suricata
detect-filename.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Pablo Rincon <pablo.rincon.crespo@gmail.com>
23  *
24  */
25 
26 #include "suricata-common.h"
27 #include "threads.h"
28 #include "debug.h"
29 #include "decode.h"
30 
31 #include "detect.h"
32 #include "detect-parse.h"
33 
34 #include "detect-engine.h"
35 #include "detect-engine-mpm.h"
36 #include "detect-engine-state.h"
37 #include "detect-engine-file.h"
40 
41 #include "flow.h"
42 #include "flow-var.h"
43 #include "flow-util.h"
44 
45 #include "util-debug.h"
46 #include "util-spm-bm.h"
47 #include "util-unittest.h"
48 #include "util-unittest-helper.h"
49 
50 #include "app-layer.h"
51 
52 #include "stream-tcp.h"
53 
54 #include "detect-filename.h"
55 #include "app-layer-parser.h"
56 
57 static int DetectFilenameMatch (ThreadVars *, DetectEngineThreadCtx *, Flow *,
58  uint8_t, File *, const Signature *, const SigMatchCtx *);
59 static int DetectFilenameSetup (DetectEngineCtx *, Signature *, const char *);
60 static int DetectFilenameSetupSticky(DetectEngineCtx *de_ctx, Signature *s, const char *str);
61 static void DetectFilenameRegisterTests(void);
62 static void DetectFilenameFree(void *);
63 static int g_file_match_list_id = 0;
64 static int g_file_name_buffer_id = 0;
65 
66 static int PrefilterMpmFilenameRegister(DetectEngineCtx *de_ctx,
67  SigGroupHead *sgh, MpmCtx *mpm_ctx,
68  const DetectMpmAppLayerRegistery *mpm_reg, int list_id);
69 static int DetectEngineInspectFilename(
70  DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
71  const DetectEngineAppInspectionEngine *engine,
72  const Signature *s,
73  Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id);
74 
75 /**
76  * \brief Registration function for keyword: filename
77  */
79 {
80  sigmatch_table[DETECT_FILENAME].name = "filename";
81  sigmatch_table[DETECT_FILENAME].desc = "match on the file name";
82  sigmatch_table[DETECT_FILENAME].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#filename";
83  sigmatch_table[DETECT_FILENAME].FileMatch = DetectFilenameMatch;
84  sigmatch_table[DETECT_FILENAME].Setup = DetectFilenameSetup;
85  sigmatch_table[DETECT_FILENAME].Free = DetectFilenameFree;
86  sigmatch_table[DETECT_FILENAME].RegisterTests = DetectFilenameRegisterTests;
88 
89  sigmatch_table[DETECT_FILE_NAME].name = "file.name";
90  sigmatch_table[DETECT_FILE_NAME].desc = "sticky buffer to match on the file name";
91  sigmatch_table[DETECT_FILE_NAME].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#filename";
92  sigmatch_table[DETECT_FILE_NAME].Setup = DetectFilenameSetupSticky;
94 
96  ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_BODY,
99  ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_BODY,
101 
105 
112 
119 
126 
127  g_file_match_list_id = DetectBufferTypeGetByName("files");
128 
129  AppProto protos_ts[] = {
131  AppProto protos_tc[] = {
133 
134  for (int i = 0; protos_ts[i] != 0; i++) {
135  DetectAppLayerInspectEngineRegister2("file.name", protos_ts[i],
137  DetectEngineInspectFilename, NULL);
138 
140  PrefilterMpmFilenameRegister, NULL, protos_ts[i],
141  0);
142  }
143  for (int i = 0; protos_tc[i] != 0; i++) {
144  DetectAppLayerInspectEngineRegister2("file.name", protos_tc[i],
146  DetectEngineInspectFilename, NULL);
147 
149  PrefilterMpmFilenameRegister, NULL, protos_tc[i],
150  0);
151  }
152 
154  "http user agent");
155 
156  g_file_name_buffer_id = DetectBufferTypeGetByName("file.name");
157  SCLogDebug("registering filename rule option");
158  return;
159 }
160 
161 /**
162  * \brief match the specified filename
163  *
164  * \param t thread local vars
165  * \param det_ctx pattern matcher thread local data
166  * \param f *LOCKED* flow
167  * \param flags direction flags
168  * \param file file being inspected
169  * \param s signature being inspected
170  * \param m sigmatch that we will cast into DetectFilenameData
171  *
172  * \retval 0 no match
173  * \retval 1 match
174  */
175 static int DetectFilenameMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx,
176  Flow *f, uint8_t flags, File *file, const Signature *s, const SigMatchCtx *m)
177 {
178  SCEnter();
179  int ret = 0;
180 
181  DetectFilenameData *filename = (DetectFilenameData *)m;
182 
183  if (file->name == NULL)
184  SCReturnInt(0);
185 
186  if (BoyerMooreNocase(filename->name, filename->len, file->name,
187  file->name_len, filename->bm_ctx) != NULL)
188  {
189 #ifdef DEBUG
190  if (SCLogDebugEnabled()) {
191  char *name = SCMalloc(filename->len + 1);
192  if (name != NULL) {
193  memcpy(name, filename->name, filename->len);
194  name[filename->len] = '\0';
195  SCLogDebug("will look for filename %s", name);
196  SCFree(name);
197  }
198  }
199 #endif
200 
201  if (!(filename->flags & DETECT_CONTENT_NEGATED)) {
202  ret = 1;
203  }
204  }
205 
206  else if (filename->flags & DETECT_CONTENT_NEGATED) {
207  SCLogDebug("negated match");
208  ret = 1;
209  }
210 
211  SCReturnInt(ret);
212 }
213 
214 /**
215  * \brief Parse the filename keyword
216  *
217  * \param idstr Pointer to the user provided option
218  *
219  * \retval filename pointer to DetectFilenameData on success
220  * \retval NULL on failure
221  */
222 static DetectFilenameData *DetectFilenameParse (const char *str, bool negate)
223 {
224  DetectFilenameData *filename = NULL;
225 
226  /* We have a correct filename option */
227  filename = SCMalloc(sizeof(DetectFilenameData));
228  if (unlikely(filename == NULL))
229  goto error;
230 
231  memset(filename, 0x00, sizeof(DetectFilenameData));
232 
233  if (DetectContentDataParse ("filename", str, &filename->name, &filename->len) == -1) {
234  goto error;
235  }
236 
237  filename->bm_ctx = BoyerMooreNocaseCtxInit(filename->name, filename->len);
238  if (filename->bm_ctx == NULL) {
239  goto error;
240  }
241 
242  if (negate) {
243  filename->flags |= DETECT_CONTENT_NEGATED;
244  }
245 
246  SCLogDebug("flags %02X", filename->flags);
247  if (filename->flags & DETECT_CONTENT_NEGATED) {
248  SCLogDebug("negated filename");
249  }
250 
251 #ifdef DEBUG
252  if (SCLogDebugEnabled()) {
253  char *name = SCMalloc(filename->len + 1);
254  if (name != NULL) {
255  memcpy(name, filename->name, filename->len);
256  name[filename->len] = '\0';
257  SCLogDebug("will look for filename %s", name);
258  SCFree(name);
259  }
260  }
261 #endif
262 
263  return filename;
264 
265 error:
266  if (filename != NULL)
267  DetectFilenameFree(filename);
268  return NULL;
269 }
270 
271 /**
272  * \brief this function is used to parse filename options
273  * \brief into the current signature
274  *
275  * \param de_ctx pointer to the Detection Engine Context
276  * \param s pointer to the Current Signature
277  * \param str pointer to the user provided "filename" option
278  *
279  * \retval 0 on Success
280  * \retval -1 on Failure
281  */
282 static int DetectFilenameSetup (DetectEngineCtx *de_ctx, Signature *s, const char *str)
283 {
284  DetectFilenameData *filename = NULL;
285  SigMatch *sm = NULL;
286 
287  filename = DetectFilenameParse(str, s->init_data->negated);
288  if (filename == NULL)
289  goto error;
290 
291  /* Okay so far so good, lets get this into a SigMatch
292  * and put it in the Signature. */
293  sm = SigMatchAlloc();
294  if (sm == NULL)
295  goto error;
296 
297  sm->type = DETECT_FILENAME;
298  sm->ctx = (void *)filename;
299 
300  SigMatchAppendSMToList(s, sm, g_file_match_list_id);
301 
303  return 0;
304 
305 error:
306  if (filename != NULL)
307  DetectFilenameFree(filename);
308  if (sm != NULL)
309  SCFree(sm);
310  return -1;
311 }
312 
313 /**
314  * \brief this function will free memory associated with DetectFilenameData
315  *
316  * \param filename pointer to DetectFilenameData
317  */
318 static void DetectFilenameFree(void *ptr)
319 {
320  if (ptr != NULL) {
321  DetectFilenameData *filename = (DetectFilenameData *)ptr;
322  if (filename->bm_ctx != NULL) {
323  BoyerMooreCtxDeInit(filename->bm_ctx);
324  }
325  if (filename->name != NULL)
326  SCFree(filename->name);
327  SCFree(filename);
328  }
329 }
330 
331 /* file.name implementation */
332 
333 /**
334  * \brief this function setup the file.data keyword used in the rule
335  *
336  * \param de_ctx Pointer to the Detection Engine Context
337  * \param s Pointer to the Signature to which the current keyword belongs
338  * \param str Should hold an empty string always
339  *
340  * \retval 0 On success
341  */
342 static int DetectFilenameSetupSticky(DetectEngineCtx *de_ctx, Signature *s, const char *str)
343 {
344  if (DetectBufferSetActiveList(s, g_file_name_buffer_id) < 0)
345  return -1;
346  return 0;
347 }
348 
349 static InspectionBuffer *FilenameGetDataCallback(DetectEngineThreadCtx *det_ctx,
350  const DetectEngineTransforms *transforms,
351  Flow *f, uint8_t flow_flags, File *cur_file,
352  int list_id, int local_file_id, bool first)
353 {
354  SCEnter();
355 
357  InspectionBuffer *buffer = InspectionBufferMultipleForListGet(fb, local_file_id);
358  if (buffer == NULL)
359  return NULL;
360  if (!first && buffer->inspect != NULL)
361  return buffer;
362 
363  const uint8_t *data = cur_file->name;
364  uint32_t data_len = cur_file->name_len;
365 
366  InspectionBufferSetup(buffer, data, data_len);
367  InspectionBufferApplyTransforms(buffer, transforms);
368 
369  SCReturnPtr(buffer, "InspectionBuffer");
370 }
371 
372 static int DetectEngineInspectFilename(
373  DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
374  const DetectEngineAppInspectionEngine *engine,
375  const Signature *s,
376  Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
377 {
378  int r = 0;
379 
380  const DetectEngineTransforms *transforms = NULL;
381  if (!engine->mpm) {
382  transforms = engine->v2.transforms;
383  }
384 
386  f->alstate, flags);
387  if (ffc == NULL) {
389  }
390 
391  int local_file_id = 0;
392  File *file = ffc->head;
393  for (; file != NULL; file = file->next) {
394  if (file->txid != tx_id)
395  continue;
396 
397  InspectionBuffer *buffer = FilenameGetDataCallback(det_ctx,
398  transforms, f, flags, file, engine->sm_list, local_file_id, false);
399  if (buffer == NULL)
400  continue;
401 
402  det_ctx->buffer_offset = 0;
403  det_ctx->discontinue_matching = 0;
404  det_ctx->inspection_recursion_counter = 0;
405  int match = DetectEngineContentInspection(de_ctx, det_ctx, s, engine->smd,
406  f,
407  (uint8_t *)buffer->inspect,
408  buffer->inspect_len,
411  if (match == 1) {
412  r = 1;
413  break;
414  }
415  local_file_id++;
416  }
417 
418  if (r == 1)
420  else
422 }
423 
424 typedef struct PrefilterMpmFilename {
425  int list_id;
426  const MpmCtx *mpm_ctx;
429 
430 /** \brief Filedata Filedata Mpm prefilter callback
431  *
432  * \param det_ctx detection engine thread ctx
433  * \param p packet to inspect
434  * \param f flow to inspect
435  * \param txv tx to inspect
436  * \param pectx inspection context
437  */
438 static void PrefilterTxFilename(DetectEngineThreadCtx *det_ctx,
439  const void *pectx,
440  Packet *p, Flow *f, void *txv,
441  const uint64_t idx, const uint8_t flags)
442 {
443  SCEnter();
444 
445  const PrefilterMpmFilename *ctx = (const PrefilterMpmFilename *)pectx;
446  const MpmCtx *mpm_ctx = ctx->mpm_ctx;
447  const int list_id = ctx->list_id;
448 
450  f->alstate, flags);
451  int local_file_id = 0;
452  if (ffc != NULL) {
453  File *file = ffc->head;
454  for (; file != NULL; file = file->next) {
455  if (file->txid != idx)
456  continue;
457 
458  InspectionBuffer *buffer = FilenameGetDataCallback(det_ctx,
459  ctx->transforms, f, flags, file, list_id, local_file_id, true);
460  if (buffer == NULL)
461  continue;
462 
463  if (buffer->inspect_len >= mpm_ctx->minlen) {
464  (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
465  &det_ctx->mtcu, &det_ctx->pmq,
466  buffer->inspect, buffer->inspect_len);
467  }
468  }
469  }
470 }
471 
472 static void PrefilterMpmFilenameFree(void *ptr)
473 {
474  SCFree(ptr);
475 }
476 
477 static int PrefilterMpmFilenameRegister(DetectEngineCtx *de_ctx,
478  SigGroupHead *sgh, MpmCtx *mpm_ctx,
479  const DetectMpmAppLayerRegistery *mpm_reg, int list_id)
480 {
481  PrefilterMpmFilename *pectx = SCCalloc(1, sizeof(*pectx));
482  if (pectx == NULL)
483  return -1;
484  pectx->list_id = list_id;
485  pectx->mpm_ctx = mpm_ctx;
486  pectx->transforms = &mpm_reg->v2.transforms;
487 
488  return PrefilterAppendTxEngine(de_ctx, sgh, PrefilterTxFilename,
489  mpm_reg->v2.alproto, mpm_reg->v2.tx_min_progress,
490  pectx, PrefilterMpmFilenameFree, mpm_reg->pname);
491 }
492 
493 #ifdef UNITTESTS /* UNITTESTS */
494 
495 /**
496  * \test Test parser accepting valid rules and rejecting invalid rules
497  */
498 static int DetectFilenameSignatureParseTest01(void)
499 {
500  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_client; file.name; content:\"abc\"; sid:1;)", true));
501  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_client; file.name; content:\"abc\"; nocase; sid:1;)", true));
502  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_client; file.name; content:\"abc\"; endswith; sid:1;)", true));
503  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_client; file.name; content:\"abc\"; startswith; sid:1;)", true));
504  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_client; file.name; content:\"abc\"; startswith; endswith; sid:1;)", true));
505  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_client; file.name; bsize:10; sid:1;)", true));
506 
507  FAIL_IF_NOT(UTHParseSignature("alert http any any -> any any (flow:to_client; file.name; content:\"abc\"; rawbytes; sid:1;)", false));
508  FAIL_IF_NOT(UTHParseSignature("alert tcp any any -> any any (flow:to_client; file.name; sid:1;)", false));
509  //FAIL_IF_NOT(UTHParseSignature("alert tls any any -> any any (flow:to_client; file.name; content:\"abc\"; sid:1;)", false));
510  PASS;
511 }
512 /**
513  * \test DetectFilenameTestParse01
514  */
515 static int DetectFilenameTestParse01 (void)
516 {
517  DetectFilenameData *dnd = DetectFilenameParse("secret.pdf", false);
518  if (dnd != NULL) {
519  DetectFilenameFree(dnd);
520  return 1;
521  }
522  return 0;
523 }
524 
525 /**
526  * \test DetectFilenameTestParse02
527  */
528 static int DetectFilenameTestParse02 (void)
529 {
530  int result = 0;
531 
532  DetectFilenameData *dnd = DetectFilenameParse("backup.tar.gz", false);
533  if (dnd != NULL) {
534  if (dnd->len == 13 && memcmp(dnd->name, "backup.tar.gz", 13) == 0) {
535  result = 1;
536  }
537 
538  DetectFilenameFree(dnd);
539  return result;
540  }
541  return 0;
542 }
543 
544 /**
545  * \test DetectFilenameTestParse03
546  */
547 static int DetectFilenameTestParse03 (void)
548 {
549  int result = 0;
550 
551  DetectFilenameData *dnd = DetectFilenameParse("cmd.exe", false);
552  if (dnd != NULL) {
553  if (dnd->len == 7 && memcmp(dnd->name, "cmd.exe", 7) == 0) {
554  result = 1;
555  }
556 
557  DetectFilenameFree(dnd);
558  return result;
559  }
560  return 0;
561 }
562 
563 #endif /* UNITTESTS */
564 
565 /**
566  * \brief this function registers unit tests for DetectFilename
567  */
568 void DetectFilenameRegisterTests(void)
569 {
570 #ifdef UNITTESTS /* UNITTESTS */
571  UtRegisterTest("DetectFilenameSignatureParseTest01", DetectFilenameSignatureParseTest01);
572 
573  UtRegisterTest("DetectFilenameTestParse01", DetectFilenameTestParse01);
574  UtRegisterTest("DetectFilenameTestParse02", DetectFilenameTestParse02);
575  UtRegisterTest("DetectFilenameTestParse03", DetectFilenameTestParse03);
576 #endif /* UNITTESTS */
577 }
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect.h:1403
SignatureInitData * init_data
Definition: detect.h:560
uint16_t flags
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1146
#define SCLogDebug(...)
Definition: util-debug.h:335
uint16_t minlen
Definition: util-mpm.h:95
uint16_t discontinue_matching
Definition: detect.h:1026
uint8_t proto
Definition: flow.h:346
#define PASS
Pass the test.
#define unlikely(expr)
Definition: util-optimize.h:35
int UTHParseSignature(const char *str, bool expect)
parser a sig and see if the expected result is correct
one time registration of keywords at start up
Definition: detect.h:567
int DetectContentDataParse(const char *keyword, const char *contentstr, uint8_t **pstr, uint16_t *plen)
Parse a content string, ie "abc|DE|fgh".
#define FILE_SIG_NEED_FILENAME
Definition: detect.h:289
Container for matching data for a signature group.
Definition: detect.h:1295
uint32_t buffer_offset
Definition: detect.h:991
const char * name
Definition: detect.h:1160
uint16_t AppProto
Signature container.
Definition: detect.h:492
struct DetectEngineAppInspectionEngine_::@100 v2
struct File_ * next
Definition: util-file.h:79
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:319
int DetectFileInspectGeneric(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const Signature *s, const SigMatchData *smd, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id)
Inspect the file inspecting keywords against the state.
main detection engine ctx
Definition: detect.h:720
int SCLogDebugEnabled(void)
Returns whether debug messages are enabled to be logged or not.
Definition: util-debug.c:631
uint8_t * BoyerMooreNocase(const uint8_t *x, uint16_t m, const uint8_t *y, uint32_t n, BmCtx *bm_ctx)
Boyer Moore search algorithm Is better as the pattern length increases and for big buffers to search ...
Definition: util-spm-bm.c:357
void * alstate
Definition: flow.h:436
void BoyerMooreCtxDeInit(BmCtx *bmctx)
Free the memory allocated to Booyer Moore context.
Definition: util-spm-bm.c:125
int DetectBufferTypeGetByName(const char *name)
#define str(s)
#define SCCalloc(nm, a)
Definition: util-mem.h:205
int(* FileMatch)(ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t flags, File *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1137
#define SIG_FLAG_TOCLIENT
Definition: detect.h:244
#define SIGMATCH_INFO_STICKY_BUFFER
Definition: detect.h:1352
void DetectFilenameRegister(void)
Registration function for keyword: filename.
const DetectEngineTransforms * transforms
#define DETECT_ENGINE_INSPECT_SIG_MATCH
uint64_t inspect_offset
Definition: detect.h:351
uint16_t mpm_type
Definition: util-mpm.h:84
Data structures and function prototypes for keeping state for the detection engine.
void(* Free)(void *)
Definition: detect.h:1151
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
uint64_t txid
Definition: util-file.h:69
#define SIGMATCH_QUOTES_OPTIONAL
Definition: detect.h:1340
#define SIG_FLAG_TOSERVER
Definition: detect.h:243
#define SCEnter(...)
Definition: util-debug.h:337
void DetectAppLayerInspectEngineRegister2(const char *name, AppProto alproto, uint32_t dir, int progress, InspectEngineFuncPtr2 Callback2, InspectionBufferGetDataPtr GetData)
register inspect engine at start up time
PrefilterRuleStore pmq
Definition: detect.h:1061
uint16_t name_len
Definition: util-file.h:66
File * head
Definition: util-file.h:99
const MpmCtx * mpm_ctx
uint8_t type
Definition: detect.h:325
#define SCReturnInt(x)
Definition: util-debug.h:341
#define FILE_SIG_NEED_FILE
Definition: detect.h:288
const char * desc
Definition: detect.h:1162
void SigMatchAppendSMToList(Signature *s, SigMatch *new, int list)
Append a SigMatch to the list type.
Definition: detect-parse.c:282
SigMatchCtx * ctx
Definition: detect.h:327
#define SCMalloc(a)
Definition: util-mem.h:174
#define DETECT_CONTENT_NEGATED
#define DETECT_ENGINE_INSPECT_SIG_NO_MATCH
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
Definition: util-mpm.h:165
#define SCFree(a)
Definition: util-mem.h:236
uint16_t tx_id
DetectEngineTransforms transforms
Definition: detect.h:585
void InspectionBufferSetup(InspectionBuffer *buffer, const uint8_t *data, const uint32_t data_len)
setup the buffer with our initial data
MpmThreadCtx mtcu
Definition: detect.h:1059
struct PrefilterMpmFilename PrefilterMpmFilename
void InspectionBufferApplyTransforms(InspectionBuffer *buffer, const DetectEngineTransforms *transforms)
#define SIGMATCH_NOOPT
Definition: detect.h:1328
int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const Signature *s, const SigMatchData *smd, Flow *f, uint8_t *buffer, uint32_t buffer_len, uint32_t stream_start_offset, uint8_t flags, uint8_t inspection_mode, void *data)
Run the actual payload match functions.
struct DetectMpmAppLayerRegistery_::@101 v2
const char * url
Definition: detect.h:1163
#define SCReturnPtr(x, type)
Definition: util-debug.h:353
SCMutex m
Definition: flow-hash.h:105
BmCtx * BoyerMooreNocaseCtxInit(uint8_t *needle, uint16_t needle_len)
Setup a Booyer Moore context for nocase search.
Definition: util-spm-bm.c:111
InspectionBufferMultipleForList * InspectionBufferGetMulti(DetectEngineThreadCtx *det_ctx, const int list_id)
int inspection_recursion_counter
Definition: detect.h:1038
#define DETECT_CI_FLAGS_SINGLE
uint32_t inspect_len
Definition: detect.h:350
int DetectBufferSetActiveList(Signature *s, const int list)
const uint8_t * inspect
Definition: detect.h:349
#define DOC_URL
Definition: suricata.h:86
void DetectBufferTypeSetDescriptionByName(const char *name, const char *desc)
uint32_t(* Search)(const struct MpmCtx_ *, struct MpmThreadCtx_ *, PrefilterRuleStore *, const uint8_t *, uint32_t)
Definition: util-mpm.h:158
SigMatch * SigMatchAlloc(void)
Definition: detect-parse.c:226
int PrefilterAppendTxEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh, void(*PrefilterTxFunc)(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *tx, const uint64_t idx, const uint8_t flags), AppProto alproto, int tx_min_progress, void *pectx, void(*FreeFunc)(void *pectx), const char *name)
Per thread variable structure.
Definition: threadvars.h:57
AppProto alproto
application level protocol
Definition: flow.h:407
uint8_t file_flags
Definition: detect.h:506
FileContainer * AppLayerParserGetFiles(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction)
#define SIGMATCH_HANDLE_NEGATION
Definition: detect.h:1348
#define DOC_VERSION
Definition: suricata.h:91
InspectionBuffer * InspectionBufferMultipleForListGet(InspectionBufferMultipleForList *fb, uint32_t local_id)
for a InspectionBufferMultipleForList get a InspectionBuffer
uint16_t flags
Definition: detect.h:1154
Flow data structure.
Definition: flow.h:327
uint8_t * name
Definition: util-file.h:75
void DetectAppLayerInspectEngineRegister(const char *name, AppProto alproto, uint32_t dir, int progress, InspectEngineFuncPtr Callback)
register inspect engine at start up time
void(* RegisterTests)(void)
Definition: detect.h:1152
a single match condition for a signature
Definition: detect.h:324
#define FAIL_IF_NOT(expr)
Fail a test if expression to true.
Definition: util-unittest.h:82
const DetectEngineTransforms * transforms
Definition: detect.h:421
void DetectAppLayerMpmRegister2(const char *name, int direction, int priority, int(*PrefilterRegister)(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectMpmAppLayerRegistery *mpm_reg, int list_id), InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
register a MPM engine