4925 
4926  DetectEngineCtx *stub_de_ctx = NULL;
4927  DetectEngineCtx *list = master->list;
4928  for ( ; list != NULL; list = list->next) {
4929  SCLogDebug("list %p tenant %u", list, list->tenant_id);
4930 
4931  if (list->type == DETECT_ENGINE_TYPE_NORMAL ||
4932  list->type == DETECT_ENGINE_TYPE_MT_STUB ||
4934  {
4935  stub_de_ctx = list;
4936  break;
4937  }
4938  }
4939  if (stub_de_ctx == NULL) {
4940  stub_de_ctx = DetectEngineCtxInitStubForMT();
4941  if (stub_de_ctx == NULL) {
4942  SCMutexUnlock(&master->lock);
4943  return -1;
4944  }
4945 
4946  if (master->list == NULL) {
4947  master->list = stub_de_ctx;
4948  } else {
4949  stub_de_ctx->next = master->list;
4950  master->list = stub_de_ctx;
4951  }
4952  }
4953 
4954  /* update the threads */
4955  SCLogDebug("MT reload starting");
4956  DetectEngineReloadThreads(stub_de_ctx);
4957  SCLogDebug("MT reload done");
4958 
4959  SCMutexUnlock(&master->lock);
4960 
4961  /* walk free list, freeing the old_de_ctx */
4963  // needed for VarNameStoreFree
4965 
4966  SCLogDebug("old_de_ctx should have been freed");
4967  return 0;
4968 }
4969 
4970 static int g_parse_metadata = 0;
4971 
4973 {
4974  g_parse_metadata = 1;
4975 }
4976 
4978 {
4979  g_parse_metadata = 0;
4980 }
4981 
4983 {
4984  return g_parse_metadata;
4985 }
4986 
4988 {
4989  switch (type) {
4990  case DETECT_SM_LIST_MATCH:
4991  return "packet";
4992  case DETECT_SM_LIST_PMATCH:
4993  return "packet/stream payload";
4994 
4995  case DETECT_SM_LIST_TMATCH:
4996  return "tag";
4997 
4999  return "base64_data";
5000 
5002  return "post-match";
5003 
5005  return "suppress";
5007  return "threshold";
5008 
5009  case DETECT_SM_LIST_MAX:
5010  return "max (internal)";
5011  }
5012  return "error";
5013 }
5014 
5015 /* events api */
5017 {
5019  det_ctx->events++;
5020 }
5021 
5023  const Signature *s, const char **sigerror, const DetectBufferType *map)
5024 {
5025  for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
5026  if (s->init_data->buffers[x].id != (uint32_t)map->id)
5027  continue;
5028  const SigMatch *sm = s->init_data->buffers[x].head;
5029  for (; sm != NULL; sm = sm->next) {
5030  if (sm->type != DETECT_CONTENT)
5031  continue;
5032 
5033  const DetectContentData *cd = (DetectContentData *)sm->ctx;
5034  if (cd->flags & DETECT_CONTENT_NOCASE) {
5035  *sigerror = "md5-like keyword should not be used together with "
5036  "nocase, since the rule is automatically "
5037  "lowercased anyway which makes nocase redundant.";
5038  SCLogWarning("rule %u: buffer %s: %s", s->id, map->name, *sigerror);
5039  }
5040 
5041  if (cd->content_len != SC_MD5_HEX_LEN) {
5042  *sigerror = "Invalid length for md5-like keyword (should "
5043  "be 32 characters long). This rule will therefore "
5044  "never match.";
5045  SCLogError("rule %u: buffer %s: %s", s->id, map->name, *sigerror);
5046  return false;
5047  }
5048 
5049  for (size_t i = 0; i < cd->content_len; ++i) {
5050  if (!isxdigit(cd->content[i])) {
5051  *sigerror =
5052  "Invalid md5-like string (should be string of hexadecimal characters)."
5053  "This rule will therefore never match.";
5054  SCLogWarning("rule %u: buffer %s: %s", s->id, map->name, *sigerror);
5055  return false;
5056  }
5057  }
5058  }
5059  }
5060  return true;
5061 }
5062 
5064 {
5066  de_ctx->RateFilterCallback = fn;
5069 }
5070 
5072 {
5073  if (det_ctx->json_content_len > SIG_JSON_CONTENT_ARRAY_LEN - 1) {
5074  SCLogDebug("json content length %u exceeds maximum %u", det_ctx->json_content_len,
5076  return -1;
5077  }
5078  if (det_ctx->json_content_len >= det_ctx->json_content_capacity) {
5079  if (det_ctx->json_content_capacity == 0) {
5080  det_ctx->json_content_capacity = 1;
5081  } else {
5082  det_ctx->json_content_capacity *= 2;
5083  }
5084  void *tmp = SCRealloc(
5085  det_ctx->json_content, det_ctx->json_content_capacity * sizeof(SigJsonContent));
5086  if (unlikely(tmp == NULL)) {
5087  return -1;
5088  }
5089  SCLogDebug("reallocated json content array to %u items", det_ctx->json_content_capacity);
5090  det_ctx->json_content = tmp;
5091  }
5092  return 0;
5093 }
5094 
5095 /*************************************Unittest*********************************/
5096 
5097 #ifdef UNITTESTS
5098 
5099 static int DetectEngineInitYamlConf(const char *conf)
5100 {
5102  SCConfInit();
5103  return SCConfYamlLoadString(conf, strlen(conf));
5104 }
5105 
5106 static void DetectEngineDeInitYamlConf(void)
5107 {
5108  SCConfDeInit();
5110 }
5111 
5112 static int DetectEngineTest01(void)
5113 {
5114  const char *conf =
5115  "%YAML 1.1\n"
5116  "---\n"
5117  "detect-engine:\n"
5118  " - profile: medium\n"
5119  " - custom-values:\n"
5120  " toclient_src_groups: 2\n"
5121  " toclient_dst_groups: 2\n"
5122  " toclient_sp_groups: 2\n"
5123  " toclient_dp_groups: 3\n"
5124  " toserver_src_groups: 2\n"
5125  " toserver_dst_groups: 4\n"
5126  " toserver_sp_groups: 2\n"
5127  " toserver_dp_groups: 25\n"
5128  " - inspection-recursion-limit: 0\n";
5129 
5130  FAIL_IF(DetectEngineInitYamlConf(conf) == -1);
5131 
5134 
5136 
5138 
5139  DetectEngineDeInitYamlConf();
5140 
5141  PASS;
5142 }
5143 
5144 static int DetectEngineTest02(void)
5145 {
5146  const char *conf =
5147  "%YAML 1.1\n"
5148  "---\n"
5149  "detect-engine:\n"
5150  " - profile: medium\n"
5151  " - custom-values:\n"
5152  " toclient_src_groups: 2\n"
5153  " toclient_dst_groups: 2\n"
5154  " toclient_sp_groups: 2\n"
5155  " toclient_dp_groups: 3\n"
5156  " toserver_src_groups: 2\n"
5157  " toserver_dst_groups: 4\n"
5158  " toserver_sp_groups: 2\n"
5159  " toserver_dp_groups: 25\n"
5160  " - inspection-recursion-limit:\n";
5161 
5162  FAIL_IF(DetectEngineInitYamlConf(conf) == -1);
5163 
5166 
5167  FAIL_IF_NOT(
5169 
5171 
5172  DetectEngineDeInitYamlConf();
5173 
5174  PASS;
5175 }
5176 
5177 static int DetectEngineTest03(void)
5178 {
5179  const char *conf =
5180  "%YAML 1.1\n"
5181  "---\n"
5182  "detect-engine:\n"
5183  " - profile: medium\n"
5184  " - custom-values:\n"
5185  " toclient_src_groups: 2\n"
5186  " toclient_dst_groups: 2\n"
5187  " toclient_sp_groups: 2\n"
5188  " toclient_dp_groups: 3\n"
5189  " toserver_src_groups: 2\n"
5190  " toserver_dst_groups: 4\n"
5191  " toserver_sp_groups: 2\n"
5192  " toserver_dp_groups: 25\n";
5193 
5194  FAIL_IF(DetectEngineInitYamlConf(conf) == -1);
5195 
5198 
5199  FAIL_IF_NOT(
5201 
5203 
5204  DetectEngineDeInitYamlConf();
5205 
5206  PASS;
5207 }
5208 
5209 static int DetectEngineTest04(void)
5210 {
5211  const char *conf =
5212  "%YAML 1.1\n"
5213  "---\n"
5214  "detect-engine:\n"
5215  " - profile: medium\n"
5216  " - custom-values:\n"
5217  " toclient_src_groups: 2\n"
5218  " toclient_dst_groups: 2\n"
5219  " toclient_sp_groups: 2\n"
5220  " toclient_dp_groups: 3\n"
5221  " toserver_src_groups: 2\n"
5222  " toserver_dst_groups: 4\n"
5223  " toserver_sp_groups: 2\n"
5224  " toserver_dp_groups: 25\n"
5225  " - inspection-recursion-limit: 10\n";
5226 
5227  FAIL_IF(DetectEngineInitYamlConf(conf) == -1);
5228 
5231 
5233 
5235 
5236  DetectEngineDeInitYamlConf();
5237 
5238  PASS;
5239 }
5240 
5241 static int DetectEngineTest08(void)
5242 {
5243  const char *conf =
5244  "%YAML 1.1\n"
5245  "---\n"
5246  "detect-engine:\n"
5247  " - profile: custom\n"
5248  " - custom-values:\n"
5249  " toclient-groups: 23\n"
5250  " toserver-groups: 27\n";
5251 
5252  FAIL_IF(DetectEngineInitYamlConf(conf) == -1);
5253 
5256 
5259 
5261 
5262  DetectEngineDeInitYamlConf();
5263 
5264  PASS;
5265 }
5266 
5267 /** \test bug 892 bad values */
5268 static int DetectEngineTest09(void)
5269 {
5270  const char *conf =
5271  "%YAML 1.1\n"
5272  "---\n"
5273  "detect-engine:\n"
5274  " - profile: custom\n"
5275  " - custom-values:\n"
5276  " toclient-groups: BA\n"
5277  " toserver-groups: BA\n"
5278  " - inspection-recursion-limit: 10\n";
5279 
5280  FAIL_IF(DetectEngineInitYamlConf(conf) == -1);
5281 
5284 
5287 
5289 
5290  DetectEngineDeInitYamlConf();
5291 
5292  PASS;
5293 }
5294 
5295 #endif
5296 
5298 {
5299 #ifdef UNITTESTS
5300  UtRegisterTest("DetectEngineTest01", DetectEngineTest01);
5301  UtRegisterTest("DetectEngineTest02", DetectEngineTest02);
5302  UtRegisterTest("DetectEngineTest03", DetectEngineTest03);
5303  UtRegisterTest("DetectEngineTest04", DetectEngineTest04);
5304  UtRegisterTest("DetectEngineTest08", DetectEngineTest08);
5305  UtRegisterTest("DetectEngineTest09", DetectEngineTest09);
5306 #endif
5307 }
DetectEngineThreadCtx_::byte_values
uint64_t * byte_values
Definition: detect.h:1279
DETECT_CONTENT_NOCASE
#define DETECT_CONTENT_NOCASE
Definition: detect-content.h:29
DETECT_TABLE_APP_TD
@ DETECT_TABLE_APP_TD
Definition: detect.h:559
DetectEngineAppInspectionEngine_::stream
bool stream
Definition: detect.h:421
HashListTableGetListData
#define HashListTableGetListData(hb)
Definition: util-hashlist.h:56
DE_STATE_ID_FILE_INSPECT
#define DE_STATE_ID_FILE_INSPECT
Definition: detect-engine-state.h:62
SCProfilingSghThreadCleanup
void SCProfilingSghThreadCleanup(DetectEngineThreadCtx *det_ctx)
Definition: util-profiling-rulegroups.c:329
DetectEngineCtxInitWithPrefix
DetectEngineCtx * DetectEngineCtxInitWithPrefix(const char *prefix, uint32_t tenant_id)
Definition: detect-engine.c:2600
DetectEngineTenantMapping_
Definition: detect.h:1708
util-device-private.h
util-byte.h
DetectAppLayerMpmMultiRegister
void DetectAppLayerMpmMultiRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionMultiBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
Definition: detect-engine-mpm.c:168
SCConfYamlLoadString
int SCConfYamlLoadString(const char *string, size_t len)
Load configuration from a YAML string.
Definition: conf-yaml-loader.c:523
tm-threads.h
DetectEngineAppInspectionEngine_
Definition: detect.h:416
DetectGetMultiData
InspectionBuffer * DetectGetMultiData(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id, uint32_t index, InspectionMultiBufferGetDataPtr GetBuf)
Definition: detect-engine.c:2125
util-hash-string.h
DetectBufferType_::supports_transforms
bool supports_transforms
Definition: detect.h:457
SignatureInitDataBuffer_::head
SigMatch * head
Definition: detect.h:534
DetectEngineSyncer_::m
SCMutex m
Definition: detect-engine.c:1881
DetectEngineAppInspectionEngine_::mpm
bool mpm
Definition: detect.h:420
DetectBufferType_::mpm
bool mpm
Definition: detect.h:454
detect-content.h
detect-engine.h
DetectEngineResetMaxSigId
void DetectEngineResetMaxSigId(DetectEngineCtx *de_ctx)
Definition: detect-engine.c:3046
DetectEngineMTApply
int DetectEngineMTApply(void)
Definition: detect-engine.c:4915
SCProfilingKeywordDestroyCtx
void SCProfilingKeywordDestroyCtx(DetectEngineCtx *de_ctx)
Definition: util-profiling-keywords.c:268
DetectEngineBufferTypeSupportsPacketGetById
bool DetectEngineBufferTypeSupportsPacketGetById(const DetectEngineCtx *de_ctx, const int id)
Definition: detect-engine.c:1436
DETECT_SM_LIST_PMATCH
@ DETECT_SM_LIST_PMATCH
Definition: detect.h:119
DetectEngineThreadCtxInitForReload
DetectEngineThreadCtx * DetectEngineThreadCtxInitForReload(ThreadVars *tv, DetectEngineCtx *new_de_ctx, int mt)
Definition: detect-engine.c:3449
DetectEngineThreadCtx_::to_clear_idx
uint32_t to_clear_idx
Definition: detect.h:1302
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
SCConfNodeRemove
void SCConfNodeRemove(SCConfNode *node)
Remove (and SCFree) the provided configuration node.
Definition: conf.c:653
SignatureInitData_::smlists
struct SigMatch_ * smlists[DETECT_SM_LIST_MAX]
Definition: detect.h:642
SCProfilingKeywordThreadCleanup
void SCProfilingKeywordThreadCleanup(DetectEngineThreadCtx *det_ctx)
Definition: util-profiling-keywords.c:338
THashDataGetResult::data
THashData * data
Definition: util-thash.h:192
AlertQueueFree
void AlertQueueFree(DetectEngineThreadCtx *det_ctx)
Definition: detect-engine-alert.c:258
SCProfilingSghThreadSetup
void SCProfilingSghThreadSetup(SCProfileSghDetectCtx *ctx, DetectEngineThreadCtx *det_ctx)
Definition: util-profiling-rulegroups.c:294
MPM_AC
@ MPM_AC
Definition: util-mpm.h:38
DetectParseDupSigHashInit
int DetectParseDupSigHashInit(DetectEngineCtx *de_ctx)
Initializes the hash table that is used to cull duplicate sigs.
Definition: detect-parse.c:3172
RELOAD
@ RELOAD
Definition: detect-engine.c:1876
DetectGetSingleData
InspectionBuffer * DetectGetSingleData(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id, InspectionSingleBufferGetDataPtr GetBuf)
Definition: detect-engine.c:2108
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:79
SIG_JSON_CONTENT_ARRAY_LEN
#define SIG_JSON_CONTENT_ARRAY_LEN
Definition: detect.h:1231
DetectLoaderThreadSpawn
void DetectLoaderThreadSpawn(void)
spawn the detect loader manager thread
Definition: detect-engine-loader.c:749
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
SinglePatternMatchDefaultMatcher
uint8_t SinglePatternMatchDefaultMatcher(void)
Returns the single pattern matcher algorithm to be used, based on the spm-algo setting in yaml.
Definition: util-spm.c:68
DetectEngineDeReference
void DetectEngineDeReference(DetectEngineCtx **de_ctx)
Definition: detect-engine.c:4635
DETECT_CI_FLAGS_START
#define DETECT_CI_FLAGS_START
Definition: detect-engine-content-inspection.h:40
DetectEngineInspectBufferGeneric
uint8_t DetectEngineInspectBufferGeneric(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const DetectEngineAppInspectionEngine *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
Do the content inspection & validation for a signature.
Definition: detect-engine.c:2049
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1444
DetectEngineMustParseMetadata
int DetectEngineMustParseMetadata(void)
Definition: detect-engine.c:4982
PKT_PSEUDO_LOG_FLUSH
#define PKT_PSEUDO_LOG_FLUSH
Definition: decode.h:1320
TAILQ_INIT
#define TAILQ_INIT(head)
Definition: queue.h:262
SignatureHook_::sm_list
int sm_list
Definition: detect.h:573
MpmFactoryDeRegisterAllMpmCtxProfiles
void MpmFactoryDeRegisterAllMpmCtxProfiles(DetectEngineCtx *de_ctx)
Definition: util-mpm.c:168
DETECT_TABLE_APP_FILTER
@ DETECT_TABLE_APP_FILTER
Definition: detect.h:558
DetectEngineThreadCtx_::counter_match_list
uint16_t counter_match_list
Definition: detect.h:1296
flow-util.h
DetectEnginePktInspectionEngine
Definition: detect.h:483
DetectEngineMasterCtx_::tenant_mapping_list
DetectEngineTenantMapping * tenant_mapping_list
Definition: detect.h:1739
SC_ATOMIC_INIT
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
Definition: util-atomic.h:314
ALPROTO_DNS
@ ALPROTO_DNS
Definition: app-layer-protos.h:47
DetectEngineAppInspectionEngine_::next
struct DetectEngineAppInspectionEngine_ * next
Definition: detect.h:441
DetectEngineInspectMultiBufferGeneric
uint8_t DetectEngineInspectMultiBufferGeneric(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const DetectEngineAppInspectionEngine *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
Definition: detect-engine.c:2149
detect-engine-siggroup.h
SigTableElmt_::name
const char * name
Definition: detect.h:1457
DetectEngineMasterCtx_::list
DetectEngineCtx * list
Definition: detect.h:1728
InspectionBuffer::initialized
bool initialized
Definition: detect-engine-inspect-buffer.h:38
MpmStoreFree
void MpmStoreFree(DetectEngineCtx *de_ctx)
Frees the hash table - DetectEngineCtx->mpm_hash_table, allocated by MpmStoreInit() function.
Definition: detect-engine-mpm.c:1619
DetectFrameMpmRegisterByParentId
void DetectFrameMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Definition: detect-engine-mpm.c:414
DetectEngineBufferTypeSupportsPacket
void DetectEngineBufferTypeSupportsPacket(DetectEngineCtx *de_ctx, const char *name)
Definition: detect-engine.c:1403
DetectEngineBufferRunSetupCallback
void DetectEngineBufferRunSetupCallback(const DetectEngineCtx *de_ctx, const int id, Signature *s)
Definition: detect-engine.c:1473
ENGINE_PROFILE_LOW
@ ENGINE_PROFILE_LOW
Definition: detect.h:1175
DetectEngineCtx_::type
enum DetectEngineType type
Definition: detect.h:1053
DetectEnginePruneFreeList
void DetectEnginePruneFreeList(void)
Definition: detect-engine.c:4729
SigLoadSignatures
int SigLoadSignatures(DetectEngineCtx *de_ctx, char *sig_file, bool sig_file_exclusive)
Load signatures.
Definition: detect-engine-loader.c:372
DetectEngineInspectBufferSingle
uint8_t DetectEngineInspectBufferSingle(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const DetectEngineAppInspectionEngine *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
Do the content inspection & validation for a signature.
Definition: detect-engine.c:1988
DetectThreadCtxGetKeywordThreadCtx
void * DetectThreadCtxGetKeywordThreadCtx(DetectEngineThreadCtx *det_ctx, int id)
Retrieve thread local keyword ctx by id.
Definition: detect-engine.c:3724
DetectEngineCtx_::guess_applayer
bool guess_applayer
Definition: detect.h:979
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
DetectAppLayerInspectEngineRegisterSingle
void DetectAppLayerInspectEngineRegisterSingle(const char *name, AppProto alproto, uint32_t dir, int progress, InspectEngineFuncPtr Callback, InspectionSingleBufferGetDataPtr GetData)
Definition: detect-engine.c:295
DetectEngineTransforms
Definition: detect.h:391
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
SIG_FLAG_INIT_NEED_FLUSH
#define SIG_FLAG_INIT_NEED_FLUSH
Definition: detect.h:297
MpmTableElmt_::name
const char * name
Definition: util-mpm.h:153
SCClassSCConfInit
void SCClassSCConfInit(DetectEngineCtx *de_ctx)
Definition: util-classification-config.c:61
DetectEngineCtxInitStubForDD
DetectEngineCtx * DetectEngineCtxInitStubForDD(void)
Definition: detect-engine.c:2590
KEYWORD_PROFILING_SET_LIST
#define KEYWORD_PROFILING_SET_LIST(ctx, list)
Definition: util-profiling.h:46
DETECT_CONTENT
@ DETECT_CONTENT
Definition: detect-engine-register.h:69
DetectEngineCtx_::max_uniq_toclient_groups
uint16_t max_uniq_toclient_groups
Definition: detect.h:990
ActionInitConfig
int ActionInitConfig(void)
Load the action order from config. If none is provided, it will be default to ACTION_PASS,...
Definition: util-action.c:105
IDLE
@ IDLE
Definition: detect-engine.c:1875
DetectEngineCtx_::ref_cnt
uint32_t ref_cnt
Definition: detect.h:1056
DetectEngineAppInspectionEngine_::Callback
InspectEngineFuncPtr Callback
Definition: detect.h:434
PathMerge
int PathMerge(char *out_buf, size_t buf_size, const char *const dir, const char *const fname)
Definition: util-path.c:74
Signature_::alproto
AppProto alproto
Definition: detect.h:673
DETECT_TABLE_PACKET_PRE_STREAM
@ DETECT_TABLE_PACKET_PRE_STREAM
Definition: detect.h:555
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:279
SigString_
Definition: detect.h:867
PacketEnqueue
void PacketEnqueue(PacketQueue *q, Packet *p)
Definition: packet-queue.c:175
DetectEngineCtx_::filedata_config
DetectFileDataCfg * filedata_config
Definition: detect.h:1039
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
DetectEngineFrameInspectionEngine::sm_list_base
uint16_t sm_list_base
Definition: detect.h:514
DetectPort_::port
uint16_t port
Definition: detect.h:221
SigMatchData_::is_last
bool is_last
Definition: detect.h:367
DetectBufferTypeSupportsFrames
void DetectBufferTypeSupportsFrames(const char *name)
Definition: detect-engine.c:1238
DetectMpmInitializeFrameMpms
void DetectMpmInitializeFrameMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:518
PacketQueue_
simple fifo queue for packets with mutex and cond Calling the mutex or triggering the cond is respons...
Definition: packet-queue.h:49
Flow_::proto
uint8_t proto
Definition: flow.h:370
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:86
DETECT_SM_LIST_DYNAMIC_START
@ DETECT_SM_LIST_DYNAMIC_START
Definition: detect.h:138
AppLayerParserGetStateProgress
int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t flags)
get the progress value for a tx/protocol
Definition: app-layer-parser.c:1087
DetectEngineThreadCtx_::decoder_events
AppLayerDecoderEvents * decoder_events
Definition: detect.h:1370
SigMatchData_::ctx
SigMatchCtx * ctx
Definition: detect.h:368
InspectionBuffer
Definition: detect-engine-inspect-buffer.h:34
DetectEngineThreadKeywordCtxItem_::InitFunc
void *(* InitFunc)(void *)
Definition: detect.h:886
Packet_::flags
uint32_t flags
Definition: decode.h:544
SCMutexIsLocked
#define SCMutexIsLocked(mut)
Definition: threads-debug.h:119
DetectEngineAppInspectionEngine_::GetData
InspectionBufferGetDataPtr GetData
Definition: detect.h:430
DetectEngineThreadKeywordCtxItem_
Definition: detect.h:885
DetectTable
DetectTable
Definition: detect.h:552
DetectEngineCtx_::pkt_mpms_list
DetectBufferMpmRegistry * pkt_mpms_list
Definition: detect.h:1089
ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL
@ ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL
Definition: detect.h:1183
Tmq_::pq
PacketQueue * pq
Definition: tm-queues.h:35
Packet_::vlan_idx
uint8_t vlan_idx
Definition: decode.h:529
flow-private.h
Flow_
Flow data structure.
Definition: flow.h:348
TmThreadContinueDetectLoaderThreads
void TmThreadContinueDetectLoaderThreads(void)
Unpauses all threads present in tv_root.
Definition: detect-engine-loader.c:649
DETECT_SM_LIST_THRESHOLD
@ DETECT_SM_LIST_THRESHOLD
Definition: detect.h:133
DetectBufferTypeRegisterSetupCallback
void DetectBufferTypeRegisterSetupCallback(const char *name, void(*SetupCallback)(const DetectEngineCtx *, Signature *))
Definition: detect-engine.c:1463
SCConfYamlHandleInclude
int SCConfYamlHandleInclude(SCConfNode *parent, const char *filename)
Include a file in the configuration.
Definition: conf-yaml-loader.c:115
DetectEngineThreadKeywordCtxItem_::data
void * data
Definition: detect.h:888
DetectEngineThreadCtx_::pmq
PrefilterRuleStore pmq
Definition: detect.h:1347
util-hash.h
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:40
DetectEngineReloadTenantBlocking
int DetectEngineReloadTenantBlocking(uint32_t tenant_id, const char *yaml, int reload_cnt)
Reload a tenant and wait for loading to complete.
Definition: detect-engine.c:4144
ctx
struct Thresholds ctx
LiveDevice_
Definition: util-device-private.h:32
DetectEngineCtx_::inspection_recursion_limit
int inspection_recursion_limit
Definition: detect.h:973
SpmTableElmt_::name
const char * name
Definition: util-spm.h:60
LiveDevice_::tenant_id_set
bool tenant_id_set
Definition: util-device-private.h:36
DetectAddressMapFree
void DetectAddressMapFree(DetectEngineCtx *de_ctx)
Definition: detect-engine-address.c:1338
DetectEngineFrameInspectionEngine::transforms
const DetectEngineTransforms * transforms
Definition: detect.h:518
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:932
StringParseUint16
int StringParseUint16(uint16_t *res, int base, size_t len, const char *str)
Definition: util-byte.c:343
DetectEngineReloadSetIdle
void DetectEngineReloadSetIdle(void)
Definition: detect-engine.c:1914
DetectBufferTypeRegisterValidateCallback
void DetectBufferTypeRegisterValidateCallback(const char *name, bool(*ValidateCallback)(const Signature *, const char **sigerror, const DetectBufferType *))
Definition: detect-engine.c:1481
LiveDevice_::id
uint16_t id
Definition: util-device-private.h:38
DetectEnginePktInspectionEngine::smd
SigMatchData * smd
Definition: detect.h:484
DetectMetadataHashInit
int DetectMetadataHashInit(DetectEngineCtx *de_ctx)
Definition: detect-metadata.c:69
SCConfGet
int SCConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:350
DetectEngineThreadCtx_::lua_blocked_function_errors
uint16_t lua_blocked_function_errors
Definition: detect.h:1377
DetectEngineThreadCtx_::global_keyword_ctxs_array
void ** global_keyword_ctxs_array
Definition: detect.h:1368
DetectEngineGetCurrent
DetectEngineCtx * DetectEngineGetCurrent(void)
Definition: detect-engine.c:3833
TransformData_::options
void * options
Definition: detect.h:388
DetectEngineFrameInspectionEngine::mpm
bool mpm
Definition: detect.h:512
SCDetectRateFilterFunc
uint8_t(* SCDetectRateFilterFunc)(const Packet *p, uint32_t sid, uint32_t gid, uint32_t rev, uint8_t original_action, uint8_t new_action, void *arg)
Function type for rate filter callback.
Definition: detect.h:928
TmThreadCountThreadsByTmmFlags
uint32_t TmThreadCountThreadsByTmmFlags(uint8_t flags)
returns a count of all the threads that match the flag
Definition: tm-threads.c:2092
DetectBufferTypeSupportsMultiInstance
void DetectBufferTypeSupportsMultiInstance(const char *name)
Definition: detect-engine.c:1228
HashListTableGetListHead
HashListTableBucket * HashListTableGetListHead(HashListTable *ht)
Definition: util-hashlist.c:287
TAILQ_FOREACH
#define TAILQ_FOREACH(var, head, field)
Definition: queue.h:252
DetectEngineInspectPacketPayload
uint8_t DetectEngineInspectPacketPayload(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const Signature *s, Flow *f, Packet *p)
Do the content inspection & validation for a signature.
Definition: detect-engine-payload.c:152
ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE
@ ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE
Definition: detect.h:1184
DetectEngineAddToMaster
int DetectEngineAddToMaster(DetectEngineCtx *de_ctx)
Definition: detect-engine.c:4659
DetectEngineCtx_::mpm_cfg
MpmConfig * mpm_cfg
Definition: detect.h:936
InspectionBufferGetPktDataPtr
InspectionBuffer *(* InspectionBufferGetPktDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Packet *p, const int list_id)
Definition: detect.h:478
SCSigSignatureOrderingModuleCleanup
void SCSigSignatureOrderingModuleCleanup(DetectEngineCtx *de_ctx)
De-registers all the signature ordering functions registered.
Definition: detect-engine-sigorder.c:939
DetectEngineBufferTypeGetNameById
const char * DetectEngineBufferTypeGetNameById(const DetectEngineCtx *de_ctx, const int id)
Definition: detect-engine.c:1308
DetectEngineCtx_::keyword_id
int keyword_id
Definition: detect.h:1035
DetectEngineMultiTenantSetup
int DetectEngineMultiTenantSetup(const bool unix_socket)
setup multi-detect / multi-tenancy
Definition: detect-engine.c:4293
PrefilterDeinit
void PrefilterDeinit(DetectEngineCtx *de_ctx)
Definition: detect-engine-prefilter.c:1420
SignatureProperties
Definition: detect.h:89
SCMutexLock
#define SCMutexLock(mut)
Definition: threads-debug.h:117
DetectBufferMpmRegistry_::next
struct DetectBufferMpmRegistry_ * next
Definition: detect.h:804
util-var-name.h
SIG_FLAG_REQUIRE_STREAM
#define SIG_FLAG_REQUIRE_STREAM
Definition: detect.h:255
ENGINE_PROFILE_MEDIUM
@ ENGINE_PROFILE_MEDIUM
Definition: detect.h:1176
HashTable_
Definition: util-hash.h:35
DetectEngineTenantMapping_::next
struct DetectEngineTenantMapping_ * next
Definition: detect.h:1714
DetectEngineSetEvent
void DetectEngineSetEvent(DetectEngineThreadCtx *det_ctx, uint8_t e)
Definition: detect-engine.c:5016
SIG_FLAG_TXBOTHDIR
#define SIG_FLAG_TXBOTHDIR
Definition: detect.h:250
DetectEngineThreadCtx_::buffers_size
uint32_t buffers_size
Definition: detect.h:1301
DetectContentInspectionMatchOnAbsentBuffer
bool DetectContentInspectionMatchOnAbsentBuffer(const SigMatchData *smd)
tells if we should match on absent buffer, because there is an absent keyword being used
Definition: detect-engine-content-inspection.c:793
SCConfGetBool
int SCConfGetBool(const char *name, int *val)
Retrieve a configuration value as a boolean.
Definition: conf.c:497
DetectEngineCtx_::profile_sgh_ctx
struct SCProfileSghDetectCtx_ * profile_sgh_ctx
Definition: detect.h:1048
tv_root
ThreadVars * tv_root[TVT_MAX]
Definition: tm-threads.c:82
DetectBufferMpmRegistry_
one time registration of keywords at start up
Definition: detect.h:762
SCReferenceConfDeinit
void SCReferenceConfDeinit(DetectEngineCtx *de_ctx)
Definition: util-reference-config.c:72
DetectPort_::next
struct DetectPort_ * next
Definition: detect.h:234
DetectEngineCtx_::tcp_priorityports
DetectPort * tcp_priorityports
Definition: detect.h:1068
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *de_ctx)
Free a DetectEngineCtx::
Definition: detect-engine.c:2634
DetectEngineAppInspectionEngine_::sm_list_base
uint16_t sm_list_base
Definition: detect.h:425
DetectEngineThreadCtx_::multi_inspect
struct DetectEngineThreadCtx_::@108 multi_inspect
DetectEngineThreadCtx_::spm_thread_ctx
SpmThreadCtx * spm_thread_ctx
Definition: detect.h:1276
DetectEngineReloadTenantsBlocking
int DetectEngineReloadTenantsBlocking(const int reload_cnt)
Reload all tenants and wait for loading to complete.
Definition: detect-engine.c:4158
InspectionBuffer::flags
uint8_t flags
Definition: detect-engine-inspect-buffer.h:39
detect-engine-frame.h
SCMUTEX_INITIALIZER
#define SCMUTEX_INITIALIZER
Definition: threads-debug.h:122
DetectEngineThreadCtx_::inspect
struct DetectEngineThreadCtx_::@107 inspect
Signature_::sm_arrays
SigMatchData * sm_arrays[DETECT_SM_LIST_MAX]
Definition: detect.h:731
SCInstance_::conf_filename
const char * conf_filename
Definition: suricata.h:177
DetectEngineCtx_::prefilter_setting
enum DetectEnginePrefilterSetting prefilter_setting
Definition: detect.h:1064
SignatureInitData_::init_flags
uint32_t init_flags
Definition: detect.h:608
DetectParseDupSigHashFree
void DetectParseDupSigHashFree(DetectEngineCtx *de_ctx)
Frees the hash table that is used to cull duplicate sigs.
Definition: detect-parse.c:3189
DetectBufferType_
Definition: detect.h:449
m
SCMutex m
Definition: flow-hash.h:6
DetectEngineCtx_::udp_priorityports
DetectPort * udp_priorityports
Definition: detect.h:1069
DetectContentData_
Definition: detect-content.h:93
SCConfYamlLoadFileWithPrefix
int SCConfYamlLoadFileWithPrefix(const char *filename, const char *prefix)
Load configuration from a YAML file, insert in tree at 'prefix'.
Definition: conf-yaml-loader.c:553
StringParseInt32
int StringParseInt32(int32_t *res, int base, size_t len, const char *str)
Definition: util-byte.c:634
PrefilterGenericMpmFrameRegister
int PrefilterGenericMpmFrameRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-frame.c:208
DetectEngineGetVersion
uint32_t DetectEngineGetVersion(void)
Definition: detect-engine.c:3814
SCConfNodeLookupChildValue
const char * SCConfNodeLookupChildValue(const SCConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:824
SleepUsec
#define SleepUsec(usec)
Definition: tm-threads.h:44
SigCleanSignatures
void SigCleanSignatures(DetectEngineCtx *de_ctx)
Definition: detect-engine-build.c:56
HashListTableLookup
void * HashListTableLookup(HashListTable *ht, void *data, uint16_t datalen)
Definition: util-hashlist.c:245
detect-engine-payload.h
DetectEngineThreadCtx_::lua_instruction_limit_errors
uint16_t lua_instruction_limit_errors
Definition: detect.h:1380
SIG_FLAG_TOCLIENT
#define SIG_FLAG_TOCLIENT
Definition: detect.h:272
DetectMd5ValidateCallback
bool DetectMd5ValidateCallback(const Signature *s, const char **sigerror, const DetectBufferType *map)
Definition: detect-engine.c:5022
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:82
DetectEngineMpmCachingEnabled
bool DetectEngineMpmCachingEnabled(void)
Definition: detect-engine.c:2455
DetectBufferIsPresent
bool DetectBufferIsPresent(const Signature *s, const uint32_t buf_id)
Definition: detect-engine.c:1503
InspectionBufferGet
InspectionBuffer * InspectionBufferGet(DetectEngineThreadCtx *det_ctx, const int list_id)
Definition: detect-engine-inspect-buffer.c:56
SigMatchData_
Data needed for Match()
Definition: detect.h:365
KEYWORD_PROFILING_START
#define KEYWORD_PROFILING_START
Definition: util-profiling.h:50
SigMatchData_::type
uint16_t type
Definition: detect.h:366
DetectEngineCtx_::version
uint32_t version
Definition: detect.h:1013
DetectPort_::port2
uint16_t port2
Definition: detect.h:222
DetectEngineCtx_::non_pf_engine_names
HashTable * non_pf_engine_names
Definition: detect.h:1142
DetectEngineThreadCtx_::events
uint16_t events
Definition: detect.h:1371
detect-engine-prefilter.h
util-unittest.h
TransformData_
Definition: detect.h:386
PrefilterMultiGenericMpmRegister
int PrefilterMultiGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-prefilter.c:1651
Signature_::frame_inspect
DetectEngineFrameInspectionEngine * frame_inspect
Definition: detect.h:727
DetectEngineFrameInspectionEngine::v1
struct DetectEngineFrameInspectionEngine::@92 v1
DetectBufferTypeCloseRegistration
void DetectBufferTypeCloseRegistration(void)
Definition: detect-engine.c:1647
DetectEnginePktInspectionEngine::transforms
const DetectEngineTransforms * transforms
Definition: detect.h:492
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:81
HashTableFree
void HashTableFree(HashTable *ht)
Free a HashTable and all its contents.
Definition: util-hash.c:100
TenantLoaderCtx_
Definition: detect-engine.c:4013
SCAppLayerDecoderEventsSetEventRaw
void SCAppLayerDecoderEventsSetEventRaw(AppLayerDecoderEvents **sevents, uint8_t event)
Set an app layer decoder event.
Definition: app-layer-events.c:96
DetectBufferTypeGetByName
int DetectBufferTypeGetByName(const char *name)
Definition: detect-engine.c:1278
KEYWORD_PROFILING_END
#define KEYWORD_PROFILING_END(ctx, type, m)
Definition: util-profiling.h:64
DetectBufferTypeSupportsPacket
void DetectBufferTypeSupportsPacket(const char *name)
Definition: detect-engine.c:1248
DetectEngineFrameInspectionEngine::Callback
InspectionBufferFrameInspectFunc Callback
Definition: detect.h:516
HashListTableAdd
int HashListTableAdd(HashListTable *ht, void *data, uint16_t datalen)
Definition: util-hashlist.c:114
HashTable_::array_size
uint32_t array_size
Definition: util-hash.h:37
SigGroupHeadHashInit
int SigGroupHeadHashInit(DetectEngineCtx *de_ctx)
Initializes the hash table in the detection engine context to hold the SigGroupHeads.
Definition: detect-engine-siggroup.c:244
InspectionBufferMultipleForList::size
uint32_t size
Definition: detect.h:381
SCRConfDeInitContext
void SCRConfDeInitContext(DetectEngineCtx *de_ctx)
Releases de_ctx resources related to Reference Config API.
Definition: util-reference-config.c:179
DetectEngineThreadCtx_::mt_det_ctxs_hash
HashTable * mt_det_ctxs_hash
Definition: detect.h:1256
strlcpy
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
DetectEnginePktInspectionRun
bool DetectEnginePktInspectionRun(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, const Signature *s, Flow *f, Packet *p, uint8_t *alert_flags)
Definition: detect-engine.c:1804
DETECT_PREFILTER_AUTO
@ DETECT_PREFILTER_AUTO
Definition: detect.h:897
DetectEngineThreadCtx_::keyword_ctxs_size
int keyword_ctxs_size
Definition: detect.h:1365
HashListTable_::array_size
uint32_t array_size
Definition: util-hashlist.h:41
DetectAppLayerMpmRegisterByParentId
void DetectAppLayerMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Definition: detect-engine-mpm.c:245
AlertQueueInit
void AlertQueueInit(DetectEngineThreadCtx *det_ctx)
Definition: detect-engine-alert.c:245
DetectEngineThreadCtx_::lua_rule_errors
uint16_t lua_rule_errors
Definition: detect.h:1374
SigString_::sig_error
char * sig_error
Definition: detect.h:870
DetectEngineAppInspectionEngine_::id
uint8_t id
Definition: detect.h:419
DetectEngineThreadCtx_::counter_alerts_suppressed
uint16_t counter_alerts_suppressed
Definition: detect.h:1293
PacketQueue_::mutex_q
SCMutex mutex_q
Definition: packet-queue.h:56
DetectEngineCtx_::base64_decode_max_len
uint16_t base64_decode_max_len
Definition: detect.h:1020
SIGNATURE_HOOK_TYPE_APP
@ SIGNATURE_HOOK_TYPE_APP
Definition: detect.h:549
THV_RUNNING_DONE
#define THV_RUNNING_DONE
Definition: threadvars.h:46
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1327
SCConfInit
void SCConfInit(void)
Initialize the configuration system.
Definition: conf.c:120
util-signal.h
SCConfDump
void SCConfDump(void)
Dump configuration to stdout.
Definition: conf.c:761
DetectEngineAppInspectionEngine_::sm_list
uint16_t sm_list
Definition: detect.h:424
TENANT_SELECTOR_UNKNOWN
@ TENANT_SELECTOR_UNKNOWN
Definition: detect.h:1702
HashListTableGetListNext
#define HashListTableGetListNext(hb)
Definition: util-hashlist.h:55
InspectionBufferMultipleForList
Definition: detect.h:379
DetectEngineTenantMapping_::tenant_id
uint32_t tenant_id
Definition: detect.h:1709
ThreadVars_::tmm_flags
uint8_t tmm_flags
Definition: threadvars.h:79
DETECT_SM_LIST_POSTMATCH
@ DETECT_SM_LIST_POSTMATCH
Definition: detect.h:127
SIG_FLAG_TOSERVER
#define SIG_FLAG_TOSERVER
Definition: detect.h:271
app-layer-htp.h
DetectEngineTenantSelectors
DetectEngineTenantSelectors
Definition: detect.h:1701
DetectPortParse
int DetectPortParse(const DetectEngineCtx *de_ctx, DetectPort **head, const char *str)
Function for parsing port strings.
Definition: detect-engine-port.c:1185
InspectionBufferPktInspectFunc
int(* InspectionBufferPktInspectFunc)(struct DetectEngineThreadCtx_ *, const struct DetectEnginePktInspectionEngine *engine, const struct Signature_ *s, Packet *p, uint8_t *alert_flags)
Definition: detect.h:471
datasets.h
InspectionBufferFree
void InspectionBufferFree(InspectionBuffer *buffer)
Definition: detect-engine-inspect-buffer.c:205
SignatureHook_::t
union SignatureHook_::@93 t
HashListTableInit
HashListTable * HashListTableInit(uint32_t size, uint32_t(*Hash)(struct HashListTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
Definition: util-hashlist.c:35
DetectEngineCtx_::requirements
SCDetectRequiresStatus * requirements
Definition: detect.h:1135
TAILQ_REMOVE
#define TAILQ_REMOVE(head, elm, field)
Definition: queue.h:312
SCRunmodeGet
SCRunMode SCRunmodeGet(void)
Get the current run mode.
Definition: suricata.c:279
SigTableElmt_::TransformValidate
bool(* TransformValidate)(const uint8_t *content, uint16_t content_len, void *context)
Definition: detect.h:1433
DetectEngineThreadCtx_::counter_alerts_overflow
uint16_t counter_alerts_overflow
Definition: detect.h:1291
util-debug.h
DetectBufferType_::ValidateCallback
bool(* ValidateCallback)(const struct Signature_ *, const char **sigerror, const struct DetectBufferType_ *)
Definition: detect.h:460
DetectEngineMoveToFreeList
int DetectEngineMoveToFreeList(DetectEngineCtx *de_ctx)
Definition: detect-engine.c:4719
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
util-error.h
DetectTableToString
const char * DetectTableToString(enum DetectTable table)
Definition: detect-engine.c:131
SpmInitGlobalThreadCtx
SpmGlobalThreadCtx * SpmInitGlobalThreadCtx(uint8_t matcher)
Definition: util-spm.c:138
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:18
SCProfilingPrefilterDestroyCtx
void SCProfilingPrefilterDestroyCtx(DetectEngineCtx *de_ctx)
Definition: util-profiling-prefilter.c:236
DetectEnginePktInspectionEngine::sm_list
uint16_t sm_list
Definition: detect.h:486
DetectEngineThreadCtx_::match_array_len
uint32_t match_array_len
Definition: detect.h:1336
ENGINE_PROFILE_HIGH
@ ENGINE_PROFILE_HIGH
Definition: detect.h:1177
DetectMpmInitializePktMpms
void DetectMpmInitializePktMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:685
DetectEngineThreadCtx_
Definition: detect.h:1244
SignatureHook_::app
struct SignatureHook_::@93::@94 app
PKT_STREAM_ADD
#define PKT_STREAM_ADD
Definition: decode.h:1262
DetectLoadersInit
void DetectLoadersInit(void)
Definition: detect-engine-loader.c:604
ThreadVars_::tm_slots
struct TmSlot_ * tm_slots
Definition: threadvars.h:96
SignatureInitData_::mpm_sm
SigMatch * mpm_sm
Definition: detect.h:623
DetectEngineBufferTypeGetDescriptionById
const char * DetectEngineBufferTypeGetDescriptionById(const DetectEngineCtx *de_ctx, const int id)
Definition: detect-engine.c:1386
SCMutexUnlock
#define SCMutexUnlock(mut)
Definition: threads-debug.h:120
DETECT_SM_LIST_BASE64_DATA
@ DETECT_SM_LIST_BASE64_DATA
Definition: detect.h:124
SIG_FLAG_FLUSH
#define SIG_FLAG_FLUSH
Definition: detect.h:259
DetectEngineThreadKeywordCtxItem_::id
int id
Definition: detect.h:890
PKT_PSEUDO_STREAM_END
#define PKT_PSEUDO_STREAM_END
Definition: decode.h:1270
DetectEngineThreadCtx_::buffers
InspectionBuffer * buffers
Definition: detect.h:1300
detect-engine-file.h
DetectEngineMasterCtx_::keyword_list
DetectEngineThreadKeywordCtxItem * keyword_list
Definition: detect.h:1744
SignatureInitData_::mpm_sm_list
int mpm_sm_list
Definition: detect.h:621
LiveGetDevice
LiveDevice * LiveGetDevice(const char *name)
Get a pointer to the device at idx.
Definition: util-device.c:268
flow-worker.h
SCConfGetInt
int SCConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
Definition: conf.c:414
DetectEngineMasterCtx_::tenant_selector
enum DetectEngineTenantSelectors tenant_selector
Definition: detect.h:1735
DetectEngineCtx_::keyword_hash
HashListTable * keyword_hash
Definition: detect.h:1037
BOOL2STR
#define BOOL2STR(b)
Definition: util-debug.h:539
DetectPktInspectEngineRegister
void DetectPktInspectEngineRegister(const char *name, InspectionBufferGetPktDataPtr GetPktData, InspectionBufferPktInspectFunc Callback)
register inspect engine at start up time
Definition: detect-engine.c:156
DetectEngineInspectStreamPayload
int DetectEngineInspectStreamPayload(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const Signature *s, Flow *f, Packet *p)
Do the content inspection & validation for a signature on the raw stream.
Definition: detect-engine-payload.c:248
util-reference-config.h
Packet_::pcap_v
PcapPacketVars pcap_v
Definition: decode.h:587
DetectEngineCtx_::failure_fatal
bool failure_fatal
Definition: detect.h:933
Signature_::pkt_inspect
DetectEnginePktInspectionEngine * pkt_inspect
Definition: detect.h:726
DetectEngineAppInspectionEngine_::GetMultiData
InspectionMultiBufferGetDataPtr GetMultiData
Definition: detect.h:432
SCEnter
#define SCEnter(...)
Definition: util-debug.h:281
detect-engine-mpm.h
DetectMetadataHashFree
void DetectMetadataHashFree(DetectEngineCtx *de_ctx)
Definition: detect-metadata.c:80
DetectBufferTypeMaxId
int DetectBufferTypeMaxId(void)
Definition: detect-engine.c:1035
DatasetPostReloadCleanup
void DatasetPostReloadCleanup(void)
Definition: datasets.c:569
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
DetectEngineBufferTypeValidateTransform
bool DetectEngineBufferTypeValidateTransform(DetectEngineCtx *de_ctx, int sm_list, const uint8_t *content, uint16_t content_len, const char **namestr)
Check content byte array compatibility with transforms.
Definition: detect-engine.c:1531
DetectEngineCtx_::sm_types_prefilter
bool * sm_types_prefilter
Definition: detect.h:1111
DetectEngineEnabled
int DetectEngineEnabled(void)
Check if detection is enabled.
Definition: detect-engine.c:3800
SigMatchList2DataArray
SigMatchData * SigMatchList2DataArray(SigMatch *head)
convert SigMatch list to SigMatchData array
Definition: detect-parse.c:2365
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *tv, void *initdata, void **data)
initialize thread specific detection engine context
Definition: detect-engine.c:3364
DetectEngineReloadIsIdle
int DetectEngineReloadIsIdle(void)
Definition: detect-engine.c:1922
DetectEngineFrameInspectionEngine::sm_list
uint16_t sm_list
Definition: detect.h:513
DETECT_ENGINE_INSPECT_SIG_MATCH
#define DETECT_ENGINE_INSPECT_SIG_MATCH
Definition: detect-engine-state.h:41
PKT_DETECT_HAS_STREAMDATA
#define PKT_DETECT_HAS_STREAMDATA
Definition: decode.h:1307
InspectionSingleBufferGetDataPtr
bool(* InspectionSingleBufferGetDataPtr)(const void *txv, const uint8_t flow_flags, const uint8_t **buf, uint32_t *buf_len)
Definition: detect-engine-helper.h:45
SigMatch_::next
struct SigMatch_ * next
Definition: detect.h:360
DetectEngineCtx_::mpm_matcher
uint8_t mpm_matcher
Definition: detect.h:935
DETECT_TABLE_PACKET_PRE_FLOW
@ DETECT_TABLE_PACKET_PRE_FLOW
Definition: detect.h:554
detect-engine-port.h
LiveDevice_::tenant_id
uint32_t tenant_id
Definition: util-device-private.h:46
SCClassConfDeinit
void SCClassConfDeinit(DetectEngineCtx *de_ctx)
Definition: util-classification-config.c:81
InspectionBuffer::inspect_offset
uint64_t inspect_offset
Definition: detect-engine-inspect-buffer.h:36
DETECT_TABLE_PACKET_FILTER
@ DETECT_TABLE_PACKET_FILTER
Definition: detect.h:556
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE
@ DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE
Definition: detect-engine-content-inspection.h:36
DetectEngineCtx_::frame_inspect_engines
DetectEngineFrameInspectionEngine * frame_inspect_engines
Definition: detect.h:1091
DetectEngineMasterCtx_::free_list
DetectEngineCtx * free_list
Definition: detect.h:1733
StringParseUint32
int StringParseUint32(uint32_t *res, int base, size_t len, const char *str)
Definition: util-byte.c:316
DetectEngineSyncState
DetectEngineSyncState
Definition: detect-engine.c:1874
LiveDevice_::dev
char * dev
Definition: util-device-private.h:33
PatternMatchThreadPrepare
void PatternMatchThreadPrepare(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
Definition: detect-engine-mpm.c:968
DetectEngineThreadKeywordCtxItem_::next
struct DetectEngineThreadKeywordCtxItem_ * next
Definition: detect.h:889
DETECT_SM_LIST_MATCH
@ DETECT_SM_LIST_MATCH
Definition: detect.h:117
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:259
HashTableAdd
int HashTableAdd(HashTable *ht, void *data, uint16_t datalen)
Definition: util-hash.c:120
ENGINE_PROFILE_UNKNOWN
@ ENGINE_PROFILE_UNKNOWN
Definition: detect.h:1174
DetectEngineBufferTypeRegister
int DetectEngineBufferTypeRegister(DetectEngineCtx *de_ctx, const char *name)
Definition: detect-engine.c:1365
DetectPort_
Port structure for detection engine.
Definition: detect.h:220
DetectEngineThreadCtx_::json_content_capacity
uint8_t json_content_capacity
Definition: detect.h:1282
app-layer-parser.h
Signature_::app_inspect
DetectEngineAppInspectionEngine * app_inspect
Definition: detect.h:725
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:359
ThreadVars_::next
struct ThreadVars_ * next
Definition: threadvars.h:125
DetectEngineContentInspection
bool DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const Signature *s, const SigMatchData *smd, Packet *p, Flow *f, const uint8_t *buffer, const uint32_t buffer_len, const uint64_t stream_start_offset, const uint8_t flags, const enum DetectContentInspectionType inspection_mode)
wrapper around DetectEngineContentInspectionInternal to return true/false only
Definition: detect-engine-content-inspection.c:749
SignatureInitData_::hook
SignatureHook hook
Definition: detect.h:590
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:317
hashlittle_safe
uint32_t hashlittle_safe(const void *key, size_t length, uint32_t initval)
Definition: util-hash-lookup3.c:482
DetectEngineThreadCtx_::base64_decoded_len
int base64_decoded_len
Definition: detect.h:1325
SigGroupCleanup
int SigGroupCleanup(DetectEngineCtx *de_ctx)
Definition: detect-engine-build.c:2265
detect-engine-tag.h
DetectEngineThreadCtx_::lua_memory_limit_errors
uint16_t lua_memory_limit_errors
Definition: detect.h:1383
util-profiling.h
tv_root_lock
SCMutex tv_root_lock
Definition: tm-threads.c:85
DetectEngineInspectStream
uint8_t DetectEngineInspectStream(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const struct DetectEngineAppInspectionEngine_ *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
inspect engine for stateful rules
Definition: detect-engine-payload.c:298
SCDetectEngineRegisterRateFilterCallback
void SCDetectEngineRegisterRateFilterCallback(SCDetectRateFilterFunc fn, void *arg)
Register a callback when a rate_filter has been applied to an alert.
Definition: detect-engine.c:5063
DetectEngineLoadTenantBlocking
int DetectEngineLoadTenantBlocking(uint32_t tenant_id, const char *yaml)
Load a tenant and wait for loading to complete.
Definition: detect-engine.c:4130
TmModuleDetectLoaderRegister
void TmModuleDetectLoaderRegister(void)
Definition: detect-engine-loader.c:765
Signature_::flags
uint32_t flags
Definition: detect.h:669
DetectBufferType_::xform_id
TransformIdData xform_id[DETECT_TRANSFORMS_MAX]
Definition: detect.h:463
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2595
RuleMatchCandidateTxArrayFree
void RuleMatchCandidateTxArrayFree(DetectEngineThreadCtx *det_ctx)
Definition: detect.c:1082
DetectEngineInitializeFastPatternList
void DetectEngineInitializeFastPatternList(DetectEngineCtx *de_ctx)
Definition: detect-fast-pattern.c:149
Packet_
Definition: decode.h:501
DetectEngineFrameInspectionEngine::alproto
AppProto alproto
Definition: detect.h:509
DE_STATE_FLAG_BASE
#define DE_STATE_FLAG_BASE
Definition: detect-engine-state.h:66
detect-engine-build.h
type
uint16_t type
Definition: decode-vlan.c:106
conf-yaml-loader.h
SCRConfLoadReferenceConfigFile
int SCRConfLoadReferenceConfigFile(DetectEngineCtx *de_ctx, FILE *fd)
Loads the Reference info from the reference.config file.
Definition: util-reference-config.c:485
DetectEngineTenantRegisterLivedev
int DetectEngineTenantRegisterLivedev(uint32_t tenant_id, int device_id)
Definition: detect-engine.c:4576
PcapPacketVars_::tenant_id
uint32_t tenant_id
Definition: source-pcap.h:37
DETECT_CI_FLAGS_END
#define DETECT_CI_FLAGS_END
Definition: detect-engine-content-inspection.h:42
DetectEngineBufferTypeSupportsFrames
void DetectEngineBufferTypeSupportsFrames(DetectEngineCtx *de_ctx, const char *name)
Definition: detect-engine.c:1395
InspectionBufferFrameInspectFunc
int(* InspectionBufferFrameInspectFunc)(struct DetectEngineThreadCtx_ *, const struct DetectEngineFrameInspectionEngine *engine, const struct Signature_ *s, Packet *p, const struct Frames *frames, const struct Frame *frame)
Definition: detect.h:504
DetectEngineCtx_::frame_mpms_list
DetectBufferMpmRegistry * frame_mpms_list
Definition: detect.h:1092
detect-engine-alert.h
conf.h
DetectEngineCtx_::sgh_mpm_ctx_cnf
uint8_t sgh_mpm_ctx_cnf
Definition: detect.h:1033
DetectEngineAppInspectionEngine_::match_on_null
bool match_on_null
Definition: detect.h:423
DetectBufferType_::packet
bool packet
Definition: detect.h:455
DetectContentData_::flags
uint32_t flags
Definition: detect-content.h:104
DetectEngineMasterCtx_::multi_tenant_enabled
int multi_tenant_enabled
Definition: detect.h:1721
TmModuleGetById
TmModule * TmModuleGetById(int id)
Returns a TM Module by its id.
Definition: tm-modules.c:69
TmSlot_
Definition: tm-threads.h:53
DetectEngineFrameInspectionEngine
Definition: detect.h:508
TenantLoaderCtx
struct TenantLoaderCtx_ TenantLoaderCtx
util-magic.h
DetectEngineCtx_::max_uniq_toserver_groups
uint16_t max_uniq_toserver_groups
Definition: detect.h:991
DetectEngineBufferTypeGetById
const DetectBufferType * DetectEngineBufferTypeGetById(const DetectEngineCtx *de_ctx, const int id)
Definition: detect-engine.c:1298
Packet_::livedev
struct LiveDevice_ * livedev
Definition: decode.h:618
DETECT_TABLE_PACKET_TD
@ DETECT_TABLE_PACKET_TD
Definition: detect.h:557
TmEcode
TmEcode
Definition: tm-threads-common.h:80
DetectEnginePktInspectionEngine::Callback
InspectionBufferPktInspectFunc Callback
Definition: detect.h:490
DetectBufferType_::name
char name[64]
Definition: detect.h:450
ALPROTO_DOH2
@ ALPROTO_DOH2
Definition: app-layer-protos.h:66
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:747
name
const char * name
Definition: tm-threads.c:2163
DetectEngineSyncer_::state
enum DetectEngineSyncState state
Definition: detect-engine.c:1882
SpmMakeThreadCtx
SpmThreadCtx * SpmMakeThreadCtx(const SpmGlobalThreadCtx *global_thread_ctx)
Definition: util-spm.c:153
ENGINE_PROFILE_CUSTOM
@ ENGINE_PROFILE_CUSTOM
Definition: detect.h:1178
SCReferenceSCConfInit
void SCReferenceSCConfInit(DetectEngineCtx *de_ctx)
Definition: util-reference-config.c:52
DetectEngineCtx_::profile_keyword_ctx
struct SCProfileKeywordDetectCtx_ * profile_keyword_ctx
Definition: detect.h:1045
DetectEngineAppInspectionEngine_::GetDataSingle
InspectionSingleBufferGetDataPtr GetDataSingle
Definition: detect.h:431
SCInstance_::additional_configs
const char ** additional_configs
Definition: suricata.h:178
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1419
reputation.h
SCProfilingPrefilterThreadCleanup
void SCProfilingPrefilterThreadCleanup(DetectEngineThreadCtx *det_ctx)
Definition: util-profiling-prefilter.c:281
SCConfCreateContextBackup
void SCConfCreateContextBackup(void)
Creates a backup of the conf_hash hash_table used by the conf API.
Definition: conf.c:684
util-action.h
HashListTable_
Definition: util-hashlist.h:37
DetectEngineThreadCtxGetJsonContext
int DetectEngineThreadCtxGetJsonContext(DetectEngineThreadCtx *det_ctx)
Definition: detect-engine.c:5071
DetectEngineCtx_::byte_extract_max_local_id
int32_t byte_extract_max_local_id
Definition: detect.h:1010
DetectEngineTransforms::transforms
TransformData transforms[DETECT_TRANSFORMS_MAX]
Definition: detect.h:392
DetectEnginePktInspectionEngine::sm_list_base
uint16_t sm_list_base
Definition: detect.h:487
ALPROTO_HTTP2
@ ALPROTO_HTTP2
Definition: app-layer-protos.h:69
SIG_PROP_FLOW_ACTION_PACKET
@ SIG_PROP_FLOW_ACTION_PACKET
Definition: detect.h:84
DetectEngineMultiTenantEnabled
bool DetectEngineMultiTenantEnabled(void)
Definition: detect-engine.c:3870
signature_properties
const struct SignatureProperties signature_properties[SIG_TYPE_MAX]
Definition: detect-engine.c:116
DetectEngineCtx_::RateFilterCallback
SCDetectRateFilterFunc RateFilterCallback
Definition: detect.h:1147
runmodes.h
RunmodeIsUnittests
int RunmodeIsUnittests(void)
Definition: suricata.c:270
PacketQueue_::cond_q
SCCondT cond_q
Definition: packet-queue.h:57
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:229
TAILQ_FOREACH_SAFE
#define TAILQ_FOREACH_SAFE(var, head, field, tvar)
Definition: queue.h:329
DetectEngineFrameInspectionEngine::dir
uint8_t dir
Definition: detect.h:510
SIG_FLAG_REQUIRE_STREAM_ONLY
#define SIG_FLAG_REQUIRE_STREAM_ONLY
Definition: detect.h:261
SpmDestroyGlobalThreadCtx
void SpmDestroyGlobalThreadCtx(SpmGlobalThreadCtx *global_thread_ctx)
Definition: util-spm.c:144
DETECT_ENGINE_INSPECT_SIG_CANT_MATCH
#define DETECT_ENGINE_INSPECT_SIG_CANT_MATCH
Definition: detect-engine-state.h:42
DetectEngineThreadCtx_::mtc
MpmThreadCtx mtc
Definition: detect.h:1343
DetectEngineRegisterTests
void DetectEngineRegisterTests(void)
Definition: detect-engine.c:5297
SigString_::filename
char * filename
Definition: detect.h:868
DetectBufferType_::multi_instance
bool multi_instance
Definition: detect.h:458
DetectLoaderQueueTask
int DetectLoaderQueueTask(int loader_id, LoaderFunc Func, void *func_ctx, LoaderFreeFunc FreeFunc)
Definition: detect-engine-loader.c:527
DETECT_ENGINE_TYPE_TENANT
@ DETECT_ENGINE_TYPE_TENANT
Definition: detect.h:905
DetectEngineBufferTypeSupportsTransformations
void DetectEngineBufferTypeSupportsTransformations(DetectEngineCtx *de_ctx, const char *name)
Definition: detect-engine.c:1419
PACKET_ALERT_FLAG_STREAM_MATCH
#define PACKET_ALERT_FLAG_STREAM_MATCH
Definition: decode.h:270
InspectionMultiBufferGetDataPtr
bool(* InspectionMultiBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const void *txv, const uint8_t flow_flags, uint32_t local_id, const uint8_t **buf, uint32_t *buf_len)
Definition: detect-engine-helper.h:42
DetectEngineBufferTypeSupportsMpmGetById
bool DetectEngineBufferTypeSupportsMpmGetById(const DetectEngineCtx *de_ctx, const int id)
Definition: detect-engine.c:1445
DetectEngineCtx_::config_prefix
char config_prefix[64]
Definition: detect.h:1051
DetectSigmatchListEnumToString
const char * DetectSigmatchListEnumToString(enum DetectSigmatchListEnum type)
Definition: detect-engine.c:4987
TmModule_
Definition: tm-modules.h:47
SCRealloc
#define SCRealloc(ptr, sz)
Definition: util-mem.h:50
DetectEngineAppInspectionEngine_::alproto
AppProto alproto
Definition: detect.h:417
SRepReloadComplete
void SRepReloadComplete(void)
Increment effective reputation version after a rule/reputation reload is complete.
Definition: reputation.c:161
SIG_FLAG_INIT_STATE_MATCH
#define SIG_FLAG_INIT_STATE_MATCH
Definition: detect.h:296
detect-engine-content-inspection.h
ThreadVars_::stream_pq
struct PacketQueue_ * stream_pq
Definition: threadvars.h:116
DetectEngineAppInspectionEngine_::smd
SigMatchData * smd
Definition: detect.h:439
DetectEngineBufferTypeSupportsFramesGetById
bool DetectEngineBufferTypeSupportsFramesGetById(const DetectEngineCtx *de_ctx, const int id)
Definition: detect-engine.c:1454
DetectBufferType_::id
int id
Definition: detect.h:452
DetectEngineCtx_::spm_matcher
uint8_t spm_matcher
Definition: detect.h:937
DetectEngineBufferTypeRegisterWithFrameEngines
int DetectEngineBufferTypeRegisterWithFrameEngines(DetectEngineCtx *de_ctx, const char *name, const int direction, const AppProto alproto, const uint8_t frame_type)
Definition: detect-engine.c:1331
DetectEnginePktInspectionEngine::GetData
InspectionBufferGetPktDataPtr GetData
Definition: detect.h:489
SCConfNodeLookupChild
SCConfNode * SCConfNodeLookupChild(const SCConfNode *node, const char *name)
Lookup a child configuration node by name.
Definition: conf.c:796
DETECT_ENGINE_TYPE_NORMAL
@ DETECT_ENGINE_TYPE_NORMAL
Definition: detect.h:902
FlowWorkerGetDetectCtxPtr
void * FlowWorkerGetDetectCtxPtr(void *flow_worker)
Definition: flow-worker.c:747
detect-fast-pattern.h
DetectBufferType_::frame
bool frame
Definition: detect.h:456
DetectEngineBufferTypeSupportsMultiInstanceGetById
bool DetectEngineBufferTypeSupportsMultiInstanceGetById(const DetectEngineCtx *de_ctx, const int id)
Definition: detect-engine.c:1427
SCCondSignal
#define SCCondSignal
Definition: threads-debug.h:140
ThreadVars_::inq
Tmq * inq
Definition: threadvars.h:90
util-conf.h
DetectEngineCtx_::sig_stat
SigFileLoaderStat sig_stat
Definition: detect.h:1102
Packet_::flow
struct Flow_ * flow
Definition: decode.h:546
DetectEngineFrameMpmRegister
void DetectEngineFrameMpmRegister(DetectEngineCtx *de_ctx, const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), AppProto alproto, uint8_t type)
Definition: detect-engine-mpm.c:455
DetectEngineThreadCtx_::to_clear_queue
uint32_t * to_clear_queue
Definition: detect.h:1303
SpmDestroyThreadCtx
void SpmDestroyThreadCtx(SpmThreadCtx *thread_ctx)
Definition: util-spm.c:163
DetectEngineCtx_::profile_prefilter_ctx
struct SCProfilePrefilterDetectCtx_ * profile_prefilter_ctx
Definition: detect.h:1046
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
TENANT_SELECTOR_DIRECT
@ TENANT_SELECTOR_DIRECT
Definition: detect.h:1703
DETECT_CI_FLAGS_SINGLE
#define DETECT_CI_FLAGS_SINGLE
Definition: detect-engine-content-inspection.h:49
DetectEnginePktInspectionSetup
int DetectEnginePktInspectionSetup(Signature *s)
Definition: detect-engine.c:1852
DetectBufferTypeRegister
int DetectBufferTypeRegister(const char *name)
Definition: detect-engine.c:1214
InspectEngineFuncPtr
uint8_t(* InspectEngineFuncPtr)(struct DetectEngineCtx_ *de_ctx, struct DetectEngineThreadCtx_ *det_ctx, const struct DetectEngineAppInspectionEngine_ *engine, const struct Signature_ *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
Definition: detect.h:411
SleepMsec
#define SleepMsec(msec)
Definition: tm-threads.h:45
flags
uint8_t flags
Definition: decode-gre.h:0
DetectRegisterThreadCtxFuncs
int DetectRegisterThreadCtxFuncs(DetectEngineCtx *de_ctx, const char *name, void *(*InitFunc)(void *), void *data, void(*FreeFunc)(void *), int mode)
Register Thread keyword context Funcs.
Definition: detect-engine.c:3654
MpmStoreInit
int MpmStoreInit(DetectEngineCtx *de_ctx)
Initializes the MpmStore mpm hash table to be used by the detection engine context.
Definition: detect-engine-mpm.c:1456
DetectEngineMasterCtx_::keyword_id
int keyword_id
Definition: detect.h:1745
DetectEngineCtx_::app_mpms_list
DetectBufferMpmRegistry * app_mpms_list
Definition: detect.h:1084
suricata-common.h
SIG_PROP_FLOW_ACTION_FLOW_IF_STATEFUL
@ SIG_PROP_FLOW_ACTION_FLOW_IF_STATEFUL
Definition: detect.h:86
DetectEngineCtxInitStubForMT
DetectEngineCtx * DetectEngineCtxInitStubForMT(void)
Definition: detect-engine.c:2585
SigMatch_::type
uint16_t type
Definition: detect.h:357
DetectBufferTypeSupportsMpm
void DetectBufferTypeSupportsMpm(const char *name)
Definition: detect-engine.c:1258
util-path.h
DetectEngineThreadCtx_::tenant_id
uint32_t tenant_id
Definition: detect.h:1247
DetectEngineAppInspectionEngine_::v2
struct DetectEngineAppInspectionEngine_::@88 v2
HashListTableFree
void HashListTableFree(HashListTable *ht)
Definition: util-hashlist.c:88
detect-byte-extract.h
DetectEngineCtx_::buffer_type_hash_name
HashListTable * buffer_type_hash_name
Definition: detect.h:1079
DetectEngineCtx_::next
struct DetectEngineCtx_ * next
Definition: detect.h:1058
DETECT_TABLE_NOT_SET
@ DETECT_TABLE_NOT_SET
Definition: detect.h:553
DETECT_ENGINE_TYPE_DD_STUB
@ DETECT_ENGINE_TYPE_DD_STUB
Definition: detect.h:903
TENANT_SELECTOR_VLAN
@ TENANT_SELECTOR_VLAN
Definition: detect.h:1704
DetectEngineBumpVersion
void DetectEngineBumpVersion(void)
Definition: detect-engine.c:3824
DetectEngineFrameInspectionEngine::next
struct DetectEngineFrameInspectionEngine * next
Definition: detect.h:521
SignatureHook_::type
enum SignatureHookType type
Definition: detect.h:572
DetectEngineInspectFrameBufferGeneric
int DetectEngineInspectFrameBufferGeneric(DetectEngineThreadCtx *det_ctx, const DetectEngineFrameInspectionEngine *engine, const Signature *s, Packet *p, const Frames *frames, const Frame *frame)
Do the content inspection & validation for a signature.
Definition: detect-engine-frame.c:560
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *tv, void *data)
Definition: detect-engine.c:3596
util-spm.h
DetectEnginePktInspectionEngine::next
struct DetectEnginePktInspectionEngine * next
Definition: detect.h:494
DetectContentData_::content
uint8_t * content
Definition: detect-content.h:94
DetectEngineCtx_::rate_filter_callback_arg
void * rate_filter_callback_arg
Definition: detect.h:1150
DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT
#define DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT
Definition: detect-engine.c:95
version
uint8_t version
Definition: decode-gre.h:1
PostRuleMatchWorkQueue::q
PostRuleMatchWorkQueueItem * q
Definition: detect.h:1226
TransformIdData_::id_data_len
uint32_t id_data_len
Definition: detect.h:446
PatternMatchDefaultMatcher
uint8_t PatternMatchDefaultMatcher(void)
Function to return the multi pattern matcher algorithm to be used by the engine, based on the mpm-alg...
Definition: detect-engine-mpm.c:911
util-classification-config.h
SCConfDeInit
void SCConfDeInit(void)
De-initializes the configuration system.
Definition: conf.c:703
DetectEngineTenantRegisterPcapFile
int DetectEngineTenantRegisterPcapFile(uint32_t tenant_id)
Definition: detect-engine.c:4592
SCStrdup
#define SCStrdup(s)
Definition: util-mem.h:56
FatalError
#define FatalError(...)
Definition: util-debug.h:514
SigGroupHeadHashFree
void SigGroupHeadHashFree(DetectEngineCtx *de_ctx)
Frees the hash table - DetectEngineCtx->sgh_hash_table, allocated by SigGroupHeadHashInit() function.
Definition: detect-engine-siggroup.c:299
SCAppLayerDecoderEventsFreeEvents
void SCAppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events)
Definition: app-layer-events.c:137
DetectEngineInspectGenericList
uint8_t DetectEngineInspectGenericList(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const struct DetectEngineAppInspectionEngine_ *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
Do the content inspection & validation for a signature.
Definition: detect-engine.c:1946
DetectEngineAppInspectionEngineSignatureFree
void DetectEngineAppInspectionEngineSignatureFree(DetectEngineCtx *de_ctx, Signature *s)
free app inspect engines for a signature
Definition: detect-engine.c:929
TVT_PPT
@ TVT_PPT
Definition: tm-threads-common.h:88
DETECT_ENGINE_CONTENT_INSPECTION_MODE_HEADER
@ DETECT_ENGINE_CONTENT_INSPECTION_MODE_HEADER
Definition: detect-engine-content-inspection.h:33
util-hash-lookup3.h
DETECT_SM_LIST_TMATCH
@ DETECT_SM_LIST_TMATCH
Definition: detect.h:129
DetectEngineCtx_::loader_id
int loader_id
Definition: detect.h:1061
SCInstance_::sig_file
char * sig_file
Definition: suricata.h:138
TransformData_::transform
int transform
Definition: detect.h:387
DETECT_ENGINE_INSPECT_SIG_NO_MATCH
#define DETECT_ENGINE_INSPECT_SIG_NO_MATCH
Definition: detect-engine-state.h:40
DetectEngineCtx_::pkt_inspect_engines
DetectEnginePktInspectionEngine * pkt_inspect_engines
Definition: detect.h:1088
DetectEngineBufferTypeSupportsMpm
void DetectEngineBufferTypeSupportsMpm(DetectEngineCtx *de_ctx, const char *name)
Definition: detect-engine.c:1411
SIG_TYPE_MAX
@ SIG_TYPE_MAX
Definition: detect.h:79
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
DetectEngineCtx_::sm_types_silent_error
bool * sm_types_silent_error
Definition: detect.h:1112
DetectEngineAppInspectionEngine_::progress
int16_t progress
Definition: detect.h:426
DetectEngineThreadKeywordCtxItem_::FreeFunc
void(* FreeFunc)(void *)
Definition: detect.h:887
app-layer-events.h
SignatureInitDataBuffer_::only_ts
bool only_ts
Definition: detect.h:532
util-validate.h
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:258
DetectEngineFreeFastPatternList
void DetectEngineFreeFastPatternList(DetectEngineCtx *de_ctx)
Definition: detect-fast-pattern.c:171
MPM_AC_KS
@ MPM_AC_KS
Definition: util-mpm.h:39
DetectBufferTypeSupportsTransformations
void DetectBufferTypeSupportsTransformations(const char *name)
Definition: detect-engine.c:1268
detect-engine-sigorder.h
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
DetectEngineMpmCachingGetPath
const char * DetectEngineMpmCachingGetPath(void)
Definition: detect-engine.c:2464
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
DetectAddressMapInit
int DetectAddressMapInit(DetectEngineCtx *de_ctx)
Definition: detect-engine-address.c:1327
InjectPacketsForFlush
void InjectPacketsForFlush(ThreadVars **detect_tvs, int no_of_detect_tvs)
Definition: detect-engine.c:2239
InspectionBuffer::inspect_len
uint32_t inspect_len
Definition: detect-engine-inspect-buffer.h:37
SignatureInitData_::buffers
SignatureInitDataBuffer * buffers
Definition: detect.h:647
DetectEngineCtx_::app_inspect_engines
DetectEngineAppInspectionEngine * app_inspect_engines
Definition: detect.h:1087
DetectEngineCtx_::filemagic_thread_ctx_id
int filemagic_thread_ctx_id
Definition: detect.h:982
SigJsonContent
Definition: detect.h:1236
DetectEngineSyncer_
Definition: detect-engine.c:1880
DetectEngineThreadCtx_::global_keyword_ctxs_size
int global_keyword_ctxs_size
Definition: detect.h:1367
DetectEngineThreadCtx_::json_content
SigJsonContent * json_content
Definition: detect.h:1281
PrefilterInit
void PrefilterInit(DetectEngineCtx *de_ctx)
Definition: detect-engine-prefilter.c:1427
InspectionBuffer::inspect
const uint8_t * inspect
Definition: detect-engine-inspect-buffer.h:35
DetectEngineThreadCtx_::tv
ThreadVars * tv
Definition: detect.h:1252
DetectThreadCtxGetGlobalKeywordThreadCtx
void * DetectThreadCtxGetGlobalKeywordThreadCtx(DetectEngineThreadCtx *det_ctx, int id)
Retrieve thread local keyword ctx by id.
Definition: detect-engine.c:3788
SCConfGetNode
SCConfNode * SCConfGetNode(const char *name)
Get a SCConfNode by name.
Definition: conf.c:181
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:271
DETECT_TBLSIZE
int DETECT_TBLSIZE
Definition: detect-engine-register.c:288
SRepInit
int SRepInit(DetectEngineCtx *de_ctx)
init reputation
Definition: reputation.c:566
DetectEngineReloadStart
int DetectEngineReloadStart(void)
Definition: detect-engine.c:1888
DetectEngineUnsetParseMetadata
void DetectEngineUnsetParseMetadata(void)
Definition: detect-engine.c:4977
PKT_SRC_DETECT_RELOAD_FLUSH
@ PKT_SRC_DETECT_RELOAD_FLUSH
Definition: decode.h:61
DetectEngineThreadCtx_::counter_alerts
uint16_t counter_alerts
Definition: detect.h:1289
DetectEngineThreadCtx_::keyword_ctxs_array
void ** keyword_ctxs_array
Definition: detect.h:1364
SCFree
#define SCFree(p)
Definition: util-mem.h:61
DetectEngineMasterCtx_
Definition: detect.h:1717
Signature_::id
uint32_t id
Definition: detect.h:713
HashListTableBucket_
Definition: util-hashlist.h:28
DetectEngineThreadKeywordCtxItem_::name
const char * name
Definition: detect.h:891
detect-tcphdr.h
DetectEngineCtx_::guess_applayer_log_limit
uint8_t guess_applayer_log_limit
Definition: detect.h:976
HashListTableRemove
int HashListTableRemove(HashListTable *ht, void *data, uint16_t datalen)
Definition: util-hashlist.c:154
DatasetReload
void DatasetReload(void)
Definition: datasets.c:543
DetectBufferType_::transforms
DetectEngineTransforms transforms
Definition: detect.h:462
detect-engine-iponly.h
SCConfRestoreContextBackup
void SCConfRestoreContextBackup(void)
Restores the backup of the hash_table present in backup_conf_hash back to conf_hash.
Definition: conf.c:694
DetectEngineType
DetectEngineType
Definition: detect.h:901
detect-parse.h
SignatureInitDataBuffer_::id
uint32_t id
Definition: detect.h:525
Signature_
Signature container.
Definition: detect.h:668
SigMatch_
a single match condition for a signature
Definition: detect.h:356
DetectEngineCtx_::tenant_path
char * tenant_path
Definition: detect.h:1132
DetectEngineAppInspectionEngine_::transforms
const DetectEngineTransforms * transforms
Definition: detect.h:436
DETECT_SM_LIST_MAX
@ DETECT_SM_LIST_MAX
Definition: detect.h:135
DetectBufferType_::parent_id
int parent_id
Definition: detect.h:453
DETECT_PREFILTER_MPM
@ DETECT_PREFILTER_MPM
Definition: detect.h:896
TenantLoaderCtx_::yaml
char * yaml
Definition: detect-engine.c:4016
InspectionBufferSetupAndApplyTransforms
void InspectionBufferSetupAndApplyTransforms(DetectEngineThreadCtx *det_ctx, const int list_id, InspectionBuffer *buffer, const uint8_t *data, const uint32_t data_len, const DetectEngineTransforms *transforms)
setup the buffer with our initial data
Definition: detect-engine-inspect-buffer.c:197
TransformIdData_::id_data
const uint8_t * id_data
Definition: detect.h:445
DetectLoadersSync
int DetectLoadersSync(void)
wait for loader tasks to complete
Definition: detect-engine-loader.c:561
SCProfilingSghDestroyCtx
void SCProfilingSghDestroyCtx(DetectEngineCtx *de_ctx)
Definition: util-profiling-rulegroups.c:285
HashTableInit
HashTable * HashTableInit(uint32_t size, uint32_t(*Hash)(struct HashTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
Definition: util-hash.c:35
DetectEngineTenantMapping_::traffic_id
uint32_t traffic_id
Definition: detect.h:1712
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
MPM_HS
@ MPM_HS
Definition: util-mpm.h:40
ALPROTO_FAILED
@ ALPROTO_FAILED
Definition: app-layer-protos.h:33
spm_table
SpmTableElmt spm_table[SPM_TABLE_SIZE]
Definition: util-spm.c:62
DetectEngineReference
DetectEngineCtx * DetectEngineReference(DetectEngineCtx *de_ctx)
Definition: detect-engine.c:3856
DetectEngineThreadCtx_::base64_decoded
uint8_t * base64_decoded
Definition: detect.h:1324
TenantLoaderCtx_::reload_cnt
int reload_cnt
Definition: detect-engine.c:4015
mpm_table
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
Definition: util-mpm.c:47
DetectEngineSyncer
struct DetectEngineSyncer_ DetectEngineSyncer
DetectMpmInitializeAppMpms
void DetectMpmInitializeAppMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:291
EngineModeIsIPS
int EngineModeIsIPS(void)
Definition: suricata.c:242
MpmTableElmt_::ConfigDeinit
void(* ConfigDeinit)(MpmConfig **)
Definition: util-mpm.h:160
DetectEngineTransforms::cnt
int cnt
Definition: detect.h:393
DetectEngineThreadCtx_::de_ctx
DetectEngineCtx * de_ctx
Definition: detect.h:1362
InspectionBufferSetupMultiEmpty
void InspectionBufferSetupMultiEmpty(InspectionBuffer *buffer)
setup the buffer empty
Definition: detect-engine-inspect-buffer.c:144
suricata.h
DetectEngineCtx_::sig_array
Signature ** sig_array
Definition: detect.h:950
MpmTableElmt_::ConfigCacheDirSet
void(* ConfigCacheDirSet)(MpmConfig *, const char *dir_path)
Definition: util-mpm.h:161
InspectionBufferGetDataPtr
InspectionBuffer *(* InspectionBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id)
Definition: detect-engine-helper.h:39
DetectEngineAppInspectionEngine_::dir
uint8_t dir
Definition: detect.h:418
PmqFree
void PmqFree(PrefilterRuleStore *pmq)
Cleanup and free a Pmq.
Definition: util-prefilter.c:126
DetectContentData_::content_len
uint16_t content_len
Definition: detect-content.h:95
DETECT_ENGINE_TYPE_MT_STUB
@ DETECT_ENGINE_TYPE_MT_STUB
Definition: detect.h:904
SCConfNode_::name
char * name
Definition: conf.h:38
SignatureInitDataBuffer_::only_tc
bool only_tc
Definition: detect.h:531
detect-uricontent.h
DetectEngineCtx_::buffer_type_id
uint32_t buffer_type_id
Definition: detect.h:1081
ThresholdCacheThreadFree
void ThresholdCacheThreadFree(void)
Definition: detect-engine-threshold.c:454
Packet_::vlan_id
uint16_t vlan_id[VLAN_MAX_LAYERS]
Definition: decode.h:528
RUNMODE_CONF_TEST
@ RUNMODE_CONF_TEST
Definition: runmodes.h:54
DetectEngineReload
int DetectEngineReload(const SCInstance *suri)
Reload the detection engine.
Definition: detect-engine.c:4786
DetectEngineBufferRunValidateCallback
bool DetectEngineBufferRunValidateCallback(const DetectEngineCtx *de_ctx, const int id, const Signature *s, const char **sigerror)
Definition: detect-engine.c:1492
DetectEngineCtx_::sigerror
const char * sigerror
Definition: detect.h:1025
DetectEngineThreadCtx_::json_content_len
uint8_t json_content_len
Definition: detect.h:1283
DetectBufferType_::SetupCallback
void(* SetupCallback)(const struct DetectEngineCtx_ *, struct Signature_ *)
Definition: detect.h:459
DetectAppLayerInspectEngineRegister
void DetectAppLayerInspectEngineRegister(const char *name, AppProto alproto, uint32_t dir, int progress, InspectEngineFuncPtr Callback, InspectionBufferGetDataPtr GetData)
Registers an app inspection engine.
Definition: detect-engine.c:273
DetectEngineThreadCtx_::mt_det_ctxs_cnt
uint32_t mt_det_ctxs_cnt
Definition: detect.h:1254
DetectEngineContentInspectionBuffer
bool DetectEngineContentInspectionBuffer(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const Signature *s, const SigMatchData *smd, Packet *p, Flow *f, const InspectionBuffer *b, const enum DetectContentInspectionType inspection_mode)
wrapper around DetectEngineContentInspectionInternal to return true/false only
Definition: detect-engine-content-inspection.c:773
DetectEngineMasterCtx_::lock
SCMutex lock
Definition: detect.h:1718
DetectEnginePktInspectionEngine::mpm
bool mpm
Definition: detect.h:485
SCInstance_
Definition: suricata.h:133
DetectEngineCtx_::spm_global_thread_ctx
SpmGlobalThreadCtx * spm_global_thread_ctx
Definition: detect.h:986
DetectEngineClearMaster
void DetectEngineClearMaster(void)
Definition: detect-engine.c:4759
id
uint32_t id
Definition: detect-flowbits.c:938
SRepDestroy
void SRepDestroy(DetectEngineCtx *de_ctx)
Definition: reputation.c:649
MpmTableElmt_::ConfigInit
MpmConfig *(* ConfigInit)(void)
Definition: util-mpm.h:159
StatsRegisterAvgCounter
uint16_t StatsRegisterAvgCounter(const char *name, struct ThreadVars_ *tv)
Registers a counter, whose value holds the average of all the values assigned to it.
Definition: counters.c:988
SIG_PROP_FLOW_ACTION_FLOW
@ SIG_PROP_FLOW_ACTION_FLOW
Definition: detect.h:85
DetectBufferTypeSetDescriptionByName
void DetectBufferTypeSetDescriptionByName(const char *name, const char *desc)
Definition: detect-engine.c:1375
SigString_::sig_str
char * sig_str
Definition: detect.h:869
SCStatFn
#define SCStatFn(pathname, statbuf)
Definition: util-path.h:35
DetectUnregisterThreadCtxFuncs
int DetectUnregisterThreadCtxFuncs(DetectEngineCtx *de_ctx, void *data, const char *name)
Remove Thread keyword context registration.
Definition: detect-engine.c:3706
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:375
SCInstance_::sig_file_exclusive
bool sig_file_exclusive
Definition: suricata.h:139
DetectAppLayerMultiRegister
void DetectAppLayerMultiRegister(const char *name, AppProto alproto, uint32_t dir, int progress, InspectionMultiBufferGetDataPtr GetData, int priority)
Definition: detect-engine.c:2099
DetectEngineFrameInspectEngineRegister
void DetectEngineFrameInspectEngineRegister(DetectEngineCtx *de_ctx, const char *name, int dir, InspectionBufferFrameInspectFunc Callback, AppProto alproto, uint8_t type)
register inspect engine at start up time
Definition: detect-engine.c:451
DetectEngineTenantRegisterVlanId
int DetectEngineTenantRegisterVlanId(uint32_t tenant_id, uint16_t vlan_id)
Definition: detect-engine.c:4582
flow.h
DetectEngineSetParseMetadata
void DetectEngineSetParseMetadata(void)
Definition: detect-engine.c:4972
TmThreadsCheckFlag
int TmThreadsCheckFlag(ThreadVars *tv, uint32_t flag)
Check if a thread flag is set.
Definition: tm-threads.c:93
SCLogNotice
#define SCLogNotice(...)
Macro used to log NOTICE messages.
Definition: util-debug.h:247
DetectPktMpmRegisterByParentId
void DetectPktMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Definition: detect-engine-mpm.c:645
TENANT_SELECTOR_LIVEDEV
@ TENANT_SELECTOR_LIVEDEV
Definition: detect.h:1705
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:442
DetectEngineFrameInspectionEngine::type
uint8_t type
Definition: detect.h:511
StatsRegisterCounter
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
Definition: counters.c:968
DetectSigmatchListEnum
DetectSigmatchListEnum
Definition: detect.h:115
DetectEngineMasterCtx_::version
uint32_t version
Definition: detect.h:1724
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
DetectEngineCtx_::sig_array_len
uint32_t sig_array_len
Definition: detect.h:951
util-enum.h
SCConfNode_
Definition: conf.h:37
DetectEngineTenantUnregisterPcapFile
int DetectEngineTenantUnregisterPcapFile(uint32_t tenant_id)
Definition: detect-engine.c:4598
TenantLoaderCtx_::tenant_id
uint32_t tenant_id
Definition: detect-engine.c:4014
DetectEngineCtx_::signum
uint32_t signum
Definition: detect.h:953
DetectEngineCtx_::tenant_id
uint32_t tenant_id
Definition: detect.h:939
SignatureInitData_::buffer_index
uint32_t buffer_index
Definition: detect.h:648
detect-engine-loader.h
SigFileLoaderStat_
Signature loader statistics.
Definition: detect.h:876
SCConfNode_::val
char * val
Definition: conf.h:39
DetectEngineInspectPktBufferGeneric
int DetectEngineInspectPktBufferGeneric(DetectEngineThreadCtx *det_ctx, const DetectEnginePktInspectionEngine *engine, const Signature *s, Packet *p, uint8_t *_alert_flags)
Do the content inspection & validation for a signature.
Definition: detect-engine.c:2197
DetectEngineCtx_::buffer_type_hash_id
HashListTable * buffer_type_hash_id
Definition: detect.h:1080
DetectEngineGetByTenantId
DetectEngineCtx * DetectEngineGetByTenantId(uint32_t tenant_id)
Definition: detect-engine.c:4609
DetectPortCleanupList
void DetectPortCleanupList(const DetectEngineCtx *de_ctx, DetectPort *head)
Free a DetectPort list and each of its members.
Definition: detect-engine-port.c:124
SigTableElmt_::TransformId
void(* TransformId)(const uint8_t **data, uint32_t *length, void *context)
Definition: detect.h:1436
DETECT_SM_LIST_SUPPRESS
@ DETECT_SM_LIST_SUPPRESS
Definition: detect.h:132
SCMutex
#define SCMutex
Definition: threads-debug.h:114
InspectionBufferMultipleForList::inspection_buffers
InspectionBuffer * inspection_buffers
Definition: detect.h:380
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
DetectEngineAppInspectionEngine2Signature
int DetectEngineAppInspectionEngine2Signature(DetectEngineCtx *de_ctx, Signature *s)
Definition: detect-engine.c:801
SCClassConfLoadClassificationConfigFile
bool SCClassConfLoadClassificationConfigFile(DetectEngineCtx *de_ctx, FILE *fd)
Loads the Classtype info from the classification.config file.
Definition: util-classification-config.c:524
InspectionBufferSetupMulti
void InspectionBufferSetupMulti(DetectEngineThreadCtx *det_ctx, InspectionBuffer *buffer, const DetectEngineTransforms *transforms, const uint8_t *data, const uint32_t data_len)
setup the buffer with our initial data
Definition: detect-engine-inspect-buffer.c:157
DetectEngineTenantUnregisterVlanId
int DetectEngineTenantUnregisterVlanId(uint32_t tenant_id, uint16_t vlan_id)
Definition: detect-engine.c:4587
SCStat
struct stat SCStat
Definition: util-path.h:33
detect-engine-address.h
PmqSetup
int PmqSetup(PrefilterRuleStore *pmq)
Setup a pmq.
Definition: util-prefilter.c:37
PatternMatchThreadDestroy
void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
Definition: detect-engine-mpm.c:963
TmModule_::flags
uint8_t flags
Definition: tm-modules.h:80
VarNameStoreActivate
int VarNameStoreActivate(void)
Definition: util-var-name.c:214
DetectEngineThreadCtx_::counter_mpm_list
uint16_t counter_mpm_list
Definition: detect.h:1295
InspectionBufferMultipleForListGet
InspectionBuffer * InspectionBufferMultipleForListGet(DetectEngineThreadCtx *det_ctx, const int list_id, const uint32_t local_id)
for a InspectionBufferMultipleForList get a InspectionBuffer
Definition: detect-engine-inspect-buffer.c:76
RuleMatchCandidateTxArrayInit
void RuleMatchCandidateTxArrayInit(DetectEngineThreadCtx *det_ctx, uint32_t size)
Definition: detect.c:1069
SCProfilingKeywordThreadSetup
void SCProfilingKeywordThreadSetup(SCProfileKeywordDetectCtx *ctx, DetectEngineThreadCtx *det_ctx)
Definition: util-profiling-keywords.c:284
util-threshold-config.h
DetectEngineReloadIsStart
int DetectEngineReloadIsStart(void)
Definition: detect-engine.c:1902
DetectRegisterThreadCtxGlobalFuncs
int DetectRegisterThreadCtxGlobalFuncs(const char *name, void *(*InitFunc)(void *), void *data, void(*FreeFunc)(void *))
Register Thread keyword context Funcs (Global)
Definition: detect-engine.c:3744
DetectEngineThreadCtx_::post_rule_work_queue
PostRuleMatchWorkQueue post_rule_work_queue
Definition: detect.h:1345
DetectEngineThreadCtx_::tenant_array_size
uint32_t tenant_array_size
Definition: detect.h:1259
DetectEngineThreadCtx_::tenant_array
struct DetectEngineTenantMapping_ * tenant_array
Definition: detect.h:1258
suricata_ctl_flags
volatile uint8_t suricata_ctl_flags
Definition: suricata.c:172
DetectEnginePktInspectionEngine::v1
struct DetectEnginePktInspectionEngine::@91 v1
detect-engine-threshold.h
TM_FLAG_FLOWWORKER_TM
#define TM_FLAG_FLOWWORKER_TM
Definition: tm-modules.h:34
FlowWorkerReplaceDetectCtx
void FlowWorkerReplaceDetectCtx(void *flow_worker, void *detect_ctx)
Definition: flow-worker.c:740
StringHashDjb2
uint32_t StringHashDjb2(const uint8_t *data, uint32_t datalen)
Definition: util-hash-string.c:22
DetectEngineBufferTypeGetByIdTransforms
int DetectEngineBufferTypeGetByIdTransforms(DetectEngineCtx *de_ctx, const int id, TransformData *transforms, int transform_cnt)
Definition: detect-engine.c:1654
DetectEngineThreadCtx_::TenantGetId
uint32_t(* TenantGetId)(const void *, const Packet *p)
Definition: detect.h:1261
SCProfilingPrefilterThreadSetup
void SCProfilingPrefilterThreadSetup(SCProfilePrefilterDetectCtx *ctx, DetectEngineThreadCtx *det_ctx)
Definition: util-profiling-prefilter.c:245
SCClassConfDeInitContext
void SCClassConfDeInitContext(DetectEngineCtx *de_ctx)
Releases resources used by the Classification Config API.
Definition: util-classification-config.c:190
PrefilterPktNonPFStatsDump
void PrefilterPktNonPFStatsDump(void)
Definition: detect-engine-prefilter.c:590
DetectBufferType_::description
char description[128]
Definition: detect.h:451
SIG_FLAG_REQUIRE_PACKET
#define SIG_FLAG_REQUIRE_PACKET
Definition: detect.h:254
DetectEngineFrameInspectionEngine::smd
SigMatchData * smd
Definition: detect.h:520
DetectEngineThreadCtx_::match_array
Signature ** match_array
Definition: detect.h:1333