suricata
detect-engine.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2022 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #include "suricata-common.h"
25 #include "suricata.h"
26 #include "detect.h"
27 #include "flow.h"
28 #include "flow-private.h"
29 #include "flow-util.h"
30 #include "flow-worker.h"
31 #include "conf.h"
32 #include "conf-yaml-loader.h"
33 #include "datasets.h"
34 
35 #include "app-layer-parser.h"
36 #include "app-layer-events.h"
37 #include "app-layer-htp.h"
38 
39 #include "detect-parse.h"
40 #include "detect-engine-sigorder.h"
41 
42 #include "detect-engine-build.h"
43 #include "detect-engine-siggroup.h"
44 #include "detect-engine-address.h"
45 #include "detect-engine-port.h"
47 #include "detect-engine-mpm.h"
48 #include "detect-engine-iponly.h"
49 #include "detect-engine-tag.h"
50 #include "detect-engine-frame.h"
51 
52 #include "detect-engine-file.h"
53 
54 #include "detect-engine.h"
55 #include "detect-engine-state.h"
56 #include "detect-engine-payload.h"
57 #include "detect-fast-pattern.h"
58 #include "detect-byte-extract.h"
59 #include "detect-content.h"
60 #include "detect-uricontent.h"
61 #include "detect-tcphdr.h"
64 
65 #include "detect-engine-loader.h"
66 
67 #include "detect-engine-alert.h"
68 
70 #include "util-reference-config.h"
71 #include "util-threshold-config.h"
72 #include "util-error.h"
73 #include "util-hash.h"
74 #include "util-byte.h"
75 #include "util-debug.h"
76 #include "util-unittest.h"
77 #include "util-action.h"
78 #include "util-magic.h"
79 #include "util-signal.h"
80 #include "util-spm.h"
81 #include "util-device-private.h"
82 #include "util-var-name.h"
83 #include "util-path.h"
84 #include "util-profiling.h"
85 #include "util-validate.h"
86 #include "util-hash-string.h"
87 #include "util-enum.h"
88 #include "util-conf.h"
89 
90 #include "tm-threads.h"
91 #include "runmodes.h"
92 
93 #include "reputation.h"
94 
95 #define DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT 3000
96 
97 static int DetectEngineCtxLoadConf(DetectEngineCtx *);
98 
99 static DetectEngineMasterCtx g_master_de_ctx = { SCMUTEX_INITIALIZER,
100  0, 99, NULL, NULL, TENANT_SELECTOR_UNKNOWN, NULL, NULL, 0};
101 
102 static uint32_t TenantIdHash(HashTable *h, void *data, uint16_t data_len);
103 static char TenantIdCompare(void *d1, uint16_t d1_len, void *d2, uint16_t d2_len);
104 static void TenantIdFree(void *d);
105 static uint32_t DetectEngineTenantGetIdFromLivedev(const void *ctx, const Packet *p);
106 static uint32_t DetectEngineTenantGetIdFromVlanId(const void *ctx, const Packet *p);
107 static uint32_t DetectEngineTenantGetIdFromPcap(const void *ctx, const Packet *p);
108 
109 static bool DetectEngineMultiTenantEnabledWithLock(void);
110 static DetectEngineAppInspectionEngine *g_app_inspect_engines = NULL;
111 static DetectEnginePktInspectionEngine *g_pkt_inspect_engines = NULL;
112 static DetectEngineFrameInspectionEngine *g_frame_inspect_engines = NULL;
113 
114 // clang-format off
115 // rule types documentation tag start: SignatureProperties
117  /* SIG_TYPE_NOT_SET */ { SIG_PROP_FLOW_ACTION_PACKET, },
118  /* SIG_TYPE_IPONLY */ { SIG_PROP_FLOW_ACTION_FLOW, },
119  /* SIG_TYPE_LIKE_IPONLY */ { SIG_PROP_FLOW_ACTION_FLOW, },
120  /* SIG_TYPE_PDONLY */ { SIG_PROP_FLOW_ACTION_FLOW, },
121  /* SIG_TYPE_DEONLY */ { SIG_PROP_FLOW_ACTION_PACKET, },
122  /* SIG_TYPE_PKT */ { SIG_PROP_FLOW_ACTION_PACKET, },
123  /* SIG_TYPE_PKT_STREAM */ { SIG_PROP_FLOW_ACTION_FLOW_IF_STATEFUL, },
124  /* SIG_TYPE_STREAM */ { SIG_PROP_FLOW_ACTION_FLOW_IF_STATEFUL, },
125  /* SIG_TYPE_APPLAYER */ { SIG_PROP_FLOW_ACTION_FLOW, },
126  /* SIG_TYPE_APP_TX */ { SIG_PROP_FLOW_ACTION_FLOW, },
127 };
128 // rule types documentation tag end: SignatureProperties
129 // clang-format on
130 
131 const char *DetectTableToString(enum DetectTable table)
132 {
133  switch (table) {
135  return "not_set";
137  return "pre_flow";
139  return "pre_stream";
141  return "packet_filter";
143  return "packet_td";
145  return "app_filter";
146  case DETECT_TABLE_APP_TD:
147  return "app_td";
148  default:
149  return "unknown";
150  }
151 }
152 
153 /** \brief register inspect engine at start up time
154  *
155  * \note errors are fatal */
159 {
161  const int sm_list = DetectBufferTypeGetByName(name);
162  if (sm_list == -1) {
163  FatalError("failed to register inspect engine %s", name);
164  }
165 
166  if ((sm_list < DETECT_SM_LIST_MATCH) || (sm_list >= SHRT_MAX) ||
167  (Callback == NULL))
168  {
169  SCLogError("Invalid arguments");
170  BUG_ON(1);
171  }
172 
173  DetectEnginePktInspectionEngine *new_engine = SCCalloc(1, sizeof(*new_engine));
174  if (unlikely(new_engine == NULL)) {
175  FatalError("failed to register inspect engine %s: %s", name, strerror(errno));
176  }
177  new_engine->sm_list = (uint16_t)sm_list;
178  new_engine->sm_list_base = (uint16_t)sm_list;
179  new_engine->v1.Callback = Callback;
180  new_engine->v1.GetData = GetPktData;
181 
182  if (g_pkt_inspect_engines == NULL) {
183  g_pkt_inspect_engines = new_engine;
184  } else {
185  DetectEnginePktInspectionEngine *t = g_pkt_inspect_engines;
186  while (t->next != NULL) {
187  t = t->next;
188  }
189 
190  t->next = new_engine;
191  }
192 }
193 
194 /** \brief register inspect engine at start up time
195  *
196  * \note errors are fatal */
197 static void AppLayerInspectEngineRegisterInternal(const char *name, AppProto alproto, uint32_t dir,
198  int progress, InspectEngineFuncPtr Callback, InspectionBufferGetDataPtr GetData,
199  InspectionSingleBufferGetDataPtr GetDataSingle,
200  InspectionMultiBufferGetDataPtr GetMultiData)
201 {
202  BUG_ON(progress >= 48);
203 
205  const int sm_list = DetectBufferTypeGetByName(name);
206  if (sm_list == -1) {
207  FatalError("failed to register inspect engine %s", name);
208  }
209  SCLogDebug("name %s id %d", name, sm_list);
210 
211  if ((alproto == ALPROTO_FAILED) || (!(dir == SIG_FLAG_TOSERVER || dir == SIG_FLAG_TOCLIENT)) ||
212  (sm_list < DETECT_SM_LIST_MATCH) || (sm_list >= SHRT_MAX) ||
213  (progress < 0 || progress >= SHRT_MAX) || (Callback == NULL)) {
214  SCLogError("Invalid arguments");
215  BUG_ON(1);
216  } else if (Callback == DetectEngineInspectBufferGeneric && GetData == NULL) {
217  SCLogError("Invalid arguments: must register "
218  "GetData with DetectEngineInspectBufferGeneric");
219  BUG_ON(1);
220  } else if (Callback == DetectEngineInspectBufferSingle && GetDataSingle == NULL) {
221  SCLogError("Invalid arguments: must register "
222  "GetData with DetectEngineInspectBufferGeneric");
223  BUG_ON(1);
224  } else if (Callback == DetectEngineInspectMultiBufferGeneric && GetMultiData == NULL) {
225  SCLogError("Invalid arguments: must register "
226  "GetData with DetectEngineInspectMultiBufferGeneric");
227  BUG_ON(1);
228  }
229 
230  uint8_t direction;
231  if (dir == SIG_FLAG_TOSERVER) {
232  direction = 0;
233  } else {
234  direction = 1;
235  }
236  // every DNS or HTTP2 can be accessed from DOH2
237  if (alproto == ALPROTO_HTTP2 || alproto == ALPROTO_DNS) {
238  AppLayerInspectEngineRegisterInternal(
239  name, ALPROTO_DOH2, dir, progress, Callback, GetData, GetDataSingle, GetMultiData);
240  }
241 
242  DetectEngineAppInspectionEngine *new_engine =
244  if (unlikely(new_engine == NULL)) {
245  exit(EXIT_FAILURE);
246  }
247  new_engine->alproto = alproto;
248  new_engine->dir = direction;
249  new_engine->sm_list = (uint16_t)sm_list;
250  new_engine->sm_list_base = (uint16_t)sm_list;
251  new_engine->progress = (int16_t)progress;
252  new_engine->v2.Callback = Callback;
253  if (Callback == DetectEngineInspectBufferGeneric) {
254  new_engine->v2.GetData = GetData;
255  } else if (Callback == DetectEngineInspectBufferSingle) {
256  new_engine->v2.GetDataSingle = GetDataSingle;
257  } else if (Callback == DetectEngineInspectMultiBufferGeneric) {
258  new_engine->v2.GetMultiData = GetMultiData;
259  }
260 
261  if (g_app_inspect_engines == NULL) {
262  g_app_inspect_engines = new_engine;
263  } else {
264  DetectEngineAppInspectionEngine *t = g_app_inspect_engines;
265  while (t->next != NULL) {
266  t = t->next;
267  }
268 
269  t->next = new_engine;
270  }
271 }
272 
273 void DetectAppLayerInspectEngineRegister(const char *name, AppProto alproto, uint32_t dir,
274  int progress, InspectEngineFuncPtr Callback, InspectionBufferGetDataPtr GetData)
275 {
276  /* before adding, check that we don't add a duplicate entry, which will
277  * propagate all the way into the packet runtime if allowed. */
278  DetectEngineAppInspectionEngine *t = g_app_inspect_engines;
279  while (t != NULL) {
280  const uint32_t t_direction = t->dir == 0 ? SIG_FLAG_TOSERVER : SIG_FLAG_TOCLIENT;
281  const int sm_list = DetectBufferTypeGetByName(name);
282 
283  if (t->sm_list == sm_list && t->alproto == alproto && t_direction == dir &&
284  t->progress == progress && t->v2.Callback == Callback && t->v2.GetData == GetData) {
286  return;
287  }
288  t = t->next;
289  }
290 
291  AppLayerInspectEngineRegisterInternal(
292  name, alproto, dir, progress, Callback, GetData, NULL, NULL);
293 }
294 
295 void DetectAppLayerInspectEngineRegisterSingle(const char *name, AppProto alproto, uint32_t dir,
296  int progress, InspectEngineFuncPtr Callback, InspectionSingleBufferGetDataPtr GetData)
297 {
298  /* before adding, check that we don't add a duplicate entry, which will
299  * propagate all the way into the packet runtime if allowed. */
300  DetectEngineAppInspectionEngine *t = g_app_inspect_engines;
301  while (t != NULL) {
302  const uint32_t t_direction = t->dir == 0 ? SIG_FLAG_TOSERVER : SIG_FLAG_TOCLIENT;
303  const int sm_list = DetectBufferTypeGetByName(name);
304 
305  if (t->sm_list == sm_list && t->alproto == alproto && t_direction == dir &&
306  t->progress == progress && t->v2.Callback == Callback &&
307  t->v2.GetDataSingle == GetData) {
309  return;
310  }
311  t = t->next;
312  }
313 
314  AppLayerInspectEngineRegisterInternal(
315  name, alproto, dir, progress, Callback, NULL, GetData, NULL);
316 }
317 
318 /* copy an inspect engine with transforms to a new list id. */
319 static void DetectAppLayerInspectEngineCopy(
321  int sm_list, int new_list,
322  const DetectEngineTransforms *transforms)
323 {
324  const DetectEngineAppInspectionEngine *t = g_app_inspect_engines;
325  while (t) {
326  if (t->sm_list == sm_list) {
328  if (unlikely(new_engine == NULL)) {
329  exit(EXIT_FAILURE);
330  }
331  new_engine->alproto = t->alproto;
332  new_engine->dir = t->dir;
333  DEBUG_VALIDATE_BUG_ON(new_list < 0 || new_list > UINT16_MAX);
334  new_engine->sm_list = (uint16_t)new_list; /* use new list id */
335  DEBUG_VALIDATE_BUG_ON(sm_list < 0 || sm_list > UINT16_MAX);
336  new_engine->sm_list_base = (uint16_t)sm_list;
337  new_engine->progress = t->progress;
338  new_engine->v2 = t->v2;
339  new_engine->v2.transforms = transforms; /* assign transforms */
340 
341  if (de_ctx->app_inspect_engines == NULL) {
342  de_ctx->app_inspect_engines = new_engine;
343  } else {
345  while (list->next != NULL) {
346  list = list->next;
347  }
348 
349  list->next = new_engine;
350  }
351  }
352  t = t->next;
353  }
354 }
355 
356 /* copy inspect engines from global registrations to de_ctx list */
357 static void DetectAppLayerInspectEngineCopyListToDetectCtx(DetectEngineCtx *de_ctx)
358 {
359  const DetectEngineAppInspectionEngine *t = g_app_inspect_engines;
361  while (t) {
363  if (unlikely(new_engine == NULL)) {
364  exit(EXIT_FAILURE);
365  }
366  new_engine->alproto = t->alproto;
367  new_engine->dir = t->dir;
368  new_engine->sm_list = t->sm_list;
369  new_engine->sm_list_base = t->sm_list;
370  new_engine->progress = t->progress;
371  new_engine->v2 = t->v2;
372 
373  if (list == NULL) {
374  de_ctx->app_inspect_engines = new_engine;
375  } else {
376  list->next = new_engine;
377  }
378  list = new_engine;
379 
380  t = t->next;
381  }
382 }
383 
384 /* copy an inspect engine with transforms to a new list id. */
385 static void DetectPktInspectEngineCopy(
387  int sm_list, int new_list,
388  const DetectEngineTransforms *transforms)
389 {
390  const DetectEnginePktInspectionEngine *t = g_pkt_inspect_engines;
391  while (t) {
392  if (t->sm_list == sm_list) {
394  if (unlikely(new_engine == NULL)) {
395  exit(EXIT_FAILURE);
396  }
397  DEBUG_VALIDATE_BUG_ON(new_list < 0 || new_list > UINT16_MAX);
398  new_engine->sm_list = (uint16_t)new_list; /* use new list id */
399  DEBUG_VALIDATE_BUG_ON(sm_list < 0 || sm_list > UINT16_MAX);
400  new_engine->sm_list_base = (uint16_t)sm_list;
401  new_engine->v1 = t->v1;
402  new_engine->v1.transforms = transforms; /* assign transforms */
403 
404  if (de_ctx->pkt_inspect_engines == NULL) {
405  de_ctx->pkt_inspect_engines = new_engine;
406  } else {
408  while (list->next != NULL) {
409  list = list->next;
410  }
411 
412  list->next = new_engine;
413  }
414  }
415  t = t->next;
416  }
417 }
418 
419 /* copy inspect engines from global registrations to de_ctx list */
420 static void DetectPktInspectEngineCopyListToDetectCtx(DetectEngineCtx *de_ctx)
421 {
422  const DetectEnginePktInspectionEngine *t = g_pkt_inspect_engines;
423  while (t) {
424  SCLogDebug("engine %p", t);
426  if (unlikely(new_engine == NULL)) {
427  exit(EXIT_FAILURE);
428  }
429  new_engine->sm_list = t->sm_list;
430  new_engine->sm_list_base = t->sm_list;
431  new_engine->v1 = t->v1;
432 
433  if (de_ctx->pkt_inspect_engines == NULL) {
434  de_ctx->pkt_inspect_engines = new_engine;
435  } else {
437  while (list->next != NULL) {
438  list = list->next;
439  }
440 
441  list->next = new_engine;
442  }
443 
444  t = t->next;
445  }
446 }
447 
448 /** \brief register inspect engine at start up time
449  *
450  * \note errors are fatal */
452  InspectionBufferFrameInspectFunc Callback, AppProto alproto, uint8_t type)
453 {
454  const int sm_list = DetectEngineBufferTypeRegister(de_ctx, name);
455  if (sm_list < 0) {
456  FatalError("failed to register inspect engine %s", name);
457  }
458 
459  if ((sm_list < DETECT_SM_LIST_MATCH) || (sm_list >= SHRT_MAX) || (Callback == NULL)) {
460  SCLogError("Invalid arguments");
461  BUG_ON(1);
462  }
463 
464  uint8_t direction;
465  if (dir == SIG_FLAG_TOSERVER) {
466  direction = 0;
467  } else {
468  direction = 1;
469  }
470 
471  DetectEngineFrameInspectionEngine *new_engine = SCCalloc(1, sizeof(*new_engine));
472  if (unlikely(new_engine == NULL)) {
473  FatalError("failed to register inspect engine %s: %s", name, strerror(errno));
474  }
475  new_engine->sm_list = (uint16_t)sm_list;
476  new_engine->sm_list_base = (uint16_t)sm_list;
477  new_engine->dir = direction;
478  new_engine->v1.Callback = Callback;
479  new_engine->alproto = alproto;
480  new_engine->type = type;
481 
482  if (de_ctx->frame_inspect_engines == NULL) {
483  de_ctx->frame_inspect_engines = new_engine;
484  } else {
486  while (list->next != NULL) {
487  list = list->next;
488  }
489 
490  list->next = new_engine;
491  }
492 }
493 
494 /* copy an inspect engine with transforms to a new list id. */
495 static void DetectFrameInspectEngineCopy(DetectEngineCtx *de_ctx, int sm_list, int new_list,
496  const DetectEngineTransforms *transforms)
497 {
498  /* take the list from the detect engine as the buffers can be registered
499  * dynamically. */
501  while (t) {
502  if (t->sm_list == sm_list) {
505  if (unlikely(new_engine == NULL)) {
506  exit(EXIT_FAILURE);
507  }
508  DEBUG_VALIDATE_BUG_ON(new_list < 0 || new_list > UINT16_MAX);
509  new_engine->sm_list = (uint16_t)new_list; /* use new list id */
510  DEBUG_VALIDATE_BUG_ON(sm_list < 0 || sm_list > UINT16_MAX);
511  new_engine->sm_list_base = (uint16_t)sm_list;
512  new_engine->dir = t->dir;
513  new_engine->alproto = t->alproto;
514  new_engine->type = t->type;
515  new_engine->v1 = t->v1;
516  new_engine->v1.transforms = transforms; /* assign transforms */
517 
518  /* append to the list */
520  while (list->next != NULL) {
521  list = list->next;
522  }
523 
524  list->next = new_engine;
525  }
526  t = t->next;
527  }
528 }
529 
530 /* copy inspect engines from global registrations to de_ctx list */
531 static void DetectFrameInspectEngineCopyListToDetectCtx(DetectEngineCtx *de_ctx)
532 {
533  const DetectEngineFrameInspectionEngine *t = g_frame_inspect_engines;
534  while (t) {
535  SCLogDebug("engine %p", t);
538  if (unlikely(new_engine == NULL)) {
539  exit(EXIT_FAILURE);
540  }
541  new_engine->sm_list = t->sm_list;
542  new_engine->sm_list_base = t->sm_list;
543  new_engine->dir = t->dir;
544  new_engine->alproto = t->alproto;
545  new_engine->type = t->type;
546  new_engine->v1 = t->v1;
547 
548  if (de_ctx->frame_inspect_engines == NULL) {
549  de_ctx->frame_inspect_engines = new_engine;
550  } else {
552  while (list->next != NULL) {
553  list = list->next;
554  }
555 
556  list->next = new_engine;
557  }
558 
559  t = t->next;
560  }
561 }
562 
563 /** \internal
564  * \brief append the stream inspection
565  *
566  * If stream inspection is MPM, then prepend it.
567  */
568 static void AppendStreamInspectEngine(
569  Signature *s, SigMatchData *stream, uint8_t direction, uint8_t id)
570 {
571  bool prepend = false;
572 
574  if (unlikely(new_engine == NULL)) {
575  exit(EXIT_FAILURE);
576  }
578  SCLogDebug("stream is mpm");
579  prepend = true;
580  new_engine->mpm = true;
581  }
582  new_engine->alproto = ALPROTO_UNKNOWN; /* all */
583  new_engine->dir = direction;
584  new_engine->stream = true;
585  new_engine->sm_list = DETECT_SM_LIST_PMATCH;
586  new_engine->sm_list_base = DETECT_SM_LIST_PMATCH;
587  new_engine->smd = stream;
588  new_engine->v2.Callback = DetectEngineInspectStream;
589  new_engine->progress = 0;
590 
591  /* append */
592  if (s->app_inspect == NULL) {
593  s->app_inspect = new_engine;
594  new_engine->id = DE_STATE_FLAG_BASE; /* id is used as flag in stateful detect */
595  } else if (prepend) {
596  new_engine->next = s->app_inspect;
597  s->app_inspect = new_engine;
598  new_engine->id = id;
599 
600  } else {
602  while (a->next != NULL) {
603  a = a->next;
604  }
605 
606  a->next = new_engine;
607  new_engine->id = id;
608  }
609  SCLogDebug("sid %u: engine %p/%u added", s->id, new_engine, new_engine->id);
610 }
611 
612 static void AppendFrameInspectEngine(DetectEngineCtx *de_ctx,
614  const int mpm_list)
615 {
616  bool prepend = false;
617 
618  if (u->alproto == ALPROTO_UNKNOWN) {
619  /* special case, inspect engine applies to all protocols */
620  } else if (s->alproto != ALPROTO_UNKNOWN && !AppProtoEquals(s->alproto, u->alproto))
621  return;
622 
623  if (s->flags & SIG_FLAG_TOSERVER && !(s->flags & SIG_FLAG_TOCLIENT)) {
624  if (u->dir == 1)
625  return;
626  } else if (s->flags & SIG_FLAG_TOCLIENT && !(s->flags & SIG_FLAG_TOSERVER)) {
627  if (u->dir == 0)
628  return;
629  }
630 
633  if (unlikely(new_engine == NULL)) {
634  exit(EXIT_FAILURE);
635  }
636  if (mpm_list == u->sm_list) {
638  prepend = true;
639  new_engine->mpm = true;
640  }
641 
642  new_engine->type = u->type;
643  new_engine->sm_list = u->sm_list;
644  new_engine->sm_list_base = u->sm_list_base;
645  new_engine->smd = smd;
646  new_engine->v1 = u->v1;
647  SCLogDebug("sm_list %d new_engine->v1 %p/%p", new_engine->sm_list, new_engine->v1.Callback,
648  new_engine->v1.transforms);
649 
650  if (s->frame_inspect == NULL) {
651  s->frame_inspect = new_engine;
652  } else if (prepend) {
653  new_engine->next = s->frame_inspect;
654  s->frame_inspect = new_engine;
655  } else {
657  while (a->next != NULL) {
658  a = a->next;
659  }
660  new_engine->next = a->next;
661  a->next = new_engine;
662  }
663 }
664 
665 static void AppendPacketInspectEngine(DetectEngineCtx *de_ctx,
667  const int mpm_list)
668 {
669  bool prepend = false;
670 
671  DetectEnginePktInspectionEngine *new_engine =
673  if (unlikely(new_engine == NULL)) {
674  exit(EXIT_FAILURE);
675  }
676  if (mpm_list == e->sm_list) {
678  prepend = true;
679  new_engine->mpm = true;
680  }
681 
682  new_engine->sm_list = e->sm_list;
683  new_engine->sm_list_base = e->sm_list_base;
684  new_engine->smd = smd;
685  new_engine->v1 = e->v1;
686  SCLogDebug("sm_list %d new_engine->v1 %p/%p/%p", new_engine->sm_list, new_engine->v1.Callback,
687  new_engine->v1.GetData, new_engine->v1.transforms);
688 
689  if (s->pkt_inspect == NULL) {
690  s->pkt_inspect = new_engine;
691  } else if (prepend) {
692  new_engine->next = s->pkt_inspect;
693  s->pkt_inspect = new_engine;
694  } else {
696  while (a->next != NULL) {
697  a = a->next;
698  }
699  new_engine->next = a->next;
700  a->next = new_engine;
701  }
702 }
703 
704 static void AppendAppInspectEngine(DetectEngineCtx *de_ctx,
706  const int mpm_list, const int files_id, uint8_t *last_id, bool *head_is_mpm)
707 {
708  if (t->alproto == ALPROTO_UNKNOWN) {
709  /* special case, inspect engine applies to all protocols */
710  } else if (s->alproto != ALPROTO_UNKNOWN && !AppProtoEquals(s->alproto, t->alproto))
711  return;
712 
713  if (s->flags & SIG_FLAG_TOSERVER && !(s->flags & SIG_FLAG_TOCLIENT)) {
714  if (t->dir == 1)
715  return;
716  } else if (s->flags & SIG_FLAG_TOCLIENT && !(s->flags & SIG_FLAG_TOSERVER)) {
717  if (t->dir == 0)
718  return;
719  }
720  SCLogDebug("app engine: t %p t->id %u => alproto:%s files:%s", t, t->id,
721  AppProtoToString(t->alproto), BOOL2STR(t->sm_list == files_id));
722 
723  DetectEngineAppInspectionEngine *new_engine =
725  if (unlikely(new_engine == NULL)) {
726  exit(EXIT_FAILURE);
727  }
728  bool prepend = false;
729  if (mpm_list == t->sm_list) {
731  prepend = true;
732  *head_is_mpm = true;
733  new_engine->mpm = true;
734  }
735 
736  new_engine->alproto = t->alproto;
737  new_engine->dir = t->dir;
738  new_engine->sm_list = t->sm_list;
739  new_engine->sm_list_base = t->sm_list_base;
740  new_engine->smd = smd;
741  new_engine->match_on_null = smd ? DetectContentInspectionMatchOnAbsentBuffer(smd) : false;
742  new_engine->progress = t->progress;
743  new_engine->v2 = t->v2;
744  SCLogDebug("sm_list %d new_engine->v2 %p/%p/%p", new_engine->sm_list, new_engine->v2.Callback,
745  new_engine->v2.GetData, new_engine->v2.transforms);
746 
747  if (s->app_inspect == NULL) {
748  s->app_inspect = new_engine;
749  if (new_engine->sm_list == files_id) {
750  new_engine->id = DE_STATE_ID_FILE_INSPECT;
751  SCLogDebug("sid %u: engine %p/%u is FILE ENGINE", s->id, new_engine, new_engine->id);
752  } else {
753  new_engine->id = DE_STATE_FLAG_BASE; /* id is used as flag in stateful detect */
754  SCLogDebug("sid %u: engine %p/%u %s", s->id, new_engine, new_engine->id,
756  }
757 
758  /* prepend engine if forced or if our engine has a lower progress. */
759  } else if (prepend || (!(*head_is_mpm) && s->app_inspect->progress > new_engine->progress)) {
760  new_engine->next = s->app_inspect;
761  s->app_inspect = new_engine;
762  if (new_engine->sm_list == files_id) {
763  new_engine->id = DE_STATE_ID_FILE_INSPECT;
764  SCLogDebug("sid %u: engine %p/%u is FILE ENGINE", s->id, new_engine, new_engine->id);
765  } else {
766  new_engine->id = ++(*last_id);
767  SCLogDebug("sid %u: engine %p/%u %s", s->id, new_engine, new_engine->id,
769  }
770 
771  } else {
773  while (a->next != NULL) {
774  if (a->next && a->next->progress > new_engine->progress) {
775  break;
776  }
777  a = a->next;
778  }
779 
780  new_engine->next = a->next;
781  a->next = new_engine;
782  if (new_engine->sm_list == files_id) {
783  new_engine->id = DE_STATE_ID_FILE_INSPECT;
784  SCLogDebug("sid %u: engine %p/%u is FILE ENGINE", s->id, new_engine, new_engine->id);
785  } else {
786  new_engine->id = ++(*last_id);
787  SCLogDebug("sid %u: engine %p/%u %s", s->id, new_engine, new_engine->id,
789  }
790  }
791 
792  SCLogDebug("sid %u: engine %p/%u added", s->id, new_engine, new_engine->id);
793 
795 }
796 
797 /**
798  * \note for the file inspect engine, the id DE_STATE_ID_FILE_INSPECT
799  * is assigned.
800  */
802 {
803  const int mpm_list = s->init_data->mpm_sm ? s->init_data->mpm_sm_list : -1;
804  const int files_id = DetectBufferTypeGetByName("files");
805  bool head_is_mpm = false;
806  uint8_t last_id = DE_STATE_FLAG_BASE;
807  SCLogDebug("%u: setup app inspect engines. %u buffers", s->id, s->init_data->buffer_index);
808 
809  for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
811  SCLogDebug("smd %p, id %u", smd, s->init_data->buffers[x].id);
812 
813  const DetectBufferType *b =
815  if (b == NULL)
816  FatalError("unknown buffer");
817 
818  if (b->frame) {
820  u != NULL; u = u->next) {
821  if (u->sm_list == s->init_data->buffers[x].id) {
822  AppendFrameInspectEngine(de_ctx, u, s, smd, mpm_list);
823  }
824  }
825  } else if (b->packet) {
826  /* set up pkt inspect engines */
827  for (const DetectEnginePktInspectionEngine *e = de_ctx->pkt_inspect_engines; e != NULL;
828  e = e->next) {
829  SCLogDebug("e %p sm_list %u", e, e->sm_list);
830  if (e->sm_list == s->init_data->buffers[x].id) {
831  AppendPacketInspectEngine(de_ctx, e, s, smd, mpm_list);
832  }
833  }
834  } else {
835  SCLogDebug("app %s id %u parent %u rule %u xforms %u", b->name, b->id, b->parent_id,
836  s->init_data->buffers[x].id, b->transforms.cnt);
837  for (const DetectEngineAppInspectionEngine *t = de_ctx->app_inspect_engines; t != NULL;
838  t = t->next) {
839  if (t->sm_list == s->init_data->buffers[x].id) {
840  if (s->flags & SIG_FLAG_TXBOTHDIR) {
841  // ambiguous keywords have app engines in both directions
842  // so we skip the wrong direction for this buffer
843  if (s->init_data->buffers[x].only_tc && t->dir == 0) {
844  continue;
845  } else if (s->init_data->buffers[x].only_ts && t->dir == 1) {
846  continue;
847  }
848  }
849  AppendAppInspectEngine(
850  de_ctx, t, s, smd, mpm_list, files_id, &last_id, &head_is_mpm);
851  }
852  }
853  }
854  }
855 
856  /* handle rules that have an app-layer hook w/o bringing their own app inspect engine,
857  * e.g. `alert dns:request_complete ... (sid:1;)`
858  *
859  * Here we use a minimal stub inspect engine in which we set:
860  * - alproto
861  * - progress
862  * - sm_list/sm_list_base to get the mapping to the hook name
863  * - dir based on sig direction
864  *
865  * The inspect engine has no callback and is thus considered a straight match.
866  */
868  uint8_t dir = 0;
872  if (s->flags & SIG_FLAG_TOSERVER)
873  dir = 0;
874  else if (s->flags & SIG_FLAG_TOCLIENT)
875  dir = 1;
876 
878  .alproto = s->init_data->hook.t.app.alproto,
879  .progress = (uint16_t)s->init_data->hook.t.app.app_progress,
880  .sm_list = (uint16_t)s->init_data->hook.sm_list,
881  .sm_list_base = (uint16_t)s->init_data->hook.sm_list,
882  .dir = dir,
883  };
884  AppendAppInspectEngine(de_ctx, &t, s, NULL, mpm_list, files_id, &last_id, &head_is_mpm);
885  }
886 
889  {
890  /* if engine is added multiple times, we pass it the same list */
892  BUG_ON(stream == NULL);
893  if (s->flags & SIG_FLAG_TOSERVER && !(s->flags & SIG_FLAG_TOCLIENT)) {
894  AppendStreamInspectEngine(s, stream, 0, last_id + 1);
895  } else if (s->flags & SIG_FLAG_TOCLIENT && !(s->flags & SIG_FLAG_TOSERVER)) {
896  AppendStreamInspectEngine(s, stream, 1, last_id + 1);
897  } else {
898  AppendStreamInspectEngine(s, stream, 0, last_id + 1);
899  AppendStreamInspectEngine(s, stream, 1, last_id + 1);
900  }
901 
903  SCLogDebug("set SIG_FLAG_FLUSH on %u", s->id);
904  s->flags |= SIG_FLAG_FLUSH;
905  }
906  }
907 
908 #ifdef DEBUG
910  while (iter) {
911  SCLogDebug("%u: engine %s id %u progress %d %s", s->id,
913  iter->sm_list == mpm_list ? "MPM" : "");
914  iter = iter->next;
915  }
916 #endif
917  return 0;
918 }
919 
920 /** \brief free app inspect engines for a signature
921  *
922  * For lists that are registered multiple times, like http_header and
923  * http_cookie, making the engines owner of the lists is complicated.
924  * Multiple engines in a sig may be pointing to the same list. To
925  * address this the 'free' code needs to be extra careful about not
926  * double freeing, so it takes an approach to first fill an array
927  * of the to-free pointers before freeing them.
928  */
930 {
931  int engines = 0;
932 
934  while (ie) {
935  ie = ie->next;
936  engines++;
937  }
939  while (e) {
940  e = e->next;
941  engines++;
942  }
944  while (u) {
945  u = u->next;
946  engines++;
947  }
948  if (engines == 0) {
949  BUG_ON(s->pkt_inspect);
950  BUG_ON(s->frame_inspect);
951  return;
952  }
953 
954  SigMatchData *bufs[engines];
955  memset(&bufs, 0, (engines * sizeof(SigMatchData *)));
956  int arrays = 0;
957 
958  /* free engines and put smd in the array */
959  ie = s->app_inspect;
960  while (ie) {
962 
963  bool skip = false;
964  for (int i = 0; i < arrays; i++) {
965  if (bufs[i] == ie->smd) {
966  skip = true;
967  break;
968  }
969  }
970  if (!skip) {
971  bufs[arrays++] = ie->smd;
972  }
973  SCFree(ie);
974  ie = next;
975  }
976  e = s->pkt_inspect;
977  while (e) {
979 
980  bool skip = false;
981  for (int i = 0; i < arrays; i++) {
982  if (bufs[i] == e->smd) {
983  skip = true;
984  break;
985  }
986  }
987  if (!skip) {
988  bufs[arrays++] = e->smd;
989  }
990  SCFree(e);
991  e = next;
992  }
993  u = s->frame_inspect;
994  while (u) {
996 
997  bool skip = false;
998  for (int i = 0; i < arrays; i++) {
999  if (bufs[i] == u->smd) {
1000  skip = true;
1001  break;
1002  }
1003  }
1004  if (!skip) {
1005  bufs[arrays++] = u->smd;
1006  }
1007  SCFree(u);
1008  u = next;
1009  }
1010 
1011  for (int i = 0; i < engines; i++) {
1012  if (bufs[i] == NULL)
1013  continue;
1014  SigMatchData *smd = bufs[i];
1015  while (1) {
1016  if (sigmatch_table[smd->type].Free != NULL) {
1017  sigmatch_table[smd->type].Free(de_ctx, smd->ctx);
1018  }
1019  if (smd->is_last)
1020  break;
1021  smd++;
1022  }
1023  SCFree(bufs[i]);
1024  }
1025 }
1026 
1027 /* code for registering buffers */
1028 
1029 #include "util-hash-lookup3.h"
1030 
1031 static HashListTable *g_buffer_type_hash = NULL;
1032 static int g_buffer_type_id = DETECT_SM_LIST_DYNAMIC_START;
1033 static int g_buffer_type_reg_closed = 0;
1034 
1036 {
1037  return g_buffer_type_id;
1038 }
1039 
1040 static void DetectBufferAddTransformData(DetectBufferType *map)
1041 {
1042  for (int i = 0; i < map->transforms.cnt; i++) {
1043  const TransformData *t = &map->transforms.transforms[i];
1046  &map->xform_id[i].id_data, &map->xform_id[i].id_data_len, t->options);
1047  SCLogDebug("transform identity data: [%p] \"%s\" [%d]", map->xform_id[i].id_data,
1048  (char *)map->xform_id[i].id_data, map->xform_id[i].id_data_len);
1049  }
1050  }
1051 }
1052 
1053 static uint32_t DetectBufferTypeHashNameFunc(HashListTable *ht, void *data, uint16_t datalen)
1054 {
1055  const DetectBufferType *map = (DetectBufferType *)data;
1056  uint32_t hash = hashlittle_safe(map->name, strlen(map->name), 0);
1057 
1058  // Add the transform data
1059  // - Collect transform id and position
1060  // - Collect identity data, if any
1061  hash += hashlittle_safe((uint8_t *)&map->transforms.cnt, sizeof(map->transforms.cnt), 0);
1062  for (int i = 0; i < map->transforms.cnt; i++) {
1063  const TransformData *t = &map->transforms.transforms[i];
1064  int tval = t->transform;
1065  hash += hashlittle_safe((uint8_t *)&tval, sizeof(tval), 0);
1066  if (map->xform_id[i].id_data) {
1067  hash += hashlittle_safe(
1068  &map->xform_id[i].id_data_len, sizeof(map->xform_id[i].id_data_len), 0);
1069  hash += hashlittle_safe(map->xform_id[i].id_data, map->xform_id[i].id_data_len, 0);
1070  }
1071  }
1072  hash %= ht->array_size;
1073  SCLogDebug("map->name %s, hash %d", map->name, hash);
1074  return hash;
1075 }
1076 
1077 static uint32_t DetectBufferTypeHashIdFunc(HashListTable *ht, void *data, uint16_t datalen)
1078 {
1079  const DetectBufferType *map = (DetectBufferType *)data;
1080  uint32_t hash = map->id;
1081  hash %= ht->array_size;
1082  return hash;
1083 }
1084 
1085 static char DetectBufferTypeCompareNameFunc(void *data1, uint16_t len1, void *data2, uint16_t len2)
1086 {
1087  DetectBufferType *map1 = (DetectBufferType *)data1;
1088  DetectBufferType *map2 = (DetectBufferType *)data2;
1089 
1090  char r = (strcmp(map1->name, map2->name) == 0);
1091 
1092  // Compare the transforms
1093  // the transform supports identity, that data will also be added.
1094  r &= map1->transforms.cnt == map2->transforms.cnt;
1095  if (r && map1->transforms.cnt) {
1096  for (int i = 0; i < map1->transforms.cnt; i++) {
1097  if (map1->transforms.transforms[i].transform !=
1098  map2->transforms.transforms[i].transform) {
1099  r = 0;
1100  break;
1101  }
1102 
1103  SCLogDebug("%s: transform ids match; checking specialized data", map1->name);
1104  // Checks
1105  // - Both NULL: --> ok, continue
1106  // - One NULL: --> no match, break?
1107  // - identity data lengths match: --> ok, continue
1108  // - identity data matches: ok
1109 
1110  // Stop if only one is NULL
1111  if ((map1->xform_id[i].id_data == NULL) ^ (map2->xform_id[i].id_data == NULL)) {
1112  SCLogDebug("identity data: only one is null");
1113  r = 0;
1114  break;
1115  } else if (map1->xform_id[i].id_data == NULL) { /* continue when both are null */
1116  SCLogDebug("identity data: both null");
1117  r = 1;
1118  continue;
1119  } else if (map1->xform_id[i].id_data_len != map2->xform_id[i].id_data_len) {
1120  // Stop when id data lengths aren't equal
1121  SCLogDebug("id data: unequal lengths");
1122  r = 0;
1123  break;
1124  }
1125 
1126  // stop if the identity data is different
1127  r &= memcmp(map1->xform_id[i].id_data, map2->xform_id[i].id_data,
1128  map1->xform_id[i].id_data_len) == 0;
1129  if (r == 0)
1130  break;
1131  SCLogDebug("identity data: data matches");
1132  }
1133  }
1134  return r;
1135 }
1136 
1137 static char DetectBufferTypeCompareIdFunc(void *data1, uint16_t len1, void *data2, uint16_t len2)
1138 {
1139  DetectBufferType *map1 = (DetectBufferType *)data1;
1140  DetectBufferType *map2 = (DetectBufferType *)data2;
1141  return map1->id == map2->id;
1142 }
1143 
1144 static void DetectBufferTypeFreeFunc(void *data)
1145 {
1146  DetectBufferType *map = (DetectBufferType *)data;
1147 
1148  if (map == NULL) {
1149  return;
1150  }
1151 
1152  /* Release transformation option memory, if any */
1153  for (int i = 0; i < map->transforms.cnt; i++) {
1154  if (map->transforms.transforms[i].options == NULL)
1155  continue;
1156 
1157  if (sigmatch_table[map->transforms.transforms[i].transform].Free == NULL) {
1158  SCLogError("%s allocates transform option memory but has no free routine",
1160  continue;
1161  }
1163  }
1164 
1165  SCFree(map);
1166 }
1167 
1168 static int DetectBufferTypeInit(void)
1169 {
1170  BUG_ON(g_buffer_type_hash);
1171  g_buffer_type_hash = HashListTableInit(256, DetectBufferTypeHashNameFunc,
1172  DetectBufferTypeCompareNameFunc, DetectBufferTypeFreeFunc);
1173  if (g_buffer_type_hash == NULL)
1174  return -1;
1175 
1176  return 0;
1177 }
1178 #if 0
1179 static void DetectBufferTypeFree(void)
1180 {
1181  if (g_buffer_type_hash == NULL)
1182  return;
1183 
1184  HashListTableFree(g_buffer_type_hash);
1185  g_buffer_type_hash = NULL;
1186 }
1187 #endif
1188 static int DetectBufferTypeAdd(const char *string)
1189 {
1190  BUG_ON(string == NULL || strlen(string) >= 64);
1191 
1192  DetectBufferType *map = SCCalloc(1, sizeof(*map));
1193  if (map == NULL)
1194  return -1;
1195 
1196  strlcpy(map->name, string, sizeof(map->name));
1197  map->id = g_buffer_type_id++;
1198 
1199  BUG_ON(HashListTableAdd(g_buffer_type_hash, (void *)map, 0) != 0);
1200  SCLogDebug("buffer %s registered with id %d", map->name, map->id);
1201  return map->id;
1202 }
1203 
1204 static DetectBufferType *DetectBufferTypeLookupByName(const char *string)
1205 {
1206  DetectBufferType map;
1207  memset(&map, 0, sizeof(map));
1208  strlcpy(map.name, string, sizeof(map.name));
1209 
1210  DetectBufferType *res = HashListTableLookup(g_buffer_type_hash, &map, 0);
1211  return res;
1212 }
1213 
1215 {
1216  BUG_ON(g_buffer_type_reg_closed);
1217  if (g_buffer_type_hash == NULL)
1218  DetectBufferTypeInit();
1219 
1220  DetectBufferType *exists = DetectBufferTypeLookupByName(name);
1221  if (!exists) {
1222  return DetectBufferTypeAdd(name);
1223  } else {
1224  return exists->id;
1225  }
1226 }
1227 
1229 {
1230  BUG_ON(g_buffer_type_reg_closed);
1232  DetectBufferType *exists = DetectBufferTypeLookupByName(name);
1233  BUG_ON(!exists);
1234  exists->multi_instance = true;
1235  SCLogDebug("%p %s -- %d supports multi instance", exists, name, exists->id);
1236 }
1237 
1239 {
1240  BUG_ON(g_buffer_type_reg_closed);
1242  DetectBufferType *exists = DetectBufferTypeLookupByName(name);
1243  BUG_ON(!exists);
1244  exists->frame = true;
1245  SCLogDebug("%p %s -- %d supports frame inspection", exists, name, exists->id);
1246 }
1247 
1249 {
1250  BUG_ON(g_buffer_type_reg_closed);
1252  DetectBufferType *exists = DetectBufferTypeLookupByName(name);
1253  BUG_ON(!exists);
1254  exists->packet = true;
1255  SCLogDebug("%p %s -- %d supports packet inspection", exists, name, exists->id);
1256 }
1257 
1259 {
1260  BUG_ON(g_buffer_type_reg_closed);
1262  DetectBufferType *exists = DetectBufferTypeLookupByName(name);
1263  BUG_ON(!exists);
1264  exists->mpm = true;
1265  SCLogDebug("%p %s -- %d supports mpm", exists, name, exists->id);
1266 }
1267 
1269 {
1270  BUG_ON(g_buffer_type_reg_closed);
1272  DetectBufferType *exists = DetectBufferTypeLookupByName(name);
1273  BUG_ON(!exists);
1274  exists->supports_transforms = true;
1275  SCLogDebug("%p %s -- %d supports transformations", exists, name, exists->id);
1276 }
1277 
1279 {
1280  DetectBufferType *exists = DetectBufferTypeLookupByName(name);
1281  if (!exists) {
1282  return -1;
1283  }
1284  return exists->id;
1285 }
1286 
1287 static DetectBufferType *DetectEngineBufferTypeLookupByName(
1288  const DetectEngineCtx *de_ctx, const char *string)
1289 {
1290  DetectBufferType map;
1291  memset(&map, 0, sizeof(map));
1292  strlcpy(map.name, string, sizeof(map.name));
1293 
1295  return res;
1296 }
1297 
1299 {
1300  DetectBufferType lookup;
1301  memset(&lookup, 0, sizeof(lookup));
1302  lookup.id = id;
1303  const DetectBufferType *res =
1304  HashListTableLookup(de_ctx->buffer_type_hash_id, (void *)&lookup, 0);
1305  return res;
1306 }
1307 
1309 {
1311  return res ? res->name : NULL;
1312 }
1313 
1314 static int DetectEngineBufferTypeAdd(DetectEngineCtx *de_ctx, const char *string)
1315 {
1316  BUG_ON(string == NULL || strlen(string) >= 32);
1317 
1318  DetectBufferType *map = SCCalloc(1, sizeof(*map));
1319  if (map == NULL)
1320  return -1;
1321 
1322  strlcpy(map->name, string, sizeof(map->name));
1323  map->id = de_ctx->buffer_type_id++;
1324 
1325  BUG_ON(HashListTableAdd(de_ctx->buffer_type_hash_name, (void *)map, 0) != 0);
1326  BUG_ON(HashListTableAdd(de_ctx->buffer_type_hash_id, (void *)map, 0) != 0);
1327  SCLogDebug("buffer %s registered with id %d", map->name, map->id);
1328  return map->id;
1329 }
1330 
1332  const int direction, const AppProto alproto, const uint8_t frame_type)
1333 {
1334  DetectBufferType *exists = DetectEngineBufferTypeLookupByName(de_ctx, name);
1335  if (exists) {
1336  return exists->id;
1337  }
1338 
1339  const int buffer_id = DetectEngineBufferTypeAdd(de_ctx, name);
1340  if (buffer_id < 0) {
1341  return -1;
1342  }
1343 
1344  /* TODO hack we need the map to get the name. Should we return the map at reg? */
1345  const DetectBufferType *map = DetectEngineBufferTypeGetById(de_ctx, buffer_id);
1346  BUG_ON(!map);
1347 
1348  /* register MPM/inspect engines */
1349  if (direction & SIG_FLAG_TOSERVER) {
1351  PrefilterGenericMpmFrameRegister, alproto, frame_type);
1353  DetectEngineInspectFrameBufferGeneric, alproto, frame_type);
1354  }
1355  if (direction & SIG_FLAG_TOCLIENT) {
1357  PrefilterGenericMpmFrameRegister, alproto, frame_type);
1359  DetectEngineInspectFrameBufferGeneric, alproto, frame_type);
1360  }
1361 
1362  return buffer_id;
1363 }
1364 
1366 {
1367  DetectBufferType *exists = DetectEngineBufferTypeLookupByName(de_ctx, name);
1368  if (!exists) {
1369  return DetectEngineBufferTypeAdd(de_ctx, name);
1370  } else {
1371  return exists->id;
1372  }
1373 }
1374 
1375 void DetectBufferTypeSetDescriptionByName(const char *name, const char *desc)
1376 {
1377  BUG_ON(desc == NULL || strlen(desc) >= 128);
1378 
1379  DetectBufferType *exists = DetectBufferTypeLookupByName(name);
1380  if (!exists) {
1381  return;
1382  }
1383  strlcpy(exists->description, desc, sizeof(exists->description));
1384 }
1385 
1387 {
1389  if (!exists) {
1390  return NULL;
1391  }
1392  return exists->description;
1393 }
1394 
1396 {
1397  DetectBufferType *exists = DetectEngineBufferTypeLookupByName(de_ctx, name);
1398  BUG_ON(!exists);
1399  exists->frame = true;
1400  SCLogDebug("%p %s -- %d supports frame inspection", exists, name, exists->id);
1401 }
1402 
1404 {
1405  DetectBufferType *exists = DetectEngineBufferTypeLookupByName(de_ctx, name);
1406  BUG_ON(!exists);
1407  exists->packet = true;
1408  SCLogDebug("%p %s -- %d supports packet inspection", exists, name, exists->id);
1409 }
1410 
1412 {
1413  DetectBufferType *exists = DetectEngineBufferTypeLookupByName(de_ctx, name);
1414  BUG_ON(!exists);
1415  exists->mpm = true;
1416  SCLogDebug("%p %s -- %d supports mpm", exists, name, exists->id);
1417 }
1418 
1420 {
1421  DetectBufferType *exists = DetectEngineBufferTypeLookupByName(de_ctx, name);
1422  BUG_ON(!exists);
1423  exists->supports_transforms = true;
1424  SCLogDebug("%p %s -- %d supports transformations", exists, name, exists->id);
1425 }
1426 
1428 {
1430  if (map == NULL)
1431  return false;
1432  SCLogDebug("map %p id %d multi_instance? %s", map, id, BOOL2STR(map->multi_instance));
1433  return map->multi_instance;
1434 }
1435 
1437 {
1439  if (map == NULL)
1440  return false;
1441  SCLogDebug("map %p id %d packet? %d", map, id, map->packet);
1442  return map->packet;
1443 }
1444 
1446 {
1448  if (map == NULL)
1449  return false;
1450  SCLogDebug("map %p id %d mpm? %d", map, id, map->mpm);
1451  return map->mpm;
1452 }
1453 
1455 {
1457  if (map == NULL)
1458  return false;
1459  SCLogDebug("map %p id %d frame? %d", map, id, map->frame);
1460  return map->frame;
1461 }
1462 
1464  void (*SetupCallback)(const DetectEngineCtx *, Signature *))
1465 {
1466  BUG_ON(g_buffer_type_reg_closed);
1468  DetectBufferType *exists = DetectBufferTypeLookupByName(name);
1469  BUG_ON(!exists);
1470  exists->SetupCallback = SetupCallback;
1471 }
1472 
1474 {
1476  if (map && map->SetupCallback) {
1477  map->SetupCallback(de_ctx, s);
1478  }
1479 }
1480 
1482  const char *name, bool (*ValidateCallback)(const Signature *, const char **sigerror,
1483  const DetectBufferType *))
1484 {
1485  BUG_ON(g_buffer_type_reg_closed);
1487  DetectBufferType *exists = DetectBufferTypeLookupByName(name);
1488  BUG_ON(!exists);
1489  exists->ValidateCallback = ValidateCallback;
1490 }
1491 
1493  const DetectEngineCtx *de_ctx, const int id, const Signature *s, const char **sigerror)
1494 {
1496  // only run validation if the buffer is not transformed
1497  if (map && map->ValidateCallback && map->transforms.cnt == 0) {
1498  return map->ValidateCallback(s, sigerror, map);
1499  }
1500  return true;
1501 }
1502 
1503 bool DetectBufferIsPresent(const Signature *s, const uint32_t buf_id)
1504 {
1505  for (uint32_t i = 0; i < s->init_data->buffer_index; i++) {
1506  if (buf_id == s->init_data->buffers[i].id) {
1507  return true;
1508  }
1509  }
1510  return false;
1511 }
1512 
1513 /** \brief Check content byte array compatibility with transforms
1514  *
1515  * The "content" array is presented to the transforms so that each
1516  * transform may validate that it's compatible with the transform.
1517  *
1518  * When a transform indicates the byte array is incompatible, none of the
1519  * subsequent transforms, if any, are invoked. This means the first validation
1520  * failure terminates the loop.
1521  *
1522  * \param de_ctx Detection engine context.
1523  * \param sm_list The SM list id.
1524  * \param content The byte array being validated
1525  * \param namestr returns the name of the transform that is incompatible with
1526  * content.
1527  *
1528  * \retval true (false) If any of the transforms indicate the byte array is
1529  * (is not) compatible.
1530  **/
1532  const uint8_t *content, uint16_t content_len, const char **namestr)
1533 {
1534  const DetectBufferType *dbt = DetectEngineBufferTypeGetById(de_ctx, sm_list);
1535  BUG_ON(dbt == NULL);
1536 
1537  for (int i = 0; i < dbt->transforms.cnt; i++) {
1538  const TransformData *t = &dbt->transforms.transforms[i];
1540  continue;
1541 
1542  if (sigmatch_table[t->transform].TransformValidate(content, content_len, t->options)) {
1543  continue;
1544  }
1545 
1546  if (namestr) {
1547  *namestr = sigmatch_table[t->transform].name;
1548  }
1549 
1550  return false;
1551  }
1552 
1553  return true;
1554 }
1555 
1556 static void DetectBufferTypeSetupDetectEngine(DetectEngineCtx *de_ctx)
1557 {
1558  const int size = g_buffer_type_id;
1559  BUG_ON(!(size > 0));
1560 
1561  de_ctx->buffer_type_hash_name = HashListTableInit(256, DetectBufferTypeHashNameFunc,
1562  DetectBufferTypeCompareNameFunc, DetectBufferTypeFreeFunc);
1565  HashListTableInit(256, DetectBufferTypeHashIdFunc, DetectBufferTypeCompareIdFunc,
1566  NULL); // entries owned by buffer_type_hash_name
1567  BUG_ON(de_ctx->buffer_type_hash_id == NULL);
1568  de_ctx->buffer_type_id = g_buffer_type_id;
1569 
1570  SCLogDebug("DETECT_SM_LIST_DYNAMIC_START %u", DETECT_SM_LIST_DYNAMIC_START);
1571  HashListTableBucket *b = HashListTableGetListHead(g_buffer_type_hash);
1572  while (b) {
1574 
1575  DetectBufferType *copy = SCCalloc(1, sizeof(*copy));
1576  BUG_ON(!copy);
1577  memcpy(copy, map, sizeof(*copy));
1578  int r = HashListTableAdd(de_ctx->buffer_type_hash_name, (void *)copy, 0);
1579  BUG_ON(r != 0);
1580  r = HashListTableAdd(de_ctx->buffer_type_hash_id, (void *)copy, 0);
1581  BUG_ON(r != 0);
1582 
1583  SCLogDebug("name %s id %d mpm %s packet %s -- %s. "
1584  "Callbacks: Setup %p Validate %p",
1585  map->name, map->id, map->mpm ? "true" : "false", map->packet ? "true" : "false",
1586  map->description, map->SetupCallback, map->ValidateCallback);
1587  b = HashListTableGetListNext(b);
1588  }
1589 
1592  DetectAppLayerInspectEngineCopyListToDetectCtx(de_ctx);
1594  DetectFrameInspectEngineCopyListToDetectCtx(de_ctx);
1596  DetectPktInspectEngineCopyListToDetectCtx(de_ctx);
1597 }
1598 
1599 static void DetectBufferTypeFreeDetectEngine(DetectEngineCtx *de_ctx)
1600 {
1601  if (de_ctx) {
1606 
1608  while (ilist) {
1610  SCFree(ilist);
1611  ilist = next;
1612  }
1614  while (mlist) {
1615  DetectBufferMpmRegistry *next = mlist->next;
1616  SCFree(mlist);
1617  mlist = next;
1618  }
1620  while (plist) {
1622  SCFree(plist);
1623  plist = next;
1624  }
1626  while (pmlist) {
1627  DetectBufferMpmRegistry *next = pmlist->next;
1628  SCFree(pmlist);
1629  pmlist = next;
1630  }
1632  while (framelist) {
1634  SCFree(framelist);
1635  framelist = next;
1636  }
1638  while (framemlist) {
1639  DetectBufferMpmRegistry *next = framemlist->next;
1640  SCFree(framemlist);
1641  framemlist = next;
1642  }
1644  }
1645 }
1646 
1648 {
1649  BUG_ON(g_buffer_type_hash == NULL);
1650 
1651  g_buffer_type_reg_closed = 1;
1652 }
1653 
1655  DetectEngineCtx *de_ctx, const int id, TransformData *transforms, int transform_cnt)
1656 {
1657  const DetectBufferType *base_map = DetectEngineBufferTypeGetById(de_ctx, id);
1658  if (!base_map) {
1659  return -1;
1660  }
1661  if (!base_map->supports_transforms) {
1662  SCLogError("buffer '%s' does not support transformations", base_map->name);
1663  return -1;
1664  }
1665 
1666  SCLogDebug("base_map %s", base_map->name);
1667 
1669  memset(&t, 0, sizeof(t));
1670  for (int i = 0; i < transform_cnt; i++) {
1671  t.transforms[i] = transforms[i];
1672  }
1673  t.cnt = transform_cnt;
1674 
1675  DetectBufferType lookup_map;
1676  memset(&lookup_map, 0, sizeof(lookup_map));
1677  strlcpy(lookup_map.name, base_map->name, sizeof(lookup_map.name));
1678  lookup_map.transforms = t;
1679 
1680  /* Add transform identity data from transforms */
1681  if (t.cnt) {
1682  DetectBufferAddTransformData(&lookup_map);
1683  }
1685 
1686  SCLogDebug("res %p", res);
1687  if (res != NULL) {
1688  return res->id;
1689  }
1690 
1691  DetectBufferType *map = SCCalloc(1, sizeof(*map));
1692  if (map == NULL)
1693  return -1;
1694 
1695  strlcpy(map->name, base_map->name, sizeof(map->name));
1696  map->id = de_ctx->buffer_type_id++;
1697  map->parent_id = base_map->id;
1698  map->transforms = t;
1699  map->mpm = base_map->mpm;
1700  map->packet = base_map->packet;
1701  map->frame = base_map->frame;
1702  map->SetupCallback = base_map->SetupCallback;
1703  map->ValidateCallback = base_map->ValidateCallback;
1704  if (map->frame) {
1706  } else if (map->packet) {
1708  map->id, map->parent_id, &map->transforms);
1709  } else {
1711  map->id, map->parent_id, &map->transforms);
1712  }
1713 
1714  BUG_ON(HashListTableAdd(de_ctx->buffer_type_hash_name, (void *)map, 0) != 0);
1715  BUG_ON(HashListTableAdd(de_ctx->buffer_type_hash_id, (void *)map, 0) != 0);
1716  SCLogDebug("buffer %s registered with id %d, parent %d", map->name, map->id, map->parent_id);
1717 
1718  if (map->frame) {
1719  DetectFrameInspectEngineCopy(de_ctx, map->parent_id, map->id, &map->transforms);
1720  } else if (map->packet) {
1721  DetectPktInspectEngineCopy(de_ctx, map->parent_id, map->id, &map->transforms);
1722  } else {
1723  DetectAppLayerInspectEngineCopy(de_ctx, map->parent_id, map->id, &map->transforms);
1724  }
1725  return map->id;
1726 }
1727 
1728 /* returns false if no match, true if match */
1729 static int DetectEngineInspectRulePacketMatches(
1730  DetectEngineThreadCtx *det_ctx,
1731  const DetectEnginePktInspectionEngine *engine,
1732  const Signature *s,
1733  Packet *p, uint8_t *_alert_flags)
1734 {
1735  SCEnter();
1736 
1737  /* run the packet match functions */
1739  const SigMatchData *smd = s->sm_arrays[DETECT_SM_LIST_MATCH];
1740 
1741  SCLogDebug("running match functions, sm %p", smd);
1742  while (1) {
1744  if (sigmatch_table[smd->type].Match(det_ctx, p, s, smd->ctx) <= 0) {
1745  KEYWORD_PROFILING_END(det_ctx, smd->type, 0);
1746  SCLogDebug("no match");
1748  }
1749  KEYWORD_PROFILING_END(det_ctx, smd->type, 1);
1750  if (smd->is_last) {
1751  SCLogDebug("match and is_last");
1752  break;
1753  }
1754  smd++;
1755  }
1757 }
1758 
1759 static int DetectEngineInspectRulePayloadMatches(
1760  DetectEngineThreadCtx *det_ctx,
1761  const DetectEnginePktInspectionEngine *engine,
1762  const Signature *s, Packet *p, uint8_t *alert_flags)
1763 {
1764  SCEnter();
1765 
1766  DetectEngineCtx *de_ctx = det_ctx->de_ctx;
1767 
1769  /* if we have stream msgs, inspect against those first,
1770  * but not for a "dsize" signature */
1771  if (s->flags & SIG_FLAG_REQUIRE_STREAM) {
1772  int pmatch = 0;
1773  if (p->flags & PKT_DETECT_HAS_STREAMDATA) {
1774  pmatch = DetectEngineInspectStreamPayload(de_ctx, det_ctx, s, p->flow, p);
1775  if (pmatch) {
1776  *alert_flags |= PACKET_ALERT_FLAG_STREAM_MATCH;
1777  }
1778  }
1779  /* no match? then inspect packet payload */
1780  if (pmatch == 0) {
1781  SCLogDebug("no match in stream, fall back to packet payload");
1782 
1783  /* skip if we don't have to inspect the packet and segment was
1784  * added to stream */
1785  if (!(s->flags & SIG_FLAG_REQUIRE_PACKET) && (p->flags & PKT_STREAM_ADD)) {
1787  }
1789  SCLogDebug("SIG_FLAG_REQUIRE_STREAM_ONLY, so no match");
1791  }
1792  if (DetectEngineInspectPacketPayload(de_ctx, det_ctx, s, p->flow, p) != 1) {
1794  }
1795  }
1796  } else {
1797  if (DetectEngineInspectPacketPayload(de_ctx, det_ctx, s, p->flow, p) != 1) {
1799  }
1800  }
1802 }
1803 
1805  DetectEngineThreadCtx *det_ctx, const Signature *s,
1806  Flow *f, Packet *p,
1807  uint8_t *alert_flags)
1808 {
1809  SCEnter();
1810 
1811  for (DetectEnginePktInspectionEngine *e = s->pkt_inspect; e != NULL; e = e->next) {
1812  if (e->v1.Callback(det_ctx, e, s, p, alert_flags) != DETECT_ENGINE_INSPECT_SIG_MATCH) {
1813  SCLogDebug("sid %u: e %p Callback returned no match", s->id, e);
1814  return false;
1815  }
1816  SCLogDebug("sid %u: e %p Callback returned true", s->id, e);
1817  }
1818 
1819  SCLogDebug("sid %u: returning true", s->id);
1820  return true;
1821 }
1822 
1823 /**
1824  * \param data pointer to SigMatchData. Allowed to be NULL.
1825  */
1826 static int DetectEnginePktInspectionAppend(Signature *s, InspectionBufferPktInspectFunc Callback,
1827  SigMatchData *data, const int list_id)
1828 {
1829  DetectEnginePktInspectionEngine *e = SCCalloc(1, sizeof(*e));
1830  if (e == NULL)
1831  return -1;
1832 
1833  e->mpm = s->init_data->mpm_sm_list == list_id;
1834  DEBUG_VALIDATE_BUG_ON(list_id < 0 || list_id > UINT16_MAX);
1835  e->sm_list = (uint16_t)list_id;
1836  e->sm_list_base = (uint16_t)list_id;
1837  e->v1.Callback = Callback;
1838  e->smd = data;
1839 
1840  if (s->pkt_inspect == NULL) {
1841  s->pkt_inspect = e;
1842  } else {
1844  while (a->next != NULL) {
1845  a = a->next;
1846  }
1847  a->next = e;
1848  }
1849  return 0;
1850 }
1851 
1853 {
1854  /* only handle PMATCH here if we're not an app inspect rule */
1856  if (DetectEnginePktInspectionAppend(
1857  s, DetectEngineInspectRulePayloadMatches, NULL, DETECT_SM_LIST_PMATCH) < 0)
1858  return -1;
1859  SCLogDebug("sid %u: DetectEngineInspectRulePayloadMatches appended", s->id);
1860  }
1861 
1862  if (s->sm_arrays[DETECT_SM_LIST_MATCH]) {
1863  if (DetectEnginePktInspectionAppend(
1864  s, DetectEngineInspectRulePacketMatches, NULL, DETECT_SM_LIST_MATCH) < 0)
1865  return -1;
1866  SCLogDebug("sid %u: DetectEngineInspectRulePacketMatches appended", s->id);
1867  }
1868 
1869  return 0;
1870 }
1871 
1872 /* code to control the main thread to do a reload */
1873 
1875  IDLE, /**< ready to start a reload */
1876  RELOAD, /**< command main thread to do the reload */
1877 };
1878 
1879 
1880 typedef struct DetectEngineSyncer_ {
1884 
1885 static DetectEngineSyncer detect_sync = { SCMUTEX_INITIALIZER, IDLE };
1886 
1887 /* tell main to start reloading */
1889 {
1890  int r = 0;
1891  SCMutexLock(&detect_sync.m);
1892  if (detect_sync.state == IDLE) {
1893  detect_sync.state = RELOAD;
1894  } else {
1895  r = -1;
1896  }
1897  SCMutexUnlock(&detect_sync.m);
1898  return r;
1899 }
1900 
1901 /* main thread checks this to see if it should start */
1903 {
1904  int r = 0;
1905  SCMutexLock(&detect_sync.m);
1906  if (detect_sync.state == RELOAD) {
1907  r = 1;
1908  }
1909  SCMutexUnlock(&detect_sync.m);
1910  return r;
1911 }
1912 
1913 /* main thread sets done when it's done */
1915 {
1916  SCMutexLock(&detect_sync.m);
1917  detect_sync.state = IDLE;
1918  SCMutexUnlock(&detect_sync.m);
1919 }
1920 
1921 /* caller loops this until it returns 1 */
1923 {
1924  int r = 0;
1925  SCMutexLock(&detect_sync.m);
1926  if (detect_sync.state == IDLE) {
1927  r = 1;
1928  }
1929  SCMutexUnlock(&detect_sync.m);
1930  return r;
1931 }
1932 
1933 /** \brief Do the content inspection & validation for a signature
1934  *
1935  * \param de_ctx Detection engine context
1936  * \param det_ctx Detection engine thread context
1937  * \param s Signature to inspect
1938  * \param sm SigMatch to inspect
1939  * \param f Flow
1940  * \param flags app layer flags
1941  * \param state App layer state
1942  *
1943  * \retval 0 no match
1944  * \retval 1 match
1945  */
1947  const struct DetectEngineAppInspectionEngine_ *engine, const Signature *s, Flow *f,
1948  uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
1949 {
1950  SigMatchData *smd = engine->smd;
1951  SCLogDebug("running match functions, sm %p", smd);
1952  if (smd != NULL) {
1953  while (1) {
1954  int match = 0;
1956  match = sigmatch_table[smd->type].
1957  AppLayerTxMatch(det_ctx, f, flags, alstate, txv, s, smd->ctx);
1958  KEYWORD_PROFILING_END(det_ctx, smd->type, (match == 1));
1959  if (match == 0)
1961  if (match == 2) {
1963  }
1964 
1965  if (smd->is_last)
1966  break;
1967  smd++;
1968  }
1969  }
1970 
1972 }
1973 
1974 /**
1975  * \brief Do the content inspection & validation for a signature
1976  *
1977  * \param de_ctx Detection engine context
1978  * \param det_ctx Detection engine thread context
1979  * \param s Signature to inspect
1980  * \param f Flow
1981  * \param flags app layer flags
1982  * \param state App layer state
1983  *
1984  * \retval 0 no match.
1985  * \retval 1 match.
1986  * \retval 2 Sig can't match.
1987  */
1989  const DetectEngineAppInspectionEngine *engine, const Signature *s, Flow *f, uint8_t flags,
1990  void *alstate, void *txv, uint64_t tx_id)
1991 {
1992  const int list_id = engine->sm_list;
1993  SCLogDebug("running inspect on %d", list_id);
1994 
1995  const bool eof =
1996  (AppLayerParserGetStateProgress(f->proto, f->alproto, txv, flags) > engine->progress);
1997 
1998  SCLogDebug("list %d mpm? %s transforms %p", engine->sm_list, engine->mpm ? "true" : "false",
1999  engine->v2.transforms);
2000 
2001  /* if prefilter didn't already run, we need to consider transformations */
2002  const DetectEngineTransforms *transforms = NULL;
2003  if (!engine->mpm) {
2004  transforms = engine->v2.transforms;
2005  }
2006 
2007  const InspectionBuffer *buffer = DetectGetSingleData(
2008  det_ctx, transforms, f, flags, txv, list_id, engine->v2.GetDataSingle);
2009  if (unlikely(buffer == NULL)) {
2010  if (eof && engine->match_on_null) {
2012  }
2014  }
2015 
2016  const uint32_t data_len = buffer->inspect_len;
2017  const uint8_t *data = buffer->inspect;
2018  const uint64_t offset = buffer->inspect_offset;
2019 
2020  uint8_t ci_flags = eof ? DETECT_CI_FLAGS_END : 0;
2021  ci_flags |= (offset == 0 ? DETECT_CI_FLAGS_START : 0);
2022  ci_flags |= buffer->flags;
2023 
2024  /* Inspect all the uricontents fetched on each
2025  * transaction at the app layer */
2026  const bool match = DetectEngineContentInspection(de_ctx, det_ctx, s, engine->smd, NULL, f, data,
2028  if (match) {
2030  } else {
2032  }
2033 }
2034 
2035 /**
2036  * \brief Do the content inspection & validation for a signature
2037  *
2038  * \param de_ctx Detection engine context
2039  * \param det_ctx Detection engine thread context
2040  * \param s Signature to inspect
2041  * \param f Flow
2042  * \param flags app layer flags
2043  * \param state App layer state
2044  *
2045  * \retval 0 no match.
2046  * \retval 1 match.
2047  * \retval 2 Sig can't match.
2048  */
2050  const DetectEngineAppInspectionEngine *engine, const Signature *s, Flow *f, uint8_t flags,
2051  void *alstate, void *txv, uint64_t tx_id)
2052 {
2053  const int list_id = engine->sm_list;
2054  SCLogDebug("running inspect on %d", list_id);
2055 
2056  const bool eof = (AppLayerParserGetStateProgress(f->proto, f->alproto, txv, flags) > engine->progress);
2057 
2058  SCLogDebug("list %d mpm? %s transforms %p",
2059  engine->sm_list, engine->mpm ? "true" : "false", engine->v2.transforms);
2060 
2061  /* if prefilter didn't already run, we need to consider transformations */
2062  const DetectEngineTransforms *transforms = NULL;
2063  if (!engine->mpm) {
2064  transforms = engine->v2.transforms;
2065  }
2066 
2067  const InspectionBuffer *buffer = engine->v2.GetData(det_ctx, transforms,
2068  f, flags, txv, list_id);
2069  if (unlikely(buffer == NULL)) {
2070  if (eof && engine->match_on_null) {
2072  }
2075  }
2076 
2077  const uint32_t data_len = buffer->inspect_len;
2078  const uint8_t *data = buffer->inspect;
2079  const uint64_t offset = buffer->inspect_offset;
2080 
2081  uint8_t ci_flags = eof ? DETECT_CI_FLAGS_END : 0;
2082  ci_flags |= (offset == 0 ? DETECT_CI_FLAGS_START : 0);
2083  ci_flags |= buffer->flags;
2084 
2085  /* Inspect all the uricontents fetched on each
2086  * transaction at the app layer */
2087  const bool match = DetectEngineContentInspection(de_ctx, det_ctx, s, engine->smd, NULL, f, data,
2089  if (match) {
2091  } else {
2094  }
2095 }
2096 
2097 // wrapper for both DetectAppLayerInspectEngineRegister and DetectAppLayerMpmRegister
2098 // with cast of callback function
2099 void DetectAppLayerMultiRegister(const char *name, AppProto alproto, uint32_t dir, int progress,
2100  InspectionMultiBufferGetDataPtr GetData, int priority)
2101 {
2102  AppLayerInspectEngineRegisterInternal(name, alproto, dir, progress,
2103  DetectEngineInspectMultiBufferGeneric, NULL, NULL, GetData);
2105  name, dir, priority, PrefilterMultiGenericMpmRegister, GetData, alproto, progress);
2106 }
2107 
2109  const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv,
2110  const int list_id, InspectionSingleBufferGetDataPtr GetBuf)
2111 {
2112  InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
2113  if (buffer->inspect == NULL) {
2114  const uint8_t *b = NULL;
2115  uint32_t b_len = 0;
2116 
2117  if (!GetBuf(txv, flow_flags, &b, &b_len))
2118  return NULL;
2119 
2120  InspectionBufferSetupAndApplyTransforms(det_ctx, list_id, buffer, b, b_len, transforms);
2121  }
2122  return buffer;
2123 }
2124 
2126  const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv,
2127  const int list_id, uint32_t index, InspectionMultiBufferGetDataPtr GetBuf)
2128 {
2129  InspectionBuffer *buffer = InspectionBufferMultipleForListGet(det_ctx, list_id, index);
2130  if (buffer == NULL) {
2131  return NULL;
2132  }
2133  if (buffer->initialized) {
2134  return buffer;
2135  }
2136 
2137  const uint8_t *data = NULL;
2138  uint32_t data_len = 0;
2139 
2140  if (!GetBuf(det_ctx, txv, flow_flags, index, &data, &data_len)) {
2142  return NULL;
2143  }
2144  InspectionBufferSetupMulti(det_ctx, buffer, transforms, data, data_len);
2145  buffer->flags = DETECT_CI_FLAGS_SINGLE;
2146  return buffer;
2147 }
2148 
2151  const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
2152 {
2153  uint32_t local_id = 0;
2154  const DetectEngineTransforms *transforms = NULL;
2155  if (!engine->mpm) {
2156  transforms = engine->v2.transforms;
2157  }
2158 
2159  do {
2160  InspectionBuffer *buffer = DetectGetMultiData(det_ctx, transforms, f, flags, txv,
2161  engine->sm_list, local_id, engine->v2.GetMultiData);
2162 
2163  if (buffer == NULL || buffer->inspect == NULL)
2164  break;
2165 
2166  // The GetData functions set buffer->flags to DETECT_CI_FLAGS_SINGLE
2167  // This is not meant for streaming buffers
2168  const bool match = DetectEngineContentInspectionBuffer(de_ctx, det_ctx, s, engine->smd,
2170  if (match) {
2172  }
2173  local_id++;
2174  } while (1);
2175  if (local_id == 0) {
2176  // That means we did not get even one buffer value from the multi-buffer
2177  const bool eof = (AppLayerParserGetStateProgress(f->proto, f->alproto, txv, flags) >
2178  engine->progress);
2179  if (eof && engine->match_on_null) {
2181  }
2182  }
2184 }
2185 
2186 /**
2187  * \brief Do the content inspection & validation for a signature
2188  *
2189  * \param de_ctx Detection engine context
2190  * \param det_ctx Detection engine thread context
2191  * \param s Signature to inspect
2192  * \param p Packet
2193  *
2194  * \retval 0 no match.
2195  * \retval 1 match.
2196  */
2198  DetectEngineThreadCtx *det_ctx,
2199  const DetectEnginePktInspectionEngine *engine,
2200  const Signature *s, Packet *p, uint8_t *_alert_flags)
2201 {
2202  const int list_id = engine->sm_list;
2203  SCLogDebug("running inspect on %d", list_id);
2204 
2205  SCLogDebug("list %d transforms %p",
2206  engine->sm_list, engine->v1.transforms);
2207 
2208  /* if prefilter didn't already run, we need to consider transformations */
2209  const DetectEngineTransforms *transforms = NULL;
2210  if (!engine->mpm) {
2211  transforms = engine->v1.transforms;
2212  }
2213 
2214  const InspectionBuffer *buffer = engine->v1.GetData(det_ctx, transforms, p,
2215  list_id);
2216  if (unlikely(buffer == NULL)) {
2218  }
2219 
2220  uint8_t ci_flags = DETECT_CI_FLAGS_START|DETECT_CI_FLAGS_END;
2221  ci_flags |= buffer->flags;
2222 
2223  /* Inspect all the uricontents fetched on each
2224  * transaction at the app layer */
2225  const bool match = DetectEngineContentInspection(det_ctx->de_ctx, det_ctx, s, engine->smd, p,
2226  p->flow, buffer->inspect, buffer->inspect_len, 0, ci_flags,
2228  if (match) {
2230  } else {
2232  }
2233 }
2234 
2235 /** \internal
2236  * \brief inject a pseudo packet into each detect thread
2237  * if the thread should flush its output logs.
2238  */
2239 void InjectPacketsForFlush(ThreadVars **detect_tvs, int no_of_detect_tvs)
2240 {
2241  /* inject a fake packet if the detect thread that needs it. This function
2242  * is called when a heartbeat log-flush request has been made
2243  * and it should process a pseudo packet and flush its output logs
2244  * to speed the process. */
2245 #if DEBUG
2246  int count = 0;
2247 #endif
2248  for (int i = 0; i < no_of_detect_tvs; i++) {
2249  if (detect_tvs[i]) { // && detect_tvs[i]->inq != NULL) {
2250  Packet *p = PacketGetFromAlloc();
2251  if (p != NULL) {
2252  SCLogDebug("Injecting pkt for tv %s[i=%d] %d", detect_tvs[i]->name, i, count++);
2256  PacketQueue *q = detect_tvs[i]->stream_pq;
2257  SCMutexLock(&q->mutex_q);
2258  PacketEnqueue(q, p);
2259  SCCondSignal(&q->cond_q);
2260  SCMutexUnlock(&q->mutex_q);
2261  }
2262  }
2263  }
2264  SCLogDebug("leaving: thread notification count = %d", count);
2265 }
2266 
2267 /** \internal
2268  * \brief inject a pseudo packet into each detect thread
2269  * -that doesn't use the new det_ctx yet
2270  * -*or*, if the thread should flush its output logs.
2271  */
2272 static void InjectPackets(
2273  ThreadVars **detect_tvs, DetectEngineThreadCtx **new_det_ctx, int no_of_detect_tvs)
2274 {
2275  /* inject a fake packet if the detect thread that needs it. This function
2276  * is called if
2277  * - A thread isn't using a DE ctx and should
2278  * - Or, it should process a pseudo packet and flush its output logs.
2279  * to speed the process. */
2280  for (int i = 0; i < no_of_detect_tvs; i++) {
2281  if (SC_ATOMIC_GET(new_det_ctx[i]->so_far_used_by_detect) != 1) {
2282  if (detect_tvs[i]->inq != NULL) {
2283  Packet *p = PacketGetFromAlloc();
2284  if (p != NULL) {
2287  PacketQueue *q = detect_tvs[i]->inq->pq;
2288  SCMutexLock(&q->mutex_q);
2289  PacketEnqueue(q, p);
2290  SCCondSignal(&q->cond_q);
2291  SCMutexUnlock(&q->mutex_q);
2292  }
2293  }
2294  }
2295  }
2296 }
2297 
2298 /** \internal
2299  * \brief Update detect threads with new detect engine
2300  *
2301  * Atomically update each detect thread with a new thread context
2302  * that is associated to the new detection engine(s).
2303  *
2304  * If called in unix socket mode, it's possible that we don't have
2305  * detect threads yet.
2306  *
2307  * \retval -1 error
2308  * \retval 0 no detection threads
2309  * \retval 1 successful reload
2310  */
2311 static int DetectEngineReloadThreads(DetectEngineCtx *new_de_ctx)
2312 {
2313  SCEnter();
2314  uint32_t i = 0;
2315 
2316  /* count detect threads in use */
2317  uint32_t no_of_detect_tvs = TmThreadCountThreadsByTmmFlags(TM_FLAG_FLOWWORKER_TM);
2318  /* can be zero in unix socket mode */
2319  if (no_of_detect_tvs == 0) {
2320  return 0;
2321  }
2322 
2323  /* prepare swap structures */
2324  DetectEngineThreadCtx *old_det_ctx[no_of_detect_tvs];
2325  DetectEngineThreadCtx *new_det_ctx[no_of_detect_tvs];
2326  ThreadVars *detect_tvs[no_of_detect_tvs];
2327  memset(old_det_ctx, 0x00, (no_of_detect_tvs * sizeof(DetectEngineThreadCtx *)));
2328  memset(new_det_ctx, 0x00, (no_of_detect_tvs * sizeof(DetectEngineThreadCtx *)));
2329  memset(detect_tvs, 0x00, (no_of_detect_tvs * sizeof(ThreadVars *)));
2330 
2331  /* start the process of swapping detect threads ctxs */
2332 
2333  /* get reference to tv's and setup new_det_ctx array */
2335  for (ThreadVars *tv = tv_root[TVT_PPT]; tv != NULL; tv = tv->next) {
2336  if ((tv->tmm_flags & TM_FLAG_FLOWWORKER_TM) == 0) {
2337  continue;
2338  }
2339  for (TmSlot *s = tv->tm_slots; s != NULL; s = s->slot_next) {
2340  TmModule *tm = TmModuleGetById(s->tm_id);
2341  if (!(tm->flags & TM_FLAG_FLOWWORKER_TM)) {
2342  continue;
2343  }
2344 
2345  if (suricata_ctl_flags != 0) {
2347  goto error;
2348  }
2349 
2350  old_det_ctx[i] = FlowWorkerGetDetectCtxPtr(SC_ATOMIC_GET(s->slot_data));
2351  detect_tvs[i] = tv;
2352 
2353  new_det_ctx[i] = DetectEngineThreadCtxInitForReload(tv, new_de_ctx, 1);
2354  if (new_det_ctx[i] == NULL) {
2355  SCLogError("Detect engine thread init "
2356  "failure in live rule swap. Let's get out of here");
2358  goto error;
2359  }
2360  SCLogDebug("live rule swap created new det_ctx - %p and de_ctx "
2361  "- %p\n", new_det_ctx[i], new_de_ctx);
2362  i++;
2363  break;
2364  }
2365  }
2366  BUG_ON(i != no_of_detect_tvs);
2367 
2368  /* atomically replace the det_ctx data */
2369  i = 0;
2370  for (ThreadVars *tv = tv_root[TVT_PPT]; tv != NULL; tv = tv->next) {
2371  if ((tv->tmm_flags & TM_FLAG_FLOWWORKER_TM) == 0) {
2372  continue;
2373  }
2374  for (TmSlot *s = tv->tm_slots; s != NULL; s = s->slot_next) {
2375  TmModule *tm = TmModuleGetById(s->tm_id);
2376  if (!(tm->flags & TM_FLAG_FLOWWORKER_TM)) {
2377  continue;
2378  }
2379  SCLogDebug("swapping new det_ctx - %p with older one - %p",
2380  new_det_ctx[i], SC_ATOMIC_GET(s->slot_data));
2381  FlowWorkerReplaceDetectCtx(SC_ATOMIC_GET(s->slot_data), new_det_ctx[i++]);
2382  break;
2383  }
2384  }
2386 
2387  /* threads now all have new data, however they may not have started using
2388  * it and may still use the old data */
2389 
2390  SCLogDebug("Live rule swap has swapped %d old det_ctx's with new ones, "
2391  "along with the new de_ctx", no_of_detect_tvs);
2392 
2393  InjectPackets(detect_tvs, new_det_ctx, no_of_detect_tvs);
2394 
2395  /* loop waiting for detect threads to switch to the new det_ctx. Try to
2396  * wake up capture if needed (break loop). */
2397  uint32_t threads_done = 0;
2398 retry:
2399  for (i = 0; i < no_of_detect_tvs; i++) {
2400  if (suricata_ctl_flags != 0) {
2401  threads_done = no_of_detect_tvs;
2402  break;
2403  }
2404  SleepMsec(1);
2405  if (SC_ATOMIC_GET(new_det_ctx[i]->so_far_used_by_detect) == 1) {
2406  SCLogDebug("new_det_ctx - %p used by detect engine", new_det_ctx[i]);
2407  threads_done++;
2408  } else {
2409  TmThreadsCaptureBreakLoop(detect_tvs[i]);
2410  }
2411  }
2412  if (threads_done < no_of_detect_tvs) {
2413  threads_done = 0;
2414  SleepMsec(250);
2415  goto retry;
2416  }
2417 
2418  /* this is to make sure that if someone initiated shutdown during a live
2419  * rule swap, the live rule swap won't clean up the old det_ctx and
2420  * de_ctx, till all detect threads have stopped working and sitting
2421  * silently after setting RUNNING_DONE flag and while waiting for
2422  * THV_DEINIT flag */
2423  if (i != no_of_detect_tvs) { // not all threads we swapped
2424  for (ThreadVars *tv = tv_root[TVT_PPT]; tv != NULL; tv = tv->next) {
2425  if ((tv->tmm_flags & TM_FLAG_FLOWWORKER_TM) == 0) {
2426  continue;
2427  }
2428 
2430  SleepUsec(100);
2431  }
2432  }
2433  }
2434 
2435  /* free all the ctxs */
2436  for (i = 0; i < no_of_detect_tvs; i++) {
2437  SCLogDebug("Freeing old_det_ctx - %p used by detect",
2438  old_det_ctx[i]);
2439  DetectEngineThreadCtxDeinit(NULL, old_det_ctx[i]);
2440  }
2441 
2443 
2444  return 1;
2445 
2446  error:
2447  for (i = 0; i < no_of_detect_tvs; i++) {
2448  if (new_det_ctx[i] != NULL)
2449  DetectEngineThreadCtxDeinit(NULL, new_det_ctx[i]);
2450  }
2451  return -1;
2452 }
2453 
2455 {
2456  int sgh_mpm_caching = 0;
2457  if (SCConfGetBool("detect.sgh-mpm-caching", &sgh_mpm_caching) != 1) {
2458  return false;
2459  }
2460  return (bool)sgh_mpm_caching;
2461 }
2462 
2464 {
2465  if (DetectEngineMpmCachingEnabled() == false) {
2466  return NULL;
2467  }
2468 
2469  char yamlpath[] = "detect.sgh-mpm-caching-path";
2470  const char *strval = NULL;
2471  if (SCConfGet(yamlpath, &strval) == 1 && strval != NULL) {
2472  return strval;
2473  }
2474 
2475  static bool notified = false;
2476  if (!notified) {
2477  SCLogInfo("%s has no path specified, using %s", yamlpath, SGH_CACHE_DIR);
2478  notified = true;
2479  }
2480  return SGH_CACHE_DIR;
2481 }
2482 
2483 static DetectEngineCtx *DetectEngineCtxInitReal(
2484  enum DetectEngineType type, const char *prefix, uint32_t tenant_id)
2485 {
2487  if (unlikely(de_ctx == NULL))
2488  goto error;
2489 
2490  memset(&de_ctx->sig_stat, 0, sizeof(SigFileLoaderStat));
2491  TAILQ_INIT(&de_ctx->sig_stat.failed_sigs);
2492  de_ctx->sigerror = NULL;
2493  de_ctx->type = type;
2495  de_ctx->tenant_id = tenant_id;
2496 
2499  SCLogDebug("stub %u with version %u", type, de_ctx->version);
2500  return de_ctx;
2501  }
2502 
2503  if (prefix != NULL) {
2504  strlcpy(de_ctx->config_prefix, prefix, sizeof(de_ctx->config_prefix));
2505  }
2506 
2507  int failure_fatal = 0;
2508  if (SCConfGetBool("engine.init-failure-fatal", (int *)&failure_fatal) != 1) {
2509  SCLogDebug("ConfGetBool could not load the value.");
2510  }
2511  de_ctx->failure_fatal = (failure_fatal == 1);
2512 
2515  SCLogConfig("pattern matchers: MPM: %s, SPM: %s",
2518 
2521  if (de_ctx->mpm_cfg == NULL) {
2522  goto error;
2523  }
2524  }
2528  }
2529 
2531  if (de_ctx->spm_global_thread_ctx == NULL) {
2532  SCLogDebug("Unable to alloc SpmGlobalThreadCtx.");
2533  goto error;
2534  }
2535 
2537  if (de_ctx->sm_types_prefilter == NULL) {
2538  goto error;
2539  }
2541  if (de_ctx->sm_types_silent_error == NULL) {
2542  goto error;
2543  }
2544  if (DetectEngineCtxLoadConf(de_ctx) == -1) {
2545  goto error;
2546  }
2547 
2553  DetectBufferTypeSetupDetectEngine(de_ctx);
2555 
2556  /* init iprep... ignore errors for now */
2557  (void)SRepInit(de_ctx);
2558 
2562  goto error;
2563  }
2564 
2565  if (ActionInitConfig() < 0) {
2566  goto error;
2567  }
2569  if (SCRConfLoadReferenceConfigFile(de_ctx, NULL) < 0) {
2571  goto error;
2572  }
2573 
2575  SCLogDebug("dectx with version %u", de_ctx->version);
2576  return de_ctx;
2577 error:
2578  if (de_ctx != NULL) {
2580  }
2581  return NULL;
2582 }
2583 
2585 {
2586  return DetectEngineCtxInitReal(DETECT_ENGINE_TYPE_MT_STUB, NULL, 0);
2587 }
2588 
2590 {
2591  return DetectEngineCtxInitReal(DETECT_ENGINE_TYPE_DD_STUB, NULL, 0);
2592 }
2593 
2595 {
2596  return DetectEngineCtxInitReal(DETECT_ENGINE_TYPE_NORMAL, NULL, 0);
2597 }
2598 
2599 DetectEngineCtx *DetectEngineCtxInitWithPrefix(const char *prefix, uint32_t tenant_id)
2600 {
2601  if (prefix == NULL || strlen(prefix) == 0)
2602  return DetectEngineCtxInit();
2603  else
2604  return DetectEngineCtxInitReal(DETECT_ENGINE_TYPE_NORMAL, prefix, tenant_id);
2605 }
2606 
2607 static void DetectEngineCtxFreeThreadKeywordData(DetectEngineCtx *de_ctx)
2608 {
2610 }
2611 
2612 static void DetectEngineCtxFreeFailedSigs(DetectEngineCtx *de_ctx)
2613 {
2614  SigString *item = NULL;
2615  SigString *sitem;
2616 
2617  TAILQ_FOREACH_SAFE(item, &de_ctx->sig_stat.failed_sigs, next, sitem) {
2618  SCFree(item->filename);
2619  SCFree(item->sig_str);
2620  if (item->sig_error) {
2621  SCFree(item->sig_error);
2622  }
2623  TAILQ_REMOVE(&de_ctx->sig_stat.failed_sigs, item, next);
2624  SCFree(item);
2625  }
2626 }
2627 
2628 /**
2629  * \brief Free a DetectEngineCtx::
2630  *
2631  * \param de_ctx DetectEngineCtx:: to be freed
2632  */
2634 {
2635 
2636  if (de_ctx == NULL)
2637  return;
2638 
2639 #ifdef PROFILE_RULES
2640  if (de_ctx->profile_ctx != NULL) {
2641  SCProfilingRuleDestroyCtx(de_ctx->profile_ctx);
2642  de_ctx->profile_ctx = NULL;
2643  }
2644 #endif
2645 #ifdef PROFILING
2646  if (de_ctx->profile_keyword_ctx != NULL) {
2647  SCProfilingKeywordDestroyCtx(de_ctx);//->profile_keyword_ctx);
2648 // de_ctx->profile_keyword_ctx = NULL;
2649  }
2650  if (de_ctx->profile_sgh_ctx != NULL) {
2652  }
2654 #endif
2655 
2658  }
2659  /* Normally the hashes are freed elsewhere, but
2660  * to be sure look at them again here.
2661  */
2667  if (de_ctx->sig_array)
2669 
2670  if (de_ctx->filedata_config)
2672 
2676 
2678 
2682 
2684 
2685  DetectEngineCtxFreeThreadKeywordData(de_ctx);
2687  DetectEngineCtxFreeFailedSigs(de_ctx);
2688 
2691 
2692  /* if we have a config prefix, remove the config from the tree */
2693  if (strlen(de_ctx->config_prefix) > 0) {
2694  /* remove config */
2696  if (node != NULL) {
2697  SCConfNodeRemove(node); /* frees node */
2698  }
2699 #if 0
2700  SCConfDump();
2701 #endif
2702  }
2703 
2706 
2707  DetectBufferTypeFreeDetectEngine(de_ctx);
2710 
2711  if (de_ctx->tenant_path) {
2713  }
2714 
2715  if (de_ctx->requirements) {
2716  SCDetectRequiresStatusFree(de_ctx->requirements);
2717  }
2718 
2719  if (de_ctx->non_pf_engine_names) {
2721  }
2722  SCFree(de_ctx);
2723  //DetectAddressGroupPrintMemory();
2724  //DetectSigGroupPrintMemory();
2725  //DetectPortPrintMemory();
2726 }
2727 
2728 /** \brief Function that load DetectEngineCtx config for grouping sigs
2729  * used by the engine
2730  * \retval 0 if no config provided, 1 if config was provided
2731  * and loaded successfully
2732  */
2733 static int DetectEngineCtxLoadConf(DetectEngineCtx *de_ctx)
2734 {
2735  uint8_t profile = ENGINE_PROFILE_MEDIUM;
2736  const char *max_uniq_toclient_groups_str = NULL;
2737  const char *max_uniq_toserver_groups_str = NULL;
2738  const char *sgh_mpm_context = NULL;
2739  const char *de_ctx_profile = NULL;
2740 
2741  (void)SCConfGet("detect.profile", &de_ctx_profile);
2742  (void)SCConfGet("detect.sgh-mpm-context", &sgh_mpm_context);
2743 
2744  SCConfNode *de_ctx_custom = SCConfGetNode("detect-engine");
2745  SCConfNode *opt = NULL;
2746 
2747  if (de_ctx_custom != NULL) {
2748  TAILQ_FOREACH(opt, &de_ctx_custom->head, next) {
2749  if (de_ctx_profile == NULL) {
2750  if (opt->val && strcmp(opt->val, "profile") == 0) {
2751  de_ctx_profile = opt->head.tqh_first->val;
2752  }
2753  }
2754 
2755  if (sgh_mpm_context == NULL) {
2756  if (opt->val && strcmp(opt->val, "sgh-mpm-context") == 0) {
2757  sgh_mpm_context = opt->head.tqh_first->val;
2758  }
2759  }
2760  }
2761  }
2762 
2763  if (de_ctx_profile != NULL) {
2764  if (strcmp(de_ctx_profile, "low") == 0 ||
2765  strcmp(de_ctx_profile, "lowest") == 0) { // legacy
2766  profile = ENGINE_PROFILE_LOW;
2767  } else if (strcmp(de_ctx_profile, "medium") == 0) {
2768  profile = ENGINE_PROFILE_MEDIUM;
2769  } else if (strcmp(de_ctx_profile, "high") == 0 ||
2770  strcmp(de_ctx_profile, "highest") == 0) { // legacy
2771  profile = ENGINE_PROFILE_HIGH;
2772  } else if (strcmp(de_ctx_profile, "custom") == 0) {
2773  profile = ENGINE_PROFILE_CUSTOM;
2774  } else {
2775  SCLogError("invalid value for detect.profile: '%s'. "
2776  "Valid options: low, medium, high and custom.",
2777  de_ctx_profile);
2778  return -1;
2779  }
2780 
2781  SCLogDebug("Profile for detection engine groups is \"%s\"", de_ctx_profile);
2782  } else {
2783  SCLogDebug("Profile for detection engine groups not provided "
2784  "at suricata.yaml. Using default (\"medium\").");
2785  }
2786 
2787  /* detect-engine.sgh-mpm-context option parsing */
2788  if (sgh_mpm_context == NULL || strcmp(sgh_mpm_context, "auto") == 0) {
2789  /* for now, since we still haven't implemented any intelligence into
2790  * understanding the patterns and distributing mpm_ctx across sgh */
2792  de_ctx->mpm_matcher == MPM_HS) {
2794  } else {
2796  }
2797  } else {
2798  if (strcmp(sgh_mpm_context, "single") == 0) {
2800  } else if (strcmp(sgh_mpm_context, "full") == 0) {
2802  } else {
2803  SCLogError("You have supplied an "
2804  "invalid conf value for detect-engine.sgh-mpm-context-"
2805  "%s",
2806  sgh_mpm_context);
2807  exit(EXIT_FAILURE);
2808  }
2809  }
2810 
2811  if (RunmodeIsUnittests()) {
2813  }
2814 
2815  /* parse profile custom-values */
2816  opt = NULL;
2817  switch (profile) {
2818  case ENGINE_PROFILE_LOW:
2821  break;
2822 
2823  case ENGINE_PROFILE_HIGH:
2826  break;
2827 
2828  case ENGINE_PROFILE_CUSTOM:
2829  (void)SCConfGet("detect.custom-values.toclient-groups", &max_uniq_toclient_groups_str);
2830  (void)SCConfGet("detect.custom-values.toserver-groups", &max_uniq_toserver_groups_str);
2831 
2832  if (de_ctx_custom != NULL) {
2833  TAILQ_FOREACH(opt, &de_ctx_custom->head, next) {
2834  if (opt->val && strcmp(opt->val, "custom-values") == 0) {
2835  if (max_uniq_toclient_groups_str == NULL) {
2836  max_uniq_toclient_groups_str = (char *)SCConfNodeLookupChildValue(
2837  opt->head.tqh_first, "toclient-sp-groups");
2838  }
2839  if (max_uniq_toclient_groups_str == NULL) {
2840  max_uniq_toclient_groups_str = (char *)SCConfNodeLookupChildValue(
2841  opt->head.tqh_first, "toclient-groups");
2842  }
2843  if (max_uniq_toserver_groups_str == NULL) {
2844  max_uniq_toserver_groups_str = (char *)SCConfNodeLookupChildValue(
2845  opt->head.tqh_first, "toserver-dp-groups");
2846  }
2847  if (max_uniq_toserver_groups_str == NULL) {
2848  max_uniq_toserver_groups_str = (char *)SCConfNodeLookupChildValue(
2849  opt->head.tqh_first, "toserver-groups");
2850  }
2851  }
2852  }
2853  }
2854  if (max_uniq_toclient_groups_str != NULL) {
2856  (uint16_t)strlen(max_uniq_toclient_groups_str),
2857  (const char *)max_uniq_toclient_groups_str) <= 0) {
2859 
2860  SCLogWarning("parsing '%s' for "
2861  "toclient-groups failed, using %u",
2862  max_uniq_toclient_groups_str, de_ctx->max_uniq_toclient_groups);
2863  }
2864  } else {
2866  }
2867  SCLogConfig("toclient-groups %u", de_ctx->max_uniq_toclient_groups);
2868 
2869  if (max_uniq_toserver_groups_str != NULL) {
2871  (uint16_t)strlen(max_uniq_toserver_groups_str),
2872  (const char *)max_uniq_toserver_groups_str) <= 0) {
2874 
2875  SCLogWarning("parsing '%s' for "
2876  "toserver-groups failed, using %u",
2877  max_uniq_toserver_groups_str, de_ctx->max_uniq_toserver_groups);
2878  }
2879  } else {
2881  }
2882  SCLogConfig("toserver-groups %u", de_ctx->max_uniq_toserver_groups);
2883  break;
2884 
2885  /* Default (or no config provided) is profile medium */
2886  case ENGINE_PROFILE_MEDIUM:
2888  default:
2891  break;
2892  }
2893 
2894  intmax_t value = 0;
2896  if (SCConfGetInt("detect.inspection-recursion-limit", &value) == 1) {
2897  if (value >= 0 && value <= INT_MAX) {
2898  de_ctx->inspection_recursion_limit = (int)value;
2899  }
2900 
2901  /* fall back to old config parsing */
2902  } else {
2903  SCConfNode *insp_recursion_limit_node = NULL;
2904  char *insp_recursion_limit = NULL;
2905 
2906  if (de_ctx_custom != NULL) {
2907  opt = NULL;
2908  TAILQ_FOREACH(opt, &de_ctx_custom->head, next) {
2909  if (opt->val && strcmp(opt->val, "inspection-recursion-limit") != 0)
2910  continue;
2911 
2912  insp_recursion_limit_node = SCConfNodeLookupChild(opt, opt->val);
2913  if (insp_recursion_limit_node == NULL) {
2914  SCLogError("Error retrieving conf "
2915  "entry for detect-engine:inspection-recursion-limit");
2916  break;
2917  }
2918  insp_recursion_limit = insp_recursion_limit_node->val;
2919  SCLogDebug("Found detect-engine.inspection-recursion-limit - %s:%s",
2920  insp_recursion_limit_node->name, insp_recursion_limit_node->val);
2921  break;
2922  }
2923 
2924  if (insp_recursion_limit != NULL) {
2926  0, (const char *)insp_recursion_limit) < 0) {
2927  SCLogWarning("Invalid value for "
2928  "detect-engine.inspection-recursion-limit: %s "
2929  "resetting to %d",
2930  insp_recursion_limit, DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT);
2933  }
2934  }
2935  }
2936  }
2937 
2940 
2941  SCLogDebug("de_ctx->inspection_recursion_limit: %d",
2943 
2944  // default value is 4
2946  if (SCConfGetInt("detect.stream-tx-log-limit", &value) == 1) {
2947  if (value >= 0 && value <= UINT8_MAX) {
2948  de_ctx->guess_applayer_log_limit = (uint8_t)value;
2949  } else {
2950  SCLogWarning("Invalid value for detect-engine.stream-tx-log-limit: must be between 0 "
2951  "and 255, will default to 4");
2952  }
2953  }
2954  int guess_applayer = 0;
2955  if ((SCConfGetBool("detect.guess-applayer-tx", &guess_applayer)) == 1) {
2956  if (guess_applayer == 1) {
2957  de_ctx->guess_applayer = true;
2958  }
2959  }
2960 
2961  /* parse port grouping priority settings */
2962 
2963  const char *ports = NULL;
2964  (void)SCConfGet("detect.grouping.tcp-priority-ports", &ports);
2965  if (ports) {
2966  SCLogConfig("grouping: tcp-priority-ports %s", ports);
2967  } else {
2968  (void)SCConfGet("detect.grouping.tcp-whitelist", &ports);
2969  if (ports) {
2970  SCLogConfig(
2971  "grouping: tcp-priority-ports from legacy 'tcp-whitelist' setting: %s", ports);
2972  } else {
2973  ports = "53, 80, 139, 443, 445, 1433, 3306, 3389, 6666, 6667, 8080";
2974  SCLogConfig("grouping: tcp-priority-ports (default) %s", ports);
2975  }
2976  }
2977  if (DetectPortParse(de_ctx, &de_ctx->tcp_priorityports, ports) != 0) {
2978  SCLogWarning("'%s' is not a valid value "
2979  "for detect.grouping.tcp-priority-ports",
2980  ports);
2981  }
2983  for ( ; x != NULL; x = x->next) {
2984  if (x->port != x->port2) {
2985  SCLogWarning("'%s' is not a valid value "
2986  "for detect.grouping.tcp-priority-ports: only single ports allowed",
2987  ports);
2989  de_ctx->tcp_priorityports = NULL;
2990  break;
2991  }
2992  }
2993 
2994  ports = NULL;
2995  (void)SCConfGet("detect.grouping.udp-priority-ports", &ports);
2996  if (ports) {
2997  SCLogConfig("grouping: udp-priority-ports %s", ports);
2998  } else {
2999  (void)SCConfGet("detect.grouping.udp-whitelist", &ports);
3000  if (ports) {
3001  SCLogConfig(
3002  "grouping: udp-priority-ports from legacy 'udp-whitelist' setting: %s", ports);
3003  } else {
3004  ports = "53, 135, 5060";
3005  SCLogConfig("grouping: udp-priority-ports (default) %s", ports);
3006  }
3007  }
3008  if (DetectPortParse(de_ctx, &de_ctx->udp_priorityports, ports) != 0) {
3009  SCLogWarning("'%s' is not a valid value "
3010  "for detect.grouping.udp-priority-ports",
3011  ports);
3012  }
3013  for (x = de_ctx->udp_priorityports; x != NULL; x = x->next) {
3014  if (x->port != x->port2) {
3015  SCLogWarning("'%s' is not a valid value "
3016  "for detect.grouping.udp-priority-ports: only single ports allowed",
3017  ports);
3019  de_ctx->udp_priorityports = NULL;
3020  break;
3021  }
3022  }
3023 
3025  const char *pf_setting = NULL;
3026  if (SCConfGet("detect.prefilter.default", &pf_setting) == 1 && pf_setting) {
3027  if (strcasecmp(pf_setting, "mpm") == 0) {
3029  } else if (strcasecmp(pf_setting, "auto") == 0) {
3031  }
3032  }
3033  switch (de_ctx->prefilter_setting) {
3034  case DETECT_PREFILTER_MPM:
3035  SCLogConfig("prefilter engines: MPM");
3036  break;
3037  case DETECT_PREFILTER_AUTO:
3038  SCLogConfig("prefilter engines: MPM and keywords");
3039  break;
3040  }
3041 
3042  return 0;
3043 }
3044 
3046 {
3047  de_ctx->signum = 0;
3048 }
3049 
3050 static int DetectEngineThreadCtxInitGlobalKeywords(DetectEngineThreadCtx *det_ctx)
3051 {
3052  const DetectEngineMasterCtx *master = &g_master_de_ctx;
3053 
3054  if (master->keyword_id > 0) {
3055  // coverity[suspicious_sizeof : FALSE]
3056  det_ctx->global_keyword_ctxs_array = (void **)SCCalloc(master->keyword_id, sizeof(void *));
3057  if (det_ctx->global_keyword_ctxs_array == NULL) {
3058  SCLogError("setting up thread local detect ctx");
3059  return TM_ECODE_FAILED;
3060  }
3061  det_ctx->global_keyword_ctxs_size = master->keyword_id;
3062 
3063  const DetectEngineThreadKeywordCtxItem *item = master->keyword_list;
3064  while (item) {
3065  det_ctx->global_keyword_ctxs_array[item->id] = item->InitFunc(item->data);
3066  if (det_ctx->global_keyword_ctxs_array[item->id] == NULL) {
3067  SCLogError("setting up thread local detect ctx "
3068  "for keyword \"%s\" failed",
3069  item->name);
3070  return TM_ECODE_FAILED;
3071  }
3072  item = item->next;
3073  }
3074  }
3075  return TM_ECODE_OK;
3076 }
3077 
3078 static void DetectEngineThreadCtxDeinitGlobalKeywords(DetectEngineThreadCtx *det_ctx)
3079 {
3080  if (det_ctx->global_keyword_ctxs_array == NULL ||
3081  det_ctx->global_keyword_ctxs_size == 0) {
3082  return;
3083  }
3084 
3085  const DetectEngineMasterCtx *master = &g_master_de_ctx;
3086  if (master->keyword_id > 0) {
3087  const DetectEngineThreadKeywordCtxItem *item = master->keyword_list;
3088  while (item) {
3089  if (det_ctx->global_keyword_ctxs_array[item->id] != NULL)
3090  item->FreeFunc(det_ctx->global_keyword_ctxs_array[item->id]);
3091 
3092  item = item->next;
3093  }
3094  det_ctx->global_keyword_ctxs_size = 0;
3096  det_ctx->global_keyword_ctxs_array = NULL;
3097  }
3098 }
3099 
3100 static int DetectEngineThreadCtxInitKeywords(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx)
3101 {
3102  if (de_ctx->keyword_id > 0) {
3103  // coverity[suspicious_sizeof : FALSE]
3104  det_ctx->keyword_ctxs_array = SCCalloc(de_ctx->keyword_id, sizeof(void *));
3105  if (det_ctx->keyword_ctxs_array == NULL) {
3106  SCLogError("setting up thread local detect ctx");
3107  return TM_ECODE_FAILED;
3108  }
3109 
3110  det_ctx->keyword_ctxs_size = de_ctx->keyword_id;
3111 
3113  for (; hb != NULL; hb = HashListTableGetListNext(hb)) {
3115 
3116  det_ctx->keyword_ctxs_array[item->id] = item->InitFunc(item->data);
3117  if (det_ctx->keyword_ctxs_array[item->id] == NULL) {
3118  SCLogError("setting up thread local detect ctx "
3119  "for keyword \"%s\" failed",
3120  item->name);
3121  return TM_ECODE_FAILED;
3122  }
3123  }
3124  }
3125  return TM_ECODE_OK;
3126 }
3127 
3128 static void DetectEngineThreadCtxDeinitKeywords(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx)
3129 {
3130  if (de_ctx->keyword_id > 0) {
3132  for (; hb != NULL; hb = HashListTableGetListNext(hb)) {
3134 
3135  if (det_ctx->keyword_ctxs_array[item->id] != NULL)
3136  item->FreeFunc(det_ctx->keyword_ctxs_array[item->id]);
3137  }
3138  det_ctx->keyword_ctxs_size = 0;
3139  SCFree(det_ctx->keyword_ctxs_array);
3140  det_ctx->keyword_ctxs_array = NULL;
3141  }
3142 }
3143 
3144 /** NOTE: master MUST be locked before calling this */
3145 static TmEcode DetectEngineThreadCtxInitForMT(ThreadVars *tv, DetectEngineThreadCtx *det_ctx)
3146 {
3147  DetectEngineMasterCtx *master = &g_master_de_ctx;
3148 
3149  DetectEngineTenantMapping *map_array = NULL;
3150  uint32_t map_array_size = 0;
3151  uint32_t map_cnt = 0;
3152  uint32_t max_tenant_id = 0;
3153  DetectEngineCtx *list = master->list;
3154 
3155  if (master->tenant_selector == TENANT_SELECTOR_UNKNOWN) {
3156  SCLogError("no tenant selector set: "
3157  "set using multi-detect.selector");
3158  return TM_ECODE_FAILED;
3159  }
3160 
3161  uint32_t tcnt = 0;
3162  while (list) {
3163  if (list->tenant_id > max_tenant_id)
3164  max_tenant_id = list->tenant_id;
3165 
3166  list = list->next;
3167  tcnt++;
3168  }
3169 
3170  HashTable *mt_det_ctxs_hash =
3171  HashTableInit(tcnt * 2, TenantIdHash, TenantIdCompare, TenantIdFree);
3172  if (mt_det_ctxs_hash == NULL) {
3173  goto error;
3174  }
3175 
3176  if (tcnt == 0) {
3177  SCLogInfo("no tenants left, or none registered yet");
3178  } else {
3179  max_tenant_id++;
3180 
3182  while (map) {
3183  map_cnt++;
3184  map = map->next;
3185  }
3186 
3187  if (map_cnt > 0) {
3188  map_array_size = map_cnt + 1;
3189 
3190  map_array = SCCalloc(map_array_size, sizeof(*map_array));
3191  if (map_array == NULL)
3192  goto error;
3193 
3194  /* fill the array */
3195  map_cnt = 0;
3196  map = master->tenant_mapping_list;
3197  while (map) {
3198  if (map_cnt >= map_array_size) {
3199  goto error;
3200  }
3201  map_array[map_cnt].traffic_id = map->traffic_id;
3202  map_array[map_cnt].tenant_id = map->tenant_id;
3203  map_cnt++;
3204  map = map->next;
3205  }
3206 
3207  }
3208 
3209  /* set up hash for tenant lookup */
3210  list = master->list;
3211  while (list) {
3212  SCLogDebug("tenant-id %u", list->tenant_id);
3213  if (list->tenant_id != 0) {
3215  if (mt_det_ctx == NULL)
3216  goto error;
3217  if (HashTableAdd(mt_det_ctxs_hash, mt_det_ctx, 0) != 0) {
3218  goto error;
3219  }
3220  }
3221  list = list->next;
3222  }
3223  }
3224 
3225  det_ctx->mt_det_ctxs_hash = mt_det_ctxs_hash;
3226  mt_det_ctxs_hash = NULL;
3227 
3228  det_ctx->mt_det_ctxs_cnt = max_tenant_id;
3229 
3230  det_ctx->tenant_array = map_array;
3231  det_ctx->tenant_array_size = map_array_size;
3232 
3233  switch (master->tenant_selector) {
3235  SCLogDebug("TENANT_SELECTOR_UNKNOWN");
3236  break;
3237  case TENANT_SELECTOR_VLAN:
3238  det_ctx->TenantGetId = DetectEngineTenantGetIdFromVlanId;
3239  SCLogDebug("TENANT_SELECTOR_VLAN");
3240  break;
3242  det_ctx->TenantGetId = DetectEngineTenantGetIdFromLivedev;
3243  SCLogDebug("TENANT_SELECTOR_LIVEDEV");
3244  break;
3246  det_ctx->TenantGetId = DetectEngineTenantGetIdFromPcap;
3247  SCLogDebug("TENANT_SELECTOR_DIRECT");
3248  break;
3249  }
3250 
3251  return TM_ECODE_OK;
3252 error:
3253  if (map_array != NULL)
3254  SCFree(map_array);
3255  if (mt_det_ctxs_hash != NULL)
3256  HashTableFree(mt_det_ctxs_hash);
3257 
3258  return TM_ECODE_FAILED;
3259 }
3260 
3261 /** \internal
3262  * \brief Helper for DetectThread setup functions
3263  */
3264 static TmEcode ThreadCtxDoInit (DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx)
3265 {
3267 
3268  PmqSetup(&det_ctx->pmq);
3269 
3271  if (det_ctx->spm_thread_ctx == NULL) {
3272  return TM_ECODE_FAILED;
3273  }
3274 
3275  /* DeState */
3276  if (de_ctx->sig_array_len > 0) {
3277  det_ctx->match_array_len = de_ctx->sig_array_len;
3278  det_ctx->match_array = SCCalloc(det_ctx->match_array_len, sizeof(Signature *));
3279  if (det_ctx->match_array == NULL) {
3280  return TM_ECODE_FAILED;
3281  }
3282 
3284  }
3285 
3286  /* Alert processing queue */
3287  AlertQueueInit(det_ctx);
3288 
3289  /* byte_extract storage */
3290  det_ctx->byte_values = SCMalloc(sizeof(*det_ctx->byte_values) *
3292  if (det_ctx->byte_values == NULL) {
3293  return TM_ECODE_FAILED;
3294  }
3295 
3296  /* Allocate space for base64 decoded data. */
3299  if (det_ctx->base64_decoded == NULL) {
3300  return TM_ECODE_FAILED;
3301  }
3302  det_ctx->base64_decoded_len = 0;
3303  }
3304 
3306  det_ctx->inspect.buffers = SCCalloc(det_ctx->inspect.buffers_size, sizeof(InspectionBuffer));
3307  if (det_ctx->inspect.buffers == NULL) {
3308  return TM_ECODE_FAILED;
3309  }
3310  det_ctx->inspect.to_clear_queue = SCCalloc(det_ctx->inspect.buffers_size, sizeof(uint32_t));
3311  if (det_ctx->inspect.to_clear_queue == NULL) {
3312  return TM_ECODE_FAILED;
3313  }
3314  det_ctx->inspect.to_clear_idx = 0;
3315 
3318  if (det_ctx->multi_inspect.buffers == NULL) {
3319  return TM_ECODE_FAILED;
3320  }
3321  det_ctx->multi_inspect.to_clear_queue = SCCalloc(det_ctx->multi_inspect.buffers_size, sizeof(uint32_t));
3322  if (det_ctx->multi_inspect.to_clear_queue == NULL) {
3323  return TM_ECODE_FAILED;
3324  }
3325  det_ctx->multi_inspect.to_clear_idx = 0;
3326 
3327 
3328  DetectEngineThreadCtxInitKeywords(de_ctx, det_ctx);
3329  DetectEngineThreadCtxInitGlobalKeywords(det_ctx);
3330 #ifdef PROFILE_RULES
3331  SCProfilingRuleThreadSetup(de_ctx->profile_ctx, det_ctx);
3332 #endif
3333 #ifdef PROFILING
3337 #endif
3338  SC_ATOMIC_INIT(det_ctx->so_far_used_by_detect);
3339 
3340  return TM_ECODE_OK;
3341 }
3342 
3343 /** \brief initialize thread specific detection engine context
3344  *
3345  * \note there is a special case when using delayed detect. In this case the
3346  * function is called twice per thread. The first time the rules are not
3347  * yet loaded. de_ctx->delayed_detect_initialized will be 0. The 2nd
3348  * time they will be loaded. de_ctx->delayed_detect_initialized will be 1.
3349  * This is needed to do the per thread counter registration before the
3350  * packet runtime starts. In delayed detect mode, the first call will
3351  * return a NULL ptr through the data ptr.
3352  *
3353  * \param tv ThreadVars for this thread
3354  * \param initdata pointer to de_ctx
3355  * \param data[out] pointer to store our thread detection ctx
3356  *
3357  * \retval TM_ECODE_OK if all went well
3358  * \retval TM_ECODE_FAILED on serious errors
3359  */
3360 TmEcode DetectEngineThreadCtxInit(ThreadVars *tv, void *initdata, void **data)
3361 {
3362  DetectEngineThreadCtx *det_ctx = SCCalloc(1, sizeof(DetectEngineThreadCtx));
3363  if (unlikely(det_ctx == NULL))
3364  return TM_ECODE_FAILED;
3365 
3366  det_ctx->tv = tv;
3367  det_ctx->de_ctx = DetectEngineGetCurrent();
3368  if (det_ctx->de_ctx == NULL) {
3369 #ifdef UNITTESTS
3370  if (RunmodeIsUnittests()) {
3371  det_ctx->de_ctx = (DetectEngineCtx *)initdata;
3372  } else {
3373  DetectEngineThreadCtxDeinit(tv, det_ctx);
3374  return TM_ECODE_FAILED;
3375  }
3376 #else
3377  DetectEngineThreadCtxDeinit(tv, det_ctx);
3378  return TM_ECODE_FAILED;
3379 #endif
3380  }
3381 
3382  if (det_ctx->de_ctx->type == DETECT_ENGINE_TYPE_NORMAL ||
3383  det_ctx->de_ctx->type == DETECT_ENGINE_TYPE_TENANT)
3384  {
3385  if (ThreadCtxDoInit(det_ctx->de_ctx, det_ctx) != TM_ECODE_OK) {
3386  DetectEngineThreadCtxDeinit(tv, det_ctx);
3387  return TM_ECODE_FAILED;
3388  }
3389  }
3390 
3391  /** alert counter setup */
3392  det_ctx->counter_alerts = StatsRegisterCounter("detect.alert", tv);
3393  det_ctx->counter_alerts_overflow = StatsRegisterCounter("detect.alert_queue_overflow", tv);
3394  det_ctx->counter_alerts_suppressed = StatsRegisterCounter("detect.alerts_suppressed", tv);
3395 
3396  /* Register counter for Lua rule errors. */
3397  det_ctx->lua_rule_errors = StatsRegisterCounter("detect.lua.errors", tv);
3398 
3399  /* Register a counter for Lua blocked function attempts. */
3400  det_ctx->lua_blocked_function_errors =
3401  StatsRegisterCounter("detect.lua.blocked_function_errors", tv);
3402 
3403  /* Register a counter for Lua instruction limit errors. */
3404  det_ctx->lua_instruction_limit_errors =
3405  StatsRegisterCounter("detect.lua.instruction_limit_errors", tv);
3406 
3407  /* Register a counter for Lua memory limit errors. */
3408  det_ctx->lua_memory_limit_errors = StatsRegisterCounter("detect.lua.memory_limit_errors", tv);
3409 
3410  det_ctx->json_content = NULL;
3411  det_ctx->json_content_capacity = 0;
3412  det_ctx->json_content_len = 0;
3413 
3414 #ifdef PROFILING
3415  det_ctx->counter_mpm_list = StatsRegisterAvgCounter("detect.mpm_list", tv);
3416  det_ctx->counter_match_list = StatsRegisterAvgCounter("detect.match_list", tv);
3417 #endif
3418 
3420  DetectEngineMasterCtx *master = &g_master_de_ctx;
3421  SCMutexLock(&master->lock);
3422  if (DetectEngineThreadCtxInitForMT(tv, det_ctx) != TM_ECODE_OK) {
3423  DetectEngineThreadCtxDeinit(tv, det_ctx);
3424  SCMutexUnlock(&master->lock);
3425  return TM_ECODE_FAILED;
3426  }
3427  SCMutexUnlock(&master->lock);
3428  }
3429 
3430  /* pass thread data back to caller */
3431  *data = (void *)det_ctx;
3432 
3433  return TM_ECODE_OK;
3434 }
3435 
3436 /**
3437  * \internal
3438  * \brief initialize a det_ctx for reload cases
3439  * \param new_de_ctx the new detection engine
3440  * \param mt flag to indicate if MT should be set up for this det_ctx
3441  * this should only be done for the 'root' det_ctx
3442  *
3443  * \retval det_ctx detection engine thread ctx or NULL in case of error
3444  */
3446  ThreadVars *tv, DetectEngineCtx *new_de_ctx, int mt)
3447 {
3448  DetectEngineThreadCtx *det_ctx = SCCalloc(1, sizeof(DetectEngineThreadCtx));
3449  if (unlikely(det_ctx == NULL))
3450  return NULL;
3451 
3452  det_ctx->tenant_id = new_de_ctx->tenant_id;
3453  det_ctx->tv = tv;
3454  det_ctx->de_ctx = DetectEngineReference(new_de_ctx);
3455  if (det_ctx->de_ctx == NULL) {
3456  SCFree(det_ctx);
3457  return NULL;
3458  }
3459 
3460  /* most of the init happens here */
3461  if (det_ctx->de_ctx->type == DETECT_ENGINE_TYPE_NORMAL ||
3462  det_ctx->de_ctx->type == DETECT_ENGINE_TYPE_TENANT)
3463  {
3464  if (ThreadCtxDoInit(det_ctx->de_ctx, det_ctx) != TM_ECODE_OK) {
3465  DetectEngineDeReference(&det_ctx->de_ctx);
3466  SCFree(det_ctx);
3467  return NULL;
3468  }
3469  }
3470 
3471  /** alert counter setup */
3472  det_ctx->counter_alerts = StatsRegisterCounter("detect.alert", tv);
3473  det_ctx->counter_alerts_overflow = StatsRegisterCounter("detect.alert_queue_overflow", tv);
3474  det_ctx->counter_alerts_suppressed = StatsRegisterCounter("detect.alerts_suppressed", tv);
3475 #ifdef PROFILING
3476  det_ctx->counter_mpm_list = StatsRegisterAvgCounter("detect.mpm_list", tv);
3477  det_ctx->counter_match_list = StatsRegisterAvgCounter("detect.match_list", tv);
3478 #endif
3479 
3480  if (mt && DetectEngineMultiTenantEnabledWithLock()) {
3481  if (DetectEngineThreadCtxInitForMT(tv, det_ctx) != TM_ECODE_OK) {
3482  DetectEngineDeReference(&det_ctx->de_ctx);
3483  SCFree(det_ctx);
3484  return NULL;
3485  }
3486  }
3487 
3488  return det_ctx;
3489 }
3490 
3491 static void DetectEngineThreadCtxFree(DetectEngineThreadCtx *det_ctx)
3492 {
3493 #if DEBUG
3494  SCLogDebug("PACKET PKT_STREAM_ADD: %"PRIu64, det_ctx->pkt_stream_add_cnt);
3495 
3496  SCLogDebug("PAYLOAD MPM %"PRIu64"/%"PRIu64, det_ctx->payload_mpm_cnt, det_ctx->payload_mpm_size);
3497  SCLogDebug("STREAM MPM %"PRIu64"/%"PRIu64, det_ctx->stream_mpm_cnt, det_ctx->stream_mpm_size);
3498 
3499  SCLogDebug("PAYLOAD SIG %"PRIu64"/%"PRIu64, det_ctx->payload_persig_cnt, det_ctx->payload_persig_size);
3500  SCLogDebug("STREAM SIG %"PRIu64"/%"PRIu64, det_ctx->stream_persig_cnt, det_ctx->stream_persig_size);
3501 #endif
3502 
3503  if (det_ctx->tenant_array != NULL) {
3504  SCFree(det_ctx->tenant_array);
3505  det_ctx->tenant_array = NULL;
3506  }
3507 
3508 #ifdef PROFILE_RULES
3509  SCProfilingRuleThreadCleanup(det_ctx);
3510 #endif
3511 #ifdef PROFILING
3514  SCProfilingSghThreadCleanup(det_ctx);
3515 #endif
3516 
3517  /** \todo get rid of this static */
3518  if (det_ctx->de_ctx != NULL) {
3519  PatternMatchThreadDestroy(&det_ctx->mtc, det_ctx->de_ctx->mpm_matcher);
3520  }
3521 
3522  PmqFree(&det_ctx->pmq);
3523 
3524  if (det_ctx->spm_thread_ctx != NULL) {
3526  }
3527  if (det_ctx->match_array != NULL)
3528  SCFree(det_ctx->match_array);
3529 
3531 
3532  AlertQueueFree(det_ctx);
3533 
3534  if (det_ctx->post_rule_work_queue.q)
3535  SCFree(det_ctx->post_rule_work_queue.q);
3536 
3537  if (det_ctx->byte_values != NULL)
3538  SCFree(det_ctx->byte_values);
3539 
3540  /* Decoded base64 data. */
3541  if (det_ctx->base64_decoded != NULL) {
3542  SCFree(det_ctx->base64_decoded);
3543  }
3544 
3545  if (det_ctx->inspect.buffers) {
3546  for (uint32_t i = 0; i < det_ctx->inspect.buffers_size; i++) {
3547  InspectionBufferFree(&det_ctx->inspect.buffers[i]);
3548  }
3549  SCFree(det_ctx->inspect.buffers);
3550  }
3551  if (det_ctx->inspect.to_clear_queue) {
3552  SCFree(det_ctx->inspect.to_clear_queue);
3553  }
3554  if (det_ctx->multi_inspect.buffers) {
3555  for (uint32_t i = 0; i < det_ctx->multi_inspect.buffers_size; i++) {
3557  for (uint32_t x = 0; x < fb->size; x++) {
3559  }
3561  }
3562  SCFree(det_ctx->multi_inspect.buffers);
3563  }
3564  if (det_ctx->multi_inspect.to_clear_queue) {
3566  }
3567 
3568  DetectEngineThreadCtxDeinitGlobalKeywords(det_ctx);
3569  if (det_ctx->de_ctx != NULL) {
3570  DetectEngineThreadCtxDeinitKeywords(det_ctx->de_ctx, det_ctx);
3571 #ifdef UNITTESTS
3572  if (!RunmodeIsUnittests() || det_ctx->de_ctx->ref_cnt > 0)
3573  DetectEngineDeReference(&det_ctx->de_ctx);
3574 #else
3575  DetectEngineDeReference(&det_ctx->de_ctx);
3576 #endif
3577  }
3578 
3579  if (det_ctx->json_content) {
3580  SCFree(det_ctx->json_content);
3581  det_ctx->json_content = NULL;
3582  det_ctx->json_content_capacity = 0;
3583  }
3584 
3587  SCFree(det_ctx);
3588 
3590 }
3591 
3593 {
3594  DetectEngineThreadCtx *det_ctx = (DetectEngineThreadCtx *)data;
3595 
3596  if (det_ctx == NULL) {
3597  SCLogWarning("argument \"data\" NULL");
3598  return TM_ECODE_OK;
3599  }
3600 
3601  if (det_ctx->mt_det_ctxs_hash != NULL) {
3602  HashTableFree(det_ctx->mt_det_ctxs_hash);
3603  det_ctx->mt_det_ctxs_hash = NULL;
3604  }
3605  DetectEngineThreadCtxFree(det_ctx);
3606 
3607  return TM_ECODE_OK;
3608 }
3609 
3610 static uint32_t DetectKeywordCtxHashFunc(HashListTable *ht, void *data, uint16_t datalen)
3611 {
3613  const char *name = ctx->name;
3614  uint64_t hash =
3615  StringHashDjb2((const uint8_t *)name, (uint32_t)strlen(name)) + (ptrdiff_t)ctx->data;
3616  hash %= ht->array_size;
3617  return (uint32_t)hash;
3618 }
3619 
3620 static char DetectKeywordCtxCompareFunc(void *data1, uint16_t len1, void *data2, uint16_t len2)
3621 {
3622  DetectEngineThreadKeywordCtxItem *ctx1 = data1;
3623  DetectEngineThreadKeywordCtxItem *ctx2 = data2;
3624  const char *name1 = ctx1->name;
3625  const char *name2 = ctx2->name;
3626  return (strcmp(name1, name2) == 0 && ctx1->data == ctx2->data);
3627 }
3628 
3629 static void DetectKeywordCtxFreeFunc(void *ptr)
3630 {
3631  SCFree(ptr);
3632 }
3633 
3634 /** \brief Register Thread keyword context Funcs
3635  *
3636  * \param de_ctx detection engine to register in
3637  * \param name keyword name for error printing
3638  * \param InitFunc function ptr
3639  * \param data keyword init data to pass to Func. Can be NULL.
3640  * \param FreeFunc function ptr
3641  * \param mode 0 normal (ctx per keyword instance) 1 shared (one ctx per det_ct)
3642  *
3643  * \retval id for retrieval of ctx at runtime
3644  * \retval -1 on error
3645  *
3646  * \note make sure "data" remains valid and it free'd elsewhere. It's
3647  * recommended to store it in the keywords global ctx so that
3648  * it's freed when the de_ctx is freed.
3649  */
3650 int DetectRegisterThreadCtxFuncs(DetectEngineCtx *de_ctx, const char *name, void *(*InitFunc)(void *), void *data, void (*FreeFunc)(void *), int mode)
3651 {
3652  BUG_ON(de_ctx == NULL || InitFunc == NULL || FreeFunc == NULL);
3653 
3654  if (de_ctx->keyword_hash == NULL) {
3655  de_ctx->keyword_hash = HashListTableInit(4096, // TODO
3656  DetectKeywordCtxHashFunc, DetectKeywordCtxCompareFunc, DetectKeywordCtxFreeFunc);
3657  BUG_ON(de_ctx->keyword_hash == NULL);
3658  }
3659 
3660  if (mode) {
3661  DetectEngineThreadKeywordCtxItem search = { .data = data, .name = name };
3662 
3664  HashListTableLookup(de_ctx->keyword_hash, (void *)&search, 0);
3665  if (item)
3666  return item->id;
3667 
3668  /* fall through */
3669  }
3670 
3672  if (unlikely(item == NULL))
3673  return -1;
3674 
3675  item->InitFunc = InitFunc;
3676  item->FreeFunc = FreeFunc;
3677  item->data = data;
3678  item->name = name;
3679  item->id = de_ctx->keyword_id++;
3680 
3681  if (HashListTableAdd(de_ctx->keyword_hash, (void *)item, 0) < 0) {
3682  SCFree(item);
3683  return -1;
3684  }
3685  return item->id;
3686 }
3687 
3688 /** \brief Remove Thread keyword context registration
3689  *
3690  * \param de_ctx detection engine to deregister from
3691  * \param det_ctx detection engine thread context to deregister from
3692  * \param data keyword init data to pass to Func. Can be NULL.
3693  * \param name keyword name for error printing
3694  *
3695  * \retval 1 Item unregistered
3696  * \retval 0 otherwise
3697  *
3698  * \note make sure "data" remains valid and it free'd elsewhere. It's
3699  * recommended to store it in the keywords global ctx so that
3700  * it's freed when the de_ctx is freed.
3701  */
3703 {
3704  /* might happen if we call this before a call to *Register* */
3705  if (de_ctx->keyword_hash == NULL)
3706  return 1;
3707  DetectEngineThreadKeywordCtxItem remove = { .data = data, .name = name };
3708  if (HashListTableRemove(de_ctx->keyword_hash, (void *)&remove, 0) == 0)
3709  return 1;
3710  return 0;
3711 }
3712 /** \brief Retrieve thread local keyword ctx by id
3713  *
3714  * \param det_ctx detection engine thread ctx to retrieve the ctx from
3715  * \param id id of the ctx returned by DetectRegisterThreadCtxInitFunc at
3716  * keyword init.
3717  *
3718  * \retval ctx or NULL on error
3719  */
3721 {
3722  if (id < 0 || id > det_ctx->keyword_ctxs_size || det_ctx->keyword_ctxs_array == NULL)
3723  return NULL;
3724 
3725  return det_ctx->keyword_ctxs_array[id];
3726 }
3727 
3728 
3729 /** \brief Register Thread keyword context Funcs (Global)
3730  *
3731  * IDs stay static over reloads and between tenants
3732  *
3733  * \param name keyword name for error printing
3734  * \param InitFunc function ptr
3735  * \param FreeFunc function ptr
3736  *
3737  * \retval id for retrieval of ctx at runtime
3738  * \retval -1 on error
3739  */
3741  void *(*InitFunc)(void *), void *data, void (*FreeFunc)(void *))
3742 {
3743  int id;
3744  BUG_ON(InitFunc == NULL || FreeFunc == NULL);
3745 
3746  DetectEngineMasterCtx *master = &g_master_de_ctx;
3747 
3748  /* if already registered, return existing id */
3750  while (item != NULL) {
3751  if (strcmp(name, item->name) == 0) {
3752  id = item->id;
3753  return id;
3754  }
3755 
3756  item = item->next;
3757  }
3758 
3759  item = SCCalloc(1, sizeof(*item));
3760  if (unlikely(item == NULL)) {
3761  return -1;
3762  }
3763  item->InitFunc = InitFunc;
3764  item->FreeFunc = FreeFunc;
3765  item->name = name;
3766  item->data = data;
3767 
3768  item->next = master->keyword_list;
3769  master->keyword_list = item;
3770  item->id = master->keyword_id++;
3771 
3772  id = item->id;
3773  return id;
3774 }
3775 
3776 /** \brief Retrieve thread local keyword ctx by id
3777  *
3778  * \param det_ctx detection engine thread ctx to retrieve the ctx from
3779  * \param id id of the ctx returned by DetectRegisterThreadCtxInitFunc at
3780  * keyword init.
3781  *
3782  * \retval ctx or NULL on error
3783  */
3785 {
3786  if (id < 0 || id > det_ctx->global_keyword_ctxs_size ||
3787  det_ctx->global_keyword_ctxs_array == NULL) {
3788  return NULL;
3789  }
3790 
3791  return det_ctx->global_keyword_ctxs_array[id];
3792 }
3793 
3794 /** \brief Check if detection is enabled
3795  * \retval bool true or false */
3797 {
3798  DetectEngineMasterCtx *master = &g_master_de_ctx;
3799  SCMutexLock(&master->lock);
3800 
3801  if (master->list == NULL) {
3802  SCMutexUnlock(&master->lock);
3803  return 0;
3804  }
3805 
3806  SCMutexUnlock(&master->lock);
3807  return 1;
3808 }
3809 
3811 {
3812  uint32_t version;
3813  DetectEngineMasterCtx *master = &g_master_de_ctx;
3814  SCMutexLock(&master->lock);
3815  version = master->version;
3816  SCMutexUnlock(&master->lock);
3817  return version;
3818 }
3819 
3821 {
3822  DetectEngineMasterCtx *master = &g_master_de_ctx;
3823  SCMutexLock(&master->lock);
3824  master->version++;
3825  SCLogDebug("master version now %u", master->version);
3826  SCMutexUnlock(&master->lock);
3827 }
3828 
3830 {
3831  DetectEngineMasterCtx *master = &g_master_de_ctx;
3832  SCMutexLock(&master->lock);
3833 
3834  DetectEngineCtx *de_ctx = master->list;
3835  while (de_ctx) {
3839  {
3840  de_ctx->ref_cnt++;
3841  SCLogDebug("de_ctx %p ref_cnt %u", de_ctx, de_ctx->ref_cnt);
3842  SCMutexUnlock(&master->lock);
3843  return de_ctx;
3844  }
3845  de_ctx = de_ctx->next;
3846  }
3847 
3848  SCMutexUnlock(&master->lock);
3849  return NULL;
3850 }
3851 
3853 {
3854  if (de_ctx == NULL)
3855  return NULL;
3856  de_ctx->ref_cnt++;
3857  return de_ctx;
3858 }
3859 
3860 static bool DetectEngineMultiTenantEnabledWithLock(void)
3861 {
3862  DetectEngineMasterCtx *master = &g_master_de_ctx;
3863  return master->multi_tenant_enabled;
3864 }
3865 
3867 {
3868  DetectEngineMasterCtx *master = &g_master_de_ctx;
3869  SCMutexLock(&master->lock);
3870  bool enabled = DetectEngineMultiTenantEnabledWithLock();
3871  SCMutexUnlock(&master->lock);
3872  return enabled;
3873 }
3874 
3875 /** \internal
3876  * \brief load a tenant from a yaml file
3877  *
3878  * \param tenant_id the tenant id by which the config is known
3879  * \param filename full path of a yaml file
3880  * \param loader_id id of loader thread or -1
3881  *
3882  * \retval 0 ok
3883  * \retval -1 failed
3884  */
3885 static int DetectEngineMultiTenantLoadTenant(uint32_t tenant_id, const char *filename, int loader_id)
3886 {
3887  DetectEngineCtx *de_ctx = NULL;
3888  char prefix[64];
3889 
3890  snprintf(prefix, sizeof(prefix), "multi-detect.%u", tenant_id);
3891 
3892  SCStat st;
3893  if (SCStatFn(filename, &st) != 0) {
3894  SCLogError("failed to stat file %s", filename);
3895  goto error;
3896  }
3897 
3898  de_ctx = DetectEngineGetByTenantId(tenant_id);
3899  if (de_ctx != NULL) {
3900  SCLogError("tenant %u already registered", tenant_id);
3902  goto error;
3903  }
3904 
3905  SCConfNode *node = SCConfGetNode(prefix);
3906  if (node == NULL) {
3907  SCLogError("failed to properly setup yaml %s", filename);
3908  goto error;
3909  }
3910 
3911  de_ctx = DetectEngineCtxInitWithPrefix(prefix, tenant_id);
3912  if (de_ctx == NULL) {
3913  SCLogError("initializing detection engine "
3914  "context failed.");
3915  goto error;
3916  }
3917  SCLogDebug("de_ctx %p with prefix %s", de_ctx, de_ctx->config_prefix);
3918 
3920  de_ctx->tenant_id = tenant_id;
3921  de_ctx->loader_id = loader_id;
3922  de_ctx->tenant_path = SCStrdup(filename);
3923  if (de_ctx->tenant_path == NULL) {
3924  SCLogError("Failed to duplicate path");
3925  goto error;
3926  }
3927 
3928  if (SigLoadSignatures(de_ctx, NULL, false) < 0) {
3929  SCLogError("Loading signatures failed.");
3930  goto error;
3931  }
3932 
3934 
3935  return 0;
3936 
3937 error:
3938  if (de_ctx != NULL) {
3940  }
3941  return -1;
3942 }
3943 
3944 static int DetectEngineMultiTenantReloadTenant(uint32_t tenant_id, const char *filename, int reload_cnt)
3945 {
3946  DetectEngineCtx *old_de_ctx = DetectEngineGetByTenantId(tenant_id);
3947  if (old_de_ctx == NULL) {
3948  SCLogError("tenant detect engine not found");
3949  return -1;
3950  }
3951 
3952  if (filename == NULL)
3953  filename = old_de_ctx->tenant_path;
3954 
3955  char prefix[64];
3956  snprintf(prefix, sizeof(prefix), "multi-detect.%u.reload.%d", tenant_id, reload_cnt);
3957  reload_cnt++;
3958  SCLogDebug("prefix %s", prefix);
3959 
3960  if (SCConfYamlLoadFileWithPrefix(filename, prefix) != 0) {
3961  SCLogError("failed to load yaml");
3962  goto error;
3963  }
3964 
3965  SCConfNode *node = SCConfGetNode(prefix);
3966  if (node == NULL) {
3967  SCLogError("failed to properly setup yaml %s", filename);
3968  goto error;
3969  }
3970 
3971  DetectEngineCtx *new_de_ctx = DetectEngineCtxInitWithPrefix(prefix, tenant_id);
3972  if (new_de_ctx == NULL) {
3973  SCLogError("initializing detection engine "
3974  "context failed.");
3975  goto error;
3976  }
3977  SCLogDebug("de_ctx %p with prefix %s", new_de_ctx, new_de_ctx->config_prefix);
3978 
3979  new_de_ctx->type = DETECT_ENGINE_TYPE_TENANT;
3980  new_de_ctx->tenant_id = tenant_id;
3981  new_de_ctx->loader_id = old_de_ctx->loader_id;
3982  new_de_ctx->tenant_path = SCStrdup(filename);
3983  if (new_de_ctx->tenant_path == NULL) {
3984  SCLogError("Failed to duplicate path");
3985  goto new_de_ctx_error;
3986  }
3987 
3988  if (SigLoadSignatures(new_de_ctx, NULL, false) < 0) {
3989  SCLogError("Loading signatures failed.");
3990  goto new_de_ctx_error;
3991  }
3992 
3993  DetectEngineAddToMaster(new_de_ctx);
3994 
3995  /* move to free list */
3996  DetectEngineMoveToFreeList(old_de_ctx);
3997  DetectEngineDeReference(&old_de_ctx);
3998  return 0;
3999 
4000 new_de_ctx_error:
4001  DetectEngineCtxFree(new_de_ctx);
4002 
4003 error:
4004  DetectEngineDeReference(&old_de_ctx);
4005  return -1;
4006 }
4007 
4008 
4009 typedef struct TenantLoaderCtx_ {
4010  uint32_t tenant_id;
4011  int reload_cnt; /**< used by reload */
4012  char *yaml; /**< heap alloc'd copy of file path for the yaml */
4014 
4015 static void DetectLoaderFreeTenant(void *ctx)
4016 {
4018  if (t->yaml != NULL) {
4019  SCFree(t->yaml);
4020  }
4021  SCFree(t);
4022 }
4023 
4024 static int DetectLoaderFuncLoadTenant(void *vctx, int loader_id)
4025 {
4026  TenantLoaderCtx *ctx = (TenantLoaderCtx *)vctx;
4027 
4028  SCLogDebug("loader %d", loader_id);
4029  if (DetectEngineMultiTenantLoadTenant(ctx->tenant_id, ctx->yaml, loader_id) != 0) {
4030  return -1;
4031  }
4032  return 0;
4033 }
4034 
4035 static int DetectLoaderSetupLoadTenant(uint32_t tenant_id, const char *yaml)
4036 {
4037  TenantLoaderCtx *t = SCCalloc(1, sizeof(*t));
4038  if (t == NULL)
4039  return -ENOMEM;
4040 
4041  t->tenant_id = tenant_id;
4042  t->yaml = SCStrdup(yaml);
4043  if (t->yaml == NULL) {
4044  SCFree(t);
4045  return -ENOMEM;
4046  }
4047 
4048  return DetectLoaderQueueTask(-1, DetectLoaderFuncLoadTenant, t, DetectLoaderFreeTenant);
4049 }
4050 
4051 static int DetectLoaderFuncReloadTenant(void *vctx, int loader_id)
4052 {
4053  TenantLoaderCtx *ctx = (TenantLoaderCtx *)vctx;
4054 
4055  SCLogDebug("loader_id %d", loader_id);
4056 
4057  if (DetectEngineMultiTenantReloadTenant(ctx->tenant_id, ctx->yaml, ctx->reload_cnt) != 0) {
4058  return -1;
4059  }
4060  return 0;
4061 }
4062 
4063 static int DetectLoaderSetupReloadTenants(const int reload_cnt)
4064 {
4065  int ret = 0;
4066  DetectEngineMasterCtx *master = &g_master_de_ctx;
4067  SCMutexLock(&master->lock);
4068 
4069  DetectEngineCtx *de_ctx = master->list;
4070  while (de_ctx) {
4072  TenantLoaderCtx *t = SCCalloc(1, sizeof(*t));
4073  if (t == NULL) {
4074  ret = -1;
4075  goto error;
4076  }
4077  t->tenant_id = de_ctx->tenant_id;
4078  t->reload_cnt = reload_cnt;
4079  int loader_id = de_ctx->loader_id;
4080 
4081  int r = DetectLoaderQueueTask(
4082  loader_id, DetectLoaderFuncReloadTenant, t, DetectLoaderFreeTenant);
4083  if (r < 0) {
4084  ret = -2;
4085  goto error;
4086  }
4087  }
4088 
4089  de_ctx = de_ctx->next;
4090  }
4091 error:
4092  SCMutexUnlock(&master->lock);
4093  return ret;
4094 }
4095 
4096 static int DetectLoaderSetupReloadTenant(uint32_t tenant_id, const char *yaml, int reload_cnt)
4097 {
4098  DetectEngineCtx *old_de_ctx = DetectEngineGetByTenantId(tenant_id);
4099  if (old_de_ctx == NULL)
4100  return -ENOENT;
4101  int loader_id = old_de_ctx->loader_id;
4102  DetectEngineDeReference(&old_de_ctx);
4103 
4104  TenantLoaderCtx *t = SCCalloc(1, sizeof(*t));
4105  if (t == NULL)
4106  return -ENOMEM;
4107 
4108  t->tenant_id = tenant_id;
4109  if (yaml != NULL) {
4110  t->yaml = SCStrdup(yaml);
4111  if (t->yaml == NULL) {
4112  SCFree(t);
4113  return -ENOMEM;
4114  }
4115  }
4116  t->reload_cnt = reload_cnt;
4117 
4118  SCLogDebug("loader_id %d", loader_id);
4119 
4120  return DetectLoaderQueueTask(
4121  loader_id, DetectLoaderFuncReloadTenant, t, DetectLoaderFreeTenant);
4122 }
4123 
4124 /** \brief Load a tenant and wait for loading to complete
4125  */
4126 int DetectEngineLoadTenantBlocking(uint32_t tenant_id, const char *yaml)
4127 {
4128  int r = DetectLoaderSetupLoadTenant(tenant_id, yaml);
4129  if (r < 0)
4130  return r;
4131 
4132  if (DetectLoadersSync() != 0)
4133  return -1;
4134 
4135  return 0;
4136 }
4137 
4138 /** \brief Reload a tenant and wait for loading to complete
4139  */
4140 int DetectEngineReloadTenantBlocking(uint32_t tenant_id, const char *yaml, int reload_cnt)
4141 {
4142  int r = DetectLoaderSetupReloadTenant(tenant_id, yaml, reload_cnt);
4143  if (r < 0)
4144  return r;
4145 
4146  if (DetectLoadersSync() != 0)
4147  return -1;
4148 
4149  return 0;
4150 }
4151 
4152 /** \brief Reload all tenants and wait for loading to complete
4153  */
4154 int DetectEngineReloadTenantsBlocking(const int reload_cnt)
4155 {
4156  int r = DetectLoaderSetupReloadTenants(reload_cnt);
4157  if (r < 0)
4158  return r;
4159 
4160  if (DetectLoadersSync() != 0)
4161  return -1;
4162 
4163  return 0;
4164 }
4165 
4166 static int DetectEngineMultiTenantSetupLoadLivedevMappings(
4167  const SCConfNode *mappings_root_node, bool failure_fatal)
4168 {
4169  SCConfNode *mapping_node = NULL;
4170 
4171  int mapping_cnt = 0;
4172  if (mappings_root_node != NULL) {
4173  TAILQ_FOREACH(mapping_node, &mappings_root_node->head, next) {
4174  SCConfNode *tenant_id_node = SCConfNodeLookupChild(mapping_node, "tenant-id");
4175  if (tenant_id_node == NULL)
4176  goto bad_mapping;
4177  SCConfNode *device_node = SCConfNodeLookupChild(mapping_node, "device");
4178  if (device_node == NULL)
4179  goto bad_mapping;
4180 
4181  uint32_t tenant_id = 0;
4182  if (StringParseUint32(&tenant_id, 10, (uint16_t)strlen(tenant_id_node->val),
4183  tenant_id_node->val) < 0) {
4184  SCLogError("tenant-id "
4185  "of %s is invalid",
4186  tenant_id_node->val);
4187  goto bad_mapping;
4188  }
4189 
4190  const char *dev = device_node->val;
4191  LiveDevice *ld = LiveGetDevice(dev);
4192  if (ld == NULL) {
4193  SCLogWarning("device %s not found", dev);
4194  goto bad_mapping;
4195  }
4196 
4197  if (ld->tenant_id_set) {
4198  SCLogWarning("device %s already mapped to tenant-id %u", dev, ld->tenant_id);
4199  goto bad_mapping;
4200  }
4201 
4202  ld->tenant_id = tenant_id;
4203  ld->tenant_id_set = true;
4204 
4205  if (DetectEngineTenantRegisterLivedev(tenant_id, ld->id) != 0) {
4206  goto error;
4207  }
4208 
4209  SCLogConfig("device %s connected to tenant-id %u", dev, tenant_id);
4210  mapping_cnt++;
4211  continue;
4212 
4213  bad_mapping:
4214  if (failure_fatal)
4215  goto error;
4216  }
4217  }
4218  SCLogConfig("%d device - tenant-id mappings defined", mapping_cnt);
4219  return mapping_cnt;
4220 
4221 error:
4222  return 0;
4223 }
4224 
4225 static int DetectEngineMultiTenantSetupLoadVlanMappings(
4226  const SCConfNode *mappings_root_node, bool failure_fatal)
4227 {
4228  SCConfNode *mapping_node = NULL;
4229 
4230  int mapping_cnt = 0;
4231  if (mappings_root_node != NULL) {
4232  TAILQ_FOREACH(mapping_node, &mappings_root_node->head, next) {
4233  SCConfNode *tenant_id_node = SCConfNodeLookupChild(mapping_node, "tenant-id");
4234  if (tenant_id_node == NULL)
4235  goto bad_mapping;
4236  SCConfNode *vlan_id_node = SCConfNodeLookupChild(mapping_node, "vlan-id");
4237  if (vlan_id_node == NULL)
4238  goto bad_mapping;
4239 
4240  uint32_t tenant_id = 0;
4241  if (StringParseUint32(&tenant_id, 10, (uint16_t)strlen(tenant_id_node->val),
4242  tenant_id_node->val) < 0) {
4243  SCLogError("tenant-id "
4244  "of %s is invalid",
4245  tenant_id_node->val);
4246  goto bad_mapping;
4247  }
4248 
4249  uint16_t vlan_id = 0;
4250  if (StringParseUint16(
4251  &vlan_id, 10, (uint16_t)strlen(vlan_id_node->val), vlan_id_node->val) < 0) {
4252  SCLogError("vlan-id "
4253  "of %s is invalid",
4254  vlan_id_node->val);
4255  goto bad_mapping;
4256  }
4257  if (vlan_id == 0 || vlan_id >= 4095) {
4258  SCLogError("vlan-id "
4259  "of %s is invalid. Valid range 1-4094.",
4260  vlan_id_node->val);
4261  goto bad_mapping;
4262  }
4263 
4264  if (DetectEngineTenantRegisterVlanId(tenant_id, vlan_id) != 0) {
4265  goto error;
4266  }
4267  SCLogConfig("vlan %u connected to tenant-id %u", vlan_id, tenant_id);
4268  mapping_cnt++;
4269  continue;
4270 
4271  bad_mapping:
4272  if (failure_fatal)
4273  goto error;
4274  }
4275  }
4276  return mapping_cnt;
4277 
4278 error:
4279  return 0;
4280 }
4281 
4282 /**
4283  * \brief setup multi-detect / multi-tenancy
4284  *
4285  * See if MT is enabled. If so, setup the selector, tenants and mappings.
4286  * Tenants and mappings are optional, and can also dynamically be added
4287  * and removed from the unix socket.
4288  */
4289 int DetectEngineMultiTenantSetup(const bool unix_socket)
4290 {
4292  DetectEngineMasterCtx *master = &g_master_de_ctx;
4293  int failure_fatal = 0;
4294  (void)SCConfGetBool("engine.init-failure-fatal", &failure_fatal);
4295 
4296  int enabled = 0;
4297  (void)SCConfGetBool("multi-detect.enabled", &enabled);
4298  if (enabled == 1) {
4303 
4304  SCMutexLock(&master->lock);
4305  master->multi_tenant_enabled = 1;
4306 
4307  const char *handler = NULL;
4308  if (SCConfGet("multi-detect.selector", &handler) == 1) {
4309  SCLogConfig("multi-tenant selector type %s", handler);
4310 
4311  if (strcmp(handler, "vlan") == 0) {
4312  tenant_selector = master->tenant_selector = TENANT_SELECTOR_VLAN;
4313 
4314  int vlanbool = 0;
4315  if ((SCConfGetBool("vlan.use-for-tracking", &vlanbool)) == 1 && vlanbool == 0) {
4316  SCLogError("vlan tracking is disabled, "
4317  "can't use multi-detect selector 'vlan'");
4318  SCMutexUnlock(&master->lock);
4319  goto error;
4320  }
4321 
4322  } else if (strcmp(handler, "direct") == 0) {
4323  tenant_selector = master->tenant_selector = TENANT_SELECTOR_DIRECT;
4324  } else if (strcmp(handler, "device") == 0) {
4325  tenant_selector = master->tenant_selector = TENANT_SELECTOR_LIVEDEV;
4326  if (EngineModeIsIPS()) {
4327  SCLogWarning("multi-tenant 'device' mode not supported for IPS");
4328  SCMutexUnlock(&master->lock);
4329  goto error;
4330  }
4331 
4332  } else {
4333  SCLogError("unknown value %s "
4334  "multi-detect.selector",
4335  handler);
4336  SCMutexUnlock(&master->lock);
4337  goto error;
4338  }
4339  }
4340  SCMutexUnlock(&master->lock);
4341  SCLogConfig("multi-detect is enabled (multi tenancy). Selector: %s", handler);
4342 
4343  /* traffic -- tenant mappings */
4344  SCConfNode *mappings_root_node = SCConfGetNode("multi-detect.mappings");
4345 
4346  if (tenant_selector == TENANT_SELECTOR_VLAN) {
4347  int mapping_cnt = DetectEngineMultiTenantSetupLoadVlanMappings(mappings_root_node,
4348  failure_fatal);
4349  if (mapping_cnt == 0) {
4350  /* no mappings are valid when we're in unix socket mode,
4351  * they can be added on the fly. Otherwise warn/error
4352  * depending on failure_fatal */
4353 
4354  if (unix_socket) {
4355  SCLogNotice("no tenant traffic mappings defined, "
4356  "tenants won't be used until mappings are added");
4357  } else {
4358  if (failure_fatal) {
4359  SCLogError("no multi-detect mappings defined");
4360  goto error;
4361  } else {
4362  SCLogWarning("no multi-detect mappings defined");
4363  }
4364  }
4365  }
4366  } else if (tenant_selector == TENANT_SELECTOR_LIVEDEV) {
4367  int mapping_cnt = DetectEngineMultiTenantSetupLoadLivedevMappings(mappings_root_node,
4368  failure_fatal);
4369  if (mapping_cnt == 0) {
4370  if (failure_fatal) {
4371  SCLogError("no multi-detect mappings defined");
4372  goto error;
4373  } else {
4374  SCLogWarning("no multi-detect mappings defined");
4375  }
4376  }
4377  }
4378 
4379  /* tenants */
4380  SCConfNode *tenants_root_node = SCConfGetNode("multi-detect.tenants");
4381  SCConfNode *tenant_node = NULL;
4382 
4383  if (tenants_root_node != NULL) {
4384  const char *path = NULL;
4385  SCConfNode *path_node = SCConfGetNode("multi-detect.config-path");
4386  if (path_node) {
4387  path = path_node->val;
4388  SCLogConfig("tenants config path: %s", path);
4389  }
4390 
4391  TAILQ_FOREACH(tenant_node, &tenants_root_node->head, next) {
4392  SCConfNode *id_node = SCConfNodeLookupChild(tenant_node, "id");
4393  if (id_node == NULL) {
4394  goto bad_tenant;
4395  }
4396  SCConfNode *yaml_node = SCConfNodeLookupChild(tenant_node, "yaml");
4397  if (yaml_node == NULL) {
4398  goto bad_tenant;
4399  }
4400 
4401  uint32_t tenant_id = 0;
4402  if (StringParseUint32(
4403  &tenant_id, 10, (uint16_t)strlen(id_node->val), id_node->val) < 0) {
4404  SCLogError("tenant_id "
4405  "of %s is invalid",
4406  id_node->val);
4407  goto bad_tenant;
4408  }
4409  SCLogDebug("tenant id: %u, %s", tenant_id, yaml_node->val);
4410 
4411  char yaml_path[PATH_MAX] = "";
4412  if (path) {
4413  if (PathMerge(yaml_path, PATH_MAX, path, yaml_node->val) < 0)
4414  goto bad_tenant;
4415  } else {
4416  size_t r = strlcpy(yaml_path, yaml_node->val, sizeof(yaml_path));
4417  if (r >= sizeof(yaml_path))
4418  goto bad_tenant;
4419  }
4420  SCLogDebug("tenant path: %s", yaml_path);
4421 
4422  /* setup the yaml in this loop so that it's not done by the loader
4423  * threads. SCConfYamlLoadFileWithPrefix is not thread safe. */
4424  char prefix[64];
4425  snprintf(prefix, sizeof(prefix), "multi-detect.%u", tenant_id);
4426  if (SCConfYamlLoadFileWithPrefix(yaml_path, prefix) != 0) {
4427  SCLogError("failed to load yaml %s", yaml_path);
4428  goto bad_tenant;
4429  }
4430 
4431  int r = DetectLoaderSetupLoadTenant(tenant_id, yaml_path);
4432  if (r < 0) {
4433  /* error logged already */
4434  goto bad_tenant;
4435  }
4436  continue;
4437 
4438  bad_tenant:
4439  if (failure_fatal)
4440  goto error;
4441  }
4442  }
4443 
4444  /* wait for our loaders to complete their tasks */
4445  if (DetectLoadersSync() != 0) {
4446  goto error;
4447  }
4448 
4450 
4451  } else {
4452  SCLogDebug("multi-detect not enabled (multi tenancy)");
4453  }
4454  return 0;
4455 error:
4456  return -1;
4457 }
4458 
4459 static uint32_t DetectEngineTenantGetIdFromVlanId(const void *ctx, const Packet *p)
4460 {
4461  const DetectEngineThreadCtx *det_ctx = ctx;
4462  uint32_t x = 0;
4463  uint32_t vlan_id = 0;
4464 
4465  if (p->vlan_idx == 0)
4466  return 0;
4467 
4468  vlan_id = p->vlan_id[0];
4469 
4470  if (det_ctx == NULL || det_ctx->tenant_array == NULL || det_ctx->tenant_array_size == 0)
4471  return 0;
4472 
4473  /* not very efficient, but for now we're targeting only limited amounts.
4474  * Can use hash/tree approach later. */
4475  for (x = 0; x < det_ctx->tenant_array_size; x++) {
4476  if (det_ctx->tenant_array[x].traffic_id == vlan_id)
4477  return det_ctx->tenant_array[x].tenant_id;
4478  }
4479 
4480  return 0;
4481 }
4482 
4483 static uint32_t DetectEngineTenantGetIdFromLivedev(const void *ctx, const Packet *p)
4484 {
4485  const DetectEngineThreadCtx *det_ctx = ctx;
4486  const LiveDevice *ld = p->livedev;
4487 
4488  if (ld == NULL || det_ctx == NULL)
4489  return 0;
4490 
4491  SCLogDebug("using tenant-id %u for packet on device %s", ld->tenant_id, ld->dev);
4492  return ld->tenant_id;
4493 }
4494 
4495 static int DetectEngineTenantRegisterSelector(
4496  enum DetectEngineTenantSelectors selector, uint32_t tenant_id, uint32_t traffic_id)
4497 {
4498  DetectEngineMasterCtx *master = &g_master_de_ctx;
4499  SCMutexLock(&master->lock);
4500 
4501  if (!(master->tenant_selector == TENANT_SELECTOR_UNKNOWN || master->tenant_selector == selector)) {
4502  SCLogInfo("conflicting selector already set");
4503  SCMutexUnlock(&master->lock);
4504  return -1;
4505  }
4506 
4508  while (m) {
4509  if (m->traffic_id == traffic_id) {
4510  SCLogInfo("traffic id already registered");
4511  SCMutexUnlock(&master->lock);
4512  return -1;
4513  }
4514  m = m->next;
4515  }
4516 
4517  DetectEngineTenantMapping *map = SCCalloc(1, sizeof(*map));
4518  if (map == NULL) {
4519  SCLogInfo("memory fail");
4520  SCMutexUnlock(&master->lock);
4521  return -1;
4522  }
4523  map->traffic_id = traffic_id;
4524  map->tenant_id = tenant_id;
4525 
4526  map->next = master->tenant_mapping_list;
4527  master->tenant_mapping_list = map;
4528 
4529  master->tenant_selector = selector;
4530 
4531  SCLogDebug("tenant handler %u %u %u registered", selector, tenant_id, traffic_id);
4532  SCMutexUnlock(&master->lock);
4533  return 0;
4534 }
4535 
4536 static int DetectEngineTenantUnregisterSelector(
4537  enum DetectEngineTenantSelectors selector, uint32_t tenant_id, uint32_t traffic_id)
4538 {
4539  DetectEngineMasterCtx *master = &g_master_de_ctx;
4540  SCMutexLock(&master->lock);
4541 
4542  if (master->tenant_mapping_list == NULL) {
4543  SCMutexUnlock(&master->lock);
4544  return -1;
4545  }
4546 
4547  DetectEngineTenantMapping *prev = NULL;
4549  while (map) {
4550  if (map->traffic_id == traffic_id &&
4551  map->tenant_id == tenant_id)
4552  {
4553  if (prev != NULL)
4554  prev->next = map->next;
4555  else
4556  master->tenant_mapping_list = map->next;
4557 
4558  map->next = NULL;
4559  SCFree(map);
4560  SCLogInfo("tenant handler %u %u %u unregistered", selector, tenant_id, traffic_id);
4561  SCMutexUnlock(&master->lock);
4562  return 0;
4563  }
4564  prev = map;
4565  map = map->next;
4566  }
4567 
4568  SCMutexUnlock(&master->lock);
4569  return -1;
4570 }
4571 
4572 int DetectEngineTenantRegisterLivedev(uint32_t tenant_id, int device_id)
4573 {
4574  return DetectEngineTenantRegisterSelector(
4575  TENANT_SELECTOR_LIVEDEV, tenant_id, (uint32_t)device_id);
4576 }
4577 
4578 int DetectEngineTenantRegisterVlanId(uint32_t tenant_id, uint16_t vlan_id)
4579 {
4580  return DetectEngineTenantRegisterSelector(TENANT_SELECTOR_VLAN, tenant_id, (uint32_t)vlan_id);
4581 }
4582 
4583 int DetectEngineTenantUnregisterVlanId(uint32_t tenant_id, uint16_t vlan_id)
4584 {
4585  return DetectEngineTenantUnregisterSelector(TENANT_SELECTOR_VLAN, tenant_id, (uint32_t)vlan_id);
4586 }
4587 
4588 int DetectEngineTenantRegisterPcapFile(uint32_t tenant_id)
4589 {
4590  SCLogInfo("registering %u %d 0", TENANT_SELECTOR_DIRECT, tenant_id);
4591  return DetectEngineTenantRegisterSelector(TENANT_SELECTOR_DIRECT, tenant_id, 0);
4592 }
4593 
4595 {
4596  SCLogInfo("unregistering %u %d 0", TENANT_SELECTOR_DIRECT, tenant_id);
4597  return DetectEngineTenantUnregisterSelector(TENANT_SELECTOR_DIRECT, tenant_id, 0);
4598 }
4599 
4600 static uint32_t DetectEngineTenantGetIdFromPcap(const void *ctx, const Packet *p)
4601 {
4602  return p->pcap_v.tenant_id;
4603 }
4604 
4606 {
4607  DetectEngineMasterCtx *master = &g_master_de_ctx;
4608  SCMutexLock(&master->lock);
4609 
4610  if (master->list == NULL) {
4611  SCMutexUnlock(&master->lock);
4612  return NULL;
4613  }
4614 
4615  DetectEngineCtx *de_ctx = master->list;
4616  while (de_ctx) {
4618  de_ctx->tenant_id == tenant_id)
4619  {
4620  de_ctx->ref_cnt++;
4621  break;
4622  }
4623 
4624  de_ctx = de_ctx->next;
4625  }
4626 
4627  SCMutexUnlock(&master->lock);
4628  return de_ctx;
4629 }
4630 
4632 {
4633  DEBUG_VALIDATE_BUG_ON((*de_ctx)->ref_cnt == 0);
4634  (*de_ctx)->ref_cnt--;
4635  *de_ctx = NULL;
4636 }
4637 
4638 static int DetectEngineAddToList(DetectEngineCtx *instance)
4639 {
4640  DetectEngineMasterCtx *master = &g_master_de_ctx;
4641 
4642  if (instance == NULL)
4643  return -1;
4644 
4645  if (master->list == NULL) {
4646  master->list = instance;
4647  } else {
4648  instance->next = master->list;
4649  master->list = instance;
4650  }
4651 
4652  return 0;
4653 }
4654 
4656 {
4657  int r;
4658 
4659  if (de_ctx == NULL)
4660  return -1;
4661 
4662  SCLogDebug("adding de_ctx %p to master", de_ctx);
4663 
4664  DetectEngineMasterCtx *master = &g_master_de_ctx;
4665  SCMutexLock(&master->lock);
4666  r = DetectEngineAddToList(de_ctx);
4667  SCMutexUnlock(&master->lock);
4668  return r;
4669 }
4670 
4671 static int DetectEngineMoveToFreeListNoLock(DetectEngineMasterCtx *master, DetectEngineCtx *de_ctx)
4672 {
4673  DetectEngineCtx *instance = master->list;
4674  if (instance == NULL) {
4675  return -1;
4676  }
4677 
4678  /* remove from active list */
4679  if (instance == de_ctx) {
4680  master->list = instance->next;
4681  } else {
4682  DetectEngineCtx *prev = instance;
4683  instance = instance->next; /* already checked first element */
4684 
4685  while (instance) {
4686  DetectEngineCtx *next = instance->next;
4687 
4688  if (instance == de_ctx) {
4689  prev->next = instance->next;
4690  break;
4691  }
4692 
4693  prev = instance;
4694  instance = next;
4695  }
4696  if (instance == NULL) {
4697  return -1;
4698  }
4699  }
4700 
4701  /* instance is now detached from list */
4702  instance->next = NULL;
4703 
4704  /* add to free list */
4705  if (master->free_list == NULL) {
4706  master->free_list = instance;
4707  } else {
4708  instance->next = master->free_list;
4709  master->free_list = instance;
4710  }
4711  SCLogDebug("detect engine %p moved to free list (%u refs)", de_ctx, de_ctx->ref_cnt);
4712  return 0;
4713 }
4714 
4716 {
4717  int ret = 0;
4718  DetectEngineMasterCtx *master = &g_master_de_ctx;
4719  SCMutexLock(&master->lock);
4720  ret = DetectEngineMoveToFreeListNoLock(master, de_ctx);
4721  SCMutexUnlock(&master->lock);
4722  return ret;
4723 }
4724 
4726 {
4727  DetectEngineMasterCtx *master = &g_master_de_ctx;
4728  SCMutexLock(&master->lock);
4729 
4730  DetectEngineCtx *prev = NULL;
4731  DetectEngineCtx *instance = master->free_list;
4732  while (instance) {
4733  DetectEngineCtx *next = instance->next;
4734 
4735  SCLogDebug("detect engine %p has %u ref(s)", instance, instance->ref_cnt);
4736 
4737  if (instance->ref_cnt == 0) {
4738  if (prev == NULL) {
4739  master->free_list = next;
4740  } else {
4741  prev->next = next;
4742  }
4743 
4744  SCLogDebug("freeing detect engine %p", instance);
4745  DetectEngineCtxFree(instance);
4746  instance = NULL;
4747  }
4748 
4749  prev = instance;
4750  instance = next;
4751  }
4752  SCMutexUnlock(&master->lock);
4753 }
4754 
4756 {
4757  DetectEngineMasterCtx *master = &g_master_de_ctx;
4758  SCMutexLock(&master->lock);
4759 
4760  DetectEngineCtx *instance = master->list;
4761  while (instance) {
4762  DetectEngineCtx *next = instance->next;
4763  DEBUG_VALIDATE_BUG_ON(instance->ref_cnt);
4764  SCLogDebug("detect engine %p has %u ref(s)", instance, instance->ref_cnt);
4765  instance->ref_cnt = 0;
4766  DetectEngineMoveToFreeListNoLock(master, instance);
4767  instance = next;
4768  }
4769  SCMutexUnlock(&master->lock);
4771 }
4772 
4773 static int reloads = 0;
4774 
4775 /** \brief Reload the detection engine
4776  *
4777  * \param filename YAML file to load for the detect config
4778  *
4779  * \retval -1 error
4780  * \retval 0 ok
4781  */
4783 {
4784  DetectEngineCtx *new_de_ctx = NULL;
4785  DetectEngineCtx *old_de_ctx = NULL;
4786 
4787  char prefix[128];
4788  memset(prefix, 0, sizeof(prefix));
4789 
4790  SCLogNotice("rule reload starting");
4791 
4792  if (suri->conf_filename != NULL) {
4793  snprintf(prefix, sizeof(prefix), "detect-engine-reloads.%d", reloads++);
4794  SCLogConfig("Reloading %s", suri->conf_filename);
4795  if (SCConfYamlLoadFileWithPrefix(suri->conf_filename, prefix) != 0) {
4796  SCLogError("failed to load yaml %s", suri->conf_filename);
4797  return -1;
4798  }
4799 
4800  SCConfNode *node = SCConfGetNode(prefix);
4801  if (node == NULL) {
4802  SCLogError("failed to properly setup yaml %s", suri->conf_filename);
4803  return -1;
4804  }
4805 
4806  if (suri->additional_configs) {
4807  for (int i = 0; suri->additional_configs[i] != NULL; i++) {
4808  SCLogConfig("Reloading %s", suri->additional_configs[i]);
4810  }
4811  }
4812 
4813 #if 0
4814  SCConfDump();
4815 #endif
4816  }
4817 
4818  /* get a reference to the current de_ctx */
4819  old_de_ctx = DetectEngineGetCurrent();
4820  if (old_de_ctx == NULL)
4821  return -1;
4822  SCLogDebug("get ref to old_de_ctx %p", old_de_ctx);
4823  DatasetReload();
4824 
4825  /* only reload a regular 'normal' and 'delayed detect stub' detect engines */
4826  if (!(old_de_ctx->type == DETECT_ENGINE_TYPE_NORMAL ||
4827  old_de_ctx->type == DETECT_ENGINE_TYPE_DD_STUB))
4828  {
4829  DetectEngineDeReference(&old_de_ctx);
4830  SCLogNotice("rule reload complete");
4831  return -1;
4832  }
4833 
4834  /* get new detection engine */
4835  new_de_ctx = DetectEngineCtxInitWithPrefix(prefix, old_de_ctx->tenant_id);
4836  if (new_de_ctx == NULL) {
4837  SCLogError("initializing detection engine "
4838  "context failed.");
4839  DetectEngineDeReference(&old_de_ctx);
4840  return -1;
4841  }
4842  if (SigLoadSignatures(new_de_ctx,
4843  suri->sig_file, suri->sig_file_exclusive) != 0) {
4844  DetectEngineCtxFree(new_de_ctx);
4845  DetectEngineDeReference(&old_de_ctx);
4846  return -1;
4847  }
4848  SCLogDebug("set up new_de_ctx %p", new_de_ctx);
4849 
4850  /* Copy over callbacks. */
4851  new_de_ctx->RateFilterCallback = old_de_ctx->RateFilterCallback;
4852  new_de_ctx->rate_filter_callback_arg = old_de_ctx->rate_filter_callback_arg;
4853 
4854  /* add to master */
4855  DetectEngineAddToMaster(new_de_ctx);
4856 
4857  /* move to old free list */
4858  DetectEngineMoveToFreeList(old_de_ctx);
4859  DetectEngineDeReference(&old_de_ctx);
4860 
4861  SCLogDebug("going to reload the threads to use new_de_ctx %p", new_de_ctx);
4862  /* update the threads */
4863  DetectEngineReloadThreads(new_de_ctx);
4864  SCLogDebug("threads now run new_de_ctx %p", new_de_ctx);
4865 
4866  /* walk free list, freeing the old_de_ctx */
4868 
4870 
4872 
4873  SCLogDebug("old_de_ctx should have been freed");
4874 
4875  SCLogNotice("rule reload complete");
4876 
4877 #ifdef HAVE_MALLOC_TRIM
4878  /* The reload process potentially frees up large amounts of memory.
4879  * Encourage the memory management system to reclaim as much as it
4880  * can.
4881  */
4882  malloc_trim(0);
4883 #endif
4884 
4885  return 0;
4886 }
4887 
4888 static uint32_t TenantIdHash(HashTable *h, void *data, uint16_t data_len)
4889 {
4890  DetectEngineThreadCtx *det_ctx = (DetectEngineThreadCtx *)data;
4891  return det_ctx->tenant_id % h->array_size;
4892 }
4893 
4894 static char TenantIdCompare(void *d1, uint16_t d1_len, void *d2, uint16_t d2_len)
4895 {
4898  return (det1->tenant_id == det2->tenant_id);
4899 }
4900 
4901 static void TenantIdFree(void *d)
4902 {
4903  DetectEngineThreadCtxFree(d);
4904 }
4905 
4907 {
4908  DetectEngineMasterCtx *master = &g_master_de_ctx;
4909  SCMutexLock(&master->lock);
4910 
4911  if (master->tenant_selector == TENANT_SELECTOR_UNKNOWN) {
4912  SCLogInfo("error, no tenant selector");
4913  SCMutexUnlock(&master->lock);
4914  return -1;
4915  }
4916 
4917  DetectEngineCtx *stub_de_ctx = NULL;
4918  DetectEngineCtx *list = master->list;
4919  for ( ; list != NULL; list = list->next) {
4920  SCLogDebug("list %p tenant %u", list, list->tenant_id);
4921 
4922  if (list->type == DETECT_ENGINE_TYPE_NORMAL ||
4923  list->type == DETECT_ENGINE_TYPE_MT_STUB ||
4925  {
4926  stub_de_ctx = list;
4927  break;
4928  }
4929  }
4930  if (stub_de_ctx == NULL) {
4931  stub_de_ctx = DetectEngineCtxInitStubForMT();
4932  if (stub_de_ctx == NULL) {
4933  SCMutexUnlock(&master->lock);
4934  return -1;
4935  }
4936 
4937  if (master->list == NULL) {
4938  master->list = stub_de_ctx;
4939  } else {
4940  stub_de_ctx->next = master->list;
4941  master->list = stub_de_ctx;
4942  }
4943  }
4944 
4945  /* update the threads */
4946  SCLogDebug("MT reload starting");
4947  DetectEngineReloadThreads(stub_de_ctx);
4948  SCLogDebug("MT reload done");
4949 
4950  SCMutexUnlock(&master->lock);
4951 
4952  /* walk free list, freeing the old_de_ctx */
4954  // needed for VarNameStoreFree
4956 
4957  SCLogDebug("old_de_ctx should have been freed");
4958  return 0;
4959 }
4960 
4961 static int g_parse_metadata = 0;
4962 
4964 {
4965  g_parse_metadata = 1;
4966 }
4967 
4969 {
4970  g_parse_metadata = 0;
4971 }
4972 
4974 {
4975  return g_parse_metadata;
4976 }
4977 
4979 {
4980  switch (type) {
4981  case DETECT_SM_LIST_MATCH:
4982  return "packet";
4983  case DETECT_SM_LIST_PMATCH:
4984  return "packet/stream payload";
4985 
4986  case DETECT_SM_LIST_TMATCH:
4987  return "tag";
4988 
4990  return "base64_data";
4991 
4993  return "post-match";
4994 
4996  return "suppress";
4998  return "threshold";
4999 
5000  case DETECT_SM_LIST_MAX:
5001  return "max (internal)";
5002  }
5003  return "error";
5004 }
5005 
5006 /* events api */
5008 {
5010  det_ctx->events++;
5011 }
5012 
5014  const Signature *s, const char **sigerror, const DetectBufferType *map)
5015 {
5016  for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
5017  if (s->init_data->buffers[x].id != (uint32_t)map->id)
5018  continue;
5019  const SigMatch *sm = s->init_data->buffers[x].head;
5020  for (; sm != NULL; sm = sm->next) {
5021  if (sm->type != DETECT_CONTENT)
5022  continue;
5023 
5024  const DetectContentData *cd = (DetectContentData *)sm->ctx;
5025  if (cd->flags & DETECT_CONTENT_NOCASE) {
5026  *sigerror = "md5-like keyword should not be used together with "
5027  "nocase, since the rule is automatically "
5028  "lowercased anyway which makes nocase redundant.";
5029  SCLogWarning("rule %u: buffer %s: %s", s->id, map->name, *sigerror);
5030  }
5031 
5032  if (cd->content_len != SC_MD5_HEX_LEN) {
5033  *sigerror = "Invalid length for md5-like keyword (should "
5034  "be 32 characters long). This rule will therefore "
5035  "never match.";
5036  SCLogError("rule %u: buffer %s: %s", s->id, map->name, *sigerror);
5037  return false;
5038  }
5039 
5040  for (size_t i = 0; i < cd->content_len; ++i) {
5041  if (!isxdigit(cd->content[i])) {
5042  *sigerror =
5043  "Invalid md5-like string (should be string of hexadecimal characters)."
5044  "This rule will therefore never match.";
5045  SCLogWarning("rule %u: buffer %s: %s", s->id, map->name, *sigerror);
5046  return false;
5047  }
5048  }
5049  }
5050  }
5051  return true;
5052 }
5053 
5055 {
5057  de_ctx->RateFilterCallback = fn;
5060 }
5061 
5063 {
5064  if (det_ctx->json_content_len > SIG_JSON_CONTENT_ARRAY_LEN - 1) {
5065  SCLogDebug("json content length %u exceeds maximum %u", det_ctx->json_content_len,
5067  return -1;
5068  }
5069  if (det_ctx->json_content_len >= det_ctx->json_content_capacity) {
5070  if (det_ctx->json_content_capacity == 0) {
5071  det_ctx->json_content_capacity = 1;
5072  } else {
5073  det_ctx->json_content_capacity *= 2;
5074  }
5075  void *tmp = SCRealloc(
5076  det_ctx->json_content, det_ctx->json_content_capacity * sizeof(SigJsonContent));
5077  if (unlikely(tmp == NULL)) {
5078  return -1;
5079  }
5080  SCLogDebug("reallocated json content array to %u items", det_ctx->json_content_capacity);
5081  det_ctx->json_content = tmp;
5082  }
5083  return 0;
5084 }
5085 
5086 /*************************************Unittest*********************************/
5087 
5088 #ifdef UNITTESTS
5089 
5090 static int DetectEngineInitYamlConf(const char *conf)
5091 {
5093  SCConfInit();
5094  return SCConfYamlLoadString(conf, strlen(conf));
5095 }
5096 
5097 static void DetectEngineDeInitYamlConf(void)
5098 {
5099  SCConfDeInit();
5101 }
5102 
5103 static int DetectEngineTest01(void)
5104 {
5105  const char *conf =
5106  "%YAML 1.1\n"
5107  "---\n"
5108  "detect-engine:\n"
5109  " - profile: medium\n"
5110  " - custom-values:\n"
5111  " toclient_src_groups: 2\n"
5112  " toclient_dst_groups: 2\n"
5113  " toclient_sp_groups: 2\n"
5114  " toclient_dp_groups: 3\n"
5115  " toserver_src_groups: 2\n"
5116  " toserver_dst_groups: 4\n"
5117  " toserver_sp_groups: 2\n"
5118  " toserver_dp_groups: 25\n"
5119  " - inspection-recursion-limit: 0\n";
5120 
5121  FAIL_IF(DetectEngineInitYamlConf(conf) == -1);
5122 
5125 
5127 
5129 
5130  DetectEngineDeInitYamlConf();
5131 
5132  PASS;
5133 }
5134 
5135 static int DetectEngineTest02(void)
5136 {
5137  const char *conf =
5138  "%YAML 1.1\n"
5139  "---\n"
5140  "detect-engine:\n"
5141  " - profile: medium\n"
5142  " - custom-values:\n"
5143  " toclient_src_groups: 2\n"
5144  " toclient_dst_groups: 2\n"
5145  " toclient_sp_groups: 2\n"
5146  " toclient_dp_groups: 3\n"
5147  " toserver_src_groups: 2\n"
5148  " toserver_dst_groups: 4\n"
5149  " toserver_sp_groups: 2\n"
5150  " toserver_dp_groups: 25\n"
5151  " - inspection-recursion-limit:\n";
5152 
5153  FAIL_IF(DetectEngineInitYamlConf(conf) == -1);
5154 
5157 
5158  FAIL_IF_NOT(
5160 
5162 
5163  DetectEngineDeInitYamlConf();
5164 
5165  PASS;
5166 }
5167 
5168 static int DetectEngineTest03(void)
5169 {
5170  const char *conf =
5171  "%YAML 1.1\n"
5172  "---\n"
5173  "detect-engine:\n"
5174  " - profile: medium\n"
5175  " - custom-values:\n"
5176  " toclient_src_groups: 2\n"
5177  " toclient_dst_groups: 2\n"
5178  " toclient_sp_groups: 2\n"
5179  " toclient_dp_groups: 3\n"
5180  " toserver_src_groups: 2\n"
5181  " toserver_dst_groups: 4\n"
5182  " toserver_sp_groups: 2\n"
5183  " toserver_dp_groups: 25\n";
5184 
5185  FAIL_IF(DetectEngineInitYamlConf(conf) == -1);
5186 
5189 
5190  FAIL_IF_NOT(
5192 
5194 
5195  DetectEngineDeInitYamlConf();
5196 
5197  PASS;
5198 }
5199 
5200 static int DetectEngineTest04(void)
5201 {
5202  const char *conf =
5203  "%YAML 1.1\n"
5204  "---\n"
5205  "detect-engine:\n"
5206  " - profile: medium\n"
5207  " - custom-values:\n"
5208  " toclient_src_groups: 2\n"
5209  " toclient_dst_groups: 2\n"
5210  " toclient_sp_groups: 2\n"
5211  " toclient_dp_groups: 3\n"
5212  " toserver_src_groups: 2\n"
5213  " toserver_dst_groups: 4\n"
5214  " toserver_sp_groups: 2\n"
5215  " toserver_dp_groups: 25\n"
5216  " - inspection-recursion-limit: 10\n";
5217 
5218  FAIL_IF(DetectEngineInitYamlConf(conf) == -1);
5219 
5222 
5224 
5226 
5227  DetectEngineDeInitYamlConf();
5228 
5229  PASS;
5230 }
5231 
5232 static int DetectEngineTest08(void)
5233 {
5234  const char *conf =
5235  "%YAML 1.1\n"
5236  "---\n"
5237  "detect-engine:\n"
5238  " - profile: custom\n"
5239  " - custom-values:\n"
5240  " toclient-groups: 23\n"
5241  " toserver-groups: 27\n";
5242 
5243  FAIL_IF(DetectEngineInitYamlConf(conf) == -1);
5244 
5247 
5250 
5252 
5253  DetectEngineDeInitYamlConf();
5254 
5255  PASS;
5256 }
5257 
5258 /** \test bug 892 bad values */
5259 static int DetectEngineTest09(void)
5260 {
5261  const char *conf =
5262  "%YAML 1.1\n"
5263  "---\n"
5264  "detect-engine:\n"
5265  " - profile: custom\n"
5266  " - custom-values:\n"
5267  " toclient-groups: BA\n"
5268  " toserver-groups: BA\n"
5269  " - inspection-recursion-limit: 10\n";
5270 
5271  FAIL_IF(DetectEngineInitYamlConf(conf) == -1);
5272 
5275 
5278 
5280 
5281  DetectEngineDeInitYamlConf();
5282 
5283  PASS;
5284 }
5285 
5286 #endif
5287 
5289 {
5290 #ifdef UNITTESTS
5291  UtRegisterTest("DetectEngineTest01", DetectEngineTest01);
5292  UtRegisterTest("DetectEngineTest02", DetectEngineTest02);
5293  UtRegisterTest("DetectEngineTest03", DetectEngineTest03);
5294  UtRegisterTest("DetectEngineTest04", DetectEngineTest04);
5295  UtRegisterTest("DetectEngineTest08", DetectEngineTest08);
5296  UtRegisterTest("DetectEngineTest09", DetectEngineTest09);
5297 #endif
5298 }
DetectEngineThreadCtx_::byte_values
uint64_t * byte_values
Definition: detect.h:1279
DETECT_CONTENT_NOCASE
#define DETECT_CONTENT_NOCASE
Definition: detect-content.h:29
DETECT_TABLE_APP_TD
@ DETECT_TABLE_APP_TD
Definition: detect.h:559
DetectEngineAppInspectionEngine_::stream
bool stream
Definition: detect.h:421
HashListTableGetListData
#define HashListTableGetListData(hb)
Definition: util-hashlist.h:56
DE_STATE_ID_FILE_INSPECT
#define DE_STATE_ID_FILE_INSPECT
Definition: detect-engine-state.h:62
SCProfilingSghThreadCleanup
void SCProfilingSghThreadCleanup(DetectEngineThreadCtx *det_ctx)
Definition: util-profiling-rulegroups.c:329
DetectEngineCtxInitWithPrefix
DetectEngineCtx * DetectEngineCtxInitWithPrefix(const char *prefix, uint32_t tenant_id)
Definition: detect-engine.c:2599
DetectEngineTenantMapping_
Definition: detect.h:1708
util-device-private.h
util-byte.h
DetectAppLayerMpmMultiRegister
void DetectAppLayerMpmMultiRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionMultiBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
Definition: detect-engine-mpm.c:168
SCConfYamlLoadString
int SCConfYamlLoadString(const char *string, size_t len)
Load configuration from a YAML string.
Definition: conf-yaml-loader.c:523
tm-threads.h
DetectEngineAppInspectionEngine_
Definition: detect.h:416
DetectGetMultiData
InspectionBuffer * DetectGetMultiData(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id, uint32_t index, InspectionMultiBufferGetDataPtr GetBuf)
Definition: detect-engine.c:2125
util-hash-string.h
DetectBufferType_::supports_transforms
bool supports_transforms
Definition: detect.h:457
SignatureInitDataBuffer_::head
SigMatch * head
Definition: detect.h:534
DetectEngineSyncer_::m
SCMutex m
Definition: detect-engine.c:1881
DetectEngineAppInspectionEngine_::mpm
bool mpm
Definition: detect.h:420
DetectBufferType_::mpm
bool mpm
Definition: detect.h:454
detect-content.h
detect-engine.h
DetectEngineResetMaxSigId
void DetectEngineResetMaxSigId(DetectEngineCtx *de_ctx)
Definition: detect-engine.c:3045
DetectEngineMTApply
int DetectEngineMTApply(void)
Definition: detect-engine.c:4906
SCProfilingKeywordDestroyCtx
void SCProfilingKeywordDestroyCtx(DetectEngineCtx *de_ctx)
Definition: util-profiling-keywords.c:268
DetectEngineBufferTypeSupportsPacketGetById
bool DetectEngineBufferTypeSupportsPacketGetById(const DetectEngineCtx *de_ctx, const int id)
Definition: detect-engine.c:1436
DETECT_SM_LIST_PMATCH
@ DETECT_SM_LIST_PMATCH
Definition: detect.h:119
DetectEngineThreadCtxInitForReload
DetectEngineThreadCtx * DetectEngineThreadCtxInitForReload(ThreadVars *tv, DetectEngineCtx *new_de_ctx, int mt)
Definition: detect-engine.c:3445
DetectEngineThreadCtx_::to_clear_idx
uint32_t to_clear_idx
Definition: detect.h:1302
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
SCConfNodeRemove
void SCConfNodeRemove(SCConfNode *node)
Remove (and SCFree) the provided configuration node.
Definition: conf.c:653
SignatureInitData_::smlists
struct SigMatch_ * smlists[DETECT_SM_LIST_MAX]
Definition: detect.h:642
SCProfilingKeywordThreadCleanup
void SCProfilingKeywordThreadCleanup(DetectEngineThreadCtx *det_ctx)
Definition: util-profiling-keywords.c:338
THashDataGetResult::data
THashData * data
Definition: util-thash.h:192
AlertQueueFree
void AlertQueueFree(DetectEngineThreadCtx *det_ctx)
Definition: detect-engine-alert.c:258
SCProfilingSghThreadSetup
void SCProfilingSghThreadSetup(SCProfileSghDetectCtx *ctx, DetectEngineThreadCtx *det_ctx)
Definition: util-profiling-rulegroups.c:294
MPM_AC
@ MPM_AC
Definition: util-mpm.h:38
DetectParseDupSigHashInit
int DetectParseDupSigHashInit(DetectEngineCtx *de_ctx)
Initializes the hash table that is used to cull duplicate sigs.
Definition: detect-parse.c:3170
RELOAD
@ RELOAD
Definition: detect-engine.c:1876
DetectGetSingleData
InspectionBuffer * DetectGetSingleData(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id, InspectionSingleBufferGetDataPtr GetBuf)
Definition: detect-engine.c:2108
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:79
SIG_JSON_CONTENT_ARRAY_LEN
#define SIG_JSON_CONTENT_ARRAY_LEN
Definition: detect.h:1231
DetectLoaderThreadSpawn
void DetectLoaderThreadSpawn(void)
spawn the detect loader manager thread
Definition: detect-engine-loader.c:749
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
SinglePatternMatchDefaultMatcher
uint8_t SinglePatternMatchDefaultMatcher(void)
Returns the single pattern matcher algorithm to be used, based on the spm-algo setting in yaml.
Definition: util-spm.c:68
DetectEngineDeReference
void DetectEngineDeReference(DetectEngineCtx **de_ctx)
Definition: detect-engine.c:4631
DETECT_CI_FLAGS_START
#define DETECT_CI_FLAGS_START
Definition: detect-engine-content-inspection.h:40
DetectEngineInspectBufferGeneric
uint8_t DetectEngineInspectBufferGeneric(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const DetectEngineAppInspectionEngine *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
Do the content inspection & validation for a signature.
Definition: detect-engine.c:2049
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1444
DetectEngineMustParseMetadata
int DetectEngineMustParseMetadata(void)
Definition: detect-engine.c:4973
PKT_PSEUDO_LOG_FLUSH
#define PKT_PSEUDO_LOG_FLUSH
Definition: decode.h:1320
TAILQ_INIT
#define TAILQ_INIT(head)
Definition: queue.h:262
SignatureHook_::sm_list
int sm_list
Definition: detect.h:573
MpmFactoryDeRegisterAllMpmCtxProfiles
void MpmFactoryDeRegisterAllMpmCtxProfiles(DetectEngineCtx *de_ctx)
Definition: util-mpm.c:168
DETECT_TABLE_APP_FILTER
@ DETECT_TABLE_APP_FILTER
Definition: detect.h:558
DetectEngineThreadCtx_::counter_match_list
uint16_t counter_match_list
Definition: detect.h:1296
flow-util.h
DetectEnginePktInspectionEngine
Definition: detect.h:483
DetectEngineMasterCtx_::tenant_mapping_list
DetectEngineTenantMapping * tenant_mapping_list
Definition: detect.h:1739
SC_ATOMIC_INIT
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
Definition: util-atomic.h:314
ALPROTO_DNS
@ ALPROTO_DNS
Definition: app-layer-protos.h:47
DetectEngineAppInspectionEngine_::next
struct DetectEngineAppInspectionEngine_ * next
Definition: detect.h:441
DetectEngineInspectMultiBufferGeneric
uint8_t DetectEngineInspectMultiBufferGeneric(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const DetectEngineAppInspectionEngine *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
Definition: detect-engine.c:2149
detect-engine-siggroup.h
SigTableElmt_::name
const char * name
Definition: detect.h:1457
DetectEngineMasterCtx_::list
DetectEngineCtx * list
Definition: detect.h:1728
InspectionBuffer::initialized
bool initialized
Definition: detect-engine-inspect-buffer.h:38
MpmStoreFree
void MpmStoreFree(DetectEngineCtx *de_ctx)
Frees the hash table - DetectEngineCtx->mpm_hash_table, allocated by MpmStoreInit() function.
Definition: detect-engine-mpm.c:1619
DetectFrameMpmRegisterByParentId
void DetectFrameMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Definition: detect-engine-mpm.c:414
DetectEngineBufferTypeSupportsPacket
void DetectEngineBufferTypeSupportsPacket(DetectEngineCtx *de_ctx, const char *name)
Definition: detect-engine.c:1403
DetectEngineBufferRunSetupCallback
void DetectEngineBufferRunSetupCallback(const DetectEngineCtx *de_ctx, const int id, Signature *s)
Definition: detect-engine.c:1473
ENGINE_PROFILE_LOW
@ ENGINE_PROFILE_LOW
Definition: detect.h:1175
DetectEngineCtx_::type
enum DetectEngineType type
Definition: detect.h:1053
DetectEnginePruneFreeList
void DetectEnginePruneFreeList(void)
Definition: detect-engine.c:4725
SigLoadSignatures
int SigLoadSignatures(DetectEngineCtx *de_ctx, char *sig_file, bool sig_file_exclusive)
Load signatures.
Definition: detect-engine-loader.c:372
DetectEngineInspectBufferSingle
uint8_t DetectEngineInspectBufferSingle(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const DetectEngineAppInspectionEngine *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
Do the content inspection & validation for a signature.
Definition: detect-engine.c:1988
DetectThreadCtxGetKeywordThreadCtx
void * DetectThreadCtxGetKeywordThreadCtx(DetectEngineThreadCtx *det_ctx, int id)
Retrieve thread local keyword ctx by id.
Definition: detect-engine.c:3720
DetectEngineCtx_::guess_applayer
bool guess_applayer
Definition: detect.h:979
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
DetectAppLayerInspectEngineRegisterSingle
void DetectAppLayerInspectEngineRegisterSingle(const char *name, AppProto alproto, uint32_t dir, int progress, InspectEngineFuncPtr Callback, InspectionSingleBufferGetDataPtr GetData)
Definition: detect-engine.c:295
DetectEngineTransforms
Definition: detect.h:391
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
SIG_FLAG_INIT_NEED_FLUSH
#define SIG_FLAG_INIT_NEED_FLUSH
Definition: detect.h:297
MpmTableElmt_::name
const char * name
Definition: util-mpm.h:153
SCClassSCConfInit
void SCClassSCConfInit(DetectEngineCtx *de_ctx)
Definition: util-classification-config.c:61
DetectEngineCtxInitStubForDD
DetectEngineCtx * DetectEngineCtxInitStubForDD(void)
Definition: detect-engine.c:2589
KEYWORD_PROFILING_SET_LIST
#define KEYWORD_PROFILING_SET_LIST(ctx, list)
Definition: util-profiling.h:46
DETECT_CONTENT
@ DETECT_CONTENT
Definition: detect-engine-register.h:69
DetectEngineCtx_::max_uniq_toclient_groups
uint16_t max_uniq_toclient_groups
Definition: detect.h:990
ActionInitConfig
int ActionInitConfig(void)
Load the action order from config. If none is provided, it will be default to ACTION_PASS,...
Definition: util-action.c:105
IDLE
@ IDLE
Definition: detect-engine.c:1875
DetectEngineCtx_::ref_cnt
uint32_t ref_cnt
Definition: detect.h:1056
DetectEngineAppInspectionEngine_::Callback
InspectEngineFuncPtr Callback
Definition: detect.h:434
PathMerge
int PathMerge(char *out_buf, size_t buf_size, const char *const dir, const char *const fname)
Definition: util-path.c:74
Signature_::alproto
AppProto alproto
Definition: detect.h:673
DETECT_TABLE_PACKET_PRE_STREAM
@ DETECT_TABLE_PACKET_PRE_STREAM
Definition: detect.h:555
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:279
SigString_
Definition: detect.h:867
PacketEnqueue
void PacketEnqueue(PacketQueue *q, Packet *p)
Definition: packet-queue.c:175
DetectEngineCtx_::filedata_config
DetectFileDataCfg * filedata_config
Definition: detect.h:1039
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
DetectEngineFrameInspectionEngine::sm_list_base
uint16_t sm_list_base
Definition: detect.h:514
DetectPort_::port
uint16_t port
Definition: detect.h:221
SigMatchData_::is_last
bool is_last
Definition: detect.h:367
DetectBufferTypeSupportsFrames
void DetectBufferTypeSupportsFrames(const char *name)
Definition: detect-engine.c:1238
DetectMpmInitializeFrameMpms
void DetectMpmInitializeFrameMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:518
PacketQueue_
simple fifo queue for packets with mutex and cond Calling the mutex or triggering the cond is respons...
Definition: packet-queue.h:49
Flow_::proto
uint8_t proto
Definition: flow.h:370
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:86
DETECT_SM_LIST_DYNAMIC_START
@ DETECT_SM_LIST_DYNAMIC_START
Definition: detect.h:138
AppLayerParserGetStateProgress
int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t flags)
get the progress value for a tx/protocol
Definition: app-layer-parser.c:1087
DetectEngineThreadCtx_::decoder_events
AppLayerDecoderEvents * decoder_events
Definition: detect.h:1370
SigMatchData_::ctx
SigMatchCtx * ctx
Definition: detect.h:368
InspectionBuffer
Definition: detect-engine-inspect-buffer.h:34
DetectEngineThreadKeywordCtxItem_::InitFunc
void *(* InitFunc)(void *)
Definition: detect.h:886
Packet_::flags
uint32_t flags
Definition: decode.h:544
DetectEngineAppInspectionEngine_::GetData
InspectionBufferGetDataPtr GetData
Definition: detect.h:430
DetectEngineThreadKeywordCtxItem_
Definition: detect.h:885
DetectTable
DetectTable
Definition: detect.h:552
DetectEngineCtx_::pkt_mpms_list
DetectBufferMpmRegistry * pkt_mpms_list
Definition: detect.h:1089
ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL
@ ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL
Definition: detect.h:1183
Tmq_::pq
PacketQueue * pq
Definition: tm-queues.h:35
Packet_::vlan_idx
uint8_t vlan_idx
Definition: decode.h:529
flow-private.h
Flow_
Flow data structure.
Definition: flow.h:348
TmThreadContinueDetectLoaderThreads
void TmThreadContinueDetectLoaderThreads(void)
Unpauses all threads present in tv_root.
Definition: detect-engine-loader.c:649
DETECT_SM_LIST_THRESHOLD
@ DETECT_SM_LIST_THRESHOLD
Definition: detect.h:133
DetectBufferTypeRegisterSetupCallback
void DetectBufferTypeRegisterSetupCallback(const char *name, void(*SetupCallback)(const DetectEngineCtx *, Signature *))
Definition: detect-engine.c:1463
SCConfYamlHandleInclude
int SCConfYamlHandleInclude(SCConfNode *parent, const char *filename)
Include a file in the configuration.
Definition: conf-yaml-loader.c:115
DetectEngineThreadKeywordCtxItem_::data
void * data
Definition: detect.h:888
DetectEngineThreadCtx_::pmq
PrefilterRuleStore pmq
Definition: detect.h:1347
util-hash.h
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:40
DetectEngineReloadTenantBlocking
int DetectEngineReloadTenantBlocking(uint32_t tenant_id, const char *yaml, int reload_cnt)
Reload a tenant and wait for loading to complete.
Definition: detect-engine.c:4140
ctx
struct Thresholds ctx
LiveDevice_
Definition: util-device-private.h:32
DetectEngineCtx_::inspection_recursion_limit
int inspection_recursion_limit
Definition: detect.h:973
SpmTableElmt_::name
const char * name
Definition: util-spm.h:60
LiveDevice_::tenant_id_set
bool tenant_id_set
Definition: util-device-private.h:36
DetectAddressMapFree
void DetectAddressMapFree(DetectEngineCtx *de_ctx)
Definition: detect-engine-address.c:1339
DetectEngineFrameInspectionEngine::transforms
const DetectEngineTransforms * transforms
Definition: detect.h:518
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:932
StringParseUint16
int StringParseUint16(uint16_t *res, int base, size_t len, const char *str)
Definition: util-byte.c:343
DetectEngineReloadSetIdle
void DetectEngineReloadSetIdle(void)
Definition: detect-engine.c:1914
DetectBufferTypeRegisterValidateCallback
void DetectBufferTypeRegisterValidateCallback(const char *name, bool(*ValidateCallback)(const Signature *, const char **sigerror, const DetectBufferType *))
Definition: detect-engine.c:1481
LiveDevice_::id
uint16_t id
Definition: util-device-private.h:38
DetectEnginePktInspectionEngine::smd
SigMatchData * smd
Definition: detect.h:484
DetectMetadataHashInit
int DetectMetadataHashInit(DetectEngineCtx *de_ctx)
Definition: detect-metadata.c:69
SCConfGet
int SCConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:350
DetectEngineThreadCtx_::lua_blocked_function_errors
uint16_t lua_blocked_function_errors
Definition: detect.h:1377
DetectEngineThreadCtx_::global_keyword_ctxs_array
void ** global_keyword_ctxs_array
Definition: detect.h:1368
DetectEngineGetCurrent
DetectEngineCtx * DetectEngineGetCurrent(void)
Definition: detect-engine.c:3829
TransformData_::options
void * options
Definition: detect.h:388
DetectEngineFrameInspectionEngine::mpm
bool mpm
Definition: detect.h:512
SCDetectRateFilterFunc
uint8_t(* SCDetectRateFilterFunc)(const Packet *p, uint32_t sid, uint32_t gid, uint32_t rev, uint8_t original_action, uint8_t new_action, void *arg)
Function type for rate filter callback.
Definition: detect.h:928
TmThreadCountThreadsByTmmFlags
uint32_t TmThreadCountThreadsByTmmFlags(uint8_t flags)
returns a count of all the threads that match the flag
Definition: tm-threads.c:2092
DetectBufferTypeSupportsMultiInstance
void DetectBufferTypeSupportsMultiInstance(const char *name)
Definition: detect-engine.c:1228
HashListTableGetListHead
HashListTableBucket * HashListTableGetListHead(HashListTable *ht)
Definition: util-hashlist.c:287
TAILQ_FOREACH
#define TAILQ_FOREACH(var, head, field)
Definition: queue.h:252
DetectEngineInspectPacketPayload
uint8_t DetectEngineInspectPacketPayload(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const Signature *s, Flow *f, Packet *p)
Do the content inspection & validation for a signature.
Definition: detect-engine-payload.c:152
ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE
@ ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE
Definition: detect.h:1184
DetectEngineAddToMaster
int DetectEngineAddToMaster(DetectEngineCtx *de_ctx)
Definition: detect-engine.c:4655
DetectEngineCtx_::mpm_cfg
MpmConfig * mpm_cfg
Definition: detect.h:936
InspectionBufferGetPktDataPtr
InspectionBuffer *(* InspectionBufferGetPktDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Packet *p, const int list_id)
Definition: detect.h:478
SCSigSignatureOrderingModuleCleanup
void SCSigSignatureOrderingModuleCleanup(DetectEngineCtx *de_ctx)
De-registers all the signature ordering functions registered.
Definition: detect-engine-sigorder.c:939
DetectEngineBufferTypeGetNameById
const char * DetectEngineBufferTypeGetNameById(const DetectEngineCtx *de_ctx, const int id)
Definition: detect-engine.c:1308
DetectEngineCtx_::keyword_id
int keyword_id
Definition: detect.h:1035
DetectEngineMultiTenantSetup
int DetectEngineMultiTenantSetup(const bool unix_socket)
setup multi-detect / multi-tenancy
Definition: detect-engine.c:4289
PrefilterDeinit
void PrefilterDeinit(DetectEngineCtx *de_ctx)
Definition: detect-engine-prefilter.c:1420
SignatureProperties
Definition: detect.h:89
SCMutexLock
#define SCMutexLock(mut)
Definition: threads-debug.h:117
DetectBufferMpmRegistry_::next
struct DetectBufferMpmRegistry_ * next
Definition: detect.h:804
util-var-name.h
SIG_FLAG_REQUIRE_STREAM
#define SIG_FLAG_REQUIRE_STREAM
Definition: detect.h:255
ENGINE_PROFILE_MEDIUM
@ ENGINE_PROFILE_MEDIUM
Definition: detect.h:1176
HashTable_
Definition: util-hash.h:35
DetectEngineTenantMapping_::next
struct DetectEngineTenantMapping_ * next
Definition: detect.h:1714
DetectEngineSetEvent
void DetectEngineSetEvent(DetectEngineThreadCtx *det_ctx, uint8_t e)
Definition: detect-engine.c:5007
SIG_FLAG_TXBOTHDIR
#define SIG_FLAG_TXBOTHDIR
Definition: detect.h:250
DetectEngineThreadCtx_::buffers_size
uint32_t buffers_size
Definition: detect.h:1301
DetectContentInspectionMatchOnAbsentBuffer
bool DetectContentInspectionMatchOnAbsentBuffer(const SigMatchData *smd)
tells if we should match on absent buffer, because there is an absent keyword being used
Definition: detect-engine-content-inspection.c:793
SCConfGetBool
int SCConfGetBool(const char *name, int *val)
Retrieve a configuration value as a boolean.
Definition: conf.c:497
DetectEngineCtx_::profile_sgh_ctx
struct SCProfileSghDetectCtx_ * profile_sgh_ctx
Definition: detect.h:1048
tv_root
ThreadVars * tv_root[TVT_MAX]
Definition: tm-threads.c:82
DetectBufferMpmRegistry_
one time registration of keywords at start up
Definition: detect.h:762
SCReferenceConfDeinit
void SCReferenceConfDeinit(DetectEngineCtx *de_ctx)
Definition: util-reference-config.c:72
DetectPort_::next
struct DetectPort_ * next
Definition: detect.h:234
DetectEngineCtx_::tcp_priorityports
DetectPort * tcp_priorityports
Definition: detect.h:1068
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *de_ctx)
Free a DetectEngineCtx::
Definition: detect-engine.c:2633
DetectEngineAppInspectionEngine_::sm_list_base
uint16_t sm_list_base
Definition: detect.h:425
DetectEngineThreadCtx_::multi_inspect
struct DetectEngineThreadCtx_::@108 multi_inspect
DetectEngineThreadCtx_::spm_thread_ctx
SpmThreadCtx * spm_thread_ctx
Definition: detect.h:1276
DetectEngineReloadTenantsBlocking
int DetectEngineReloadTenantsBlocking(const int reload_cnt)
Reload all tenants and wait for loading to complete.
Definition: detect-engine.c:4154
InspectionBuffer::flags
uint8_t flags
Definition: detect-engine-inspect-buffer.h:39
detect-engine-frame.h
SCMUTEX_INITIALIZER
#define SCMUTEX_INITIALIZER
Definition: threads-debug.h:121
DetectEngineThreadCtx_::inspect
struct DetectEngineThreadCtx_::@107 inspect
Signature_::sm_arrays
SigMatchData * sm_arrays[DETECT_SM_LIST_MAX]
Definition: detect.h:731
SCInstance_::conf_filename
const char * conf_filename
Definition: suricata.h:177
DetectEngineCtx_::prefilter_setting
enum DetectEnginePrefilterSetting prefilter_setting
Definition: detect.h:1064
SignatureInitData_::init_flags
uint32_t init_flags
Definition: detect.h:608
DetectParseDupSigHashFree
void DetectParseDupSigHashFree(DetectEngineCtx *de_ctx)
Frees the hash table that is used to cull duplicate sigs.
Definition: detect-parse.c:3187
DetectBufferType_
Definition: detect.h:449
m
SCMutex m
Definition: flow-hash.h:6
DetectEngineCtx_::udp_priorityports
DetectPort * udp_priorityports
Definition: detect.h:1069
DetectContentData_
Definition: detect-content.h:93
SCConfYamlLoadFileWithPrefix
int SCConfYamlLoadFileWithPrefix(const char *filename, const char *prefix)
Load configuration from a YAML file, insert in tree at 'prefix'.
Definition: conf-yaml-loader.c:553
StringParseInt32
int StringParseInt32(int32_t *res, int base, size_t len, const char *str)
Definition: util-byte.c:634
PrefilterGenericMpmFrameRegister
int PrefilterGenericMpmFrameRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-frame.c:208
DetectEngineGetVersion
uint32_t DetectEngineGetVersion(void)
Definition: detect-engine.c:3810
SCConfNodeLookupChildValue
const char * SCConfNodeLookupChildValue(const SCConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:824
SleepUsec
#define SleepUsec(usec)
Definition: tm-threads.h:44
SigCleanSignatures
void SigCleanSignatures(DetectEngineCtx *de_ctx)
Definition: detect-engine-build.c:56
HashListTableLookup
void * HashListTableLookup(HashListTable *ht, void *data, uint16_t datalen)
Definition: util-hashlist.c:245
detect-engine-payload.h
DetectEngineThreadCtx_::lua_instruction_limit_errors
uint16_t lua_instruction_limit_errors
Definition: detect.h:1380
SIG_FLAG_TOCLIENT
#define SIG_FLAG_TOCLIENT
Definition: detect.h:272
DetectMd5ValidateCallback
bool DetectMd5ValidateCallback(const Signature *s, const char **sigerror, const DetectBufferType *map)
Definition: detect-engine.c:5013
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:82
DetectEngineMpmCachingEnabled
bool DetectEngineMpmCachingEnabled(void)
Definition: detect-engine.c:2454
DetectBufferIsPresent
bool DetectBufferIsPresent(const Signature *s, const uint32_t buf_id)
Definition: detect-engine.c:1503
InspectionBufferGet
InspectionBuffer * InspectionBufferGet(DetectEngineThreadCtx *det_ctx, const int list_id)
Definition: detect-engine-inspect-buffer.c:56
SigMatchData_
Data needed for Match()
Definition: detect.h:365
KEYWORD_PROFILING_START
#define KEYWORD_PROFILING_START
Definition: util-profiling.h:50
SigMatchData_::type
uint16_t type
Definition: detect.h:366
DetectEngineCtx_::version
uint32_t version
Definition: detect.h:1013
DetectPort_::port2
uint16_t port2
Definition: detect.h:222
DetectEngineCtx_::non_pf_engine_names
HashTable * non_pf_engine_names
Definition: detect.h:1142
DetectEngineThreadCtx_::events
uint16_t events
Definition: detect.h:1371
detect-engine-prefilter.h
util-unittest.h
TransformData_
Definition: detect.h:386
PrefilterMultiGenericMpmRegister
int PrefilterMultiGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-prefilter.c:1651
Signature_::frame_inspect
DetectEngineFrameInspectionEngine * frame_inspect
Definition: detect.h:727
DetectEngineFrameInspectionEngine::v1
struct DetectEngineFrameInspectionEngine::@92 v1
DetectBufferTypeCloseRegistration
void DetectBufferTypeCloseRegistration(void)
Definition: detect-engine.c:1647
DetectEnginePktInspectionEngine::transforms
const DetectEngineTransforms * transforms
Definition: detect.h:492
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:81
HashTableFree
void HashTableFree(HashTable *ht)
Free a HashTable and all its contents.
Definition: util-hash.c:100
TenantLoaderCtx_
Definition: detect-engine.c:4009
SCAppLayerDecoderEventsSetEventRaw
void SCAppLayerDecoderEventsSetEventRaw(AppLayerDecoderEvents **sevents, uint8_t event)
Set an app layer decoder event.
Definition: app-layer-events.c:96
DetectBufferTypeGetByName
int DetectBufferTypeGetByName(const char *name)
Definition: detect-engine.c:1278
KEYWORD_PROFILING_END
#define KEYWORD_PROFILING_END(ctx, type, m)
Definition: util-profiling.h:64
DetectBufferTypeSupportsPacket
void DetectBufferTypeSupportsPacket(const char *name)
Definition: detect-engine.c:1248
DetectEngineFrameInspectionEngine::Callback
InspectionBufferFrameInspectFunc Callback
Definition: detect.h:516
HashListTableAdd
int HashListTableAdd(HashListTable *ht, void *data, uint16_t datalen)
Definition: util-hashlist.c:114
HashTable_::array_size
uint32_t array_size
Definition: util-hash.h:37
SigGroupHeadHashInit
int SigGroupHeadHashInit(DetectEngineCtx *de_ctx)
Initializes the hash table in the detection engine context to hold the SigGroupHeads.
Definition: detect-engine-siggroup.c:244
InspectionBufferMultipleForList::size
uint32_t size
Definition: detect.h:381
SCRConfDeInitContext
void SCRConfDeInitContext(DetectEngineCtx *de_ctx)
Releases de_ctx resources related to Reference Config API.
Definition: util-reference-config.c:179
DetectEngineThreadCtx_::mt_det_ctxs_hash
HashTable * mt_det_ctxs_hash
Definition: detect.h:1256
strlcpy
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
DetectEnginePktInspectionRun
bool DetectEnginePktInspectionRun(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, const Signature *s, Flow *f, Packet *p, uint8_t *alert_flags)
Definition: detect-engine.c:1804
DETECT_PREFILTER_AUTO
@ DETECT_PREFILTER_AUTO
Definition: detect.h:897
DetectEngineThreadCtx_::keyword_ctxs_size
int keyword_ctxs_size
Definition: detect.h:1365
HashListTable_::array_size
uint32_t array_size
Definition: util-hashlist.h:41
DetectAppLayerMpmRegisterByParentId
void DetectAppLayerMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Definition: detect-engine-mpm.c:245
AlertQueueInit
void AlertQueueInit(DetectEngineThreadCtx *det_ctx)
Definition: detect-engine-alert.c:245
DetectEngineThreadCtx_::lua_rule_errors
uint16_t lua_rule_errors
Definition: detect.h:1374
SigString_::sig_error
char * sig_error
Definition: detect.h:870
DetectEngineAppInspectionEngine_::id
uint8_t id
Definition: detect.h:419
DetectEngineThreadCtx_::counter_alerts_suppressed
uint16_t counter_alerts_suppressed
Definition: detect.h:1293
PacketQueue_::mutex_q
SCMutex mutex_q
Definition: packet-queue.h:56
DetectEngineCtx_::base64_decode_max_len
uint16_t base64_decode_max_len
Definition: detect.h:1020
SIGNATURE_HOOK_TYPE_APP
@ SIGNATURE_HOOK_TYPE_APP
Definition: detect.h:549
THV_RUNNING_DONE
#define THV_RUNNING_DONE
Definition: threadvars.h:46
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1327
SCConfInit
void SCConfInit(void)
Initialize the configuration system.
Definition: conf.c:120
util-signal.h
SCConfDump
void SCConfDump(void)
Dump configuration to stdout.
Definition: conf.c:761
DetectEngineAppInspectionEngine_::sm_list
uint16_t sm_list
Definition: detect.h:424
TENANT_SELECTOR_UNKNOWN
@ TENANT_SELECTOR_UNKNOWN
Definition: detect.h:1702
HashListTableGetListNext
#define HashListTableGetListNext(hb)
Definition: util-hashlist.h:55
InspectionBufferMultipleForList
Definition: detect.h:379
DetectEngineTenantMapping_::tenant_id
uint32_t tenant_id
Definition: detect.h:1709
ThreadVars_::tmm_flags
uint8_t tmm_flags
Definition: threadvars.h:79
DETECT_SM_LIST_POSTMATCH
@ DETECT_SM_LIST_POSTMATCH
Definition: detect.h:127
SIG_FLAG_TOSERVER
#define SIG_FLAG_TOSERVER
Definition: detect.h:271
app-layer-htp.h
DetectEngineTenantSelectors
DetectEngineTenantSelectors
Definition: detect.h:1701
DetectPortParse
int DetectPortParse(const DetectEngineCtx *de_ctx, DetectPort **head, const char *str)
Function for parsing port strings.
Definition: detect-engine-port.c:1185
InspectionBufferPktInspectFunc
int(* InspectionBufferPktInspectFunc)(struct DetectEngineThreadCtx_ *, const struct DetectEnginePktInspectionEngine *engine, const struct Signature_ *s, Packet *p, uint8_t *alert_flags)
Definition: detect.h:471
datasets.h
InspectionBufferFree
void InspectionBufferFree(InspectionBuffer *buffer)
Definition: detect-engine-inspect-buffer.c:205
SignatureHook_::t
union SignatureHook_::@93 t
HashListTableInit
HashListTable * HashListTableInit(uint32_t size, uint32_t(*Hash)(struct HashListTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
Definition: util-hashlist.c:35
DetectEngineCtx_::requirements
SCDetectRequiresStatus * requirements
Definition: detect.h:1135
TAILQ_REMOVE
#define TAILQ_REMOVE(head, elm, field)
Definition: queue.h:312
SCRunmodeGet
SCRunMode SCRunmodeGet(void)
Get the current run mode.
Definition: suricata.c:279
SigTableElmt_::TransformValidate
bool(* TransformValidate)(const uint8_t *content, uint16_t content_len, void *context)
Definition: detect.h:1433
DetectEngineThreadCtx_::counter_alerts_overflow
uint16_t counter_alerts_overflow
Definition: detect.h:1291
util-debug.h
DetectBufferType_::ValidateCallback
bool(* ValidateCallback)(const struct Signature_ *, const char **sigerror, const struct DetectBufferType_ *)
Definition: detect.h:460
DetectEngineMoveToFreeList
int DetectEngineMoveToFreeList(DetectEngineCtx *de_ctx)
Definition: detect-engine.c:4715
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
util-error.h
DetectTableToString
const char * DetectTableToString(enum DetectTable table)
Definition: detect-engine.c:131
SpmInitGlobalThreadCtx
SpmGlobalThreadCtx * SpmInitGlobalThreadCtx(uint8_t matcher)
Definition: util-spm.c:138
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:18
SCProfilingPrefilterDestroyCtx
void SCProfilingPrefilterDestroyCtx(DetectEngineCtx *de_ctx)
Definition: util-profiling-prefilter.c:236
DetectEnginePktInspectionEngine::sm_list
uint16_t sm_list
Definition: detect.h:486
DetectEngineThreadCtx_::match_array_len
uint32_t match_array_len
Definition: detect.h:1336
ENGINE_PROFILE_HIGH
@ ENGINE_PROFILE_HIGH
Definition: detect.h:1177
DetectMpmInitializePktMpms
void DetectMpmInitializePktMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:685
DetectEngineThreadCtx_
Definition: detect.h:1244
SignatureHook_::app
struct SignatureHook_::@93::@94 app
PKT_STREAM_ADD
#define PKT_STREAM_ADD
Definition: decode.h:1262
DetectLoadersInit
void DetectLoadersInit(void)
Definition: detect-engine-loader.c:604
ThreadVars_::tm_slots
struct TmSlot_ * tm_slots
Definition: threadvars.h:96
SignatureInitData_::mpm_sm
SigMatch * mpm_sm
Definition: detect.h:623
DetectEngineBufferTypeGetDescriptionById
const char * DetectEngineBufferTypeGetDescriptionById(const DetectEngineCtx *de_ctx, const int id)
Definition: detect-engine.c:1386
SCMutexUnlock
#define SCMutexUnlock(mut)
Definition: threads-debug.h:119
DETECT_SM_LIST_BASE64_DATA
@ DETECT_SM_LIST_BASE64_DATA
Definition: detect.h:124
SIG_FLAG_FLUSH
#define SIG_FLAG_FLUSH
Definition: detect.h:259
DetectEngineThreadKeywordCtxItem_::id
int id
Definition: detect.h:890
PKT_PSEUDO_STREAM_END
#define PKT_PSEUDO_STREAM_END
Definition: decode.h:1270
DetectEngineThreadCtx_::buffers
InspectionBuffer * buffers
Definition: detect.h:1300
detect-engine-file.h
DetectEngineMasterCtx_::keyword_list
DetectEngineThreadKeywordCtxItem * keyword_list
Definition: detect.h:1744
SignatureInitData_::mpm_sm_list
int mpm_sm_list
Definition: detect.h:621
LiveGetDevice
LiveDevice * LiveGetDevice(const char *name)
Get a pointer to the device at idx.
Definition: util-device.c:268
flow-worker.h
SCConfGetInt
int SCConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
Definition: conf.c:414
DetectEngineMasterCtx_::tenant_selector
enum DetectEngineTenantSelectors tenant_selector
Definition: detect.h:1735
DetectEngineCtx_::keyword_hash
HashListTable * keyword_hash
Definition: detect.h:1037
BOOL2STR
#define BOOL2STR(b)
Definition: util-debug.h:539
DetectPktInspectEngineRegister
void DetectPktInspectEngineRegister(const char *name, InspectionBufferGetPktDataPtr GetPktData, InspectionBufferPktInspectFunc Callback)
register inspect engine at start up time
Definition: detect-engine.c:156
DetectEngineInspectStreamPayload
int DetectEngineInspectStreamPayload(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const Signature *s, Flow *f, Packet *p)
Do the content inspection & validation for a signature on the raw stream.
Definition: detect-engine-payload.c:248
util-reference-config.h
Packet_::pcap_v
PcapPacketVars pcap_v
Definition: decode.h:587
DetectEngineCtx_::failure_fatal
bool failure_fatal
Definition: detect.h:933
Signature_::pkt_inspect
DetectEnginePktInspectionEngine * pkt_inspect
Definition: detect.h:726
DetectEngineAppInspectionEngine_::GetMultiData
InspectionMultiBufferGetDataPtr GetMultiData
Definition: detect.h:432
SCEnter
#define SCEnter(...)
Definition: util-debug.h:281
detect-engine-mpm.h
DetectMetadataHashFree
void DetectMetadataHashFree(DetectEngineCtx *de_ctx)
Definition: detect-metadata.c:80
DetectBufferTypeMaxId
int DetectBufferTypeMaxId(void)
Definition: detect-engine.c:1035
DatasetPostReloadCleanup
void DatasetPostReloadCleanup(void)
Definition: datasets.c:569
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
DetectEngineBufferTypeValidateTransform
bool DetectEngineBufferTypeValidateTransform(DetectEngineCtx *de_ctx, int sm_list, const uint8_t *content, uint16_t content_len, const char **namestr)
Check content byte array compatibility with transforms.
Definition: detect-engine.c:1531
DetectEngineCtx_::sm_types_prefilter
bool * sm_types_prefilter
Definition: detect.h:1111
DetectEngineEnabled
int DetectEngineEnabled(void)
Check if detection is enabled.
Definition: detect-engine.c:3796
SigMatchList2DataArray
SigMatchData * SigMatchList2DataArray(SigMatch *head)
convert SigMatch list to SigMatchData array
Definition: detect-parse.c:2365
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *tv, void *initdata, void **data)
initialize thread specific detection engine context
Definition: detect-engine.c:3360
DetectEngineReloadIsIdle
int DetectEngineReloadIsIdle(void)
Definition: detect-engine.c:1922
DetectEngineFrameInspectionEngine::sm_list
uint16_t sm_list
Definition: detect.h:513
DETECT_ENGINE_INSPECT_SIG_MATCH
#define DETECT_ENGINE_INSPECT_SIG_MATCH
Definition: detect-engine-state.h:41
PKT_DETECT_HAS_STREAMDATA
#define PKT_DETECT_HAS_STREAMDATA
Definition: decode.h:1307
InspectionSingleBufferGetDataPtr
bool(* InspectionSingleBufferGetDataPtr)(const void *txv, const uint8_t flow_flags, const uint8_t **buf, uint32_t *buf_len)
Definition: detect-engine-helper.h:45
SigMatch_::next
struct SigMatch_ * next
Definition: detect.h:360
DetectEngineCtx_::mpm_matcher
uint8_t mpm_matcher
Definition: detect.h:935
DETECT_TABLE_PACKET_PRE_FLOW
@ DETECT_TABLE_PACKET_PRE_FLOW
Definition: detect.h:554
detect-engine-port.h
LiveDevice_::tenant_id
uint32_t tenant_id
Definition: util-device-private.h:46
SCClassConfDeinit
void SCClassConfDeinit(DetectEngineCtx *de_ctx)
Definition: util-classification-config.c:81
InspectionBuffer::inspect_offset
uint64_t inspect_offset
Definition: detect-engine-inspect-buffer.h:36
DETECT_TABLE_PACKET_FILTER
@ DETECT_TABLE_PACKET_FILTER
Definition: detect.h:556
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE
@ DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE
Definition: detect-engine-content-inspection.h:36
DetectEngineCtx_::frame_inspect_engines
DetectEngineFrameInspectionEngine * frame_inspect_engines
Definition: detect.h:1091
DetectEngineMasterCtx_::free_list
DetectEngineCtx * free_list
Definition: detect.h:1733
StringParseUint32
int StringParseUint32(uint32_t *res, int base, size_t len, const char *str)
Definition: util-byte.c:316
DetectEngineSyncState
DetectEngineSyncState
Definition: detect-engine.c:1874
LiveDevice_::dev
char * dev
Definition: util-device-private.h:33
PatternMatchThreadPrepare
void PatternMatchThreadPrepare(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
Definition: detect-engine-mpm.c:968
DetectEngineThreadKeywordCtxItem_::next
struct DetectEngineThreadKeywordCtxItem_ * next
Definition: detect.h:889
DETECT_SM_LIST_MATCH
@ DETECT_SM_LIST_MATCH
Definition: detect.h:117
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:259
HashTableAdd
int HashTableAdd(HashTable *ht, void *data, uint16_t datalen)
Definition: util-hash.c:120
ENGINE_PROFILE_UNKNOWN
@ ENGINE_PROFILE_UNKNOWN
Definition: detect.h:1174
DetectEngineBufferTypeRegister
int DetectEngineBufferTypeRegister(DetectEngineCtx *de_ctx, const char *name)
Definition: detect-engine.c:1365
DetectPort_
Port structure for detection engine.
Definition: detect.h:220
DetectEngineThreadCtx_::json_content_capacity
uint8_t json_content_capacity
Definition: detect.h:1282
app-layer-parser.h
Signature_::app_inspect
DetectEngineAppInspectionEngine * app_inspect
Definition: detect.h:725
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:359
ThreadVars_::next
struct ThreadVars_ * next
Definition: threadvars.h:125
DetectEngineContentInspection
bool DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const Signature *s, const SigMatchData *smd, Packet *p, Flow *f, const uint8_t *buffer, const uint32_t buffer_len, const uint64_t stream_start_offset, const uint8_t flags, const enum DetectContentInspectionType inspection_mode)
wrapper around DetectEngineContentInspectionInternal to return true/false only
Definition: detect-engine-content-inspection.c:749
SignatureInitData_::hook
SignatureHook hook
Definition: detect.h:590
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:317
hashlittle_safe
uint32_t hashlittle_safe(const void *key, size_t length, uint32_t initval)
Definition: util-hash-lookup3.c:482
DetectEngineThreadCtx_::base64_decoded_len
int base64_decoded_len
Definition: detect.h:1325
SigGroupCleanup
int SigGroupCleanup(DetectEngineCtx *de_ctx)
Definition: detect-engine-build.c:2256
detect-engine-tag.h
DetectEngineThreadCtx_::lua_memory_limit_errors
uint16_t lua_memory_limit_errors
Definition: detect.h:1383
util-profiling.h
tv_root_lock
SCMutex tv_root_lock
Definition: tm-threads.c:85
DetectEngineInspectStream
uint8_t DetectEngineInspectStream(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const struct DetectEngineAppInspectionEngine_ *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
inspect engine for stateful rules
Definition: detect-engine-payload.c:298
SCDetectEngineRegisterRateFilterCallback
void SCDetectEngineRegisterRateFilterCallback(SCDetectRateFilterFunc fn, void *arg)
Register a callback when a rate_filter has been applied to an alert.
Definition: detect-engine.c:5054
DetectEngineLoadTenantBlocking
int DetectEngineLoadTenantBlocking(uint32_t tenant_id, const char *yaml)
Load a tenant and wait for loading to complete.
Definition: detect-engine.c:4126
TmModuleDetectLoaderRegister
void TmModuleDetectLoaderRegister(void)
Definition: detect-engine-loader.c:765
Signature_::flags
uint32_t flags
Definition: detect.h:669
DetectBufferType_::xform_id
TransformIdData xform_id[DETECT_TRANSFORMS_MAX]
Definition: detect.h:463
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2594
RuleMatchCandidateTxArrayFree
void RuleMatchCandidateTxArrayFree(DetectEngineThreadCtx *det_ctx)
Definition: detect.c:1082
DetectEngineInitializeFastPatternList
void DetectEngineInitializeFastPatternList(DetectEngineCtx *de_ctx)
Definition: detect-fast-pattern.c:149
Packet_
Definition: decode.h:501
DetectEngineFrameInspectionEngine::alproto
AppProto alproto
Definition: detect.h:509
DE_STATE_FLAG_BASE
#define DE_STATE_FLAG_BASE
Definition: detect-engine-state.h:66
detect-engine-build.h
type
uint16_t type
Definition: decode-vlan.c:106
conf-yaml-loader.h
SCRConfLoadReferenceConfigFile
int SCRConfLoadReferenceConfigFile(DetectEngineCtx *de_ctx, FILE *fd)
Loads the Reference info from the reference.config file.
Definition: util-reference-config.c:485
DetectEngineTenantRegisterLivedev
int DetectEngineTenantRegisterLivedev(uint32_t tenant_id, int device_id)
Definition: detect-engine.c:4572
PcapPacketVars_::tenant_id
uint32_t tenant_id
Definition: source-pcap.h:37
DETECT_CI_FLAGS_END
#define DETECT_CI_FLAGS_END
Definition: detect-engine-content-inspection.h:42
DetectEngineBufferTypeSupportsFrames
void DetectEngineBufferTypeSupportsFrames(DetectEngineCtx *de_ctx, const char *name)
Definition: detect-engine.c:1395
InspectionBufferFrameInspectFunc
int(* InspectionBufferFrameInspectFunc)(struct DetectEngineThreadCtx_ *, const struct DetectEngineFrameInspectionEngine *engine, const struct Signature_ *s, Packet *p, const struct Frames *frames, const struct Frame *frame)
Definition: detect.h:504
DetectEngineCtx_::frame_mpms_list
DetectBufferMpmRegistry * frame_mpms_list
Definition: detect.h:1092
detect-engine-alert.h
conf.h
DetectEngineCtx_::sgh_mpm_ctx_cnf
uint8_t sgh_mpm_ctx_cnf
Definition: detect.h:1033
DetectEngineAppInspectionEngine_::match_on_null
bool match_on_null
Definition: detect.h:423
DetectBufferType_::packet
bool packet
Definition: detect.h:455
DetectContentData_::flags
uint32_t flags
Definition: detect-content.h:104
DetectEngineMasterCtx_::multi_tenant_enabled
int multi_tenant_enabled
Definition: detect.h:1721
TmModuleGetById
TmModule * TmModuleGetById(int id)
Returns a TM Module by its id.
Definition: tm-modules.c:69
TmSlot_
Definition: tm-threads.h:53
DetectEngineFrameInspectionEngine
Definition: detect.h:508
TenantLoaderCtx
struct TenantLoaderCtx_ TenantLoaderCtx
util-magic.h
DetectEngineCtx_::max_uniq_toserver_groups
uint16_t max_uniq_toserver_groups
Definition: detect.h:991
DetectEngineBufferTypeGetById
const DetectBufferType * DetectEngineBufferTypeGetById(const DetectEngineCtx *de_ctx, const int id)
Definition: detect-engine.c:1298
Packet_::livedev
struct LiveDevice_ * livedev
Definition: decode.h:618
DETECT_TABLE_PACKET_TD
@ DETECT_TABLE_PACKET_TD
Definition: detect.h:557
TmEcode
TmEcode
Definition: tm-threads-common.h:80
DetectEnginePktInspectionEngine::Callback
InspectionBufferPktInspectFunc Callback
Definition: detect.h:490
DetectBufferType_::name
char name[64]
Definition: detect.h:450
ALPROTO_DOH2
@ ALPROTO_DOH2
Definition: app-layer-protos.h:66
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:747
name
const char * name
Definition: tm-threads.c:2163
DetectEngineSyncer_::state
enum DetectEngineSyncState state
Definition: detect-engine.c:1882
SpmMakeThreadCtx
SpmThreadCtx * SpmMakeThreadCtx(const SpmGlobalThreadCtx *global_thread_ctx)
Definition: util-spm.c:153
ENGINE_PROFILE_CUSTOM
@ ENGINE_PROFILE_CUSTOM
Definition: detect.h:1178
SCReferenceSCConfInit
void SCReferenceSCConfInit(DetectEngineCtx *de_ctx)
Definition: util-reference-config.c:52
DetectEngineCtx_::profile_keyword_ctx
struct SCProfileKeywordDetectCtx_ * profile_keyword_ctx
Definition: detect.h:1045
DetectEngineAppInspectionEngine_::GetDataSingle
InspectionSingleBufferGetDataPtr GetDataSingle
Definition: detect.h:431
SCInstance_::additional_configs
const char ** additional_configs
Definition: suricata.h:178
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1419
reputation.h
SCProfilingPrefilterThreadCleanup
void SCProfilingPrefilterThreadCleanup(DetectEngineThreadCtx *det_ctx)
Definition: util-profiling-prefilter.c:281
SCConfCreateContextBackup
void SCConfCreateContextBackup(void)
Creates a backup of the conf_hash hash_table used by the conf API.
Definition: conf.c:684
util-action.h
HashListTable_
Definition: util-hashlist.h:37
DetectEngineThreadCtxGetJsonContext
int DetectEngineThreadCtxGetJsonContext(DetectEngineThreadCtx *det_ctx)
Definition: detect-engine.c:5062
DetectEngineCtx_::byte_extract_max_local_id
int32_t byte_extract_max_local_id
Definition: detect.h:1010
DetectEngineTransforms::transforms
TransformData transforms[DETECT_TRANSFORMS_MAX]
Definition: detect.h:392
DetectEnginePktInspectionEngine::sm_list_base
uint16_t sm_list_base
Definition: detect.h:487
ALPROTO_HTTP2
@ ALPROTO_HTTP2
Definition: app-layer-protos.h:69
SIG_PROP_FLOW_ACTION_PACKET
@ SIG_PROP_FLOW_ACTION_PACKET
Definition: detect.h:84
DetectEngineMultiTenantEnabled
bool DetectEngineMultiTenantEnabled(void)
Definition: detect-engine.c:3866
signature_properties
const struct SignatureProperties signature_properties[SIG_TYPE_MAX]
Definition: detect-engine.c:116
DetectEngineCtx_::RateFilterCallback
SCDetectRateFilterFunc RateFilterCallback
Definition: detect.h:1147
runmodes.h
RunmodeIsUnittests
int RunmodeIsUnittests(void)
Definition: suricata.c:270
PacketQueue_::cond_q
SCCondT cond_q
Definition: packet-queue.h:57
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:229
TAILQ_FOREACH_SAFE
#define TAILQ_FOREACH_SAFE(var, head, field, tvar)
Definition: queue.h:329
DetectEngineFrameInspectionEngine::dir
uint8_t dir
Definition: detect.h:510
SIG_FLAG_REQUIRE_STREAM_ONLY
#define SIG_FLAG_REQUIRE_STREAM_ONLY
Definition: detect.h:261
SpmDestroyGlobalThreadCtx
void SpmDestroyGlobalThreadCtx(SpmGlobalThreadCtx *global_thread_ctx)
Definition: util-spm.c:144
DETECT_ENGINE_INSPECT_SIG_CANT_MATCH
#define DETECT_ENGINE_INSPECT_SIG_CANT_MATCH
Definition: detect-engine-state.h:42
DetectEngineThreadCtx_::mtc
MpmThreadCtx mtc
Definition: detect.h:1343
DetectEngineRegisterTests
void DetectEngineRegisterTests(void)
Definition: detect-engine.c:5288
SigString_::filename
char * filename
Definition: detect.h:868
DetectBufferType_::multi_instance
bool multi_instance
Definition: detect.h:458
DetectLoaderQueueTask
int DetectLoaderQueueTask(int loader_id, LoaderFunc Func, void *func_ctx, LoaderFreeFunc FreeFunc)
Definition: detect-engine-loader.c:527
DETECT_ENGINE_TYPE_TENANT
@ DETECT_ENGINE_TYPE_TENANT
Definition: detect.h:905
DetectEngineBufferTypeSupportsTransformations
void DetectEngineBufferTypeSupportsTransformations(DetectEngineCtx *de_ctx, const char *name)
Definition: detect-engine.c:1419
PACKET_ALERT_FLAG_STREAM_MATCH
#define PACKET_ALERT_FLAG_STREAM_MATCH
Definition: decode.h:270
InspectionMultiBufferGetDataPtr
bool(* InspectionMultiBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const void *txv, const uint8_t flow_flags, uint32_t local_id, const uint8_t **buf, uint32_t *buf_len)
Definition: detect-engine-helper.h:42
DetectEngineBufferTypeSupportsMpmGetById
bool DetectEngineBufferTypeSupportsMpmGetById(const DetectEngineCtx *de_ctx, const int id)
Definition: detect-engine.c:1445
DetectEngineCtx_::config_prefix
char config_prefix[64]
Definition: detect.h:1051
DetectSigmatchListEnumToString
const char * DetectSigmatchListEnumToString(enum DetectSigmatchListEnum type)
Definition: detect-engine.c:4978
TmModule_
Definition: tm-modules.h:47
SCRealloc
#define SCRealloc(ptr, sz)
Definition: util-mem.h:50
DetectEngineAppInspectionEngine_::alproto
AppProto alproto
Definition: detect.h:417
SRepReloadComplete
void SRepReloadComplete(void)
Increment effective reputation version after a rule/reputation reload is complete.
Definition: reputation.c:161
SIG_FLAG_INIT_STATE_MATCH
#define SIG_FLAG_INIT_STATE_MATCH
Definition: detect.h:296
detect-engine-content-inspection.h
ThreadVars_::stream_pq
struct PacketQueue_ * stream_pq
Definition: threadvars.h:116
DetectEngineAppInspectionEngine_::smd
SigMatchData * smd
Definition: detect.h:439
DetectEngineBufferTypeSupportsFramesGetById
bool DetectEngineBufferTypeSupportsFramesGetById(const DetectEngineCtx *de_ctx, const int id)
Definition: detect-engine.c:1454
DetectBufferType_::id
int id
Definition: detect.h:452
DetectEngineCtx_::spm_matcher
uint8_t spm_matcher
Definition: detect.h:937
DetectEngineBufferTypeRegisterWithFrameEngines
int DetectEngineBufferTypeRegisterWithFrameEngines(DetectEngineCtx *de_ctx, const char *name, const int direction, const AppProto alproto, const uint8_t frame_type)
Definition: detect-engine.c:1331
DetectEnginePktInspectionEngine::GetData
InspectionBufferGetPktDataPtr GetData
Definition: detect.h:489
SCConfNodeLookupChild
SCConfNode * SCConfNodeLookupChild(const SCConfNode *node, const char *name)
Lookup a child configuration node by name.
Definition: conf.c:796
DETECT_ENGINE_TYPE_NORMAL
@ DETECT_ENGINE_TYPE_NORMAL
Definition: detect.h:902
FlowWorkerGetDetectCtxPtr
void * FlowWorkerGetDetectCtxPtr(void *flow_worker)
Definition: flow-worker.c:747
detect-fast-pattern.h
DetectBufferType_::frame
bool frame
Definition: detect.h:456
DetectEngineBufferTypeSupportsMultiInstanceGetById
bool DetectEngineBufferTypeSupportsMultiInstanceGetById(const DetectEngineCtx *de_ctx, const int id)
Definition: detect-engine.c:1427
SCCondSignal
#define SCCondSignal
Definition: threads-debug.h:139
ThreadVars_::inq
Tmq * inq
Definition: threadvars.h:90
util-conf.h
DetectEngineCtx_::sig_stat
SigFileLoaderStat sig_stat
Definition: detect.h:1102
Packet_::flow
struct Flow_ * flow
Definition: decode.h:546
DetectEngineFrameMpmRegister
void DetectEngineFrameMpmRegister(DetectEngineCtx *de_ctx, const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id), AppProto alproto, uint8_t type)
Definition: detect-engine-mpm.c:455
DetectEngineThreadCtx_::to_clear_queue
uint32_t * to_clear_queue
Definition: detect.h:1303
SpmDestroyThreadCtx
void SpmDestroyThreadCtx(SpmThreadCtx *thread_ctx)
Definition: util-spm.c:163
DetectEngineCtx_::profile_prefilter_ctx
struct SCProfilePrefilterDetectCtx_ * profile_prefilter_ctx
Definition: detect.h:1046
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
TENANT_SELECTOR_DIRECT
@ TENANT_SELECTOR_DIRECT
Definition: detect.h:1703
DETECT_CI_FLAGS_SINGLE
#define DETECT_CI_FLAGS_SINGLE
Definition: detect-engine-content-inspection.h:49
DetectEnginePktInspectionSetup
int DetectEnginePktInspectionSetup(Signature *s)
Definition: detect-engine.c:1852
DetectBufferTypeRegister
int DetectBufferTypeRegister(const char *name)
Definition: detect-engine.c:1214
InspectEngineFuncPtr
uint8_t(* InspectEngineFuncPtr)(struct DetectEngineCtx_ *de_ctx, struct DetectEngineThreadCtx_ *det_ctx, const struct DetectEngineAppInspectionEngine_ *engine, const struct Signature_ *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
Definition: detect.h:411
SleepMsec
#define SleepMsec(msec)
Definition: tm-threads.h:45
flags
uint8_t flags
Definition: decode-gre.h:0
DetectRegisterThreadCtxFuncs
int DetectRegisterThreadCtxFuncs(DetectEngineCtx *de_ctx, const char *name, void *(*InitFunc)(void *), void *data, void(*FreeFunc)(void *), int mode)
Register Thread keyword context Funcs.
Definition: detect-engine.c:3650
MpmStoreInit
int MpmStoreInit(DetectEngineCtx *de_ctx)
Initializes the MpmStore mpm hash table to be used by the detection engine context.
Definition: detect-engine-mpm.c:1456
DetectEngineMasterCtx_::keyword_id
int keyword_id
Definition: detect.h:1745
DetectEngineCtx_::app_mpms_list
DetectBufferMpmRegistry * app_mpms_list
Definition: detect.h:1084
suricata-common.h
SIG_PROP_FLOW_ACTION_FLOW_IF_STATEFUL
@ SIG_PROP_FLOW_ACTION_FLOW_IF_STATEFUL
Definition: detect.h:86
DetectEngineCtxInitStubForMT
DetectEngineCtx * DetectEngineCtxInitStubForMT(void)
Definition: detect-engine.c:2584
SigMatch_::type
uint16_t type
Definition: detect.h:357
DetectBufferTypeSupportsMpm
void DetectBufferTypeSupportsMpm(const char *name)
Definition: detect-engine.c:1258
util-path.h
DetectEngineThreadCtx_::tenant_id
uint32_t tenant_id
Definition: detect.h:1247
DetectEngineAppInspectionEngine_::v2
struct DetectEngineAppInspectionEngine_::@88 v2
HashListTableFree
void HashListTableFree(HashListTable *ht)
Definition: util-hashlist.c:88
detect-byte-extract.h
DetectEngineCtx_::buffer_type_hash_name
HashListTable * buffer_type_hash_name
Definition: detect.h:1079
DetectEngineCtx_::next
struct DetectEngineCtx_ * next
Definition: detect.h:1058
DETECT_TABLE_NOT_SET
@ DETECT_TABLE_NOT_SET
Definition: detect.h:553
DETECT_ENGINE_TYPE_DD_STUB
@ DETECT_ENGINE_TYPE_DD_STUB
Definition: detect.h:903
TENANT_SELECTOR_VLAN
@ TENANT_SELECTOR_VLAN
Definition: detect.h:1704
DetectEngineBumpVersion
void DetectEngineBumpVersion(void)
Definition: detect-engine.c:3820
DetectEngineFrameInspectionEngine::next
struct DetectEngineFrameInspectionEngine * next
Definition: detect.h:521
SignatureHook_::type
enum SignatureHookType type
Definition: detect.h:572
DetectEngineInspectFrameBufferGeneric
int DetectEngineInspectFrameBufferGeneric(DetectEngineThreadCtx *det_ctx, const DetectEngineFrameInspectionEngine *engine, const Signature *s, Packet *p, const Frames *frames, const Frame *frame)
Do the content inspection & validation for a signature.
Definition: detect-engine-frame.c:560
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *tv, void *data)
Definition: detect-engine.c:3592
util-spm.h
DetectEnginePktInspectionEngine::next
struct DetectEnginePktInspectionEngine * next
Definition: detect.h:494
DetectContentData_::content
uint8_t * content
Definition: detect-content.h:94
DetectEngineCtx_::rate_filter_callback_arg
void * rate_filter_callback_arg
Definition: detect.h:1150
DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT
#define DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT
Definition: detect-engine.c:95
version
uint8_t version
Definition: decode-gre.h:1
PostRuleMatchWorkQueue::q
PostRuleMatchWorkQueueItem * q
Definition: detect.h:1226
TransformIdData_::id_data_len
uint32_t id_data_len
Definition: detect.h:446
PatternMatchDefaultMatcher
uint8_t PatternMatchDefaultMatcher(void)
Function to return the multi pattern matcher algorithm to be used by the engine, based on the mpm-alg...
Definition: detect-engine-mpm.c:911
util-classification-config.h
SCConfDeInit
void SCConfDeInit(void)
De-initializes the configuration system.
Definition: conf.c:703
DetectEngineTenantRegisterPcapFile
int DetectEngineTenantRegisterPcapFile(uint32_t tenant_id)
Definition: detect-engine.c:4588
SCStrdup
#define SCStrdup(s)
Definition: util-mem.h:56
FatalError
#define FatalError(...)
Definition: util-debug.h:514
SigGroupHeadHashFree
void SigGroupHeadHashFree(DetectEngineCtx *de_ctx)
Frees the hash table - DetectEngineCtx->sgh_hash_table, allocated by SigGroupHeadHashInit() function.
Definition: detect-engine-siggroup.c:299
SCAppLayerDecoderEventsFreeEvents
void SCAppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events)
Definition: app-layer-events.c:137
DetectEngineInspectGenericList
uint8_t DetectEngineInspectGenericList(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const struct DetectEngineAppInspectionEngine_ *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
Do the content inspection & validation for a signature.
Definition: detect-engine.c:1946
DetectEngineAppInspectionEngineSignatureFree
void DetectEngineAppInspectionEngineSignatureFree(DetectEngineCtx *de_ctx, Signature *s)
free app inspect engines for a signature
Definition: detect-engine.c:929
TVT_PPT
@ TVT_PPT
Definition: tm-threads-common.h:88
DETECT_ENGINE_CONTENT_INSPECTION_MODE_HEADER
@ DETECT_ENGINE_CONTENT_INSPECTION_MODE_HEADER
Definition: detect-engine-content-inspection.h:33
util-hash-lookup3.h
DETECT_SM_LIST_TMATCH
@ DETECT_SM_LIST_TMATCH
Definition: detect.h:129
DetectEngineCtx_::loader_id
int loader_id
Definition: detect.h:1061
SCInstance_::sig_file
char * sig_file
Definition: suricata.h:138
TransformData_::transform
int transform
Definition: detect.h:387
DETECT_ENGINE_INSPECT_SIG_NO_MATCH
#define DETECT_ENGINE_INSPECT_SIG_NO_MATCH
Definition: detect-engine-state.h:40
DetectEngineCtx_::pkt_inspect_engines
DetectEnginePktInspectionEngine * pkt_inspect_engines
Definition: detect.h:1088
DetectEngineBufferTypeSupportsMpm
void DetectEngineBufferTypeSupportsMpm(DetectEngineCtx *de_ctx, const char *name)
Definition: detect-engine.c:1411
SIG_TYPE_MAX
@ SIG_TYPE_MAX
Definition: detect.h:79
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
DetectEngineCtx_::sm_types_silent_error
bool * sm_types_silent_error
Definition: detect.h:1112
DetectEngineAppInspectionEngine_::progress
int16_t progress
Definition: detect.h:426
DetectEngineThreadKeywordCtxItem_::FreeFunc
void(* FreeFunc)(void *)
Definition: detect.h:887
app-layer-events.h
SignatureInitDataBuffer_::only_ts
bool only_ts
Definition: detect.h:532
util-validate.h
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:258
DetectEngineFreeFastPatternList
void DetectEngineFreeFastPatternList(DetectEngineCtx *de_ctx)
Definition: detect-fast-pattern.c:171
MPM_AC_KS
@ MPM_AC_KS
Definition: util-mpm.h:39
DetectBufferTypeSupportsTransformations
void DetectBufferTypeSupportsTransformations(const char *name)
Definition: detect-engine.c:1268
detect-engine-sigorder.h
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
DetectEngineMpmCachingGetPath
const char * DetectEngineMpmCachingGetPath(void)
Definition: detect-engine.c:2463
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
DetectAddressMapInit
int DetectAddressMapInit(DetectEngineCtx *de_ctx)
Definition: detect-engine-address.c:1328
InjectPacketsForFlush
void InjectPacketsForFlush(ThreadVars **detect_tvs, int no_of_detect_tvs)
Definition: detect-engine.c:2239
InspectionBuffer::inspect_len
uint32_t inspect_len
Definition: detect-engine-inspect-buffer.h:37
SignatureInitData_::buffers
SignatureInitDataBuffer * buffers
Definition: detect.h:647
DetectEngineCtx_::app_inspect_engines
DetectEngineAppInspectionEngine * app_inspect_engines
Definition: detect.h:1087
DetectEngineCtx_::filemagic_thread_ctx_id
int filemagic_thread_ctx_id
Definition: detect.h:982
SigJsonContent
Definition: detect.h:1236
DetectEngineSyncer_
Definition: detect-engine.c:1880
DetectEngineThreadCtx_::global_keyword_ctxs_size
int global_keyword_ctxs_size
Definition: detect.h:1367
DetectEngineThreadCtx_::json_content
SigJsonContent * json_content
Definition: detect.h:1281
PrefilterInit
void PrefilterInit(DetectEngineCtx *de_ctx)
Definition: detect-engine-prefilter.c:1427
InspectionBuffer::inspect
const uint8_t * inspect
Definition: detect-engine-inspect-buffer.h:35
DetectEngineThreadCtx_::tv
ThreadVars * tv
Definition: detect.h:1252
DetectThreadCtxGetGlobalKeywordThreadCtx
void * DetectThreadCtxGetGlobalKeywordThreadCtx(DetectEngineThreadCtx *det_ctx, int id)
Retrieve thread local keyword ctx by id.
Definition: detect-engine.c:3784
SCConfGetNode
SCConfNode * SCConfGetNode(const char *name)
Get a SCConfNode by name.
Definition: conf.c:181
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:271
DETECT_TBLSIZE
int DETECT_TBLSIZE
Definition: detect-engine-register.c:288
SRepInit
int SRepInit(DetectEngineCtx *de_ctx)
init reputation
Definition: reputation.c:566
DetectEngineReloadStart
int DetectEngineReloadStart(void)
Definition: detect-engine.c:1888
DetectEngineUnsetParseMetadata
void DetectEngineUnsetParseMetadata(void)
Definition: detect-engine.c:4968
PKT_SRC_DETECT_RELOAD_FLUSH
@ PKT_SRC_DETECT_RELOAD_FLUSH
Definition: decode.h:61
DetectEngineThreadCtx_::counter_alerts
uint16_t counter_alerts
Definition: detect.h:1289
DetectEngineThreadCtx_::keyword_ctxs_array
void ** keyword_ctxs_array
Definition: detect.h:1364
SCFree
#define SCFree(p)
Definition: util-mem.h:61
DetectEngineMasterCtx_
Definition: detect.h:1717
Signature_::id
uint32_t id
Definition: detect.h:713
HashListTableBucket_
Definition: util-hashlist.h:28
DetectEngineThreadKeywordCtxItem_::name
const char * name
Definition: detect.h:891
detect-tcphdr.h
DetectEngineCtx_::guess_applayer_log_limit
uint8_t guess_applayer_log_limit
Definition: detect.h:976
HashListTableRemove
int HashListTableRemove(HashListTable *ht, void *data, uint16_t datalen)
Definition: util-hashlist.c:154
DatasetReload
void DatasetReload(void)
Definition: datasets.c:543
DetectBufferType_::transforms
DetectEngineTransforms transforms
Definition: detect.h:462
detect-engine-iponly.h
SCConfRestoreContextBackup
void SCConfRestoreContextBackup(void)
Restores the backup of the hash_table present in backup_conf_hash back to conf_hash.
Definition: conf.c:694
DetectEngineType
DetectEngineType
Definition: detect.h:901
detect-parse.h
SignatureInitDataBuffer_::id
uint32_t id
Definition: detect.h:525
Signature_
Signature container.
Definition: detect.h:668
SigMatch_
a single match condition for a signature
Definition: detect.h:356
DetectEngineCtx_::tenant_path
char * tenant_path
Definition: detect.h:1132
DetectEngineAppInspectionEngine_::transforms
const DetectEngineTransforms * transforms
Definition: detect.h:436
DETECT_SM_LIST_MAX
@ DETECT_SM_LIST_MAX
Definition: detect.h:135
DetectBufferType_::parent_id
int parent_id
Definition: detect.h:453
DETECT_PREFILTER_MPM
@ DETECT_PREFILTER_MPM
Definition: detect.h:896
TenantLoaderCtx_::yaml
char * yaml
Definition: detect-engine.c:4012
InspectionBufferSetupAndApplyTransforms
void InspectionBufferSetupAndApplyTransforms(DetectEngineThreadCtx *det_ctx, const int list_id, InspectionBuffer *buffer, const uint8_t *data, const uint32_t data_len, const DetectEngineTransforms *transforms)
setup the buffer with our initial data
Definition: detect-engine-inspect-buffer.c:197
TransformIdData_::id_data
const uint8_t * id_data
Definition: detect.h:445
DetectLoadersSync
int DetectLoadersSync(void)
wait for loader tasks to complete
Definition: detect-engine-loader.c:561
SCProfilingSghDestroyCtx
void SCProfilingSghDestroyCtx(DetectEngineCtx *de_ctx)
Definition: util-profiling-rulegroups.c:285
HashTableInit
HashTable * HashTableInit(uint32_t size, uint32_t(*Hash)(struct HashTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
Definition: util-hash.c:35
DetectEngineTenantMapping_::traffic_id
uint32_t traffic_id
Definition: detect.h:1712
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
MPM_HS
@ MPM_HS
Definition: util-mpm.h:40
ALPROTO_FAILED
@ ALPROTO_FAILED
Definition: app-layer-protos.h:33
spm_table
SpmTableElmt spm_table[SPM_TABLE_SIZE]
Definition: util-spm.c:62
DetectEngineReference
DetectEngineCtx * DetectEngineReference(DetectEngineCtx *de_ctx)
Definition: detect-engine.c:3852
DetectEngineThreadCtx_::base64_decoded
uint8_t * base64_decoded
Definition: detect.h:1324
TenantLoaderCtx_::reload_cnt
int reload_cnt
Definition: detect-engine.c:4011
mpm_table
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
Definition: util-mpm.c:47
DetectEngineSyncer
struct DetectEngineSyncer_ DetectEngineSyncer
DetectMpmInitializeAppMpms
void DetectMpmInitializeAppMpms(DetectEngineCtx *de_ctx)
Definition: detect-engine-mpm.c:291
EngineModeIsIPS
int EngineModeIsIPS(void)
Definition: suricata.c:242
MpmTableElmt_::ConfigDeinit
void(* ConfigDeinit)(MpmConfig **)
Definition: util-mpm.h:160
DetectEngineTransforms::cnt
int cnt
Definition: detect.h:393
DetectEngineThreadCtx_::de_ctx
DetectEngineCtx * de_ctx
Definition: detect.h:1362
InspectionBufferSetupMultiEmpty
void InspectionBufferSetupMultiEmpty(InspectionBuffer *buffer)
setup the buffer empty
Definition: detect-engine-inspect-buffer.c:144
suricata.h
DetectEngineCtx_::sig_array
Signature ** sig_array
Definition: detect.h:950
MpmTableElmt_::ConfigCacheDirSet
void(* ConfigCacheDirSet)(MpmConfig *, const char *dir_path)
Definition: util-mpm.h:161
InspectionBufferGetDataPtr
InspectionBuffer *(* InspectionBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id)
Definition: detect-engine-helper.h:39
DetectEngineAppInspectionEngine_::dir
uint8_t dir
Definition: detect.h:418
PmqFree
void PmqFree(PrefilterRuleStore *pmq)
Cleanup and free a Pmq.
Definition: util-prefilter.c:126
DetectContentData_::content_len
uint16_t content_len
Definition: detect-content.h:95
DETECT_ENGINE_TYPE_MT_STUB
@ DETECT_ENGINE_TYPE_MT_STUB
Definition: detect.h:904
SCConfNode_::name
char * name
Definition: conf.h:38
SignatureInitDataBuffer_::only_tc
bool only_tc
Definition: detect.h:531
detect-uricontent.h
DetectEngineCtx_::buffer_type_id
uint32_t buffer_type_id
Definition: detect.h:1081
ThresholdCacheThreadFree
void ThresholdCacheThreadFree(void)
Definition: detect-engine-threshold.c:454
Packet_::vlan_id
uint16_t vlan_id[VLAN_MAX_LAYERS]
Definition: decode.h:528
RUNMODE_CONF_TEST
@ RUNMODE_CONF_TEST
Definition: runmodes.h:54
DetectEngineReload
int DetectEngineReload(const SCInstance *suri)
Reload the detection engine.
Definition: detect-engine.c:4782
DetectEngineBufferRunValidateCallback
bool DetectEngineBufferRunValidateCallback(const DetectEngineCtx *de_ctx, const int id, const Signature *s, const char **sigerror)
Definition: detect-engine.c:1492
DetectEngineCtx_::sigerror
const char * sigerror
Definition: detect.h:1025
DetectEngineThreadCtx_::json_content_len
uint8_t json_content_len
Definition: detect.h:1283
DetectBufferType_::SetupCallback
void(* SetupCallback)(const struct DetectEngineCtx_ *, struct Signature_ *)
Definition: detect.h:459
DetectAppLayerInspectEngineRegister
void DetectAppLayerInspectEngineRegister(const char *name, AppProto alproto, uint32_t dir, int progress, InspectEngineFuncPtr Callback, InspectionBufferGetDataPtr GetData)
Registers an app inspection engine.
Definition: detect-engine.c:273
DetectEngineThreadCtx_::mt_det_ctxs_cnt
uint32_t mt_det_ctxs_cnt
Definition: detect.h:1254
DetectEngineContentInspectionBuffer
bool DetectEngineContentInspectionBuffer(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const Signature *s, const SigMatchData *smd, Packet *p, Flow *f, const InspectionBuffer *b, const enum DetectContentInspectionType inspection_mode)
wrapper around DetectEngineContentInspectionInternal to return true/false only
Definition: detect-engine-content-inspection.c:773
DetectEngineMasterCtx_::lock
SCMutex lock
Definition: detect.h:1718
DetectEnginePktInspectionEngine::mpm
bool mpm
Definition: detect.h:485
SCInstance_
Definition: suricata.h:133
DetectEngineCtx_::spm_global_thread_ctx
SpmGlobalThreadCtx * spm_global_thread_ctx
Definition: detect.h:986
DetectEngineClearMaster
void DetectEngineClearMaster(void)
Definition: detect-engine.c:4755
id
uint32_t id
Definition: detect-flowbits.c:938
SRepDestroy
void SRepDestroy(DetectEngineCtx *de_ctx)
Definition: reputation.c:649
MpmTableElmt_::ConfigInit
MpmConfig *(* ConfigInit)(void)
Definition: util-mpm.h:159
StatsRegisterAvgCounter
uint16_t StatsRegisterAvgCounter(const char *name, struct ThreadVars_ *tv)
Registers a counter, whose value holds the average of all the values assigned to it.
Definition: counters.c:972
SIG_PROP_FLOW_ACTION_FLOW
@ SIG_PROP_FLOW_ACTION_FLOW
Definition: detect.h:85
DetectBufferTypeSetDescriptionByName
void DetectBufferTypeSetDescriptionByName(const char *name, const char *desc)
Definition: detect-engine.c:1375
SigString_::sig_str
char * sig_str
Definition: detect.h:869
SCStatFn
#define SCStatFn(pathname, statbuf)
Definition: util-path.h:35
DetectUnregisterThreadCtxFuncs
int DetectUnregisterThreadCtxFuncs(DetectEngineCtx *de_ctx, void *data, const char *name)
Remove Thread keyword context registration.
Definition: detect-engine.c:3702
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:375
SCInstance_::sig_file_exclusive
bool sig_file_exclusive
Definition: suricata.h:139
DetectAppLayerMultiRegister
void DetectAppLayerMultiRegister(const char *name, AppProto alproto, uint32_t dir, int progress, InspectionMultiBufferGetDataPtr GetData, int priority)
Definition: detect-engine.c:2099
DetectEngineFrameInspectEngineRegister
void DetectEngineFrameInspectEngineRegister(DetectEngineCtx *de_ctx, const char *name, int dir, InspectionBufferFrameInspectFunc Callback, AppProto alproto, uint8_t type)
register inspect engine at start up time
Definition: detect-engine.c:451
DetectEngineTenantRegisterVlanId
int DetectEngineTenantRegisterVlanId(uint32_t tenant_id, uint16_t vlan_id)
Definition: detect-engine.c:4578
flow.h
DetectEngineSetParseMetadata
void DetectEngineSetParseMetadata(void)
Definition: detect-engine.c:4963
TmThreadsCheckFlag
int TmThreadsCheckFlag(ThreadVars *tv, uint32_t flag)
Check if a thread flag is set.
Definition: tm-threads.c:93
SCLogNotice
#define SCLogNotice(...)
Macro used to log NOTICE messages.
Definition: util-debug.h:247
DetectPktMpmRegisterByParentId
void DetectPktMpmRegisterByParentId(DetectEngineCtx *de_ctx, const int id, const int parent_id, DetectEngineTransforms *transforms)
copy a mpm engine from parent_id, add in transforms
Definition: detect-engine-mpm.c:645
TENANT_SELECTOR_LIVEDEV
@ TENANT_SELECTOR_LIVEDEV
Definition: detect.h:1705
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:442
DetectEngineFrameInspectionEngine::type
uint8_t type
Definition: detect.h:511
StatsRegisterCounter
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
Definition: counters.c:952
DetectSigmatchListEnum
DetectSigmatchListEnum
Definition: detect.h:115
DetectEngineMasterCtx_::version
uint32_t version
Definition: detect.h:1724
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
DetectEngineCtx_::sig_array_len
uint32_t sig_array_len
Definition: detect.h:951
util-enum.h
SCConfNode_
Definition: conf.h:37
DetectEngineTenantUnregisterPcapFile
int DetectEngineTenantUnregisterPcapFile(uint32_t tenant_id)
Definition: detect-engine.c:4594
TenantLoaderCtx_::tenant_id
uint32_t tenant_id
Definition: detect-engine.c:4010
DetectEngineCtx_::signum
uint32_t signum
Definition: detect.h:953
DetectEngineCtx_::tenant_id
uint32_t tenant_id
Definition: detect.h:939
SignatureInitData_::buffer_index
uint32_t buffer_index
Definition: detect.h:648
detect-engine-loader.h
SigFileLoaderStat_
Signature loader statistics.
Definition: detect.h:876
SCConfNode_::val
char * val
Definition: conf.h:39
DetectEngineInspectPktBufferGeneric
int DetectEngineInspectPktBufferGeneric(DetectEngineThreadCtx *det_ctx, const DetectEnginePktInspectionEngine *engine, const Signature *s, Packet *p, uint8_t *_alert_flags)
Do the content inspection & validation for a signature.
Definition: detect-engine.c:2197
DetectEngineCtx_::buffer_type_hash_id
HashListTable * buffer_type_hash_id
Definition: detect.h:1080
DetectEngineGetByTenantId
DetectEngineCtx * DetectEngineGetByTenantId(uint32_t tenant_id)
Definition: detect-engine.c:4605
DetectPortCleanupList
void DetectPortCleanupList(const DetectEngineCtx *de_ctx, DetectPort *head)
Free a DetectPort list and each of its members.
Definition: detect-engine-port.c:124
SigTableElmt_::TransformId
void(* TransformId)(const uint8_t **data, uint32_t *length, void *context)
Definition: detect.h:1436
DETECT_SM_LIST_SUPPRESS
@ DETECT_SM_LIST_SUPPRESS
Definition: detect.h:132
SCMutex
#define SCMutex
Definition: threads-debug.h:114
InspectionBufferMultipleForList::inspection_buffers
InspectionBuffer * inspection_buffers
Definition: detect.h:380
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
DetectEngineAppInspectionEngine2Signature
int DetectEngineAppInspectionEngine2Signature(DetectEngineCtx *de_ctx, Signature *s)
Definition: detect-engine.c:801
SCClassConfLoadClassificationConfigFile
bool SCClassConfLoadClassificationConfigFile(DetectEngineCtx *de_ctx, FILE *fd)
Loads the Classtype info from the classification.config file.
Definition: util-classification-config.c:524
InspectionBufferSetupMulti
void InspectionBufferSetupMulti(DetectEngineThreadCtx *det_ctx, InspectionBuffer *buffer, const DetectEngineTransforms *transforms, const uint8_t *data, const uint32_t data_len)
setup the buffer with our initial data
Definition: detect-engine-inspect-buffer.c:157
DetectEngineTenantUnregisterVlanId
int DetectEngineTenantUnregisterVlanId(uint32_t tenant_id, uint16_t vlan_id)
Definition: detect-engine.c:4583
SCStat
struct stat SCStat
Definition: util-path.h:33
detect-engine-address.h
PmqSetup
int PmqSetup(PrefilterRuleStore *pmq)
Setup a pmq.
Definition: util-prefilter.c:37
PatternMatchThreadDestroy
void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher)
Definition: detect-engine-mpm.c:963
TmModule_::flags
uint8_t flags
Definition: tm-modules.h:80
VarNameStoreActivate
int VarNameStoreActivate(void)
Definition: util-var-name.c:214
DetectEngineThreadCtx_::counter_mpm_list
uint16_t counter_mpm_list
Definition: detect.h:1295
InspectionBufferMultipleForListGet
InspectionBuffer * InspectionBufferMultipleForListGet(DetectEngineThreadCtx *det_ctx, const int list_id, const uint32_t local_id)
for a InspectionBufferMultipleForList get a InspectionBuffer
Definition: detect-engine-inspect-buffer.c:76
RuleMatchCandidateTxArrayInit
void RuleMatchCandidateTxArrayInit(DetectEngineThreadCtx *det_ctx, uint32_t size)
Definition: detect.c:1069
SCProfilingKeywordThreadSetup
void SCProfilingKeywordThreadSetup(SCProfileKeywordDetectCtx *ctx, DetectEngineThreadCtx *det_ctx)
Definition: util-profiling-keywords.c:284
util-threshold-config.h
DetectEngineReloadIsStart
int DetectEngineReloadIsStart(void)
Definition: detect-engine.c:1902
DetectRegisterThreadCtxGlobalFuncs
int DetectRegisterThreadCtxGlobalFuncs(const char *name, void *(*InitFunc)(void *), void *data, void(*FreeFunc)(void *))
Register Thread keyword context Funcs (Global)
Definition: detect-engine.c:3740
DetectEngineThreadCtx_::post_rule_work_queue
PostRuleMatchWorkQueue post_rule_work_queue
Definition: detect.h:1345
DetectEngineThreadCtx_::tenant_array_size
uint32_t tenant_array_size
Definition: detect.h:1259
DetectEngineThreadCtx_::tenant_array
struct DetectEngineTenantMapping_ * tenant_array
Definition: detect.h:1258
suricata_ctl_flags
volatile uint8_t suricata_ctl_flags
Definition: suricata.c:172
DetectEnginePktInspectionEngine::v1
struct DetectEnginePktInspectionEngine::@91 v1
detect-engine-threshold.h
TM_FLAG_FLOWWORKER_TM
#define TM_FLAG_FLOWWORKER_TM
Definition: tm-modules.h:34
FlowWorkerReplaceDetectCtx
void FlowWorkerReplaceDetectCtx(void *flow_worker, void *detect_ctx)
Definition: flow-worker.c:740
StringHashDjb2
uint32_t StringHashDjb2(const uint8_t *data, uint32_t datalen)
Definition: util-hash-string.c:22
DetectEngineBufferTypeGetByIdTransforms
int DetectEngineBufferTypeGetByIdTransforms(DetectEngineCtx *de_ctx, const int id, TransformData *transforms, int transform_cnt)
Definition: detect-engine.c:1654
DetectEngineThreadCtx_::TenantGetId
uint32_t(* TenantGetId)(const void *, const Packet *p)
Definition: detect.h:1261
SCProfilingPrefilterThreadSetup
void SCProfilingPrefilterThreadSetup(SCProfilePrefilterDetectCtx *ctx, DetectEngineThreadCtx *det_ctx)
Definition: util-profiling-prefilter.c:245
SCClassConfDeInitContext
void SCClassConfDeInitContext(DetectEngineCtx *de_ctx)
Releases resources used by the Classification Config API.
Definition: util-classification-config.c:190
PrefilterPktNonPFStatsDump
void PrefilterPktNonPFStatsDump(void)
Definition: detect-engine-prefilter.c:590
DetectBufferType_::description
char description[128]
Definition: detect.h:451
SIG_FLAG_REQUIRE_PACKET
#define SIG_FLAG_REQUIRE_PACKET
Definition: detect.h:254
DetectEngineFrameInspectionEngine::smd
SigMatchData * smd
Definition: detect.h:520
DetectEngineThreadCtx_::match_array
Signature ** match_array
Definition: detect.h:1333