suricata
detect.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2022 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Basic detection engine
24  */
25 
26 #include "suricata-common.h"
27 #include "suricata.h"
28 
29 #include "decode.h"
30 #include "packet.h"
31 #include "flow.h"
32 #include "stream-tcp.h"
33 #include "app-layer.h"
34 #include "app-layer-parser.h"
35 #include "app-layer-frames.h"
36 
37 #include "detect.h"
38 #include "detect-dsize.h"
39 #include "detect-engine.h"
40 #include "detect-engine-build.h"
41 #include "detect-engine-frame.h"
42 #include "detect-engine-profile.h"
43 
44 #include "detect-engine-alert.h"
45 #include "detect-engine-siggroup.h"
46 #include "detect-engine-address.h"
47 #include "detect-engine-proto.h"
48 #include "detect-engine-port.h"
49 #include "detect-engine-mpm.h"
50 #include "detect-engine-iponly.h"
53 #include "detect-engine-state.h"
54 #include "detect-engine-analyzer.h"
55 
56 #include "detect-engine-payload.h"
57 #include "detect-engine-event.h"
58 
59 #include "detect-filestore.h"
60 #include "detect-flowvar.h"
61 #include "detect-replace.h"
62 
63 #include "util-validate.h"
64 #include "util-detect.h"
65 #include "util-profiling.h"
66 
67 #include "action-globals.h"
68 
69 typedef struct DetectRunScratchpad {
71  const uint8_t flow_flags; /* flow/state flags: STREAM_* */
72  const bool app_decoder_events;
73  const SigGroupHead *sgh;
76 
77 /* prototypes */
78 static DetectRunScratchpad DetectRunSetup(const DetectEngineCtx *de_ctx,
79  DetectEngineThreadCtx *det_ctx, Packet * const p, Flow * const pflow);
80 static void DetectRunInspectIPOnly(ThreadVars *tv, const DetectEngineCtx *de_ctx,
81  DetectEngineThreadCtx *det_ctx, Flow * const pflow, Packet * const p);
82 static inline void DetectRunGetRuleGroup(const DetectEngineCtx *de_ctx,
83  Packet * const p, Flow * const pflow, DetectRunScratchpad *scratch);
84 static inline void DetectRunPrefilterPkt(ThreadVars *tv,
86  DetectRunScratchpad *scratch);
87 static inline void DetectRulePacketRules(ThreadVars * const tv,
88  DetectEngineCtx * const de_ctx, DetectEngineThreadCtx * const det_ctx,
89  Packet * const p, Flow * const pflow, const DetectRunScratchpad *scratch);
90 static void DetectRunTx(ThreadVars *tv, DetectEngineCtx *de_ctx,
91  DetectEngineThreadCtx *det_ctx, Packet *p,
92  Flow *f, DetectRunScratchpad *scratch);
93 static void DetectRunFrames(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
94  Packet *p, Flow *f, DetectRunScratchpad *scratch);
95 static inline void DetectRunPostRules(ThreadVars *tv, DetectEngineCtx *de_ctx,
96  DetectEngineThreadCtx *det_ctx, Packet * const p, Flow * const pflow,
97  DetectRunScratchpad *scratch);
98 static void DetectRunCleanup(DetectEngineThreadCtx *det_ctx,
99  Packet *p, Flow * const pflow);
100 
101 /** \internal
102  */
103 static void DetectRun(ThreadVars *th_v,
105  Packet *p)
106 {
107  SCEnter();
108  SCLogDebug("p->pcap_cnt %" PRIu64 " direction %s pkt_src %s", p->pcap_cnt,
109  p->flow ? (FlowGetPacketDirection(p->flow, p) == TOSERVER ? "toserver" : "toclient")
110  : "noflow",
111  PktSrcToString(p->pkt_src));
112 
113  /* bail early if packet should not be inspected */
114  if (p->flags & PKT_NOPACKET_INSPECTION) {
115  /* nothing to do */
116  SCReturn;
117  }
118 
119  /* Load the Packet's flow early, even though it might not be needed.
120  * Mark as a constant pointer, although the flow itself can change. */
121  Flow * const pflow = p->flow;
122 
123  DetectRunScratchpad scratch = DetectRunSetup(de_ctx, det_ctx, p, pflow);
124 
125  /* run the IPonly engine */
126  DetectRunInspectIPOnly(th_v, de_ctx, det_ctx, pflow, p);
127 
128  /* get our rule group */
129  DetectRunGetRuleGroup(de_ctx, p, pflow, &scratch);
130  /* if we didn't get a sig group head, we
131  * have nothing to do.... */
132  if (scratch.sgh == NULL) {
133  SCLogDebug("no sgh for this packet, nothing to match against");
134  goto end;
135  }
136 
137  /* run the prefilters for packets */
138  DetectRunPrefilterPkt(th_v, de_ctx, det_ctx, p, &scratch);
139 
141  /* inspect the rules against the packet */
142  DetectRulePacketRules(th_v, de_ctx, det_ctx, p, pflow, &scratch);
144 
145  /* run tx/state inspection. Don't call for ICMP error msgs. */
146  if (pflow && pflow->alstate && likely(pflow->proto == p->proto)) {
147  if (p->proto == IPPROTO_TCP) {
148  if ((p->flags & PKT_STREAM_EST) == 0) {
149  goto end;
150  }
151  const TcpSession *ssn = p->flow->protoctx;
152  bool setting_nopayload = p->flow->alparser &&
156  // we may be right after disabling app-layer (ssh)
157  if (ssn &&
158  ((ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED) == 0 || setting_nopayload)) {
159  // PACKET_PROFILING_DETECT_START(p, PROF_DETECT_TX);
160  DetectRunFrames(th_v, de_ctx, det_ctx, p, pflow, &scratch);
161  // PACKET_PROFILING_DETECT_END(p, PROF_DETECT_TX);
162  }
163  // no update to transactions
164  if (!PKT_IS_PSEUDOPKT(p) && p->app_update_direction == 0 &&
165  ((PKT_IS_TOSERVER(p) && (p->flow->flags & FLOW_TS_APP_UPDATED) == 0) ||
166  (PKT_IS_TOCLIENT(p) && (p->flow->flags & FLOW_TC_APP_UPDATED) == 0))) {
167  goto end;
168  }
169  } else if (p->proto == IPPROTO_UDP) {
170  DetectRunFrames(th_v, de_ctx, det_ctx, p, pflow, &scratch);
171  }
172 
174  DetectRunTx(th_v, de_ctx, det_ctx, p, pflow, &scratch);
176  /* see if we need to increment the inspect_id and reset the de_state */
179  pflow, pflow->alparser, pflow->alstate, scratch.flow_flags, (scratch.sgh == NULL));
181  }
182 
183 end:
184  DetectRunPostRules(th_v, de_ctx, det_ctx, p, pflow, &scratch);
185 
186  DetectRunCleanup(det_ctx, p, pflow);
187  SCReturn;
188 }
189 
190 static void DetectRunPostMatch(ThreadVars *tv,
191  DetectEngineThreadCtx *det_ctx, Packet *p,
192  const Signature *s)
193 {
194  /* run the packet match functions */
196  if (smd != NULL) {
198 
199  SCLogDebug("running match functions, sm %p", smd);
200 
201  while (1) {
203  (void)sigmatch_table[smd->type].Match(det_ctx, p, s, smd->ctx);
204  KEYWORD_PROFILING_END(det_ctx, smd->type, 1);
205  if (smd->is_last)
206  break;
207  smd++;
208  }
209  }
210 }
211 
212 /**
213  * \brief Get the SigGroupHead for a packet.
214  *
215  * \param de_ctx detection engine context
216  * \param p packet
217  *
218  * \retval sgh the SigGroupHead or NULL if non applies to the packet
219  */
221  const Packet *p)
222 {
223  SCEnter();
224  SigGroupHead *sgh = NULL;
225 
226  /* if the packet proto is 0 (not set), we're inspecting it against
227  * the decoder events sgh we have. */
228  if (p->proto == 0 && p->events.cnt > 0) {
229  SCReturnPtr(de_ctx->decoder_event_sgh, "SigGroupHead");
230  } else if (p->proto == 0) {
231  if (!(PacketIsIPv4(p) || PacketIsIPv6(p))) {
232  /* not IP, so nothing to do */
233  SCReturnPtr(NULL, "SigGroupHead");
234  }
235  }
236 
237  /* select the flow_gh */
238  const int dir = (p->flowflags & FLOW_PKT_TOCLIENT) == 0;
239 
240  int proto = PacketGetIPProto(p);
241  if (proto == IPPROTO_TCP) {
242  DetectPort *list = de_ctx->flow_gh[dir].tcp;
243  SCLogDebug("tcp toserver %p, tcp toclient %p: going to use %p", de_ctx->flow_gh[1].tcp,
244  de_ctx->flow_gh[0].tcp, de_ctx->flow_gh[dir].tcp);
245  const uint16_t port = dir ? p->dp : p->sp;
246  SCLogDebug("tcp port %u -> %u:%u", port, p->sp, p->dp);
247  DetectPort *sghport = DetectPortLookupGroup(list, port);
248  if (sghport != NULL)
249  sgh = sghport->sh;
250  SCLogDebug("TCP list %p, port %u, direction %s, sghport %p, sgh %p", list, port,
251  dir ? "toserver" : "toclient", sghport, sgh);
252  } else if (proto == IPPROTO_UDP) {
253  DetectPort *list = de_ctx->flow_gh[dir].udp;
254  uint16_t port = dir ? p->dp : p->sp;
255  DetectPort *sghport = DetectPortLookupGroup(list, port);
256  if (sghport != NULL)
257  sgh = sghport->sh;
258  SCLogDebug("UDP list %p, port %u, direction %s, sghport %p, sgh %p", list, port,
259  dir ? "toserver" : "toclient", sghport, sgh);
260  } else {
261  sgh = de_ctx->flow_gh[dir].sgh[proto];
262  }
263 
264  SCReturnPtr(sgh, "SigGroupHead");
265 }
266 
267 static inline void DetectPrefilterMergeSort(DetectEngineCtx *de_ctx,
268  DetectEngineThreadCtx *det_ctx)
269 {
270  SigIntId mpm, nonmpm;
271  SigIntId *mpm_ptr = det_ctx->pmq.rule_id_array;
272  SigIntId *nonmpm_ptr = det_ctx->non_pf_id_array;
273  uint32_t m_cnt = det_ctx->pmq.rule_id_array_cnt;
274  uint32_t n_cnt = det_ctx->non_pf_id_cnt;
275  SigIntId *final_ptr;
276  uint32_t final_cnt;
277  SigIntId id;
278  SigIntId previous_id = (SigIntId)-1;
279  Signature **sig_array = de_ctx->sig_array;
280  Signature **match_array = det_ctx->match_array;
281  Signature *s;
282 
283  SCLogDebug("PMQ rule id array count %d", det_ctx->pmq.rule_id_array_cnt);
284 
285  /* Load first values. */
286  if (likely(m_cnt)) {
287  mpm = *mpm_ptr;
288  } else {
289  /* mpm list is empty */
290  final_ptr = nonmpm_ptr;
291  final_cnt = n_cnt;
292  goto final;
293  }
294  if (likely(n_cnt)) {
295  nonmpm = *nonmpm_ptr;
296  } else {
297  /* non-mpm list is empty. */
298  final_ptr = mpm_ptr;
299  final_cnt = m_cnt;
300  goto final;
301  }
302  while (1) {
303  if (mpm < nonmpm) {
304  /* Take from mpm list */
305  id = mpm;
306 
307  s = sig_array[id];
308  /* As the mpm list can contain duplicates, check for that here. */
309  if (likely(id != previous_id)) {
310  *match_array++ = s;
311  previous_id = id;
312  }
313  if (unlikely(--m_cnt == 0)) {
314  /* mpm list is now empty */
315  final_ptr = nonmpm_ptr;
316  final_cnt = n_cnt;
317  goto final;
318  }
319  mpm_ptr++;
320  mpm = *mpm_ptr;
321  } else if (mpm > nonmpm) {
322  id = nonmpm;
323 
324  s = sig_array[id];
325  /* As the mpm list can contain duplicates, check for that here. */
326  if (likely(id != previous_id)) {
327  *match_array++ = s;
328  previous_id = id;
329  }
330  if (unlikely(--n_cnt == 0)) {
331  final_ptr = mpm_ptr;
332  final_cnt = m_cnt;
333  goto final;
334  }
335  nonmpm_ptr++;
336  nonmpm = *nonmpm_ptr;
337 
338  } else { /* implied mpm == nonmpm */
339  /* special case: if on both lists, it's a negated mpm pattern */
340 
341  /* mpm list may have dups, so skip past them here */
342  while (--m_cnt != 0) {
343  mpm_ptr++;
344  mpm = *mpm_ptr;
345  if (mpm != nonmpm)
346  break;
347  }
348  /* if mpm is done, update nonmpm_ptrs and jump to final */
349  if (unlikely(m_cnt == 0)) {
350  n_cnt--;
351 
352  /* mpm list is now empty */
353  final_ptr = ++nonmpm_ptr;
354  final_cnt = n_cnt;
355  goto final;
356  }
357  /* otherwise, if nonmpm is done jump to final for mpm
358  * mpm ptrs already updated */
359  if (unlikely(--n_cnt == 0)) {
360  final_ptr = mpm_ptr;
361  final_cnt = m_cnt;
362  goto final;
363  }
364 
365  /* not at end of the lists, update nonmpm. Mpm already
366  * updated in while loop above. */
367  nonmpm_ptr++;
368  nonmpm = *nonmpm_ptr;
369  }
370  }
371 
372  final: /* Only one list remaining. Just walk that list. */
373 
374  while (final_cnt-- > 0) {
375  id = *final_ptr++;
376  s = sig_array[id];
377 
378  /* As the mpm list can contain duplicates, check for that here. */
379  if (likely(id != previous_id)) {
380  *match_array++ = s;
381  previous_id = id;
382  }
383  }
384 
385  det_ctx->match_array_cnt = match_array - det_ctx->match_array;
386  DEBUG_VALIDATE_BUG_ON((det_ctx->pmq.rule_id_array_cnt + det_ctx->non_pf_id_cnt) < det_ctx->match_array_cnt);
387  PMQ_RESET(&det_ctx->pmq);
388 }
389 
390 /** \internal
391  * \brief build non-prefilter list based on the rule group list we've set.
392  */
393 static inline void DetectPrefilterBuildNonPrefilterList(
394  DetectEngineThreadCtx *det_ctx, const SignatureMask mask, const AppProto alproto)
395 {
396  for (uint32_t x = 0; x < det_ctx->non_pf_store_cnt; x++) {
397  /* only if the mask matches this rule can possibly match,
398  * so build the non_mpm array only for match candidates */
399  const SignatureMask rule_mask = det_ctx->non_pf_store_ptr[x].mask;
400  const AppProto rule_alproto = det_ctx->non_pf_store_ptr[x].alproto;
401  if ((rule_mask & mask) == rule_mask &&
402  (rule_alproto == 0 || AppProtoEquals(rule_alproto, alproto))) {
403  det_ctx->non_pf_id_array[det_ctx->non_pf_id_cnt++] = det_ctx->non_pf_store_ptr[x].id;
404  }
405  }
406 }
407 
408 /** \internal
409  * \brief select non-mpm list
410  * Based on the packet properties, select the non-mpm list to use
411  * \todo move non_pf_store* into scratchpad */
412 static inline void
413 DetectPrefilterSetNonPrefilterList(const Packet *p, DetectEngineThreadCtx *det_ctx, DetectRunScratchpad *scratch)
414 {
415  if ((p->proto == IPPROTO_TCP) && PacketIsTCP(p) && (PacketGetTCP(p)->th_flags & TH_SYN)) {
416  det_ctx->non_pf_store_ptr = scratch->sgh->non_pf_syn_store_array;
417  det_ctx->non_pf_store_cnt = scratch->sgh->non_pf_syn_store_cnt;
418  } else {
419  det_ctx->non_pf_store_ptr = scratch->sgh->non_pf_other_store_array;
420  det_ctx->non_pf_store_cnt = scratch->sgh->non_pf_other_store_cnt;
421  }
422  SCLogDebug("sgh non_pf ptr %p cnt %u (syn %p/%u, other %p/%u)",
423  det_ctx->non_pf_store_ptr, det_ctx->non_pf_store_cnt,
424  scratch->sgh->non_pf_syn_store_array, scratch->sgh->non_pf_syn_store_cnt,
426 }
427 
428 /** \internal
429  * \brief update flow's file tracking flags based on the detection engine
430  * A set of flags is prepared that is sent to the File API. The
431  File API may reject one or more based on the global force settings.
432  */
433 static inline void
434 DetectPostInspectFileFlagsUpdate(Flow *f, const SigGroupHead *sgh, uint8_t direction)
435 {
436  uint16_t flow_file_flags = FLOWFILE_INIT;
437 
438  if (sgh == NULL) {
439  SCLogDebug("requesting disabling all file features for flow");
440  flow_file_flags = FLOWFILE_NONE;
441  } else {
442  if (sgh->filestore_cnt == 0) {
443  SCLogDebug("requesting disabling filestore for flow");
444  flow_file_flags |= (FLOWFILE_NO_STORE_TS|FLOWFILE_NO_STORE_TC);
445  }
446 #ifdef HAVE_MAGIC
447  if (!(sgh->flags & SIG_GROUP_HEAD_HAVEFILEMAGIC)) {
448  SCLogDebug("requesting disabling magic for flow");
449  flow_file_flags |= (FLOWFILE_NO_MAGIC_TS|FLOWFILE_NO_MAGIC_TC);
450  }
451 #endif
452  if (!(sgh->flags & SIG_GROUP_HEAD_HAVEFILEMD5)) {
453  SCLogDebug("requesting disabling md5 for flow");
454  flow_file_flags |= (FLOWFILE_NO_MD5_TS|FLOWFILE_NO_MD5_TC);
455  }
456  if (!(sgh->flags & SIG_GROUP_HEAD_HAVEFILESHA1)) {
457  SCLogDebug("requesting disabling sha1 for flow");
458  flow_file_flags |= (FLOWFILE_NO_SHA1_TS|FLOWFILE_NO_SHA1_TC);
459  }
460  if (!(sgh->flags & SIG_GROUP_HEAD_HAVEFILESHA256)) {
461  SCLogDebug("requesting disabling sha256 for flow");
462  flow_file_flags |= (FLOWFILE_NO_SHA256_TS|FLOWFILE_NO_SHA256_TC);
463  }
464  if (!(sgh->flags & SIG_GROUP_HEAD_HAVEFILESIZE)) {
465  SCLogDebug("requesting disabling filesize for flow");
466  flow_file_flags |= (FLOWFILE_NO_SIZE_TS|FLOWFILE_NO_SIZE_TC);
467  }
468  }
469  if (flow_file_flags != 0) {
470  FileUpdateFlowFileFlags(f, flow_file_flags, direction);
471  }
472 }
473 
474 static inline void
475 DetectRunPostGetFirstRuleGroup(const Packet *p, Flow *pflow, const SigGroupHead *sgh)
476 {
477  if ((p->flowflags & FLOW_PKT_TOSERVER) && !(pflow->flags & FLOW_SGH_TOSERVER)) {
478  /* first time we see this toserver sgh, store it */
479  pflow->sgh_toserver = sgh;
480  pflow->flags |= FLOW_SGH_TOSERVER;
481 
482  if (p->proto == IPPROTO_TCP && (sgh == NULL || !(sgh->flags & SIG_GROUP_HEAD_HAVERAWSTREAM))) {
483  if (pflow->protoctx != NULL) {
484  TcpSession *ssn = pflow->protoctx;
485  SCLogDebug("STREAMTCP_STREAM_FLAG_DISABLE_RAW ssn.client");
487  }
488  }
489 
490  DetectPostInspectFileFlagsUpdate(pflow,
491  pflow->sgh_toserver, STREAM_TOSERVER);
492 
493  } else if ((p->flowflags & FLOW_PKT_TOCLIENT) && !(pflow->flags & FLOW_SGH_TOCLIENT)) {
494  pflow->sgh_toclient = sgh;
495  pflow->flags |= FLOW_SGH_TOCLIENT;
496 
497  if (p->proto == IPPROTO_TCP && (sgh == NULL || !(sgh->flags & SIG_GROUP_HEAD_HAVERAWSTREAM))) {
498  if (pflow->protoctx != NULL) {
499  TcpSession *ssn = pflow->protoctx;
500  SCLogDebug("STREAMTCP_STREAM_FLAG_DISABLE_RAW ssn.server");
502  }
503  }
504 
505  DetectPostInspectFileFlagsUpdate(pflow,
506  pflow->sgh_toclient, STREAM_TOCLIENT);
507  }
508 }
509 
510 static inline void DetectRunGetRuleGroup(
511  const DetectEngineCtx *de_ctx,
512  Packet * const p, Flow * const pflow,
513  DetectRunScratchpad *scratch)
514 {
515  const SigGroupHead *sgh = NULL;
516 
517  if (pflow) {
518  bool use_flow_sgh = false;
519  /* Get the stored sgh from the flow (if any). Make sure we're not using
520  * the sgh for icmp error packets part of the same stream. */
521  if (PacketGetIPProto(p) == pflow->proto) { /* filter out icmp */
523  if ((p->flowflags & FLOW_PKT_TOSERVER) && (pflow->flags & FLOW_SGH_TOSERVER)) {
524  sgh = pflow->sgh_toserver;
525  SCLogDebug("sgh = pflow->sgh_toserver; => %p", sgh);
526  use_flow_sgh = true;
527  } else if ((p->flowflags & FLOW_PKT_TOCLIENT) && (pflow->flags & FLOW_SGH_TOCLIENT)) {
528  sgh = pflow->sgh_toclient;
529  SCLogDebug("sgh = pflow->sgh_toclient; => %p", sgh);
530  use_flow_sgh = true;
531  }
533  }
534 
535  if (!(use_flow_sgh)) {
539 
540  /* HACK: prevent the wrong sgh (or NULL) from being stored in the
541  * flow's sgh pointers */
542  if (PacketIsICMPv4(p) && ICMPV4_DEST_UNREACH_IS_VALID(p)) {
543  ; /* no-op */
544  } else {
545  /* store the found sgh (or NULL) in the flow to save us
546  * from looking it up again for the next packet.
547  * Also run other tasks */
548  DetectRunPostGetFirstRuleGroup(p, pflow, sgh);
549  }
550  }
551  } else { /* p->flags & PKT_HAS_FLOW */
552  /* no flow */
553 
557  }
558 
559  scratch->sgh = sgh;
560 }
561 
562 static void DetectRunInspectIPOnly(ThreadVars *tv, const DetectEngineCtx *de_ctx,
563  DetectEngineThreadCtx *det_ctx,
564  Flow * const pflow, Packet * const p)
565 {
566  if (pflow) {
567  /* set the iponly stuff */
568  if (pflow->flags & FLOW_TOCLIENT_IPONLY_SET)
570  if (pflow->flags & FLOW_TOSERVER_IPONLY_SET)
572 
575  {
576  SCLogDebug("testing against \"ip-only\" signatures");
577 
579  IPOnlyMatchPacket(tv, de_ctx, det_ctx, &de_ctx->io_ctx, p);
581 
582  /* save in the flow that we scanned this direction... */
583  FlowSetIPOnlyFlag(pflow, p->flowflags & FLOW_PKT_TOSERVER ? 1 : 0);
584  }
585  } else { /* p->flags & PKT_HAS_FLOW */
586  /* no flow */
587 
588  /* Even without flow we should match the packet src/dst */
590  IPOnlyMatchPacket(tv, de_ctx, det_ctx, &de_ctx->io_ctx, p);
592  }
593 }
594 
595 /** \internal
596  * \brief inspect the rule header: protocol, ports, etc
597  * \retval bool false if no match, true if match */
598 static inline bool DetectRunInspectRuleHeader(const Packet *p, const Flow *f, const Signature *s,
599  const uint32_t sflags, const uint8_t s_proto_flags)
600 {
601  /* check if this signature has a requirement for flowvars of some type
602  * and if so, if we actually have any in the flow. If not, the sig
603  * can't match and we skip it. */
604  if ((p->flags & PKT_HAS_FLOW) && (sflags & SIG_FLAG_REQUIRE_FLOWVAR)) {
605  DEBUG_VALIDATE_BUG_ON(f == NULL);
606 
607  /* no flowvars? skip this sig */
608  const bool fv = f->flowvar != NULL;
609  if (fv == false) {
610  SCLogDebug("skipping sig as the flow has no flowvars and sig "
611  "has SIG_FLAG_REQUIRE_FLOWVAR flag set.");
612  return false;
613  }
614  }
615 
616  if ((s_proto_flags & DETECT_PROTO_IPV4) && !PacketIsIPv4(p)) {
617  SCLogDebug("ip version didn't match");
618  return false;
619  }
620  if ((s_proto_flags & DETECT_PROTO_IPV6) && !PacketIsIPv6(p)) {
621  SCLogDebug("ip version didn't match");
622  return false;
623  }
624 
625  if (DetectProtoContainsProto(&s->proto, PacketGetIPProto(p)) == 0) {
626  SCLogDebug("proto didn't match");
627  return false;
628  }
629 
630  /* check the source & dst port in the sig */
631  if (p->proto == IPPROTO_TCP || p->proto == IPPROTO_UDP || p->proto == IPPROTO_SCTP) {
632  if (!(sflags & SIG_FLAG_DP_ANY)) {
633  if (p->flags & PKT_IS_FRAGMENT)
634  return false;
635  const DetectPort *dport = DetectPortLookupGroup(s->dp, p->dp);
636  if (dport == NULL) {
637  SCLogDebug("dport didn't match.");
638  return false;
639  }
640  }
641  if (!(sflags & SIG_FLAG_SP_ANY)) {
642  if (p->flags & PKT_IS_FRAGMENT)
643  return false;
644  const DetectPort *sport = DetectPortLookupGroup(s->sp, p->sp);
645  if (sport == NULL) {
646  SCLogDebug("sport didn't match.");
647  return false;
648  }
649  }
650  } else if ((sflags & (SIG_FLAG_DP_ANY|SIG_FLAG_SP_ANY)) != (SIG_FLAG_DP_ANY|SIG_FLAG_SP_ANY)) {
651  SCLogDebug("port-less protocol and sig needs ports");
652  return false;
653  }
654 
655  /* check the destination address */
656  if (!(sflags & SIG_FLAG_DST_ANY)) {
657  if (PacketIsIPv4(p)) {
659  return false;
660  } else if (PacketIsIPv6(p)) {
662  return false;
663  }
664  }
665  /* check the source address */
666  if (!(sflags & SIG_FLAG_SRC_ANY)) {
667  if (PacketIsIPv4(p)) {
669  return false;
670  } else if (PacketIsIPv6(p)) {
672  return false;
673  }
674  }
675 
676  return true;
677 }
678 
679 /** \internal
680  * \brief run packet/stream prefilter engines
681  */
682 static inline void DetectRunPrefilterPkt(
683  ThreadVars *tv,
685  DetectEngineThreadCtx *det_ctx,
686  Packet *p,
687  DetectRunScratchpad *scratch
688 )
689 {
690  DetectPrefilterSetNonPrefilterList(p, det_ctx, scratch);
691 
692  /* create our prefilter mask */
693  PacketCreateMask(p, &scratch->pkt_mask, scratch->alproto, scratch->app_decoder_events);
694 
695  /* build and prefilter non_pf list against the mask of the packet */
697  det_ctx->non_pf_id_cnt = 0;
698  if (likely(det_ctx->non_pf_store_cnt > 0)) {
699  DetectPrefilterBuildNonPrefilterList(det_ctx, scratch->pkt_mask, scratch->alproto);
700  }
702 
703  /* run the prefilter engines */
704  Prefilter(det_ctx, scratch->sgh, p, scratch->flow_flags, scratch->pkt_mask);
705  /* create match list if we have non-pf and/or pf */
706  if (det_ctx->non_pf_store_cnt || det_ctx->pmq.rule_id_array_cnt) {
707 #ifdef PROFILING
708  if (tv) {
709  StatsAddUI64(tv, det_ctx->counter_mpm_list, (uint64_t)det_ctx->pmq.rule_id_array_cnt);
710  }
711 #endif
713  DetectPrefilterMergeSort(de_ctx, det_ctx);
715  }
716 
717 #ifdef PROFILING
718  if (tv) {
720  (uint64_t)det_ctx->non_pf_store_cnt);
721  /* non mpm sigs after mask prefilter */
723  (uint64_t)det_ctx->non_pf_id_cnt);
724  }
725 #endif
726 }
727 
728 static inline void DetectRulePacketRules(
729  ThreadVars * const tv,
730  DetectEngineCtx * const de_ctx,
731  DetectEngineThreadCtx * const det_ctx,
732  Packet * const p,
733  Flow * const pflow,
734  const DetectRunScratchpad *scratch
735 )
736 {
737  const Signature *next_s = NULL;
738 
739  /* inspect the sigs against the packet */
740  /* Prefetch the next signature. */
741  SigIntId match_cnt = det_ctx->match_array_cnt;
742 #ifdef PROFILING
743  if (tv) {
745  (uint64_t)match_cnt);
746  }
747 #endif
748  Signature **match_array = det_ctx->match_array;
749 
750  SGH_PROFILING_RECORD(det_ctx, scratch->sgh);
751 #ifdef PROFILING
752  if (match_cnt >= de_ctx->profile_match_logging_threshold)
753  RulesDumpMatchArray(det_ctx, scratch->sgh, p);
754 #endif
755 
756  uint32_t sflags, next_sflags = 0;
757  if (match_cnt) {
758  next_s = *match_array++;
759  next_sflags = next_s->flags;
760  }
761  while (match_cnt--) {
763  uint8_t alert_flags = 0;
764 #ifdef PROFILE_RULES
765  bool smatch = false; /* signature match */
766 #endif
767  const Signature *s = next_s;
768  sflags = next_sflags;
769  if (match_cnt) {
770  next_s = *match_array++;
771  next_sflags = next_s->flags;
772  }
773  const uint8_t s_proto_flags = s->proto.flags;
774 
775  SCLogDebug("inspecting signature id %"PRIu32"", s->id);
776 
777  if (s->app_inspect != NULL) {
778  goto next; // handle sig in DetectRunTx
779  }
780  if (s->frame_inspect != NULL) {
781  goto next; // handle sig in DetectRunFrame
782  }
783 
784  /* don't run mask check for stateful rules.
785  * There we depend on prefilter */
786  if ((s->mask & scratch->pkt_mask) != s->mask) {
787  SCLogDebug("mask mismatch %x & %x != %x", s->mask, scratch->pkt_mask, s->mask);
788  goto next;
789  }
790 
791  if (SigDsizePrefilter(p, s, sflags))
792  goto next;
793 
794  /* if the sig has alproto and the session as well they should match */
795  if (likely(sflags & SIG_FLAG_APPLAYER)) {
796  if (s->alproto != ALPROTO_UNKNOWN && !AppProtoEquals(s->alproto, scratch->alproto)) {
797  SCLogDebug("alproto mismatch");
798  goto next;
799  }
800  }
801 
802  if (DetectRunInspectRuleHeader(p, pflow, s, sflags, s_proto_flags) == false) {
803  goto next;
804  }
805 
806  if (DetectEnginePktInspectionRun(tv, det_ctx, s, pflow, p, &alert_flags) == false) {
807  goto next;
808  }
809 
810 #ifdef PROFILE_RULES
811  smatch = true;
812 #endif
813  DetectRunPostMatch(tv, det_ctx, p, s);
814 
815  uint64_t txid = PACKET_ALERT_NOTX;
816  if ((alert_flags & PACKET_ALERT_FLAG_STREAM_MATCH) ||
817  (s->alproto != ALPROTO_UNKNOWN && pflow->proto == IPPROTO_UDP)) {
818  // if there is a stream match (TCP), or
819  // a UDP specific app-layer signature,
820  // try to use the good tx for the packet direction
821  if (pflow->alstate) {
822  uint8_t dir =
823  (p->flowflags & FLOW_PKT_TOCLIENT) ? STREAM_TOCLIENT : STREAM_TOSERVER;
825  void *tx_ptr =
826  AppLayerParserGetTx(pflow->proto, pflow->alproto, pflow->alstate, txid);
827  AppLayerTxData *txd =
828  tx_ptr ? AppLayerParserGetTxData(pflow->proto, pflow->alproto, tx_ptr)
829  : NULL;
830  if (txd && txd->stream_logged < de_ctx->stream_tx_log_limit) {
831  alert_flags |= PACKET_ALERT_FLAG_TX;
832  txd->stream_logged++;
833  }
834  }
835  }
836  AlertQueueAppend(det_ctx, s, p, txid, alert_flags);
837 next:
838  DetectVarProcessList(det_ctx, pflow, p);
839  DetectReplaceFree(det_ctx);
840  RULE_PROFILING_END(det_ctx, s, smatch, p);
841  continue;
842  }
843 }
844 
845 static DetectRunScratchpad DetectRunSetup(
846  const DetectEngineCtx *de_ctx,
847  DetectEngineThreadCtx *det_ctx,
848  Packet * const p, Flow * const pflow)
849 {
850  AppProto alproto = ALPROTO_UNKNOWN;
851  uint8_t flow_flags = 0; /* flow/state flags */
852  bool app_decoder_events = false;
853 
855 
856 #ifdef UNITTESTS
857  p->alerts.cnt = 0;
858  p->alerts.discarded = 0;
859  p->alerts.suppressed = 0;
860 #endif
861  det_ctx->filestore_cnt = 0;
862  det_ctx->base64_decoded_len = 0;
863  det_ctx->raw_stream_progress = 0;
864  det_ctx->match_array_cnt = 0;
865 
866  det_ctx->alert_queue_size = 0;
867  p->alerts.drop.action = 0;
868 
869 #ifdef DEBUG
870  if (p->flags & PKT_STREAM_ADD) {
871  det_ctx->pkt_stream_add_cnt++;
872  }
873 #endif
874 
875  /* grab the protocol state we will detect on */
876  if (p->flags & PKT_HAS_FLOW) {
877  DEBUG_VALIDATE_BUG_ON(pflow == NULL);
878 
879  if (p->flowflags & FLOW_PKT_TOSERVER) {
880  flow_flags = STREAM_TOSERVER;
881  SCLogDebug("flag STREAM_TOSERVER set");
882  } else if (p->flowflags & FLOW_PKT_TOCLIENT) {
883  flow_flags = STREAM_TOCLIENT;
884  SCLogDebug("flag STREAM_TOCLIENT set");
885  }
886  SCLogDebug("p->flowflags 0x%02x", p->flowflags);
887 
888  if (p->flags & PKT_STREAM_EOF) {
889  flow_flags |= STREAM_EOF;
890  SCLogDebug("STREAM_EOF set");
891  }
892 
893  /* store tenant_id in the flow so that we can use it
894  * for creating pseudo packets */
895  if (p->tenant_id > 0 && pflow->tenant_id == 0) {
896  pflow->tenant_id = p->tenant_id;
897  }
898 
899  /* live ruleswap check for flow updates */
900  if (pflow->de_ctx_version == 0) {
901  /* first time this flow is inspected, set id */
902  pflow->de_ctx_version = de_ctx->version;
903  } else if (pflow->de_ctx_version != de_ctx->version) {
904  /* first time we inspect flow with this de_ctx, reset */
905  pflow->flags &= ~FLOW_SGH_TOSERVER;
906  pflow->flags &= ~FLOW_SGH_TOCLIENT;
907  pflow->sgh_toserver = NULL;
908  pflow->sgh_toclient = NULL;
909 
910  pflow->de_ctx_version = de_ctx->version;
911  GenericVarFree(pflow->flowvar);
912  pflow->flowvar = NULL;
913 
915  }
916 
917  /* Retrieve the app layer state and protocol and the tcp reassembled
918  * stream chunks. */
919  if ((p->proto == IPPROTO_TCP && (p->flags & PKT_STREAM_EST)) ||
920  (p->proto == IPPROTO_UDP) ||
922  {
923  /* update flow flags with knowledge on disruptions */
924  flow_flags = FlowGetDisruptionFlags(pflow, flow_flags);
925  alproto = FlowGetAppProtocol(pflow);
926  if (p->proto == IPPROTO_TCP && pflow->protoctx &&
929  }
930  SCLogDebug("alproto %u", alproto);
931  } else {
932  SCLogDebug("packet doesn't have established flag set (proto %d)", p->proto);
933  }
934 
935  app_decoder_events = AppLayerParserHasDecoderEvents(pflow->alparser);
936  }
937 
938  DetectRunScratchpad pad = { alproto, flow_flags, app_decoder_events, NULL, 0 };
940  return pad;
941 }
942 
943 static inline void DetectRunPostRules(
944  ThreadVars *tv,
946  DetectEngineThreadCtx *det_ctx,
947  Packet * const p,
948  Flow * const pflow,
949  DetectRunScratchpad *scratch)
950 {
951  /* so now let's iterate the alerts and remove the ones after a pass rule
952  * matched (if any). This is done inside PacketAlertFinalize() */
953  /* PR: installed "tag" keywords are handled after the threshold inspection */
954 
956  PacketAlertFinalize(de_ctx, det_ctx, p);
957  if (p->alerts.cnt > 0) {
958  StatsAddUI64(tv, det_ctx->counter_alerts, (uint64_t)p->alerts.cnt);
959  }
960  if (p->alerts.discarded > 0) {
961  StatsAddUI64(tv, det_ctx->counter_alerts_overflow, (uint64_t)p->alerts.discarded);
962  }
963  if (p->alerts.suppressed > 0) {
964  StatsAddUI64(tv, det_ctx->counter_alerts_suppressed, (uint64_t)p->alerts.suppressed);
965  }
967 }
968 
969 static void DetectRunCleanup(DetectEngineThreadCtx *det_ctx,
970  Packet *p, Flow * const pflow)
971 {
973  InspectionBufferClean(det_ctx);
974 
975  if (pflow != NULL) {
976  /* update inspected tracker for raw reassembly */
977  if (p->proto == IPPROTO_TCP && pflow->protoctx != NULL &&
980  det_ctx->raw_stream_progress);
981  }
982  }
984  SCReturn;
985 }
986 
988 {
990  det_ctx->tx_candidates = SCCalloc(size, sizeof(RuleMatchCandidateTx));
991  if (det_ctx->tx_candidates == NULL) {
992  FatalError("failed to allocate %" PRIu64 " bytes",
993  (uint64_t)(size * sizeof(RuleMatchCandidateTx)));
994  }
995  det_ctx->tx_candidates_size = size;
996  SCLogDebug("array initialized to %u elements (%"PRIu64" bytes)",
997  size, (uint64_t)(size * sizeof(RuleMatchCandidateTx)));
998 }
999 
1001 {
1002  SCFree(det_ctx->tx_candidates);
1003  det_ctx->tx_candidates_size = 0;
1004 }
1005 
1006 /* if size >= cur_space */
1007 static inline bool RuleMatchCandidateTxArrayHasSpace(const DetectEngineThreadCtx *det_ctx,
1008  const uint32_t need)
1009 {
1010  if (det_ctx->tx_candidates_size >= need)
1011  return 1;
1012  return 0;
1013 }
1014 
1015 /* realloc */
1016 static int RuleMatchCandidateTxArrayExpand(DetectEngineThreadCtx *det_ctx, const uint32_t needed)
1017 {
1018  const uint32_t old_size = det_ctx->tx_candidates_size;
1019  uint32_t new_size = needed;
1020  void *ptmp = SCRealloc(det_ctx->tx_candidates, (new_size * sizeof(RuleMatchCandidateTx)));
1021  if (ptmp == NULL) {
1022  FatalError("failed to expand to %" PRIu64 " bytes",
1023  (uint64_t)(new_size * sizeof(RuleMatchCandidateTx)));
1024  // TODO can this be handled more gracefully?
1025  }
1026  det_ctx->tx_candidates = ptmp;
1027  det_ctx->tx_candidates_size = new_size;
1028  SCLogDebug("array expanded from %u to %u elements (%"PRIu64" bytes -> %"PRIu64" bytes)",
1029  old_size, new_size, (uint64_t)(old_size * sizeof(RuleMatchCandidateTx)),
1030  (uint64_t)(new_size * sizeof(RuleMatchCandidateTx))); (void)old_size;
1031  return 1;
1032 }
1033 
1034 /** \internal
1035  * \brief sort helper for sorting match candidates by id: ascending
1036  *
1037  * The id field is set from Signature::num, so we sort the candidates to match the signature
1038  * sort order (ascending), where candidates that have flags go first.
1039  */
1040 static int
1041 DetectRunTxSortHelper(const void *a, const void *b)
1042 {
1043  const RuleMatchCandidateTx *s0 = a;
1044  const RuleMatchCandidateTx *s1 = b;
1045  if (s1->id == s0->id) {
1046  if (s1->flags && !s0->flags)
1047  return 1;
1048  else if (!s1->flags && s0->flags)
1049  return -1;
1050  return 0;
1051  } else
1052  return s0->id > s1->id ? 1 : -1;
1053 }
1054 
1055 #if 0
1056 #define TRACE_SID_TXS(sid,txs,...) \
1057  do { \
1058  char _trace_buf[2048]; \
1059  snprintf(_trace_buf, sizeof(_trace_buf), __VA_ARGS__); \
1060  SCLogNotice("%p/%"PRIu64"/%u: %s", txs->tx_ptr, txs->tx_id, sid, _trace_buf); \
1061  } while(0)
1062 #else
1063 #define TRACE_SID_TXS(sid,txs,...)
1064 #endif
1065 
1066 // Get inner transaction for engine
1067 void *DetectGetInnerTx(void *tx_ptr, AppProto alproto, AppProto engine_alproto, uint8_t flow_flags)
1068 {
1069  if (unlikely(alproto == ALPROTO_DOH2)) {
1070  if (engine_alproto == ALPROTO_DNS) {
1071  // need to get the dns tx pointer
1072  tx_ptr = SCDoH2GetDnsTx(tx_ptr, flow_flags);
1073  } else if (engine_alproto != ALPROTO_HTTP2) {
1074  // incompatible engine->alproto with flow alproto
1075  tx_ptr = NULL;
1076  }
1077  } else if (engine_alproto != alproto) {
1078  // incompatible engine->alproto with flow alproto
1079  tx_ptr = NULL;
1080  }
1081  return tx_ptr;
1082 }
1083 
1084 /** \internal
1085  * \brief inspect a rule against a transaction
1086  *
1087  * Inspect a rule. New detection or continued stateful
1088  * detection.
1089  *
1090  * \param stored_flags pointer to stored flags or NULL.
1091  * If stored_flags is set it means we're continuing
1092  * inspection from an earlier run.
1093  *
1094  * \retval bool true sig matched, false didn't match
1095  */
1096 static bool DetectRunTxInspectRule(ThreadVars *tv,
1098  DetectEngineThreadCtx *det_ctx,
1099  Packet *p,
1100  Flow *f,
1101  const uint8_t in_flow_flags, // direction, EOF, etc
1102  void *alstate,
1103  DetectTransaction *tx,
1104  const Signature *s,
1105  uint32_t *stored_flags,
1106  RuleMatchCandidateTx *can,
1107  DetectRunScratchpad *scratch)
1108 {
1109  const uint8_t flow_flags = in_flow_flags;
1110  const int direction = (flow_flags & STREAM_TOSERVER) ? 0 : 1;
1111  uint32_t inspect_flags = stored_flags ? *stored_flags : 0;
1112  int total_matches = 0;
1113  uint16_t file_no_match = 0;
1114  bool retval = false;
1115  bool mpm_before_progress = false; // is mpm engine before progress?
1116  bool mpm_in_progress = false; // is mpm engine in a buffer we will revisit?
1117 
1118  TRACE_SID_TXS(s->id, tx, "starting %s", direction ? "toclient" : "toserver");
1119 
1120  /* for a new inspection we inspect pkt header and packet matches */
1121  if (likely(stored_flags == NULL)) {
1122  TRACE_SID_TXS(s->id, tx, "first inspect, run packet matches");
1123  if (DetectRunInspectRuleHeader(p, f, s, s->flags, s->proto.flags) == false) {
1124  TRACE_SID_TXS(s->id, tx, "DetectRunInspectRuleHeader() no match");
1125  return false;
1126  }
1127  if (DetectEnginePktInspectionRun(tv, det_ctx, s, f, p, NULL) == false) {
1128  TRACE_SID_TXS(s->id, tx, "DetectEnginePktInspectionRun no match");
1129  return false;
1130  }
1131  /* stream mpm and negated mpm sigs can end up here with wrong proto */
1132  if (!(AppProtoEquals(s->alproto, f->alproto) || s->alproto == ALPROTO_UNKNOWN)) {
1133  TRACE_SID_TXS(s->id, tx, "alproto mismatch");
1134  return false;
1135  }
1136  }
1137 
1138  const DetectEngineAppInspectionEngine *engine = s->app_inspect;
1139  do {
1140  TRACE_SID_TXS(s->id, tx, "engine %p inspect_flags %x", engine, inspect_flags);
1141  if (!(inspect_flags & BIT_U32(engine->id)) &&
1142  direction == engine->dir)
1143  {
1144  void *tx_ptr = DetectGetInnerTx(tx->tx_ptr, f->alproto, engine->alproto, flow_flags);
1145  if (tx_ptr == NULL) {
1146  if (engine->alproto != ALPROTO_UNKNOWN) {
1147  /* special case: file_data on 'alert tcp' will have engines
1148  * in the list that are not for us. */
1149  engine = engine->next;
1150  continue;
1151  } else {
1152  tx_ptr = tx->tx_ptr;
1153  }
1154  }
1155 
1156  /* engines are sorted per progress, except that the one with
1157  * mpm/prefilter enabled is first */
1158  if (tx->tx_progress < engine->progress) {
1159  SCLogDebug("tx progress %d < engine progress %d",
1160  tx->tx_progress, engine->progress);
1161  break;
1162  }
1163  if (engine->mpm) {
1164  if (tx->tx_progress > engine->progress) {
1165  TRACE_SID_TXS(s->id, tx,
1166  "engine->mpm: t->tx_progress %u > engine->progress %u, so set "
1167  "mpm_before_progress",
1168  tx->tx_progress, engine->progress);
1169  mpm_before_progress = true;
1170  } else if (tx->tx_progress == engine->progress) {
1171  TRACE_SID_TXS(s->id, tx,
1172  "engine->mpm: t->tx_progress %u == engine->progress %u, so set "
1173  "mpm_in_progress",
1174  tx->tx_progress, engine->progress);
1175  mpm_in_progress = true;
1176  }
1177  }
1178 
1179  /* run callback: but bypass stream callback if we can */
1180  uint8_t match;
1181  if (unlikely(engine->stream && can->stream_stored)) {
1182  match = can->stream_result;
1183  TRACE_SID_TXS(s->id, tx, "stream skipped, stored result %d used instead", match);
1184  } else {
1185  KEYWORD_PROFILING_SET_LIST(det_ctx, engine->sm_list);
1186  DEBUG_VALIDATE_BUG_ON(engine->v2.Callback == NULL);
1187  match = engine->v2.Callback(
1188  de_ctx, det_ctx, engine, s, f, flow_flags, alstate, tx_ptr, tx->tx_id);
1189  TRACE_SID_TXS(s->id, tx, "engine %p match %d", engine, match);
1190  if (engine->stream) {
1191  can->stream_stored = true;
1192  can->stream_result = match;
1193  TRACE_SID_TXS(s->id, tx, "stream ran, store result %d for next tx (if any)", match);
1194  }
1195  }
1196  if (match == DETECT_ENGINE_INSPECT_SIG_MATCH) {
1197  inspect_flags |= BIT_U32(engine->id);
1198  engine = engine->next;
1199  total_matches++;
1200  continue;
1201  } else if (match == DETECT_ENGINE_INSPECT_SIG_MATCH_MORE_FILES) {
1202  /* if the file engine matched, but indicated more
1203  * files are still in progress, we don't set inspect
1204  * flags as these would end inspection for this tx */
1205  engine = engine->next;
1206  total_matches++;
1207  continue;
1208  } else if (match == DETECT_ENGINE_INSPECT_SIG_CANT_MATCH) {
1209  inspect_flags |= DE_STATE_FLAG_SIG_CANT_MATCH;
1210  inspect_flags |= BIT_U32(engine->id);
1211  } else if (match == DETECT_ENGINE_INSPECT_SIG_CANT_MATCH_FILES) {
1212  inspect_flags |= DE_STATE_FLAG_SIG_CANT_MATCH;
1213  inspect_flags |= BIT_U32(engine->id);
1214  file_no_match = 1;
1215  }
1216  /* implied DETECT_ENGINE_INSPECT_SIG_NO_MATCH */
1217  if (engine->mpm && mpm_before_progress) {
1218  inspect_flags |= DE_STATE_FLAG_SIG_CANT_MATCH;
1219  inspect_flags |= BIT_U32(engine->id);
1220  }
1221  break;
1222  }
1223  engine = engine->next;
1224  } while (engine != NULL);
1225  TRACE_SID_TXS(s->id, tx, "inspect_flags %x, total_matches %u, engine %p",
1226  inspect_flags, total_matches, engine);
1227 
1228  if (engine == NULL && total_matches) {
1229  inspect_flags |= DE_STATE_FLAG_FULL_INSPECT;
1230  TRACE_SID_TXS(s->id, tx, "MATCH");
1231  retval = true;
1232  }
1233 
1234  if (stored_flags) {
1235  *stored_flags = inspect_flags;
1236  TRACE_SID_TXS(s->id, tx, "continue inspect flags %08x", inspect_flags);
1237  } else {
1238  // store... or? If tx is done we might not want to come back to this tx
1239 
1240  // also... if mpmid tracking is enabled, we won't do a sig again for this tx...
1241  TRACE_SID_TXS(s->id, tx, "start inspect flags %08x", inspect_flags);
1242  if (inspect_flags & DE_STATE_FLAG_SIG_CANT_MATCH) {
1243  if (file_no_match) {
1244  /* if we have a mismatch on a file sig, we need to keep state.
1245  * We may get another file on the same tx (for http and smtp
1246  * at least), so for a new file we need to re-eval the sig.
1247  * Thoughts / TODO:
1248  * - not for some protos that have 1 file per tx (e.g. nfs)
1249  * - maybe we only need this for file sigs that mix with
1250  * other matches? E.g. 'POST + filename', is different than
1251  * just 'filename'.
1252  */
1253  DetectRunStoreStateTx(scratch->sgh, f, tx->tx_ptr, tx->tx_id, s,
1254  inspect_flags, flow_flags, file_no_match);
1255  }
1256  } else if ((inspect_flags & DE_STATE_FLAG_FULL_INSPECT) && mpm_before_progress) {
1257  TRACE_SID_TXS(s->id, tx, "no need to store match sig, "
1258  "mpm won't trigger for it anymore");
1259 
1260  if (inspect_flags & DE_STATE_FLAG_FILE_INSPECT) {
1261  TRACE_SID_TXS(s->id, tx, "except that for new files, "
1262  "we may have to revisit anyway");
1263  DetectRunStoreStateTx(scratch->sgh, f, tx->tx_ptr, tx->tx_id, s,
1264  inspect_flags, flow_flags, file_no_match);
1265  }
1266  } else if ((inspect_flags & DE_STATE_FLAG_FULL_INSPECT) == 0 && mpm_in_progress) {
1267  TRACE_SID_TXS(s->id, tx, "no need to store no-match sig, "
1268  "mpm will revisit it");
1269  } else if (inspect_flags != 0 || file_no_match != 0) {
1270  TRACE_SID_TXS(s->id, tx, "storing state: flags %08x", inspect_flags);
1271  DetectRunStoreStateTx(scratch->sgh, f, tx->tx_ptr, tx->tx_id, s,
1272  inspect_flags, flow_flags, file_no_match);
1273  }
1274  }
1275 
1276  return retval;
1277 }
1278 
1279 #define NO_TX \
1280  { \
1281  NULL, 0, NULL, NULL, 0, 0, 0, 0, 0, \
1282  }
1283 
1284 /** \internal
1285  * \brief get a DetectTransaction object
1286  * \retval struct filled with relevant info or all nulls/0s
1287  */
1288 static DetectTransaction GetDetectTx(const uint8_t ipproto, const AppProto alproto,
1289  void *alstate, const uint64_t tx_id, void *tx_ptr, const int tx_end_state,
1290  const uint8_t flow_flags)
1291 {
1292  AppLayerTxData *txd = AppLayerParserGetTxData(ipproto, alproto, tx_ptr);
1293  if (unlikely(txd == NULL)) {
1294  DetectTransaction no_tx = NO_TX;
1295  return no_tx;
1296  }
1297  uint64_t detect_flags =
1298  (flow_flags & STREAM_TOSERVER) ? txd->detect_flags_ts : txd->detect_flags_tc;
1299  if (detect_flags & APP_LAYER_TX_INSPECTED_FLAG) {
1300  SCLogDebug("%"PRIu64" tx already fully inspected for %s. Flags %016"PRIx64,
1301  tx_id, flow_flags & STREAM_TOSERVER ? "toserver" : "toclient",
1302  detect_flags);
1303  DetectTransaction no_tx = NO_TX;
1304  return no_tx;
1305  }
1306  if (detect_flags & APP_LAYER_TX_SKIP_INSPECT_FLAG) {
1307  SCLogDebug("%" PRIu64 " tx should not be inspected in direction %s. Flags %016" PRIx64,
1308  tx_id, flow_flags & STREAM_TOSERVER ? "toserver" : "toclient", detect_flags);
1309  DetectTransaction no_tx = NO_TX;
1310  return no_tx;
1311  }
1312 
1313  const int tx_progress = AppLayerParserGetStateProgress(ipproto, alproto, tx_ptr, flow_flags);
1314  const int dir_int = (flow_flags & STREAM_TOSERVER) ? 0 : 1;
1315  DetectEngineState *tx_de_state = txd->de_state;
1316  DetectEngineStateDirection *tx_dir_state = tx_de_state ? &tx_de_state->dir_state[dir_int] : NULL;
1317  uint64_t prefilter_flags = detect_flags & APP_LAYER_TX_PREFILTER_MASK;
1319 
1320  DetectTransaction tx = {
1321  .tx_ptr = tx_ptr,
1322  .tx_id = tx_id,
1323  .tx_data_ptr = (struct AppLayerTxData *)txd,
1324  .de_state = tx_dir_state,
1325  .detect_flags = detect_flags,
1326  .prefilter_flags = prefilter_flags,
1327  .prefilter_flags_orig = prefilter_flags,
1328  .tx_progress = tx_progress,
1329  .tx_end_state = tx_end_state,
1330  };
1331  return tx;
1332 }
1333 
1334 static inline void StoreDetectFlags(DetectTransaction *tx, const uint8_t flow_flags,
1335  const uint8_t ipproto, const AppProto alproto, const uint64_t detect_flags)
1336 {
1338  if (likely(txd != NULL)) {
1339  if (flow_flags & STREAM_TOSERVER) {
1340  txd->detect_flags_ts = detect_flags;
1341  } else {
1342  txd->detect_flags_tc = detect_flags;
1343  }
1344  }
1345 }
1346 
1347 // Merge 'state' rules from the regular prefilter
1348 // updates array_idx on the way
1349 static inline void RuleMatchCandidateMergeStateRules(
1350  DetectEngineThreadCtx *det_ctx, uint32_t *array_idx)
1351 {
1352  // Now, we will merge 2 sorted lists :
1353  // the one in det_ctx->tx_candidates
1354  // and the one in det_ctx->match_array
1355  // For match_array, we take only the relevant elements where s->app_inspect != NULL
1356 
1357  // Basically, we iterate at the same time over the 2 lists
1358  // comparing and taking an element from either.
1359 
1360  // Trick is to do so in place in det_ctx->tx_candidates,
1361  // so as to minimize the number of moves in det_ctx->tx_candidates.
1362  // For this, the algorithm traverses the lists in reverse order.
1363  // Otherwise, if the first element of match_array was to be put before
1364  // all tx_candidates, we would need to shift all tx_candidates
1365 
1366  // Retain the number of elements sorted in tx_candidates before merge
1367  uint32_t j = *array_idx;
1368  // First loop only counting the number of elements to add
1369  for (uint32_t i = 0; i < det_ctx->match_array_cnt; i++) {
1370  const Signature *s = det_ctx->match_array[i];
1371  if (s->app_inspect != NULL) {
1372  (*array_idx)++;
1373  }
1374  }
1375  // Future number of elements in tx_candidates after merge
1376  uint32_t k = *array_idx;
1377 
1378  if (k == j) {
1379  // no new element from match_array to merge in tx_candidates
1380  return;
1381  }
1382 
1383  // variable i is for all elements of match_array (even not relevant ones)
1384  // variable j is for elements of tx_candidates before merge
1385  // variable k is for elements of tx_candidates after merge
1386  for (uint32_t i = det_ctx->match_array_cnt; i > 0;) {
1387  const Signature *s = det_ctx->match_array[i - 1];
1388  if (s->app_inspect == NULL) {
1389  // no relevant element, get the next one from match_array
1390  i--;
1391  continue;
1392  }
1393  // we have one element from match_array to merge in tx_candidates
1394  k--;
1395  if (j > 0) {
1396  // j > 0 means there is still at least one element in tx_candidates to merge
1397  const RuleMatchCandidateTx *s0 = &det_ctx->tx_candidates[j - 1];
1398  if (s->num <= s0->id) {
1399  // get next element from previous tx_candidates
1400  j--;
1401  // take the element from tx_candidates before merge
1402  det_ctx->tx_candidates[k].s = det_ctx->tx_candidates[j].s;
1403  det_ctx->tx_candidates[k].id = det_ctx->tx_candidates[j].id;
1404  det_ctx->tx_candidates[k].flags = det_ctx->tx_candidates[j].flags;
1405  det_ctx->tx_candidates[k].stream_reset = det_ctx->tx_candidates[j].stream_reset;
1406  continue;
1407  }
1408  } // otherwise
1409  // get next element from match_array
1410  i--;
1411  // take the element from match_array
1412  det_ctx->tx_candidates[k].s = s;
1413  det_ctx->tx_candidates[k].id = s->num;
1414  det_ctx->tx_candidates[k].flags = NULL;
1415  det_ctx->tx_candidates[k].stream_reset = 0;
1416  }
1417  // Even if k > 0 or j > 0, the loop is over. (Note that j == k now)
1418  // The remaining elements in tx_candidates up to k were already sorted
1419  // and come before any other element later in the list
1420 }
1421 
1422 static void DetectRunTx(ThreadVars *tv,
1424  DetectEngineThreadCtx *det_ctx,
1425  Packet *p,
1426  Flow *f,
1427  DetectRunScratchpad *scratch)
1428 {
1429  const uint8_t flow_flags = scratch->flow_flags;
1430  const SigGroupHead * const sgh = scratch->sgh;
1431  void * const alstate = f->alstate;
1432  const uint8_t ipproto = f->proto;
1433  const AppProto alproto = f->alproto;
1434 
1435  const uint64_t total_txs = AppLayerParserGetTxCnt(f, alstate);
1436  uint64_t tx_id_min = AppLayerParserGetTransactionInspectId(f->alparser, flow_flags);
1437  const int tx_end_state = AppLayerParserGetStateProgressCompletionStatus(alproto, flow_flags);
1438 
1439  AppLayerGetTxIteratorFunc IterFunc = AppLayerGetTxIterator(ipproto, alproto);
1440  AppLayerGetTxIterState state = { 0 };
1441 
1442  while (1) {
1443  AppLayerGetTxIterTuple ires = IterFunc(ipproto, alproto, alstate, tx_id_min, total_txs, &state);
1444  if (ires.tx_ptr == NULL)
1445  break;
1446 
1447  DetectTransaction tx = GetDetectTx(ipproto, alproto,
1448  alstate, ires.tx_id, ires.tx_ptr, tx_end_state, flow_flags);
1449  if (tx.tx_ptr == NULL) {
1450  SCLogDebug("%p/%"PRIu64" no transaction to inspect",
1451  tx.tx_ptr, tx_id_min);
1452 
1453  tx_id_min++; // next (if any) run look for +1
1454  goto next;
1455  }
1456  tx_id_min = tx.tx_id + 1; // next look for cur + 1
1457 
1458  bool do_sort = false; // do we need to sort the tx candidate list?
1459  uint32_t array_idx = 0;
1460  uint32_t total_rules = det_ctx->match_array_cnt;
1461  total_rules += (tx.de_state ? tx.de_state->cnt : 0);
1462 
1463  /* run prefilter engines and merge results into a candidates array */
1464  if (sgh->tx_engines) {
1466  DetectRunPrefilterTx(det_ctx, sgh, p, ipproto, flow_flags, alproto,
1467  alstate, &tx);
1469  SCLogDebug("%p/%"PRIu64" rules added from prefilter: %u candidates",
1470  tx.tx_ptr, tx.tx_id, det_ctx->pmq.rule_id_array_cnt);
1471 
1472  total_rules += det_ctx->pmq.rule_id_array_cnt;
1473  if (!(RuleMatchCandidateTxArrayHasSpace(det_ctx, total_rules))) {
1474  RuleMatchCandidateTxArrayExpand(det_ctx, total_rules);
1475  }
1476 
1477  for (uint32_t i = 0; i < det_ctx->pmq.rule_id_array_cnt; i++) {
1478  const Signature *s = de_ctx->sig_array[det_ctx->pmq.rule_id_array[i]];
1479  const SigIntId id = s->num;
1480  det_ctx->tx_candidates[array_idx].s = s;
1481  det_ctx->tx_candidates[array_idx].id = id;
1482  det_ctx->tx_candidates[array_idx].flags = NULL;
1483  det_ctx->tx_candidates[array_idx].stream_reset = 0;
1484  array_idx++;
1485  }
1486  PMQ_RESET(&det_ctx->pmq);
1487  } else {
1488  if (!(RuleMatchCandidateTxArrayHasSpace(det_ctx, total_rules))) {
1489  RuleMatchCandidateTxArrayExpand(det_ctx, total_rules);
1490  }
1491  }
1492 
1493  /* merge 'state' rules from the regular prefilter */
1494 #ifdef PROFILING
1495  uint32_t x = array_idx;
1496 #endif
1497  RuleMatchCandidateMergeStateRules(det_ctx, &array_idx);
1498 
1499  /* merge stored state into results */
1500  if (tx.de_state != NULL) {
1501  const uint32_t old = array_idx;
1502 
1503  /* if tx.de_state->flags has 'new file' set and sig below has
1504  * 'file inspected' flag, reset the file part of the state */
1505  const bool have_new_file = (tx.de_state->flags & DETECT_ENGINE_STATE_FLAG_FILE_NEW);
1506  if (have_new_file) {
1507  SCLogDebug("%p/%"PRIu64" destate: need to consider new file",
1508  tx.tx_ptr, tx.tx_id);
1510  }
1511 
1512  SigIntId state_cnt = 0;
1513  DeStateStore *tx_store = tx.de_state->head;
1514  for (; tx_store != NULL; tx_store = tx_store->next) {
1515  SCLogDebug("tx_store %p", tx_store);
1516 
1517  SigIntId store_cnt = 0;
1518  for (store_cnt = 0;
1519  store_cnt < DE_STATE_CHUNK_SIZE && state_cnt < tx.de_state->cnt;
1520  store_cnt++, state_cnt++)
1521  {
1522  DeStateStoreItem *item = &tx_store->store[store_cnt];
1523  SCLogDebug("rule id %u, inspect_flags %u", item->sid, item->flags);
1524  if (have_new_file && (item->flags & DE_STATE_FLAG_FILE_INSPECT)) {
1525  /* remove part of the state. File inspect engine will now
1526  * be able to run again */
1528  SCLogDebug("rule id %u, post file reset inspect_flags %u", item->sid, item->flags);
1529  }
1530  det_ctx->tx_candidates[array_idx].s = de_ctx->sig_array[item->sid];
1531  det_ctx->tx_candidates[array_idx].id = item->sid;
1532  det_ctx->tx_candidates[array_idx].flags = &item->flags;
1533  det_ctx->tx_candidates[array_idx].stream_reset = 0;
1534  array_idx++;
1535  }
1536  }
1537  do_sort |= (old && old != array_idx); // sort if continue list adds sids
1538  SCLogDebug("%p/%" PRIu64 " rules added from 'continue' list: %u", tx.tx_ptr, tx.tx_id,
1539  array_idx - old);
1540  }
1541  if (do_sort) {
1542  qsort(det_ctx->tx_candidates, array_idx, sizeof(RuleMatchCandidateTx),
1543  DetectRunTxSortHelper);
1544  }
1545 
1546 #ifdef PROFILING
1547  if (array_idx >= de_ctx->profile_match_logging_threshold)
1548  RulesDumpTxMatchArray(det_ctx, scratch->sgh, p, tx.tx_id, array_idx, x);
1549 #endif
1550  det_ctx->tx_id = tx.tx_id;
1551  det_ctx->tx_id_set = true;
1552  det_ctx->p = p;
1553 
1554 #ifdef DEBUG
1555  for (uint32_t i = 0; i < array_idx; i++) {
1556  RuleMatchCandidateTx *can = &det_ctx->tx_candidates[i];
1557  const Signature *s = det_ctx->tx_candidates[i].s;
1558  SCLogDebug("%u: sid %u flags %p", i, s->id, can->flags);
1559  }
1560 #endif
1561  /* run rules: inspect the match candidates */
1562  for (uint32_t i = 0; i < array_idx; i++) {
1563  RuleMatchCandidateTx *can = &det_ctx->tx_candidates[i];
1564  const Signature *s = det_ctx->tx_candidates[i].s;
1565  uint32_t *inspect_flags = det_ctx->tx_candidates[i].flags;
1566 
1567  /* deduplicate: rules_array is sorted, but not deduplicated:
1568  * both mpm and stored state could give us the same sid.
1569  * As they are back to back in that case we can check for it
1570  * here. We select the stored state one as that comes first
1571  * in the array. */
1572  while ((i + 1) < array_idx &&
1573  det_ctx->tx_candidates[i].s == det_ctx->tx_candidates[i + 1].s) {
1574  SCLogDebug("%p/%" PRIu64 " inspecting SKIP NEXT: sid %u (%u), flags %08x",
1575  tx.tx_ptr, tx.tx_id, s->id, s->num, inspect_flags ? *inspect_flags : 0);
1576  i++;
1577  }
1578 
1579  SCLogDebug("%p/%"PRIu64" inspecting: sid %u (%u), flags %08x",
1580  tx.tx_ptr, tx.tx_id, s->id, s->num, inspect_flags ? *inspect_flags : 0);
1581 
1582  if (inspect_flags) {
1584  SCLogDebug("%p/%"PRIu64" inspecting: sid %u (%u), flags %08x ALREADY COMPLETE",
1585  tx.tx_ptr, tx.tx_id, s->id, s->num, *inspect_flags);
1586  continue;
1587  }
1588  }
1589 
1590  if (inspect_flags) {
1591  /* continue previous inspection */
1592  SCLogDebug("%p/%" PRIu64 " Continuing sid %u", tx.tx_ptr, tx.tx_id, s->id);
1593  } else {
1594  /* start new inspection */
1595  SCLogDebug("%p/%"PRIu64" Start sid %u", tx.tx_ptr, tx.tx_id, s->id);
1596  }
1597 
1598  /* call individual rule inspection */
1600  const int r = DetectRunTxInspectRule(tv, de_ctx, det_ctx, p, f, flow_flags,
1601  alstate, &tx, s, inspect_flags, can, scratch);
1602  if (r == 1) {
1603  /* match */
1604  DetectRunPostMatch(tv, det_ctx, p, s);
1605 
1606  const uint8_t alert_flags = (PACKET_ALERT_FLAG_STATE_MATCH | PACKET_ALERT_FLAG_TX);
1607  SCLogDebug("%p/%"PRIu64" sig %u (%u) matched", tx.tx_ptr, tx.tx_id, s->id, s->num);
1608  AlertQueueAppend(det_ctx, s, p, tx.tx_id, alert_flags);
1609  }
1610  DetectVarProcessList(det_ctx, p->flow, p);
1611  RULE_PROFILING_END(det_ctx, s, r, p);
1612  }
1613 
1614  det_ctx->tx_id = 0;
1615  det_ctx->tx_id_set = false;
1616  det_ctx->p = NULL;
1617 
1618  /* see if we have any updated state to store in the tx */
1619 
1620  uint64_t new_detect_flags = 0;
1621  /* this side of the tx is done */
1622  if (tx.tx_progress >= tx.tx_end_state) {
1623  new_detect_flags |= APP_LAYER_TX_INSPECTED_FLAG;
1624  SCLogDebug("%p/%"PRIu64" tx is done for direction %s. Flag %016"PRIx64,
1625  tx.tx_ptr, tx.tx_id,
1626  flow_flags & STREAM_TOSERVER ? "toserver" : "toclient",
1627  new_detect_flags);
1628  }
1629  if (tx.prefilter_flags != tx.prefilter_flags_orig) {
1630  new_detect_flags |= tx.prefilter_flags;
1632  SCLogDebug("%p/%"PRIu64" updated prefilter flags %016"PRIx64" "
1633  "(was: %016"PRIx64") for direction %s. Flag %016"PRIx64,
1635  flow_flags & STREAM_TOSERVER ? "toserver" : "toclient",
1636  new_detect_flags);
1637  }
1638  if (new_detect_flags != 0 &&
1639  (new_detect_flags | tx.detect_flags) != tx.detect_flags)
1640  {
1641  new_detect_flags |= tx.detect_flags;
1643  SCLogDebug("%p/%"PRIu64" Storing new flags %016"PRIx64" (was %016"PRIx64")",
1644  tx.tx_ptr, tx.tx_id, new_detect_flags, tx.detect_flags);
1645 
1646  StoreDetectFlags(&tx, flow_flags, ipproto, alproto, new_detect_flags);
1647  }
1648  InspectionBufferClean(det_ctx);
1649 
1650  next:
1651  if (!ires.has_next)
1652  break;
1653  }
1654 }
1655 
1656 static void DetectRunFrames(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
1657  Packet *p, Flow *f, DetectRunScratchpad *scratch)
1658 {
1659  const SigGroupHead *const sgh = scratch->sgh;
1660  const AppProto alproto = f->alproto;
1661 
1662  /* for TCP, limit inspection to pseudo packets or real packet that did
1663  * an app-layer update. */
1664  if (p->proto == IPPROTO_TCP && !PKT_IS_PSEUDOPKT(p) &&
1665  ((PKT_IS_TOSERVER(p) && (f->flags & FLOW_TS_APP_UPDATED) == 0) ||
1666  (PKT_IS_TOCLIENT(p) && (f->flags & FLOW_TC_APP_UPDATED) == 0))) {
1667  SCLogDebug("pcap_cnt %" PRIu64 ": %s: skip frame inspection for TCP w/o APP UPDATE",
1668  p->pcap_cnt, PKT_IS_TOSERVER(p) ? "toserver" : "toclient");
1669  return;
1670  }
1671  FramesContainer *frames_container = AppLayerFramesGetContainer(f);
1672  if (frames_container == NULL) {
1673  return;
1674  }
1675  Frames *frames;
1676  if (PKT_IS_TOSERVER(p)) {
1677  frames = &frames_container->toserver;
1678  } else {
1679  frames = &frames_container->toclient;
1680  }
1681 
1682  for (uint32_t idx = 0; idx < frames->cnt; idx++) {
1683  SCLogDebug("frame %u", idx);
1684  Frame *frame = FrameGetByIndex(frames, idx);
1685  if (frame == NULL) {
1686  continue;
1687  }
1688 
1689  det_ctx->frame_inspect_progress = 0;
1690  uint32_t array_idx = 0;
1691  uint32_t total_rules = det_ctx->match_array_cnt;
1692 
1693  /* run prefilter engines and merge results into a candidates array */
1694  if (sgh->frame_engines) {
1695  // PACKET_PROFILING_DETECT_START(p, PROF_DETECT_PF_TX);
1696  DetectRunPrefilterFrame(det_ctx, sgh, p, frames, frame, alproto);
1697  // PACKET_PROFILING_DETECT_END(p, PROF_DETECT_PF_TX);
1698  SCLogDebug("%p/%" PRIi64 " rules added from prefilter: %u candidates", frame, frame->id,
1699  det_ctx->pmq.rule_id_array_cnt);
1700 
1701  total_rules += det_ctx->pmq.rule_id_array_cnt;
1702 
1703  if (!(RuleMatchCandidateTxArrayHasSpace(
1704  det_ctx, total_rules))) { // TODO is it safe to overload?
1705  RuleMatchCandidateTxArrayExpand(det_ctx, total_rules);
1706  }
1707 
1708  for (uint32_t i = 0; i < det_ctx->pmq.rule_id_array_cnt; i++) {
1709  const Signature *s = de_ctx->sig_array[det_ctx->pmq.rule_id_array[i]];
1710  const SigIntId id = s->num;
1711  det_ctx->tx_candidates[array_idx].s = s;
1712  det_ctx->tx_candidates[array_idx].id = id;
1713  det_ctx->tx_candidates[array_idx].flags = NULL;
1714  det_ctx->tx_candidates[array_idx].stream_reset = 0;
1715  array_idx++;
1716  }
1717  PMQ_RESET(&det_ctx->pmq);
1718  }
1719  /* merge 'state' rules from the regular prefilter */
1720  uint32_t x = array_idx;
1721  for (uint32_t i = 0; i < det_ctx->match_array_cnt; i++) {
1722  const Signature *s = det_ctx->match_array[i];
1723  if (s->frame_inspect != NULL) {
1724  const SigIntId id = s->num;
1725  det_ctx->tx_candidates[array_idx].s = s;
1726  det_ctx->tx_candidates[array_idx].id = id;
1727  det_ctx->tx_candidates[array_idx].flags = NULL;
1728  det_ctx->tx_candidates[array_idx].stream_reset = 0;
1729  array_idx++;
1730 
1731  SCLogDebug("%p/%" PRIi64 " rule %u (%u) added from 'match' list", frame, frame->id,
1732  s->id, id);
1733  }
1734  }
1735  SCLogDebug("%p/%" PRIi64 " rules added from 'match' list: %u", frame, frame->id,
1736  array_idx - x);
1737  (void)x;
1738 
1739  /* run rules: inspect the match candidates */
1740  for (uint32_t i = 0; i < array_idx; i++) {
1741  const Signature *s = det_ctx->tx_candidates[i].s;
1742 
1743  /* deduplicate: rules_array is sorted, but not deduplicated.
1744  * As they are back to back in that case we can check for it
1745  * here. We select the stored state one as that comes first
1746  * in the array. */
1747  while ((i + 1) < array_idx &&
1748  det_ctx->tx_candidates[i].s == det_ctx->tx_candidates[i + 1].s) {
1749  i++;
1750  }
1751  SCLogDebug("%p/%" PRIi64 " inspecting: sid %u (%u)", frame, frame->id, s->id, s->num);
1752 
1753  /* start new inspection */
1754  SCLogDebug("%p/%" PRIi64 " Start sid %u", frame, frame->id, s->id);
1755 
1756  /* call individual rule inspection */
1758  bool r = DetectRunInspectRuleHeader(p, f, s, s->flags, s->proto.flags);
1759  if (r == true) {
1760  r = DetectRunFrameInspectRule(tv, det_ctx, s, f, p, frames, frame);
1761  if (r == true) {
1762  /* match */
1763  DetectRunPostMatch(tv, det_ctx, p, s);
1764 
1765  uint8_t alert_flags = (PACKET_ALERT_FLAG_STATE_MATCH | PACKET_ALERT_FLAG_FRAME);
1766  det_ctx->frame_id = frame->id;
1767  SCLogDebug(
1768  "%p/%" PRIi64 " sig %u (%u) matched", frame, frame->id, s->id, s->num);
1769  if (frame->flags & FRAME_FLAG_TX_ID_SET) {
1770  alert_flags |= PACKET_ALERT_FLAG_TX;
1771  }
1772  AlertQueueAppend(det_ctx, s, p, frame->tx_id, alert_flags);
1773  }
1774  }
1775  DetectVarProcessList(det_ctx, p->flow, p);
1776  RULE_PROFILING_END(det_ctx, s, r, p);
1777  }
1778 
1779  /* update Frame::inspect_progress here instead of in the code above. The reason is that a
1780  * frame might be used more than once in buffers with transforms. */
1781  if (frame->inspect_progress < det_ctx->frame_inspect_progress) {
1782  frame->inspect_progress = det_ctx->frame_inspect_progress;
1783  SCLogDebug("frame->inspect_progress: %" PRIu64 " -> updated", frame->inspect_progress);
1784  } else {
1785  SCLogDebug(
1786  "frame->inspect_progress: %" PRIu64 " -> not updated", frame->inspect_progress);
1787  }
1788 
1789  SCLogDebug("%p/%" PRIi64 " rules inspected, running cleanup", frame, frame->id);
1790  InspectionBufferClean(det_ctx);
1791  }
1792 }
1793 
1794 static DetectEngineThreadCtx *GetTenantById(HashTable *h, uint32_t id)
1795 {
1796  /* technically we need to pass a DetectEngineThreadCtx struct with the
1797  * tenant_id member. But as that member is the first in the struct, we
1798  * can use the id directly. */
1799  return HashTableLookup(h, &id, 0);
1800 }
1801 
1802 static void DetectFlow(ThreadVars *tv,
1804  Packet *p)
1805 {
1806  Flow *const f = p->flow;
1807 
1808  if (p->flags & PKT_NOPACKET_INSPECTION) {
1809  /* hack: if we are in pass the entire flow mode, we need to still
1810  * update the inspect_id forward. So test for the condition here,
1811  * and call the update code if necessary. */
1812  const int pass = ((f->flags & FLOW_NOPACKET_INSPECTION));
1813  if (pass) {
1814  uint8_t flags = STREAM_FLAGS_FOR_PACKET(p);
1816  if (f->alstate) {
1818  }
1819  }
1820  SCLogDebug("p->pcap %"PRIu64": no detection on packet, "
1821  "PKT_NOPACKET_INSPECTION is set", p->pcap_cnt);
1822  return;
1823  }
1824 
1825  /* we check the flow drop here, and not the packet drop. This is
1826  * to allow stream engine "invalid" drop packets to still be
1827  * evaluated by the stream event rules. */
1828  if (f->flags & FLOW_ACTION_DROP) {
1830  SCReturn;
1831  }
1832 
1833  /* see if the packet matches one or more of the sigs */
1834  (void)DetectRun(tv, de_ctx, det_ctx, p);
1835 }
1836 
1837 
1838 static void DetectNoFlow(ThreadVars *tv,
1840  Packet *p)
1841 {
1842  /* No need to perform any detection on this packet, if the given flag is set.*/
1844  return;
1845  }
1846 
1847  /* see if the packet matches one or more of the sigs */
1848  DetectRun(tv, de_ctx, det_ctx, p);
1849 }
1850 
1851 /** \brief Detection engine thread wrapper.
1852  * \param tv thread vars
1853  * \param p packet to inspect
1854  * \param data thread specific data
1855  * \param pq packet queue
1856  * \retval TM_ECODE_FAILED error
1857  * \retval TM_ECODE_OK ok
1858  */
1859 TmEcode Detect(ThreadVars *tv, Packet *p, void *data)
1860 {
1862 
1863  DetectEngineCtx *de_ctx = NULL;
1864  DetectEngineThreadCtx *det_ctx = (DetectEngineThreadCtx *)data;
1865  if (det_ctx == NULL) {
1866  printf("ERROR: Detect has no thread ctx\n");
1867  goto error;
1868  }
1869 
1870  if (unlikely(SC_ATOMIC_GET(det_ctx->so_far_used_by_detect) == 0)) {
1871  (void)SC_ATOMIC_SET(det_ctx->so_far_used_by_detect, 1);
1872  SCLogDebug("Detect Engine using new det_ctx - %p",
1873  det_ctx);
1874  }
1875 
1876  /* if in MT mode _and_ we have tenants registered, use
1877  * MT logic. */
1878  if (det_ctx->mt_det_ctxs_cnt > 0 && det_ctx->TenantGetId != NULL)
1879  {
1880  uint32_t tenant_id = p->tenant_id;
1881  if (tenant_id == 0)
1882  tenant_id = det_ctx->TenantGetId(det_ctx, p);
1883  if (tenant_id > 0 && tenant_id < det_ctx->mt_det_ctxs_cnt) {
1884  p->tenant_id = tenant_id;
1885  det_ctx = GetTenantById(det_ctx->mt_det_ctxs_hash, tenant_id);
1886  if (det_ctx == NULL)
1887  return TM_ECODE_OK;
1888  de_ctx = det_ctx->de_ctx;
1889  if (de_ctx == NULL)
1890  return TM_ECODE_OK;
1891 
1892  if (unlikely(SC_ATOMIC_GET(det_ctx->so_far_used_by_detect) == 0)) {
1893  (void)SC_ATOMIC_SET(det_ctx->so_far_used_by_detect, 1);
1894  SCLogDebug("MT de_ctx %p det_ctx %p (tenant %u)", de_ctx, det_ctx, tenant_id);
1895  }
1896  } else {
1897  /* use default if no tenants are registered for this packet */
1898  de_ctx = det_ctx->de_ctx;
1899  }
1900  } else {
1901  de_ctx = det_ctx->de_ctx;
1902  }
1903 
1904  if (p->flow) {
1905  DetectFlow(tv, de_ctx, det_ctx, p);
1906  } else {
1907  DetectNoFlow(tv, de_ctx, det_ctx, p);
1908  }
1909 
1910 #ifdef PROFILE_RULES
1911  /* aggregate statistics */
1912  struct timeval ts;
1913  gettimeofday(&ts, NULL);
1914  if (ts.tv_sec != det_ctx->rule_perf_last_sync) {
1915  SCProfilingRuleThreatAggregate(det_ctx);
1916  det_ctx->rule_perf_last_sync = ts.tv_sec;
1917  }
1918 #endif
1919 
1920  return TM_ECODE_OK;
1921 error:
1922  return TM_ECODE_FAILED;
1923 }
1924 
1925 /** \brief disable file features we don't need
1926  * Called if we have no detection engine.
1927  */
1929 {
1930  DetectPostInspectFileFlagsUpdate(f, NULL /* no sgh */, STREAM_TOSERVER);
1931  DetectPostInspectFileFlagsUpdate(f, NULL /* no sgh */, STREAM_TOCLIENT);
1932 }
1933 
1934 #ifdef UNITTESTS
1935 /**
1936  * \brief wrapper for old tests
1937  */
1940 {
1941  if (p->flow) {
1942  DetectFlow(tv, de_ctx, det_ctx, p);
1943  } else {
1944  DetectNoFlow(tv, de_ctx, det_ctx, p);
1945  }
1946 }
1947 #endif
1948 
1949 /*
1950  * TESTS
1951  */
1952 
1953 #ifdef UNITTESTS
1954 #include "tests/detect.c"
1955 #endif
PKT_IS_TOCLIENT
#define PKT_IS_TOCLIENT(p)
Definition: decode.h:237
DetectEngineAppInspectionEngine_::stream
bool stream
Definition: detect.h:434
SigGroupHead_::non_pf_syn_store_cnt
uint32_t non_pf_syn_store_cnt
Definition: detect.h:1472
PacketCheckAction
bool PacketCheckAction(const Packet *p, const uint8_t a)
Definition: packet.c:48
FLOWFILE_NO_MD5_TS
#define FLOWFILE_NO_MD5_TS
Definition: flow.h:136
DetectEngineThreadCtx_::non_pf_store_ptr
SignatureNonPrefilterStore * non_pf_store_ptr
Definition: detect.h:1196
RulesDumpTxMatchArray
void RulesDumpTxMatchArray(const DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, const Packet *p, const uint64_t tx_id, const uint32_t rule_cnt, const uint32_t pkt_prefilter_cnt)
Definition: detect-engine-profile.c:34
SIG_GROUP_HEAD_HAVEFILEMD5
#define SIG_GROUP_HEAD_HAVEFILEMD5
Definition: detect.h:1334
FLOWFILE_NO_MD5_TC
#define FLOWFILE_NO_MD5_TC
Definition: flow.h:137
SigGroupHead_::tx_engines
PrefilterEngine * tx_engines
Definition: detect.h:1479
DetectEngineAppInspectionEngine_
Definition: detect.h:429
Packet_::proto
uint8_t proto
Definition: decode.h:497
DetectTransaction_::tx_data_ptr
struct AppLayerTxData * tx_data_ptr
Definition: detect-engine-prefilter.h:34
DetectEngineAppInspectionEngine_::mpm
bool mpm
Definition: detect.h:433
DE_STATE_CHUNK_SIZE
#define DE_STATE_CHUNK_SIZE
Definition: detect-engine-state.h:52
RuleMatchCandidateTx::stream_stored
bool stream_stored
Definition: detect.h:1081
FLOWFILE_NO_SIZE_TS
#define FLOWFILE_NO_SIZE_TS
Definition: flow.h:148
Frame::inspect_progress
uint64_t inspect_progress
Definition: app-layer-frames.h:53
DetectEngineThreadCtx_::alert_queue_size
uint16_t alert_queue_size
Definition: detect.h:1180
PROF_DETECT_GETSGH
@ PROF_DETECT_GETSGH
Definition: suricata-common.h:441
ts
uint64_t ts
Definition: source-erf-file.c:55
FLOWFILE_NO_SIZE_TC
#define FLOWFILE_NO_SIZE_TC
Definition: flow.h:149
detect-engine.h
PACKET_ALERT_FLAG_STREAM_MATCH
#define PACKET_ALERT_FLAG_STREAM_MATCH
Definition: decode.h:255
detect-engine-proto.h
DetectEngineThreadCtx_::match_array_cnt
SigIntId match_array_cnt
Definition: detect.h:1191
Frame::tx_id
uint64_t tx_id
Definition: app-layer-frames.h:52
DetectEngineStateDirection_::flags
uint8_t flags
Definition: detect-engine-state.h:88
detect-dsize.h
Signature_::addr_src_match6
DetectMatchAddressIPv6 * addr_src_match6
Definition: detect.h:634
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:127
PKT_HAS_FLOW
#define PKT_HAS_FLOW
Definition: decode.h:1266
PACKET_ALERT_FLAG_TX
#define PACKET_ALERT_FLAG_TX
Definition: decode.h:257
DetectEngineCtx_::decoder_event_sgh
struct SigGroupHead_ * decoder_event_sgh
Definition: detect.h:926
FlowGetPacketDirection
int FlowGetPacketDirection(const Flow *f, const Packet *p)
determine the direction of the packet compared to the flow
Definition: flow.c:287
DetectEngineCtx_::flow_gh
DetectEngineLookupFlow flow_gh[FLOW_STATES]
Definition: detect.h:871
DE_STATE_FLAG_SIG_CANT_MATCH
#define DE_STATE_FLAG_SIG_CANT_MATCH
Definition: detect-engine-state.h:56
DetectEngineThreadCtx_::counter_match_list
uint16_t counter_match_list
Definition: detect.h:1152
ALPROTO_DNS
@ ALPROTO_DNS
Definition: app-layer-protos.h:41
DetectEngineAppInspectionEngine_::next
struct DetectEngineAppInspectionEngine_ * next
Definition: detect.h:451
DETECT_PROTO_IPV6
#define DETECT_PROTO_IPV6
Definition: detect-engine-proto.h:32
detect-engine-siggroup.h
SigGroupHead_::flags
uint16_t flags
Definition: detect.h:1461
PKT_IS_PSEUDOPKT
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Definition: decode.h:1319
DetectEngineState_
Definition: detect-engine-state.h:92
Signature_::num
SigIntId num
Definition: detect.h:613
stream-tcp.h
PrefilterRuleStore_::rule_id_array_cnt
uint32_t rule_id_array_cnt
Definition: util-prefilter.h:40
detect-engine-event.h
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1460
SIG_GROUP_HEAD_HAVEFILESIZE
#define SIG_GROUP_HEAD_HAVEFILESIZE
Definition: detect.h:1335
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
detect.c
SC_ATOMIC_SET
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
Definition: util-atomic.h:386
KEYWORD_PROFILING_SET_LIST
#define KEYWORD_PROFILING_SET_LIST(ctx, list)
Definition: util-profiling.h:46
DetectAddressMatchIPv4
int DetectAddressMatchIPv4(const DetectMatchAddressIPv4 *addrs, uint16_t addrs_cnt, const Address *a)
Match a packets address against a signatures addrs array.
Definition: detect-engine-address.c:1589
DetectEngineAppInspectionEngine_::Callback
InspectEngineFuncPtr Callback
Definition: detect.h:444
Signature_::alproto
AppProto alproto
Definition: detect.h:606
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
SignatureNonPrefilterStore_::id
SigIntId id
Definition: detect.h:1070
FLOW_SGH_TOCLIENT
#define FLOW_SGH_TOCLIENT
Definition: flow.h:74
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:594
AppLayerParserSetTransactionInspectId
void AppLayerParserSetTransactionInspectId(const Flow *f, AppLayerParserState *pstate, void *alstate, const uint8_t flags, bool tag_txs_as_inspected)
Definition: app-layer-parser.c:730
DetectEngineStateDirection_::cnt
SigIntId cnt
Definition: detect-engine-state.h:86
AppLayerGetTxIterator
AppLayerGetTxIteratorFunc AppLayerGetTxIterator(const uint8_t ipproto, const AppProto alproto)
Definition: app-layer-parser.c:674
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
SigMatchData_::is_last
bool is_last
Definition: detect.h:360
Flow_::proto
uint8_t proto
Definition: flow.h:378
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:81
PacketAlerts_::cnt
uint16_t cnt
Definition: decode.h:267
AppLayerParserGetStateProgress
int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t flags)
get the progress value for a tx/protocol
Definition: app-layer-parser.c:1065
DetectEngineThreadCtx_::tx_id
uint64_t tx_id
Definition: detect.h:1174
DetectEngineCtx_::stream_tx_log_limit
uint8_t stream_tx_log_limit
Definition: detect.h:888
SigMatchData_::ctx
SigMatchCtx * ctx
Definition: detect.h:361
action-globals.h
FLOWFILE_NO_MAGIC_TS
#define FLOWFILE_NO_MAGIC_TS
Definition: flow.h:129
FramesContainer::toserver
Frames toserver
Definition: app-layer-frames.h:72
Packet_::flags
uint32_t flags
Definition: decode.h:512
ICMPV4_DEST_UNREACH_IS_VALID
#define ICMPV4_DEST_UNREACH_IS_VALID(p)
Definition: decode-icmpv4.h:253
Frame
Definition: app-layer-frames.h:43
Flow_
Flow data structure.
Definition: flow.h:356
DetectTransaction_::tx_end_state
const int tx_end_state
Definition: detect-engine-prefilter.h:41
PROF_DETECT_ALERT
@ PROF_DETECT_ALERT
Definition: suricata-common.h:452
DetectEngineThreadCtx_::pmq
PrefilterRuleStore pmq
Definition: detect.h:1200
SIG_GROUP_HEAD_HAVEFILESHA1
#define SIG_GROUP_HEAD_HAVEFILESHA1
Definition: detect.h:1336
FLOW_TC_APP_UPDATED
#define FLOW_TC_APP_UPDATED
Definition: flow.h:119
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:841
AppLayerParserGetStateProgressCompletionStatus
int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction)
Definition: app-layer-parser.c:1094
DetectRunScratchpad
struct DetectRunScratchpad DetectRunScratchpad
PROF_DETECT_PF_TX
@ PROF_DETECT_PF_TX
Definition: suricata-common.h:447
Frames::cnt
uint16_t cnt
Definition: app-layer-frames.h:59
Frame::id
int64_t id
Definition: app-layer-frames.h:51
APP_LAYER_TX_SKIP_INSPECT_FLAG
#define APP_LAYER_TX_SKIP_INSPECT_FLAG
Definition: app-layer-parser.h:78
DetectEngineThreadCtx_::p
Packet * p
Definition: detect.h:1178
DetectEngineAppInspectionEngine_::v2
struct DetectEngineAppInspectionEngine_::@79 v2
DetectEngineState_::dir_state
DetectEngineStateDirection dir_state[2]
Definition: detect-engine-state.h:93
FrameGetByIndex
Frame * FrameGetByIndex(Frames *frames, const uint32_t idx)
Definition: app-layer-frames.c:134
RuleMatchCandidateTx::id
SigIntId id
Definition: detect.h:1077
PROF_DETECT_CLEANUP
@ PROF_DETECT_CLEANUP
Definition: suricata-common.h:454
SIG_FLAG_DST_ANY
#define SIG_FLAG_DST_ANY
Definition: detect.h:239
NO_TX
#define NO_TX
Definition: detect.c:1279
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:232
HashTable_
Definition: util-hash.h:35
Frames
Definition: app-layer-frames.h:58
FramesContainer
Definition: app-layer-frames.h:71
PacketAlerts_::drop
PacketAlert drop
Definition: decode.h:273
APP_LAYER_TX_INSPECTED_FLAG
#define APP_LAYER_TX_INSPECTED_FLAG
Definition: app-layer-parser.h:80
DetectRunScratchpad
Definition: detect.c:69
SIG_GROUP_HEAD_HAVERAWSTREAM
#define SIG_GROUP_HEAD_HAVERAWSTREAM
Definition: detect.h:1330
FLOW_ACTION_DROP
#define FLOW_ACTION_DROP
Definition: flow.h:69
TcpStream_::flags
uint16_t flags
Definition: stream-tcp-private.h:107
FLOWFILE_NONE
#define FLOWFILE_NONE
Definition: flow.h:167
detect-engine-frame.h
SigMatchSignatures
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
Definition: detect.c:1938
Signature_::sm_arrays
SigMatchData * sm_arrays[DETECT_SM_LIST_MAX]
Definition: detect.h:654
proto
uint8_t proto
Definition: decode-template.h:0
DetectPort_::sh
struct SigGroupHead_ * sh
Definition: detect.h:228
PKT_NOPAYLOAD_INSPECTION
#define PKT_NOPAYLOAD_INSPECTION
Definition: decode.h:1255
PACKET_PROFILING_DETECT_END
#define PACKET_PROFILING_DETECT_END(p, id)
Definition: util-profiling.h:221
Detect
TmEcode Detect(ThreadVars *tv, Packet *p, void *data)
Detection engine thread wrapper.
Definition: detect.c:1859
FLOW_PKT_TOCLIENT_IPONLY_SET
#define FLOW_PKT_TOCLIENT_IPONLY_SET
Definition: flow.h:236
detect-engine-payload.h
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:506
SIG_FLAG_SRC_ANY
#define SIG_FLAG_SRC_ANY
Definition: detect.h:238
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:81
DetectRunFrameInspectRule
bool DetectRunFrameInspectRule(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, const Signature *s, Flow *f, Packet *p, const Frames *frames, const Frame *frame)
Definition: detect-engine-frame.c:227
Flow_::protoctx
void * protoctx
Definition: flow.h:446
SigMatchData_
Data needed for Match()
Definition: detect.h:358
DeStateStoreItem_::sid
SigIntId sid
Definition: detect-engine-state.h:74
RuleMatchCandidateTx::s
const Signature * s
Definition: detect.h:1087
KEYWORD_PROFILING_START
#define KEYWORD_PROFILING_START
Definition: util-profiling.h:50
DetectEngineThreadCtx_::counter_fnonmpm_list
uint16_t counter_fnonmpm_list
Definition: detect.h:1151
SigMatchData_::type
uint16_t type
Definition: detect.h:359
DetectEngineCtx_::version
uint32_t version
Definition: detect.h:922
DisableDetectFlowFileFlags
void DisableDetectFlowFileFlags(Flow *f)
disable file features we don't need Called if we have no detection engine.
Definition: detect.c:1928
AppLayerParserGetTransactionInspectId
uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction)
Definition: app-layer-parser.c:699
Packet_::alerts
PacketAlerts alerts
Definition: decode.h:588
DetectTransaction_::tx_progress
const int tx_progress
Definition: detect-engine-prefilter.h:40
DetectEngineThreadCtx_::counter_nonmpm_list
uint16_t counter_nonmpm_list
Definition: detect.h:1150
detect-engine-prefilter.h
DetectRunPrefilterFrame
void DetectRunPrefilterFrame(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const Frames *frames, const Frame *frame, const AppProto alproto)
Definition: detect-engine-frame.c:73
Packet_::events
PacketEngineEvents events
Definition: decode.h:598
Signature_::frame_inspect
DetectEngineFrameInspectionEngine * frame_inspect
Definition: detect.h:650
DetectTransaction_::prefilter_flags_orig
const uint64_t prefilter_flags_orig
Definition: detect-engine-prefilter.h:39
PROF_DETECT_PF_SORT2
@ PROF_DETECT_PF_SORT2
Definition: suricata-common.h:450
pad
uint16_t pad
Definition: source-erf-file.c:61
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:80
PacketCreateMask
void PacketCreateMask(Packet *p, SignatureMask *mask, AppProto alproto, bool app_decoder_events)
Definition: detect-engine-build.c:407
SIG_FLAG_APPLAYER
#define SIG_FLAG_APPLAYER
Definition: detect.h:246
KEYWORD_PROFILING_END
#define KEYWORD_PROFILING_END(ctx, type, m)
Definition: util-profiling.h:64
detect-flowvar.h
DetectEngineThreadCtx_::mt_det_ctxs_hash
HashTable * mt_det_ctxs_hash
Definition: detect.h:1110
PacketAlert_::action
uint8_t action
Definition: decode.h:243
TcpSession_::flags
uint32_t flags
Definition: stream-tcp-private.h:292
DetectEnginePktInspectionRun
bool DetectEnginePktInspectionRun(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, const Signature *s, Flow *f, Packet *p, uint8_t *alert_flags)
Definition: detect-engine.c:1957
Flow_::sgh_toserver
const struct SigGroupHead_ * sgh_toserver
Definition: flow.h:488
PROF_DETECT_TX_UPDATE
@ PROF_DETECT_TX_UPDATE
Definition: suricata-common.h:453
DetectEngineAppInspectionEngine_::id
uint8_t id
Definition: detect.h:432
DetectEngineThreadCtx_::counter_alerts_suppressed
uint16_t counter_alerts_suppressed
Definition: detect.h:1147
DetectRunStoreStateTx
void DetectRunStoreStateTx(const SigGroupHead *sgh, Flow *f, void *tx, uint64_t tx_id, const Signature *s, uint32_t inspect_flags, uint8_t flow_flags, const uint16_t file_no_match)
Definition: detect-engine-state.c:214
DetectEngineAppInspectionEngine_::sm_list
uint16_t sm_list
Definition: detect.h:435
FLOWFILE_INIT
#define FLOWFILE_INIT
Definition: flow.h:126
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:480
DETECT_ENGINE_INSPECT_SIG_CANT_MATCH_FILES
#define DETECT_ENGINE_INSPECT_SIG_CANT_MATCH_FILES
Definition: detect-engine-state.h:43
FLOWFILE_NO_SHA1_TC
#define FLOWFILE_NO_SHA1_TC
Definition: flow.h:141
DETECT_SM_LIST_POSTMATCH
@ DETECT_SM_LIST_POSTMATCH
Definition: detect.h:124
FramesContainer::toclient
Frames toclient
Definition: app-layer-frames.h:73
DetectEngineThreadCtx_::tx_candidates
RuleMatchCandidateTx * tx_candidates
Definition: detect.h:1193
Signature_::addr_src_match4
DetectMatchAddressIPv4 * addr_src_match4
Definition: detect.h:631
decode.h
DetectEngineThreadCtx_::counter_alerts_overflow
uint16_t counter_alerts_overflow
Definition: detect.h:1145
TOSERVER
#define TOSERVER
Definition: flow.h:45
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
PKT_IS_TOSERVER
#define PKT_IS_TOSERVER(p)
Definition: decode.h:236
Prefilter
void Prefilter(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const uint8_t flags, const SignatureMask mask)
Definition: detect-engine-prefilter.c:147
DetectEngineThreadCtx_
Definition: detect.h:1093
DEBUG_VALIDATE_PACKET
#define DEBUG_VALIDATE_PACKET(p)
Definition: util-validate.h:101
DeStateStoreItem_::flags
uint32_t flags
Definition: detect-engine-state.h:73
PKT_STREAM_ADD
#define PKT_STREAM_ADD
Definition: decode.h:1261
FLOWFILE_NO_STORE_TS
#define FLOWFILE_NO_STORE_TS
Definition: flow.h:133
BIT_U32
#define BIT_U32(n)
Definition: suricata-common.h:400
DetectEngineThreadCtx_::tx_candidates_size
uint32_t tx_candidates_size
Definition: detect.h:1194
FLOW_PKT_TOSERVER_IPONLY_SET
#define FLOW_PKT_TOSERVER_IPONLY_SET
Definition: flow.h:235
FRAME_FLAG_TX_ID_SET
#define FRAME_FLAG_TX_ID_SET
Definition: app-layer-frames.h:36
PKT_IS_FRAGMENT
#define PKT_IS_FRAGMENT
Definition: decode.h:1290
STREAM_FLAGS_FOR_PACKET
#define STREAM_FLAGS_FOR_PACKET(p)
Definition: stream.h:30
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
PMQ_RESET
#define PMQ_RESET(pmq)
Definition: util-prefilter.h:46
detect-engine-mpm.h
DetectEngineLookupFlow_::sgh
struct SigGroupHead_ * sgh[256]
Definition: detect.h:785
HashTableLookup
void * HashTableLookup(HashTable *ht, void *data, uint16_t datalen)
Definition: util-hash.c:183
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
DeStateStore_::next
struct DeStateStore_ * next
Definition: detect-engine-state.h:79
SignatureNonPrefilterStore_::alproto
AppProto alproto
Definition: detect.h:1072
Packet_::sp
Port sp
Definition: decode.h:482
FLOWFILE_NO_SHA256_TS
#define FLOWFILE_NO_SHA256_TS
Definition: flow.h:144
DETECT_ENGINE_INSPECT_SIG_MATCH
#define DETECT_ENGINE_INSPECT_SIG_MATCH
Definition: detect-engine-state.h:38
PKT_DETECT_HAS_STREAMDATA
#define PKT_DETECT_HAS_STREAMDATA
Definition: decode.h:1305
StreamReassembleRawHasDataReady
bool StreamReassembleRawHasDataReady(TcpSession *ssn, Packet *p)
does the stream engine have data to inspect?
Definition: stream-tcp-reassemble.c:1445
detect-engine-port.h
PktSrcToString
const char * PktSrcToString(enum PktSrcEnum pkt_src)
Definition: decode.c:824
DetectEngineThreadCtx_::non_pf_id_cnt
uint32_t non_pf_id_cnt
Definition: detect.h:1106
DetectPort_
Port structure for detection engine.
Definition: detect.h:217
PacketAlerts_::discarded
uint16_t discarded
Definition: decode.h:268
app-layer-parser.h
Signature_::app_inspect
DetectEngineAppInspectionEngine * app_inspect
Definition: detect.h:648
util-detect.h
detect-engine-profile.h
Flow_::sgh_toclient
const struct SigGroupHead_ * sgh_toclient
Definition: flow.h:485
DetectEngineThreadCtx_::base64_decoded_len
int base64_decoded_len
Definition: detect.h:1136
SIG_FLAG_REQUIRE_FLOWVAR
#define SIG_FLAG_REQUIRE_FLOWVAR
Definition: detect.h:263
RuleMatchCandidateTx::stream_result
uint8_t stream_result
Definition: detect.h:1082
util-profiling.h
DetectTransaction_::tx_id
const uint64_t tx_id
Definition: detect-engine-prefilter.h:33
DetectEngineLookupFlow_::udp
DetectPort * udp
Definition: detect.h:784
DetectEngineThreadCtx_::raw_stream_progress
uint64_t raw_stream_progress
Definition: detect.h:1119
FileUpdateFlowFileFlags
void FileUpdateFlowFileFlags(Flow *f, uint16_t set_file_flags, uint8_t direction)
set a flow's file flags
Definition: util-file.c:1121
SCReturn
#define SCReturn
Definition: util-debug.h:273
Signature_::flags
uint32_t flags
Definition: detect.h:602
AlertQueueAppend
void AlertQueueAppend(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, uint64_t tx_id, uint8_t alert_flags)
Append signature to local packet alert queue for later preprocessing.
Definition: detect-engine-alert.c:283
RuleMatchCandidateTxArrayFree
void RuleMatchCandidateTxArrayFree(DetectEngineThreadCtx *det_ctx)
Definition: detect.c:1000
AppLayerGetTxIterState
Definition: app-layer-parser.h:143
DetectTransaction_::prefilter_flags
uint64_t prefilter_flags
Definition: detect-engine-prefilter.h:37
Packet_
Definition: decode.h:475
detect-engine-build.h
AppLayerFramesGetContainer
FramesContainer * AppLayerFramesGetContainer(Flow *f)
Definition: app-layer-parser.c:173
DetectEngineThreadCtx_::frame_id
int64_t frame_id
Definition: detect.h:1175
APP_LAYER_TX_PREFILTER_MASK
#define APP_LAYER_TX_PREFILTER_MASK
Definition: app-layer-parser.h:83
detect-engine-alert.h
DetectRunScratchpad::pkt_mask
SignatureMask pkt_mask
Definition: detect.c:74
FlowSetIPOnlyFlag
void FlowSetIPOnlyFlag(Flow *f, int direction)
Set the IPOnly scanned flag for 'direction'.
Definition: flow.c:151
FLOW_TOSERVER_IPONLY_SET
#define FLOW_TOSERVER_IPONLY_SET
Definition: flow.h:59
DetectEngineThreadCtx_::filestore_cnt
uint16_t filestore_cnt
Definition: detect.h:1140
PROF_DETECT_IPONLY
@ PROF_DETECT_IPONLY
Definition: suricata-common.h:442
RULE_PROFILING_END
#define RULE_PROFILING_END(a, b, c, p)
Definition: util-profiling.h:422
TmEcode
TmEcode
Definition: tm-threads-common.h:79
RULE_PROFILING_START
#define RULE_PROFILING_START(p)
Definition: util-profiling.h:421
ALPROTO_DOH2
@ ALPROTO_DOH2
Definition: app-layer-protos.h:61
PKT_STREAM_EOF
#define PKT_STREAM_EOF
Definition: decode.h:1265
SCReturnPtr
#define SCReturnPtr(x, type)
Definition: util-debug.h:287
DetectTransaction_::de_state
DetectEngineStateDirection * de_state
Definition: detect-engine-prefilter.h:35
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
detect-filestore.h
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1272
detect-replace.h
RulesDumpMatchArray
void RulesDumpMatchArray(const DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, const Packet *p)
Definition: detect-engine-profile.c:79
ALPROTO_HTTP2
@ ALPROTO_HTTP2
Definition: app-layer-protos.h:64
Signature_::addr_dst_match6_cnt
uint16_t addr_dst_match6_cnt
Definition: detect.h:628
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:233
SigGroupHead_::frame_engines
PrefilterEngine * frame_engines
Definition: detect.h:1480
PACKET_ALERT_NOTX
#define PACKET_ALERT_NOTX
Definition: detect.h:53
Signature_::sp
DetectPort * sp
Definition: detect.h:642
APP_LAYER_PARSER_NO_INSPECTION
#define APP_LAYER_PARSER_NO_INSPECTION
Definition: app-layer-parser.h:35
AppLayerParserGetTx
void * AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
Definition: app-layer-parser.c:1087
DetectRunScratchpad::sgh
const SigGroupHead * sgh
Definition: detect.c:73
DETECT_ENGINE_INSPECT_SIG_CANT_MATCH
#define DETECT_ENGINE_INSPECT_SIG_CANT_MATCH
Definition: detect-engine-state.h:39
DETECT_ENGINE_STATE_FLAG_FILE_NEW
#define DETECT_ENGINE_STATE_FLAG_FILE_NEW
Definition: detect-engine-state.h:70
Flow_::flowvar
GenericVar * flowvar
Definition: flow.h:491
RuleMatchCandidateTx::flags
uint32_t * flags
Definition: detect.h:1078
Frame::flags
uint8_t flags
Definition: app-layer-frames.h:45
DetectEngineAppInspectionEngine_::alproto
AppProto alproto
Definition: detect.h:430
SCRealloc
#define SCRealloc(ptr, sz)
Definition: util-mem.h:50
detect-engine-analyzer.h
FLOWFILE_NO_SHA256_TC
#define FLOWFILE_NO_SHA256_TC
Definition: flow.h:145
DetectEngineStateDirection_::head
DeStateStore * head
Definition: detect-engine-state.h:83
DETECT_ENGINE_INSPECT_SIG_MATCH_MORE_FILES
#define DETECT_ENGINE_INSPECT_SIG_MATCH_MORE_FILES
Definition: detect-engine-state.h:49
DetectProto_::flags
uint8_t flags
Definition: detect-engine-proto.h:37
AppLayerTxData
struct AppLayerTxData AppLayerTxData
Definition: detect.h:1367
DETECT_PROTO_IPV4
#define DETECT_PROTO_IPV4
Definition: detect-engine-proto.h:31
app-layer-frames.h
DetectAddressMatchIPv6
int DetectAddressMatchIPv6(const DetectMatchAddressIPv6 *addrs, uint16_t addrs_cnt, const Address *a)
Match a packets address against a signatures addrs array.
Definition: detect-engine-address.c:1622
Packet_::tenant_id
uint32_t tenant_id
Definition: decode.h:633
Packet_::flow
struct Flow_ * flow
Definition: decode.h:514
DetectEngineStateResetTxs
void DetectEngineStateResetTxs(Flow *f)
Reset de state for active tx' To be used on detect engine reload.
Definition: detect-engine-state.c:260
FLOWFILE_NO_MAGIC_TC
#define FLOWFILE_NO_MAGIC_TC
Definition: flow.h:130
TH_SYN
#define TH_SYN
Definition: decode-tcp.h:35
flags
uint8_t flags
Definition: decode-gre.h:0
Signature_::proto
DetectProto proto
Definition: detect.h:620
SigGroupHead_::non_pf_other_store_array
SignatureNonPrefilterStore * non_pf_other_store_array
Definition: detect.h:1473
FLOW_TOCLIENT_IPONLY_SET
#define FLOW_TOCLIENT_IPONLY_SET
Definition: flow.h:61
suricata-common.h
SIG_FLAG_SP_ANY
#define SIG_FLAG_SP_ANY
Definition: detect.h:240
APP_LAYER_TX_RESERVED_FLAGS
#define APP_LAYER_TX_RESERVED_FLAGS
Definition: app-layer-parser.h:68
SigGroupHead_::non_pf_other_store_cnt
uint32_t non_pf_other_store_cnt
Definition: detect.h:1471
packet.h
DeStateStore_
Definition: detect-engine-state.h:77
ACTION_DROP
#define ACTION_DROP
Definition: action-globals.h:30
DetectTransaction_
Definition: detect-engine-prefilter.h:31
Packet_::app_update_direction
uint8_t app_update_direction
Definition: decode.h:509
PROF_DETECT_SETUP
@ PROF_DETECT_SETUP
Definition: suricata-common.h:440
DetectEngineStateDirection_
Definition: detect-engine-state.h:82
DetectEngineThreadCtx_::frame_inspect_progress
uint64_t frame_inspect_progress
Definition: detect.h:1176
DetectEngineCtx_::profile_match_logging_threshold
uint32_t profile_match_logging_threshold
Definition: detect.h:958
FLOW_TS_APP_UPDATED
#define FLOW_TS_APP_UPDATED
Definition: flow.h:118
AppLayerParserGetTxData
AppLayerTxData * AppLayerParserGetTxData(uint8_t ipproto, AppProto alproto, void *tx)
Definition: app-layer-parser.c:1157
FatalError
#define FatalError(...)
Definition: util-debug.h:502
TcpSession_::client
TcpStream client
Definition: stream-tcp-private.h:295
FLOWFILE_NO_STORE_TC
#define FLOWFILE_NO_STORE_TC
Definition: flow.h:134
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
DetectEngineThreadCtx_::non_pf_id_array
SigIntId * non_pf_id_array
Definition: detect.h:1105
DetectEngineAppInspectionEngine_::progress
int16_t progress
Definition: detect.h:437
util-validate.h
DetectTransaction_::tx_ptr
void * tx_ptr
Definition: detect-engine-prefilter.h:32
Signature_::addr_src_match6_cnt
uint16_t addr_src_match6_cnt
Definition: detect.h:629
StreamReassembleRawUpdateProgress
void StreamReassembleRawUpdateProgress(TcpSession *ssn, Packet *p, const uint64_t progress)
update stream engine after detection
Definition: stream-tcp-reassemble.c:1491
StatsAddUI64
void StatsAddUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Adds a value of type uint64_t to the local counter.
Definition: counters.c:146
FLOWFILE_NO_SHA1_TS
#define FLOWFILE_NO_SHA1_TS
Definition: flow.h:140
PROF_DETECT_RULES
@ PROF_DETECT_RULES
Definition: suricata-common.h:443
DetectRunScratchpad::app_decoder_events
const bool app_decoder_events
Definition: detect.c:72
TcpSession_::server
TcpStream server
Definition: stream-tcp-private.h:294
PROF_DETECT_NONMPMLIST
@ PROF_DETECT_NONMPMLIST
Definition: suricata-common.h:451
Signature_::dp
DetectPort * dp
Definition: detect.h:642
PacketAlerts_::suppressed
uint16_t suppressed
Definition: decode.h:269
PACKET_PROFILING_DETECT_START
#define PACKET_PROFILING_DETECT_START(p, id)
Definition: util-profiling.h:214
PACKET_ALERT_FLAG_FRAME
#define PACKET_ALERT_FLAG_FRAME
Definition: decode.h:261
DetectEngineThreadCtx_::non_pf_store_cnt
uint32_t non_pf_store_cnt
Definition: detect.h:1197
FLOW_SGH_TOSERVER
#define FLOW_SGH_TOSERVER
Definition: flow.h:72
DetectEngineThreadCtx_::counter_alerts
uint16_t counter_alerts
Definition: detect.h:1143
SCFree
#define SCFree(p)
Definition: util-mem.h:61
Packet_::pkt_src
uint8_t pkt_src
Definition: decode.h:579
SGH_PROFILING_RECORD
#define SGH_PROFILING_RECORD(det_ctx, sgh)
Definition: util-profiling.h:252
PacketAlertFinalize
void PacketAlertFinalize(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
Check the threshold of the sigs that match, set actions, break on pass action This function iterate t...
Definition: detect-engine-alert.c:371
Signature_::addr_dst_match6
DetectMatchAddressIPv6 * addr_dst_match6
Definition: detect.h:633
Flow_::alstate
void * alstate
Definition: flow.h:481
Signature_::id
uint32_t id
Definition: detect.h:636
DeStateStore_::store
DeStateStoreItem store[DE_STATE_CHUNK_SIZE]
Definition: detect-engine-state.h:78
Flow_::flags
uint32_t flags
Definition: flow.h:426
RuleMatchCandidateTx::stream_reset
uint32_t stream_reset
Definition: detect.h:1084
detect-engine-iponly.h
Signature_
Signature container.
Definition: detect.h:601
InspectionBufferClean
void InspectionBufferClean(DetectEngineThreadCtx *det_ctx)
Definition: detect-engine.c:1472
SignatureMask
#define SignatureMask
Definition: detect.h:311
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
TRACE_SID_TXS
#define TRACE_SID_TXS(sid, txs,...)
Definition: detect.c:1063
FLOW_PKT_ESTABLISHED
#define FLOW_PKT_ESTABLISHED
Definition: flow.h:234
DetectEngineThreadCtx_::tx_id_set
bool tx_id_set
Definition: detect.h:1172
STREAMTCP_FLAG_APP_LAYER_DISABLED
#define STREAMTCP_FLAG_APP_LAYER_DISABLED
Definition: stream-tcp-private.h:201
DetectRunScratchpad::flow_flags
const uint8_t flow_flags
Definition: detect.c:71
DetectEngineThreadCtx_::de_ctx
DetectEngineCtx * de_ctx
Definition: detect.h:1215
suricata.h
IPOnlyMatchPacket
void IPOnlyMatchPacket(ThreadVars *tv, const DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const DetectEngineIPOnlyCtx *io_ctx, Packet *p)
Match a packet against the IP Only detection engine contexts.
Definition: detect-engine-iponly.c:1005
DetectEngineCtx_::sig_array
Signature ** sig_array
Definition: detect.h:858
Packet_::dst
Address dst
Definition: decode.h:480
SigGroupHead_::non_pf_syn_store_array
SignatureNonPrefilterStore * non_pf_syn_store_array
Definition: detect.h:1475
PROF_DETECT_TX
@ PROF_DETECT_TX
Definition: suricata-common.h:444
DetectEngineAppInspectionEngine_::dir
uint8_t dir
Definition: detect.h:431
PKT_NOPACKET_INSPECTION
#define PKT_NOPACKET_INSPECTION
Definition: decode.h:1250
SignatureNonPrefilterStore_::mask
SignatureMask mask
Definition: detect.h:1071
DetectGetInnerTx
void * DetectGetInnerTx(void *tx_ptr, AppProto alproto, AppProto engine_alproto, uint8_t flow_flags)
Definition: detect.c:1067
DetectRunScratchpad::alproto
const AppProto alproto
Definition: detect.c:70
DE_STATE_FLAG_FULL_INSPECT
#define DE_STATE_FLAG_FULL_INSPECT
Definition: detect-engine-state.h:55
STREAMTCP_STREAM_FLAG_DISABLE_RAW
#define STREAMTCP_STREAM_FLAG_DISABLE_RAW
Definition: stream-tcp-private.h:238
DetectEngineThreadCtx_::mt_det_ctxs_cnt
uint32_t mt_det_ctxs_cnt
Definition: detect.h:1108
AppLayerGetTxIteratorFunc
AppLayerGetTxIterTuple(* AppLayerGetTxIteratorFunc)(const uint8_t ipproto, const AppProto alproto, void *alstate, uint64_t min_tx_id, uint64_t max_tx_id, AppLayerGetTxIterState *state)
tx iterator prototype
Definition: app-layer-parser.h:152
likely
#define likely(expr)
Definition: util-optimize.h:32
IPPROTO_SCTP
#define IPPROTO_SCTP
Definition: decode.h:1192
DE_STATE_FLAG_FILE_INSPECT
#define DE_STATE_FLAG_FILE_INSPECT
Definition: detect-engine-state.h:60
FLOW_NOPACKET_INSPECTION
#define FLOW_NOPACKET_INSPECTION
Definition: flow.h:64
DetectEngineCtx_::io_ctx
DetectEngineIPOnlyCtx io_ctx
Definition: detect.h:882
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:375
Signature_::addr_dst_match4
DetectMatchAddressIPv4 * addr_dst_match4
Definition: detect.h:630
FlowGetDisruptionFlags
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
Definition: flow.c:1137
TcpSession_
Definition: stream-tcp-private.h:283
flow.h
Signature_::addr_src_match4_cnt
uint16_t addr_src_match4_cnt
Definition: detect.h:627
SigIntId
#define SigIntId
Definition: suricata-common.h:315
AppLayerParserStateIssetFlag
uint16_t AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint16_t flag)
Definition: app-layer-parser.c:1760
DeStateStoreItem_
Definition: detect-engine-state.h:72
GenericVarFree
void GenericVarFree(GenericVar *gv)
Definition: util-var.c:48
Signature_::addr_dst_match4_cnt
uint16_t addr_dst_match4_cnt
Definition: detect.h:626
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:455
Packet_::dp
Port dp
Definition: decode.h:490
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
SIG_GROUP_HEAD_HAVEFILESHA256
#define SIG_GROUP_HEAD_HAVEFILESHA256
Definition: detect.h:1337
SigGroupHead_::filestore_cnt
uint16_t filestore_cnt
Definition: detect.h:1466
AppLayerParserGetTxCnt
uint64_t AppLayerParserGetTxCnt(const Flow *f, void *alstate)
Definition: app-layer-parser.c:1080
PACKET_ALERT_FLAG_STATE_MATCH
#define PACKET_ALERT_FLAG_STATE_MATCH
Definition: decode.h:253
AppLayerParserHasDecoderEvents
bool AppLayerParserHasDecoderEvents(AppLayerParserState *pstate)
Definition: app-layer-parser.c:1487
DetectEngineLookupFlow_::tcp
DetectPort * tcp
Definition: detect.h:783
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
DetectTransaction_::detect_flags
const uint64_t detect_flags
Definition: detect-engine-prefilter.h:36
detect-engine-address.h
Flow_::tenant_id
uint32_t tenant_id
Definition: flow.h:421
Packet_::src
Address src
Definition: decode.h:479
DetectEngineThreadCtx_::counter_mpm_list
uint16_t counter_mpm_list
Definition: detect.h:1149
SigMatchSignaturesGetSgh
const SigGroupHead * SigMatchSignaturesGetSgh(const DetectEngineCtx *de_ctx, const Packet *p)
Get the SigGroupHead for a packet.
Definition: detect.c:220
DetectRunPrefilterTx
void DetectRunPrefilterTx(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const uint8_t ipproto, const uint8_t flow_flags, const AppProto alproto, void *alstate, DetectTransaction *tx)
run prefilter engines on a transaction
Definition: detect-engine-prefilter.c:93
RuleMatchCandidateTxArrayInit
void RuleMatchCandidateTxArrayInit(DetectEngineThreadCtx *det_ctx, uint32_t size)
Definition: detect.c:987
SIG_FLAG_DP_ANY
#define SIG_FLAG_DP_ANY
Definition: detect.h:241
DetectPortLookupGroup
DetectPort * DetectPortLookupGroup(DetectPort *dp, uint16_t port)
Function that find the group matching port in a group head.
Definition: detect-engine-port.c:613
PKT_STREAM_EST
#define PKT_STREAM_EST
Definition: decode.h:1263
detect-engine-threshold.h
Signature_::mask
SignatureMask mask
Definition: detect.h:612
app-layer.h
RuleMatchCandidateTx
Definition: detect.h:1076
DetectEngineThreadCtx_::TenantGetId
uint32_t(* TenantGetId)(const void *, const Packet *p)
Definition: detect.h:1115
PrefilterRuleStore_::rule_id_array
SigIntId * rule_id_array
Definition: util-prefilter.h:38
PacketEngineEvents_::cnt
uint8_t cnt
Definition: decode.h:286
Flow_::de_ctx_version
uint32_t de_ctx_version
Definition: flow.h:469
DetectProtoContainsProto
int DetectProtoContainsProto(const DetectProto *dp, int proto)
see if a DetectProto contains a certain proto
Definition: detect-engine-proto.c:135
DetectEngineThreadCtx_::match_array
Signature ** match_array
Definition: detect.h:1186